linux/drivers/block/loop.c
<<
>>
Prefs
   1/*
   2 *  linux/drivers/block/loop.c
   3 *
   4 *  Written by Theodore Ts'o, 3/29/93
   5 *
   6 * Copyright 1993 by Theodore Ts'o.  Redistribution of this file is
   7 * permitted under the GNU General Public License.
   8 *
   9 * DES encryption plus some minor changes by Werner Almesberger, 30-MAY-1993
  10 * more DES encryption plus IDEA encryption by Nicholas J. Leon, June 20, 1996
  11 *
  12 * Modularized and updated for 1.1.16 kernel - Mitch Dsouza 28th May 1994
  13 * Adapted for 1.3.59 kernel - Andries Brouwer, 1 Feb 1996
  14 *
  15 * Fixed do_loop_request() re-entrancy - Vincent.Renardias@waw.com Mar 20, 1997
  16 *
  17 * Added devfs support - Richard Gooch <rgooch@atnf.csiro.au> 16-Jan-1998
  18 *
  19 * Handle sparse backing files correctly - Kenn Humborg, Jun 28, 1998
  20 *
  21 * Loadable modules and other fixes by AK, 1998
  22 *
  23 * Make real block number available to downstream transfer functions, enables
  24 * CBC (and relatives) mode encryption requiring unique IVs per data block.
  25 * Reed H. Petty, rhp@draper.net
  26 *
  27 * Maximum number of loop devices now dynamic via max_loop module parameter.
  28 * Russell Kroll <rkroll@exploits.org> 19990701
  29 *
  30 * Maximum number of loop devices when compiled-in now selectable by passing
  31 * max_loop=<1-255> to the kernel on boot.
  32 * Erik I. Bolsø, <eriki@himolde.no>, Oct 31, 1999
  33 *
  34 * Completely rewrite request handling to be make_request_fn style and
  35 * non blocking, pushing work to a helper thread. Lots of fixes from
  36 * Al Viro too.
  37 * Jens Axboe <axboe@suse.de>, Nov 2000
  38 *
  39 * Support up to 256 loop devices
  40 * Heinz Mauelshagen <mge@sistina.com>, Feb 2002
  41 *
  42 * Support for falling back on the write file operation when the address space
  43 * operations write_begin is not available on the backing filesystem.
  44 * Anton Altaparmakov, 16 Feb 2005
  45 *
  46 * Still To Fix:
  47 * - Advisory locking is ignored here.
  48 * - Should use an own CAP_* category instead of CAP_SYS_ADMIN
  49 *
  50 */
  51
  52#include <linux/module.h>
  53#include <linux/moduleparam.h>
  54#include <linux/sched.h>
  55#include <linux/fs.h>
  56#include <linux/file.h>
  57#include <linux/stat.h>
  58#include <linux/errno.h>
  59#include <linux/major.h>
  60#include <linux/wait.h>
  61#include <linux/blkdev.h>
  62#include <linux/blkpg.h>
  63#include <linux/init.h>
  64#include <linux/swap.h>
  65#include <linux/slab.h>
  66#include <linux/loop.h>
  67#include <linux/compat.h>
  68#include <linux/suspend.h>
  69#include <linux/freezer.h>
  70#include <linux/mutex.h>
  71#include <linux/writeback.h>
  72#include <linux/completion.h>
  73#include <linux/highmem.h>
  74#include <linux/kthread.h>
  75#include <linux/splice.h>
  76#include <linux/sysfs.h>
  77#include <linux/miscdevice.h>
  78#include <linux/falloc.h>
  79
  80#include <asm/uaccess.h>
  81
  82static DEFINE_IDR(loop_index_idr);
  83static DEFINE_MUTEX(loop_index_mutex);
  84
  85static int max_part;
  86static int part_shift;
  87
  88/*
  89 * Transfer functions
  90 */
  91static int transfer_none(struct loop_device *lo, int cmd,
  92                         struct page *raw_page, unsigned raw_off,
  93                         struct page *loop_page, unsigned loop_off,
  94                         int size, sector_t real_block)
  95{
  96        char *raw_buf = kmap_atomic(raw_page, KM_USER0) + raw_off;
  97        char *loop_buf = kmap_atomic(loop_page, KM_USER1) + loop_off;
  98
  99        if (cmd == READ)
 100                memcpy(loop_buf, raw_buf, size);
 101        else
 102                memcpy(raw_buf, loop_buf, size);
 103
 104        kunmap_atomic(loop_buf, KM_USER1);
 105        kunmap_atomic(raw_buf, KM_USER0);
 106        cond_resched();
 107        return 0;
 108}
 109
 110static int transfer_xor(struct loop_device *lo, int cmd,
 111                        struct page *raw_page, unsigned raw_off,
 112                        struct page *loop_page, unsigned loop_off,
 113                        int size, sector_t real_block)
 114{
 115        char *raw_buf = kmap_atomic(raw_page, KM_USER0) + raw_off;
 116        char *loop_buf = kmap_atomic(loop_page, KM_USER1) + loop_off;
 117        char *in, *out, *key;
 118        int i, keysize;
 119
 120        if (cmd == READ) {
 121                in = raw_buf;
 122                out = loop_buf;
 123        } else {
 124                in = loop_buf;
 125                out = raw_buf;
 126        }
 127
 128        key = lo->lo_encrypt_key;
 129        keysize = lo->lo_encrypt_key_size;
 130        for (i = 0; i < size; i++)
 131                *out++ = *in++ ^ key[(i & 511) % keysize];
 132
 133        kunmap_atomic(loop_buf, KM_USER1);
 134        kunmap_atomic(raw_buf, KM_USER0);
 135        cond_resched();
 136        return 0;
 137}
 138
 139static int xor_init(struct loop_device *lo, const struct loop_info64 *info)
 140{
 141        if (unlikely(info->lo_encrypt_key_size <= 0))
 142                return -EINVAL;
 143        return 0;
 144}
 145
 146static struct loop_func_table none_funcs = {
 147        .number = LO_CRYPT_NONE,
 148        .transfer = transfer_none,
 149};      
 150
 151static struct loop_func_table xor_funcs = {
 152        .number = LO_CRYPT_XOR,
 153        .transfer = transfer_xor,
 154        .init = xor_init
 155};      
 156
 157/* xfer_funcs[0] is special - its release function is never called */
 158static struct loop_func_table *xfer_funcs[MAX_LO_CRYPT] = {
 159        &none_funcs,
 160        &xor_funcs
 161};
 162
 163static loff_t get_size(loff_t offset, loff_t sizelimit, struct file *file)
 164{
 165        loff_t size, loopsize;
 166
 167        /* Compute loopsize in bytes */
 168        size = i_size_read(file->f_mapping->host);
 169        loopsize = size - offset;
 170        /* offset is beyond i_size, wierd but possible */
 171        if (loopsize < 0)
 172                return 0;
 173
 174        if (sizelimit > 0 && sizelimit < loopsize)
 175                loopsize = sizelimit;
 176        /*
 177         * Unfortunately, if we want to do I/O on the device,
 178         * the number of 512-byte sectors has to fit into a sector_t.
 179         */
 180        return loopsize >> 9;
 181}
 182
 183static loff_t get_loop_size(struct loop_device *lo, struct file *file)
 184{
 185        return get_size(lo->lo_offset, lo->lo_sizelimit, file);
 186}
 187
 188static int
 189figure_loop_size(struct loop_device *lo, loff_t offset, loff_t sizelimit)
 190{
 191        loff_t size = get_size(offset, sizelimit, lo->lo_backing_file);
 192        sector_t x = (sector_t)size;
 193
 194        if (unlikely((loff_t)x != size))
 195                return -EFBIG;
 196        if (lo->lo_offset != offset)
 197                lo->lo_offset = offset;
 198        if (lo->lo_sizelimit != sizelimit)
 199                lo->lo_sizelimit = sizelimit;
 200        set_capacity(lo->lo_disk, x);
 201        return 0;
 202}
 203
 204static inline int
 205lo_do_transfer(struct loop_device *lo, int cmd,
 206               struct page *rpage, unsigned roffs,
 207               struct page *lpage, unsigned loffs,
 208               int size, sector_t rblock)
 209{
 210        if (unlikely(!lo->transfer))
 211                return 0;
 212
 213        return lo->transfer(lo, cmd, rpage, roffs, lpage, loffs, size, rblock);
 214}
 215
 216/**
 217 * __do_lo_send_write - helper for writing data to a loop device
 218 *
 219 * This helper just factors out common code between do_lo_send_direct_write()
 220 * and do_lo_send_write().
 221 */
 222static int __do_lo_send_write(struct file *file,
 223                u8 *buf, const int len, loff_t pos)
 224{
 225        ssize_t bw;
 226        mm_segment_t old_fs = get_fs();
 227
 228        set_fs(get_ds());
 229        bw = file->f_op->write(file, buf, len, &pos);
 230        set_fs(old_fs);
 231        if (likely(bw == len))
 232                return 0;
 233        printk(KERN_ERR "loop: Write error at byte offset %llu, length %i.\n",
 234                        (unsigned long long)pos, len);
 235        if (bw >= 0)
 236                bw = -EIO;
 237        return bw;
 238}
 239
 240/**
 241 * do_lo_send_direct_write - helper for writing data to a loop device
 242 *
 243 * This is the fast, non-transforming version that does not need double
 244 * buffering.
 245 */
 246static int do_lo_send_direct_write(struct loop_device *lo,
 247                struct bio_vec *bvec, loff_t pos, struct page *page)
 248{
 249        ssize_t bw = __do_lo_send_write(lo->lo_backing_file,
 250                        kmap(bvec->bv_page) + bvec->bv_offset,
 251                        bvec->bv_len, pos);
 252        kunmap(bvec->bv_page);
 253        cond_resched();
 254        return bw;
 255}
 256
 257/**
 258 * do_lo_send_write - helper for writing data to a loop device
 259 *
 260 * This is the slow, transforming version that needs to double buffer the
 261 * data as it cannot do the transformations in place without having direct
 262 * access to the destination pages of the backing file.
 263 */
 264static int do_lo_send_write(struct loop_device *lo, struct bio_vec *bvec,
 265                loff_t pos, struct page *page)
 266{
 267        int ret = lo_do_transfer(lo, WRITE, page, 0, bvec->bv_page,
 268                        bvec->bv_offset, bvec->bv_len, pos >> 9);
 269        if (likely(!ret))
 270                return __do_lo_send_write(lo->lo_backing_file,
 271                                page_address(page), bvec->bv_len,
 272                                pos);
 273        printk(KERN_ERR "loop: Transfer error at byte offset %llu, "
 274                        "length %i.\n", (unsigned long long)pos, bvec->bv_len);
 275        if (ret > 0)
 276                ret = -EIO;
 277        return ret;
 278}
 279
 280static int lo_send(struct loop_device *lo, struct bio *bio, loff_t pos)
 281{
 282        int (*do_lo_send)(struct loop_device *, struct bio_vec *, loff_t,
 283                        struct page *page);
 284        struct bio_vec *bvec;
 285        struct page *page = NULL;
 286        int i, ret = 0;
 287
 288        if (lo->transfer != transfer_none) {
 289                page = alloc_page(GFP_NOIO | __GFP_HIGHMEM);
 290                if (unlikely(!page))
 291                        goto fail;
 292                kmap(page);
 293                do_lo_send = do_lo_send_write;
 294        } else {
 295                do_lo_send = do_lo_send_direct_write;
 296        }
 297
 298        bio_for_each_segment(bvec, bio, i) {
 299                ret = do_lo_send(lo, bvec, pos, page);
 300                if (ret < 0)
 301                        break;
 302                pos += bvec->bv_len;
 303        }
 304        if (page) {
 305                kunmap(page);
 306                __free_page(page);
 307        }
 308out:
 309        return ret;
 310fail:
 311        printk(KERN_ERR "loop: Failed to allocate temporary page for write.\n");
 312        ret = -ENOMEM;
 313        goto out;
 314}
 315
 316struct lo_read_data {
 317        struct loop_device *lo;
 318        struct page *page;
 319        unsigned offset;
 320        int bsize;
 321};
 322
 323static int
 324lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 325                struct splice_desc *sd)
 326{
 327        struct lo_read_data *p = sd->u.data;
 328        struct loop_device *lo = p->lo;
 329        struct page *page = buf->page;
 330        sector_t IV;
 331        int size;
 332
 333        IV = ((sector_t) page->index << (PAGE_CACHE_SHIFT - 9)) +
 334                                                        (buf->offset >> 9);
 335        size = sd->len;
 336        if (size > p->bsize)
 337                size = p->bsize;
 338
 339        if (lo_do_transfer(lo, READ, page, buf->offset, p->page, p->offset, size, IV)) {
 340                printk(KERN_ERR "loop: transfer error block %ld\n",
 341                       page->index);
 342                size = -EINVAL;
 343        }
 344
 345        flush_dcache_page(p->page);
 346
 347        if (size > 0)
 348                p->offset += size;
 349
 350        return size;
 351}
 352
 353static int
 354lo_direct_splice_actor(struct pipe_inode_info *pipe, struct splice_desc *sd)
 355{
 356        return __splice_from_pipe(pipe, sd, lo_splice_actor);
 357}
 358
 359static ssize_t
 360do_lo_receive(struct loop_device *lo,
 361              struct bio_vec *bvec, int bsize, loff_t pos)
 362{
 363        struct lo_read_data cookie;
 364        struct splice_desc sd;
 365        struct file *file;
 366        ssize_t retval;
 367
 368        cookie.lo = lo;
 369        cookie.page = bvec->bv_page;
 370        cookie.offset = bvec->bv_offset;
 371        cookie.bsize = bsize;
 372
 373        sd.len = 0;
 374        sd.total_len = bvec->bv_len;
 375        sd.flags = 0;
 376        sd.pos = pos;
 377        sd.u.data = &cookie;
 378
 379        file = lo->lo_backing_file;
 380        retval = splice_direct_to_actor(file, &sd, lo_direct_splice_actor);
 381
 382        return retval;
 383}
 384
 385static int
 386lo_receive(struct loop_device *lo, struct bio *bio, int bsize, loff_t pos)
 387{
 388        struct bio_vec *bvec;
 389        ssize_t s;
 390        int i;
 391
 392        bio_for_each_segment(bvec, bio, i) {
 393                s = do_lo_receive(lo, bvec, bsize, pos);
 394                if (s < 0)
 395                        return s;
 396
 397                if (s != bvec->bv_len) {
 398                        zero_fill_bio(bio);
 399                        break;
 400                }
 401                pos += bvec->bv_len;
 402        }
 403        return 0;
 404}
 405
 406static int do_bio_filebacked(struct loop_device *lo, struct bio *bio)
 407{
 408        loff_t pos;
 409        int ret;
 410
 411        pos = ((loff_t) bio->bi_sector << 9) + lo->lo_offset;
 412
 413        if (bio_rw(bio) == WRITE) {
 414                struct file *file = lo->lo_backing_file;
 415
 416                if (bio->bi_rw & REQ_FLUSH) {
 417                        ret = vfs_fsync(file, 0);
 418                        if (unlikely(ret && ret != -EINVAL)) {
 419                                ret = -EIO;
 420                                goto out;
 421                        }
 422                }
 423
 424                /*
 425                 * We use punch hole to reclaim the free space used by the
 426                 * image a.k.a. discard. However we do not support discard if
 427                 * encryption is enabled, because it may give an attacker
 428                 * useful information.
 429                 */
 430                if (bio->bi_rw & REQ_DISCARD) {
 431                        struct file *file = lo->lo_backing_file;
 432                        int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE;
 433
 434                        if ((!file->f_op->fallocate) ||
 435                            lo->lo_encrypt_key_size) {
 436                                ret = -EOPNOTSUPP;
 437                                goto out;
 438                        }
 439                        ret = file->f_op->fallocate(file, mode, pos,
 440                                                    bio->bi_size);
 441                        if (unlikely(ret && ret != -EINVAL &&
 442                                     ret != -EOPNOTSUPP))
 443                                ret = -EIO;
 444                        goto out;
 445                }
 446
 447                ret = lo_send(lo, bio, pos);
 448
 449                if ((bio->bi_rw & REQ_FUA) && !ret) {
 450                        ret = vfs_fsync(file, 0);
 451                        if (unlikely(ret && ret != -EINVAL))
 452                                ret = -EIO;
 453                }
 454        } else
 455                ret = lo_receive(lo, bio, lo->lo_blocksize, pos);
 456
 457out:
 458        return ret;
 459}
 460
 461/*
 462 * Add bio to back of pending list
 463 */
 464static void loop_add_bio(struct loop_device *lo, struct bio *bio)
 465{
 466        bio_list_add(&lo->lo_bio_list, bio);
 467}
 468
 469/*
 470 * Grab first pending buffer
 471 */
 472static struct bio *loop_get_bio(struct loop_device *lo)
 473{
 474        return bio_list_pop(&lo->lo_bio_list);
 475}
 476
 477static void loop_make_request(struct request_queue *q, struct bio *old_bio)
 478{
 479        struct loop_device *lo = q->queuedata;
 480        int rw = bio_rw(old_bio);
 481
 482        if (rw == READA)
 483                rw = READ;
 484
 485        BUG_ON(!lo || (rw != READ && rw != WRITE));
 486
 487        spin_lock_irq(&lo->lo_lock);
 488        if (lo->lo_state != Lo_bound)
 489                goto out;
 490        if (unlikely(rw == WRITE && (lo->lo_flags & LO_FLAGS_READ_ONLY)))
 491                goto out;
 492        loop_add_bio(lo, old_bio);
 493        wake_up(&lo->lo_event);
 494        spin_unlock_irq(&lo->lo_lock);
 495        return;
 496
 497out:
 498        spin_unlock_irq(&lo->lo_lock);
 499        bio_io_error(old_bio);
 500}
 501
 502struct switch_request {
 503        struct file *file;
 504        struct completion wait;
 505};
 506
 507static void do_loop_switch(struct loop_device *, struct switch_request *);
 508
 509static inline void loop_handle_bio(struct loop_device *lo, struct bio *bio)
 510{
 511        if (unlikely(!bio->bi_bdev)) {
 512                do_loop_switch(lo, bio->bi_private);
 513                bio_put(bio);
 514        } else {
 515                int ret = do_bio_filebacked(lo, bio);
 516                bio_endio(bio, ret);
 517        }
 518}
 519
 520/*
 521 * worker thread that handles reads/writes to file backed loop devices,
 522 * to avoid blocking in our make_request_fn. it also does loop decrypting
 523 * on reads for block backed loop, as that is too heavy to do from
 524 * b_end_io context where irqs may be disabled.
 525 *
 526 * Loop explanation:  loop_clr_fd() sets lo_state to Lo_rundown before
 527 * calling kthread_stop().  Therefore once kthread_should_stop() is
 528 * true, make_request will not place any more requests.  Therefore
 529 * once kthread_should_stop() is true and lo_bio is NULL, we are
 530 * done with the loop.
 531 */
 532static int loop_thread(void *data)
 533{
 534        struct loop_device *lo = data;
 535        struct bio *bio;
 536
 537        set_user_nice(current, -20);
 538
 539        while (!kthread_should_stop() || !bio_list_empty(&lo->lo_bio_list)) {
 540
 541                wait_event_interruptible(lo->lo_event,
 542                                !bio_list_empty(&lo->lo_bio_list) ||
 543                                kthread_should_stop());
 544
 545                if (bio_list_empty(&lo->lo_bio_list))
 546                        continue;
 547                spin_lock_irq(&lo->lo_lock);
 548                bio = loop_get_bio(lo);
 549                spin_unlock_irq(&lo->lo_lock);
 550
 551                BUG_ON(!bio);
 552                loop_handle_bio(lo, bio);
 553        }
 554
 555        return 0;
 556}
 557
 558/*
 559 * loop_switch performs the hard work of switching a backing store.
 560 * First it needs to flush existing IO, it does this by sending a magic
 561 * BIO down the pipe. The completion of this BIO does the actual switch.
 562 */
 563static int loop_switch(struct loop_device *lo, struct file *file)
 564{
 565        struct switch_request w;
 566        struct bio *bio = bio_alloc(GFP_KERNEL, 0);
 567        if (!bio)
 568                return -ENOMEM;
 569        init_completion(&w.wait);
 570        w.file = file;
 571        bio->bi_private = &w;
 572        bio->bi_bdev = NULL;
 573        loop_make_request(lo->lo_queue, bio);
 574        wait_for_completion(&w.wait);
 575        return 0;
 576}
 577
 578/*
 579 * Helper to flush the IOs in loop, but keeping loop thread running
 580 */
 581static int loop_flush(struct loop_device *lo)
 582{
 583        /* loop not yet configured, no running thread, nothing to flush */
 584        if (!lo->lo_thread)
 585                return 0;
 586
 587        return loop_switch(lo, NULL);
 588}
 589
 590/*
 591 * Do the actual switch; called from the BIO completion routine
 592 */
 593static void do_loop_switch(struct loop_device *lo, struct switch_request *p)
 594{
 595        struct file *file = p->file;
 596        struct file *old_file = lo->lo_backing_file;
 597        struct address_space *mapping;
 598
 599        /* if no new file, only flush of queued bios requested */
 600        if (!file)
 601                goto out;
 602
 603        mapping = file->f_mapping;
 604        mapping_set_gfp_mask(old_file->f_mapping, lo->old_gfp_mask);
 605        lo->lo_backing_file = file;
 606        lo->lo_blocksize = S_ISBLK(mapping->host->i_mode) ?
 607                mapping->host->i_bdev->bd_block_size : PAGE_SIZE;
 608        lo->old_gfp_mask = mapping_gfp_mask(mapping);
 609        mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
 610out:
 611        complete(&p->wait);
 612}
 613
 614
 615/*
 616 * loop_change_fd switched the backing store of a loopback device to
 617 * a new file. This is useful for operating system installers to free up
 618 * the original file and in High Availability environments to switch to
 619 * an alternative location for the content in case of server meltdown.
 620 * This can only work if the loop device is used read-only, and if the
 621 * new backing store is the same size and type as the old backing store.
 622 */
 623static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
 624                          unsigned int arg)
 625{
 626        struct file     *file, *old_file;
 627        struct inode    *inode;
 628        int             error;
 629
 630        error = -ENXIO;
 631        if (lo->lo_state != Lo_bound)
 632                goto out;
 633
 634        /* the loop device has to be read-only */
 635        error = -EINVAL;
 636        if (!(lo->lo_flags & LO_FLAGS_READ_ONLY))
 637                goto out;
 638
 639        error = -EBADF;
 640        file = fget(arg);
 641        if (!file)
 642                goto out;
 643
 644        inode = file->f_mapping->host;
 645        old_file = lo->lo_backing_file;
 646
 647        error = -EINVAL;
 648
 649        if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
 650                goto out_putf;
 651
 652        /* size of the new backing store needs to be the same */
 653        if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
 654                goto out_putf;
 655
 656        /* and ... switch */
 657        error = loop_switch(lo, file);
 658        if (error)
 659                goto out_putf;
 660
 661        fput(old_file);
 662        if (lo->lo_flags & LO_FLAGS_PARTSCAN)
 663                ioctl_by_bdev(bdev, BLKRRPART, 0);
 664        return 0;
 665
 666 out_putf:
 667        fput(file);
 668 out:
 669        return error;
 670}
 671
 672static inline int is_loop_device(struct file *file)
 673{
 674        struct inode *i = file->f_mapping->host;
 675
 676        return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
 677}
 678
 679/* loop sysfs attributes */
 680
 681static ssize_t loop_attr_show(struct device *dev, char *page,
 682                              ssize_t (*callback)(struct loop_device *, char *))
 683{
 684        struct gendisk *disk = dev_to_disk(dev);
 685        struct loop_device *lo = disk->private_data;
 686
 687        return callback(lo, page);
 688}
 689
 690#define LOOP_ATTR_RO(_name)                                             \
 691static ssize_t loop_attr_##_name##_show(struct loop_device *, char *);  \
 692static ssize_t loop_attr_do_show_##_name(struct device *d,              \
 693                                struct device_attribute *attr, char *b) \
 694{                                                                       \
 695        return loop_attr_show(d, b, loop_attr_##_name##_show);          \
 696}                                                                       \
 697static struct device_attribute loop_attr_##_name =                      \
 698        __ATTR(_name, S_IRUGO, loop_attr_do_show_##_name, NULL);
 699
 700static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf)
 701{
 702        ssize_t ret;
 703        char *p = NULL;
 704
 705        spin_lock_irq(&lo->lo_lock);
 706        if (lo->lo_backing_file)
 707                p = d_path(&lo->lo_backing_file->f_path, buf, PAGE_SIZE - 1);
 708        spin_unlock_irq(&lo->lo_lock);
 709
 710        if (IS_ERR_OR_NULL(p))
 711                ret = PTR_ERR(p);
 712        else {
 713                ret = strlen(p);
 714                memmove(buf, p, ret);
 715                buf[ret++] = '\n';
 716                buf[ret] = 0;
 717        }
 718
 719        return ret;
 720}
 721
 722static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf)
 723{
 724        return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset);
 725}
 726
 727static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf)
 728{
 729        return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit);
 730}
 731
 732static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf)
 733{
 734        int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR);
 735
 736        return sprintf(buf, "%s\n", autoclear ? "1" : "0");
 737}
 738
 739static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf)
 740{
 741        int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN);
 742
 743        return sprintf(buf, "%s\n", partscan ? "1" : "0");
 744}
 745
 746LOOP_ATTR_RO(backing_file);
 747LOOP_ATTR_RO(offset);
 748LOOP_ATTR_RO(sizelimit);
 749LOOP_ATTR_RO(autoclear);
 750LOOP_ATTR_RO(partscan);
 751
 752static struct attribute *loop_attrs[] = {
 753        &loop_attr_backing_file.attr,
 754        &loop_attr_offset.attr,
 755        &loop_attr_sizelimit.attr,
 756        &loop_attr_autoclear.attr,
 757        &loop_attr_partscan.attr,
 758        NULL,
 759};
 760
 761static struct attribute_group loop_attribute_group = {
 762        .name = "loop",
 763        .attrs= loop_attrs,
 764};
 765
 766static int loop_sysfs_init(struct loop_device *lo)
 767{
 768        return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
 769                                  &loop_attribute_group);
 770}
 771
 772static void loop_sysfs_exit(struct loop_device *lo)
 773{
 774        sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
 775                           &loop_attribute_group);
 776}
 777
 778static void loop_config_discard(struct loop_device *lo)
 779{
 780        struct file *file = lo->lo_backing_file;
 781        struct inode *inode = file->f_mapping->host;
 782        struct request_queue *q = lo->lo_queue;
 783
 784        /*
 785         * We use punch hole to reclaim the free space used by the
 786         * image a.k.a. discard. However we do support discard if
 787         * encryption is enabled, because it may give an attacker
 788         * useful information.
 789         */
 790        if ((!file->f_op->fallocate) ||
 791            lo->lo_encrypt_key_size) {
 792                q->limits.discard_granularity = 0;
 793                q->limits.discard_alignment = 0;
 794                q->limits.max_discard_sectors = 0;
 795                q->limits.discard_zeroes_data = 0;
 796                queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, q);
 797                return;
 798        }
 799
 800        q->limits.discard_granularity = inode->i_sb->s_blocksize;
 801        q->limits.discard_alignment = 0;
 802        q->limits.max_discard_sectors = UINT_MAX >> 9;
 803        q->limits.discard_zeroes_data = 1;
 804        queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
 805}
 806
 807static int loop_set_fd(struct loop_device *lo, fmode_t mode,
 808                       struct block_device *bdev, unsigned int arg)
 809{
 810        struct file     *file, *f;
 811        struct inode    *inode;
 812        struct address_space *mapping;
 813        unsigned lo_blocksize;
 814        int             lo_flags = 0;
 815        int             error;
 816        loff_t          size;
 817
 818        /* This is safe, since we have a reference from open(). */
 819        __module_get(THIS_MODULE);
 820
 821        error = -EBADF;
 822        file = fget(arg);
 823        if (!file)
 824                goto out;
 825
 826        error = -EBUSY;
 827        if (lo->lo_state != Lo_unbound)
 828                goto out_putf;
 829
 830        /* Avoid recursion */
 831        f = file;
 832        while (is_loop_device(f)) {
 833                struct loop_device *l;
 834
 835                if (f->f_mapping->host->i_bdev == bdev)
 836                        goto out_putf;
 837
 838                l = f->f_mapping->host->i_bdev->bd_disk->private_data;
 839                if (l->lo_state == Lo_unbound) {
 840                        error = -EINVAL;
 841                        goto out_putf;
 842                }
 843                f = l->lo_backing_file;
 844        }
 845
 846        mapping = file->f_mapping;
 847        inode = mapping->host;
 848
 849        error = -EINVAL;
 850        if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
 851                goto out_putf;
 852
 853        if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||
 854            !file->f_op->write)
 855                lo_flags |= LO_FLAGS_READ_ONLY;
 856
 857        lo_blocksize = S_ISBLK(inode->i_mode) ?
 858                inode->i_bdev->bd_block_size : PAGE_SIZE;
 859
 860        error = -EFBIG;
 861        size = get_loop_size(lo, file);
 862        if ((loff_t)(sector_t)size != size)
 863                goto out_putf;
 864
 865        error = 0;
 866
 867        set_device_ro(bdev, (lo_flags & LO_FLAGS_READ_ONLY) != 0);
 868
 869        lo->lo_blocksize = lo_blocksize;
 870        lo->lo_device = bdev;
 871        lo->lo_flags = lo_flags;
 872        lo->lo_backing_file = file;
 873        lo->transfer = transfer_none;
 874        lo->ioctl = NULL;
 875        lo->lo_sizelimit = 0;
 876        lo->old_gfp_mask = mapping_gfp_mask(mapping);
 877        mapping_set_gfp_mask(mapping, lo->old_gfp_mask & ~(__GFP_IO|__GFP_FS));
 878
 879        bio_list_init(&lo->lo_bio_list);
 880
 881        /*
 882         * set queue make_request_fn, and add limits based on lower level
 883         * device
 884         */
 885        blk_queue_make_request(lo->lo_queue, loop_make_request);
 886        lo->lo_queue->queuedata = lo;
 887
 888        if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync)
 889                blk_queue_flush(lo->lo_queue, REQ_FLUSH);
 890
 891        set_capacity(lo->lo_disk, size);
 892        bd_set_size(bdev, size << 9);
 893        loop_sysfs_init(lo);
 894        /* let user-space know about the new size */
 895        kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
 896
 897        set_blocksize(bdev, lo_blocksize);
 898
 899        lo->lo_thread = kthread_create(loop_thread, lo, "loop%d",
 900                                                lo->lo_number);
 901        if (IS_ERR(lo->lo_thread)) {
 902                error = PTR_ERR(lo->lo_thread);
 903                goto out_clr;
 904        }
 905        lo->lo_state = Lo_bound;
 906        wake_up_process(lo->lo_thread);
 907        if (part_shift)
 908                lo->lo_flags |= LO_FLAGS_PARTSCAN;
 909        if (lo->lo_flags & LO_FLAGS_PARTSCAN)
 910                ioctl_by_bdev(bdev, BLKRRPART, 0);
 911        return 0;
 912
 913out_clr:
 914        loop_sysfs_exit(lo);
 915        lo->lo_thread = NULL;
 916        lo->lo_device = NULL;
 917        lo->lo_backing_file = NULL;
 918        lo->lo_flags = 0;
 919        set_capacity(lo->lo_disk, 0);
 920        invalidate_bdev(bdev);
 921        bd_set_size(bdev, 0);
 922        kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
 923        mapping_set_gfp_mask(mapping, lo->old_gfp_mask);
 924        lo->lo_state = Lo_unbound;
 925 out_putf:
 926        fput(file);
 927 out:
 928        /* This is safe: open() is still holding a reference. */
 929        module_put(THIS_MODULE);
 930        return error;
 931}
 932
 933static int
 934loop_release_xfer(struct loop_device *lo)
 935{
 936        int err = 0;
 937        struct loop_func_table *xfer = lo->lo_encryption;
 938
 939        if (xfer) {
 940                if (xfer->release)
 941                        err = xfer->release(lo);
 942                lo->transfer = NULL;
 943                lo->lo_encryption = NULL;
 944                module_put(xfer->owner);
 945        }
 946        return err;
 947}
 948
 949static int
 950loop_init_xfer(struct loop_device *lo, struct loop_func_table *xfer,
 951               const struct loop_info64 *i)
 952{
 953        int err = 0;
 954
 955        if (xfer) {
 956                struct module *owner = xfer->owner;
 957
 958                if (!try_module_get(owner))
 959                        return -EINVAL;
 960                if (xfer->init)
 961                        err = xfer->init(lo, i);
 962                if (err)
 963                        module_put(owner);
 964                else
 965                        lo->lo_encryption = xfer;
 966        }
 967        return err;
 968}
 969
 970static int loop_clr_fd(struct loop_device *lo)
 971{
 972        struct file *filp = lo->lo_backing_file;
 973        gfp_t gfp = lo->old_gfp_mask;
 974        struct block_device *bdev = lo->lo_device;
 975
 976        if (lo->lo_state != Lo_bound)
 977                return -ENXIO;
 978
 979        if (lo->lo_refcnt > 1)  /* we needed one fd for the ioctl */
 980                return -EBUSY;
 981
 982        if (filp == NULL)
 983                return -EINVAL;
 984
 985        spin_lock_irq(&lo->lo_lock);
 986        lo->lo_state = Lo_rundown;
 987        spin_unlock_irq(&lo->lo_lock);
 988
 989        kthread_stop(lo->lo_thread);
 990
 991        spin_lock_irq(&lo->lo_lock);
 992        lo->lo_backing_file = NULL;
 993        spin_unlock_irq(&lo->lo_lock);
 994
 995        loop_release_xfer(lo);
 996        lo->transfer = NULL;
 997        lo->ioctl = NULL;
 998        lo->lo_device = NULL;
 999        lo->lo_encryption = NULL;
1000        lo->lo_offset = 0;
1001        lo->lo_sizelimit = 0;
1002        lo->lo_encrypt_key_size = 0;
1003        lo->lo_thread = NULL;
1004        memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
1005        memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
1006        memset(lo->lo_file_name, 0, LO_NAME_SIZE);
1007        if (bdev)
1008                invalidate_bdev(bdev);
1009        set_capacity(lo->lo_disk, 0);
1010        loop_sysfs_exit(lo);
1011        if (bdev) {
1012                bd_set_size(bdev, 0);
1013                /* let user-space know about this change */
1014                kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
1015        }
1016        mapping_set_gfp_mask(filp->f_mapping, gfp);
1017        lo->lo_state = Lo_unbound;
1018        /* This is safe: open() is still holding a reference. */
1019        module_put(THIS_MODULE);
1020        if (lo->lo_flags & LO_FLAGS_PARTSCAN && bdev)
1021                ioctl_by_bdev(bdev, BLKRRPART, 0);
1022        lo->lo_flags = 0;
1023        if (!part_shift)
1024                lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
1025        mutex_unlock(&lo->lo_ctl_mutex);
1026        /*
1027         * Need not hold lo_ctl_mutex to fput backing file.
1028         * Calling fput holding lo_ctl_mutex triggers a circular
1029         * lock dependency possibility warning as fput can take
1030         * bd_mutex which is usually taken before lo_ctl_mutex.
1031         */
1032        fput(filp);
1033        return 0;
1034}
1035
1036static int
1037loop_set_status(struct loop_device *lo, const struct loop_info64 *info)
1038{
1039        int err;
1040        struct loop_func_table *xfer;
1041        uid_t uid = current_uid();
1042
1043        if (lo->lo_encrypt_key_size &&
1044            lo->lo_key_owner != uid &&
1045            !capable(CAP_SYS_ADMIN))
1046                return -EPERM;
1047        if (lo->lo_state != Lo_bound)
1048                return -ENXIO;
1049        if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE)
1050                return -EINVAL;
1051
1052        err = loop_release_xfer(lo);
1053        if (err)
1054                return err;
1055
1056        if (info->lo_encrypt_type) {
1057                unsigned int type = info->lo_encrypt_type;
1058
1059                if (type >= MAX_LO_CRYPT)
1060                        return -EINVAL;
1061                xfer = xfer_funcs[type];
1062                if (xfer == NULL)
1063                        return -EINVAL;
1064        } else
1065                xfer = NULL;
1066
1067        err = loop_init_xfer(lo, xfer, info);
1068        if (err)
1069                return err;
1070
1071        if (lo->lo_offset != info->lo_offset ||
1072            lo->lo_sizelimit != info->lo_sizelimit) {
1073                if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit))
1074                        return -EFBIG;
1075        }
1076        loop_config_discard(lo);
1077
1078        memcpy(lo->lo_file_name, info->lo_file_name, LO_NAME_SIZE);
1079        memcpy(lo->lo_crypt_name, info->lo_crypt_name, LO_NAME_SIZE);
1080        lo->lo_file_name[LO_NAME_SIZE-1] = 0;
1081        lo->lo_crypt_name[LO_NAME_SIZE-1] = 0;
1082
1083        if (!xfer)
1084                xfer = &none_funcs;
1085        lo->transfer = xfer->transfer;
1086        lo->ioctl = xfer->ioctl;
1087
1088        if ((lo->lo_flags & LO_FLAGS_AUTOCLEAR) !=
1089             (info->lo_flags & LO_FLAGS_AUTOCLEAR))
1090                lo->lo_flags ^= LO_FLAGS_AUTOCLEAR;
1091
1092        if ((info->lo_flags & LO_FLAGS_PARTSCAN) &&
1093             !(lo->lo_flags & LO_FLAGS_PARTSCAN)) {
1094                lo->lo_flags |= LO_FLAGS_PARTSCAN;
1095                lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN;
1096                ioctl_by_bdev(lo->lo_device, BLKRRPART, 0);
1097        }
1098
1099        lo->lo_encrypt_key_size = info->lo_encrypt_key_size;
1100        lo->lo_init[0] = info->lo_init[0];
1101        lo->lo_init[1] = info->lo_init[1];
1102        if (info->lo_encrypt_key_size) {
1103                memcpy(lo->lo_encrypt_key, info->lo_encrypt_key,
1104                       info->lo_encrypt_key_size);
1105                lo->lo_key_owner = uid;
1106        }       
1107
1108        return 0;
1109}
1110
1111static int
1112loop_get_status(struct loop_device *lo, struct loop_info64 *info)
1113{
1114        struct file *file = lo->lo_backing_file;
1115        struct kstat stat;
1116        int error;
1117
1118        if (lo->lo_state != Lo_bound)
1119                return -ENXIO;
1120        error = vfs_getattr(file->f_path.mnt, file->f_path.dentry, &stat);
1121        if (error)
1122                return error;
1123        memset(info, 0, sizeof(*info));
1124        info->lo_number = lo->lo_number;
1125        info->lo_device = huge_encode_dev(stat.dev);
1126        info->lo_inode = stat.ino;
1127        info->lo_rdevice = huge_encode_dev(lo->lo_device ? stat.rdev : stat.dev);
1128        info->lo_offset = lo->lo_offset;
1129        info->lo_sizelimit = lo->lo_sizelimit;
1130        info->lo_flags = lo->lo_flags;
1131        memcpy(info->lo_file_name, lo->lo_file_name, LO_NAME_SIZE);
1132        memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
1133        info->lo_encrypt_type =
1134                lo->lo_encryption ? lo->lo_encryption->number : 0;
1135        if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
1136                info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
1137                memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
1138                       lo->lo_encrypt_key_size);
1139        }
1140        return 0;
1141}
1142
1143static void
1144loop_info64_from_old(const struct loop_info *info, struct loop_info64 *info64)
1145{
1146        memset(info64, 0, sizeof(*info64));
1147        info64->lo_number = info->lo_number;
1148        info64->lo_device = info->lo_device;
1149        info64->lo_inode = info->lo_inode;
1150        info64->lo_rdevice = info->lo_rdevice;
1151        info64->lo_offset = info->lo_offset;
1152        info64->lo_sizelimit = 0;
1153        info64->lo_encrypt_type = info->lo_encrypt_type;
1154        info64->lo_encrypt_key_size = info->lo_encrypt_key_size;
1155        info64->lo_flags = info->lo_flags;
1156        info64->lo_init[0] = info->lo_init[0];
1157        info64->lo_init[1] = info->lo_init[1];
1158        if (info->lo_encrypt_type == LO_CRYPT_CRYPTOAPI)
1159                memcpy(info64->lo_crypt_name, info->lo_name, LO_NAME_SIZE);
1160        else
1161                memcpy(info64->lo_file_name, info->lo_name, LO_NAME_SIZE);
1162        memcpy(info64->lo_encrypt_key, info->lo_encrypt_key, LO_KEY_SIZE);
1163}
1164
1165static int
1166loop_info64_to_old(const struct loop_info64 *info64, struct loop_info *info)
1167{
1168        memset(info, 0, sizeof(*info));
1169        info->lo_number = info64->lo_number;
1170        info->lo_device = info64->lo_device;
1171        info->lo_inode = info64->lo_inode;
1172        info->lo_rdevice = info64->lo_rdevice;
1173        info->lo_offset = info64->lo_offset;
1174        info->lo_encrypt_type = info64->lo_encrypt_type;
1175        info->lo_encrypt_key_size = info64->lo_encrypt_key_size;
1176        info->lo_flags = info64->lo_flags;
1177        info->lo_init[0] = info64->lo_init[0];
1178        info->lo_init[1] = info64->lo_init[1];
1179        if (info->lo_encrypt_type == LO_CRYPT_CRYPTOAPI)
1180                memcpy(info->lo_name, info64->lo_crypt_name, LO_NAME_SIZE);
1181        else
1182                memcpy(info->lo_name, info64->lo_file_name, LO_NAME_SIZE);
1183        memcpy(info->lo_encrypt_key, info64->lo_encrypt_key, LO_KEY_SIZE);
1184
1185        /* error in case values were truncated */
1186        if (info->lo_device != info64->lo_device ||
1187            info->lo_rdevice != info64->lo_rdevice ||
1188            info->lo_inode != info64->lo_inode ||
1189            info->lo_offset != info64->lo_offset)
1190                return -EOVERFLOW;
1191
1192        return 0;
1193}
1194
1195static int
1196loop_set_status_old(struct loop_device *lo, const struct loop_info __user *arg)
1197{
1198        struct loop_info info;
1199        struct loop_info64 info64;
1200
1201        if (copy_from_user(&info, arg, sizeof (struct loop_info)))
1202                return -EFAULT;
1203        loop_info64_from_old(&info, &info64);
1204        return loop_set_status(lo, &info64);
1205}
1206
1207static int
1208loop_set_status64(struct loop_device *lo, const struct loop_info64 __user *arg)
1209{
1210        struct loop_info64 info64;
1211
1212        if (copy_from_user(&info64, arg, sizeof (struct loop_info64)))
1213                return -EFAULT;
1214        return loop_set_status(lo, &info64);
1215}
1216
1217static int
1218loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) {
1219        struct loop_info info;
1220        struct loop_info64 info64;
1221        int err = 0;
1222
1223        if (!arg)
1224                err = -EINVAL;
1225        if (!err)
1226                err = loop_get_status(lo, &info64);
1227        if (!err)
1228                err = loop_info64_to_old(&info64, &info);
1229        if (!err && copy_to_user(arg, &info, sizeof(info)))
1230                err = -EFAULT;
1231
1232        return err;
1233}
1234
1235static int
1236loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) {
1237        struct loop_info64 info64;
1238        int err = 0;
1239
1240        if (!arg)
1241                err = -EINVAL;
1242        if (!err)
1243                err = loop_get_status(lo, &info64);
1244        if (!err && copy_to_user(arg, &info64, sizeof(info64)))
1245                err = -EFAULT;
1246
1247        return err;
1248}
1249
1250static int loop_set_capacity(struct loop_device *lo, struct block_device *bdev)
1251{
1252        int err;
1253        sector_t sec;
1254        loff_t sz;
1255
1256        err = -ENXIO;
1257        if (unlikely(lo->lo_state != Lo_bound))
1258                goto out;
1259        err = figure_loop_size(lo, lo->lo_offset, lo->lo_sizelimit);
1260        if (unlikely(err))
1261                goto out;
1262        sec = get_capacity(lo->lo_disk);
1263        /* the width of sector_t may be narrow for bit-shift */
1264        sz = sec;
1265        sz <<= 9;
1266        mutex_lock(&bdev->bd_mutex);
1267        bd_set_size(bdev, sz);
1268        /* let user-space know about the new size */
1269        kobject_uevent(&disk_to_dev(bdev->bd_disk)->kobj, KOBJ_CHANGE);
1270        mutex_unlock(&bdev->bd_mutex);
1271
1272 out:
1273        return err;
1274}
1275
1276static int lo_ioctl(struct block_device *bdev, fmode_t mode,
1277        unsigned int cmd, unsigned long arg)
1278{
1279        struct loop_device *lo = bdev->bd_disk->private_data;
1280        int err;
1281
1282        mutex_lock_nested(&lo->lo_ctl_mutex, 1);
1283        switch (cmd) {
1284        case LOOP_SET_FD:
1285                err = loop_set_fd(lo, mode, bdev, arg);
1286                break;
1287        case LOOP_CHANGE_FD:
1288                err = loop_change_fd(lo, bdev, arg);
1289                break;
1290        case LOOP_CLR_FD:
1291                /* loop_clr_fd would have unlocked lo_ctl_mutex on success */
1292                err = loop_clr_fd(lo);
1293                if (!err)
1294                        goto out_unlocked;
1295                break;
1296        case LOOP_SET_STATUS:
1297                err = -EPERM;
1298                if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
1299                        err = loop_set_status_old(lo,
1300                                        (struct loop_info __user *)arg);
1301                break;
1302        case LOOP_GET_STATUS:
1303                err = loop_get_status_old(lo, (struct loop_info __user *) arg);
1304                break;
1305        case LOOP_SET_STATUS64:
1306                err = -EPERM;
1307                if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
1308                        err = loop_set_status64(lo,
1309                                        (struct loop_info64 __user *) arg);
1310                break;
1311        case LOOP_GET_STATUS64:
1312                err = loop_get_status64(lo, (struct loop_info64 __user *) arg);
1313                break;
1314        case LOOP_SET_CAPACITY:
1315                err = -EPERM;
1316                if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN))
1317                        err = loop_set_capacity(lo, bdev);
1318                break;
1319        default:
1320                err = lo->ioctl ? lo->ioctl(lo, cmd, arg) : -EINVAL;
1321        }
1322        mutex_unlock(&lo->lo_ctl_mutex);
1323
1324out_unlocked:
1325        return err;
1326}
1327
1328#ifdef CONFIG_COMPAT
1329struct compat_loop_info {
1330        compat_int_t    lo_number;      /* ioctl r/o */
1331        compat_dev_t    lo_device;      /* ioctl r/o */
1332        compat_ulong_t  lo_inode;       /* ioctl r/o */
1333        compat_dev_t    lo_rdevice;     /* ioctl r/o */
1334        compat_int_t    lo_offset;
1335        compat_int_t    lo_encrypt_type;
1336        compat_int_t    lo_encrypt_key_size;    /* ioctl w/o */
1337        compat_int_t    lo_flags;       /* ioctl r/o */
1338        char            lo_name[LO_NAME_SIZE];
1339        unsigned char   lo_encrypt_key[LO_KEY_SIZE]; /* ioctl w/o */
1340        compat_ulong_t  lo_init[2];
1341        char            reserved[4];
1342};
1343
1344/*
1345 * Transfer 32-bit compatibility structure in userspace to 64-bit loop info
1346 * - noinlined to reduce stack space usage in main part of driver
1347 */
1348static noinline int
1349loop_info64_from_compat(const struct compat_loop_info __user *arg,
1350                        struct loop_info64 *info64)
1351{
1352        struct compat_loop_info info;
1353
1354        if (copy_from_user(&info, arg, sizeof(info)))
1355                return -EFAULT;
1356
1357        memset(info64, 0, sizeof(*info64));
1358        info64->lo_number = info.lo_number;
1359        info64->lo_device = info.lo_device;
1360        info64->lo_inode = info.lo_inode;
1361        info64->lo_rdevice = info.lo_rdevice;
1362        info64->lo_offset = info.lo_offset;
1363        info64->lo_sizelimit = 0;
1364        info64->lo_encrypt_type = info.lo_encrypt_type;
1365        info64->lo_encrypt_key_size = info.lo_encrypt_key_size;
1366        info64->lo_flags = info.lo_flags;
1367        info64->lo_init[0] = info.lo_init[0];
1368        info64->lo_init[1] = info.lo_init[1];
1369        if (info.lo_encrypt_type == LO_CRYPT_CRYPTOAPI)
1370                memcpy(info64->lo_crypt_name, info.lo_name, LO_NAME_SIZE);
1371        else
1372                memcpy(info64->lo_file_name, info.lo_name, LO_NAME_SIZE);
1373        memcpy(info64->lo_encrypt_key, info.lo_encrypt_key, LO_KEY_SIZE);
1374        return 0;
1375}
1376
1377/*
1378 * Transfer 64-bit loop info to 32-bit compatibility structure in userspace
1379 * - noinlined to reduce stack space usage in main part of driver
1380 */
1381static noinline int
1382loop_info64_to_compat(const struct loop_info64 *info64,
1383                      struct compat_loop_info __user *arg)
1384{
1385        struct compat_loop_info info;
1386
1387        memset(&info, 0, sizeof(info));
1388        info.lo_number = info64->lo_number;
1389        info.lo_device = info64->lo_device;
1390        info.lo_inode = info64->lo_inode;
1391        info.lo_rdevice = info64->lo_rdevice;
1392        info.lo_offset = info64->lo_offset;
1393        info.lo_encrypt_type = info64->lo_encrypt_type;
1394        info.lo_encrypt_key_size = info64->lo_encrypt_key_size;
1395        info.lo_flags = info64->lo_flags;
1396        info.lo_init[0] = info64->lo_init[0];
1397        info.lo_init[1] = info64->lo_init[1];
1398        if (info.lo_encrypt_type == LO_CRYPT_CRYPTOAPI)
1399                memcpy(info.lo_name, info64->lo_crypt_name, LO_NAME_SIZE);
1400        else
1401                memcpy(info.lo_name, info64->lo_file_name, LO_NAME_SIZE);
1402        memcpy(info.lo_encrypt_key, info64->lo_encrypt_key, LO_KEY_SIZE);
1403
1404        /* error in case values were truncated */
1405        if (info.lo_device != info64->lo_device ||
1406            info.lo_rdevice != info64->lo_rdevice ||
1407            info.lo_inode != info64->lo_inode ||
1408            info.lo_offset != info64->lo_offset ||
1409            info.lo_init[0] != info64->lo_init[0] ||
1410            info.lo_init[1] != info64->lo_init[1])
1411                return -EOVERFLOW;
1412
1413        if (copy_to_user(arg, &info, sizeof(info)))
1414                return -EFAULT;
1415        return 0;
1416}
1417
1418static int
1419loop_set_status_compat(struct loop_device *lo,
1420                       const struct compat_loop_info __user *arg)
1421{
1422        struct loop_info64 info64;
1423        int ret;
1424
1425        ret = loop_info64_from_compat(arg, &info64);
1426        if (ret < 0)
1427                return ret;
1428        return loop_set_status(lo, &info64);
1429}
1430
1431static int
1432loop_get_status_compat(struct loop_device *lo,
1433                       struct compat_loop_info __user *arg)
1434{
1435        struct loop_info64 info64;
1436        int err = 0;
1437
1438        if (!arg)
1439                err = -EINVAL;
1440        if (!err)
1441                err = loop_get_status(lo, &info64);
1442        if (!err)
1443                err = loop_info64_to_compat(&info64, arg);
1444        return err;
1445}
1446
1447static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
1448                           unsigned int cmd, unsigned long arg)
1449{
1450        struct loop_device *lo = bdev->bd_disk->private_data;
1451        int err;
1452
1453        switch(cmd) {
1454        case LOOP_SET_STATUS:
1455                mutex_lock(&lo->lo_ctl_mutex);
1456                err = loop_set_status_compat(
1457                        lo, (const struct compat_loop_info __user *) arg);
1458                mutex_unlock(&lo->lo_ctl_mutex);
1459                break;
1460        case LOOP_GET_STATUS:
1461                mutex_lock(&lo->lo_ctl_mutex);
1462                err = loop_get_status_compat(
1463                        lo, (struct compat_loop_info __user *) arg);
1464                mutex_unlock(&lo->lo_ctl_mutex);
1465                break;
1466        case LOOP_SET_CAPACITY:
1467        case LOOP_CLR_FD:
1468        case LOOP_GET_STATUS64:
1469        case LOOP_SET_STATUS64:
1470                arg = (unsigned long) compat_ptr(arg);
1471        case LOOP_SET_FD:
1472        case LOOP_CHANGE_FD:
1473                err = lo_ioctl(bdev, mode, cmd, arg);
1474                break;
1475        default:
1476                err = -ENOIOCTLCMD;
1477                break;
1478        }
1479        return err;
1480}
1481#endif
1482
1483static int lo_open(struct block_device *bdev, fmode_t mode)
1484{
1485        struct loop_device *lo;
1486        int err = 0;
1487
1488        mutex_lock(&loop_index_mutex);
1489        lo = bdev->bd_disk->private_data;
1490        if (!lo) {
1491                err = -ENXIO;
1492                goto out;
1493        }
1494
1495        mutex_lock(&lo->lo_ctl_mutex);
1496        lo->lo_refcnt++;
1497        mutex_unlock(&lo->lo_ctl_mutex);
1498out:
1499        mutex_unlock(&loop_index_mutex);
1500        return err;
1501}
1502
1503static int lo_release(struct gendisk *disk, fmode_t mode)
1504{
1505        struct loop_device *lo = disk->private_data;
1506        int err;
1507
1508        mutex_lock(&lo->lo_ctl_mutex);
1509
1510        if (--lo->lo_refcnt)
1511                goto out;
1512
1513        if (lo->lo_flags & LO_FLAGS_AUTOCLEAR) {
1514                /*
1515                 * In autoclear mode, stop the loop thread
1516                 * and remove configuration after last close.
1517                 */
1518                err = loop_clr_fd(lo);
1519                if (!err)
1520                        goto out_unlocked;
1521        } else {
1522                /*
1523                 * Otherwise keep thread (if running) and config,
1524                 * but flush possible ongoing bios in thread.
1525                 */
1526                loop_flush(lo);
1527        }
1528
1529out:
1530        mutex_unlock(&lo->lo_ctl_mutex);
1531out_unlocked:
1532        return 0;
1533}
1534
1535static const struct block_device_operations lo_fops = {
1536        .owner =        THIS_MODULE,
1537        .open =         lo_open,
1538        .release =      lo_release,
1539        .ioctl =        lo_ioctl,
1540#ifdef CONFIG_COMPAT
1541        .compat_ioctl = lo_compat_ioctl,
1542#endif
1543};
1544
1545/*
1546 * And now the modules code and kernel interface.
1547 */
1548static int max_loop;
1549module_param(max_loop, int, S_IRUGO);
1550MODULE_PARM_DESC(max_loop, "Maximum number of loop devices");
1551module_param(max_part, int, S_IRUGO);
1552MODULE_PARM_DESC(max_part, "Maximum number of partitions per loop device");
1553MODULE_LICENSE("GPL");
1554MODULE_ALIAS_BLOCKDEV_MAJOR(LOOP_MAJOR);
1555
1556int loop_register_transfer(struct loop_func_table *funcs)
1557{
1558        unsigned int n = funcs->number;
1559
1560        if (n >= MAX_LO_CRYPT || xfer_funcs[n])
1561                return -EINVAL;
1562        xfer_funcs[n] = funcs;
1563        return 0;
1564}
1565
1566static int unregister_transfer_cb(int id, void *ptr, void *data)
1567{
1568        struct loop_device *lo = ptr;
1569        struct loop_func_table *xfer = data;
1570
1571        mutex_lock(&lo->lo_ctl_mutex);
1572        if (lo->lo_encryption == xfer)
1573                loop_release_xfer(lo);
1574        mutex_unlock(&lo->lo_ctl_mutex);
1575        return 0;
1576}
1577
1578int loop_unregister_transfer(int number)
1579{
1580        unsigned int n = number;
1581        struct loop_func_table *xfer;
1582
1583        if (n == 0 || n >= MAX_LO_CRYPT || (xfer = xfer_funcs[n]) == NULL)
1584                return -EINVAL;
1585
1586        xfer_funcs[n] = NULL;
1587        idr_for_each(&loop_index_idr, &unregister_transfer_cb, xfer);
1588        return 0;
1589}
1590
1591EXPORT_SYMBOL(loop_register_transfer);
1592EXPORT_SYMBOL(loop_unregister_transfer);
1593
1594static int loop_add(struct loop_device **l, int i)
1595{
1596        struct loop_device *lo;
1597        struct gendisk *disk;
1598        int err;
1599
1600        lo = kzalloc(sizeof(*lo), GFP_KERNEL);
1601        if (!lo) {
1602                err = -ENOMEM;
1603                goto out;
1604        }
1605
1606        err = idr_pre_get(&loop_index_idr, GFP_KERNEL);
1607        if (err < 0)
1608                goto out_free_dev;
1609
1610        if (i >= 0) {
1611                int m;
1612
1613                /* create specific i in the index */
1614                err = idr_get_new_above(&loop_index_idr, lo, i, &m);
1615                if (err >= 0 && i != m) {
1616                        idr_remove(&loop_index_idr, m);
1617                        err = -EEXIST;
1618                }
1619        } else if (i == -1) {
1620                int m;
1621
1622                /* get next free nr */
1623                err = idr_get_new(&loop_index_idr, lo, &m);
1624                if (err >= 0)
1625                        i = m;
1626        } else {
1627                err = -EINVAL;
1628        }
1629        if (err < 0)
1630                goto out_free_dev;
1631
1632        lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
1633        if (!lo->lo_queue)
1634                goto out_free_dev;
1635
1636        disk = lo->lo_disk = alloc_disk(1 << part_shift);
1637        if (!disk)
1638                goto out_free_queue;
1639
1640        /*
1641         * Disable partition scanning by default. The in-kernel partition
1642         * scanning can be requested individually per-device during its
1643         * setup. Userspace can always add and remove partitions from all
1644         * devices. The needed partition minors are allocated from the
1645         * extended minor space, the main loop device numbers will continue
1646         * to match the loop minors, regardless of the number of partitions
1647         * used.
1648         *
1649         * If max_part is given, partition scanning is globally enabled for
1650         * all loop devices. The minors for the main loop devices will be
1651         * multiples of max_part.
1652         *
1653         * Note: Global-for-all-devices, set-only-at-init, read-only module
1654         * parameteters like 'max_loop' and 'max_part' make things needlessly
1655         * complicated, are too static, inflexible and may surprise
1656         * userspace tools. Parameters like this in general should be avoided.
1657         */
1658        if (!part_shift)
1659                disk->flags |= GENHD_FL_NO_PART_SCAN;
1660        disk->flags |= GENHD_FL_EXT_DEVT;
1661        mutex_init(&lo->lo_ctl_mutex);
1662        lo->lo_number           = i;
1663        lo->lo_thread           = NULL;
1664        init_waitqueue_head(&lo->lo_event);
1665        spin_lock_init(&lo->lo_lock);
1666        disk->major             = LOOP_MAJOR;
1667        disk->first_minor       = i << part_shift;
1668        disk->fops              = &lo_fops;
1669        disk->private_data      = lo;
1670        disk->queue             = lo->lo_queue;
1671        sprintf(disk->disk_name, "loop%d", i);
1672        add_disk(disk);
1673        *l = lo;
1674        return lo->lo_number;
1675
1676out_free_queue:
1677        blk_cleanup_queue(lo->lo_queue);
1678out_free_dev:
1679        kfree(lo);
1680out:
1681        return err;
1682}
1683
1684static void loop_remove(struct loop_device *lo)
1685{
1686        del_gendisk(lo->lo_disk);
1687        blk_cleanup_queue(lo->lo_queue);
1688        put_disk(lo->lo_disk);
1689        kfree(lo);
1690}
1691
1692static int find_free_cb(int id, void *ptr, void *data)
1693{
1694        struct loop_device *lo = ptr;
1695        struct loop_device **l = data;
1696
1697        if (lo->lo_state == Lo_unbound) {
1698                *l = lo;
1699                return 1;
1700        }
1701        return 0;
1702}
1703
1704static int loop_lookup(struct loop_device **l, int i)
1705{
1706        struct loop_device *lo;
1707        int ret = -ENODEV;
1708
1709        if (i < 0) {
1710                int err;
1711
1712                err = idr_for_each(&loop_index_idr, &find_free_cb, &lo);
1713                if (err == 1) {
1714                        *l = lo;
1715                        ret = lo->lo_number;
1716                }
1717                goto out;
1718        }
1719
1720        /* lookup and return a specific i */
1721        lo = idr_find(&loop_index_idr, i);
1722        if (lo) {
1723                *l = lo;
1724                ret = lo->lo_number;
1725        }
1726out:
1727        return ret;
1728}
1729
1730static struct kobject *loop_probe(dev_t dev, int *part, void *data)
1731{
1732        struct loop_device *lo;
1733        struct kobject *kobj;
1734        int err;
1735
1736        mutex_lock(&loop_index_mutex);
1737        err = loop_lookup(&lo, MINOR(dev) >> part_shift);
1738        if (err < 0)
1739                err = loop_add(&lo, MINOR(dev) >> part_shift);
1740        if (err < 0)
1741                kobj = ERR_PTR(err);
1742        else
1743                kobj = get_disk(lo->lo_disk);
1744        mutex_unlock(&loop_index_mutex);
1745
1746        *part = 0;
1747        return kobj;
1748}
1749
1750static long loop_control_ioctl(struct file *file, unsigned int cmd,
1751                               unsigned long parm)
1752{
1753        struct loop_device *lo;
1754        int ret = -ENOSYS;
1755
1756        mutex_lock(&loop_index_mutex);
1757        switch (cmd) {
1758        case LOOP_CTL_ADD:
1759                ret = loop_lookup(&lo, parm);
1760                if (ret >= 0) {
1761                        ret = -EEXIST;
1762                        break;
1763                }
1764                ret = loop_add(&lo, parm);
1765                break;
1766        case LOOP_CTL_REMOVE:
1767                ret = loop_lookup(&lo, parm);
1768                if (ret < 0)
1769                        break;
1770                mutex_lock(&lo->lo_ctl_mutex);
1771                if (lo->lo_state != Lo_unbound) {
1772                        ret = -EBUSY;
1773                        mutex_unlock(&lo->lo_ctl_mutex);
1774                        break;
1775                }
1776                if (lo->lo_refcnt > 0) {
1777                        ret = -EBUSY;
1778                        mutex_unlock(&lo->lo_ctl_mutex);
1779                        break;
1780                }
1781                lo->lo_disk->private_data = NULL;
1782                mutex_unlock(&lo->lo_ctl_mutex);
1783                idr_remove(&loop_index_idr, lo->lo_number);
1784                loop_remove(lo);
1785                break;
1786        case LOOP_CTL_GET_FREE:
1787                ret = loop_lookup(&lo, -1);
1788                if (ret >= 0)
1789                        break;
1790                ret = loop_add(&lo, -1);
1791        }
1792        mutex_unlock(&loop_index_mutex);
1793
1794        return ret;
1795}
1796
1797static const struct file_operations loop_ctl_fops = {
1798        .open           = nonseekable_open,
1799        .unlocked_ioctl = loop_control_ioctl,
1800        .compat_ioctl   = loop_control_ioctl,
1801        .owner          = THIS_MODULE,
1802        .llseek         = noop_llseek,
1803};
1804
1805static struct miscdevice loop_misc = {
1806        .minor          = LOOP_CTRL_MINOR,
1807        .name           = "loop-control",
1808        .fops           = &loop_ctl_fops,
1809};
1810
1811MODULE_ALIAS_MISCDEV(LOOP_CTRL_MINOR);
1812MODULE_ALIAS("devname:loop-control");
1813
1814static int __init loop_init(void)
1815{
1816        int i, nr;
1817        unsigned long range;
1818        struct loop_device *lo;
1819        int err;
1820
1821        err = misc_register(&loop_misc);
1822        if (err < 0)
1823                return err;
1824
1825        part_shift = 0;
1826        if (max_part > 0) {
1827                part_shift = fls(max_part);
1828
1829                /*
1830                 * Adjust max_part according to part_shift as it is exported
1831                 * to user space so that user can decide correct minor number
1832                 * if [s]he want to create more devices.
1833                 *
1834                 * Note that -1 is required because partition 0 is reserved
1835                 * for the whole disk.
1836                 */
1837                max_part = (1UL << part_shift) - 1;
1838        }
1839
1840        if ((1UL << part_shift) > DISK_MAX_PARTS)
1841                return -EINVAL;
1842
1843        if (max_loop > 1UL << (MINORBITS - part_shift))
1844                return -EINVAL;
1845
1846        /*
1847         * If max_loop is specified, create that many devices upfront.
1848         * This also becomes a hard limit. If max_loop is not specified,
1849         * create CONFIG_BLK_DEV_LOOP_MIN_COUNT loop devices at module
1850         * init time. Loop devices can be requested on-demand with the
1851         * /dev/loop-control interface, or be instantiated by accessing
1852         * a 'dead' device node.
1853         */
1854        if (max_loop) {
1855                nr = max_loop;
1856                range = max_loop << part_shift;
1857        } else {
1858                nr = CONFIG_BLK_DEV_LOOP_MIN_COUNT;
1859                range = 1UL << MINORBITS;
1860        }
1861
1862        if (register_blkdev(LOOP_MAJOR, "loop"))
1863                return -EIO;
1864
1865        blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
1866                                  THIS_MODULE, loop_probe, NULL, NULL);
1867
1868        /* pre-create number of devices given by config or max_loop */
1869        mutex_lock(&loop_index_mutex);
1870        for (i = 0; i < nr; i++)
1871                loop_add(&lo, i);
1872        mutex_unlock(&loop_index_mutex);
1873
1874        printk(KERN_INFO "loop: module loaded\n");
1875        return 0;
1876}
1877
1878static int loop_exit_cb(int id, void *ptr, void *data)
1879{
1880        struct loop_device *lo = ptr;
1881
1882        loop_remove(lo);
1883        return 0;
1884}
1885
1886static void __exit loop_exit(void)
1887{
1888        unsigned long range;
1889
1890        range = max_loop ? max_loop << part_shift : 1UL << MINORBITS;
1891
1892        idr_for_each(&loop_index_idr, &loop_exit_cb, NULL);
1893        idr_remove_all(&loop_index_idr);
1894        idr_destroy(&loop_index_idr);
1895
1896        blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
1897        unregister_blkdev(LOOP_MAJOR, "loop");
1898
1899        misc_deregister(&loop_misc);
1900}
1901
1902module_init(loop_init);
1903module_exit(loop_exit);
1904
1905#ifndef MODULE
1906static int __init max_loop_setup(char *str)
1907{
1908        max_loop = simple_strtol(str, NULL, 0);
1909        return 1;
1910}
1911
1912__setup("max_loop=", max_loop_setup);
1913#endif
1914
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.