libceph: fix overflow in __decode_pool_names()
[firefly-linux-kernel-4.4.55.git] / net / ceph / osdmap.c
1
2 #include <linux/ceph/ceph_debug.h>
3
4 #include <linux/module.h>
5 #include <linux/slab.h>
6 #include <asm/div64.h>
7
8 #include <linux/ceph/libceph.h>
9 #include <linux/ceph/osdmap.h>
10 #include <linux/ceph/decode.h>
11 #include <linux/crush/hash.h>
12 #include <linux/crush/mapper.h>
13
14 char *ceph_osdmap_state_str(char *str, int len, int state)
15 {
16         int flag = 0;
17
18         if (!len)
19                 goto done;
20
21         *str = '\0';
22         if (state) {
23                 if (state & CEPH_OSD_EXISTS) {
24                         snprintf(str, len, "exists");
25                         flag = 1;
26                 }
27                 if (state & CEPH_OSD_UP) {
28                         snprintf(str, len, "%s%s%s", str, (flag ? ", " : ""),
29                                  "up");
30                         flag = 1;
31                 }
32         } else {
33                 snprintf(str, len, "doesn't exist");
34         }
35 done:
36         return str;
37 }
38
39 /* maps */
40
41 static int calc_bits_of(unsigned t)
42 {
43         int b = 0;
44         while (t) {
45                 t = t >> 1;
46                 b++;
47         }
48         return b;
49 }
50
51 /*
52  * the foo_mask is the smallest value 2^n-1 that is >= foo.
53  */
54 static void calc_pg_masks(struct ceph_pg_pool_info *pi)
55 {
56         pi->pg_num_mask = (1 << calc_bits_of(le32_to_cpu(pi->v.pg_num)-1)) - 1;
57         pi->pgp_num_mask =
58                 (1 << calc_bits_of(le32_to_cpu(pi->v.pgp_num)-1)) - 1;
59         pi->lpg_num_mask =
60                 (1 << calc_bits_of(le32_to_cpu(pi->v.lpg_num)-1)) - 1;
61         pi->lpgp_num_mask =
62                 (1 << calc_bits_of(le32_to_cpu(pi->v.lpgp_num)-1)) - 1;
63 }
64
65 /*
66  * decode crush map
67  */
68 static int crush_decode_uniform_bucket(void **p, void *end,
69                                        struct crush_bucket_uniform *b)
70 {
71         dout("crush_decode_uniform_bucket %p to %p\n", *p, end);
72         ceph_decode_need(p, end, (1+b->h.size) * sizeof(u32), bad);
73         b->item_weight = ceph_decode_32(p);
74         return 0;
75 bad:
76         return -EINVAL;
77 }
78
79 static int crush_decode_list_bucket(void **p, void *end,
80                                     struct crush_bucket_list *b)
81 {
82         int j;
83         dout("crush_decode_list_bucket %p to %p\n", *p, end);
84         b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
85         if (b->item_weights == NULL)
86                 return -ENOMEM;
87         b->sum_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
88         if (b->sum_weights == NULL)
89                 return -ENOMEM;
90         ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
91         for (j = 0; j < b->h.size; j++) {
92                 b->item_weights[j] = ceph_decode_32(p);
93                 b->sum_weights[j] = ceph_decode_32(p);
94         }
95         return 0;
96 bad:
97         return -EINVAL;
98 }
99
100 static int crush_decode_tree_bucket(void **p, void *end,
101                                     struct crush_bucket_tree *b)
102 {
103         int j;
104         dout("crush_decode_tree_bucket %p to %p\n", *p, end);
105         ceph_decode_32_safe(p, end, b->num_nodes, bad);
106         b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
107         if (b->node_weights == NULL)
108                 return -ENOMEM;
109         ceph_decode_need(p, end, b->num_nodes * sizeof(u32), bad);
110         for (j = 0; j < b->num_nodes; j++)
111                 b->node_weights[j] = ceph_decode_32(p);
112         return 0;
113 bad:
114         return -EINVAL;
115 }
116
117 static int crush_decode_straw_bucket(void **p, void *end,
118                                      struct crush_bucket_straw *b)
119 {
120         int j;
121         dout("crush_decode_straw_bucket %p to %p\n", *p, end);
122         b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
123         if (b->item_weights == NULL)
124                 return -ENOMEM;
125         b->straws = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
126         if (b->straws == NULL)
127                 return -ENOMEM;
128         ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
129         for (j = 0; j < b->h.size; j++) {
130                 b->item_weights[j] = ceph_decode_32(p);
131                 b->straws[j] = ceph_decode_32(p);
132         }
133         return 0;
134 bad:
135         return -EINVAL;
136 }
137
138 static struct crush_map *crush_decode(void *pbyval, void *end)
139 {
140         struct crush_map *c;
141         int err = -EINVAL;
142         int i, j;
143         void **p = &pbyval;
144         void *start = pbyval;
145         u32 magic;
146
147         dout("crush_decode %p to %p len %d\n", *p, end, (int)(end - *p));
148
149         c = kzalloc(sizeof(*c), GFP_NOFS);
150         if (c == NULL)
151                 return ERR_PTR(-ENOMEM);
152
153         ceph_decode_need(p, end, 4*sizeof(u32), bad);
154         magic = ceph_decode_32(p);
155         if (magic != CRUSH_MAGIC) {
156                 pr_err("crush_decode magic %x != current %x\n",
157                        (unsigned)magic, (unsigned)CRUSH_MAGIC);
158                 goto bad;
159         }
160         c->max_buckets = ceph_decode_32(p);
161         c->max_rules = ceph_decode_32(p);
162         c->max_devices = ceph_decode_32(p);
163
164         c->buckets = kcalloc(c->max_buckets, sizeof(*c->buckets), GFP_NOFS);
165         if (c->buckets == NULL)
166                 goto badmem;
167         c->rules = kcalloc(c->max_rules, sizeof(*c->rules), GFP_NOFS);
168         if (c->rules == NULL)
169                 goto badmem;
170
171         /* buckets */
172         for (i = 0; i < c->max_buckets; i++) {
173                 int size = 0;
174                 u32 alg;
175                 struct crush_bucket *b;
176
177                 ceph_decode_32_safe(p, end, alg, bad);
178                 if (alg == 0) {
179                         c->buckets[i] = NULL;
180                         continue;
181                 }
182                 dout("crush_decode bucket %d off %x %p to %p\n",
183                      i, (int)(*p-start), *p, end);
184
185                 switch (alg) {
186                 case CRUSH_BUCKET_UNIFORM:
187                         size = sizeof(struct crush_bucket_uniform);
188                         break;
189                 case CRUSH_BUCKET_LIST:
190                         size = sizeof(struct crush_bucket_list);
191                         break;
192                 case CRUSH_BUCKET_TREE:
193                         size = sizeof(struct crush_bucket_tree);
194                         break;
195                 case CRUSH_BUCKET_STRAW:
196                         size = sizeof(struct crush_bucket_straw);
197                         break;
198                 default:
199                         err = -EINVAL;
200                         goto bad;
201                 }
202                 BUG_ON(size == 0);
203                 b = c->buckets[i] = kzalloc(size, GFP_NOFS);
204                 if (b == NULL)
205                         goto badmem;
206
207                 ceph_decode_need(p, end, 4*sizeof(u32), bad);
208                 b->id = ceph_decode_32(p);
209                 b->type = ceph_decode_16(p);
210                 b->alg = ceph_decode_8(p);
211                 b->hash = ceph_decode_8(p);
212                 b->weight = ceph_decode_32(p);
213                 b->size = ceph_decode_32(p);
214
215                 dout("crush_decode bucket size %d off %x %p to %p\n",
216                      b->size, (int)(*p-start), *p, end);
217
218                 b->items = kcalloc(b->size, sizeof(__s32), GFP_NOFS);
219                 if (b->items == NULL)
220                         goto badmem;
221                 b->perm = kcalloc(b->size, sizeof(u32), GFP_NOFS);
222                 if (b->perm == NULL)
223                         goto badmem;
224                 b->perm_n = 0;
225
226                 ceph_decode_need(p, end, b->size*sizeof(u32), bad);
227                 for (j = 0; j < b->size; j++)
228                         b->items[j] = ceph_decode_32(p);
229
230                 switch (b->alg) {
231                 case CRUSH_BUCKET_UNIFORM:
232                         err = crush_decode_uniform_bucket(p, end,
233                                   (struct crush_bucket_uniform *)b);
234                         if (err < 0)
235                                 goto bad;
236                         break;
237                 case CRUSH_BUCKET_LIST:
238                         err = crush_decode_list_bucket(p, end,
239                                (struct crush_bucket_list *)b);
240                         if (err < 0)
241                                 goto bad;
242                         break;
243                 case CRUSH_BUCKET_TREE:
244                         err = crush_decode_tree_bucket(p, end,
245                                 (struct crush_bucket_tree *)b);
246                         if (err < 0)
247                                 goto bad;
248                         break;
249                 case CRUSH_BUCKET_STRAW:
250                         err = crush_decode_straw_bucket(p, end,
251                                 (struct crush_bucket_straw *)b);
252                         if (err < 0)
253                                 goto bad;
254                         break;
255                 }
256         }
257
258         /* rules */
259         dout("rule vec is %p\n", c->rules);
260         for (i = 0; i < c->max_rules; i++) {
261                 u32 yes;
262                 struct crush_rule *r;
263
264                 ceph_decode_32_safe(p, end, yes, bad);
265                 if (!yes) {
266                         dout("crush_decode NO rule %d off %x %p to %p\n",
267                              i, (int)(*p-start), *p, end);
268                         c->rules[i] = NULL;
269                         continue;
270                 }
271
272                 dout("crush_decode rule %d off %x %p to %p\n",
273                      i, (int)(*p-start), *p, end);
274
275                 /* len */
276                 ceph_decode_32_safe(p, end, yes, bad);
277 #if BITS_PER_LONG == 32
278                 err = -EINVAL;
279                 if (yes > (ULONG_MAX - sizeof(*r))
280                           / sizeof(struct crush_rule_step))
281                         goto bad;
282 #endif
283                 r = c->rules[i] = kmalloc(sizeof(*r) +
284                                           yes*sizeof(struct crush_rule_step),
285                                           GFP_NOFS);
286                 if (r == NULL)
287                         goto badmem;
288                 dout(" rule %d is at %p\n", i, r);
289                 r->len = yes;
290                 ceph_decode_copy_safe(p, end, &r->mask, 4, bad); /* 4 u8's */
291                 ceph_decode_need(p, end, r->len*3*sizeof(u32), bad);
292                 for (j = 0; j < r->len; j++) {
293                         r->steps[j].op = ceph_decode_32(p);
294                         r->steps[j].arg1 = ceph_decode_32(p);
295                         r->steps[j].arg2 = ceph_decode_32(p);
296                 }
297         }
298
299         /* ignore trailing name maps. */
300
301         dout("crush_decode success\n");
302         return c;
303
304 badmem:
305         err = -ENOMEM;
306 bad:
307         dout("crush_decode fail %d\n", err);
308         crush_destroy(c);
309         return ERR_PTR(err);
310 }
311
312 /*
313  * rbtree of pg_mapping for handling pg_temp (explicit mapping of pgid
314  * to a set of osds)
315  */
316 static int pgid_cmp(struct ceph_pg l, struct ceph_pg r)
317 {
318         u64 a = *(u64 *)&l;
319         u64 b = *(u64 *)&r;
320
321         if (a < b)
322                 return -1;
323         if (a > b)
324                 return 1;
325         return 0;
326 }
327
328 static int __insert_pg_mapping(struct ceph_pg_mapping *new,
329                                struct rb_root *root)
330 {
331         struct rb_node **p = &root->rb_node;
332         struct rb_node *parent = NULL;
333         struct ceph_pg_mapping *pg = NULL;
334         int c;
335
336         dout("__insert_pg_mapping %llx %p\n", *(u64 *)&new->pgid, new);
337         while (*p) {
338                 parent = *p;
339                 pg = rb_entry(parent, struct ceph_pg_mapping, node);
340                 c = pgid_cmp(new->pgid, pg->pgid);
341                 if (c < 0)
342                         p = &(*p)->rb_left;
343                 else if (c > 0)
344                         p = &(*p)->rb_right;
345                 else
346                         return -EEXIST;
347         }
348
349         rb_link_node(&new->node, parent, p);
350         rb_insert_color(&new->node, root);
351         return 0;
352 }
353
354 static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
355                                                    struct ceph_pg pgid)
356 {
357         struct rb_node *n = root->rb_node;
358         struct ceph_pg_mapping *pg;
359         int c;
360
361         while (n) {
362                 pg = rb_entry(n, struct ceph_pg_mapping, node);
363                 c = pgid_cmp(pgid, pg->pgid);
364                 if (c < 0) {
365                         n = n->rb_left;
366                 } else if (c > 0) {
367                         n = n->rb_right;
368                 } else {
369                         dout("__lookup_pg_mapping %llx got %p\n",
370                              *(u64 *)&pgid, pg);
371                         return pg;
372                 }
373         }
374         return NULL;
375 }
376
377 static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
378 {
379         struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
380
381         if (pg) {
382                 dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
383                 rb_erase(&pg->node, root);
384                 kfree(pg);
385                 return 0;
386         }
387         dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
388         return -ENOENT;
389 }
390
391 /*
392  * rbtree of pg pool info
393  */
394 static int __insert_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *new)
395 {
396         struct rb_node **p = &root->rb_node;
397         struct rb_node *parent = NULL;
398         struct ceph_pg_pool_info *pi = NULL;
399
400         while (*p) {
401                 parent = *p;
402                 pi = rb_entry(parent, struct ceph_pg_pool_info, node);
403                 if (new->id < pi->id)
404                         p = &(*p)->rb_left;
405                 else if (new->id > pi->id)
406                         p = &(*p)->rb_right;
407                 else
408                         return -EEXIST;
409         }
410
411         rb_link_node(&new->node, parent, p);
412         rb_insert_color(&new->node, root);
413         return 0;
414 }
415
416 static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
417 {
418         struct ceph_pg_pool_info *pi;
419         struct rb_node *n = root->rb_node;
420
421         while (n) {
422                 pi = rb_entry(n, struct ceph_pg_pool_info, node);
423                 if (id < pi->id)
424                         n = n->rb_left;
425                 else if (id > pi->id)
426                         n = n->rb_right;
427                 else
428                         return pi;
429         }
430         return NULL;
431 }
432
433 int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name)
434 {
435         struct rb_node *rbp;
436
437         for (rbp = rb_first(&map->pg_pools); rbp; rbp = rb_next(rbp)) {
438                 struct ceph_pg_pool_info *pi =
439                         rb_entry(rbp, struct ceph_pg_pool_info, node);
440                 if (pi->name && strcmp(pi->name, name) == 0)
441                         return pi->id;
442         }
443         return -ENOENT;
444 }
445 EXPORT_SYMBOL(ceph_pg_poolid_by_name);
446
447 static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
448 {
449         rb_erase(&pi->node, root);
450         kfree(pi->name);
451         kfree(pi);
452 }
453
454 static int __decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
455 {
456         unsigned n, m;
457
458         ceph_decode_copy(p, &pi->v, sizeof(pi->v));
459         calc_pg_masks(pi);
460
461         /* num_snaps * snap_info_t */
462         n = le32_to_cpu(pi->v.num_snaps);
463         while (n--) {
464                 ceph_decode_need(p, end, sizeof(u64) + 1 + sizeof(u64) +
465                                  sizeof(struct ceph_timespec), bad);
466                 *p += sizeof(u64) +       /* key */
467                         1 + sizeof(u64) + /* u8, snapid */
468                         sizeof(struct ceph_timespec);
469                 m = ceph_decode_32(p);    /* snap name */
470                 *p += m;
471         }
472
473         *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
474         return 0;
475
476 bad:
477         return -EINVAL;
478 }
479
480 static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
481 {
482         struct ceph_pg_pool_info *pi;
483         u32 num, len, pool;
484
485         ceph_decode_32_safe(p, end, num, bad);
486         dout(" %d pool names\n", num);
487         while (num--) {
488                 ceph_decode_32_safe(p, end, pool, bad);
489                 ceph_decode_32_safe(p, end, len, bad);
490                 dout("  pool %d len %d\n", pool, len);
491                 ceph_decode_need(p, end, len, bad);
492                 pi = __lookup_pg_pool(&map->pg_pools, pool);
493                 if (pi) {
494                         char *name = kstrndup(*p, len, GFP_NOFS);
495
496                         if (!name)
497                                 return -ENOMEM;
498                         kfree(pi->name);
499                         pi->name = name;
500                         dout("  name is %s\n", pi->name);
501                 }
502                 *p += len;
503         }
504         return 0;
505
506 bad:
507         return -EINVAL;
508 }
509
510 /*
511  * osd map
512  */
513 void ceph_osdmap_destroy(struct ceph_osdmap *map)
514 {
515         dout("osdmap_destroy %p\n", map);
516         if (map->crush)
517                 crush_destroy(map->crush);
518         while (!RB_EMPTY_ROOT(&map->pg_temp)) {
519                 struct ceph_pg_mapping *pg =
520                         rb_entry(rb_first(&map->pg_temp),
521                                  struct ceph_pg_mapping, node);
522                 rb_erase(&pg->node, &map->pg_temp);
523                 kfree(pg);
524         }
525         while (!RB_EMPTY_ROOT(&map->pg_pools)) {
526                 struct ceph_pg_pool_info *pi =
527                         rb_entry(rb_first(&map->pg_pools),
528                                  struct ceph_pg_pool_info, node);
529                 __remove_pg_pool(&map->pg_pools, pi);
530         }
531         kfree(map->osd_state);
532         kfree(map->osd_weight);
533         kfree(map->osd_addr);
534         kfree(map);
535 }
536
537 /*
538  * adjust max osd value.  reallocate arrays.
539  */
540 static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
541 {
542         u8 *state;
543         struct ceph_entity_addr *addr;
544         u32 *weight;
545
546         state = kcalloc(max, sizeof(*state), GFP_NOFS);
547         addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
548         weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
549         if (state == NULL || addr == NULL || weight == NULL) {
550                 kfree(state);
551                 kfree(addr);
552                 kfree(weight);
553                 return -ENOMEM;
554         }
555
556         /* copy old? */
557         if (map->osd_state) {
558                 memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
559                 memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
560                 memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
561                 kfree(map->osd_state);
562                 kfree(map->osd_addr);
563                 kfree(map->osd_weight);
564         }
565
566         map->osd_state = state;
567         map->osd_weight = weight;
568         map->osd_addr = addr;
569         map->max_osd = max;
570         return 0;
571 }
572
573 /*
574  * decode a full map.
575  */
576 struct ceph_osdmap *osdmap_decode(void **p, void *end)
577 {
578         struct ceph_osdmap *map;
579         u16 version;
580         u32 len, max, i;
581         u8 ev;
582         int err = -EINVAL;
583         void *start = *p;
584         struct ceph_pg_pool_info *pi;
585
586         dout("osdmap_decode %p to %p len %d\n", *p, end, (int)(end - *p));
587
588         map = kzalloc(sizeof(*map), GFP_NOFS);
589         if (map == NULL)
590                 return ERR_PTR(-ENOMEM);
591         map->pg_temp = RB_ROOT;
592
593         ceph_decode_16_safe(p, end, version, bad);
594         if (version > CEPH_OSDMAP_VERSION) {
595                 pr_warning("got unknown v %d > %d of osdmap\n", version,
596                            CEPH_OSDMAP_VERSION);
597                 goto bad;
598         }
599
600         ceph_decode_need(p, end, 2*sizeof(u64)+6*sizeof(u32), bad);
601         ceph_decode_copy(p, &map->fsid, sizeof(map->fsid));
602         map->epoch = ceph_decode_32(p);
603         ceph_decode_copy(p, &map->created, sizeof(map->created));
604         ceph_decode_copy(p, &map->modified, sizeof(map->modified));
605
606         ceph_decode_32_safe(p, end, max, bad);
607         while (max--) {
608                 ceph_decode_need(p, end, 4 + 1 + sizeof(pi->v), bad);
609                 pi = kzalloc(sizeof(*pi), GFP_NOFS);
610                 if (!pi)
611                         goto bad;
612                 pi->id = ceph_decode_32(p);
613                 ev = ceph_decode_8(p); /* encoding version */
614                 if (ev > CEPH_PG_POOL_VERSION) {
615                         pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
616                                    ev, CEPH_PG_POOL_VERSION);
617                         kfree(pi);
618                         goto bad;
619                 }
620                 err = __decode_pool(p, end, pi);
621                 if (err < 0) {
622                         kfree(pi);
623                         goto bad;
624                 }
625                 __insert_pg_pool(&map->pg_pools, pi);
626         }
627
628         if (version >= 5 && __decode_pool_names(p, end, map) < 0)
629                 goto bad;
630
631         ceph_decode_32_safe(p, end, map->pool_max, bad);
632
633         ceph_decode_32_safe(p, end, map->flags, bad);
634
635         max = ceph_decode_32(p);
636
637         /* (re)alloc osd arrays */
638         err = osdmap_set_max_osd(map, max);
639         if (err < 0)
640                 goto bad;
641         dout("osdmap_decode max_osd = %d\n", map->max_osd);
642
643         /* osds */
644         err = -EINVAL;
645         ceph_decode_need(p, end, 3*sizeof(u32) +
646                          map->max_osd*(1 + sizeof(*map->osd_weight) +
647                                        sizeof(*map->osd_addr)), bad);
648         *p += 4; /* skip length field (should match max) */
649         ceph_decode_copy(p, map->osd_state, map->max_osd);
650
651         *p += 4; /* skip length field (should match max) */
652         for (i = 0; i < map->max_osd; i++)
653                 map->osd_weight[i] = ceph_decode_32(p);
654
655         *p += 4; /* skip length field (should match max) */
656         ceph_decode_copy(p, map->osd_addr, map->max_osd*sizeof(*map->osd_addr));
657         for (i = 0; i < map->max_osd; i++)
658                 ceph_decode_addr(&map->osd_addr[i]);
659
660         /* pg_temp */
661         ceph_decode_32_safe(p, end, len, bad);
662         for (i = 0; i < len; i++) {
663                 int n, j;
664                 struct ceph_pg pgid;
665                 struct ceph_pg_mapping *pg;
666
667                 ceph_decode_need(p, end, sizeof(u32) + sizeof(u64), bad);
668                 ceph_decode_copy(p, &pgid, sizeof(pgid));
669                 n = ceph_decode_32(p);
670                 ceph_decode_need(p, end, n * sizeof(u32), bad);
671                 err = -ENOMEM;
672                 pg = kmalloc(sizeof(*pg) + n*sizeof(u32), GFP_NOFS);
673                 if (!pg)
674                         goto bad;
675                 pg->pgid = pgid;
676                 pg->len = n;
677                 for (j = 0; j < n; j++)
678                         pg->osds[j] = ceph_decode_32(p);
679
680                 err = __insert_pg_mapping(pg, &map->pg_temp);
681                 if (err)
682                         goto bad;
683                 dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid, len);
684         }
685
686         /* crush */
687         ceph_decode_32_safe(p, end, len, bad);
688         dout("osdmap_decode crush len %d from off 0x%x\n", len,
689              (int)(*p - start));
690         ceph_decode_need(p, end, len, bad);
691         map->crush = crush_decode(*p, end);
692         *p += len;
693         if (IS_ERR(map->crush)) {
694                 err = PTR_ERR(map->crush);
695                 map->crush = NULL;
696                 goto bad;
697         }
698
699         /* ignore the rest of the map */
700         *p = end;
701
702         dout("osdmap_decode done %p %p\n", *p, end);
703         return map;
704
705 bad:
706         dout("osdmap_decode fail\n");
707         ceph_osdmap_destroy(map);
708         return ERR_PTR(err);
709 }
710
711 /*
712  * decode and apply an incremental map update.
713  */
714 struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
715                                              struct ceph_osdmap *map,
716                                              struct ceph_messenger *msgr)
717 {
718         struct crush_map *newcrush = NULL;
719         struct ceph_fsid fsid;
720         u32 epoch = 0;
721         struct ceph_timespec modified;
722         u32 len, pool;
723         __s32 new_pool_max, new_flags, max;
724         void *start = *p;
725         int err = -EINVAL;
726         u16 version;
727
728         ceph_decode_16_safe(p, end, version, bad);
729         if (version > CEPH_OSDMAP_INC_VERSION) {
730                 pr_warning("got unknown v %d > %d of inc osdmap\n", version,
731                            CEPH_OSDMAP_INC_VERSION);
732                 goto bad;
733         }
734
735         ceph_decode_need(p, end, sizeof(fsid)+sizeof(modified)+2*sizeof(u32),
736                          bad);
737         ceph_decode_copy(p, &fsid, sizeof(fsid));
738         epoch = ceph_decode_32(p);
739         BUG_ON(epoch != map->epoch+1);
740         ceph_decode_copy(p, &modified, sizeof(modified));
741         new_pool_max = ceph_decode_32(p);
742         new_flags = ceph_decode_32(p);
743
744         /* full map? */
745         ceph_decode_32_safe(p, end, len, bad);
746         if (len > 0) {
747                 dout("apply_incremental full map len %d, %p to %p\n",
748                      len, *p, end);
749                 return osdmap_decode(p, min(*p+len, end));
750         }
751
752         /* new crush? */
753         ceph_decode_32_safe(p, end, len, bad);
754         if (len > 0) {
755                 dout("apply_incremental new crush map len %d, %p to %p\n",
756                      len, *p, end);
757                 newcrush = crush_decode(*p, min(*p+len, end));
758                 if (IS_ERR(newcrush))
759                         return ERR_CAST(newcrush);
760                 *p += len;
761         }
762
763         /* new flags? */
764         if (new_flags >= 0)
765                 map->flags = new_flags;
766         if (new_pool_max >= 0)
767                 map->pool_max = new_pool_max;
768
769         ceph_decode_need(p, end, 5*sizeof(u32), bad);
770
771         /* new max? */
772         max = ceph_decode_32(p);
773         if (max >= 0) {
774                 err = osdmap_set_max_osd(map, max);
775                 if (err < 0)
776                         goto bad;
777         }
778
779         map->epoch++;
780         map->modified = modified;
781         if (newcrush) {
782                 if (map->crush)
783                         crush_destroy(map->crush);
784                 map->crush = newcrush;
785                 newcrush = NULL;
786         }
787
788         /* new_pool */
789         ceph_decode_32_safe(p, end, len, bad);
790         while (len--) {
791                 __u8 ev;
792                 struct ceph_pg_pool_info *pi;
793
794                 ceph_decode_32_safe(p, end, pool, bad);
795                 ceph_decode_need(p, end, 1 + sizeof(pi->v), bad);
796                 ev = ceph_decode_8(p);  /* encoding version */
797                 if (ev > CEPH_PG_POOL_VERSION) {
798                         pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
799                                    ev, CEPH_PG_POOL_VERSION);
800                         goto bad;
801                 }
802                 pi = __lookup_pg_pool(&map->pg_pools, pool);
803                 if (!pi) {
804                         pi = kzalloc(sizeof(*pi), GFP_NOFS);
805                         if (!pi) {
806                                 err = -ENOMEM;
807                                 goto bad;
808                         }
809                         pi->id = pool;
810                         __insert_pg_pool(&map->pg_pools, pi);
811                 }
812                 err = __decode_pool(p, end, pi);
813                 if (err < 0)
814                         goto bad;
815         }
816         if (version >= 5 && __decode_pool_names(p, end, map) < 0)
817                 goto bad;
818
819         /* old_pool */
820         ceph_decode_32_safe(p, end, len, bad);
821         while (len--) {
822                 struct ceph_pg_pool_info *pi;
823
824                 ceph_decode_32_safe(p, end, pool, bad);
825                 pi = __lookup_pg_pool(&map->pg_pools, pool);
826                 if (pi)
827                         __remove_pg_pool(&map->pg_pools, pi);
828         }
829
830         /* new_up */
831         err = -EINVAL;
832         ceph_decode_32_safe(p, end, len, bad);
833         while (len--) {
834                 u32 osd;
835                 struct ceph_entity_addr addr;
836                 ceph_decode_32_safe(p, end, osd, bad);
837                 ceph_decode_copy_safe(p, end, &addr, sizeof(addr), bad);
838                 ceph_decode_addr(&addr);
839                 pr_info("osd%d up\n", osd);
840                 BUG_ON(osd >= map->max_osd);
841                 map->osd_state[osd] |= CEPH_OSD_UP;
842                 map->osd_addr[osd] = addr;
843         }
844
845         /* new_state */
846         ceph_decode_32_safe(p, end, len, bad);
847         while (len--) {
848                 u32 osd;
849                 u8 xorstate;
850                 ceph_decode_32_safe(p, end, osd, bad);
851                 xorstate = **(u8 **)p;
852                 (*p)++;  /* clean flag */
853                 if (xorstate == 0)
854                         xorstate = CEPH_OSD_UP;
855                 if (xorstate & CEPH_OSD_UP)
856                         pr_info("osd%d down\n", osd);
857                 if (osd < map->max_osd)
858                         map->osd_state[osd] ^= xorstate;
859         }
860
861         /* new_weight */
862         ceph_decode_32_safe(p, end, len, bad);
863         while (len--) {
864                 u32 osd, off;
865                 ceph_decode_need(p, end, sizeof(u32)*2, bad);
866                 osd = ceph_decode_32(p);
867                 off = ceph_decode_32(p);
868                 pr_info("osd%d weight 0x%x %s\n", osd, off,
869                      off == CEPH_OSD_IN ? "(in)" :
870                      (off == CEPH_OSD_OUT ? "(out)" : ""));
871                 if (osd < map->max_osd)
872                         map->osd_weight[osd] = off;
873         }
874
875         /* new_pg_temp */
876         ceph_decode_32_safe(p, end, len, bad);
877         while (len--) {
878                 struct ceph_pg_mapping *pg;
879                 int j;
880                 struct ceph_pg pgid;
881                 u32 pglen;
882                 ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
883                 ceph_decode_copy(p, &pgid, sizeof(pgid));
884                 pglen = ceph_decode_32(p);
885
886                 if (pglen) {
887                         ceph_decode_need(p, end, pglen*sizeof(u32), bad);
888
889                         /* removing existing (if any) */
890                         (void) __remove_pg_mapping(&map->pg_temp, pgid);
891
892                         /* insert */
893                         pg = kmalloc(sizeof(*pg) + sizeof(u32)*pglen, GFP_NOFS);
894                         if (!pg) {
895                                 err = -ENOMEM;
896                                 goto bad;
897                         }
898                         pg->pgid = pgid;
899                         pg->len = pglen;
900                         for (j = 0; j < pglen; j++)
901                                 pg->osds[j] = ceph_decode_32(p);
902                         err = __insert_pg_mapping(pg, &map->pg_temp);
903                         if (err) {
904                                 kfree(pg);
905                                 goto bad;
906                         }
907                         dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
908                              pglen);
909                 } else {
910                         /* remove */
911                         __remove_pg_mapping(&map->pg_temp, pgid);
912                 }
913         }
914
915         /* ignore the rest */
916         *p = end;
917         return map;
918
919 bad:
920         pr_err("corrupt inc osdmap epoch %d off %d (%p of %p-%p)\n",
921                epoch, (int)(*p - start), *p, start, end);
922         print_hex_dump(KERN_DEBUG, "osdmap: ",
923                        DUMP_PREFIX_OFFSET, 16, 1,
924                        start, end - start, true);
925         if (newcrush)
926                 crush_destroy(newcrush);
927         return ERR_PTR(err);
928 }
929
930
931
932
933 /*
934  * calculate file layout from given offset, length.
935  * fill in correct oid, logical length, and object extent
936  * offset, length.
937  *
938  * for now, we write only a single su, until we can
939  * pass a stride back to the caller.
940  */
941 void ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
942                                    u64 off, u64 *plen,
943                                    u64 *ono,
944                                    u64 *oxoff, u64 *oxlen)
945 {
946         u32 osize = le32_to_cpu(layout->fl_object_size);
947         u32 su = le32_to_cpu(layout->fl_stripe_unit);
948         u32 sc = le32_to_cpu(layout->fl_stripe_count);
949         u32 bl, stripeno, stripepos, objsetno;
950         u32 su_per_object;
951         u64 t, su_offset;
952
953         dout("mapping %llu~%llu  osize %u fl_su %u\n", off, *plen,
954              osize, su);
955         su_per_object = osize / su;
956         dout("osize %u / su %u = su_per_object %u\n", osize, su,
957              su_per_object);
958
959         BUG_ON((su & ~PAGE_MASK) != 0);
960         /* bl = *off / su; */
961         t = off;
962         do_div(t, su);
963         bl = t;
964         dout("off %llu / su %u = bl %u\n", off, su, bl);
965
966         stripeno = bl / sc;
967         stripepos = bl % sc;
968         objsetno = stripeno / su_per_object;
969
970         *ono = objsetno * sc + stripepos;
971         dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned)*ono);
972
973         /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */
974         t = off;
975         su_offset = do_div(t, su);
976         *oxoff = su_offset + (stripeno % su_per_object) * su;
977
978         /*
979          * Calculate the length of the extent being written to the selected
980          * object. This is the minimum of the full length requested (plen) or
981          * the remainder of the current stripe being written to.
982          */
983         *oxlen = min_t(u64, *plen, su - su_offset);
984         *plen = *oxlen;
985
986         dout(" obj extent %llu~%llu\n", *oxoff, *oxlen);
987 }
988 EXPORT_SYMBOL(ceph_calc_file_object_mapping);
989
990 /*
991  * calculate an object layout (i.e. pgid) from an oid,
992  * file_layout, and osdmap
993  */
994 int ceph_calc_object_layout(struct ceph_object_layout *ol,
995                             const char *oid,
996                             struct ceph_file_layout *fl,
997                             struct ceph_osdmap *osdmap)
998 {
999         unsigned num, num_mask;
1000         struct ceph_pg pgid;
1001         int poolid = le32_to_cpu(fl->fl_pg_pool);
1002         struct ceph_pg_pool_info *pool;
1003         unsigned ps;
1004
1005         BUG_ON(!osdmap);
1006
1007         pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
1008         if (!pool)
1009                 return -EIO;
1010         ps = ceph_str_hash(pool->v.object_hash, oid, strlen(oid));
1011         num = le32_to_cpu(pool->v.pg_num);
1012         num_mask = pool->pg_num_mask;
1013
1014         pgid.ps = cpu_to_le16(ps);
1015         pgid.preferred = cpu_to_le16(-1);
1016         pgid.pool = fl->fl_pg_pool;
1017         dout("calc_object_layout '%s' pgid %d.%x\n", oid, poolid, ps);
1018
1019         ol->ol_pgid = pgid;
1020         ol->ol_stripe_unit = fl->fl_object_stripe_unit;
1021         return 0;
1022 }
1023 EXPORT_SYMBOL(ceph_calc_object_layout);
1024
1025 /*
1026  * Calculate raw osd vector for the given pgid.  Return pointer to osd
1027  * array, or NULL on failure.
1028  */
1029 static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
1030                         int *osds, int *num)
1031 {
1032         struct ceph_pg_mapping *pg;
1033         struct ceph_pg_pool_info *pool;
1034         int ruleno;
1035         unsigned poolid, ps, pps, t, r;
1036
1037         poolid = le32_to_cpu(pgid.pool);
1038         ps = le16_to_cpu(pgid.ps);
1039
1040         pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
1041         if (!pool)
1042                 return NULL;
1043
1044         /* pg_temp? */
1045         t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
1046                             pool->pgp_num_mask);
1047         pgid.ps = cpu_to_le16(t);
1048         pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
1049         if (pg) {
1050                 *num = pg->len;
1051                 return pg->osds;
1052         }
1053
1054         /* crush */
1055         ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
1056                                  pool->v.type, pool->v.size);
1057         if (ruleno < 0) {
1058                 pr_err("no crush rule pool %d ruleset %d type %d size %d\n",
1059                        poolid, pool->v.crush_ruleset, pool->v.type,
1060                        pool->v.size);
1061                 return NULL;
1062         }
1063
1064         pps = ceph_stable_mod(ps,
1065                               le32_to_cpu(pool->v.pgp_num),
1066                               pool->pgp_num_mask);
1067         pps += poolid;
1068         r = crush_do_rule(osdmap->crush, ruleno, pps, osds,
1069                           min_t(int, pool->v.size, *num),
1070                           osdmap->osd_weight);
1071         if (r < 0) {
1072                 pr_err("error %d from crush rule: pool %d ruleset %d type %d"
1073                        " size %d\n", r, poolid, pool->v.crush_ruleset,
1074                        pool->v.type, pool->v.size);
1075                 return NULL;
1076         }
1077         *num = r;
1078         return osds;
1079 }
1080
1081 /*
1082  * Return acting set for given pgid.
1083  */
1084 int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
1085                         int *acting)
1086 {
1087         int rawosds[CEPH_PG_MAX_SIZE], *osds;
1088         int i, o, num = CEPH_PG_MAX_SIZE;
1089
1090         osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
1091         if (!osds)
1092                 return -1;
1093
1094         /* primary is first up osd */
1095         o = 0;
1096         for (i = 0; i < num; i++)
1097                 if (ceph_osd_is_up(osdmap, osds[i]))
1098                         acting[o++] = osds[i];
1099         return o;
1100 }
1101
1102 /*
1103  * Return primary osd for given pgid, or -1 if none.
1104  */
1105 int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
1106 {
1107         int rawosds[CEPH_PG_MAX_SIZE], *osds;
1108         int i, num = CEPH_PG_MAX_SIZE;
1109
1110         osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
1111         if (!osds)
1112                 return -1;
1113
1114         /* primary is first up osd */
1115         for (i = 0; i < num; i++)
1116                 if (ceph_osd_is_up(osdmap, osds[i]))
1117                         return osds[i];
1118         return -1;
1119 }
1120 EXPORT_SYMBOL(ceph_calc_pg_primary);