xref: /linux/drivers/md/dm-integrity.c (revision 4f372263ef92ed2af55a8c226750b72021ff8d0f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2016-2017 Red Hat, Inc. All rights reserved.
4  * Copyright (C) 2016-2017 Milan Broz
5  * Copyright (C) 2016-2017 Mikulas Patocka
6  *
7  * This file is released under the GPL.
8  */
9 
10 #include "dm-bio-record.h"
11 
12 #include <linux/compiler.h>
13 #include <linux/module.h>
14 #include <linux/device-mapper.h>
15 #include <linux/dm-io.h>
16 #include <linux/vmalloc.h>
17 #include <linux/sort.h>
18 #include <linux/rbtree.h>
19 #include <linux/delay.h>
20 #include <linux/random.h>
21 #include <linux/reboot.h>
22 #include <crypto/hash.h>
23 #include <crypto/skcipher.h>
24 #include <crypto/utils.h>
25 #include <linux/async_tx.h>
26 #include <linux/dm-bufio.h>
27 
28 #include "dm-audit.h"
29 
30 #define DM_MSG_PREFIX "integrity"
31 
32 #define DEFAULT_INTERLEAVE_SECTORS	32768
33 #define DEFAULT_JOURNAL_SIZE_FACTOR	7
34 #define DEFAULT_SECTORS_PER_BITMAP_BIT	32768
35 #define DEFAULT_BUFFER_SECTORS		128
36 #define DEFAULT_JOURNAL_WATERMARK	50
37 #define DEFAULT_SYNC_MSEC		10000
38 #define DEFAULT_MAX_JOURNAL_SECTORS	(IS_ENABLED(CONFIG_64BIT) ? 131072 : 8192)
39 #define MIN_LOG2_INTERLEAVE_SECTORS	3
40 #define MAX_LOG2_INTERLEAVE_SECTORS	31
41 #define METADATA_WORKQUEUE_MAX_ACTIVE	16
42 #define RECALC_SECTORS			(IS_ENABLED(CONFIG_64BIT) ? 32768 : 2048)
43 #define RECALC_WRITE_SUPER		16
44 #define BITMAP_BLOCK_SIZE		4096	/* don't change it */
45 #define BITMAP_FLUSH_INTERVAL		(10 * HZ)
46 #define DISCARD_FILLER			0xf6
47 #define SALT_SIZE			16
48 #define RECHECK_POOL_SIZE		256
49 
50 /*
51  * Warning - DEBUG_PRINT prints security-sensitive data to the log,
52  * so it should not be enabled in the official kernel
53  */
54 //#define DEBUG_PRINT
55 //#define INTERNAL_VERIFY
56 
57 /*
58  * On disk structures
59  */
60 
61 #define SB_MAGIC			"integrt"
62 #define SB_VERSION_1			1
63 #define SB_VERSION_2			2
64 #define SB_VERSION_3			3
65 #define SB_VERSION_4			4
66 #define SB_VERSION_5			5
67 #define SB_VERSION_6			6
68 #define SB_SECTORS			8
69 #define MAX_SECTORS_PER_BLOCK		8
70 
71 struct superblock {
72 	__u8 magic[8];
73 	__u8 version;
74 	__u8 log2_interleave_sectors;
75 	__le16 integrity_tag_size;
76 	__le32 journal_sections;
77 	__le64 provided_data_sectors;	/* userspace uses this value */
78 	__le32 flags;
79 	__u8 log2_sectors_per_block;
80 	__u8 log2_blocks_per_bitmap_bit;
81 	__u8 pad[2];
82 	__le64 recalc_sector;
83 	__u8 pad2[8];
84 	__u8 salt[SALT_SIZE];
85 };
86 
87 #define SB_FLAG_HAVE_JOURNAL_MAC	0x1
88 #define SB_FLAG_RECALCULATING		0x2
89 #define SB_FLAG_DIRTY_BITMAP		0x4
90 #define SB_FLAG_FIXED_PADDING		0x8
91 #define SB_FLAG_FIXED_HMAC		0x10
92 #define SB_FLAG_INLINE			0x20
93 
94 #define	JOURNAL_ENTRY_ROUNDUP		8
95 
96 typedef __le64 commit_id_t;
97 #define JOURNAL_MAC_PER_SECTOR		8
98 
99 struct journal_entry {
100 	union {
101 		struct {
102 			__le32 sector_lo;
103 			__le32 sector_hi;
104 		} s;
105 		__le64 sector;
106 	} u;
107 	commit_id_t last_bytes[];
108 	/* __u8 tag[0]; */
109 };
110 
111 #define journal_entry_tag(ic, je)		((__u8 *)&(je)->last_bytes[(ic)->sectors_per_block])
112 
113 #if BITS_PER_LONG == 64
114 #define journal_entry_set_sector(je, x)		do { smp_wmb(); WRITE_ONCE((je)->u.sector, cpu_to_le64(x)); } while (0)
115 #else
116 #define journal_entry_set_sector(je, x)		do { (je)->u.s.sector_lo = cpu_to_le32(x); smp_wmb(); WRITE_ONCE((je)->u.s.sector_hi, cpu_to_le32((x) >> 32)); } while (0)
117 #endif
118 #define journal_entry_get_sector(je)		le64_to_cpu((je)->u.sector)
119 #define journal_entry_is_unused(je)		((je)->u.s.sector_hi == cpu_to_le32(-1))
120 #define journal_entry_set_unused(je)		((je)->u.s.sector_hi = cpu_to_le32(-1))
121 #define journal_entry_is_inprogress(je)		((je)->u.s.sector_hi == cpu_to_le32(-2))
122 #define journal_entry_set_inprogress(je)	((je)->u.s.sector_hi = cpu_to_le32(-2))
123 
124 #define JOURNAL_BLOCK_SECTORS		8
125 #define JOURNAL_SECTOR_DATA		((1 << SECTOR_SHIFT) - sizeof(commit_id_t))
126 #define JOURNAL_MAC_SIZE		(JOURNAL_MAC_PER_SECTOR * JOURNAL_BLOCK_SECTORS)
127 
128 struct journal_sector {
129 	struct_group(sectors,
130 		__u8 entries[JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR];
131 		__u8 mac[JOURNAL_MAC_PER_SECTOR];
132 	);
133 	commit_id_t commit_id;
134 };
135 
136 #define MAX_TAG_SIZE			(JOURNAL_SECTOR_DATA - JOURNAL_MAC_PER_SECTOR - offsetof(struct journal_entry, last_bytes[MAX_SECTORS_PER_BLOCK]))
137 
138 #define METADATA_PADDING_SECTORS	8
139 
140 #define N_COMMIT_IDS			4
141 
142 static unsigned char prev_commit_seq(unsigned char seq)
143 {
144 	return (seq + N_COMMIT_IDS - 1) % N_COMMIT_IDS;
145 }
146 
147 static unsigned char next_commit_seq(unsigned char seq)
148 {
149 	return (seq + 1) % N_COMMIT_IDS;
150 }
151 
152 /*
153  * In-memory structures
154  */
155 
156 struct journal_node {
157 	struct rb_node node;
158 	sector_t sector;
159 };
160 
161 struct alg_spec {
162 	char *alg_string;
163 	char *key_string;
164 	__u8 *key;
165 	unsigned int key_size;
166 };
167 
168 struct dm_integrity_c {
169 	struct dm_dev *dev;
170 	struct dm_dev *meta_dev;
171 	unsigned int tag_size;
172 	__s8 log2_tag_size;
173 	unsigned int tuple_size;
174 	sector_t start;
175 	mempool_t journal_io_mempool;
176 	struct dm_io_client *io;
177 	struct dm_bufio_client *bufio;
178 	struct workqueue_struct *metadata_wq;
179 	struct superblock *sb;
180 	unsigned int journal_pages;
181 	unsigned int n_bitmap_blocks;
182 
183 	struct page_list *journal;
184 	struct page_list *journal_io;
185 	struct page_list *journal_xor;
186 	struct page_list *recalc_bitmap;
187 	struct page_list *may_write_bitmap;
188 	struct bitmap_block_status *bbs;
189 	unsigned int bitmap_flush_interval;
190 	int synchronous_mode;
191 	struct bio_list synchronous_bios;
192 	struct delayed_work bitmap_flush_work;
193 
194 	struct crypto_skcipher *journal_crypt;
195 	struct scatterlist **journal_scatterlist;
196 	struct scatterlist **journal_io_scatterlist;
197 	struct skcipher_request **sk_requests;
198 
199 	struct crypto_shash *journal_mac;
200 
201 	struct journal_node *journal_tree;
202 	struct rb_root journal_tree_root;
203 
204 	sector_t provided_data_sectors;
205 
206 	unsigned short journal_entry_size;
207 	unsigned char journal_entries_per_sector;
208 	unsigned char journal_section_entries;
209 	unsigned short journal_section_sectors;
210 	unsigned int journal_sections;
211 	unsigned int journal_entries;
212 	sector_t data_device_sectors;
213 	sector_t meta_device_sectors;
214 	unsigned int initial_sectors;
215 	unsigned int metadata_run;
216 	__s8 log2_metadata_run;
217 	__u8 log2_buffer_sectors;
218 	__u8 sectors_per_block;
219 	__u8 log2_blocks_per_bitmap_bit;
220 
221 	unsigned char mode;
222 
223 	int failed;
224 
225 	struct crypto_shash *internal_hash;
226 
227 	struct dm_target *ti;
228 
229 	/* these variables are locked with endio_wait.lock */
230 	struct rb_root in_progress;
231 	struct list_head wait_list;
232 	wait_queue_head_t endio_wait;
233 	struct workqueue_struct *wait_wq;
234 	struct workqueue_struct *offload_wq;
235 
236 	unsigned char commit_seq;
237 	commit_id_t commit_ids[N_COMMIT_IDS];
238 
239 	unsigned int committed_section;
240 	unsigned int n_committed_sections;
241 
242 	unsigned int uncommitted_section;
243 	unsigned int n_uncommitted_sections;
244 
245 	unsigned int free_section;
246 	unsigned char free_section_entry;
247 	unsigned int free_sectors;
248 
249 	unsigned int free_sectors_threshold;
250 
251 	struct workqueue_struct *commit_wq;
252 	struct work_struct commit_work;
253 
254 	struct workqueue_struct *writer_wq;
255 	struct work_struct writer_work;
256 
257 	struct workqueue_struct *recalc_wq;
258 	struct work_struct recalc_work;
259 
260 	struct bio_list flush_bio_list;
261 
262 	unsigned long autocommit_jiffies;
263 	struct timer_list autocommit_timer;
264 	unsigned int autocommit_msec;
265 
266 	wait_queue_head_t copy_to_journal_wait;
267 
268 	struct completion crypto_backoff;
269 
270 	bool wrote_to_journal;
271 	bool journal_uptodate;
272 	bool just_formatted;
273 	bool recalculate_flag;
274 	bool reset_recalculate_flag;
275 	bool discard;
276 	bool fix_padding;
277 	bool fix_hmac;
278 	bool legacy_recalculate;
279 
280 	struct alg_spec internal_hash_alg;
281 	struct alg_spec journal_crypt_alg;
282 	struct alg_spec journal_mac_alg;
283 
284 	atomic64_t number_of_mismatches;
285 
286 	mempool_t recheck_pool;
287 	struct bio_set recheck_bios;
288 	struct bio_set recalc_bios;
289 
290 	struct notifier_block reboot_notifier;
291 };
292 
293 struct dm_integrity_range {
294 	sector_t logical_sector;
295 	sector_t n_sectors;
296 	bool waiting;
297 	union {
298 		struct rb_node node;
299 		struct {
300 			struct task_struct *task;
301 			struct list_head wait_entry;
302 		};
303 	};
304 };
305 
306 struct dm_integrity_io {
307 	struct work_struct work;
308 
309 	struct dm_integrity_c *ic;
310 	enum req_op op;
311 	bool fua;
312 
313 	struct dm_integrity_range range;
314 
315 	sector_t metadata_block;
316 	unsigned int metadata_offset;
317 
318 	atomic_t in_flight;
319 	blk_status_t bi_status;
320 
321 	struct completion *completion;
322 
323 	struct dm_bio_details bio_details;
324 
325 	char *integrity_payload;
326 	unsigned payload_len;
327 	bool integrity_payload_from_mempool;
328 	bool integrity_range_locked;
329 };
330 
331 struct journal_completion {
332 	struct dm_integrity_c *ic;
333 	atomic_t in_flight;
334 	struct completion comp;
335 };
336 
337 struct journal_io {
338 	struct dm_integrity_range range;
339 	struct journal_completion *comp;
340 };
341 
342 struct bitmap_block_status {
343 	struct work_struct work;
344 	struct dm_integrity_c *ic;
345 	unsigned int idx;
346 	unsigned long *bitmap;
347 	struct bio_list bio_queue;
348 	spinlock_t bio_queue_lock;
349 
350 };
351 
352 static struct kmem_cache *journal_io_cache;
353 
354 #define JOURNAL_IO_MEMPOOL	32
355 
356 #ifdef DEBUG_PRINT
357 #define DEBUG_print(x, ...)			printk(KERN_DEBUG x, ##__VA_ARGS__)
358 #define DEBUG_bytes(bytes, len, msg, ...)	printk(KERN_DEBUG msg "%s%*ph\n", ##__VA_ARGS__, \
359 						       len ? ": " : "", len, bytes)
360 #else
361 #define DEBUG_print(x, ...)			do { } while (0)
362 #define DEBUG_bytes(bytes, len, msg, ...)	do { } while (0)
363 #endif
364 
365 static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map);
366 static int dm_integrity_map_inline(struct dm_integrity_io *dio, bool from_map);
367 static void integrity_bio_wait(struct work_struct *w);
368 static void dm_integrity_dtr(struct dm_target *ti);
369 
370 static void dm_integrity_io_error(struct dm_integrity_c *ic, const char *msg, int err)
371 {
372 	if (err == -EILSEQ)
373 		atomic64_inc(&ic->number_of_mismatches);
374 	if (!cmpxchg(&ic->failed, 0, err))
375 		DMERR("Error on %s: %d", msg, err);
376 }
377 
378 static int dm_integrity_failed(struct dm_integrity_c *ic)
379 {
380 	return READ_ONCE(ic->failed);
381 }
382 
383 static bool dm_integrity_disable_recalculate(struct dm_integrity_c *ic)
384 {
385 	if (ic->legacy_recalculate)
386 		return false;
387 	if (!(ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) ?
388 	    ic->internal_hash_alg.key || ic->journal_mac_alg.key :
389 	    ic->internal_hash_alg.key && !ic->journal_mac_alg.key)
390 		return true;
391 	return false;
392 }
393 
394 static commit_id_t dm_integrity_commit_id(struct dm_integrity_c *ic, unsigned int i,
395 					  unsigned int j, unsigned char seq)
396 {
397 	/*
398 	 * Xor the number with section and sector, so that if a piece of
399 	 * journal is written at wrong place, it is detected.
400 	 */
401 	return ic->commit_ids[seq] ^ cpu_to_le64(((__u64)i << 32) ^ j);
402 }
403 
404 static void get_area_and_offset(struct dm_integrity_c *ic, sector_t data_sector,
405 				sector_t *area, sector_t *offset)
406 {
407 	if (!ic->meta_dev) {
408 		__u8 log2_interleave_sectors = ic->sb->log2_interleave_sectors;
409 		*area = data_sector >> log2_interleave_sectors;
410 		*offset = (unsigned int)data_sector & ((1U << log2_interleave_sectors) - 1);
411 	} else {
412 		*area = 0;
413 		*offset = data_sector;
414 	}
415 }
416 
417 #define sector_to_block(ic, n)						\
418 do {									\
419 	BUG_ON((n) & (unsigned int)((ic)->sectors_per_block - 1));		\
420 	(n) >>= (ic)->sb->log2_sectors_per_block;			\
421 } while (0)
422 
423 static __u64 get_metadata_sector_and_offset(struct dm_integrity_c *ic, sector_t area,
424 					    sector_t offset, unsigned int *metadata_offset)
425 {
426 	__u64 ms;
427 	unsigned int mo;
428 
429 	ms = area << ic->sb->log2_interleave_sectors;
430 	if (likely(ic->log2_metadata_run >= 0))
431 		ms += area << ic->log2_metadata_run;
432 	else
433 		ms += area * ic->metadata_run;
434 	ms >>= ic->log2_buffer_sectors;
435 
436 	sector_to_block(ic, offset);
437 
438 	if (likely(ic->log2_tag_size >= 0)) {
439 		ms += offset >> (SECTOR_SHIFT + ic->log2_buffer_sectors - ic->log2_tag_size);
440 		mo = (offset << ic->log2_tag_size) & ((1U << SECTOR_SHIFT << ic->log2_buffer_sectors) - 1);
441 	} else {
442 		ms += (__u64)offset * ic->tag_size >> (SECTOR_SHIFT + ic->log2_buffer_sectors);
443 		mo = (offset * ic->tag_size) & ((1U << SECTOR_SHIFT << ic->log2_buffer_sectors) - 1);
444 	}
445 	*metadata_offset = mo;
446 	return ms;
447 }
448 
449 static sector_t get_data_sector(struct dm_integrity_c *ic, sector_t area, sector_t offset)
450 {
451 	sector_t result;
452 
453 	if (ic->meta_dev)
454 		return offset;
455 
456 	result = area << ic->sb->log2_interleave_sectors;
457 	if (likely(ic->log2_metadata_run >= 0))
458 		result += (area + 1) << ic->log2_metadata_run;
459 	else
460 		result += (area + 1) * ic->metadata_run;
461 
462 	result += (sector_t)ic->initial_sectors + offset;
463 	result += ic->start;
464 
465 	return result;
466 }
467 
468 static void wraparound_section(struct dm_integrity_c *ic, unsigned int *sec_ptr)
469 {
470 	if (unlikely(*sec_ptr >= ic->journal_sections))
471 		*sec_ptr -= ic->journal_sections;
472 }
473 
474 static void sb_set_version(struct dm_integrity_c *ic)
475 {
476 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_INLINE))
477 		ic->sb->version = SB_VERSION_6;
478 	else if (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC))
479 		ic->sb->version = SB_VERSION_5;
480 	else if (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING))
481 		ic->sb->version = SB_VERSION_4;
482 	else if (ic->mode == 'B' || ic->sb->flags & cpu_to_le32(SB_FLAG_DIRTY_BITMAP))
483 		ic->sb->version = SB_VERSION_3;
484 	else if (ic->meta_dev || ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING))
485 		ic->sb->version = SB_VERSION_2;
486 	else
487 		ic->sb->version = SB_VERSION_1;
488 }
489 
490 static int sb_mac(struct dm_integrity_c *ic, bool wr)
491 {
492 	SHASH_DESC_ON_STACK(desc, ic->journal_mac);
493 	int r;
494 	unsigned int mac_size = crypto_shash_digestsize(ic->journal_mac);
495 	__u8 *sb = (__u8 *)ic->sb;
496 	__u8 *mac = sb + (1 << SECTOR_SHIFT) - mac_size;
497 
498 	if (sizeof(struct superblock) + mac_size > 1 << SECTOR_SHIFT ||
499 	    mac_size > HASH_MAX_DIGESTSIZE) {
500 		dm_integrity_io_error(ic, "digest is too long", -EINVAL);
501 		return -EINVAL;
502 	}
503 
504 	desc->tfm = ic->journal_mac;
505 
506 	if (likely(wr)) {
507 		r = crypto_shash_digest(desc, sb, mac - sb, mac);
508 		if (unlikely(r < 0)) {
509 			dm_integrity_io_error(ic, "crypto_shash_digest", r);
510 			return r;
511 		}
512 	} else {
513 		__u8 actual_mac[HASH_MAX_DIGESTSIZE];
514 
515 		r = crypto_shash_digest(desc, sb, mac - sb, actual_mac);
516 		if (unlikely(r < 0)) {
517 			dm_integrity_io_error(ic, "crypto_shash_digest", r);
518 			return r;
519 		}
520 		if (crypto_memneq(mac, actual_mac, mac_size)) {
521 			dm_integrity_io_error(ic, "superblock mac", -EILSEQ);
522 			dm_audit_log_target(DM_MSG_PREFIX, "mac-superblock", ic->ti, 0);
523 			return -EILSEQ;
524 		}
525 	}
526 
527 	return 0;
528 }
529 
530 static int sync_rw_sb(struct dm_integrity_c *ic, blk_opf_t opf)
531 {
532 	struct dm_io_request io_req;
533 	struct dm_io_region io_loc;
534 	const enum req_op op = opf & REQ_OP_MASK;
535 	int r;
536 
537 	io_req.bi_opf = opf;
538 	io_req.mem.type = DM_IO_KMEM;
539 	io_req.mem.ptr.addr = ic->sb;
540 	io_req.notify.fn = NULL;
541 	io_req.client = ic->io;
542 	io_loc.bdev = ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev;
543 	io_loc.sector = ic->start;
544 	io_loc.count = SB_SECTORS;
545 
546 	if (op == REQ_OP_WRITE) {
547 		sb_set_version(ic);
548 		if (ic->journal_mac && ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) {
549 			r = sb_mac(ic, true);
550 			if (unlikely(r))
551 				return r;
552 		}
553 	}
554 
555 	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
556 	if (unlikely(r))
557 		return r;
558 
559 	if (op == REQ_OP_READ) {
560 		if (ic->mode != 'R' && ic->journal_mac && ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) {
561 			r = sb_mac(ic, false);
562 			if (unlikely(r))
563 				return r;
564 		}
565 	}
566 
567 	return 0;
568 }
569 
570 #define BITMAP_OP_TEST_ALL_SET		0
571 #define BITMAP_OP_TEST_ALL_CLEAR	1
572 #define BITMAP_OP_SET			2
573 #define BITMAP_OP_CLEAR			3
574 
575 static bool block_bitmap_op(struct dm_integrity_c *ic, struct page_list *bitmap,
576 			    sector_t sector, sector_t n_sectors, int mode)
577 {
578 	unsigned long bit, end_bit, this_end_bit, page, end_page;
579 	unsigned long *data;
580 
581 	if (unlikely(((sector | n_sectors) & ((1 << ic->sb->log2_sectors_per_block) - 1)) != 0)) {
582 		DMCRIT("invalid bitmap access (%llx,%llx,%d,%d,%d)",
583 			sector,
584 			n_sectors,
585 			ic->sb->log2_sectors_per_block,
586 			ic->log2_blocks_per_bitmap_bit,
587 			mode);
588 		BUG();
589 	}
590 
591 	if (unlikely(!n_sectors))
592 		return true;
593 
594 	bit = sector >> (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
595 	end_bit = (sector + n_sectors - 1) >>
596 		(ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
597 
598 	page = bit / (PAGE_SIZE * 8);
599 	bit %= PAGE_SIZE * 8;
600 
601 	end_page = end_bit / (PAGE_SIZE * 8);
602 	end_bit %= PAGE_SIZE * 8;
603 
604 repeat:
605 	if (page < end_page)
606 		this_end_bit = PAGE_SIZE * 8 - 1;
607 	else
608 		this_end_bit = end_bit;
609 
610 	data = lowmem_page_address(bitmap[page].page);
611 
612 	if (mode == BITMAP_OP_TEST_ALL_SET) {
613 		while (bit <= this_end_bit) {
614 			if (!(bit % BITS_PER_LONG) && this_end_bit >= bit + BITS_PER_LONG - 1) {
615 				do {
616 					if (data[bit / BITS_PER_LONG] != -1)
617 						return false;
618 					bit += BITS_PER_LONG;
619 				} while (this_end_bit >= bit + BITS_PER_LONG - 1);
620 				continue;
621 			}
622 			if (!test_bit(bit, data))
623 				return false;
624 			bit++;
625 		}
626 	} else if (mode == BITMAP_OP_TEST_ALL_CLEAR) {
627 		while (bit <= this_end_bit) {
628 			if (!(bit % BITS_PER_LONG) && this_end_bit >= bit + BITS_PER_LONG - 1) {
629 				do {
630 					if (data[bit / BITS_PER_LONG] != 0)
631 						return false;
632 					bit += BITS_PER_LONG;
633 				} while (this_end_bit >= bit + BITS_PER_LONG - 1);
634 				continue;
635 			}
636 			if (test_bit(bit, data))
637 				return false;
638 			bit++;
639 		}
640 	} else if (mode == BITMAP_OP_SET) {
641 		while (bit <= this_end_bit) {
642 			if (!(bit % BITS_PER_LONG) && this_end_bit >= bit + BITS_PER_LONG - 1) {
643 				do {
644 					data[bit / BITS_PER_LONG] = -1;
645 					bit += BITS_PER_LONG;
646 				} while (this_end_bit >= bit + BITS_PER_LONG - 1);
647 				continue;
648 			}
649 			__set_bit(bit, data);
650 			bit++;
651 		}
652 	} else if (mode == BITMAP_OP_CLEAR) {
653 		if (!bit && this_end_bit == PAGE_SIZE * 8 - 1)
654 			clear_page(data);
655 		else {
656 			while (bit <= this_end_bit) {
657 				if (!(bit % BITS_PER_LONG) && this_end_bit >= bit + BITS_PER_LONG - 1) {
658 					do {
659 						data[bit / BITS_PER_LONG] = 0;
660 						bit += BITS_PER_LONG;
661 					} while (this_end_bit >= bit + BITS_PER_LONG - 1);
662 					continue;
663 				}
664 				__clear_bit(bit, data);
665 				bit++;
666 			}
667 		}
668 	} else {
669 		BUG();
670 	}
671 
672 	if (unlikely(page < end_page)) {
673 		bit = 0;
674 		page++;
675 		goto repeat;
676 	}
677 
678 	return true;
679 }
680 
681 static void block_bitmap_copy(struct dm_integrity_c *ic, struct page_list *dst, struct page_list *src)
682 {
683 	unsigned int n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE);
684 	unsigned int i;
685 
686 	for (i = 0; i < n_bitmap_pages; i++) {
687 		unsigned long *dst_data = lowmem_page_address(dst[i].page);
688 		unsigned long *src_data = lowmem_page_address(src[i].page);
689 
690 		copy_page(dst_data, src_data);
691 	}
692 }
693 
694 static struct bitmap_block_status *sector_to_bitmap_block(struct dm_integrity_c *ic, sector_t sector)
695 {
696 	unsigned int bit = sector >> (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
697 	unsigned int bitmap_block = bit / (BITMAP_BLOCK_SIZE * 8);
698 
699 	BUG_ON(bitmap_block >= ic->n_bitmap_blocks);
700 	return &ic->bbs[bitmap_block];
701 }
702 
703 static void access_journal_check(struct dm_integrity_c *ic, unsigned int section, unsigned int offset,
704 				 bool e, const char *function)
705 {
706 #if defined(CONFIG_DM_DEBUG) || defined(INTERNAL_VERIFY)
707 	unsigned int limit = e ? ic->journal_section_entries : ic->journal_section_sectors;
708 
709 	if (unlikely(section >= ic->journal_sections) ||
710 	    unlikely(offset >= limit)) {
711 		DMCRIT("%s: invalid access at (%u,%u), limit (%u,%u)",
712 		       function, section, offset, ic->journal_sections, limit);
713 		BUG();
714 	}
715 #endif
716 }
717 
718 static void page_list_location(struct dm_integrity_c *ic, unsigned int section, unsigned int offset,
719 			       unsigned int *pl_index, unsigned int *pl_offset)
720 {
721 	unsigned int sector;
722 
723 	access_journal_check(ic, section, offset, false, "page_list_location");
724 
725 	sector = section * ic->journal_section_sectors + offset;
726 
727 	*pl_index = sector >> (PAGE_SHIFT - SECTOR_SHIFT);
728 	*pl_offset = (sector << SECTOR_SHIFT) & (PAGE_SIZE - 1);
729 }
730 
731 static struct journal_sector *access_page_list(struct dm_integrity_c *ic, struct page_list *pl,
732 					       unsigned int section, unsigned int offset, unsigned int *n_sectors)
733 {
734 	unsigned int pl_index, pl_offset;
735 	char *va;
736 
737 	page_list_location(ic, section, offset, &pl_index, &pl_offset);
738 
739 	if (n_sectors)
740 		*n_sectors = (PAGE_SIZE - pl_offset) >> SECTOR_SHIFT;
741 
742 	va = lowmem_page_address(pl[pl_index].page);
743 
744 	return (struct journal_sector *)(va + pl_offset);
745 }
746 
747 static struct journal_sector *access_journal(struct dm_integrity_c *ic, unsigned int section, unsigned int offset)
748 {
749 	return access_page_list(ic, ic->journal, section, offset, NULL);
750 }
751 
752 static struct journal_entry *access_journal_entry(struct dm_integrity_c *ic, unsigned int section, unsigned int n)
753 {
754 	unsigned int rel_sector, offset;
755 	struct journal_sector *js;
756 
757 	access_journal_check(ic, section, n, true, "access_journal_entry");
758 
759 	rel_sector = n % JOURNAL_BLOCK_SECTORS;
760 	offset = n / JOURNAL_BLOCK_SECTORS;
761 
762 	js = access_journal(ic, section, rel_sector);
763 	return (struct journal_entry *)((char *)js + offset * ic->journal_entry_size);
764 }
765 
766 static struct journal_sector *access_journal_data(struct dm_integrity_c *ic, unsigned int section, unsigned int n)
767 {
768 	n <<= ic->sb->log2_sectors_per_block;
769 
770 	n += JOURNAL_BLOCK_SECTORS;
771 
772 	access_journal_check(ic, section, n, false, "access_journal_data");
773 
774 	return access_journal(ic, section, n);
775 }
776 
777 static void section_mac(struct dm_integrity_c *ic, unsigned int section, __u8 result[JOURNAL_MAC_SIZE])
778 {
779 	SHASH_DESC_ON_STACK(desc, ic->journal_mac);
780 	int r;
781 	unsigned int j, size;
782 
783 	desc->tfm = ic->journal_mac;
784 
785 	r = crypto_shash_init(desc);
786 	if (unlikely(r < 0)) {
787 		dm_integrity_io_error(ic, "crypto_shash_init", r);
788 		goto err;
789 	}
790 
791 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) {
792 		__le64 section_le;
793 
794 		r = crypto_shash_update(desc, (__u8 *)&ic->sb->salt, SALT_SIZE);
795 		if (unlikely(r < 0)) {
796 			dm_integrity_io_error(ic, "crypto_shash_update", r);
797 			goto err;
798 		}
799 
800 		section_le = cpu_to_le64(section);
801 		r = crypto_shash_update(desc, (__u8 *)&section_le, sizeof(section_le));
802 		if (unlikely(r < 0)) {
803 			dm_integrity_io_error(ic, "crypto_shash_update", r);
804 			goto err;
805 		}
806 	}
807 
808 	for (j = 0; j < ic->journal_section_entries; j++) {
809 		struct journal_entry *je = access_journal_entry(ic, section, j);
810 
811 		r = crypto_shash_update(desc, (__u8 *)&je->u.sector, sizeof(je->u.sector));
812 		if (unlikely(r < 0)) {
813 			dm_integrity_io_error(ic, "crypto_shash_update", r);
814 			goto err;
815 		}
816 	}
817 
818 	size = crypto_shash_digestsize(ic->journal_mac);
819 
820 	if (likely(size <= JOURNAL_MAC_SIZE)) {
821 		r = crypto_shash_final(desc, result);
822 		if (unlikely(r < 0)) {
823 			dm_integrity_io_error(ic, "crypto_shash_final", r);
824 			goto err;
825 		}
826 		memset(result + size, 0, JOURNAL_MAC_SIZE - size);
827 	} else {
828 		__u8 digest[HASH_MAX_DIGESTSIZE];
829 
830 		if (WARN_ON(size > sizeof(digest))) {
831 			dm_integrity_io_error(ic, "digest_size", -EINVAL);
832 			goto err;
833 		}
834 		r = crypto_shash_final(desc, digest);
835 		if (unlikely(r < 0)) {
836 			dm_integrity_io_error(ic, "crypto_shash_final", r);
837 			goto err;
838 		}
839 		memcpy(result, digest, JOURNAL_MAC_SIZE);
840 	}
841 
842 	return;
843 err:
844 	memset(result, 0, JOURNAL_MAC_SIZE);
845 }
846 
847 static void rw_section_mac(struct dm_integrity_c *ic, unsigned int section, bool wr)
848 {
849 	__u8 result[JOURNAL_MAC_SIZE];
850 	unsigned int j;
851 
852 	if (!ic->journal_mac)
853 		return;
854 
855 	section_mac(ic, section, result);
856 
857 	for (j = 0; j < JOURNAL_BLOCK_SECTORS; j++) {
858 		struct journal_sector *js = access_journal(ic, section, j);
859 
860 		if (likely(wr))
861 			memcpy(&js->mac, result + (j * JOURNAL_MAC_PER_SECTOR), JOURNAL_MAC_PER_SECTOR);
862 		else {
863 			if (crypto_memneq(&js->mac, result + (j * JOURNAL_MAC_PER_SECTOR), JOURNAL_MAC_PER_SECTOR)) {
864 				dm_integrity_io_error(ic, "journal mac", -EILSEQ);
865 				dm_audit_log_target(DM_MSG_PREFIX, "mac-journal", ic->ti, 0);
866 			}
867 		}
868 	}
869 }
870 
871 static void complete_journal_op(void *context)
872 {
873 	struct journal_completion *comp = context;
874 
875 	BUG_ON(!atomic_read(&comp->in_flight));
876 	if (likely(atomic_dec_and_test(&comp->in_flight)))
877 		complete(&comp->comp);
878 }
879 
880 static void xor_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section,
881 			unsigned int n_sections, struct journal_completion *comp)
882 {
883 	struct async_submit_ctl submit;
884 	size_t n_bytes = (size_t)(n_sections * ic->journal_section_sectors) << SECTOR_SHIFT;
885 	unsigned int pl_index, pl_offset, section_index;
886 	struct page_list *source_pl, *target_pl;
887 
888 	if (likely(encrypt)) {
889 		source_pl = ic->journal;
890 		target_pl = ic->journal_io;
891 	} else {
892 		source_pl = ic->journal_io;
893 		target_pl = ic->journal;
894 	}
895 
896 	page_list_location(ic, section, 0, &pl_index, &pl_offset);
897 
898 	atomic_add(roundup(pl_offset + n_bytes, PAGE_SIZE) >> PAGE_SHIFT, &comp->in_flight);
899 
900 	init_async_submit(&submit, ASYNC_TX_XOR_ZERO_DST, NULL, complete_journal_op, comp, NULL);
901 
902 	section_index = pl_index;
903 
904 	do {
905 		size_t this_step;
906 		struct page *src_pages[2];
907 		struct page *dst_page;
908 
909 		while (unlikely(pl_index == section_index)) {
910 			unsigned int dummy;
911 
912 			if (likely(encrypt))
913 				rw_section_mac(ic, section, true);
914 			section++;
915 			n_sections--;
916 			if (!n_sections)
917 				break;
918 			page_list_location(ic, section, 0, &section_index, &dummy);
919 		}
920 
921 		this_step = min(n_bytes, (size_t)PAGE_SIZE - pl_offset);
922 		dst_page = target_pl[pl_index].page;
923 		src_pages[0] = source_pl[pl_index].page;
924 		src_pages[1] = ic->journal_xor[pl_index].page;
925 
926 		async_xor(dst_page, src_pages, pl_offset, 2, this_step, &submit);
927 
928 		pl_index++;
929 		pl_offset = 0;
930 		n_bytes -= this_step;
931 	} while (n_bytes);
932 
933 	BUG_ON(n_sections);
934 
935 	async_tx_issue_pending_all();
936 }
937 
938 static void complete_journal_encrypt(void *data, int err)
939 {
940 	struct journal_completion *comp = data;
941 
942 	if (unlikely(err)) {
943 		if (likely(err == -EINPROGRESS)) {
944 			complete(&comp->ic->crypto_backoff);
945 			return;
946 		}
947 		dm_integrity_io_error(comp->ic, "asynchronous encrypt", err);
948 	}
949 	complete_journal_op(comp);
950 }
951 
952 static bool do_crypt(bool encrypt, struct skcipher_request *req, struct journal_completion *comp)
953 {
954 	int r;
955 
956 	skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
957 				      complete_journal_encrypt, comp);
958 	if (likely(encrypt))
959 		r = crypto_skcipher_encrypt(req);
960 	else
961 		r = crypto_skcipher_decrypt(req);
962 	if (likely(!r))
963 		return false;
964 	if (likely(r == -EINPROGRESS))
965 		return true;
966 	if (likely(r == -EBUSY)) {
967 		wait_for_completion(&comp->ic->crypto_backoff);
968 		reinit_completion(&comp->ic->crypto_backoff);
969 		return true;
970 	}
971 	dm_integrity_io_error(comp->ic, "encrypt", r);
972 	return false;
973 }
974 
975 static void crypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section,
976 			  unsigned int n_sections, struct journal_completion *comp)
977 {
978 	struct scatterlist **source_sg;
979 	struct scatterlist **target_sg;
980 
981 	atomic_add(2, &comp->in_flight);
982 
983 	if (likely(encrypt)) {
984 		source_sg = ic->journal_scatterlist;
985 		target_sg = ic->journal_io_scatterlist;
986 	} else {
987 		source_sg = ic->journal_io_scatterlist;
988 		target_sg = ic->journal_scatterlist;
989 	}
990 
991 	do {
992 		struct skcipher_request *req;
993 		unsigned int ivsize;
994 		char *iv;
995 
996 		if (likely(encrypt))
997 			rw_section_mac(ic, section, true);
998 
999 		req = ic->sk_requests[section];
1000 		ivsize = crypto_skcipher_ivsize(ic->journal_crypt);
1001 		iv = req->iv;
1002 
1003 		memcpy(iv, iv + ivsize, ivsize);
1004 
1005 		req->src = source_sg[section];
1006 		req->dst = target_sg[section];
1007 
1008 		if (unlikely(do_crypt(encrypt, req, comp)))
1009 			atomic_inc(&comp->in_flight);
1010 
1011 		section++;
1012 		n_sections--;
1013 	} while (n_sections);
1014 
1015 	atomic_dec(&comp->in_flight);
1016 	complete_journal_op(comp);
1017 }
1018 
1019 static void encrypt_journal(struct dm_integrity_c *ic, bool encrypt, unsigned int section,
1020 			    unsigned int n_sections, struct journal_completion *comp)
1021 {
1022 	if (ic->journal_xor)
1023 		return xor_journal(ic, encrypt, section, n_sections, comp);
1024 	else
1025 		return crypt_journal(ic, encrypt, section, n_sections, comp);
1026 }
1027 
1028 static void complete_journal_io(unsigned long error, void *context)
1029 {
1030 	struct journal_completion *comp = context;
1031 
1032 	if (unlikely(error != 0))
1033 		dm_integrity_io_error(comp->ic, "writing journal", -EIO);
1034 	complete_journal_op(comp);
1035 }
1036 
1037 static void rw_journal_sectors(struct dm_integrity_c *ic, blk_opf_t opf,
1038 			       unsigned int sector, unsigned int n_sectors,
1039 			       struct journal_completion *comp)
1040 {
1041 	struct dm_io_request io_req;
1042 	struct dm_io_region io_loc;
1043 	unsigned int pl_index, pl_offset;
1044 	int r;
1045 
1046 	if (unlikely(dm_integrity_failed(ic))) {
1047 		if (comp)
1048 			complete_journal_io(-1UL, comp);
1049 		return;
1050 	}
1051 
1052 	pl_index = sector >> (PAGE_SHIFT - SECTOR_SHIFT);
1053 	pl_offset = (sector << SECTOR_SHIFT) & (PAGE_SIZE - 1);
1054 
1055 	io_req.bi_opf = opf;
1056 	io_req.mem.type = DM_IO_PAGE_LIST;
1057 	if (ic->journal_io)
1058 		io_req.mem.ptr.pl = &ic->journal_io[pl_index];
1059 	else
1060 		io_req.mem.ptr.pl = &ic->journal[pl_index];
1061 	io_req.mem.offset = pl_offset;
1062 	if (likely(comp != NULL)) {
1063 		io_req.notify.fn = complete_journal_io;
1064 		io_req.notify.context = comp;
1065 	} else {
1066 		io_req.notify.fn = NULL;
1067 	}
1068 	io_req.client = ic->io;
1069 	io_loc.bdev = ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev;
1070 	io_loc.sector = ic->start + SB_SECTORS + sector;
1071 	io_loc.count = n_sectors;
1072 
1073 	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
1074 	if (unlikely(r)) {
1075 		dm_integrity_io_error(ic, (opf & REQ_OP_MASK) == REQ_OP_READ ?
1076 				      "reading journal" : "writing journal", r);
1077 		if (comp) {
1078 			WARN_ONCE(1, "asynchronous dm_io failed: %d", r);
1079 			complete_journal_io(-1UL, comp);
1080 		}
1081 	}
1082 }
1083 
1084 static void rw_journal(struct dm_integrity_c *ic, blk_opf_t opf,
1085 		       unsigned int section, unsigned int n_sections,
1086 		       struct journal_completion *comp)
1087 {
1088 	unsigned int sector, n_sectors;
1089 
1090 	sector = section * ic->journal_section_sectors;
1091 	n_sectors = n_sections * ic->journal_section_sectors;
1092 
1093 	rw_journal_sectors(ic, opf, sector, n_sectors, comp);
1094 }
1095 
1096 static void write_journal(struct dm_integrity_c *ic, unsigned int commit_start, unsigned int commit_sections)
1097 {
1098 	struct journal_completion io_comp;
1099 	struct journal_completion crypt_comp_1;
1100 	struct journal_completion crypt_comp_2;
1101 	unsigned int i;
1102 
1103 	io_comp.ic = ic;
1104 	init_completion(&io_comp.comp);
1105 
1106 	if (commit_start + commit_sections <= ic->journal_sections) {
1107 		io_comp.in_flight = (atomic_t)ATOMIC_INIT(1);
1108 		if (ic->journal_io) {
1109 			crypt_comp_1.ic = ic;
1110 			init_completion(&crypt_comp_1.comp);
1111 			crypt_comp_1.in_flight = (atomic_t)ATOMIC_INIT(0);
1112 			encrypt_journal(ic, true, commit_start, commit_sections, &crypt_comp_1);
1113 			wait_for_completion_io(&crypt_comp_1.comp);
1114 		} else {
1115 			for (i = 0; i < commit_sections; i++)
1116 				rw_section_mac(ic, commit_start + i, true);
1117 		}
1118 		rw_journal(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, commit_start,
1119 			   commit_sections, &io_comp);
1120 	} else {
1121 		unsigned int to_end;
1122 
1123 		io_comp.in_flight = (atomic_t)ATOMIC_INIT(2);
1124 		to_end = ic->journal_sections - commit_start;
1125 		if (ic->journal_io) {
1126 			crypt_comp_1.ic = ic;
1127 			init_completion(&crypt_comp_1.comp);
1128 			crypt_comp_1.in_flight = (atomic_t)ATOMIC_INIT(0);
1129 			encrypt_journal(ic, true, commit_start, to_end, &crypt_comp_1);
1130 			if (try_wait_for_completion(&crypt_comp_1.comp)) {
1131 				rw_journal(ic, REQ_OP_WRITE | REQ_FUA,
1132 					   commit_start, to_end, &io_comp);
1133 				reinit_completion(&crypt_comp_1.comp);
1134 				crypt_comp_1.in_flight = (atomic_t)ATOMIC_INIT(0);
1135 				encrypt_journal(ic, true, 0, commit_sections - to_end, &crypt_comp_1);
1136 				wait_for_completion_io(&crypt_comp_1.comp);
1137 			} else {
1138 				crypt_comp_2.ic = ic;
1139 				init_completion(&crypt_comp_2.comp);
1140 				crypt_comp_2.in_flight = (atomic_t)ATOMIC_INIT(0);
1141 				encrypt_journal(ic, true, 0, commit_sections - to_end, &crypt_comp_2);
1142 				wait_for_completion_io(&crypt_comp_1.comp);
1143 				rw_journal(ic, REQ_OP_WRITE | REQ_FUA, commit_start, to_end, &io_comp);
1144 				wait_for_completion_io(&crypt_comp_2.comp);
1145 			}
1146 		} else {
1147 			for (i = 0; i < to_end; i++)
1148 				rw_section_mac(ic, commit_start + i, true);
1149 			rw_journal(ic, REQ_OP_WRITE | REQ_FUA, commit_start, to_end, &io_comp);
1150 			for (i = 0; i < commit_sections - to_end; i++)
1151 				rw_section_mac(ic, i, true);
1152 		}
1153 		rw_journal(ic, REQ_OP_WRITE | REQ_FUA, 0, commit_sections - to_end, &io_comp);
1154 	}
1155 
1156 	wait_for_completion_io(&io_comp.comp);
1157 }
1158 
1159 static void copy_from_journal(struct dm_integrity_c *ic, unsigned int section, unsigned int offset,
1160 			      unsigned int n_sectors, sector_t target, io_notify_fn fn, void *data)
1161 {
1162 	struct dm_io_request io_req;
1163 	struct dm_io_region io_loc;
1164 	int r;
1165 	unsigned int sector, pl_index, pl_offset;
1166 
1167 	BUG_ON((target | n_sectors | offset) & (unsigned int)(ic->sectors_per_block - 1));
1168 
1169 	if (unlikely(dm_integrity_failed(ic))) {
1170 		fn(-1UL, data);
1171 		return;
1172 	}
1173 
1174 	sector = section * ic->journal_section_sectors + JOURNAL_BLOCK_SECTORS + offset;
1175 
1176 	pl_index = sector >> (PAGE_SHIFT - SECTOR_SHIFT);
1177 	pl_offset = (sector << SECTOR_SHIFT) & (PAGE_SIZE - 1);
1178 
1179 	io_req.bi_opf = REQ_OP_WRITE;
1180 	io_req.mem.type = DM_IO_PAGE_LIST;
1181 	io_req.mem.ptr.pl = &ic->journal[pl_index];
1182 	io_req.mem.offset = pl_offset;
1183 	io_req.notify.fn = fn;
1184 	io_req.notify.context = data;
1185 	io_req.client = ic->io;
1186 	io_loc.bdev = ic->dev->bdev;
1187 	io_loc.sector = target;
1188 	io_loc.count = n_sectors;
1189 
1190 	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
1191 	if (unlikely(r)) {
1192 		WARN_ONCE(1, "asynchronous dm_io failed: %d", r);
1193 		fn(-1UL, data);
1194 	}
1195 }
1196 
1197 static bool ranges_overlap(struct dm_integrity_range *range1, struct dm_integrity_range *range2)
1198 {
1199 	return range1->logical_sector < range2->logical_sector + range2->n_sectors &&
1200 	       range1->logical_sector + range1->n_sectors > range2->logical_sector;
1201 }
1202 
1203 static bool add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range, bool check_waiting)
1204 {
1205 	struct rb_node **n = &ic->in_progress.rb_node;
1206 	struct rb_node *parent;
1207 
1208 	BUG_ON((new_range->logical_sector | new_range->n_sectors) & (unsigned int)(ic->sectors_per_block - 1));
1209 
1210 	if (likely(check_waiting)) {
1211 		struct dm_integrity_range *range;
1212 
1213 		list_for_each_entry(range, &ic->wait_list, wait_entry) {
1214 			if (unlikely(ranges_overlap(range, new_range)))
1215 				return false;
1216 		}
1217 	}
1218 
1219 	parent = NULL;
1220 
1221 	while (*n) {
1222 		struct dm_integrity_range *range = container_of(*n, struct dm_integrity_range, node);
1223 
1224 		parent = *n;
1225 		if (new_range->logical_sector + new_range->n_sectors <= range->logical_sector)
1226 			n = &range->node.rb_left;
1227 		else if (new_range->logical_sector >= range->logical_sector + range->n_sectors)
1228 			n = &range->node.rb_right;
1229 		else
1230 			return false;
1231 	}
1232 
1233 	rb_link_node(&new_range->node, parent, n);
1234 	rb_insert_color(&new_range->node, &ic->in_progress);
1235 
1236 	return true;
1237 }
1238 
1239 static void remove_range_unlocked(struct dm_integrity_c *ic, struct dm_integrity_range *range)
1240 {
1241 	rb_erase(&range->node, &ic->in_progress);
1242 	while (unlikely(!list_empty(&ic->wait_list))) {
1243 		struct dm_integrity_range *last_range =
1244 			list_first_entry(&ic->wait_list, struct dm_integrity_range, wait_entry);
1245 		struct task_struct *last_range_task;
1246 
1247 		last_range_task = last_range->task;
1248 		list_del(&last_range->wait_entry);
1249 		if (!add_new_range(ic, last_range, false)) {
1250 			last_range->task = last_range_task;
1251 			list_add(&last_range->wait_entry, &ic->wait_list);
1252 			break;
1253 		}
1254 		last_range->waiting = false;
1255 		wake_up_process(last_range_task);
1256 	}
1257 }
1258 
1259 static void remove_range(struct dm_integrity_c *ic, struct dm_integrity_range *range)
1260 {
1261 	unsigned long flags;
1262 
1263 	spin_lock_irqsave(&ic->endio_wait.lock, flags);
1264 	remove_range_unlocked(ic, range);
1265 	spin_unlock_irqrestore(&ic->endio_wait.lock, flags);
1266 }
1267 
1268 static void wait_and_add_new_range(struct dm_integrity_c *ic, struct dm_integrity_range *new_range)
1269 {
1270 	new_range->waiting = true;
1271 	list_add_tail(&new_range->wait_entry, &ic->wait_list);
1272 	new_range->task = current;
1273 	do {
1274 		__set_current_state(TASK_UNINTERRUPTIBLE);
1275 		spin_unlock_irq(&ic->endio_wait.lock);
1276 		io_schedule();
1277 		spin_lock_irq(&ic->endio_wait.lock);
1278 	} while (unlikely(new_range->waiting));
1279 }
1280 
1281 static void add_new_range_and_wait(struct dm_integrity_c *ic, struct dm_integrity_range *new_range)
1282 {
1283 	if (unlikely(!add_new_range(ic, new_range, true)))
1284 		wait_and_add_new_range(ic, new_range);
1285 }
1286 
1287 static void init_journal_node(struct journal_node *node)
1288 {
1289 	RB_CLEAR_NODE(&node->node);
1290 	node->sector = (sector_t)-1;
1291 }
1292 
1293 static void add_journal_node(struct dm_integrity_c *ic, struct journal_node *node, sector_t sector)
1294 {
1295 	struct rb_node **link;
1296 	struct rb_node *parent;
1297 
1298 	node->sector = sector;
1299 	BUG_ON(!RB_EMPTY_NODE(&node->node));
1300 
1301 	link = &ic->journal_tree_root.rb_node;
1302 	parent = NULL;
1303 
1304 	while (*link) {
1305 		struct journal_node *j;
1306 
1307 		parent = *link;
1308 		j = container_of(parent, struct journal_node, node);
1309 		if (sector < j->sector)
1310 			link = &j->node.rb_left;
1311 		else
1312 			link = &j->node.rb_right;
1313 	}
1314 
1315 	rb_link_node(&node->node, parent, link);
1316 	rb_insert_color(&node->node, &ic->journal_tree_root);
1317 }
1318 
1319 static void remove_journal_node(struct dm_integrity_c *ic, struct journal_node *node)
1320 {
1321 	BUG_ON(RB_EMPTY_NODE(&node->node));
1322 	rb_erase(&node->node, &ic->journal_tree_root);
1323 	init_journal_node(node);
1324 }
1325 
1326 #define NOT_FOUND	(-1U)
1327 
1328 static unsigned int find_journal_node(struct dm_integrity_c *ic, sector_t sector, sector_t *next_sector)
1329 {
1330 	struct rb_node *n = ic->journal_tree_root.rb_node;
1331 	unsigned int found = NOT_FOUND;
1332 
1333 	*next_sector = (sector_t)-1;
1334 	while (n) {
1335 		struct journal_node *j = container_of(n, struct journal_node, node);
1336 
1337 		if (sector == j->sector)
1338 			found = j - ic->journal_tree;
1339 
1340 		if (sector < j->sector) {
1341 			*next_sector = j->sector;
1342 			n = j->node.rb_left;
1343 		} else
1344 			n = j->node.rb_right;
1345 	}
1346 
1347 	return found;
1348 }
1349 
1350 static bool test_journal_node(struct dm_integrity_c *ic, unsigned int pos, sector_t sector)
1351 {
1352 	struct journal_node *node, *next_node;
1353 	struct rb_node *next;
1354 
1355 	if (unlikely(pos >= ic->journal_entries))
1356 		return false;
1357 	node = &ic->journal_tree[pos];
1358 	if (unlikely(RB_EMPTY_NODE(&node->node)))
1359 		return false;
1360 	if (unlikely(node->sector != sector))
1361 		return false;
1362 
1363 	next = rb_next(&node->node);
1364 	if (unlikely(!next))
1365 		return true;
1366 
1367 	next_node = container_of(next, struct journal_node, node);
1368 	return next_node->sector != sector;
1369 }
1370 
1371 static bool find_newer_committed_node(struct dm_integrity_c *ic, struct journal_node *node)
1372 {
1373 	struct rb_node *next;
1374 	struct journal_node *next_node;
1375 	unsigned int next_section;
1376 
1377 	BUG_ON(RB_EMPTY_NODE(&node->node));
1378 
1379 	next = rb_next(&node->node);
1380 	if (unlikely(!next))
1381 		return false;
1382 
1383 	next_node = container_of(next, struct journal_node, node);
1384 
1385 	if (next_node->sector != node->sector)
1386 		return false;
1387 
1388 	next_section = (unsigned int)(next_node - ic->journal_tree) / ic->journal_section_entries;
1389 	if (next_section >= ic->committed_section &&
1390 	    next_section < ic->committed_section + ic->n_committed_sections)
1391 		return true;
1392 	if (next_section + ic->journal_sections < ic->committed_section + ic->n_committed_sections)
1393 		return true;
1394 
1395 	return false;
1396 }
1397 
1398 #define TAG_READ	0
1399 #define TAG_WRITE	1
1400 #define TAG_CMP		2
1401 
1402 static int dm_integrity_rw_tag(struct dm_integrity_c *ic, unsigned char *tag, sector_t *metadata_block,
1403 			       unsigned int *metadata_offset, unsigned int total_size, int op)
1404 {
1405 	unsigned int hash_offset = 0;
1406 	unsigned char mismatch_hash = 0;
1407 	unsigned char mismatch_filler = !ic->discard;
1408 
1409 	do {
1410 		unsigned char *data, *dp;
1411 		struct dm_buffer *b;
1412 		unsigned int to_copy;
1413 		int r;
1414 
1415 		r = dm_integrity_failed(ic);
1416 		if (unlikely(r))
1417 			return r;
1418 
1419 		data = dm_bufio_read(ic->bufio, *metadata_block, &b);
1420 		if (IS_ERR(data))
1421 			return PTR_ERR(data);
1422 
1423 		to_copy = min((1U << SECTOR_SHIFT << ic->log2_buffer_sectors) - *metadata_offset, total_size);
1424 		dp = data + *metadata_offset;
1425 		if (op == TAG_READ) {
1426 			memcpy(tag, dp, to_copy);
1427 		} else if (op == TAG_WRITE) {
1428 			if (crypto_memneq(dp, tag, to_copy)) {
1429 				memcpy(dp, tag, to_copy);
1430 				dm_bufio_mark_partial_buffer_dirty(b, *metadata_offset, *metadata_offset + to_copy);
1431 			}
1432 		} else {
1433 			/* e.g.: op == TAG_CMP */
1434 
1435 			if (likely(is_power_of_2(ic->tag_size))) {
1436 				if (unlikely(crypto_memneq(dp, tag, to_copy)))
1437 					goto thorough_test;
1438 			} else {
1439 				unsigned int i, ts;
1440 thorough_test:
1441 				ts = total_size;
1442 
1443 				for (i = 0; i < to_copy; i++, ts--) {
1444 					/*
1445 					 * Warning: the control flow must not be
1446 					 * dependent on match/mismatch of
1447 					 * individual bytes.
1448 					 */
1449 					mismatch_hash |= dp[i] ^ tag[i];
1450 					mismatch_filler |= dp[i] ^ DISCARD_FILLER;
1451 					hash_offset++;
1452 					if (unlikely(hash_offset == ic->tag_size)) {
1453 						if (unlikely(mismatch_hash) && unlikely(mismatch_filler)) {
1454 							dm_bufio_release(b);
1455 							return ts;
1456 						}
1457 						hash_offset = 0;
1458 						mismatch_hash = 0;
1459 						mismatch_filler = !ic->discard;
1460 					}
1461 				}
1462 			}
1463 		}
1464 		dm_bufio_release(b);
1465 
1466 		tag += to_copy;
1467 		*metadata_offset += to_copy;
1468 		if (unlikely(*metadata_offset == 1U << SECTOR_SHIFT << ic->log2_buffer_sectors)) {
1469 			(*metadata_block)++;
1470 			*metadata_offset = 0;
1471 		}
1472 
1473 		if (unlikely(!is_power_of_2(ic->tag_size)))
1474 			hash_offset = (hash_offset + to_copy) % ic->tag_size;
1475 
1476 		total_size -= to_copy;
1477 	} while (unlikely(total_size));
1478 
1479 	return 0;
1480 }
1481 
1482 struct flush_request {
1483 	struct dm_io_request io_req;
1484 	struct dm_io_region io_reg;
1485 	struct dm_integrity_c *ic;
1486 	struct completion comp;
1487 };
1488 
1489 static void flush_notify(unsigned long error, void *fr_)
1490 {
1491 	struct flush_request *fr = fr_;
1492 
1493 	if (unlikely(error != 0))
1494 		dm_integrity_io_error(fr->ic, "flushing disk cache", -EIO);
1495 	complete(&fr->comp);
1496 }
1497 
1498 static void dm_integrity_flush_buffers(struct dm_integrity_c *ic, bool flush_data)
1499 {
1500 	int r;
1501 	struct flush_request fr;
1502 
1503 	if (!ic->meta_dev)
1504 		flush_data = false;
1505 	if (flush_data) {
1506 		fr.io_req.bi_opf = REQ_OP_WRITE | REQ_PREFLUSH | REQ_SYNC;
1507 		fr.io_req.mem.type = DM_IO_KMEM;
1508 		fr.io_req.mem.ptr.addr = NULL;
1509 		fr.io_req.notify.fn = flush_notify;
1510 		fr.io_req.notify.context = &fr;
1511 		fr.io_req.client = dm_bufio_get_dm_io_client(ic->bufio);
1512 		fr.io_reg.bdev = ic->dev->bdev;
1513 		fr.io_reg.sector = 0;
1514 		fr.io_reg.count = 0;
1515 		fr.ic = ic;
1516 		init_completion(&fr.comp);
1517 		r = dm_io(&fr.io_req, 1, &fr.io_reg, NULL, IOPRIO_DEFAULT);
1518 		BUG_ON(r);
1519 	}
1520 
1521 	r = dm_bufio_write_dirty_buffers(ic->bufio);
1522 	if (unlikely(r))
1523 		dm_integrity_io_error(ic, "writing tags", r);
1524 
1525 	if (flush_data)
1526 		wait_for_completion(&fr.comp);
1527 }
1528 
1529 static void sleep_on_endio_wait(struct dm_integrity_c *ic)
1530 {
1531 	DECLARE_WAITQUEUE(wait, current);
1532 
1533 	__add_wait_queue(&ic->endio_wait, &wait);
1534 	__set_current_state(TASK_UNINTERRUPTIBLE);
1535 	spin_unlock_irq(&ic->endio_wait.lock);
1536 	io_schedule();
1537 	spin_lock_irq(&ic->endio_wait.lock);
1538 	__remove_wait_queue(&ic->endio_wait, &wait);
1539 }
1540 
1541 static void autocommit_fn(struct timer_list *t)
1542 {
1543 	struct dm_integrity_c *ic = from_timer(ic, t, autocommit_timer);
1544 
1545 	if (likely(!dm_integrity_failed(ic)))
1546 		queue_work(ic->commit_wq, &ic->commit_work);
1547 }
1548 
1549 static void schedule_autocommit(struct dm_integrity_c *ic)
1550 {
1551 	if (!timer_pending(&ic->autocommit_timer))
1552 		mod_timer(&ic->autocommit_timer, jiffies + ic->autocommit_jiffies);
1553 }
1554 
1555 static void submit_flush_bio(struct dm_integrity_c *ic, struct dm_integrity_io *dio)
1556 {
1557 	struct bio *bio;
1558 	unsigned long flags;
1559 
1560 	spin_lock_irqsave(&ic->endio_wait.lock, flags);
1561 	bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
1562 	bio_list_add(&ic->flush_bio_list, bio);
1563 	spin_unlock_irqrestore(&ic->endio_wait.lock, flags);
1564 
1565 	queue_work(ic->commit_wq, &ic->commit_work);
1566 }
1567 
1568 static void do_endio(struct dm_integrity_c *ic, struct bio *bio)
1569 {
1570 	int r;
1571 
1572 	r = dm_integrity_failed(ic);
1573 	if (unlikely(r) && !bio->bi_status)
1574 		bio->bi_status = errno_to_blk_status(r);
1575 	if (unlikely(ic->synchronous_mode) && bio_op(bio) == REQ_OP_WRITE) {
1576 		unsigned long flags;
1577 
1578 		spin_lock_irqsave(&ic->endio_wait.lock, flags);
1579 		bio_list_add(&ic->synchronous_bios, bio);
1580 		queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, 0);
1581 		spin_unlock_irqrestore(&ic->endio_wait.lock, flags);
1582 		return;
1583 	}
1584 	bio_endio(bio);
1585 }
1586 
1587 static void do_endio_flush(struct dm_integrity_c *ic, struct dm_integrity_io *dio)
1588 {
1589 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
1590 
1591 	if (unlikely(dio->fua) && likely(!bio->bi_status) && likely(!dm_integrity_failed(ic)))
1592 		submit_flush_bio(ic, dio);
1593 	else
1594 		do_endio(ic, bio);
1595 }
1596 
1597 static void dec_in_flight(struct dm_integrity_io *dio)
1598 {
1599 	if (atomic_dec_and_test(&dio->in_flight)) {
1600 		struct dm_integrity_c *ic = dio->ic;
1601 		struct bio *bio;
1602 
1603 		remove_range(ic, &dio->range);
1604 
1605 		if (dio->op == REQ_OP_WRITE || unlikely(dio->op == REQ_OP_DISCARD))
1606 			schedule_autocommit(ic);
1607 
1608 		bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
1609 		if (unlikely(dio->bi_status) && !bio->bi_status)
1610 			bio->bi_status = dio->bi_status;
1611 		if (likely(!bio->bi_status) && unlikely(bio_sectors(bio) != dio->range.n_sectors)) {
1612 			dio->range.logical_sector += dio->range.n_sectors;
1613 			bio_advance(bio, dio->range.n_sectors << SECTOR_SHIFT);
1614 			INIT_WORK(&dio->work, integrity_bio_wait);
1615 			queue_work(ic->offload_wq, &dio->work);
1616 			return;
1617 		}
1618 		do_endio_flush(ic, dio);
1619 	}
1620 }
1621 
1622 static void integrity_end_io(struct bio *bio)
1623 {
1624 	struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
1625 
1626 	dm_bio_restore(&dio->bio_details, bio);
1627 	if (bio->bi_integrity)
1628 		bio->bi_opf |= REQ_INTEGRITY;
1629 
1630 	if (dio->completion)
1631 		complete(dio->completion);
1632 
1633 	dec_in_flight(dio);
1634 }
1635 
1636 static void integrity_sector_checksum(struct dm_integrity_c *ic, sector_t sector,
1637 				      const char *data, char *result)
1638 {
1639 	__le64 sector_le = cpu_to_le64(sector);
1640 	SHASH_DESC_ON_STACK(req, ic->internal_hash);
1641 	int r;
1642 	unsigned int digest_size;
1643 
1644 	req->tfm = ic->internal_hash;
1645 
1646 	r = crypto_shash_init(req);
1647 	if (unlikely(r < 0)) {
1648 		dm_integrity_io_error(ic, "crypto_shash_init", r);
1649 		goto failed;
1650 	}
1651 
1652 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) {
1653 		r = crypto_shash_update(req, (__u8 *)&ic->sb->salt, SALT_SIZE);
1654 		if (unlikely(r < 0)) {
1655 			dm_integrity_io_error(ic, "crypto_shash_update", r);
1656 			goto failed;
1657 		}
1658 	}
1659 
1660 	r = crypto_shash_update(req, (const __u8 *)&sector_le, sizeof(sector_le));
1661 	if (unlikely(r < 0)) {
1662 		dm_integrity_io_error(ic, "crypto_shash_update", r);
1663 		goto failed;
1664 	}
1665 
1666 	r = crypto_shash_update(req, data, ic->sectors_per_block << SECTOR_SHIFT);
1667 	if (unlikely(r < 0)) {
1668 		dm_integrity_io_error(ic, "crypto_shash_update", r);
1669 		goto failed;
1670 	}
1671 
1672 	r = crypto_shash_final(req, result);
1673 	if (unlikely(r < 0)) {
1674 		dm_integrity_io_error(ic, "crypto_shash_final", r);
1675 		goto failed;
1676 	}
1677 
1678 	digest_size = crypto_shash_digestsize(ic->internal_hash);
1679 	if (unlikely(digest_size < ic->tag_size))
1680 		memset(result + digest_size, 0, ic->tag_size - digest_size);
1681 
1682 	return;
1683 
1684 failed:
1685 	/* this shouldn't happen anyway, the hash functions have no reason to fail */
1686 	get_random_bytes(result, ic->tag_size);
1687 }
1688 
1689 static noinline void integrity_recheck(struct dm_integrity_io *dio, char *checksum)
1690 {
1691 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
1692 	struct dm_integrity_c *ic = dio->ic;
1693 	struct bvec_iter iter;
1694 	struct bio_vec bv;
1695 	sector_t sector, logical_sector, area, offset;
1696 	struct page *page;
1697 
1698 	get_area_and_offset(ic, dio->range.logical_sector, &area, &offset);
1699 	dio->metadata_block = get_metadata_sector_and_offset(ic, area, offset,
1700 							     &dio->metadata_offset);
1701 	sector = get_data_sector(ic, area, offset);
1702 	logical_sector = dio->range.logical_sector;
1703 
1704 	page = mempool_alloc(&ic->recheck_pool, GFP_NOIO);
1705 
1706 	__bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
1707 		unsigned pos = 0;
1708 
1709 		do {
1710 			sector_t alignment;
1711 			char *mem;
1712 			char *buffer = page_to_virt(page);
1713 			int r;
1714 			struct dm_io_request io_req;
1715 			struct dm_io_region io_loc;
1716 			io_req.bi_opf = REQ_OP_READ;
1717 			io_req.mem.type = DM_IO_KMEM;
1718 			io_req.mem.ptr.addr = buffer;
1719 			io_req.notify.fn = NULL;
1720 			io_req.client = ic->io;
1721 			io_loc.bdev = ic->dev->bdev;
1722 			io_loc.sector = sector;
1723 			io_loc.count = ic->sectors_per_block;
1724 
1725 			/* Align the bio to logical block size */
1726 			alignment = dio->range.logical_sector | bio_sectors(bio) | (PAGE_SIZE >> SECTOR_SHIFT);
1727 			alignment &= -alignment;
1728 			io_loc.sector = round_down(io_loc.sector, alignment);
1729 			io_loc.count += sector - io_loc.sector;
1730 			buffer += (sector - io_loc.sector) << SECTOR_SHIFT;
1731 			io_loc.count = round_up(io_loc.count, alignment);
1732 
1733 			r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
1734 			if (unlikely(r)) {
1735 				dio->bi_status = errno_to_blk_status(r);
1736 				goto free_ret;
1737 			}
1738 
1739 			integrity_sector_checksum(ic, logical_sector, buffer, checksum);
1740 			r = dm_integrity_rw_tag(ic, checksum, &dio->metadata_block,
1741 						&dio->metadata_offset, ic->tag_size, TAG_CMP);
1742 			if (r) {
1743 				if (r > 0) {
1744 					DMERR_LIMIT("%pg: Checksum failed at sector 0x%llx",
1745 						    bio->bi_bdev, logical_sector);
1746 					atomic64_inc(&ic->number_of_mismatches);
1747 					dm_audit_log_bio(DM_MSG_PREFIX, "integrity-checksum",
1748 							 bio, logical_sector, 0);
1749 					r = -EILSEQ;
1750 				}
1751 				dio->bi_status = errno_to_blk_status(r);
1752 				goto free_ret;
1753 			}
1754 
1755 			mem = bvec_kmap_local(&bv);
1756 			memcpy(mem + pos, buffer, ic->sectors_per_block << SECTOR_SHIFT);
1757 			kunmap_local(mem);
1758 
1759 			pos += ic->sectors_per_block << SECTOR_SHIFT;
1760 			sector += ic->sectors_per_block;
1761 			logical_sector += ic->sectors_per_block;
1762 		} while (pos < bv.bv_len);
1763 	}
1764 free_ret:
1765 	mempool_free(page, &ic->recheck_pool);
1766 }
1767 
1768 static void integrity_metadata(struct work_struct *w)
1769 {
1770 	struct dm_integrity_io *dio = container_of(w, struct dm_integrity_io, work);
1771 	struct dm_integrity_c *ic = dio->ic;
1772 
1773 	int r;
1774 
1775 	if (ic->internal_hash) {
1776 		struct bvec_iter iter;
1777 		struct bio_vec bv;
1778 		unsigned int digest_size = crypto_shash_digestsize(ic->internal_hash);
1779 		struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
1780 		char *checksums;
1781 		unsigned int extra_space = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0;
1782 		char checksums_onstack[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
1783 		sector_t sector;
1784 		unsigned int sectors_to_process;
1785 
1786 		if (unlikely(ic->mode == 'R'))
1787 			goto skip_io;
1788 
1789 		if (likely(dio->op != REQ_OP_DISCARD))
1790 			checksums = kmalloc((PAGE_SIZE >> SECTOR_SHIFT >> ic->sb->log2_sectors_per_block) * ic->tag_size + extra_space,
1791 					    GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN);
1792 		else
1793 			checksums = kmalloc(PAGE_SIZE, GFP_NOIO | __GFP_NORETRY | __GFP_NOWARN);
1794 		if (!checksums) {
1795 			checksums = checksums_onstack;
1796 			if (WARN_ON(extra_space &&
1797 				    digest_size > sizeof(checksums_onstack))) {
1798 				r = -EINVAL;
1799 				goto error;
1800 			}
1801 		}
1802 
1803 		if (unlikely(dio->op == REQ_OP_DISCARD)) {
1804 			unsigned int bi_size = dio->bio_details.bi_iter.bi_size;
1805 			unsigned int max_size = likely(checksums != checksums_onstack) ? PAGE_SIZE : HASH_MAX_DIGESTSIZE;
1806 			unsigned int max_blocks = max_size / ic->tag_size;
1807 
1808 			memset(checksums, DISCARD_FILLER, max_size);
1809 
1810 			while (bi_size) {
1811 				unsigned int this_step_blocks = bi_size >> (SECTOR_SHIFT + ic->sb->log2_sectors_per_block);
1812 
1813 				this_step_blocks = min(this_step_blocks, max_blocks);
1814 				r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset,
1815 							this_step_blocks * ic->tag_size, TAG_WRITE);
1816 				if (unlikely(r)) {
1817 					if (likely(checksums != checksums_onstack))
1818 						kfree(checksums);
1819 					goto error;
1820 				}
1821 
1822 				bi_size -= this_step_blocks << (SECTOR_SHIFT + ic->sb->log2_sectors_per_block);
1823 			}
1824 
1825 			if (likely(checksums != checksums_onstack))
1826 				kfree(checksums);
1827 			goto skip_io;
1828 		}
1829 
1830 		sector = dio->range.logical_sector;
1831 		sectors_to_process = dio->range.n_sectors;
1832 
1833 		__bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
1834 			struct bio_vec bv_copy = bv;
1835 			unsigned int pos;
1836 			char *mem, *checksums_ptr;
1837 
1838 again:
1839 			mem = bvec_kmap_local(&bv_copy);
1840 			pos = 0;
1841 			checksums_ptr = checksums;
1842 			do {
1843 				integrity_sector_checksum(ic, sector, mem + pos, checksums_ptr);
1844 				checksums_ptr += ic->tag_size;
1845 				sectors_to_process -= ic->sectors_per_block;
1846 				pos += ic->sectors_per_block << SECTOR_SHIFT;
1847 				sector += ic->sectors_per_block;
1848 			} while (pos < bv_copy.bv_len && sectors_to_process && checksums != checksums_onstack);
1849 			kunmap_local(mem);
1850 
1851 			r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset,
1852 						checksums_ptr - checksums, dio->op == REQ_OP_READ ? TAG_CMP : TAG_WRITE);
1853 			if (unlikely(r)) {
1854 				if (likely(checksums != checksums_onstack))
1855 					kfree(checksums);
1856 				if (r > 0) {
1857 					integrity_recheck(dio, checksums_onstack);
1858 					goto skip_io;
1859 				}
1860 				goto error;
1861 			}
1862 
1863 			if (!sectors_to_process)
1864 				break;
1865 
1866 			if (unlikely(pos < bv_copy.bv_len)) {
1867 				bv_copy.bv_offset += pos;
1868 				bv_copy.bv_len -= pos;
1869 				goto again;
1870 			}
1871 		}
1872 
1873 		if (likely(checksums != checksums_onstack))
1874 			kfree(checksums);
1875 	} else {
1876 		struct bio_integrity_payload *bip = dio->bio_details.bi_integrity;
1877 
1878 		if (bip) {
1879 			struct bio_vec biv;
1880 			struct bvec_iter iter;
1881 			unsigned int data_to_process = dio->range.n_sectors;
1882 
1883 			sector_to_block(ic, data_to_process);
1884 			data_to_process *= ic->tag_size;
1885 
1886 			bip_for_each_vec(biv, bip, iter) {
1887 				unsigned char *tag;
1888 				unsigned int this_len;
1889 
1890 				BUG_ON(PageHighMem(biv.bv_page));
1891 				tag = bvec_virt(&biv);
1892 				this_len = min(biv.bv_len, data_to_process);
1893 				r = dm_integrity_rw_tag(ic, tag, &dio->metadata_block, &dio->metadata_offset,
1894 							this_len, dio->op == REQ_OP_READ ? TAG_READ : TAG_WRITE);
1895 				if (unlikely(r))
1896 					goto error;
1897 				data_to_process -= this_len;
1898 				if (!data_to_process)
1899 					break;
1900 			}
1901 		}
1902 	}
1903 skip_io:
1904 	dec_in_flight(dio);
1905 	return;
1906 error:
1907 	dio->bi_status = errno_to_blk_status(r);
1908 	dec_in_flight(dio);
1909 }
1910 
1911 static inline bool dm_integrity_check_limits(struct dm_integrity_c *ic, sector_t logical_sector, struct bio *bio)
1912 {
1913 	if (unlikely(logical_sector + bio_sectors(bio) > ic->provided_data_sectors)) {
1914 		DMERR("Too big sector number: 0x%llx + 0x%x > 0x%llx",
1915 		      logical_sector, bio_sectors(bio),
1916 		      ic->provided_data_sectors);
1917 		return false;
1918 	}
1919 	if (unlikely((logical_sector | bio_sectors(bio)) & (unsigned int)(ic->sectors_per_block - 1))) {
1920 		DMERR("Bio not aligned on %u sectors: 0x%llx, 0x%x",
1921 		      ic->sectors_per_block,
1922 		      logical_sector, bio_sectors(bio));
1923 		return false;
1924 	}
1925 	if (ic->sectors_per_block > 1 && likely(bio_op(bio) != REQ_OP_DISCARD)) {
1926 		struct bvec_iter iter;
1927 		struct bio_vec bv;
1928 
1929 		bio_for_each_segment(bv, bio, iter) {
1930 			if (unlikely(bv.bv_len & ((ic->sectors_per_block << SECTOR_SHIFT) - 1))) {
1931 				DMERR("Bio vector (%u,%u) is not aligned on %u-sector boundary",
1932 					bv.bv_offset, bv.bv_len, ic->sectors_per_block);
1933 				return false;
1934 			}
1935 		}
1936 	}
1937 	return true;
1938 }
1939 
1940 static int dm_integrity_map(struct dm_target *ti, struct bio *bio)
1941 {
1942 	struct dm_integrity_c *ic = ti->private;
1943 	struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
1944 	struct bio_integrity_payload *bip;
1945 
1946 	sector_t area, offset;
1947 
1948 	dio->ic = ic;
1949 	dio->bi_status = 0;
1950 	dio->op = bio_op(bio);
1951 
1952 	if (ic->mode == 'I') {
1953 		bio->bi_iter.bi_sector = dm_target_offset(ic->ti, bio->bi_iter.bi_sector);
1954 		dio->integrity_payload = NULL;
1955 		dio->integrity_payload_from_mempool = false;
1956 		dio->integrity_range_locked = false;
1957 		return dm_integrity_map_inline(dio, true);
1958 	}
1959 
1960 	if (unlikely(dio->op == REQ_OP_DISCARD)) {
1961 		if (ti->max_io_len) {
1962 			sector_t sec = dm_target_offset(ti, bio->bi_iter.bi_sector);
1963 			unsigned int log2_max_io_len = __fls(ti->max_io_len);
1964 			sector_t start_boundary = sec >> log2_max_io_len;
1965 			sector_t end_boundary = (sec + bio_sectors(bio) - 1) >> log2_max_io_len;
1966 
1967 			if (start_boundary < end_boundary) {
1968 				sector_t len = ti->max_io_len - (sec & (ti->max_io_len - 1));
1969 
1970 				dm_accept_partial_bio(bio, len);
1971 			}
1972 		}
1973 	}
1974 
1975 	if (unlikely(bio->bi_opf & REQ_PREFLUSH)) {
1976 		submit_flush_bio(ic, dio);
1977 		return DM_MAPIO_SUBMITTED;
1978 	}
1979 
1980 	dio->range.logical_sector = dm_target_offset(ti, bio->bi_iter.bi_sector);
1981 	dio->fua = dio->op == REQ_OP_WRITE && bio->bi_opf & REQ_FUA;
1982 	if (unlikely(dio->fua)) {
1983 		/*
1984 		 * Don't pass down the FUA flag because we have to flush
1985 		 * disk cache anyway.
1986 		 */
1987 		bio->bi_opf &= ~REQ_FUA;
1988 	}
1989 	if (unlikely(!dm_integrity_check_limits(ic, dio->range.logical_sector, bio)))
1990 		return DM_MAPIO_KILL;
1991 
1992 	bip = bio_integrity(bio);
1993 	if (!ic->internal_hash) {
1994 		if (bip) {
1995 			unsigned int wanted_tag_size = bio_sectors(bio) >> ic->sb->log2_sectors_per_block;
1996 
1997 			if (ic->log2_tag_size >= 0)
1998 				wanted_tag_size <<= ic->log2_tag_size;
1999 			else
2000 				wanted_tag_size *= ic->tag_size;
2001 			if (unlikely(wanted_tag_size != bip->bip_iter.bi_size)) {
2002 				DMERR("Invalid integrity data size %u, expected %u",
2003 				      bip->bip_iter.bi_size, wanted_tag_size);
2004 				return DM_MAPIO_KILL;
2005 			}
2006 		}
2007 	} else {
2008 		if (unlikely(bip != NULL)) {
2009 			DMERR("Unexpected integrity data when using internal hash");
2010 			return DM_MAPIO_KILL;
2011 		}
2012 	}
2013 
2014 	if (unlikely(ic->mode == 'R') && unlikely(dio->op != REQ_OP_READ))
2015 		return DM_MAPIO_KILL;
2016 
2017 	get_area_and_offset(ic, dio->range.logical_sector, &area, &offset);
2018 	dio->metadata_block = get_metadata_sector_and_offset(ic, area, offset, &dio->metadata_offset);
2019 	bio->bi_iter.bi_sector = get_data_sector(ic, area, offset);
2020 
2021 	dm_integrity_map_continue(dio, true);
2022 	return DM_MAPIO_SUBMITTED;
2023 }
2024 
2025 static bool __journal_read_write(struct dm_integrity_io *dio, struct bio *bio,
2026 				 unsigned int journal_section, unsigned int journal_entry)
2027 {
2028 	struct dm_integrity_c *ic = dio->ic;
2029 	sector_t logical_sector;
2030 	unsigned int n_sectors;
2031 
2032 	logical_sector = dio->range.logical_sector;
2033 	n_sectors = dio->range.n_sectors;
2034 	do {
2035 		struct bio_vec bv = bio_iovec(bio);
2036 		char *mem;
2037 
2038 		if (unlikely(bv.bv_len >> SECTOR_SHIFT > n_sectors))
2039 			bv.bv_len = n_sectors << SECTOR_SHIFT;
2040 		n_sectors -= bv.bv_len >> SECTOR_SHIFT;
2041 		bio_advance_iter(bio, &bio->bi_iter, bv.bv_len);
2042 retry_kmap:
2043 		mem = kmap_local_page(bv.bv_page);
2044 		if (likely(dio->op == REQ_OP_WRITE))
2045 			flush_dcache_page(bv.bv_page);
2046 
2047 		do {
2048 			struct journal_entry *je = access_journal_entry(ic, journal_section, journal_entry);
2049 
2050 			if (unlikely(dio->op == REQ_OP_READ)) {
2051 				struct journal_sector *js;
2052 				char *mem_ptr;
2053 				unsigned int s;
2054 
2055 				if (unlikely(journal_entry_is_inprogress(je))) {
2056 					flush_dcache_page(bv.bv_page);
2057 					kunmap_local(mem);
2058 
2059 					__io_wait_event(ic->copy_to_journal_wait, !journal_entry_is_inprogress(je));
2060 					goto retry_kmap;
2061 				}
2062 				smp_rmb();
2063 				BUG_ON(journal_entry_get_sector(je) != logical_sector);
2064 				js = access_journal_data(ic, journal_section, journal_entry);
2065 				mem_ptr = mem + bv.bv_offset;
2066 				s = 0;
2067 				do {
2068 					memcpy(mem_ptr, js, JOURNAL_SECTOR_DATA);
2069 					*(commit_id_t *)(mem_ptr + JOURNAL_SECTOR_DATA) = je->last_bytes[s];
2070 					js++;
2071 					mem_ptr += 1 << SECTOR_SHIFT;
2072 				} while (++s < ic->sectors_per_block);
2073 #ifdef INTERNAL_VERIFY
2074 				if (ic->internal_hash) {
2075 					char checksums_onstack[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
2076 
2077 					integrity_sector_checksum(ic, logical_sector, mem + bv.bv_offset, checksums_onstack);
2078 					if (unlikely(crypto_memneq(checksums_onstack, journal_entry_tag(ic, je), ic->tag_size))) {
2079 						DMERR_LIMIT("Checksum failed when reading from journal, at sector 0x%llx",
2080 							    logical_sector);
2081 						dm_audit_log_bio(DM_MSG_PREFIX, "journal-checksum",
2082 								 bio, logical_sector, 0);
2083 					}
2084 				}
2085 #endif
2086 			}
2087 
2088 			if (!ic->internal_hash) {
2089 				struct bio_integrity_payload *bip = bio_integrity(bio);
2090 				unsigned int tag_todo = ic->tag_size;
2091 				char *tag_ptr = journal_entry_tag(ic, je);
2092 
2093 				if (bip) {
2094 					do {
2095 						struct bio_vec biv = bvec_iter_bvec(bip->bip_vec, bip->bip_iter);
2096 						unsigned int tag_now = min(biv.bv_len, tag_todo);
2097 						char *tag_addr;
2098 
2099 						BUG_ON(PageHighMem(biv.bv_page));
2100 						tag_addr = bvec_virt(&biv);
2101 						if (likely(dio->op == REQ_OP_WRITE))
2102 							memcpy(tag_ptr, tag_addr, tag_now);
2103 						else
2104 							memcpy(tag_addr, tag_ptr, tag_now);
2105 						bvec_iter_advance(bip->bip_vec, &bip->bip_iter, tag_now);
2106 						tag_ptr += tag_now;
2107 						tag_todo -= tag_now;
2108 					} while (unlikely(tag_todo));
2109 				} else if (likely(dio->op == REQ_OP_WRITE))
2110 					memset(tag_ptr, 0, tag_todo);
2111 			}
2112 
2113 			if (likely(dio->op == REQ_OP_WRITE)) {
2114 				struct journal_sector *js;
2115 				unsigned int s;
2116 
2117 				js = access_journal_data(ic, journal_section, journal_entry);
2118 				memcpy(js, mem + bv.bv_offset, ic->sectors_per_block << SECTOR_SHIFT);
2119 
2120 				s = 0;
2121 				do {
2122 					je->last_bytes[s] = js[s].commit_id;
2123 				} while (++s < ic->sectors_per_block);
2124 
2125 				if (ic->internal_hash) {
2126 					unsigned int digest_size = crypto_shash_digestsize(ic->internal_hash);
2127 
2128 					if (unlikely(digest_size > ic->tag_size)) {
2129 						char checksums_onstack[HASH_MAX_DIGESTSIZE];
2130 
2131 						integrity_sector_checksum(ic, logical_sector, (char *)js, checksums_onstack);
2132 						memcpy(journal_entry_tag(ic, je), checksums_onstack, ic->tag_size);
2133 					} else
2134 						integrity_sector_checksum(ic, logical_sector, (char *)js, journal_entry_tag(ic, je));
2135 				}
2136 
2137 				journal_entry_set_sector(je, logical_sector);
2138 			}
2139 			logical_sector += ic->sectors_per_block;
2140 
2141 			journal_entry++;
2142 			if (unlikely(journal_entry == ic->journal_section_entries)) {
2143 				journal_entry = 0;
2144 				journal_section++;
2145 				wraparound_section(ic, &journal_section);
2146 			}
2147 
2148 			bv.bv_offset += ic->sectors_per_block << SECTOR_SHIFT;
2149 		} while (bv.bv_len -= ic->sectors_per_block << SECTOR_SHIFT);
2150 
2151 		if (unlikely(dio->op == REQ_OP_READ))
2152 			flush_dcache_page(bv.bv_page);
2153 		kunmap_local(mem);
2154 	} while (n_sectors);
2155 
2156 	if (likely(dio->op == REQ_OP_WRITE)) {
2157 		smp_mb();
2158 		if (unlikely(waitqueue_active(&ic->copy_to_journal_wait)))
2159 			wake_up(&ic->copy_to_journal_wait);
2160 		if (READ_ONCE(ic->free_sectors) <= ic->free_sectors_threshold)
2161 			queue_work(ic->commit_wq, &ic->commit_work);
2162 		else
2163 			schedule_autocommit(ic);
2164 	} else
2165 		remove_range(ic, &dio->range);
2166 
2167 	if (unlikely(bio->bi_iter.bi_size)) {
2168 		sector_t area, offset;
2169 
2170 		dio->range.logical_sector = logical_sector;
2171 		get_area_and_offset(ic, dio->range.logical_sector, &area, &offset);
2172 		dio->metadata_block = get_metadata_sector_and_offset(ic, area, offset, &dio->metadata_offset);
2173 		return true;
2174 	}
2175 
2176 	return false;
2177 }
2178 
2179 static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map)
2180 {
2181 	struct dm_integrity_c *ic = dio->ic;
2182 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
2183 	unsigned int journal_section, journal_entry;
2184 	unsigned int journal_read_pos;
2185 	sector_t recalc_sector;
2186 	struct completion read_comp;
2187 	bool discard_retried = false;
2188 	bool need_sync_io = ic->internal_hash && dio->op == REQ_OP_READ;
2189 
2190 	if (unlikely(dio->op == REQ_OP_DISCARD) && ic->mode != 'D')
2191 		need_sync_io = true;
2192 
2193 	if (need_sync_io && from_map) {
2194 		INIT_WORK(&dio->work, integrity_bio_wait);
2195 		queue_work(ic->offload_wq, &dio->work);
2196 		return;
2197 	}
2198 
2199 lock_retry:
2200 	spin_lock_irq(&ic->endio_wait.lock);
2201 retry:
2202 	if (unlikely(dm_integrity_failed(ic))) {
2203 		spin_unlock_irq(&ic->endio_wait.lock);
2204 		do_endio(ic, bio);
2205 		return;
2206 	}
2207 	dio->range.n_sectors = bio_sectors(bio);
2208 	journal_read_pos = NOT_FOUND;
2209 	if (ic->mode == 'J' && likely(dio->op != REQ_OP_DISCARD)) {
2210 		if (dio->op == REQ_OP_WRITE) {
2211 			unsigned int next_entry, i, pos;
2212 			unsigned int ws, we, range_sectors;
2213 
2214 			dio->range.n_sectors = min(dio->range.n_sectors,
2215 						   (sector_t)ic->free_sectors << ic->sb->log2_sectors_per_block);
2216 			if (unlikely(!dio->range.n_sectors)) {
2217 				if (from_map)
2218 					goto offload_to_thread;
2219 				sleep_on_endio_wait(ic);
2220 				goto retry;
2221 			}
2222 			range_sectors = dio->range.n_sectors >> ic->sb->log2_sectors_per_block;
2223 			ic->free_sectors -= range_sectors;
2224 			journal_section = ic->free_section;
2225 			journal_entry = ic->free_section_entry;
2226 
2227 			next_entry = ic->free_section_entry + range_sectors;
2228 			ic->free_section_entry = next_entry % ic->journal_section_entries;
2229 			ic->free_section += next_entry / ic->journal_section_entries;
2230 			ic->n_uncommitted_sections += next_entry / ic->journal_section_entries;
2231 			wraparound_section(ic, &ic->free_section);
2232 
2233 			pos = journal_section * ic->journal_section_entries + journal_entry;
2234 			ws = journal_section;
2235 			we = journal_entry;
2236 			i = 0;
2237 			do {
2238 				struct journal_entry *je;
2239 
2240 				add_journal_node(ic, &ic->journal_tree[pos], dio->range.logical_sector + i);
2241 				pos++;
2242 				if (unlikely(pos >= ic->journal_entries))
2243 					pos = 0;
2244 
2245 				je = access_journal_entry(ic, ws, we);
2246 				BUG_ON(!journal_entry_is_unused(je));
2247 				journal_entry_set_inprogress(je);
2248 				we++;
2249 				if (unlikely(we == ic->journal_section_entries)) {
2250 					we = 0;
2251 					ws++;
2252 					wraparound_section(ic, &ws);
2253 				}
2254 			} while ((i += ic->sectors_per_block) < dio->range.n_sectors);
2255 
2256 			spin_unlock_irq(&ic->endio_wait.lock);
2257 			goto journal_read_write;
2258 		} else {
2259 			sector_t next_sector;
2260 
2261 			journal_read_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
2262 			if (likely(journal_read_pos == NOT_FOUND)) {
2263 				if (unlikely(dio->range.n_sectors > next_sector - dio->range.logical_sector))
2264 					dio->range.n_sectors = next_sector - dio->range.logical_sector;
2265 			} else {
2266 				unsigned int i;
2267 				unsigned int jp = journal_read_pos + 1;
2268 
2269 				for (i = ic->sectors_per_block; i < dio->range.n_sectors; i += ic->sectors_per_block, jp++) {
2270 					if (!test_journal_node(ic, jp, dio->range.logical_sector + i))
2271 						break;
2272 				}
2273 				dio->range.n_sectors = i;
2274 			}
2275 		}
2276 	}
2277 	if (unlikely(!add_new_range(ic, &dio->range, true))) {
2278 		/*
2279 		 * We must not sleep in the request routine because it could
2280 		 * stall bios on current->bio_list.
2281 		 * So, we offload the bio to a workqueue if we have to sleep.
2282 		 */
2283 		if (from_map) {
2284 offload_to_thread:
2285 			spin_unlock_irq(&ic->endio_wait.lock);
2286 			INIT_WORK(&dio->work, integrity_bio_wait);
2287 			queue_work(ic->wait_wq, &dio->work);
2288 			return;
2289 		}
2290 		if (journal_read_pos != NOT_FOUND)
2291 			dio->range.n_sectors = ic->sectors_per_block;
2292 		wait_and_add_new_range(ic, &dio->range);
2293 		/*
2294 		 * wait_and_add_new_range drops the spinlock, so the journal
2295 		 * may have been changed arbitrarily. We need to recheck.
2296 		 * To simplify the code, we restrict I/O size to just one block.
2297 		 */
2298 		if (journal_read_pos != NOT_FOUND) {
2299 			sector_t next_sector;
2300 			unsigned int new_pos;
2301 
2302 			new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
2303 			if (unlikely(new_pos != journal_read_pos)) {
2304 				remove_range_unlocked(ic, &dio->range);
2305 				goto retry;
2306 			}
2307 		}
2308 	}
2309 	if (ic->mode == 'J' && likely(dio->op == REQ_OP_DISCARD) && !discard_retried) {
2310 		sector_t next_sector;
2311 		unsigned int new_pos;
2312 
2313 		new_pos = find_journal_node(ic, dio->range.logical_sector, &next_sector);
2314 		if (unlikely(new_pos != NOT_FOUND) ||
2315 		    unlikely(next_sector < dio->range.logical_sector - dio->range.n_sectors)) {
2316 			remove_range_unlocked(ic, &dio->range);
2317 			spin_unlock_irq(&ic->endio_wait.lock);
2318 			queue_work(ic->commit_wq, &ic->commit_work);
2319 			flush_workqueue(ic->commit_wq);
2320 			queue_work(ic->writer_wq, &ic->writer_work);
2321 			flush_workqueue(ic->writer_wq);
2322 			discard_retried = true;
2323 			goto lock_retry;
2324 		}
2325 	}
2326 	recalc_sector = le64_to_cpu(ic->sb->recalc_sector);
2327 	spin_unlock_irq(&ic->endio_wait.lock);
2328 
2329 	if (unlikely(journal_read_pos != NOT_FOUND)) {
2330 		journal_section = journal_read_pos / ic->journal_section_entries;
2331 		journal_entry = journal_read_pos % ic->journal_section_entries;
2332 		goto journal_read_write;
2333 	}
2334 
2335 	if (ic->mode == 'B' && (dio->op == REQ_OP_WRITE || unlikely(dio->op == REQ_OP_DISCARD))) {
2336 		if (!block_bitmap_op(ic, ic->may_write_bitmap, dio->range.logical_sector,
2337 				     dio->range.n_sectors, BITMAP_OP_TEST_ALL_SET)) {
2338 			struct bitmap_block_status *bbs;
2339 
2340 			bbs = sector_to_bitmap_block(ic, dio->range.logical_sector);
2341 			spin_lock(&bbs->bio_queue_lock);
2342 			bio_list_add(&bbs->bio_queue, bio);
2343 			spin_unlock(&bbs->bio_queue_lock);
2344 			queue_work(ic->writer_wq, &bbs->work);
2345 			return;
2346 		}
2347 	}
2348 
2349 	dio->in_flight = (atomic_t)ATOMIC_INIT(2);
2350 
2351 	if (need_sync_io) {
2352 		init_completion(&read_comp);
2353 		dio->completion = &read_comp;
2354 	} else
2355 		dio->completion = NULL;
2356 
2357 	dm_bio_record(&dio->bio_details, bio);
2358 	bio_set_dev(bio, ic->dev->bdev);
2359 	bio->bi_integrity = NULL;
2360 	bio->bi_opf &= ~REQ_INTEGRITY;
2361 	bio->bi_end_io = integrity_end_io;
2362 	bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT;
2363 
2364 	if (unlikely(dio->op == REQ_OP_DISCARD) && likely(ic->mode != 'D')) {
2365 		integrity_metadata(&dio->work);
2366 		dm_integrity_flush_buffers(ic, false);
2367 
2368 		dio->in_flight = (atomic_t)ATOMIC_INIT(1);
2369 		dio->completion = NULL;
2370 
2371 		submit_bio_noacct(bio);
2372 
2373 		return;
2374 	}
2375 
2376 	submit_bio_noacct(bio);
2377 
2378 	if (need_sync_io) {
2379 		wait_for_completion_io(&read_comp);
2380 		if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
2381 		    dio->range.logical_sector + dio->range.n_sectors > recalc_sector)
2382 			goto skip_check;
2383 		if (ic->mode == 'B') {
2384 			if (!block_bitmap_op(ic, ic->recalc_bitmap, dio->range.logical_sector,
2385 					     dio->range.n_sectors, BITMAP_OP_TEST_ALL_CLEAR))
2386 				goto skip_check;
2387 		}
2388 
2389 		if (likely(!bio->bi_status))
2390 			integrity_metadata(&dio->work);
2391 		else
2392 skip_check:
2393 			dec_in_flight(dio);
2394 	} else {
2395 		INIT_WORK(&dio->work, integrity_metadata);
2396 		queue_work(ic->metadata_wq, &dio->work);
2397 	}
2398 
2399 	return;
2400 
2401 journal_read_write:
2402 	if (unlikely(__journal_read_write(dio, bio, journal_section, journal_entry)))
2403 		goto lock_retry;
2404 
2405 	do_endio_flush(ic, dio);
2406 }
2407 
2408 static int dm_integrity_map_inline(struct dm_integrity_io *dio, bool from_map)
2409 {
2410 	struct dm_integrity_c *ic = dio->ic;
2411 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
2412 	struct bio_integrity_payload *bip;
2413 	unsigned ret;
2414 	sector_t recalc_sector;
2415 
2416 	if (unlikely(bio_integrity(bio))) {
2417 		bio->bi_status = BLK_STS_NOTSUPP;
2418 		bio_endio(bio);
2419 		return DM_MAPIO_SUBMITTED;
2420 	}
2421 
2422 	bio_set_dev(bio, ic->dev->bdev);
2423 	if (unlikely((bio->bi_opf & REQ_PREFLUSH) != 0))
2424 		return DM_MAPIO_REMAPPED;
2425 
2426 retry:
2427 	if (!dio->integrity_payload) {
2428 		unsigned digest_size, extra_size;
2429 		dio->payload_len = ic->tuple_size * (bio_sectors(bio) >> ic->sb->log2_sectors_per_block);
2430 		digest_size = crypto_shash_digestsize(ic->internal_hash);
2431 		extra_size = unlikely(digest_size > ic->tag_size) ? digest_size - ic->tag_size : 0;
2432 		dio->payload_len += extra_size;
2433 		dio->integrity_payload = kmalloc(dio->payload_len, GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
2434 		if (unlikely(!dio->integrity_payload)) {
2435 			const unsigned x_size = PAGE_SIZE << 1;
2436 			if (dio->payload_len > x_size) {
2437 				unsigned sectors = ((x_size - extra_size) / ic->tuple_size) << ic->sb->log2_sectors_per_block;
2438 				if (WARN_ON(!sectors || sectors >= bio_sectors(bio))) {
2439 					bio->bi_status = BLK_STS_NOTSUPP;
2440 					bio_endio(bio);
2441 					return DM_MAPIO_SUBMITTED;
2442 				}
2443 				dm_accept_partial_bio(bio, sectors);
2444 				goto retry;
2445 			}
2446 		}
2447 	}
2448 
2449 	dio->range.logical_sector = bio->bi_iter.bi_sector;
2450 	dio->range.n_sectors = bio_sectors(bio);
2451 
2452 	if (!(ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)))
2453 		goto skip_spinlock;
2454 #ifdef CONFIG_64BIT
2455 	/*
2456 	 * On 64-bit CPUs we can optimize the lock away (so that it won't cause
2457 	 * cache line bouncing) and use acquire/release barriers instead.
2458 	 *
2459 	 * Paired with smp_store_release in integrity_recalc_inline.
2460 	 */
2461 	recalc_sector = le64_to_cpu(smp_load_acquire(&ic->sb->recalc_sector));
2462 	if (likely(dio->range.logical_sector + dio->range.n_sectors <= recalc_sector))
2463 		goto skip_spinlock;
2464 #endif
2465 	spin_lock_irq(&ic->endio_wait.lock);
2466 	recalc_sector = le64_to_cpu(ic->sb->recalc_sector);
2467 	if (dio->range.logical_sector + dio->range.n_sectors <= recalc_sector)
2468 		goto skip_unlock;
2469 	if (unlikely(!add_new_range(ic, &dio->range, true))) {
2470 		if (from_map) {
2471 			spin_unlock_irq(&ic->endio_wait.lock);
2472 			INIT_WORK(&dio->work, integrity_bio_wait);
2473 			queue_work(ic->wait_wq, &dio->work);
2474 			return DM_MAPIO_SUBMITTED;
2475 		}
2476 		wait_and_add_new_range(ic, &dio->range);
2477 	}
2478 	dio->integrity_range_locked = true;
2479 skip_unlock:
2480 	spin_unlock_irq(&ic->endio_wait.lock);
2481 skip_spinlock:
2482 
2483 	if (unlikely(!dio->integrity_payload)) {
2484 		dio->integrity_payload = page_to_virt((struct page *)mempool_alloc(&ic->recheck_pool, GFP_NOIO));
2485 		dio->integrity_payload_from_mempool = true;
2486 	}
2487 
2488 	dio->bio_details.bi_iter = bio->bi_iter;
2489 
2490 	if (unlikely(!dm_integrity_check_limits(ic, bio->bi_iter.bi_sector, bio))) {
2491 		return DM_MAPIO_KILL;
2492 	}
2493 
2494 	bio->bi_iter.bi_sector += ic->start + SB_SECTORS;
2495 
2496 	bip = bio_integrity_alloc(bio, GFP_NOIO, 1);
2497 	if (IS_ERR(bip)) {
2498 		bio->bi_status = errno_to_blk_status(PTR_ERR(bip));
2499 		bio_endio(bio);
2500 		return DM_MAPIO_SUBMITTED;
2501 	}
2502 
2503 	if (dio->op == REQ_OP_WRITE) {
2504 		unsigned pos = 0;
2505 		while (dio->bio_details.bi_iter.bi_size) {
2506 			struct bio_vec bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
2507 			const char *mem = bvec_kmap_local(&bv);
2508 			if (ic->tag_size < ic->tuple_size)
2509 				memset(dio->integrity_payload + pos + ic->tag_size, 0, ic->tuple_size - ic->tuple_size);
2510 			integrity_sector_checksum(ic, dio->bio_details.bi_iter.bi_sector, mem, dio->integrity_payload + pos);
2511 			kunmap_local(mem);
2512 			pos += ic->tuple_size;
2513 			bio_advance_iter_single(bio, &dio->bio_details.bi_iter, ic->sectors_per_block << SECTOR_SHIFT);
2514 		}
2515 	}
2516 
2517 	ret = bio_integrity_add_page(bio, virt_to_page(dio->integrity_payload),
2518 					dio->payload_len, offset_in_page(dio->integrity_payload));
2519 	if (unlikely(ret != dio->payload_len)) {
2520 		bio->bi_status = BLK_STS_RESOURCE;
2521 		bio_endio(bio);
2522 		return DM_MAPIO_SUBMITTED;
2523 	}
2524 
2525 	return DM_MAPIO_REMAPPED;
2526 }
2527 
2528 static inline void dm_integrity_free_payload(struct dm_integrity_io *dio)
2529 {
2530 	struct dm_integrity_c *ic = dio->ic;
2531 	if (unlikely(dio->integrity_payload_from_mempool))
2532 		mempool_free(virt_to_page(dio->integrity_payload), &ic->recheck_pool);
2533 	else
2534 		kfree(dio->integrity_payload);
2535 	dio->integrity_payload = NULL;
2536 	dio->integrity_payload_from_mempool = false;
2537 }
2538 
2539 static void dm_integrity_inline_recheck(struct work_struct *w)
2540 {
2541 	struct dm_integrity_io *dio = container_of(w, struct dm_integrity_io, work);
2542 	struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
2543 	struct dm_integrity_c *ic = dio->ic;
2544 	struct bio *outgoing_bio;
2545 	void *outgoing_data;
2546 
2547 	dio->integrity_payload = page_to_virt((struct page *)mempool_alloc(&ic->recheck_pool, GFP_NOIO));
2548 	dio->integrity_payload_from_mempool = true;
2549 
2550 	outgoing_data = dio->integrity_payload + PAGE_SIZE;
2551 
2552 	while (dio->bio_details.bi_iter.bi_size) {
2553 		char digest[HASH_MAX_DIGESTSIZE];
2554 		int r;
2555 		struct bio_integrity_payload *bip;
2556 		struct bio_vec bv;
2557 		char *mem;
2558 
2559 		outgoing_bio = bio_alloc_bioset(ic->dev->bdev, 1, REQ_OP_READ, GFP_NOIO, &ic->recheck_bios);
2560 		bio_add_virt_nofail(outgoing_bio, outgoing_data,
2561 				ic->sectors_per_block << SECTOR_SHIFT);
2562 
2563 		bip = bio_integrity_alloc(outgoing_bio, GFP_NOIO, 1);
2564 		if (IS_ERR(bip)) {
2565 			bio_put(outgoing_bio);
2566 			bio->bi_status = errno_to_blk_status(PTR_ERR(bip));
2567 			bio_endio(bio);
2568 			return;
2569 		}
2570 
2571 		r = bio_integrity_add_page(outgoing_bio, virt_to_page(dio->integrity_payload), ic->tuple_size, 0);
2572 		if (unlikely(r != ic->tuple_size)) {
2573 			bio_put(outgoing_bio);
2574 			bio->bi_status = BLK_STS_RESOURCE;
2575 			bio_endio(bio);
2576 			return;
2577 		}
2578 
2579 		outgoing_bio->bi_iter.bi_sector = dio->bio_details.bi_iter.bi_sector + ic->start + SB_SECTORS;
2580 
2581 		r = submit_bio_wait(outgoing_bio);
2582 		if (unlikely(r != 0)) {
2583 			bio_put(outgoing_bio);
2584 			bio->bi_status = errno_to_blk_status(r);
2585 			bio_endio(bio);
2586 			return;
2587 		}
2588 		bio_put(outgoing_bio);
2589 
2590 		integrity_sector_checksum(ic, dio->bio_details.bi_iter.bi_sector, outgoing_data, digest);
2591 		if (unlikely(crypto_memneq(digest, dio->integrity_payload, min(crypto_shash_digestsize(ic->internal_hash), ic->tag_size)))) {
2592 			DMERR_LIMIT("%pg: Checksum failed at sector 0x%llx",
2593 				ic->dev->bdev, dio->bio_details.bi_iter.bi_sector);
2594 			atomic64_inc(&ic->number_of_mismatches);
2595 			dm_audit_log_bio(DM_MSG_PREFIX, "integrity-checksum",
2596 				bio, dio->bio_details.bi_iter.bi_sector, 0);
2597 
2598 			bio->bi_status = BLK_STS_PROTECTION;
2599 			bio_endio(bio);
2600 			return;
2601 		}
2602 
2603 		bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
2604 		mem = bvec_kmap_local(&bv);
2605 		memcpy(mem, outgoing_data, ic->sectors_per_block << SECTOR_SHIFT);
2606 		kunmap_local(mem);
2607 
2608 		bio_advance_iter_single(bio, &dio->bio_details.bi_iter, ic->sectors_per_block << SECTOR_SHIFT);
2609 	}
2610 
2611 	bio_endio(bio);
2612 }
2613 
2614 static int dm_integrity_end_io(struct dm_target *ti, struct bio *bio, blk_status_t *status)
2615 {
2616 	struct dm_integrity_c *ic = ti->private;
2617 	if (ic->mode == 'I') {
2618 		struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
2619 		if (dio->op == REQ_OP_READ && likely(*status == BLK_STS_OK)) {
2620 			unsigned pos = 0;
2621 			if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
2622 			    unlikely(dio->integrity_range_locked))
2623 				goto skip_check;
2624 			while (dio->bio_details.bi_iter.bi_size) {
2625 				char digest[HASH_MAX_DIGESTSIZE];
2626 				struct bio_vec bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
2627 				char *mem = bvec_kmap_local(&bv);
2628 				//memset(mem, 0xff, ic->sectors_per_block << SECTOR_SHIFT);
2629 				integrity_sector_checksum(ic, dio->bio_details.bi_iter.bi_sector, mem, digest);
2630 				if (unlikely(crypto_memneq(digest, dio->integrity_payload + pos,
2631 						min(crypto_shash_digestsize(ic->internal_hash), ic->tag_size)))) {
2632 					kunmap_local(mem);
2633 					dm_integrity_free_payload(dio);
2634 					INIT_WORK(&dio->work, dm_integrity_inline_recheck);
2635 					queue_work(ic->offload_wq, &dio->work);
2636 					return DM_ENDIO_INCOMPLETE;
2637 				}
2638 				kunmap_local(mem);
2639 				pos += ic->tuple_size;
2640 				bio_advance_iter_single(bio, &dio->bio_details.bi_iter, ic->sectors_per_block << SECTOR_SHIFT);
2641 			}
2642 		}
2643 skip_check:
2644 		dm_integrity_free_payload(dio);
2645 		if (unlikely(dio->integrity_range_locked))
2646 			remove_range(ic, &dio->range);
2647 	}
2648 	return DM_ENDIO_DONE;
2649 }
2650 
2651 static void integrity_bio_wait(struct work_struct *w)
2652 {
2653 	struct dm_integrity_io *dio = container_of(w, struct dm_integrity_io, work);
2654 	struct dm_integrity_c *ic = dio->ic;
2655 
2656 	if (ic->mode == 'I') {
2657 		struct bio *bio = dm_bio_from_per_bio_data(dio, sizeof(struct dm_integrity_io));
2658 		int r = dm_integrity_map_inline(dio, false);
2659 		switch (r) {
2660 			case DM_MAPIO_KILL:
2661 				bio->bi_status = BLK_STS_IOERR;
2662 				fallthrough;
2663 			case DM_MAPIO_REMAPPED:
2664 				submit_bio_noacct(bio);
2665 				fallthrough;
2666 			case DM_MAPIO_SUBMITTED:
2667 				return;
2668 			default:
2669 				BUG();
2670 		}
2671 	} else {
2672 		dm_integrity_map_continue(dio, false);
2673 	}
2674 }
2675 
2676 static void pad_uncommitted(struct dm_integrity_c *ic)
2677 {
2678 	if (ic->free_section_entry) {
2679 		ic->free_sectors -= ic->journal_section_entries - ic->free_section_entry;
2680 		ic->free_section_entry = 0;
2681 		ic->free_section++;
2682 		wraparound_section(ic, &ic->free_section);
2683 		ic->n_uncommitted_sections++;
2684 	}
2685 	if (WARN_ON(ic->journal_sections * ic->journal_section_entries !=
2686 		    (ic->n_uncommitted_sections + ic->n_committed_sections) *
2687 		    ic->journal_section_entries + ic->free_sectors)) {
2688 		DMCRIT("journal_sections %u, journal_section_entries %u, "
2689 		       "n_uncommitted_sections %u, n_committed_sections %u, "
2690 		       "journal_section_entries %u, free_sectors %u",
2691 		       ic->journal_sections, ic->journal_section_entries,
2692 		       ic->n_uncommitted_sections, ic->n_committed_sections,
2693 		       ic->journal_section_entries, ic->free_sectors);
2694 	}
2695 }
2696 
2697 static void integrity_commit(struct work_struct *w)
2698 {
2699 	struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, commit_work);
2700 	unsigned int commit_start, commit_sections;
2701 	unsigned int i, j, n;
2702 	struct bio *flushes;
2703 
2704 	timer_delete(&ic->autocommit_timer);
2705 
2706 	if (ic->mode == 'I')
2707 		return;
2708 
2709 	spin_lock_irq(&ic->endio_wait.lock);
2710 	flushes = bio_list_get(&ic->flush_bio_list);
2711 	if (unlikely(ic->mode != 'J')) {
2712 		spin_unlock_irq(&ic->endio_wait.lock);
2713 		dm_integrity_flush_buffers(ic, true);
2714 		goto release_flush_bios;
2715 	}
2716 
2717 	pad_uncommitted(ic);
2718 	commit_start = ic->uncommitted_section;
2719 	commit_sections = ic->n_uncommitted_sections;
2720 	spin_unlock_irq(&ic->endio_wait.lock);
2721 
2722 	if (!commit_sections)
2723 		goto release_flush_bios;
2724 
2725 	ic->wrote_to_journal = true;
2726 
2727 	i = commit_start;
2728 	for (n = 0; n < commit_sections; n++) {
2729 		for (j = 0; j < ic->journal_section_entries; j++) {
2730 			struct journal_entry *je;
2731 
2732 			je = access_journal_entry(ic, i, j);
2733 			io_wait_event(ic->copy_to_journal_wait, !journal_entry_is_inprogress(je));
2734 		}
2735 		for (j = 0; j < ic->journal_section_sectors; j++) {
2736 			struct journal_sector *js;
2737 
2738 			js = access_journal(ic, i, j);
2739 			js->commit_id = dm_integrity_commit_id(ic, i, j, ic->commit_seq);
2740 		}
2741 		i++;
2742 		if (unlikely(i >= ic->journal_sections))
2743 			ic->commit_seq = next_commit_seq(ic->commit_seq);
2744 		wraparound_section(ic, &i);
2745 	}
2746 	smp_rmb();
2747 
2748 	write_journal(ic, commit_start, commit_sections);
2749 
2750 	spin_lock_irq(&ic->endio_wait.lock);
2751 	ic->uncommitted_section += commit_sections;
2752 	wraparound_section(ic, &ic->uncommitted_section);
2753 	ic->n_uncommitted_sections -= commit_sections;
2754 	ic->n_committed_sections += commit_sections;
2755 	spin_unlock_irq(&ic->endio_wait.lock);
2756 
2757 	if (READ_ONCE(ic->free_sectors) <= ic->free_sectors_threshold)
2758 		queue_work(ic->writer_wq, &ic->writer_work);
2759 
2760 release_flush_bios:
2761 	while (flushes) {
2762 		struct bio *next = flushes->bi_next;
2763 
2764 		flushes->bi_next = NULL;
2765 		do_endio(ic, flushes);
2766 		flushes = next;
2767 	}
2768 }
2769 
2770 static void complete_copy_from_journal(unsigned long error, void *context)
2771 {
2772 	struct journal_io *io = context;
2773 	struct journal_completion *comp = io->comp;
2774 	struct dm_integrity_c *ic = comp->ic;
2775 
2776 	remove_range(ic, &io->range);
2777 	mempool_free(io, &ic->journal_io_mempool);
2778 	if (unlikely(error != 0))
2779 		dm_integrity_io_error(ic, "copying from journal", -EIO);
2780 	complete_journal_op(comp);
2781 }
2782 
2783 static void restore_last_bytes(struct dm_integrity_c *ic, struct journal_sector *js,
2784 			       struct journal_entry *je)
2785 {
2786 	unsigned int s = 0;
2787 
2788 	do {
2789 		js->commit_id = je->last_bytes[s];
2790 		js++;
2791 	} while (++s < ic->sectors_per_block);
2792 }
2793 
2794 static void do_journal_write(struct dm_integrity_c *ic, unsigned int write_start,
2795 			     unsigned int write_sections, bool from_replay)
2796 {
2797 	unsigned int i, j, n;
2798 	struct journal_completion comp;
2799 	struct blk_plug plug;
2800 
2801 	blk_start_plug(&plug);
2802 
2803 	comp.ic = ic;
2804 	comp.in_flight = (atomic_t)ATOMIC_INIT(1);
2805 	init_completion(&comp.comp);
2806 
2807 	i = write_start;
2808 	for (n = 0; n < write_sections; n++, i++, wraparound_section(ic, &i)) {
2809 #ifndef INTERNAL_VERIFY
2810 		if (unlikely(from_replay))
2811 #endif
2812 			rw_section_mac(ic, i, false);
2813 		for (j = 0; j < ic->journal_section_entries; j++) {
2814 			struct journal_entry *je = access_journal_entry(ic, i, j);
2815 			sector_t sec, area, offset;
2816 			unsigned int k, l, next_loop;
2817 			sector_t metadata_block;
2818 			unsigned int metadata_offset;
2819 			struct journal_io *io;
2820 
2821 			if (journal_entry_is_unused(je))
2822 				continue;
2823 			BUG_ON(unlikely(journal_entry_is_inprogress(je)) && !from_replay);
2824 			sec = journal_entry_get_sector(je);
2825 			if (unlikely(from_replay)) {
2826 				if (unlikely(sec & (unsigned int)(ic->sectors_per_block - 1))) {
2827 					dm_integrity_io_error(ic, "invalid sector in journal", -EIO);
2828 					sec &= ~(sector_t)(ic->sectors_per_block - 1);
2829 				}
2830 				if (unlikely(sec >= ic->provided_data_sectors)) {
2831 					journal_entry_set_unused(je);
2832 					continue;
2833 				}
2834 			}
2835 			get_area_and_offset(ic, sec, &area, &offset);
2836 			restore_last_bytes(ic, access_journal_data(ic, i, j), je);
2837 			for (k = j + 1; k < ic->journal_section_entries; k++) {
2838 				struct journal_entry *je2 = access_journal_entry(ic, i, k);
2839 				sector_t sec2, area2, offset2;
2840 
2841 				if (journal_entry_is_unused(je2))
2842 					break;
2843 				BUG_ON(unlikely(journal_entry_is_inprogress(je2)) && !from_replay);
2844 				sec2 = journal_entry_get_sector(je2);
2845 				if (unlikely(sec2 >= ic->provided_data_sectors))
2846 					break;
2847 				get_area_and_offset(ic, sec2, &area2, &offset2);
2848 				if (area2 != area || offset2 != offset + ((k - j) << ic->sb->log2_sectors_per_block))
2849 					break;
2850 				restore_last_bytes(ic, access_journal_data(ic, i, k), je2);
2851 			}
2852 			next_loop = k - 1;
2853 
2854 			io = mempool_alloc(&ic->journal_io_mempool, GFP_NOIO);
2855 			io->comp = &comp;
2856 			io->range.logical_sector = sec;
2857 			io->range.n_sectors = (k - j) << ic->sb->log2_sectors_per_block;
2858 
2859 			spin_lock_irq(&ic->endio_wait.lock);
2860 			add_new_range_and_wait(ic, &io->range);
2861 
2862 			if (likely(!from_replay)) {
2863 				struct journal_node *section_node = &ic->journal_tree[i * ic->journal_section_entries];
2864 
2865 				/* don't write if there is newer committed sector */
2866 				while (j < k && find_newer_committed_node(ic, &section_node[j])) {
2867 					struct journal_entry *je2 = access_journal_entry(ic, i, j);
2868 
2869 					journal_entry_set_unused(je2);
2870 					remove_journal_node(ic, &section_node[j]);
2871 					j++;
2872 					sec += ic->sectors_per_block;
2873 					offset += ic->sectors_per_block;
2874 				}
2875 				while (j < k && find_newer_committed_node(ic, &section_node[k - 1])) {
2876 					struct journal_entry *je2 = access_journal_entry(ic, i, k - 1);
2877 
2878 					journal_entry_set_unused(je2);
2879 					remove_journal_node(ic, &section_node[k - 1]);
2880 					k--;
2881 				}
2882 				if (j == k) {
2883 					remove_range_unlocked(ic, &io->range);
2884 					spin_unlock_irq(&ic->endio_wait.lock);
2885 					mempool_free(io, &ic->journal_io_mempool);
2886 					goto skip_io;
2887 				}
2888 				for (l = j; l < k; l++)
2889 					remove_journal_node(ic, &section_node[l]);
2890 			}
2891 			spin_unlock_irq(&ic->endio_wait.lock);
2892 
2893 			metadata_block = get_metadata_sector_and_offset(ic, area, offset, &metadata_offset);
2894 			for (l = j; l < k; l++) {
2895 				int r;
2896 				struct journal_entry *je2 = access_journal_entry(ic, i, l);
2897 
2898 				if (
2899 #ifndef INTERNAL_VERIFY
2900 				    unlikely(from_replay) &&
2901 #endif
2902 				    ic->internal_hash) {
2903 					char test_tag[MAX_T(size_t, HASH_MAX_DIGESTSIZE, MAX_TAG_SIZE)];
2904 
2905 					integrity_sector_checksum(ic, sec + ((l - j) << ic->sb->log2_sectors_per_block),
2906 								  (char *)access_journal_data(ic, i, l), test_tag);
2907 					if (unlikely(crypto_memneq(test_tag, journal_entry_tag(ic, je2), ic->tag_size))) {
2908 						dm_integrity_io_error(ic, "tag mismatch when replaying journal", -EILSEQ);
2909 						dm_audit_log_target(DM_MSG_PREFIX, "integrity-replay-journal", ic->ti, 0);
2910 					}
2911 				}
2912 
2913 				journal_entry_set_unused(je2);
2914 				r = dm_integrity_rw_tag(ic, journal_entry_tag(ic, je2), &metadata_block, &metadata_offset,
2915 							ic->tag_size, TAG_WRITE);
2916 				if (unlikely(r))
2917 					dm_integrity_io_error(ic, "reading tags", r);
2918 			}
2919 
2920 			atomic_inc(&comp.in_flight);
2921 			copy_from_journal(ic, i, j << ic->sb->log2_sectors_per_block,
2922 					  (k - j) << ic->sb->log2_sectors_per_block,
2923 					  get_data_sector(ic, area, offset),
2924 					  complete_copy_from_journal, io);
2925 skip_io:
2926 			j = next_loop;
2927 		}
2928 	}
2929 
2930 	dm_bufio_write_dirty_buffers_async(ic->bufio);
2931 
2932 	blk_finish_plug(&plug);
2933 
2934 	complete_journal_op(&comp);
2935 	wait_for_completion_io(&comp.comp);
2936 
2937 	dm_integrity_flush_buffers(ic, true);
2938 }
2939 
2940 static void integrity_writer(struct work_struct *w)
2941 {
2942 	struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, writer_work);
2943 	unsigned int write_start, write_sections;
2944 	unsigned int prev_free_sectors;
2945 
2946 	spin_lock_irq(&ic->endio_wait.lock);
2947 	write_start = ic->committed_section;
2948 	write_sections = ic->n_committed_sections;
2949 	spin_unlock_irq(&ic->endio_wait.lock);
2950 
2951 	if (!write_sections)
2952 		return;
2953 
2954 	do_journal_write(ic, write_start, write_sections, false);
2955 
2956 	spin_lock_irq(&ic->endio_wait.lock);
2957 
2958 	ic->committed_section += write_sections;
2959 	wraparound_section(ic, &ic->committed_section);
2960 	ic->n_committed_sections -= write_sections;
2961 
2962 	prev_free_sectors = ic->free_sectors;
2963 	ic->free_sectors += write_sections * ic->journal_section_entries;
2964 	if (unlikely(!prev_free_sectors))
2965 		wake_up_locked(&ic->endio_wait);
2966 
2967 	spin_unlock_irq(&ic->endio_wait.lock);
2968 }
2969 
2970 static void recalc_write_super(struct dm_integrity_c *ic)
2971 {
2972 	int r;
2973 
2974 	dm_integrity_flush_buffers(ic, false);
2975 	if (dm_integrity_failed(ic))
2976 		return;
2977 
2978 	r = sync_rw_sb(ic, REQ_OP_WRITE);
2979 	if (unlikely(r))
2980 		dm_integrity_io_error(ic, "writing superblock", r);
2981 }
2982 
2983 static void integrity_recalc(struct work_struct *w)
2984 {
2985 	struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, recalc_work);
2986 	size_t recalc_tags_size;
2987 	u8 *recalc_buffer = NULL;
2988 	u8 *recalc_tags = NULL;
2989 	struct dm_integrity_range range;
2990 	struct dm_io_request io_req;
2991 	struct dm_io_region io_loc;
2992 	sector_t area, offset;
2993 	sector_t metadata_block;
2994 	unsigned int metadata_offset;
2995 	sector_t logical_sector, n_sectors;
2996 	__u8 *t;
2997 	unsigned int i;
2998 	int r;
2999 	unsigned int super_counter = 0;
3000 	unsigned recalc_sectors = RECALC_SECTORS;
3001 
3002 retry:
3003 	recalc_buffer = __vmalloc(recalc_sectors << SECTOR_SHIFT, GFP_NOIO);
3004 	if (!recalc_buffer) {
3005 oom:
3006 		recalc_sectors >>= 1;
3007 		if (recalc_sectors >= 1U << ic->sb->log2_sectors_per_block)
3008 			goto retry;
3009 		DMCRIT("out of memory for recalculate buffer - recalculation disabled");
3010 		goto free_ret;
3011 	}
3012 	recalc_tags_size = (recalc_sectors >> ic->sb->log2_sectors_per_block) * ic->tag_size;
3013 	if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size)
3014 		recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size;
3015 	recalc_tags = kvmalloc(recalc_tags_size, GFP_NOIO);
3016 	if (!recalc_tags) {
3017 		vfree(recalc_buffer);
3018 		recalc_buffer = NULL;
3019 		goto oom;
3020 	}
3021 
3022 	DEBUG_print("start recalculation... (position %llx)\n", le64_to_cpu(ic->sb->recalc_sector));
3023 
3024 	spin_lock_irq(&ic->endio_wait.lock);
3025 
3026 next_chunk:
3027 
3028 	if (unlikely(dm_post_suspending(ic->ti)))
3029 		goto unlock_ret;
3030 
3031 	range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
3032 	if (unlikely(range.logical_sector >= ic->provided_data_sectors)) {
3033 		if (ic->mode == 'B') {
3034 			block_bitmap_op(ic, ic->recalc_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR);
3035 			DEBUG_print("queue_delayed_work: bitmap_flush_work\n");
3036 			queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, 0);
3037 		}
3038 		goto unlock_ret;
3039 	}
3040 
3041 	get_area_and_offset(ic, range.logical_sector, &area, &offset);
3042 	range.n_sectors = min((sector_t)recalc_sectors, ic->provided_data_sectors - range.logical_sector);
3043 	if (!ic->meta_dev)
3044 		range.n_sectors = min(range.n_sectors, ((sector_t)1U << ic->sb->log2_interleave_sectors) - (unsigned int)offset);
3045 
3046 	add_new_range_and_wait(ic, &range);
3047 	spin_unlock_irq(&ic->endio_wait.lock);
3048 	logical_sector = range.logical_sector;
3049 	n_sectors = range.n_sectors;
3050 
3051 	if (ic->mode == 'B') {
3052 		if (block_bitmap_op(ic, ic->recalc_bitmap, logical_sector, n_sectors, BITMAP_OP_TEST_ALL_CLEAR))
3053 			goto advance_and_next;
3054 
3055 		while (block_bitmap_op(ic, ic->recalc_bitmap, logical_sector,
3056 				       ic->sectors_per_block, BITMAP_OP_TEST_ALL_CLEAR)) {
3057 			logical_sector += ic->sectors_per_block;
3058 			n_sectors -= ic->sectors_per_block;
3059 			cond_resched();
3060 		}
3061 		while (block_bitmap_op(ic, ic->recalc_bitmap, logical_sector + n_sectors - ic->sectors_per_block,
3062 				       ic->sectors_per_block, BITMAP_OP_TEST_ALL_CLEAR)) {
3063 			n_sectors -= ic->sectors_per_block;
3064 			cond_resched();
3065 		}
3066 		get_area_and_offset(ic, logical_sector, &area, &offset);
3067 	}
3068 
3069 	DEBUG_print("recalculating: %llx, %llx\n", logical_sector, n_sectors);
3070 
3071 	if (unlikely(++super_counter == RECALC_WRITE_SUPER)) {
3072 		recalc_write_super(ic);
3073 		if (ic->mode == 'B')
3074 			queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, ic->bitmap_flush_interval);
3075 
3076 		super_counter = 0;
3077 	}
3078 
3079 	if (unlikely(dm_integrity_failed(ic)))
3080 		goto err;
3081 
3082 	io_req.bi_opf = REQ_OP_READ;
3083 	io_req.mem.type = DM_IO_VMA;
3084 	io_req.mem.ptr.addr = recalc_buffer;
3085 	io_req.notify.fn = NULL;
3086 	io_req.client = ic->io;
3087 	io_loc.bdev = ic->dev->bdev;
3088 	io_loc.sector = get_data_sector(ic, area, offset);
3089 	io_loc.count = n_sectors;
3090 
3091 	r = dm_io(&io_req, 1, &io_loc, NULL, IOPRIO_DEFAULT);
3092 	if (unlikely(r)) {
3093 		dm_integrity_io_error(ic, "reading data", r);
3094 		goto err;
3095 	}
3096 
3097 	t = recalc_tags;
3098 	for (i = 0; i < n_sectors; i += ic->sectors_per_block) {
3099 		integrity_sector_checksum(ic, logical_sector + i, recalc_buffer + (i << SECTOR_SHIFT), t);
3100 		t += ic->tag_size;
3101 	}
3102 
3103 	metadata_block = get_metadata_sector_and_offset(ic, area, offset, &metadata_offset);
3104 
3105 	r = dm_integrity_rw_tag(ic, recalc_tags, &metadata_block, &metadata_offset, t - recalc_tags, TAG_WRITE);
3106 	if (unlikely(r)) {
3107 		dm_integrity_io_error(ic, "writing tags", r);
3108 		goto err;
3109 	}
3110 
3111 	if (ic->mode == 'B') {
3112 		sector_t start, end;
3113 
3114 		start = (range.logical_sector >>
3115 			 (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) <<
3116 			(ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
3117 		end = ((range.logical_sector + range.n_sectors) >>
3118 		       (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) <<
3119 			(ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
3120 		block_bitmap_op(ic, ic->recalc_bitmap, start, end - start, BITMAP_OP_CLEAR);
3121 	}
3122 
3123 advance_and_next:
3124 	cond_resched();
3125 
3126 	spin_lock_irq(&ic->endio_wait.lock);
3127 	remove_range_unlocked(ic, &range);
3128 	ic->sb->recalc_sector = cpu_to_le64(range.logical_sector + range.n_sectors);
3129 	goto next_chunk;
3130 
3131 err:
3132 	remove_range(ic, &range);
3133 	goto free_ret;
3134 
3135 unlock_ret:
3136 	spin_unlock_irq(&ic->endio_wait.lock);
3137 
3138 	recalc_write_super(ic);
3139 
3140 free_ret:
3141 	vfree(recalc_buffer);
3142 	kvfree(recalc_tags);
3143 }
3144 
3145 static void integrity_recalc_inline(struct work_struct *w)
3146 {
3147 	struct dm_integrity_c *ic = container_of(w, struct dm_integrity_c, recalc_work);
3148 	size_t recalc_tags_size;
3149 	u8 *recalc_buffer = NULL;
3150 	u8 *recalc_tags = NULL;
3151 	struct dm_integrity_range range;
3152 	struct bio *bio;
3153 	struct bio_integrity_payload *bip;
3154 	__u8 *t;
3155 	unsigned int i;
3156 	int r;
3157 	unsigned ret;
3158 	unsigned int super_counter = 0;
3159 	unsigned recalc_sectors = RECALC_SECTORS;
3160 
3161 retry:
3162 	recalc_buffer = kmalloc(recalc_sectors << SECTOR_SHIFT, GFP_NOIO | __GFP_NOWARN);
3163 	if (!recalc_buffer) {
3164 oom:
3165 		recalc_sectors >>= 1;
3166 		if (recalc_sectors >= 1U << ic->sb->log2_sectors_per_block)
3167 			goto retry;
3168 		DMCRIT("out of memory for recalculate buffer - recalculation disabled");
3169 		goto free_ret;
3170 	}
3171 
3172 	recalc_tags_size = (recalc_sectors >> ic->sb->log2_sectors_per_block) * ic->tuple_size;
3173 	if (crypto_shash_digestsize(ic->internal_hash) > ic->tuple_size)
3174 		recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tuple_size;
3175 	recalc_tags = kmalloc(recalc_tags_size, GFP_NOIO | __GFP_NOWARN);
3176 	if (!recalc_tags) {
3177 		kfree(recalc_buffer);
3178 		recalc_buffer = NULL;
3179 		goto oom;
3180 	}
3181 
3182 	spin_lock_irq(&ic->endio_wait.lock);
3183 
3184 next_chunk:
3185 	if (unlikely(dm_post_suspending(ic->ti)))
3186 		goto unlock_ret;
3187 
3188 	range.logical_sector = le64_to_cpu(ic->sb->recalc_sector);
3189 	if (unlikely(range.logical_sector >= ic->provided_data_sectors))
3190 		goto unlock_ret;
3191 	range.n_sectors = min((sector_t)recalc_sectors, ic->provided_data_sectors - range.logical_sector);
3192 
3193 	add_new_range_and_wait(ic, &range);
3194 	spin_unlock_irq(&ic->endio_wait.lock);
3195 
3196 	if (unlikely(++super_counter == RECALC_WRITE_SUPER)) {
3197 		recalc_write_super(ic);
3198 		super_counter = 0;
3199 	}
3200 
3201 	if (unlikely(dm_integrity_failed(ic)))
3202 		goto err;
3203 
3204 	DEBUG_print("recalculating: %llx - %llx\n", range.logical_sector, range.n_sectors);
3205 
3206 	bio = bio_alloc_bioset(ic->dev->bdev, 1, REQ_OP_READ, GFP_NOIO, &ic->recalc_bios);
3207 	bio->bi_iter.bi_sector = ic->start + SB_SECTORS + range.logical_sector;
3208 	bio_add_virt_nofail(bio, recalc_buffer,
3209 			range.n_sectors << SECTOR_SHIFT);
3210 	r = submit_bio_wait(bio);
3211 	bio_put(bio);
3212 	if (unlikely(r)) {
3213 		dm_integrity_io_error(ic, "reading data", r);
3214 		goto err;
3215 	}
3216 
3217 	t = recalc_tags;
3218 	for (i = 0; i < range.n_sectors; i += ic->sectors_per_block) {
3219 		memset(t, 0, ic->tuple_size);
3220 		integrity_sector_checksum(ic, range.logical_sector + i, recalc_buffer + (i << SECTOR_SHIFT), t);
3221 		t += ic->tuple_size;
3222 	}
3223 
3224 	bio = bio_alloc_bioset(ic->dev->bdev, 1, REQ_OP_WRITE, GFP_NOIO, &ic->recalc_bios);
3225 	bio->bi_iter.bi_sector = ic->start + SB_SECTORS + range.logical_sector;
3226 	bio_add_virt_nofail(bio, recalc_buffer,
3227 			range.n_sectors << SECTOR_SHIFT);
3228 
3229 	bip = bio_integrity_alloc(bio, GFP_NOIO, 1);
3230 	if (unlikely(IS_ERR(bip))) {
3231 		bio_put(bio);
3232 		DMCRIT("out of memory for bio integrity payload - recalculation disabled");
3233 		goto err;
3234 	}
3235 	ret = bio_integrity_add_page(bio, virt_to_page(recalc_tags), t - recalc_tags, offset_in_page(recalc_tags));
3236 	if (unlikely(ret != t - recalc_tags)) {
3237 		bio_put(bio);
3238 		dm_integrity_io_error(ic, "attaching integrity tags", -ENOMEM);
3239 		goto err;
3240 	}
3241 
3242 	r = submit_bio_wait(bio);
3243 	bio_put(bio);
3244 	if (unlikely(r)) {
3245 		dm_integrity_io_error(ic, "writing data", r);
3246 		goto err;
3247 	}
3248 
3249 	cond_resched();
3250 	spin_lock_irq(&ic->endio_wait.lock);
3251 	remove_range_unlocked(ic, &range);
3252 #ifdef CONFIG_64BIT
3253 	/* Paired with smp_load_acquire in dm_integrity_map_inline. */
3254 	smp_store_release(&ic->sb->recalc_sector, cpu_to_le64(range.logical_sector + range.n_sectors));
3255 #else
3256 	ic->sb->recalc_sector = cpu_to_le64(range.logical_sector + range.n_sectors);
3257 #endif
3258 	goto next_chunk;
3259 
3260 err:
3261 	remove_range(ic, &range);
3262 	goto free_ret;
3263 
3264 unlock_ret:
3265 	spin_unlock_irq(&ic->endio_wait.lock);
3266 
3267 	recalc_write_super(ic);
3268 
3269 free_ret:
3270 	kfree(recalc_buffer);
3271 	kfree(recalc_tags);
3272 }
3273 
3274 static void bitmap_block_work(struct work_struct *w)
3275 {
3276 	struct bitmap_block_status *bbs = container_of(w, struct bitmap_block_status, work);
3277 	struct dm_integrity_c *ic = bbs->ic;
3278 	struct bio *bio;
3279 	struct bio_list bio_queue;
3280 	struct bio_list waiting;
3281 
3282 	bio_list_init(&waiting);
3283 
3284 	spin_lock(&bbs->bio_queue_lock);
3285 	bio_queue = bbs->bio_queue;
3286 	bio_list_init(&bbs->bio_queue);
3287 	spin_unlock(&bbs->bio_queue_lock);
3288 
3289 	while ((bio = bio_list_pop(&bio_queue))) {
3290 		struct dm_integrity_io *dio;
3291 
3292 		dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
3293 
3294 		if (block_bitmap_op(ic, ic->may_write_bitmap, dio->range.logical_sector,
3295 				    dio->range.n_sectors, BITMAP_OP_TEST_ALL_SET)) {
3296 			remove_range(ic, &dio->range);
3297 			INIT_WORK(&dio->work, integrity_bio_wait);
3298 			queue_work(ic->offload_wq, &dio->work);
3299 		} else {
3300 			block_bitmap_op(ic, ic->journal, dio->range.logical_sector,
3301 					dio->range.n_sectors, BITMAP_OP_SET);
3302 			bio_list_add(&waiting, bio);
3303 		}
3304 	}
3305 
3306 	if (bio_list_empty(&waiting))
3307 		return;
3308 
3309 	rw_journal_sectors(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC,
3310 			   bbs->idx * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT),
3311 			   BITMAP_BLOCK_SIZE >> SECTOR_SHIFT, NULL);
3312 
3313 	while ((bio = bio_list_pop(&waiting))) {
3314 		struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
3315 
3316 		block_bitmap_op(ic, ic->may_write_bitmap, dio->range.logical_sector,
3317 				dio->range.n_sectors, BITMAP_OP_SET);
3318 
3319 		remove_range(ic, &dio->range);
3320 		INIT_WORK(&dio->work, integrity_bio_wait);
3321 		queue_work(ic->offload_wq, &dio->work);
3322 	}
3323 
3324 	queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, ic->bitmap_flush_interval);
3325 }
3326 
3327 static void bitmap_flush_work(struct work_struct *work)
3328 {
3329 	struct dm_integrity_c *ic = container_of(work, struct dm_integrity_c, bitmap_flush_work.work);
3330 	struct dm_integrity_range range;
3331 	unsigned long limit;
3332 	struct bio *bio;
3333 
3334 	dm_integrity_flush_buffers(ic, false);
3335 
3336 	range.logical_sector = 0;
3337 	range.n_sectors = ic->provided_data_sectors;
3338 
3339 	spin_lock_irq(&ic->endio_wait.lock);
3340 	add_new_range_and_wait(ic, &range);
3341 	spin_unlock_irq(&ic->endio_wait.lock);
3342 
3343 	dm_integrity_flush_buffers(ic, true);
3344 
3345 	limit = ic->provided_data_sectors;
3346 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
3347 		limit = le64_to_cpu(ic->sb->recalc_sector)
3348 			>> (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)
3349 			<< (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit);
3350 	}
3351 	/*DEBUG_print("zeroing journal\n");*/
3352 	block_bitmap_op(ic, ic->journal, 0, limit, BITMAP_OP_CLEAR);
3353 	block_bitmap_op(ic, ic->may_write_bitmap, 0, limit, BITMAP_OP_CLEAR);
3354 
3355 	rw_journal_sectors(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, 0,
3356 			   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3357 
3358 	spin_lock_irq(&ic->endio_wait.lock);
3359 	remove_range_unlocked(ic, &range);
3360 	while (unlikely((bio = bio_list_pop(&ic->synchronous_bios)) != NULL)) {
3361 		bio_endio(bio);
3362 		spin_unlock_irq(&ic->endio_wait.lock);
3363 		spin_lock_irq(&ic->endio_wait.lock);
3364 	}
3365 	spin_unlock_irq(&ic->endio_wait.lock);
3366 }
3367 
3368 
3369 static void init_journal(struct dm_integrity_c *ic, unsigned int start_section,
3370 			 unsigned int n_sections, unsigned char commit_seq)
3371 {
3372 	unsigned int i, j, n;
3373 
3374 	if (!n_sections)
3375 		return;
3376 
3377 	for (n = 0; n < n_sections; n++) {
3378 		i = start_section + n;
3379 		wraparound_section(ic, &i);
3380 		for (j = 0; j < ic->journal_section_sectors; j++) {
3381 			struct journal_sector *js = access_journal(ic, i, j);
3382 
3383 			BUILD_BUG_ON(sizeof(js->sectors) != JOURNAL_SECTOR_DATA);
3384 			memset(&js->sectors, 0, sizeof(js->sectors));
3385 			js->commit_id = dm_integrity_commit_id(ic, i, j, commit_seq);
3386 		}
3387 		for (j = 0; j < ic->journal_section_entries; j++) {
3388 			struct journal_entry *je = access_journal_entry(ic, i, j);
3389 
3390 			journal_entry_set_unused(je);
3391 		}
3392 	}
3393 
3394 	write_journal(ic, start_section, n_sections);
3395 }
3396 
3397 static int find_commit_seq(struct dm_integrity_c *ic, unsigned int i, unsigned int j, commit_id_t id)
3398 {
3399 	unsigned char k;
3400 
3401 	for (k = 0; k < N_COMMIT_IDS; k++) {
3402 		if (dm_integrity_commit_id(ic, i, j, k) == id)
3403 			return k;
3404 	}
3405 	dm_integrity_io_error(ic, "journal commit id", -EIO);
3406 	return -EIO;
3407 }
3408 
3409 static void replay_journal(struct dm_integrity_c *ic)
3410 {
3411 	unsigned int i, j;
3412 	bool used_commit_ids[N_COMMIT_IDS];
3413 	unsigned int max_commit_id_sections[N_COMMIT_IDS];
3414 	unsigned int write_start, write_sections;
3415 	unsigned int continue_section;
3416 	bool journal_empty;
3417 	unsigned char unused, last_used, want_commit_seq;
3418 
3419 	if (ic->mode == 'R')
3420 		return;
3421 
3422 	if (ic->journal_uptodate)
3423 		return;
3424 
3425 	last_used = 0;
3426 	write_start = 0;
3427 
3428 	if (!ic->just_formatted) {
3429 		DEBUG_print("reading journal\n");
3430 		rw_journal(ic, REQ_OP_READ, 0, ic->journal_sections, NULL);
3431 		if (ic->journal_io)
3432 			DEBUG_bytes(lowmem_page_address(ic->journal_io[0].page), 64, "read journal");
3433 		if (ic->journal_io) {
3434 			struct journal_completion crypt_comp;
3435 
3436 			crypt_comp.ic = ic;
3437 			init_completion(&crypt_comp.comp);
3438 			crypt_comp.in_flight = (atomic_t)ATOMIC_INIT(0);
3439 			encrypt_journal(ic, false, 0, ic->journal_sections, &crypt_comp);
3440 			wait_for_completion(&crypt_comp.comp);
3441 		}
3442 		DEBUG_bytes(lowmem_page_address(ic->journal[0].page), 64, "decrypted journal");
3443 	}
3444 
3445 	if (dm_integrity_failed(ic))
3446 		goto clear_journal;
3447 
3448 	journal_empty = true;
3449 	memset(used_commit_ids, 0, sizeof(used_commit_ids));
3450 	memset(max_commit_id_sections, 0, sizeof(max_commit_id_sections));
3451 	for (i = 0; i < ic->journal_sections; i++) {
3452 		for (j = 0; j < ic->journal_section_sectors; j++) {
3453 			int k;
3454 			struct journal_sector *js = access_journal(ic, i, j);
3455 
3456 			k = find_commit_seq(ic, i, j, js->commit_id);
3457 			if (k < 0)
3458 				goto clear_journal;
3459 			used_commit_ids[k] = true;
3460 			max_commit_id_sections[k] = i;
3461 		}
3462 		if (journal_empty) {
3463 			for (j = 0; j < ic->journal_section_entries; j++) {
3464 				struct journal_entry *je = access_journal_entry(ic, i, j);
3465 
3466 				if (!journal_entry_is_unused(je)) {
3467 					journal_empty = false;
3468 					break;
3469 				}
3470 			}
3471 		}
3472 	}
3473 
3474 	if (!used_commit_ids[N_COMMIT_IDS - 1]) {
3475 		unused = N_COMMIT_IDS - 1;
3476 		while (unused && !used_commit_ids[unused - 1])
3477 			unused--;
3478 	} else {
3479 		for (unused = 0; unused < N_COMMIT_IDS; unused++)
3480 			if (!used_commit_ids[unused])
3481 				break;
3482 		if (unused == N_COMMIT_IDS) {
3483 			dm_integrity_io_error(ic, "journal commit ids", -EIO);
3484 			goto clear_journal;
3485 		}
3486 	}
3487 	DEBUG_print("first unused commit seq %d [%d,%d,%d,%d]\n",
3488 		    unused, used_commit_ids[0], used_commit_ids[1],
3489 		    used_commit_ids[2], used_commit_ids[3]);
3490 
3491 	last_used = prev_commit_seq(unused);
3492 	want_commit_seq = prev_commit_seq(last_used);
3493 
3494 	if (!used_commit_ids[want_commit_seq] && used_commit_ids[prev_commit_seq(want_commit_seq)])
3495 		journal_empty = true;
3496 
3497 	write_start = max_commit_id_sections[last_used] + 1;
3498 	if (unlikely(write_start >= ic->journal_sections))
3499 		want_commit_seq = next_commit_seq(want_commit_seq);
3500 	wraparound_section(ic, &write_start);
3501 
3502 	i = write_start;
3503 	for (write_sections = 0; write_sections < ic->journal_sections; write_sections++) {
3504 		for (j = 0; j < ic->journal_section_sectors; j++) {
3505 			struct journal_sector *js = access_journal(ic, i, j);
3506 
3507 			if (js->commit_id != dm_integrity_commit_id(ic, i, j, want_commit_seq)) {
3508 				/*
3509 				 * This could be caused by crash during writing.
3510 				 * We won't replay the inconsistent part of the
3511 				 * journal.
3512 				 */
3513 				DEBUG_print("commit id mismatch at position (%u, %u): %d != %d\n",
3514 					    i, j, find_commit_seq(ic, i, j, js->commit_id), want_commit_seq);
3515 				goto brk;
3516 			}
3517 		}
3518 		i++;
3519 		if (unlikely(i >= ic->journal_sections))
3520 			want_commit_seq = next_commit_seq(want_commit_seq);
3521 		wraparound_section(ic, &i);
3522 	}
3523 brk:
3524 
3525 	if (!journal_empty) {
3526 		DEBUG_print("replaying %u sections, starting at %u, commit seq %d\n",
3527 			    write_sections, write_start, want_commit_seq);
3528 		do_journal_write(ic, write_start, write_sections, true);
3529 	}
3530 
3531 	if (write_sections == ic->journal_sections && (ic->mode == 'J' || journal_empty)) {
3532 		continue_section = write_start;
3533 		ic->commit_seq = want_commit_seq;
3534 		DEBUG_print("continuing from section %u, commit seq %d\n", write_start, ic->commit_seq);
3535 	} else {
3536 		unsigned int s;
3537 		unsigned char erase_seq;
3538 
3539 clear_journal:
3540 		DEBUG_print("clearing journal\n");
3541 
3542 		erase_seq = prev_commit_seq(prev_commit_seq(last_used));
3543 		s = write_start;
3544 		init_journal(ic, s, 1, erase_seq);
3545 		s++;
3546 		wraparound_section(ic, &s);
3547 		if (ic->journal_sections >= 2) {
3548 			init_journal(ic, s, ic->journal_sections - 2, erase_seq);
3549 			s += ic->journal_sections - 2;
3550 			wraparound_section(ic, &s);
3551 			init_journal(ic, s, 1, erase_seq);
3552 		}
3553 
3554 		continue_section = 0;
3555 		ic->commit_seq = next_commit_seq(erase_seq);
3556 	}
3557 
3558 	ic->committed_section = continue_section;
3559 	ic->n_committed_sections = 0;
3560 
3561 	ic->uncommitted_section = continue_section;
3562 	ic->n_uncommitted_sections = 0;
3563 
3564 	ic->free_section = continue_section;
3565 	ic->free_section_entry = 0;
3566 	ic->free_sectors = ic->journal_entries;
3567 
3568 	ic->journal_tree_root = RB_ROOT;
3569 	for (i = 0; i < ic->journal_entries; i++)
3570 		init_journal_node(&ic->journal_tree[i]);
3571 }
3572 
3573 static void dm_integrity_enter_synchronous_mode(struct dm_integrity_c *ic)
3574 {
3575 	DEBUG_print("%s\n", __func__);
3576 
3577 	if (ic->mode == 'B') {
3578 		ic->bitmap_flush_interval = msecs_to_jiffies(10) + 1;
3579 		ic->synchronous_mode = 1;
3580 
3581 		cancel_delayed_work_sync(&ic->bitmap_flush_work);
3582 		queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, 0);
3583 		flush_workqueue(ic->commit_wq);
3584 	}
3585 }
3586 
3587 static int dm_integrity_reboot(struct notifier_block *n, unsigned long code, void *x)
3588 {
3589 	struct dm_integrity_c *ic = container_of(n, struct dm_integrity_c, reboot_notifier);
3590 
3591 	DEBUG_print("%s\n", __func__);
3592 
3593 	dm_integrity_enter_synchronous_mode(ic);
3594 
3595 	return NOTIFY_DONE;
3596 }
3597 
3598 static void dm_integrity_postsuspend(struct dm_target *ti)
3599 {
3600 	struct dm_integrity_c *ic = ti->private;
3601 	int r;
3602 
3603 	WARN_ON(unregister_reboot_notifier(&ic->reboot_notifier));
3604 
3605 	timer_delete_sync(&ic->autocommit_timer);
3606 
3607 	if (ic->recalc_wq)
3608 		drain_workqueue(ic->recalc_wq);
3609 
3610 	if (ic->mode == 'B')
3611 		cancel_delayed_work_sync(&ic->bitmap_flush_work);
3612 
3613 	queue_work(ic->commit_wq, &ic->commit_work);
3614 	drain_workqueue(ic->commit_wq);
3615 
3616 	if (ic->mode == 'J') {
3617 		queue_work(ic->writer_wq, &ic->writer_work);
3618 		drain_workqueue(ic->writer_wq);
3619 		dm_integrity_flush_buffers(ic, true);
3620 		if (ic->wrote_to_journal) {
3621 			init_journal(ic, ic->free_section,
3622 				     ic->journal_sections - ic->free_section, ic->commit_seq);
3623 			if (ic->free_section) {
3624 				init_journal(ic, 0, ic->free_section,
3625 					     next_commit_seq(ic->commit_seq));
3626 			}
3627 		}
3628 	}
3629 
3630 	if (ic->mode == 'B') {
3631 		dm_integrity_flush_buffers(ic, true);
3632 #if 1
3633 		/* set to 0 to test bitmap replay code */
3634 		init_journal(ic, 0, ic->journal_sections, 0);
3635 		ic->sb->flags &= ~cpu_to_le32(SB_FLAG_DIRTY_BITMAP);
3636 		r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
3637 		if (unlikely(r))
3638 			dm_integrity_io_error(ic, "writing superblock", r);
3639 #endif
3640 	}
3641 
3642 	BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
3643 
3644 	ic->journal_uptodate = true;
3645 }
3646 
3647 static void dm_integrity_resume(struct dm_target *ti)
3648 {
3649 	struct dm_integrity_c *ic = ti->private;
3650 	__u64 old_provided_data_sectors = le64_to_cpu(ic->sb->provided_data_sectors);
3651 	int r;
3652 
3653 	DEBUG_print("resume\n");
3654 
3655 	ic->wrote_to_journal = false;
3656 
3657 	if (ic->provided_data_sectors != old_provided_data_sectors) {
3658 		if (ic->provided_data_sectors > old_provided_data_sectors &&
3659 		    ic->mode == 'B' &&
3660 		    ic->sb->log2_blocks_per_bitmap_bit == ic->log2_blocks_per_bitmap_bit) {
3661 			rw_journal_sectors(ic, REQ_OP_READ, 0,
3662 					   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3663 			block_bitmap_op(ic, ic->journal, old_provided_data_sectors,
3664 					ic->provided_data_sectors - old_provided_data_sectors, BITMAP_OP_SET);
3665 			rw_journal_sectors(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, 0,
3666 					   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3667 		}
3668 
3669 		ic->sb->provided_data_sectors = cpu_to_le64(ic->provided_data_sectors);
3670 		r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
3671 		if (unlikely(r))
3672 			dm_integrity_io_error(ic, "writing superblock", r);
3673 	}
3674 
3675 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_DIRTY_BITMAP)) {
3676 		DEBUG_print("resume dirty_bitmap\n");
3677 		rw_journal_sectors(ic, REQ_OP_READ, 0,
3678 				   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3679 		if (ic->mode == 'B') {
3680 			if (ic->sb->log2_blocks_per_bitmap_bit == ic->log2_blocks_per_bitmap_bit &&
3681 			    !ic->reset_recalculate_flag) {
3682 				block_bitmap_copy(ic, ic->recalc_bitmap, ic->journal);
3683 				block_bitmap_copy(ic, ic->may_write_bitmap, ic->journal);
3684 				if (!block_bitmap_op(ic, ic->journal, 0, ic->provided_data_sectors,
3685 						     BITMAP_OP_TEST_ALL_CLEAR)) {
3686 					ic->sb->flags |= cpu_to_le32(SB_FLAG_RECALCULATING);
3687 					ic->sb->recalc_sector = cpu_to_le64(0);
3688 				}
3689 			} else {
3690 				DEBUG_print("non-matching blocks_per_bitmap_bit: %u, %u\n",
3691 					    ic->sb->log2_blocks_per_bitmap_bit, ic->log2_blocks_per_bitmap_bit);
3692 				ic->sb->log2_blocks_per_bitmap_bit = ic->log2_blocks_per_bitmap_bit;
3693 				block_bitmap_op(ic, ic->recalc_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_SET);
3694 				block_bitmap_op(ic, ic->may_write_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_SET);
3695 				block_bitmap_op(ic, ic->journal, 0, ic->provided_data_sectors, BITMAP_OP_SET);
3696 				rw_journal_sectors(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, 0,
3697 						   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3698 				ic->sb->flags |= cpu_to_le32(SB_FLAG_RECALCULATING);
3699 				ic->sb->recalc_sector = cpu_to_le64(0);
3700 			}
3701 		} else {
3702 			if (!(ic->sb->log2_blocks_per_bitmap_bit == ic->log2_blocks_per_bitmap_bit &&
3703 			      block_bitmap_op(ic, ic->journal, 0, ic->provided_data_sectors, BITMAP_OP_TEST_ALL_CLEAR)) ||
3704 			    ic->reset_recalculate_flag) {
3705 				ic->sb->flags |= cpu_to_le32(SB_FLAG_RECALCULATING);
3706 				ic->sb->recalc_sector = cpu_to_le64(0);
3707 			}
3708 			init_journal(ic, 0, ic->journal_sections, 0);
3709 			replay_journal(ic);
3710 			ic->sb->flags &= ~cpu_to_le32(SB_FLAG_DIRTY_BITMAP);
3711 		}
3712 		r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
3713 		if (unlikely(r))
3714 			dm_integrity_io_error(ic, "writing superblock", r);
3715 	} else {
3716 		replay_journal(ic);
3717 		if (ic->reset_recalculate_flag) {
3718 			ic->sb->flags |= cpu_to_le32(SB_FLAG_RECALCULATING);
3719 			ic->sb->recalc_sector = cpu_to_le64(0);
3720 		}
3721 		if (ic->mode == 'B') {
3722 			ic->sb->flags |= cpu_to_le32(SB_FLAG_DIRTY_BITMAP);
3723 			ic->sb->log2_blocks_per_bitmap_bit = ic->log2_blocks_per_bitmap_bit;
3724 			r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
3725 			if (unlikely(r))
3726 				dm_integrity_io_error(ic, "writing superblock", r);
3727 
3728 			block_bitmap_op(ic, ic->journal, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR);
3729 			block_bitmap_op(ic, ic->recalc_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR);
3730 			block_bitmap_op(ic, ic->may_write_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR);
3731 			if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
3732 			    le64_to_cpu(ic->sb->recalc_sector) < ic->provided_data_sectors) {
3733 				block_bitmap_op(ic, ic->journal, le64_to_cpu(ic->sb->recalc_sector),
3734 						ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_sector), BITMAP_OP_SET);
3735 				block_bitmap_op(ic, ic->recalc_bitmap, le64_to_cpu(ic->sb->recalc_sector),
3736 						ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_sector), BITMAP_OP_SET);
3737 				block_bitmap_op(ic, ic->may_write_bitmap, le64_to_cpu(ic->sb->recalc_sector),
3738 						ic->provided_data_sectors - le64_to_cpu(ic->sb->recalc_sector), BITMAP_OP_SET);
3739 			}
3740 			rw_journal_sectors(ic, REQ_OP_WRITE | REQ_FUA | REQ_SYNC, 0,
3741 					   ic->n_bitmap_blocks * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT), NULL);
3742 		}
3743 	}
3744 
3745 	DEBUG_print("testing recalc: %x\n", ic->sb->flags);
3746 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
3747 		__u64 recalc_pos = le64_to_cpu(ic->sb->recalc_sector);
3748 
3749 		DEBUG_print("recalc pos: %llx / %llx\n", recalc_pos, ic->provided_data_sectors);
3750 		if (recalc_pos < ic->provided_data_sectors) {
3751 			queue_work(ic->recalc_wq, &ic->recalc_work);
3752 		} else if (recalc_pos > ic->provided_data_sectors) {
3753 			ic->sb->recalc_sector = cpu_to_le64(ic->provided_data_sectors);
3754 			recalc_write_super(ic);
3755 		}
3756 	}
3757 
3758 	ic->reboot_notifier.notifier_call = dm_integrity_reboot;
3759 	ic->reboot_notifier.next = NULL;
3760 	ic->reboot_notifier.priority = INT_MAX - 1;	/* be notified after md and before hardware drivers */
3761 	WARN_ON(register_reboot_notifier(&ic->reboot_notifier));
3762 
3763 #if 0
3764 	/* set to 1 to stress test synchronous mode */
3765 	dm_integrity_enter_synchronous_mode(ic);
3766 #endif
3767 }
3768 
3769 static void dm_integrity_status(struct dm_target *ti, status_type_t type,
3770 				unsigned int status_flags, char *result, unsigned int maxlen)
3771 {
3772 	struct dm_integrity_c *ic = ti->private;
3773 	unsigned int arg_count;
3774 	size_t sz = 0;
3775 
3776 	switch (type) {
3777 	case STATUSTYPE_INFO:
3778 		DMEMIT("%llu %llu",
3779 			(unsigned long long)atomic64_read(&ic->number_of_mismatches),
3780 			ic->provided_data_sectors);
3781 		if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING))
3782 			DMEMIT(" %llu", le64_to_cpu(ic->sb->recalc_sector));
3783 		else
3784 			DMEMIT(" -");
3785 		break;
3786 
3787 	case STATUSTYPE_TABLE: {
3788 		arg_count = 1; /* buffer_sectors */
3789 		arg_count += !!ic->meta_dev;
3790 		arg_count += ic->sectors_per_block != 1;
3791 		arg_count += !!(ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING));
3792 		arg_count += ic->reset_recalculate_flag;
3793 		arg_count += ic->discard;
3794 		arg_count += ic->mode != 'I'; /* interleave_sectors */
3795 		arg_count += ic->mode == 'J'; /* journal_sectors */
3796 		arg_count += ic->mode == 'J'; /* journal_watermark */
3797 		arg_count += ic->mode == 'J'; /* commit_time */
3798 		arg_count += ic->mode == 'B'; /* sectors_per_bit */
3799 		arg_count += ic->mode == 'B'; /* bitmap_flush_interval */
3800 		arg_count += !!ic->internal_hash_alg.alg_string;
3801 		arg_count += !!ic->journal_crypt_alg.alg_string;
3802 		arg_count += !!ic->journal_mac_alg.alg_string;
3803 		arg_count += (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0;
3804 		arg_count += (ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) != 0;
3805 		arg_count += ic->legacy_recalculate;
3806 		DMEMIT("%s %llu %u %c %u", ic->dev->name, ic->start,
3807 		       ic->tag_size, ic->mode, arg_count);
3808 		if (ic->meta_dev)
3809 			DMEMIT(" meta_device:%s", ic->meta_dev->name);
3810 		if (ic->sectors_per_block != 1)
3811 			DMEMIT(" block_size:%u", ic->sectors_per_block << SECTOR_SHIFT);
3812 		if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING))
3813 			DMEMIT(" recalculate");
3814 		if (ic->reset_recalculate_flag)
3815 			DMEMIT(" reset_recalculate");
3816 		if (ic->discard)
3817 			DMEMIT(" allow_discards");
3818 		if (ic->mode != 'I')
3819 			DMEMIT(" interleave_sectors:%u", 1U << ic->sb->log2_interleave_sectors);
3820 		DMEMIT(" buffer_sectors:%u", 1U << ic->log2_buffer_sectors);
3821 		if (ic->mode == 'J') {
3822 			__u64 watermark_percentage = (__u64)(ic->journal_entries - ic->free_sectors_threshold) * 100;
3823 
3824 			watermark_percentage += ic->journal_entries / 2;
3825 			do_div(watermark_percentage, ic->journal_entries);
3826 			DMEMIT(" journal_sectors:%u", ic->initial_sectors - SB_SECTORS);
3827 			DMEMIT(" journal_watermark:%u", (unsigned int)watermark_percentage);
3828 			DMEMIT(" commit_time:%u", ic->autocommit_msec);
3829 		}
3830 		if (ic->mode == 'B') {
3831 			DMEMIT(" sectors_per_bit:%llu", (sector_t)ic->sectors_per_block << ic->log2_blocks_per_bitmap_bit);
3832 			DMEMIT(" bitmap_flush_interval:%u", jiffies_to_msecs(ic->bitmap_flush_interval));
3833 		}
3834 		if ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0)
3835 			DMEMIT(" fix_padding");
3836 		if ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) != 0)
3837 			DMEMIT(" fix_hmac");
3838 		if (ic->legacy_recalculate)
3839 			DMEMIT(" legacy_recalculate");
3840 
3841 #define EMIT_ALG(a, n)							\
3842 		do {							\
3843 			if (ic->a.alg_string) {				\
3844 				DMEMIT(" %s:%s", n, ic->a.alg_string);	\
3845 				if (ic->a.key_string)			\
3846 					DMEMIT(":%s", ic->a.key_string);\
3847 			}						\
3848 		} while (0)
3849 		EMIT_ALG(internal_hash_alg, "internal_hash");
3850 		EMIT_ALG(journal_crypt_alg, "journal_crypt");
3851 		EMIT_ALG(journal_mac_alg, "journal_mac");
3852 		break;
3853 	}
3854 	case STATUSTYPE_IMA:
3855 		DMEMIT_TARGET_NAME_VERSION(ti->type);
3856 		DMEMIT(",dev_name=%s,start=%llu,tag_size=%u,mode=%c",
3857 			ic->dev->name, ic->start, ic->tag_size, ic->mode);
3858 
3859 		if (ic->meta_dev)
3860 			DMEMIT(",meta_device=%s", ic->meta_dev->name);
3861 		if (ic->sectors_per_block != 1)
3862 			DMEMIT(",block_size=%u", ic->sectors_per_block << SECTOR_SHIFT);
3863 
3864 		DMEMIT(",recalculate=%c", (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) ?
3865 		       'y' : 'n');
3866 		DMEMIT(",allow_discards=%c", ic->discard ? 'y' : 'n');
3867 		DMEMIT(",fix_padding=%c",
3868 		       ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING)) != 0) ? 'y' : 'n');
3869 		DMEMIT(",fix_hmac=%c",
3870 		       ((ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_HMAC)) != 0) ? 'y' : 'n');
3871 		DMEMIT(",legacy_recalculate=%c", ic->legacy_recalculate ? 'y' : 'n');
3872 
3873 		DMEMIT(",journal_sectors=%u", ic->initial_sectors - SB_SECTORS);
3874 		DMEMIT(",interleave_sectors=%u", 1U << ic->sb->log2_interleave_sectors);
3875 		DMEMIT(",buffer_sectors=%u", 1U << ic->log2_buffer_sectors);
3876 		DMEMIT(";");
3877 		break;
3878 	}
3879 }
3880 
3881 static int dm_integrity_iterate_devices(struct dm_target *ti,
3882 					iterate_devices_callout_fn fn, void *data)
3883 {
3884 	struct dm_integrity_c *ic = ti->private;
3885 
3886 	if (!ic->meta_dev)
3887 		return fn(ti, ic->dev, ic->start + ic->initial_sectors + ic->metadata_run, ti->len, data);
3888 	else
3889 		return fn(ti, ic->dev, 0, ti->len, data);
3890 }
3891 
3892 static void dm_integrity_io_hints(struct dm_target *ti, struct queue_limits *limits)
3893 {
3894 	struct dm_integrity_c *ic = ti->private;
3895 
3896 	if (ic->sectors_per_block > 1) {
3897 		limits->logical_block_size = ic->sectors_per_block << SECTOR_SHIFT;
3898 		limits->physical_block_size = ic->sectors_per_block << SECTOR_SHIFT;
3899 		limits->io_min = ic->sectors_per_block << SECTOR_SHIFT;
3900 		limits->dma_alignment = limits->logical_block_size - 1;
3901 		limits->discard_granularity = ic->sectors_per_block << SECTOR_SHIFT;
3902 	}
3903 
3904 	if (!ic->internal_hash) {
3905 		struct blk_integrity *bi = &limits->integrity;
3906 
3907 		memset(bi, 0, sizeof(*bi));
3908 		bi->tuple_size = ic->tag_size;
3909 		bi->tag_size = bi->tuple_size;
3910 		bi->interval_exp =
3911 			ic->sb->log2_sectors_per_block + SECTOR_SHIFT;
3912 	}
3913 
3914 	limits->max_integrity_segments = USHRT_MAX;
3915 }
3916 
3917 static void calculate_journal_section_size(struct dm_integrity_c *ic)
3918 {
3919 	unsigned int sector_space = JOURNAL_SECTOR_DATA;
3920 
3921 	ic->journal_sections = le32_to_cpu(ic->sb->journal_sections);
3922 	ic->journal_entry_size = roundup(offsetof(struct journal_entry, last_bytes[ic->sectors_per_block]) + ic->tag_size,
3923 					 JOURNAL_ENTRY_ROUNDUP);
3924 
3925 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_HAVE_JOURNAL_MAC))
3926 		sector_space -= JOURNAL_MAC_PER_SECTOR;
3927 	ic->journal_entries_per_sector = sector_space / ic->journal_entry_size;
3928 	ic->journal_section_entries = ic->journal_entries_per_sector * JOURNAL_BLOCK_SECTORS;
3929 	ic->journal_section_sectors = (ic->journal_section_entries << ic->sb->log2_sectors_per_block) + JOURNAL_BLOCK_SECTORS;
3930 	ic->journal_entries = ic->journal_section_entries * ic->journal_sections;
3931 }
3932 
3933 static int calculate_device_limits(struct dm_integrity_c *ic)
3934 {
3935 	__u64 initial_sectors;
3936 
3937 	calculate_journal_section_size(ic);
3938 	initial_sectors = SB_SECTORS + (__u64)ic->journal_section_sectors * ic->journal_sections;
3939 	if (initial_sectors + METADATA_PADDING_SECTORS >= ic->meta_device_sectors || initial_sectors > UINT_MAX)
3940 		return -EINVAL;
3941 	ic->initial_sectors = initial_sectors;
3942 
3943 	if (ic->mode == 'I') {
3944 		if (ic->initial_sectors + ic->provided_data_sectors > ic->meta_device_sectors)
3945 			return -EINVAL;
3946 	} else if (!ic->meta_dev) {
3947 		sector_t last_sector, last_area, last_offset;
3948 
3949 		/* we have to maintain excessive padding for compatibility with existing volumes */
3950 		__u64 metadata_run_padding =
3951 			ic->sb->flags & cpu_to_le32(SB_FLAG_FIXED_PADDING) ?
3952 			(__u64)(METADATA_PADDING_SECTORS << SECTOR_SHIFT) :
3953 			(__u64)(1 << SECTOR_SHIFT << METADATA_PADDING_SECTORS);
3954 
3955 		ic->metadata_run = round_up((__u64)ic->tag_size << (ic->sb->log2_interleave_sectors - ic->sb->log2_sectors_per_block),
3956 					    metadata_run_padding) >> SECTOR_SHIFT;
3957 		if (!(ic->metadata_run & (ic->metadata_run - 1)))
3958 			ic->log2_metadata_run = __ffs(ic->metadata_run);
3959 		else
3960 			ic->log2_metadata_run = -1;
3961 
3962 		get_area_and_offset(ic, ic->provided_data_sectors - 1, &last_area, &last_offset);
3963 		last_sector = get_data_sector(ic, last_area, last_offset);
3964 		if (last_sector < ic->start || last_sector >= ic->meta_device_sectors)
3965 			return -EINVAL;
3966 	} else {
3967 		__u64 meta_size = (ic->provided_data_sectors >> ic->sb->log2_sectors_per_block) * ic->tag_size;
3968 
3969 		meta_size = (meta_size + ((1U << (ic->log2_buffer_sectors + SECTOR_SHIFT)) - 1))
3970 				>> (ic->log2_buffer_sectors + SECTOR_SHIFT);
3971 		meta_size <<= ic->log2_buffer_sectors;
3972 		if (ic->initial_sectors + meta_size < ic->initial_sectors ||
3973 		    ic->initial_sectors + meta_size > ic->meta_device_sectors)
3974 			return -EINVAL;
3975 		ic->metadata_run = 1;
3976 		ic->log2_metadata_run = 0;
3977 	}
3978 
3979 	return 0;
3980 }
3981 
3982 static void get_provided_data_sectors(struct dm_integrity_c *ic)
3983 {
3984 	if (!ic->meta_dev) {
3985 		int test_bit;
3986 
3987 		ic->provided_data_sectors = 0;
3988 		for (test_bit = fls64(ic->meta_device_sectors) - 1; test_bit >= 3; test_bit--) {
3989 			__u64 prev_data_sectors = ic->provided_data_sectors;
3990 
3991 			ic->provided_data_sectors |= (sector_t)1 << test_bit;
3992 			if (calculate_device_limits(ic))
3993 				ic->provided_data_sectors = prev_data_sectors;
3994 		}
3995 	} else {
3996 		ic->provided_data_sectors = ic->data_device_sectors;
3997 		ic->provided_data_sectors &= ~(sector_t)(ic->sectors_per_block - 1);
3998 	}
3999 }
4000 
4001 static int initialize_superblock(struct dm_integrity_c *ic,
4002 				 unsigned int journal_sectors, unsigned int interleave_sectors)
4003 {
4004 	unsigned int journal_sections;
4005 	int test_bit;
4006 
4007 	memset(ic->sb, 0, SB_SECTORS << SECTOR_SHIFT);
4008 	memcpy(ic->sb->magic, SB_MAGIC, 8);
4009 	if (ic->mode == 'I')
4010 		ic->sb->flags |= cpu_to_le32(SB_FLAG_INLINE);
4011 	ic->sb->integrity_tag_size = cpu_to_le16(ic->tag_size);
4012 	ic->sb->log2_sectors_per_block = __ffs(ic->sectors_per_block);
4013 	if (ic->journal_mac_alg.alg_string)
4014 		ic->sb->flags |= cpu_to_le32(SB_FLAG_HAVE_JOURNAL_MAC);
4015 
4016 	calculate_journal_section_size(ic);
4017 	journal_sections = journal_sectors / ic->journal_section_sectors;
4018 	if (!journal_sections)
4019 		journal_sections = 1;
4020 	if (ic->mode == 'I')
4021 		journal_sections = 0;
4022 
4023 	if (ic->fix_hmac && (ic->internal_hash_alg.alg_string || ic->journal_mac_alg.alg_string)) {
4024 		ic->sb->flags |= cpu_to_le32(SB_FLAG_FIXED_HMAC);
4025 		get_random_bytes(ic->sb->salt, SALT_SIZE);
4026 	}
4027 
4028 	if (!ic->meta_dev) {
4029 		if (ic->fix_padding)
4030 			ic->sb->flags |= cpu_to_le32(SB_FLAG_FIXED_PADDING);
4031 		ic->sb->journal_sections = cpu_to_le32(journal_sections);
4032 		if (!interleave_sectors)
4033 			interleave_sectors = DEFAULT_INTERLEAVE_SECTORS;
4034 		ic->sb->log2_interleave_sectors = __fls(interleave_sectors);
4035 		ic->sb->log2_interleave_sectors = max_t(__u8, MIN_LOG2_INTERLEAVE_SECTORS, ic->sb->log2_interleave_sectors);
4036 		ic->sb->log2_interleave_sectors = min_t(__u8, MAX_LOG2_INTERLEAVE_SECTORS, ic->sb->log2_interleave_sectors);
4037 
4038 		get_provided_data_sectors(ic);
4039 		if (!ic->provided_data_sectors)
4040 			return -EINVAL;
4041 	} else {
4042 		ic->sb->log2_interleave_sectors = 0;
4043 
4044 		get_provided_data_sectors(ic);
4045 		if (!ic->provided_data_sectors)
4046 			return -EINVAL;
4047 
4048 try_smaller_buffer:
4049 		ic->sb->journal_sections = cpu_to_le32(0);
4050 		for (test_bit = fls(journal_sections) - 1; test_bit >= 0; test_bit--) {
4051 			__u32 prev_journal_sections = le32_to_cpu(ic->sb->journal_sections);
4052 			__u32 test_journal_sections = prev_journal_sections | (1U << test_bit);
4053 
4054 			if (test_journal_sections > journal_sections)
4055 				continue;
4056 			ic->sb->journal_sections = cpu_to_le32(test_journal_sections);
4057 			if (calculate_device_limits(ic))
4058 				ic->sb->journal_sections = cpu_to_le32(prev_journal_sections);
4059 
4060 		}
4061 		if (!le32_to_cpu(ic->sb->journal_sections)) {
4062 			if (ic->log2_buffer_sectors > 3) {
4063 				ic->log2_buffer_sectors--;
4064 				goto try_smaller_buffer;
4065 			}
4066 			return -EINVAL;
4067 		}
4068 	}
4069 
4070 	ic->sb->provided_data_sectors = cpu_to_le64(ic->provided_data_sectors);
4071 
4072 	sb_set_version(ic);
4073 
4074 	return 0;
4075 }
4076 
4077 static void dm_integrity_free_page_list(struct page_list *pl)
4078 {
4079 	unsigned int i;
4080 
4081 	if (!pl)
4082 		return;
4083 	for (i = 0; pl[i].page; i++)
4084 		__free_page(pl[i].page);
4085 	kvfree(pl);
4086 }
4087 
4088 static struct page_list *dm_integrity_alloc_page_list(unsigned int n_pages)
4089 {
4090 	struct page_list *pl;
4091 	unsigned int i;
4092 
4093 	pl = kvmalloc_array(n_pages + 1, sizeof(struct page_list), GFP_KERNEL | __GFP_ZERO);
4094 	if (!pl)
4095 		return NULL;
4096 
4097 	for (i = 0; i < n_pages; i++) {
4098 		pl[i].page = alloc_page(GFP_KERNEL);
4099 		if (!pl[i].page) {
4100 			dm_integrity_free_page_list(pl);
4101 			return NULL;
4102 		}
4103 		if (i)
4104 			pl[i - 1].next = &pl[i];
4105 	}
4106 	pl[i].page = NULL;
4107 	pl[i].next = NULL;
4108 
4109 	return pl;
4110 }
4111 
4112 static void dm_integrity_free_journal_scatterlist(struct dm_integrity_c *ic, struct scatterlist **sl)
4113 {
4114 	unsigned int i;
4115 
4116 	for (i = 0; i < ic->journal_sections; i++)
4117 		kvfree(sl[i]);
4118 	kvfree(sl);
4119 }
4120 
4121 static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_integrity_c *ic,
4122 								   struct page_list *pl)
4123 {
4124 	struct scatterlist **sl;
4125 	unsigned int i;
4126 
4127 	sl = kvmalloc_array(ic->journal_sections,
4128 			    sizeof(struct scatterlist *),
4129 			    GFP_KERNEL | __GFP_ZERO);
4130 	if (!sl)
4131 		return NULL;
4132 
4133 	for (i = 0; i < ic->journal_sections; i++) {
4134 		struct scatterlist *s;
4135 		unsigned int start_index, start_offset;
4136 		unsigned int end_index, end_offset;
4137 		unsigned int n_pages;
4138 		unsigned int idx;
4139 
4140 		page_list_location(ic, i, 0, &start_index, &start_offset);
4141 		page_list_location(ic, i, ic->journal_section_sectors - 1,
4142 				   &end_index, &end_offset);
4143 
4144 		n_pages = (end_index - start_index + 1);
4145 
4146 		s = kvmalloc_array(n_pages, sizeof(struct scatterlist),
4147 				   GFP_KERNEL);
4148 		if (!s) {
4149 			dm_integrity_free_journal_scatterlist(ic, sl);
4150 			return NULL;
4151 		}
4152 
4153 		sg_init_table(s, n_pages);
4154 		for (idx = start_index; idx <= end_index; idx++) {
4155 			char *va = lowmem_page_address(pl[idx].page);
4156 			unsigned int start = 0, end = PAGE_SIZE;
4157 
4158 			if (idx == start_index)
4159 				start = start_offset;
4160 			if (idx == end_index)
4161 				end = end_offset + (1 << SECTOR_SHIFT);
4162 			sg_set_buf(&s[idx - start_index], va + start, end - start);
4163 		}
4164 
4165 		sl[i] = s;
4166 	}
4167 
4168 	return sl;
4169 }
4170 
4171 static void free_alg(struct alg_spec *a)
4172 {
4173 	kfree_sensitive(a->alg_string);
4174 	kfree_sensitive(a->key);
4175 	memset(a, 0, sizeof(*a));
4176 }
4177 
4178 static int get_alg_and_key(const char *arg, struct alg_spec *a, char **error, char *error_inval)
4179 {
4180 	char *k;
4181 
4182 	free_alg(a);
4183 
4184 	a->alg_string = kstrdup(strchr(arg, ':') + 1, GFP_KERNEL);
4185 	if (!a->alg_string)
4186 		goto nomem;
4187 
4188 	k = strchr(a->alg_string, ':');
4189 	if (k) {
4190 		*k = 0;
4191 		a->key_string = k + 1;
4192 		if (strlen(a->key_string) & 1)
4193 			goto inval;
4194 
4195 		a->key_size = strlen(a->key_string) / 2;
4196 		a->key = kmalloc(a->key_size, GFP_KERNEL);
4197 		if (!a->key)
4198 			goto nomem;
4199 		if (hex2bin(a->key, a->key_string, a->key_size))
4200 			goto inval;
4201 	}
4202 
4203 	return 0;
4204 inval:
4205 	*error = error_inval;
4206 	return -EINVAL;
4207 nomem:
4208 	*error = "Out of memory for an argument";
4209 	return -ENOMEM;
4210 }
4211 
4212 static int get_mac(struct crypto_shash **hash, struct alg_spec *a, char **error,
4213 		   char *error_alg, char *error_key)
4214 {
4215 	int r;
4216 
4217 	if (a->alg_string) {
4218 		*hash = crypto_alloc_shash(a->alg_string, 0, CRYPTO_ALG_ALLOCATES_MEMORY);
4219 		if (IS_ERR(*hash)) {
4220 			*error = error_alg;
4221 			r = PTR_ERR(*hash);
4222 			*hash = NULL;
4223 			return r;
4224 		}
4225 
4226 		if (a->key) {
4227 			r = crypto_shash_setkey(*hash, a->key, a->key_size);
4228 			if (r) {
4229 				*error = error_key;
4230 				return r;
4231 			}
4232 		} else if (crypto_shash_get_flags(*hash) & CRYPTO_TFM_NEED_KEY) {
4233 			*error = error_key;
4234 			return -ENOKEY;
4235 		}
4236 	}
4237 
4238 	return 0;
4239 }
4240 
4241 static int create_journal(struct dm_integrity_c *ic, char **error)
4242 {
4243 	int r = 0;
4244 	unsigned int i;
4245 	__u64 journal_pages, journal_desc_size, journal_tree_size;
4246 	unsigned char *crypt_data = NULL, *crypt_iv = NULL;
4247 	struct skcipher_request *req = NULL;
4248 
4249 	ic->commit_ids[0] = cpu_to_le64(0x1111111111111111ULL);
4250 	ic->commit_ids[1] = cpu_to_le64(0x2222222222222222ULL);
4251 	ic->commit_ids[2] = cpu_to_le64(0x3333333333333333ULL);
4252 	ic->commit_ids[3] = cpu_to_le64(0x4444444444444444ULL);
4253 
4254 	journal_pages = roundup((__u64)ic->journal_sections * ic->journal_section_sectors,
4255 				PAGE_SIZE >> SECTOR_SHIFT) >> (PAGE_SHIFT - SECTOR_SHIFT);
4256 	journal_desc_size = journal_pages * sizeof(struct page_list);
4257 	if (journal_pages >= totalram_pages() - totalhigh_pages() || journal_desc_size > ULONG_MAX) {
4258 		*error = "Journal doesn't fit into memory";
4259 		r = -ENOMEM;
4260 		goto bad;
4261 	}
4262 	ic->journal_pages = journal_pages;
4263 
4264 	ic->journal = dm_integrity_alloc_page_list(ic->journal_pages);
4265 	if (!ic->journal) {
4266 		*error = "Could not allocate memory for journal";
4267 		r = -ENOMEM;
4268 		goto bad;
4269 	}
4270 	if (ic->journal_crypt_alg.alg_string) {
4271 		unsigned int ivsize, blocksize;
4272 		struct journal_completion comp;
4273 
4274 		comp.ic = ic;
4275 		ic->journal_crypt = crypto_alloc_skcipher(ic->journal_crypt_alg.alg_string, 0, CRYPTO_ALG_ALLOCATES_MEMORY);
4276 		if (IS_ERR(ic->journal_crypt)) {
4277 			*error = "Invalid journal cipher";
4278 			r = PTR_ERR(ic->journal_crypt);
4279 			ic->journal_crypt = NULL;
4280 			goto bad;
4281 		}
4282 		ivsize = crypto_skcipher_ivsize(ic->journal_crypt);
4283 		blocksize = crypto_skcipher_blocksize(ic->journal_crypt);
4284 
4285 		if (ic->journal_crypt_alg.key) {
4286 			r = crypto_skcipher_setkey(ic->journal_crypt, ic->journal_crypt_alg.key,
4287 						   ic->journal_crypt_alg.key_size);
4288 			if (r) {
4289 				*error = "Error setting encryption key";
4290 				goto bad;
4291 			}
4292 		}
4293 		DEBUG_print("cipher %s, block size %u iv size %u\n",
4294 			    ic->journal_crypt_alg.alg_string, blocksize, ivsize);
4295 
4296 		ic->journal_io = dm_integrity_alloc_page_list(ic->journal_pages);
4297 		if (!ic->journal_io) {
4298 			*error = "Could not allocate memory for journal io";
4299 			r = -ENOMEM;
4300 			goto bad;
4301 		}
4302 
4303 		if (blocksize == 1) {
4304 			struct scatterlist *sg;
4305 
4306 			req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL);
4307 			if (!req) {
4308 				*error = "Could not allocate crypt request";
4309 				r = -ENOMEM;
4310 				goto bad;
4311 			}
4312 
4313 			crypt_iv = kzalloc(ivsize, GFP_KERNEL);
4314 			if (!crypt_iv) {
4315 				*error = "Could not allocate iv";
4316 				r = -ENOMEM;
4317 				goto bad;
4318 			}
4319 
4320 			ic->journal_xor = dm_integrity_alloc_page_list(ic->journal_pages);
4321 			if (!ic->journal_xor) {
4322 				*error = "Could not allocate memory for journal xor";
4323 				r = -ENOMEM;
4324 				goto bad;
4325 			}
4326 
4327 			sg = kvmalloc_array(ic->journal_pages + 1,
4328 					    sizeof(struct scatterlist),
4329 					    GFP_KERNEL);
4330 			if (!sg) {
4331 				*error = "Unable to allocate sg list";
4332 				r = -ENOMEM;
4333 				goto bad;
4334 			}
4335 			sg_init_table(sg, ic->journal_pages + 1);
4336 			for (i = 0; i < ic->journal_pages; i++) {
4337 				char *va = lowmem_page_address(ic->journal_xor[i].page);
4338 
4339 				clear_page(va);
4340 				sg_set_buf(&sg[i], va, PAGE_SIZE);
4341 			}
4342 			sg_set_buf(&sg[i], &ic->commit_ids, sizeof(ic->commit_ids));
4343 
4344 			skcipher_request_set_crypt(req, sg, sg,
4345 						   PAGE_SIZE * ic->journal_pages + sizeof(ic->commit_ids), crypt_iv);
4346 			init_completion(&comp.comp);
4347 			comp.in_flight = (atomic_t)ATOMIC_INIT(1);
4348 			if (do_crypt(true, req, &comp))
4349 				wait_for_completion(&comp.comp);
4350 			kvfree(sg);
4351 			r = dm_integrity_failed(ic);
4352 			if (r) {
4353 				*error = "Unable to encrypt journal";
4354 				goto bad;
4355 			}
4356 			DEBUG_bytes(lowmem_page_address(ic->journal_xor[0].page), 64, "xor data");
4357 
4358 			crypto_free_skcipher(ic->journal_crypt);
4359 			ic->journal_crypt = NULL;
4360 		} else {
4361 			unsigned int crypt_len = roundup(ivsize, blocksize);
4362 
4363 			req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL);
4364 			if (!req) {
4365 				*error = "Could not allocate crypt request";
4366 				r = -ENOMEM;
4367 				goto bad;
4368 			}
4369 
4370 			crypt_iv = kmalloc(ivsize, GFP_KERNEL);
4371 			if (!crypt_iv) {
4372 				*error = "Could not allocate iv";
4373 				r = -ENOMEM;
4374 				goto bad;
4375 			}
4376 
4377 			crypt_data = kmalloc(crypt_len, GFP_KERNEL);
4378 			if (!crypt_data) {
4379 				*error = "Unable to allocate crypt data";
4380 				r = -ENOMEM;
4381 				goto bad;
4382 			}
4383 
4384 			ic->journal_scatterlist = dm_integrity_alloc_journal_scatterlist(ic, ic->journal);
4385 			if (!ic->journal_scatterlist) {
4386 				*error = "Unable to allocate sg list";
4387 				r = -ENOMEM;
4388 				goto bad;
4389 			}
4390 			ic->journal_io_scatterlist = dm_integrity_alloc_journal_scatterlist(ic, ic->journal_io);
4391 			if (!ic->journal_io_scatterlist) {
4392 				*error = "Unable to allocate sg list";
4393 				r = -ENOMEM;
4394 				goto bad;
4395 			}
4396 			ic->sk_requests = kvmalloc_array(ic->journal_sections,
4397 							 sizeof(struct skcipher_request *),
4398 							 GFP_KERNEL | __GFP_ZERO);
4399 			if (!ic->sk_requests) {
4400 				*error = "Unable to allocate sk requests";
4401 				r = -ENOMEM;
4402 				goto bad;
4403 			}
4404 			for (i = 0; i < ic->journal_sections; i++) {
4405 				struct scatterlist sg;
4406 				struct skcipher_request *section_req;
4407 				__le32 section_le = cpu_to_le32(i);
4408 
4409 				memset(crypt_iv, 0x00, ivsize);
4410 				memset(crypt_data, 0x00, crypt_len);
4411 				memcpy(crypt_data, &section_le, min_t(size_t, crypt_len, sizeof(section_le)));
4412 
4413 				sg_init_one(&sg, crypt_data, crypt_len);
4414 				skcipher_request_set_crypt(req, &sg, &sg, crypt_len, crypt_iv);
4415 				init_completion(&comp.comp);
4416 				comp.in_flight = (atomic_t)ATOMIC_INIT(1);
4417 				if (do_crypt(true, req, &comp))
4418 					wait_for_completion(&comp.comp);
4419 
4420 				r = dm_integrity_failed(ic);
4421 				if (r) {
4422 					*error = "Unable to generate iv";
4423 					goto bad;
4424 				}
4425 
4426 				section_req = skcipher_request_alloc(ic->journal_crypt, GFP_KERNEL);
4427 				if (!section_req) {
4428 					*error = "Unable to allocate crypt request";
4429 					r = -ENOMEM;
4430 					goto bad;
4431 				}
4432 				section_req->iv = kmalloc_array(ivsize, 2,
4433 								GFP_KERNEL);
4434 				if (!section_req->iv) {
4435 					skcipher_request_free(section_req);
4436 					*error = "Unable to allocate iv";
4437 					r = -ENOMEM;
4438 					goto bad;
4439 				}
4440 				memcpy(section_req->iv + ivsize, crypt_data, ivsize);
4441 				section_req->cryptlen = (size_t)ic->journal_section_sectors << SECTOR_SHIFT;
4442 				ic->sk_requests[i] = section_req;
4443 				DEBUG_bytes(crypt_data, ivsize, "iv(%u)", i);
4444 			}
4445 		}
4446 	}
4447 
4448 	for (i = 0; i < N_COMMIT_IDS; i++) {
4449 		unsigned int j;
4450 
4451 retest_commit_id:
4452 		for (j = 0; j < i; j++) {
4453 			if (ic->commit_ids[j] == ic->commit_ids[i]) {
4454 				ic->commit_ids[i] = cpu_to_le64(le64_to_cpu(ic->commit_ids[i]) + 1);
4455 				goto retest_commit_id;
4456 			}
4457 		}
4458 		DEBUG_print("commit id %u: %016llx\n", i, ic->commit_ids[i]);
4459 	}
4460 
4461 	journal_tree_size = (__u64)ic->journal_entries * sizeof(struct journal_node);
4462 	if (journal_tree_size > ULONG_MAX) {
4463 		*error = "Journal doesn't fit into memory";
4464 		r = -ENOMEM;
4465 		goto bad;
4466 	}
4467 	ic->journal_tree = kvmalloc(journal_tree_size, GFP_KERNEL);
4468 	if (!ic->journal_tree) {
4469 		*error = "Could not allocate memory for journal tree";
4470 		r = -ENOMEM;
4471 	}
4472 bad:
4473 	kfree(crypt_data);
4474 	kfree(crypt_iv);
4475 	skcipher_request_free(req);
4476 
4477 	return r;
4478 }
4479 
4480 /*
4481  * Construct a integrity mapping
4482  *
4483  * Arguments:
4484  *	device
4485  *	offset from the start of the device
4486  *	tag size
4487  *	D - direct writes, J - journal writes, B - bitmap mode, R - recovery mode
4488  *	number of optional arguments
4489  *	optional arguments:
4490  *		journal_sectors
4491  *		interleave_sectors
4492  *		buffer_sectors
4493  *		journal_watermark
4494  *		commit_time
4495  *		meta_device
4496  *		block_size
4497  *		sectors_per_bit
4498  *		bitmap_flush_interval
4499  *		internal_hash
4500  *		journal_crypt
4501  *		journal_mac
4502  *		recalculate
4503  */
4504 static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv)
4505 {
4506 	struct dm_integrity_c *ic;
4507 	char dummy;
4508 	int r;
4509 	unsigned int extra_args;
4510 	struct dm_arg_set as;
4511 	static const struct dm_arg _args[] = {
4512 		{0, 18, "Invalid number of feature args"},
4513 	};
4514 	unsigned int journal_sectors, interleave_sectors, buffer_sectors, journal_watermark, sync_msec;
4515 	bool should_write_sb;
4516 	__u64 threshold;
4517 	unsigned long long start;
4518 	__s8 log2_sectors_per_bitmap_bit = -1;
4519 	__s8 log2_blocks_per_bitmap_bit;
4520 	__u64 bits_in_journal;
4521 	__u64 n_bitmap_bits;
4522 
4523 #define DIRECT_ARGUMENTS	4
4524 
4525 	if (argc <= DIRECT_ARGUMENTS) {
4526 		ti->error = "Invalid argument count";
4527 		return -EINVAL;
4528 	}
4529 
4530 	ic = kzalloc(sizeof(struct dm_integrity_c), GFP_KERNEL);
4531 	if (!ic) {
4532 		ti->error = "Cannot allocate integrity context";
4533 		return -ENOMEM;
4534 	}
4535 	ti->private = ic;
4536 	ti->per_io_data_size = sizeof(struct dm_integrity_io);
4537 	ic->ti = ti;
4538 
4539 	ic->in_progress = RB_ROOT;
4540 	INIT_LIST_HEAD(&ic->wait_list);
4541 	init_waitqueue_head(&ic->endio_wait);
4542 	bio_list_init(&ic->flush_bio_list);
4543 	init_waitqueue_head(&ic->copy_to_journal_wait);
4544 	init_completion(&ic->crypto_backoff);
4545 	atomic64_set(&ic->number_of_mismatches, 0);
4546 	ic->bitmap_flush_interval = BITMAP_FLUSH_INTERVAL;
4547 
4548 	r = dm_get_device(ti, argv[0], dm_table_get_mode(ti->table), &ic->dev);
4549 	if (r) {
4550 		ti->error = "Device lookup failed";
4551 		goto bad;
4552 	}
4553 
4554 	if (sscanf(argv[1], "%llu%c", &start, &dummy) != 1 || start != (sector_t)start) {
4555 		ti->error = "Invalid starting offset";
4556 		r = -EINVAL;
4557 		goto bad;
4558 	}
4559 	ic->start = start;
4560 
4561 	if (strcmp(argv[2], "-")) {
4562 		if (sscanf(argv[2], "%u%c", &ic->tag_size, &dummy) != 1 || !ic->tag_size) {
4563 			ti->error = "Invalid tag size";
4564 			r = -EINVAL;
4565 			goto bad;
4566 		}
4567 	}
4568 
4569 	if (!strcmp(argv[3], "J") || !strcmp(argv[3], "B") ||
4570 	    !strcmp(argv[3], "D") || !strcmp(argv[3], "R") ||
4571 	    !strcmp(argv[3], "I")) {
4572 		ic->mode = argv[3][0];
4573 	} else {
4574 		ti->error = "Invalid mode (expecting J, B, D, R, I)";
4575 		r = -EINVAL;
4576 		goto bad;
4577 	}
4578 
4579 	journal_sectors = 0;
4580 	interleave_sectors = DEFAULT_INTERLEAVE_SECTORS;
4581 	buffer_sectors = DEFAULT_BUFFER_SECTORS;
4582 	journal_watermark = DEFAULT_JOURNAL_WATERMARK;
4583 	sync_msec = DEFAULT_SYNC_MSEC;
4584 	ic->sectors_per_block = 1;
4585 
4586 	as.argc = argc - DIRECT_ARGUMENTS;
4587 	as.argv = argv + DIRECT_ARGUMENTS;
4588 	r = dm_read_arg_group(_args, &as, &extra_args, &ti->error);
4589 	if (r)
4590 		goto bad;
4591 
4592 	while (extra_args--) {
4593 		const char *opt_string;
4594 		unsigned int val;
4595 		unsigned long long llval;
4596 
4597 		opt_string = dm_shift_arg(&as);
4598 		if (!opt_string) {
4599 			r = -EINVAL;
4600 			ti->error = "Not enough feature arguments";
4601 			goto bad;
4602 		}
4603 		if (sscanf(opt_string, "journal_sectors:%u%c", &val, &dummy) == 1)
4604 			journal_sectors = val ? val : 1;
4605 		else if (sscanf(opt_string, "interleave_sectors:%u%c", &val, &dummy) == 1)
4606 			interleave_sectors = val;
4607 		else if (sscanf(opt_string, "buffer_sectors:%u%c", &val, &dummy) == 1)
4608 			buffer_sectors = val;
4609 		else if (sscanf(opt_string, "journal_watermark:%u%c", &val, &dummy) == 1 && val <= 100)
4610 			journal_watermark = val;
4611 		else if (sscanf(opt_string, "commit_time:%u%c", &val, &dummy) == 1)
4612 			sync_msec = val;
4613 		else if (!strncmp(opt_string, "meta_device:", strlen("meta_device:"))) {
4614 			if (ic->meta_dev) {
4615 				dm_put_device(ti, ic->meta_dev);
4616 				ic->meta_dev = NULL;
4617 			}
4618 			r = dm_get_device(ti, strchr(opt_string, ':') + 1,
4619 					  dm_table_get_mode(ti->table), &ic->meta_dev);
4620 			if (r) {
4621 				ti->error = "Device lookup failed";
4622 				goto bad;
4623 			}
4624 		} else if (sscanf(opt_string, "block_size:%u%c", &val, &dummy) == 1) {
4625 			if (val < 1 << SECTOR_SHIFT ||
4626 			    val > MAX_SECTORS_PER_BLOCK << SECTOR_SHIFT ||
4627 			    (val & (val - 1))) {
4628 				r = -EINVAL;
4629 				ti->error = "Invalid block_size argument";
4630 				goto bad;
4631 			}
4632 			ic->sectors_per_block = val >> SECTOR_SHIFT;
4633 		} else if (sscanf(opt_string, "sectors_per_bit:%llu%c", &llval, &dummy) == 1) {
4634 			log2_sectors_per_bitmap_bit = !llval ? 0 : __ilog2_u64(llval);
4635 		} else if (sscanf(opt_string, "bitmap_flush_interval:%u%c", &val, &dummy) == 1) {
4636 			if ((uint64_t)val >= (uint64_t)UINT_MAX * 1000 / HZ) {
4637 				r = -EINVAL;
4638 				ti->error = "Invalid bitmap_flush_interval argument";
4639 				goto bad;
4640 			}
4641 			ic->bitmap_flush_interval = msecs_to_jiffies(val);
4642 		} else if (!strncmp(opt_string, "internal_hash:", strlen("internal_hash:"))) {
4643 			r = get_alg_and_key(opt_string, &ic->internal_hash_alg, &ti->error,
4644 					    "Invalid internal_hash argument");
4645 			if (r)
4646 				goto bad;
4647 		} else if (!strncmp(opt_string, "journal_crypt:", strlen("journal_crypt:"))) {
4648 			r = get_alg_and_key(opt_string, &ic->journal_crypt_alg, &ti->error,
4649 					    "Invalid journal_crypt argument");
4650 			if (r)
4651 				goto bad;
4652 		} else if (!strncmp(opt_string, "journal_mac:", strlen("journal_mac:"))) {
4653 			r = get_alg_and_key(opt_string, &ic->journal_mac_alg, &ti->error,
4654 					    "Invalid journal_mac argument");
4655 			if (r)
4656 				goto bad;
4657 		} else if (!strcmp(opt_string, "recalculate")) {
4658 			ic->recalculate_flag = true;
4659 		} else if (!strcmp(opt_string, "reset_recalculate")) {
4660 			ic->recalculate_flag = true;
4661 			ic->reset_recalculate_flag = true;
4662 		} else if (!strcmp(opt_string, "allow_discards")) {
4663 			ic->discard = true;
4664 		} else if (!strcmp(opt_string, "fix_padding")) {
4665 			ic->fix_padding = true;
4666 		} else if (!strcmp(opt_string, "fix_hmac")) {
4667 			ic->fix_hmac = true;
4668 		} else if (!strcmp(opt_string, "legacy_recalculate")) {
4669 			ic->legacy_recalculate = true;
4670 		} else {
4671 			r = -EINVAL;
4672 			ti->error = "Invalid argument";
4673 			goto bad;
4674 		}
4675 	}
4676 
4677 	ic->data_device_sectors = bdev_nr_sectors(ic->dev->bdev);
4678 	if (!ic->meta_dev)
4679 		ic->meta_device_sectors = ic->data_device_sectors;
4680 	else
4681 		ic->meta_device_sectors = bdev_nr_sectors(ic->meta_dev->bdev);
4682 
4683 	if (!journal_sectors) {
4684 		journal_sectors = min((sector_t)DEFAULT_MAX_JOURNAL_SECTORS,
4685 				      ic->data_device_sectors >> DEFAULT_JOURNAL_SIZE_FACTOR);
4686 	}
4687 
4688 	if (!buffer_sectors)
4689 		buffer_sectors = 1;
4690 	ic->log2_buffer_sectors = min((int)__fls(buffer_sectors), 31 - SECTOR_SHIFT);
4691 
4692 	r = get_mac(&ic->internal_hash, &ic->internal_hash_alg, &ti->error,
4693 		    "Invalid internal hash", "Error setting internal hash key");
4694 	if (r)
4695 		goto bad;
4696 
4697 	r = get_mac(&ic->journal_mac, &ic->journal_mac_alg, &ti->error,
4698 		    "Invalid journal mac", "Error setting journal mac key");
4699 	if (r)
4700 		goto bad;
4701 
4702 	if (!ic->tag_size) {
4703 		if (!ic->internal_hash) {
4704 			ti->error = "Unknown tag size";
4705 			r = -EINVAL;
4706 			goto bad;
4707 		}
4708 		ic->tag_size = crypto_shash_digestsize(ic->internal_hash);
4709 	}
4710 	if (ic->tag_size > MAX_TAG_SIZE) {
4711 		ti->error = "Too big tag size";
4712 		r = -EINVAL;
4713 		goto bad;
4714 	}
4715 	if (!(ic->tag_size & (ic->tag_size - 1)))
4716 		ic->log2_tag_size = __ffs(ic->tag_size);
4717 	else
4718 		ic->log2_tag_size = -1;
4719 
4720 	if (ic->mode == 'I') {
4721 		struct blk_integrity *bi;
4722 		if (ic->meta_dev) {
4723 			r = -EINVAL;
4724 			ti->error = "Metadata device not supported in inline mode";
4725 			goto bad;
4726 		}
4727 		if (!ic->internal_hash_alg.alg_string) {
4728 			r = -EINVAL;
4729 			ti->error = "Internal hash not set in inline mode";
4730 			goto bad;
4731 		}
4732 		if (ic->journal_crypt_alg.alg_string || ic->journal_mac_alg.alg_string) {
4733 			r = -EINVAL;
4734 			ti->error = "Journal crypt not supported in inline mode";
4735 			goto bad;
4736 		}
4737 		if (ic->discard) {
4738 			r = -EINVAL;
4739 			ti->error = "Discards not supported in inline mode";
4740 			goto bad;
4741 		}
4742 		bi = blk_get_integrity(ic->dev->bdev->bd_disk);
4743 		if (!bi || bi->csum_type != BLK_INTEGRITY_CSUM_NONE) {
4744 			r = -EINVAL;
4745 			ti->error = "Integrity profile not supported";
4746 			goto bad;
4747 		}
4748 		/*printk("tag_size: %u, tuple_size: %u\n", bi->tag_size, bi->tuple_size);*/
4749 		if (bi->tuple_size < ic->tag_size) {
4750 			r = -EINVAL;
4751 			ti->error = "The integrity profile is smaller than tag size";
4752 			goto bad;
4753 		}
4754 		if ((unsigned long)bi->tuple_size > PAGE_SIZE / 2) {
4755 			r = -EINVAL;
4756 			ti->error = "Too big tuple size";
4757 			goto bad;
4758 		}
4759 		ic->tuple_size = bi->tuple_size;
4760 		if (1 << bi->interval_exp != ic->sectors_per_block << SECTOR_SHIFT) {
4761 			r = -EINVAL;
4762 			ti->error = "Integrity profile sector size mismatch";
4763 			goto bad;
4764 		}
4765 	}
4766 
4767 	if (ic->mode == 'B' && !ic->internal_hash) {
4768 		r = -EINVAL;
4769 		ti->error = "Bitmap mode can be only used with internal hash";
4770 		goto bad;
4771 	}
4772 
4773 	if (ic->discard && !ic->internal_hash) {
4774 		r = -EINVAL;
4775 		ti->error = "Discard can be only used with internal hash";
4776 		goto bad;
4777 	}
4778 
4779 	ic->autocommit_jiffies = msecs_to_jiffies(sync_msec);
4780 	ic->autocommit_msec = sync_msec;
4781 	timer_setup(&ic->autocommit_timer, autocommit_fn, 0);
4782 
4783 	ic->io = dm_io_client_create();
4784 	if (IS_ERR(ic->io)) {
4785 		r = PTR_ERR(ic->io);
4786 		ic->io = NULL;
4787 		ti->error = "Cannot allocate dm io";
4788 		goto bad;
4789 	}
4790 
4791 	r = mempool_init_slab_pool(&ic->journal_io_mempool, JOURNAL_IO_MEMPOOL, journal_io_cache);
4792 	if (r) {
4793 		ti->error = "Cannot allocate mempool";
4794 		goto bad;
4795 	}
4796 
4797 	r = mempool_init_page_pool(&ic->recheck_pool, 1, ic->mode == 'I' ? 1 : 0);
4798 	if (r) {
4799 		ti->error = "Cannot allocate mempool";
4800 		goto bad;
4801 	}
4802 
4803 	if (ic->mode == 'I') {
4804 		r = bioset_init(&ic->recheck_bios, RECHECK_POOL_SIZE, 0, BIOSET_NEED_BVECS);
4805 		if (r) {
4806 			ti->error = "Cannot allocate bio set";
4807 			goto bad;
4808 		}
4809 		r = bioset_init(&ic->recalc_bios, 1, 0, BIOSET_NEED_BVECS);
4810 		if (r) {
4811 			ti->error = "Cannot allocate bio set";
4812 			goto bad;
4813 		}
4814 	}
4815 
4816 	ic->metadata_wq = alloc_workqueue("dm-integrity-metadata",
4817 					  WQ_MEM_RECLAIM, METADATA_WORKQUEUE_MAX_ACTIVE);
4818 	if (!ic->metadata_wq) {
4819 		ti->error = "Cannot allocate workqueue";
4820 		r = -ENOMEM;
4821 		goto bad;
4822 	}
4823 
4824 	/*
4825 	 * If this workqueue weren't ordered, it would cause bio reordering
4826 	 * and reduced performance.
4827 	 */
4828 	ic->wait_wq = alloc_ordered_workqueue("dm-integrity-wait", WQ_MEM_RECLAIM);
4829 	if (!ic->wait_wq) {
4830 		ti->error = "Cannot allocate workqueue";
4831 		r = -ENOMEM;
4832 		goto bad;
4833 	}
4834 
4835 	ic->offload_wq = alloc_workqueue("dm-integrity-offload", WQ_MEM_RECLAIM,
4836 					  METADATA_WORKQUEUE_MAX_ACTIVE);
4837 	if (!ic->offload_wq) {
4838 		ti->error = "Cannot allocate workqueue";
4839 		r = -ENOMEM;
4840 		goto bad;
4841 	}
4842 
4843 	ic->commit_wq = alloc_workqueue("dm-integrity-commit", WQ_MEM_RECLAIM, 1);
4844 	if (!ic->commit_wq) {
4845 		ti->error = "Cannot allocate workqueue";
4846 		r = -ENOMEM;
4847 		goto bad;
4848 	}
4849 	INIT_WORK(&ic->commit_work, integrity_commit);
4850 
4851 	if (ic->mode == 'J' || ic->mode == 'B') {
4852 		ic->writer_wq = alloc_workqueue("dm-integrity-writer", WQ_MEM_RECLAIM, 1);
4853 		if (!ic->writer_wq) {
4854 			ti->error = "Cannot allocate workqueue";
4855 			r = -ENOMEM;
4856 			goto bad;
4857 		}
4858 		INIT_WORK(&ic->writer_work, integrity_writer);
4859 	}
4860 
4861 	ic->sb = alloc_pages_exact(SB_SECTORS << SECTOR_SHIFT, GFP_KERNEL);
4862 	if (!ic->sb) {
4863 		r = -ENOMEM;
4864 		ti->error = "Cannot allocate superblock area";
4865 		goto bad;
4866 	}
4867 
4868 	r = sync_rw_sb(ic, REQ_OP_READ);
4869 	if (r) {
4870 		ti->error = "Error reading superblock";
4871 		goto bad;
4872 	}
4873 	should_write_sb = false;
4874 	if (memcmp(ic->sb->magic, SB_MAGIC, 8)) {
4875 		if (ic->mode != 'R') {
4876 			if (memchr_inv(ic->sb, 0, SB_SECTORS << SECTOR_SHIFT)) {
4877 				r = -EINVAL;
4878 				ti->error = "The device is not initialized";
4879 				goto bad;
4880 			}
4881 		}
4882 
4883 		r = initialize_superblock(ic, journal_sectors, interleave_sectors);
4884 		if (r) {
4885 			ti->error = "Could not initialize superblock";
4886 			goto bad;
4887 		}
4888 		if (ic->mode != 'R')
4889 			should_write_sb = true;
4890 	}
4891 
4892 	if (!ic->sb->version || ic->sb->version > SB_VERSION_6) {
4893 		r = -EINVAL;
4894 		ti->error = "Unknown version";
4895 		goto bad;
4896 	}
4897 	if (!!(ic->sb->flags & cpu_to_le32(SB_FLAG_INLINE)) != (ic->mode == 'I')) {
4898 		r = -EINVAL;
4899 		ti->error = "Inline flag mismatch";
4900 		goto bad;
4901 	}
4902 	if (le16_to_cpu(ic->sb->integrity_tag_size) != ic->tag_size) {
4903 		r = -EINVAL;
4904 		ti->error = "Tag size doesn't match the information in superblock";
4905 		goto bad;
4906 	}
4907 	if (ic->sb->log2_sectors_per_block != __ffs(ic->sectors_per_block)) {
4908 		r = -EINVAL;
4909 		ti->error = "Block size doesn't match the information in superblock";
4910 		goto bad;
4911 	}
4912 	if (ic->mode != 'I') {
4913 		if (!le32_to_cpu(ic->sb->journal_sections)) {
4914 			r = -EINVAL;
4915 			ti->error = "Corrupted superblock, journal_sections is 0";
4916 			goto bad;
4917 		}
4918 	} else {
4919 		if (le32_to_cpu(ic->sb->journal_sections)) {
4920 			r = -EINVAL;
4921 			ti->error = "Corrupted superblock, journal_sections is not 0";
4922 			goto bad;
4923 		}
4924 	}
4925 	/* make sure that ti->max_io_len doesn't overflow */
4926 	if (!ic->meta_dev) {
4927 		if (ic->sb->log2_interleave_sectors < MIN_LOG2_INTERLEAVE_SECTORS ||
4928 		    ic->sb->log2_interleave_sectors > MAX_LOG2_INTERLEAVE_SECTORS) {
4929 			r = -EINVAL;
4930 			ti->error = "Invalid interleave_sectors in the superblock";
4931 			goto bad;
4932 		}
4933 	} else {
4934 		if (ic->sb->log2_interleave_sectors) {
4935 			r = -EINVAL;
4936 			ti->error = "Invalid interleave_sectors in the superblock";
4937 			goto bad;
4938 		}
4939 	}
4940 	if (!!(ic->sb->flags & cpu_to_le32(SB_FLAG_HAVE_JOURNAL_MAC)) != !!ic->journal_mac_alg.alg_string) {
4941 		r = -EINVAL;
4942 		ti->error = "Journal mac mismatch";
4943 		goto bad;
4944 	}
4945 
4946 	get_provided_data_sectors(ic);
4947 	if (!ic->provided_data_sectors) {
4948 		r = -EINVAL;
4949 		ti->error = "The device is too small";
4950 		goto bad;
4951 	}
4952 
4953 try_smaller_buffer:
4954 	r = calculate_device_limits(ic);
4955 	if (r) {
4956 		if (ic->meta_dev) {
4957 			if (ic->log2_buffer_sectors > 3) {
4958 				ic->log2_buffer_sectors--;
4959 				goto try_smaller_buffer;
4960 			}
4961 		}
4962 		ti->error = "The device is too small";
4963 		goto bad;
4964 	}
4965 
4966 	if (log2_sectors_per_bitmap_bit < 0)
4967 		log2_sectors_per_bitmap_bit = __fls(DEFAULT_SECTORS_PER_BITMAP_BIT);
4968 	if (log2_sectors_per_bitmap_bit < ic->sb->log2_sectors_per_block)
4969 		log2_sectors_per_bitmap_bit = ic->sb->log2_sectors_per_block;
4970 
4971 	bits_in_journal = ((__u64)ic->journal_section_sectors * ic->journal_sections) << (SECTOR_SHIFT + 3);
4972 	if (bits_in_journal > UINT_MAX)
4973 		bits_in_journal = UINT_MAX;
4974 	if (bits_in_journal)
4975 		while (bits_in_journal < (ic->provided_data_sectors + ((sector_t)1 << log2_sectors_per_bitmap_bit) - 1) >> log2_sectors_per_bitmap_bit)
4976 			log2_sectors_per_bitmap_bit++;
4977 
4978 	log2_blocks_per_bitmap_bit = log2_sectors_per_bitmap_bit - ic->sb->log2_sectors_per_block;
4979 	ic->log2_blocks_per_bitmap_bit = log2_blocks_per_bitmap_bit;
4980 	if (should_write_sb)
4981 		ic->sb->log2_blocks_per_bitmap_bit = log2_blocks_per_bitmap_bit;
4982 
4983 	n_bitmap_bits = ((ic->provided_data_sectors >> ic->sb->log2_sectors_per_block)
4984 				+ (((sector_t)1 << log2_blocks_per_bitmap_bit) - 1)) >> log2_blocks_per_bitmap_bit;
4985 	ic->n_bitmap_blocks = DIV_ROUND_UP(n_bitmap_bits, BITMAP_BLOCK_SIZE * 8);
4986 
4987 	if (!ic->meta_dev)
4988 		ic->log2_buffer_sectors = min(ic->log2_buffer_sectors, (__u8)__ffs(ic->metadata_run));
4989 
4990 	if (ti->len > ic->provided_data_sectors) {
4991 		r = -EINVAL;
4992 		ti->error = "Not enough provided sectors for requested mapping size";
4993 		goto bad;
4994 	}
4995 
4996 	threshold = (__u64)ic->journal_entries * (100 - journal_watermark);
4997 	threshold += 50;
4998 	do_div(threshold, 100);
4999 	ic->free_sectors_threshold = threshold;
5000 
5001 	DEBUG_print("initialized:\n");
5002 	DEBUG_print("	integrity_tag_size %u\n", le16_to_cpu(ic->sb->integrity_tag_size));
5003 	DEBUG_print("	journal_entry_size %u\n", ic->journal_entry_size);
5004 	DEBUG_print("	journal_entries_per_sector %u\n", ic->journal_entries_per_sector);
5005 	DEBUG_print("	journal_section_entries %u\n", ic->journal_section_entries);
5006 	DEBUG_print("	journal_section_sectors %u\n", ic->journal_section_sectors);
5007 	DEBUG_print("	journal_sections %u\n", (unsigned int)le32_to_cpu(ic->sb->journal_sections));
5008 	DEBUG_print("	journal_entries %u\n", ic->journal_entries);
5009 	DEBUG_print("	log2_interleave_sectors %d\n", ic->sb->log2_interleave_sectors);
5010 	DEBUG_print("	data_device_sectors 0x%llx\n", bdev_nr_sectors(ic->dev->bdev));
5011 	DEBUG_print("	initial_sectors 0x%x\n", ic->initial_sectors);
5012 	DEBUG_print("	metadata_run 0x%x\n", ic->metadata_run);
5013 	DEBUG_print("	log2_metadata_run %d\n", ic->log2_metadata_run);
5014 	DEBUG_print("	provided_data_sectors 0x%llx (%llu)\n", ic->provided_data_sectors, ic->provided_data_sectors);
5015 	DEBUG_print("	log2_buffer_sectors %u\n", ic->log2_buffer_sectors);
5016 	DEBUG_print("	bits_in_journal %llu\n", bits_in_journal);
5017 
5018 	if (ic->recalculate_flag && !(ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING))) {
5019 		ic->sb->flags |= cpu_to_le32(SB_FLAG_RECALCULATING);
5020 		ic->sb->recalc_sector = cpu_to_le64(0);
5021 	}
5022 
5023 	if (ic->internal_hash) {
5024 		ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1);
5025 		if (!ic->recalc_wq) {
5026 			ti->error = "Cannot allocate workqueue";
5027 			r = -ENOMEM;
5028 			goto bad;
5029 		}
5030 		INIT_WORK(&ic->recalc_work, ic->mode == 'I' ? integrity_recalc_inline : integrity_recalc);
5031 	} else {
5032 		if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING)) {
5033 			ti->error = "Recalculate can only be specified with internal_hash";
5034 			r = -EINVAL;
5035 			goto bad;
5036 		}
5037 	}
5038 
5039 	if (ic->sb->flags & cpu_to_le32(SB_FLAG_RECALCULATING) &&
5040 	    le64_to_cpu(ic->sb->recalc_sector) < ic->provided_data_sectors &&
5041 	    dm_integrity_disable_recalculate(ic)) {
5042 		ti->error = "Recalculating with HMAC is disabled for security reasons - if you really need it, use the argument \"legacy_recalculate\"";
5043 		r = -EOPNOTSUPP;
5044 		goto bad;
5045 	}
5046 
5047 	ic->bufio = dm_bufio_client_create(ic->meta_dev ? ic->meta_dev->bdev : ic->dev->bdev,
5048 			1U << (SECTOR_SHIFT + ic->log2_buffer_sectors), 1, 0, NULL, NULL, 0);
5049 	if (IS_ERR(ic->bufio)) {
5050 		r = PTR_ERR(ic->bufio);
5051 		ti->error = "Cannot initialize dm-bufio";
5052 		ic->bufio = NULL;
5053 		goto bad;
5054 	}
5055 	dm_bufio_set_sector_offset(ic->bufio, ic->start + ic->initial_sectors);
5056 
5057 	if (ic->mode != 'R' && ic->mode != 'I') {
5058 		r = create_journal(ic, &ti->error);
5059 		if (r)
5060 			goto bad;
5061 
5062 	}
5063 
5064 	if (ic->mode == 'B') {
5065 		unsigned int i;
5066 		unsigned int n_bitmap_pages = DIV_ROUND_UP(ic->n_bitmap_blocks, PAGE_SIZE / BITMAP_BLOCK_SIZE);
5067 
5068 		ic->recalc_bitmap = dm_integrity_alloc_page_list(n_bitmap_pages);
5069 		if (!ic->recalc_bitmap) {
5070 			ti->error = "Could not allocate memory for bitmap";
5071 			r = -ENOMEM;
5072 			goto bad;
5073 		}
5074 		ic->may_write_bitmap = dm_integrity_alloc_page_list(n_bitmap_pages);
5075 		if (!ic->may_write_bitmap) {
5076 			ti->error = "Could not allocate memory for bitmap";
5077 			r = -ENOMEM;
5078 			goto bad;
5079 		}
5080 		ic->bbs = kvmalloc_array(ic->n_bitmap_blocks, sizeof(struct bitmap_block_status), GFP_KERNEL);
5081 		if (!ic->bbs) {
5082 			ti->error = "Could not allocate memory for bitmap";
5083 			r = -ENOMEM;
5084 			goto bad;
5085 		}
5086 		INIT_DELAYED_WORK(&ic->bitmap_flush_work, bitmap_flush_work);
5087 		for (i = 0; i < ic->n_bitmap_blocks; i++) {
5088 			struct bitmap_block_status *bbs = &ic->bbs[i];
5089 			unsigned int sector, pl_index, pl_offset;
5090 
5091 			INIT_WORK(&bbs->work, bitmap_block_work);
5092 			bbs->ic = ic;
5093 			bbs->idx = i;
5094 			bio_list_init(&bbs->bio_queue);
5095 			spin_lock_init(&bbs->bio_queue_lock);
5096 
5097 			sector = i * (BITMAP_BLOCK_SIZE >> SECTOR_SHIFT);
5098 			pl_index = sector >> (PAGE_SHIFT - SECTOR_SHIFT);
5099 			pl_offset = (sector << SECTOR_SHIFT) & (PAGE_SIZE - 1);
5100 
5101 			bbs->bitmap = lowmem_page_address(ic->journal[pl_index].page) + pl_offset;
5102 		}
5103 	}
5104 
5105 	if (should_write_sb) {
5106 		init_journal(ic, 0, ic->journal_sections, 0);
5107 		r = dm_integrity_failed(ic);
5108 		if (unlikely(r)) {
5109 			ti->error = "Error initializing journal";
5110 			goto bad;
5111 		}
5112 		r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
5113 		if (r) {
5114 			ti->error = "Error initializing superblock";
5115 			goto bad;
5116 		}
5117 		ic->just_formatted = true;
5118 	}
5119 
5120 	if (!ic->meta_dev && ic->mode != 'I') {
5121 		r = dm_set_target_max_io_len(ti, 1U << ic->sb->log2_interleave_sectors);
5122 		if (r)
5123 			goto bad;
5124 	}
5125 	if (ic->mode == 'B') {
5126 		unsigned int max_io_len;
5127 
5128 		max_io_len = ((sector_t)ic->sectors_per_block << ic->log2_blocks_per_bitmap_bit) * (BITMAP_BLOCK_SIZE * 8);
5129 		if (!max_io_len)
5130 			max_io_len = 1U << 31;
5131 		DEBUG_print("max_io_len: old %u, new %u\n", ti->max_io_len, max_io_len);
5132 		if (!ti->max_io_len || ti->max_io_len > max_io_len) {
5133 			r = dm_set_target_max_io_len(ti, max_io_len);
5134 			if (r)
5135 				goto bad;
5136 		}
5137 	}
5138 
5139 	ti->num_flush_bios = 1;
5140 	ti->flush_supported = true;
5141 	if (ic->discard)
5142 		ti->num_discard_bios = 1;
5143 
5144 	if (ic->mode == 'I')
5145 		ti->mempool_needs_integrity = true;
5146 
5147 	dm_audit_log_ctr(DM_MSG_PREFIX, ti, 1);
5148 	return 0;
5149 
5150 bad:
5151 	dm_audit_log_ctr(DM_MSG_PREFIX, ti, 0);
5152 	dm_integrity_dtr(ti);
5153 	return r;
5154 }
5155 
5156 static void dm_integrity_dtr(struct dm_target *ti)
5157 {
5158 	struct dm_integrity_c *ic = ti->private;
5159 
5160 	BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
5161 	BUG_ON(!list_empty(&ic->wait_list));
5162 
5163 	if (ic->mode == 'B' && ic->bitmap_flush_work.work.func)
5164 		cancel_delayed_work_sync(&ic->bitmap_flush_work);
5165 	if (ic->metadata_wq)
5166 		destroy_workqueue(ic->metadata_wq);
5167 	if (ic->wait_wq)
5168 		destroy_workqueue(ic->wait_wq);
5169 	if (ic->offload_wq)
5170 		destroy_workqueue(ic->offload_wq);
5171 	if (ic->commit_wq)
5172 		destroy_workqueue(ic->commit_wq);
5173 	if (ic->writer_wq)
5174 		destroy_workqueue(ic->writer_wq);
5175 	if (ic->recalc_wq)
5176 		destroy_workqueue(ic->recalc_wq);
5177 	kvfree(ic->bbs);
5178 	if (ic->bufio)
5179 		dm_bufio_client_destroy(ic->bufio);
5180 	bioset_exit(&ic->recalc_bios);
5181 	bioset_exit(&ic->recheck_bios);
5182 	mempool_exit(&ic->recheck_pool);
5183 	mempool_exit(&ic->journal_io_mempool);
5184 	if (ic->io)
5185 		dm_io_client_destroy(ic->io);
5186 	if (ic->dev)
5187 		dm_put_device(ti, ic->dev);
5188 	if (ic->meta_dev)
5189 		dm_put_device(ti, ic->meta_dev);
5190 	dm_integrity_free_page_list(ic->journal);
5191 	dm_integrity_free_page_list(ic->journal_io);
5192 	dm_integrity_free_page_list(ic->journal_xor);
5193 	dm_integrity_free_page_list(ic->recalc_bitmap);
5194 	dm_integrity_free_page_list(ic->may_write_bitmap);
5195 	if (ic->journal_scatterlist)
5196 		dm_integrity_free_journal_scatterlist(ic, ic->journal_scatterlist);
5197 	if (ic->journal_io_scatterlist)
5198 		dm_integrity_free_journal_scatterlist(ic, ic->journal_io_scatterlist);
5199 	if (ic->sk_requests) {
5200 		unsigned int i;
5201 
5202 		for (i = 0; i < ic->journal_sections; i++) {
5203 			struct skcipher_request *req;
5204 
5205 			req = ic->sk_requests[i];
5206 			if (req) {
5207 				kfree_sensitive(req->iv);
5208 				skcipher_request_free(req);
5209 			}
5210 		}
5211 		kvfree(ic->sk_requests);
5212 	}
5213 	kvfree(ic->journal_tree);
5214 	if (ic->sb)
5215 		free_pages_exact(ic->sb, SB_SECTORS << SECTOR_SHIFT);
5216 
5217 	if (ic->internal_hash)
5218 		crypto_free_shash(ic->internal_hash);
5219 	free_alg(&ic->internal_hash_alg);
5220 
5221 	if (ic->journal_crypt)
5222 		crypto_free_skcipher(ic->journal_crypt);
5223 	free_alg(&ic->journal_crypt_alg);
5224 
5225 	if (ic->journal_mac)
5226 		crypto_free_shash(ic->journal_mac);
5227 	free_alg(&ic->journal_mac_alg);
5228 
5229 	kfree(ic);
5230 	dm_audit_log_dtr(DM_MSG_PREFIX, ti, 1);
5231 }
5232 
5233 static struct target_type integrity_target = {
5234 	.name			= "integrity",
5235 	.version		= {1, 13, 0},
5236 	.module			= THIS_MODULE,
5237 	.features		= DM_TARGET_SINGLETON | DM_TARGET_INTEGRITY,
5238 	.ctr			= dm_integrity_ctr,
5239 	.dtr			= dm_integrity_dtr,
5240 	.map			= dm_integrity_map,
5241 	.end_io			= dm_integrity_end_io,
5242 	.postsuspend		= dm_integrity_postsuspend,
5243 	.resume			= dm_integrity_resume,
5244 	.status			= dm_integrity_status,
5245 	.iterate_devices	= dm_integrity_iterate_devices,
5246 	.io_hints		= dm_integrity_io_hints,
5247 };
5248 
5249 static int __init dm_integrity_init(void)
5250 {
5251 	int r;
5252 
5253 	journal_io_cache = kmem_cache_create("integrity_journal_io",
5254 					     sizeof(struct journal_io), 0, 0, NULL);
5255 	if (!journal_io_cache) {
5256 		DMERR("can't allocate journal io cache");
5257 		return -ENOMEM;
5258 	}
5259 
5260 	r = dm_register_target(&integrity_target);
5261 	if (r < 0) {
5262 		kmem_cache_destroy(journal_io_cache);
5263 		return r;
5264 	}
5265 
5266 	return 0;
5267 }
5268 
5269 static void __exit dm_integrity_exit(void)
5270 {
5271 	dm_unregister_target(&integrity_target);
5272 	kmem_cache_destroy(journal_io_cache);
5273 }
5274 
5275 module_init(dm_integrity_init);
5276 module_exit(dm_integrity_exit);
5277 
5278 MODULE_AUTHOR("Milan Broz");
5279 MODULE_AUTHOR("Mikulas Patocka");
5280 MODULE_DESCRIPTION(DM_NAME " target for integrity tags extension");
5281 MODULE_LICENSE("GPL");
5282