xref: /freebsd/sys/geom/shsec/g_shsec.c (revision e9e8876a4d6afc1ad5315faaa191b25121a813d7)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2005 Pawel Jakub Dawidek <pjd@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/kernel.h>
35 #include <sys/module.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/bio.h>
39 #include <sys/sbuf.h>
40 #include <sys/sysctl.h>
41 #include <sys/malloc.h>
42 #include <vm/uma.h>
43 #include <geom/geom.h>
44 #include <geom/geom_dbg.h>
45 #include <geom/shsec/g_shsec.h>
46 
47 FEATURE(geom_shsec, "GEOM shared secret device support");
48 
49 static MALLOC_DEFINE(M_SHSEC, "shsec_data", "GEOM_SHSEC Data");
50 
51 static uma_zone_t g_shsec_zone;
52 
53 static int g_shsec_destroy(struct g_shsec_softc *sc, boolean_t force);
54 static int g_shsec_destroy_geom(struct gctl_req *req, struct g_class *mp,
55     struct g_geom *gp);
56 
57 static g_taste_t g_shsec_taste;
58 static g_ctl_req_t g_shsec_config;
59 static g_dumpconf_t g_shsec_dumpconf;
60 static g_init_t g_shsec_init;
61 static g_fini_t g_shsec_fini;
62 
63 struct g_class g_shsec_class = {
64 	.name = G_SHSEC_CLASS_NAME,
65 	.version = G_VERSION,
66 	.ctlreq = g_shsec_config,
67 	.taste = g_shsec_taste,
68 	.destroy_geom = g_shsec_destroy_geom,
69 	.init = g_shsec_init,
70 	.fini = g_shsec_fini
71 };
72 
73 SYSCTL_DECL(_kern_geom);
74 static SYSCTL_NODE(_kern_geom, OID_AUTO, shsec, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
75     "GEOM_SHSEC stuff");
76 static u_int g_shsec_debug;
77 SYSCTL_UINT(_kern_geom_shsec, OID_AUTO, debug, CTLFLAG_RWTUN, &g_shsec_debug, 0,
78     "Debug level");
79 static u_long g_shsec_maxmem;
80 SYSCTL_ULONG(_kern_geom_shsec, OID_AUTO, maxmem,
81     CTLFLAG_RDTUN | CTLFLAG_NOFETCH, &g_shsec_maxmem,
82     0, "Maximum memory that can be allocated for I/O (in bytes)");
83 static u_int g_shsec_alloc_failed = 0;
84 SYSCTL_UINT(_kern_geom_shsec, OID_AUTO, alloc_failed, CTLFLAG_RD,
85     &g_shsec_alloc_failed, 0, "How many times I/O allocation failed");
86 
87 /*
88  * Greatest Common Divisor.
89  */
90 static u_int
91 gcd(u_int a, u_int b)
92 {
93 	u_int c;
94 
95 	while (b != 0) {
96 		c = a;
97 		a = b;
98 		b = (c % b);
99 	}
100 	return (a);
101 }
102 
103 /*
104  * Least Common Multiple.
105  */
106 static u_int
107 lcm(u_int a, u_int b)
108 {
109 
110 	return ((a * b) / gcd(a, b));
111 }
112 
113 static void
114 g_shsec_init(struct g_class *mp __unused)
115 {
116 
117 	g_shsec_maxmem = maxphys * 100;
118 	TUNABLE_ULONG_FETCH("kern.geom.shsec.maxmem,", &g_shsec_maxmem);
119 	g_shsec_zone = uma_zcreate("g_shsec_zone", maxphys, NULL, NULL, NULL,
120 	    NULL, 0, 0);
121 	g_shsec_maxmem -= g_shsec_maxmem % maxphys;
122 	uma_zone_set_max(g_shsec_zone, g_shsec_maxmem / maxphys);
123 }
124 
125 static void
126 g_shsec_fini(struct g_class *mp __unused)
127 {
128 
129 	uma_zdestroy(g_shsec_zone);
130 }
131 
132 /*
133  * Return the number of valid disks.
134  */
135 static u_int
136 g_shsec_nvalid(struct g_shsec_softc *sc)
137 {
138 	u_int i, no;
139 
140 	no = 0;
141 	for (i = 0; i < sc->sc_ndisks; i++) {
142 		if (sc->sc_disks[i] != NULL)
143 			no++;
144 	}
145 
146 	return (no);
147 }
148 
149 static void
150 g_shsec_remove_disk(struct g_consumer *cp)
151 {
152 	struct g_shsec_softc *sc;
153 	u_int no;
154 
155 	KASSERT(cp != NULL, ("Non-valid disk in %s.", __func__));
156 	sc = (struct g_shsec_softc *)cp->private;
157 	KASSERT(sc != NULL, ("NULL sc in %s.", __func__));
158 	no = cp->index;
159 
160 	G_SHSEC_DEBUG(0, "Disk %s removed from %s.", cp->provider->name,
161 	    sc->sc_name);
162 
163 	sc->sc_disks[no] = NULL;
164 	if (sc->sc_provider != NULL) {
165 		g_wither_provider(sc->sc_provider, ENXIO);
166 		sc->sc_provider = NULL;
167 		G_SHSEC_DEBUG(0, "Device %s removed.", sc->sc_name);
168 	}
169 
170 	if (cp->acr > 0 || cp->acw > 0 || cp->ace > 0)
171 		return;
172 	g_detach(cp);
173 	g_destroy_consumer(cp);
174 }
175 
176 static void
177 g_shsec_orphan(struct g_consumer *cp)
178 {
179 	struct g_shsec_softc *sc;
180 	struct g_geom *gp;
181 
182 	g_topology_assert();
183 	gp = cp->geom;
184 	sc = gp->softc;
185 	if (sc == NULL)
186 		return;
187 
188 	g_shsec_remove_disk(cp);
189 	/* If there are no valid disks anymore, remove device. */
190 	if (LIST_EMPTY(&gp->consumer))
191 		g_shsec_destroy(sc, 1);
192 }
193 
194 static int
195 g_shsec_access(struct g_provider *pp, int dr, int dw, int de)
196 {
197 	struct g_consumer *cp1, *cp2, *tmp;
198 	struct g_shsec_softc *sc;
199 	struct g_geom *gp;
200 	int error;
201 
202 	gp = pp->geom;
203 	sc = gp->softc;
204 
205 	/* On first open, grab an extra "exclusive" bit */
206 	if (pp->acr == 0 && pp->acw == 0 && pp->ace == 0)
207 		de++;
208 	/* ... and let go of it on last close */
209 	if ((pp->acr + dr) == 0 && (pp->acw + dw) == 0 && (pp->ace + de) == 0)
210 		de--;
211 
212 	error = ENXIO;
213 	LIST_FOREACH_SAFE(cp1, &gp->consumer, consumer, tmp) {
214 		error = g_access(cp1, dr, dw, de);
215 		if (error != 0)
216 			goto fail;
217 		if (cp1->acr == 0 && cp1->acw == 0 && cp1->ace == 0 &&
218 		    cp1->flags & G_CF_ORPHAN) {
219 			g_detach(cp1);
220 			g_destroy_consumer(cp1);
221 		}
222 	}
223 
224 	/* If there are no valid disks anymore, remove device. */
225 	if (LIST_EMPTY(&gp->consumer))
226 		g_shsec_destroy(sc, 1);
227 
228 	return (error);
229 
230 fail:
231 	/* If we fail here, backout all previous changes. */
232 	LIST_FOREACH(cp2, &gp->consumer, consumer) {
233 		if (cp1 == cp2)
234 			break;
235 		g_access(cp2, -dr, -dw, -de);
236 	}
237 	return (error);
238 }
239 
240 static void
241 g_shsec_xor1(uint32_t *src, uint32_t *dst, ssize_t len)
242 {
243 
244 	for (; len > 0; len -= sizeof(uint32_t), dst++)
245 		*dst = *dst ^ *src++;
246 	KASSERT(len == 0, ("len != 0 (len=%zd)", len));
247 }
248 
249 static void
250 g_shsec_done(struct bio *bp)
251 {
252 	struct bio *pbp;
253 
254 	pbp = bp->bio_parent;
255 	if (bp->bio_error == 0)
256 		G_SHSEC_LOGREQ(2, bp, "Request done.");
257 	else {
258 		G_SHSEC_LOGREQ(0, bp, "Request failed (error=%d).",
259 		    bp->bio_error);
260 		if (pbp->bio_error == 0)
261 			pbp->bio_error = bp->bio_error;
262 	}
263 	if (pbp->bio_cmd == BIO_READ) {
264 		if ((pbp->bio_pflags & G_SHSEC_BFLAG_FIRST) != 0) {
265 			bcopy(bp->bio_data, pbp->bio_data, pbp->bio_length);
266 			pbp->bio_pflags = 0;
267 		} else {
268 			g_shsec_xor1((uint32_t *)bp->bio_data,
269 			    (uint32_t *)pbp->bio_data,
270 			    (ssize_t)pbp->bio_length);
271 		}
272 	}
273 	explicit_bzero(bp->bio_data, bp->bio_length);
274 	uma_zfree(g_shsec_zone, bp->bio_data);
275 	g_destroy_bio(bp);
276 	pbp->bio_inbed++;
277 	if (pbp->bio_children == pbp->bio_inbed) {
278 		pbp->bio_completed = pbp->bio_length;
279 		g_io_deliver(pbp, pbp->bio_error);
280 	}
281 }
282 
283 static void
284 g_shsec_xor2(uint32_t *rand, uint32_t *dst, ssize_t len)
285 {
286 
287 	for (; len > 0; len -= sizeof(uint32_t), dst++) {
288 		*rand = arc4random();
289 		*dst = *dst ^ *rand++;
290 	}
291 	KASSERT(len == 0, ("len != 0 (len=%zd)", len));
292 }
293 
294 static void
295 g_shsec_start(struct bio *bp)
296 {
297 	TAILQ_HEAD(, bio) queue = TAILQ_HEAD_INITIALIZER(queue);
298 	struct g_shsec_softc *sc;
299 	struct bio *cbp;
300 	uint32_t *dst;
301 	ssize_t len;
302 	u_int no;
303 	int error;
304 
305 	sc = bp->bio_to->geom->softc;
306 	/*
307 	 * If sc == NULL, provider's error should be set and g_shsec_start()
308 	 * should not be called at all.
309 	 */
310 	KASSERT(sc != NULL,
311 	    ("Provider's error should be set (error=%d)(device=%s).",
312 	    bp->bio_to->error, bp->bio_to->name));
313 
314 	G_SHSEC_LOGREQ(2, bp, "Request received.");
315 
316 	switch (bp->bio_cmd) {
317 	case BIO_READ:
318 	case BIO_WRITE:
319 	case BIO_FLUSH:
320 	case BIO_SPEEDUP:
321 		/*
322 		 * Only those requests are supported.
323 		 */
324 		break;
325 	case BIO_DELETE:
326 	case BIO_GETATTR:
327 		/* To which provider it should be delivered? */
328 	default:
329 		g_io_deliver(bp, EOPNOTSUPP);
330 		return;
331 	}
332 
333 	/*
334 	 * Allocate all bios first and calculate XOR.
335 	 */
336 	dst = NULL;
337 	len = bp->bio_length;
338 	if (bp->bio_cmd == BIO_READ)
339 		bp->bio_pflags = G_SHSEC_BFLAG_FIRST;
340 	for (no = 0; no < sc->sc_ndisks; no++) {
341 		cbp = g_clone_bio(bp);
342 		if (cbp == NULL) {
343 			error = ENOMEM;
344 			goto failure;
345 		}
346 		TAILQ_INSERT_TAIL(&queue, cbp, bio_queue);
347 
348 		/*
349 		 * Fill in the component buf structure.
350 		 */
351 		cbp->bio_done = g_shsec_done;
352 		cbp->bio_data = uma_zalloc(g_shsec_zone, M_NOWAIT);
353 		if (cbp->bio_data == NULL) {
354 			g_shsec_alloc_failed++;
355 			error = ENOMEM;
356 			goto failure;
357 		}
358 		cbp->bio_caller2 = sc->sc_disks[no];
359 		if (bp->bio_cmd == BIO_WRITE) {
360 			if (no == 0) {
361 				dst = (uint32_t *)cbp->bio_data;
362 				bcopy(bp->bio_data, dst, len);
363 			} else {
364 				g_shsec_xor2((uint32_t *)cbp->bio_data, dst,
365 				    len);
366 			}
367 		}
368 	}
369 	/*
370 	 * Fire off all allocated requests!
371 	 */
372 	while ((cbp = TAILQ_FIRST(&queue)) != NULL) {
373 		struct g_consumer *cp;
374 
375 		TAILQ_REMOVE(&queue, cbp, bio_queue);
376 		cp = cbp->bio_caller2;
377 		cbp->bio_caller2 = NULL;
378 		cbp->bio_to = cp->provider;
379 		G_SHSEC_LOGREQ(2, cbp, "Sending request.");
380 		g_io_request(cbp, cp);
381 	}
382 	return;
383 failure:
384 	while ((cbp = TAILQ_FIRST(&queue)) != NULL) {
385 		TAILQ_REMOVE(&queue, cbp, bio_queue);
386 		bp->bio_children--;
387 		if (cbp->bio_data != NULL) {
388 			explicit_bzero(cbp->bio_data, cbp->bio_length);
389 			uma_zfree(g_shsec_zone, cbp->bio_data);
390 		}
391 		g_destroy_bio(cbp);
392 	}
393 	if (bp->bio_error == 0)
394 		bp->bio_error = error;
395 	g_io_deliver(bp, bp->bio_error);
396 }
397 
398 static void
399 g_shsec_check_and_run(struct g_shsec_softc *sc)
400 {
401 	off_t mediasize, ms;
402 	u_int no, sectorsize = 0;
403 
404 	if (g_shsec_nvalid(sc) != sc->sc_ndisks)
405 		return;
406 
407 	sc->sc_provider = g_new_providerf(sc->sc_geom, "shsec/%s", sc->sc_name);
408 	/*
409 	 * Find the smallest disk.
410 	 */
411 	mediasize = sc->sc_disks[0]->provider->mediasize;
412 	mediasize -= sc->sc_disks[0]->provider->sectorsize;
413 	sectorsize = sc->sc_disks[0]->provider->sectorsize;
414 	for (no = 1; no < sc->sc_ndisks; no++) {
415 		ms = sc->sc_disks[no]->provider->mediasize;
416 		ms -= sc->sc_disks[no]->provider->sectorsize;
417 		if (ms < mediasize)
418 			mediasize = ms;
419 		sectorsize = lcm(sectorsize,
420 		    sc->sc_disks[no]->provider->sectorsize);
421 	}
422 	sc->sc_provider->sectorsize = sectorsize;
423 	sc->sc_provider->mediasize = mediasize;
424 	g_error_provider(sc->sc_provider, 0);
425 
426 	G_SHSEC_DEBUG(0, "Device %s activated.", sc->sc_name);
427 }
428 
429 static int
430 g_shsec_read_metadata(struct g_consumer *cp, struct g_shsec_metadata *md)
431 {
432 	struct g_provider *pp;
433 	u_char *buf;
434 	int error;
435 
436 	g_topology_assert();
437 
438 	error = g_access(cp, 1, 0, 0);
439 	if (error != 0)
440 		return (error);
441 	pp = cp->provider;
442 	g_topology_unlock();
443 	buf = g_read_data(cp, pp->mediasize - pp->sectorsize, pp->sectorsize,
444 	    &error);
445 	g_topology_lock();
446 	g_access(cp, -1, 0, 0);
447 	if (buf == NULL)
448 		return (error);
449 
450 	/* Decode metadata. */
451 	shsec_metadata_decode(buf, md);
452 	g_free(buf);
453 
454 	return (0);
455 }
456 
457 /*
458  * Add disk to given device.
459  */
460 static int
461 g_shsec_add_disk(struct g_shsec_softc *sc, struct g_provider *pp, u_int no)
462 {
463 	struct g_consumer *cp, *fcp;
464 	struct g_geom *gp;
465 	struct g_shsec_metadata md;
466 	int error;
467 
468 	/* Metadata corrupted? */
469 	if (no >= sc->sc_ndisks)
470 		return (EINVAL);
471 
472 	/* Check if disk is not already attached. */
473 	if (sc->sc_disks[no] != NULL)
474 		return (EEXIST);
475 
476 	gp = sc->sc_geom;
477 	fcp = LIST_FIRST(&gp->consumer);
478 
479 	cp = g_new_consumer(gp);
480 	error = g_attach(cp, pp);
481 	if (error != 0) {
482 		g_destroy_consumer(cp);
483 		return (error);
484 	}
485 
486 	if (fcp != NULL && (fcp->acr > 0 || fcp->acw > 0 || fcp->ace > 0)) {
487 		error = g_access(cp, fcp->acr, fcp->acw, fcp->ace);
488 		if (error != 0) {
489 			g_detach(cp);
490 			g_destroy_consumer(cp);
491 			return (error);
492 		}
493 	}
494 
495 	/* Reread metadata. */
496 	error = g_shsec_read_metadata(cp, &md);
497 	if (error != 0)
498 		goto fail;
499 
500 	if (strcmp(md.md_magic, G_SHSEC_MAGIC) != 0 ||
501 	    strcmp(md.md_name, sc->sc_name) != 0 || md.md_id != sc->sc_id) {
502 		G_SHSEC_DEBUG(0, "Metadata on %s changed.", pp->name);
503 		goto fail;
504 	}
505 
506 	cp->private = sc;
507 	cp->index = no;
508 	sc->sc_disks[no] = cp;
509 
510 	G_SHSEC_DEBUG(0, "Disk %s attached to %s.", pp->name, sc->sc_name);
511 
512 	g_shsec_check_and_run(sc);
513 
514 	return (0);
515 fail:
516 	if (fcp != NULL && (fcp->acr > 0 || fcp->acw > 0 || fcp->ace > 0))
517 		g_access(cp, -fcp->acr, -fcp->acw, -fcp->ace);
518 	g_detach(cp);
519 	g_destroy_consumer(cp);
520 	return (error);
521 }
522 
523 static struct g_geom *
524 g_shsec_create(struct g_class *mp, const struct g_shsec_metadata *md)
525 {
526 	struct g_shsec_softc *sc;
527 	struct g_geom *gp;
528 	u_int no;
529 
530 	G_SHSEC_DEBUG(1, "Creating device %s (id=%u).", md->md_name, md->md_id);
531 
532 	/* Two disks is minimum. */
533 	if (md->md_all < 2) {
534 		G_SHSEC_DEBUG(0, "Too few disks defined for %s.", md->md_name);
535 		return (NULL);
536 	}
537 
538 	/* Check for duplicate unit */
539 	LIST_FOREACH(gp, &mp->geom, geom) {
540 		sc = gp->softc;
541 		if (sc != NULL && strcmp(sc->sc_name, md->md_name) == 0) {
542 			G_SHSEC_DEBUG(0, "Device %s already configured.",
543 			    sc->sc_name);
544 			return (NULL);
545 		}
546 	}
547 	gp = g_new_geomf(mp, "%s", md->md_name);
548 	sc = malloc(sizeof(*sc), M_SHSEC, M_WAITOK | M_ZERO);
549 	gp->start = g_shsec_start;
550 	gp->spoiled = g_shsec_orphan;
551 	gp->orphan = g_shsec_orphan;
552 	gp->access = g_shsec_access;
553 	gp->dumpconf = g_shsec_dumpconf;
554 
555 	sc->sc_id = md->md_id;
556 	sc->sc_ndisks = md->md_all;
557 	sc->sc_disks = malloc(sizeof(struct g_consumer *) * sc->sc_ndisks,
558 	    M_SHSEC, M_WAITOK | M_ZERO);
559 	for (no = 0; no < sc->sc_ndisks; no++)
560 		sc->sc_disks[no] = NULL;
561 
562 	gp->softc = sc;
563 	sc->sc_geom = gp;
564 	sc->sc_provider = NULL;
565 
566 	G_SHSEC_DEBUG(0, "Device %s created (id=%u).", sc->sc_name, sc->sc_id);
567 
568 	return (gp);
569 }
570 
571 static int
572 g_shsec_destroy(struct g_shsec_softc *sc, boolean_t force)
573 {
574 	struct g_provider *pp;
575 	struct g_geom *gp;
576 	u_int no;
577 
578 	g_topology_assert();
579 
580 	if (sc == NULL)
581 		return (ENXIO);
582 
583 	pp = sc->sc_provider;
584 	if (pp != NULL && (pp->acr != 0 || pp->acw != 0 || pp->ace != 0)) {
585 		if (force) {
586 			G_SHSEC_DEBUG(0, "Device %s is still open, so it "
587 			    "can't be definitely removed.", pp->name);
588 		} else {
589 			G_SHSEC_DEBUG(1,
590 			    "Device %s is still open (r%dw%de%d).", pp->name,
591 			    pp->acr, pp->acw, pp->ace);
592 			return (EBUSY);
593 		}
594 	}
595 
596 	for (no = 0; no < sc->sc_ndisks; no++) {
597 		if (sc->sc_disks[no] != NULL)
598 			g_shsec_remove_disk(sc->sc_disks[no]);
599 	}
600 
601 	gp = sc->sc_geom;
602 	gp->softc = NULL;
603 	KASSERT(sc->sc_provider == NULL, ("Provider still exists? (device=%s)",
604 	    gp->name));
605 	free(sc->sc_disks, M_SHSEC);
606 	free(sc, M_SHSEC);
607 
608 	pp = LIST_FIRST(&gp->provider);
609 	if (pp == NULL || (pp->acr == 0 && pp->acw == 0 && pp->ace == 0))
610 		G_SHSEC_DEBUG(0, "Device %s destroyed.", gp->name);
611 
612 	g_wither_geom(gp, ENXIO);
613 
614 	return (0);
615 }
616 
617 static int
618 g_shsec_destroy_geom(struct gctl_req *req __unused, struct g_class *mp __unused,
619     struct g_geom *gp)
620 {
621 	struct g_shsec_softc *sc;
622 
623 	sc = gp->softc;
624 	return (g_shsec_destroy(sc, 0));
625 }
626 
627 static struct g_geom *
628 g_shsec_taste(struct g_class *mp, struct g_provider *pp, int flags __unused)
629 {
630 	struct g_shsec_metadata md;
631 	struct g_shsec_softc *sc;
632 	struct g_consumer *cp;
633 	struct g_geom *gp;
634 	int error;
635 
636 	g_trace(G_T_TOPOLOGY, "%s(%s, %s)", __func__, mp->name, pp->name);
637 	g_topology_assert();
638 
639 	/* Skip providers that are already open for writing. */
640 	if (pp->acw > 0)
641 		return (NULL);
642 
643 	G_SHSEC_DEBUG(3, "Tasting %s.", pp->name);
644 
645 	gp = g_new_geomf(mp, "shsec:taste");
646 	gp->start = g_shsec_start;
647 	gp->access = g_shsec_access;
648 	gp->orphan = g_shsec_orphan;
649 	cp = g_new_consumer(gp);
650 	error = g_attach(cp, pp);
651 	if (error == 0) {
652 		error = g_shsec_read_metadata(cp, &md);
653 		g_detach(cp);
654 	}
655 	g_destroy_consumer(cp);
656 	g_destroy_geom(gp);
657 	if (error != 0)
658 		return (NULL);
659 	gp = NULL;
660 
661 	if (strcmp(md.md_magic, G_SHSEC_MAGIC) != 0)
662 		return (NULL);
663 	if (md.md_version > G_SHSEC_VERSION) {
664 		G_SHSEC_DEBUG(0, "Kernel module is too old to handle %s.\n",
665 		    pp->name);
666 		return (NULL);
667 	}
668 	/*
669 	 * Backward compatibility:
670 	 */
671 	/* There was no md_provsize field in earlier versions of metadata. */
672 	if (md.md_version < 1)
673 		md.md_provsize = pp->mediasize;
674 
675 	if (md.md_provider[0] != '\0' &&
676 	    !g_compare_names(md.md_provider, pp->name))
677 		return (NULL);
678 	if (md.md_provsize != pp->mediasize)
679 		return (NULL);
680 
681 	/*
682 	 * Let's check if device already exists.
683 	 */
684 	sc = NULL;
685 	LIST_FOREACH(gp, &mp->geom, geom) {
686 		sc = gp->softc;
687 		if (sc == NULL)
688 			continue;
689 		if (strcmp(md.md_name, sc->sc_name) != 0)
690 			continue;
691 		if (md.md_id != sc->sc_id)
692 			continue;
693 		break;
694 	}
695 	if (gp != NULL) {
696 		G_SHSEC_DEBUG(1, "Adding disk %s to %s.", pp->name, gp->name);
697 		error = g_shsec_add_disk(sc, pp, md.md_no);
698 		if (error != 0) {
699 			G_SHSEC_DEBUG(0, "Cannot add disk %s to %s (error=%d).",
700 			    pp->name, gp->name, error);
701 			return (NULL);
702 		}
703 	} else {
704 		gp = g_shsec_create(mp, &md);
705 		if (gp == NULL) {
706 			G_SHSEC_DEBUG(0, "Cannot create device %s.", md.md_name);
707 			return (NULL);
708 		}
709 		sc = gp->softc;
710 		G_SHSEC_DEBUG(1, "Adding disk %s to %s.", pp->name, gp->name);
711 		error = g_shsec_add_disk(sc, pp, md.md_no);
712 		if (error != 0) {
713 			G_SHSEC_DEBUG(0, "Cannot add disk %s to %s (error=%d).",
714 			    pp->name, gp->name, error);
715 			g_shsec_destroy(sc, 1);
716 			return (NULL);
717 		}
718 	}
719 	return (gp);
720 }
721 
722 static struct g_shsec_softc *
723 g_shsec_find_device(struct g_class *mp, const char *name)
724 {
725 	struct g_shsec_softc *sc;
726 	struct g_geom *gp;
727 
728 	LIST_FOREACH(gp, &mp->geom, geom) {
729 		sc = gp->softc;
730 		if (sc == NULL)
731 			continue;
732 		if (strcmp(sc->sc_name, name) == 0)
733 			return (sc);
734 	}
735 	return (NULL);
736 }
737 
738 static void
739 g_shsec_ctl_destroy(struct gctl_req *req, struct g_class *mp)
740 {
741 	struct g_shsec_softc *sc;
742 	int *force, *nargs, error;
743 	const char *name;
744 	char param[16];
745 	u_int i;
746 
747 	g_topology_assert();
748 
749 	nargs = gctl_get_paraml(req, "nargs", sizeof(*nargs));
750 	if (nargs == NULL) {
751 		gctl_error(req, "No '%s' argument.", "nargs");
752 		return;
753 	}
754 	if (*nargs <= 0) {
755 		gctl_error(req, "Missing device(s).");
756 		return;
757 	}
758 	force = gctl_get_paraml(req, "force", sizeof(*force));
759 	if (force == NULL) {
760 		gctl_error(req, "No '%s' argument.", "force");
761 		return;
762 	}
763 
764 	for (i = 0; i < (u_int)*nargs; i++) {
765 		snprintf(param, sizeof(param), "arg%u", i);
766 		name = gctl_get_asciiparam(req, param);
767 		if (name == NULL) {
768 			gctl_error(req, "No 'arg%u' argument.", i);
769 			return;
770 		}
771 		sc = g_shsec_find_device(mp, name);
772 		if (sc == NULL) {
773 			gctl_error(req, "No such device: %s.", name);
774 			return;
775 		}
776 		error = g_shsec_destroy(sc, *force);
777 		if (error != 0) {
778 			gctl_error(req, "Cannot destroy device %s (error=%d).",
779 			    sc->sc_name, error);
780 			return;
781 		}
782 	}
783 }
784 
785 static void
786 g_shsec_config(struct gctl_req *req, struct g_class *mp, const char *verb)
787 {
788 	uint32_t *version;
789 
790 	g_topology_assert();
791 
792 	version = gctl_get_paraml(req, "version", sizeof(*version));
793 	if (version == NULL) {
794 		gctl_error(req, "No '%s' argument.", "version");
795 		return;
796 	}
797 	if (*version != G_SHSEC_VERSION) {
798 		gctl_error(req, "Userland and kernel parts are out of sync.");
799 		return;
800 	}
801 
802 	if (strcmp(verb, "stop") == 0) {
803 		g_shsec_ctl_destroy(req, mp);
804 		return;
805 	}
806 
807 	gctl_error(req, "Unknown verb.");
808 }
809 
810 static void
811 g_shsec_dumpconf(struct sbuf *sb, const char *indent, struct g_geom *gp,
812     struct g_consumer *cp, struct g_provider *pp)
813 {
814 	struct g_shsec_softc *sc;
815 
816 	sc = gp->softc;
817 	if (sc == NULL)
818 		return;
819 	if (pp != NULL) {
820 		/* Nothing here. */
821 	} else if (cp != NULL) {
822 		sbuf_printf(sb, "%s<Number>%u</Number>\n", indent,
823 		    (u_int)cp->index);
824 	} else {
825 		sbuf_printf(sb, "%s<ID>%u</ID>\n", indent, (u_int)sc->sc_id);
826 		sbuf_printf(sb, "%s<Status>Total=%u, Online=%u</Status>\n",
827 		    indent, sc->sc_ndisks, g_shsec_nvalid(sc));
828 		sbuf_printf(sb, "%s<State>", indent);
829 		if (sc->sc_provider != NULL && sc->sc_provider->error == 0)
830 			sbuf_printf(sb, "UP");
831 		else
832 			sbuf_printf(sb, "DOWN");
833 		sbuf_printf(sb, "</State>\n");
834 	}
835 }
836 
837 DECLARE_GEOM_CLASS(g_shsec_class, g_shsec);
838 MODULE_VERSION(geom_shsec, 0);
839