// SPDX-License-Identifier: GPL-2.0-only

  /*
   * dcookies.c
   *
   * Copyright 2002 John Levon <levon@movementarian.org>
   *
   * Persistent cookie-path mappings. These are used by
   * profilers to convert a per-task EIP value into something
   * non-transitory that can be processed at a later date.
   * This is done by locking the dentry/vfsmnt pair in the
   * kernel until released by the tasks needing the persistent
   * objects. The tag is simply an unsigned long that refers
   * to the pair and can be looked up from userspace.
   */

  #include <linux/syscalls.h>

  #include <linux/export.h>

  #include <linux/slab.h>
  #include <linux/list.h>
  #include <linux/mount.h>

  #include <linux/capability.h>

  #include <linux/dcache.h>
  #include <linux/mm.h>

  #include <linux/err.h>

  #include <linux/errno.h>
  #include <linux/dcookies.h>

  #include <linux/mutex.h>

  #include <linux/path.h>

  #include <linux/compat.h>

  #include <linux/uaccess.h>

  
  /* The dcookies are allocated from a kmem_cache and
   * hashed onto a small number of lists. None of the
   * code here is particularly performance critical
   */
  struct dcookie_struct {

  	struct path path;

  	struct list_head hash_list;
  };
  
  static LIST_HEAD(dcookie_users);

  static DEFINE_MUTEX(dcookie_mutex);

  static struct kmem_cache *dcookie_cache __read_mostly;

  static struct list_head *dcookie_hashtable __read_mostly;
  static size_t hash_size __read_mostly;

  
  static inline int is_live(void)
  {
  	return !(list_empty(&dcookie_users));
  }
  
  
  /* The dentry is locked, its address will do for the cookie */
  static inline unsigned long dcookie_value(struct dcookie_struct * dcs)
  {

  	return (unsigned long)dcs->path.dentry;

  }
  
  
  static size_t dcookie_hash(unsigned long dcookie)
  {
  	return (dcookie >> L1_CACHE_SHIFT) & (hash_size - 1);
  }
  
  
  static struct dcookie_struct * find_dcookie(unsigned long dcookie)
  {
  	struct dcookie_struct *found = NULL;
  	struct dcookie_struct * dcs;
  	struct list_head * pos;
  	struct list_head * list;
  
  	list = dcookie_hashtable + dcookie_hash(dcookie);
  
  	list_for_each(pos, list) {
  		dcs = list_entry(pos, struct dcookie_struct, hash_list);
  		if (dcookie_value(dcs) == dcookie) {
  			found = dcs;
  			break;
  		}
  	}
  
  	return found;
  }
  
  
  static void hash_dcookie(struct dcookie_struct * dcs)
  {
  	struct list_head * list = dcookie_hashtable + dcookie_hash(dcookie_value(dcs));
  	list_add(&dcs->hash_list, list);
  }

  static struct dcookie_struct *alloc_dcookie(const struct path *path)

  {

  	struct dcookie_struct *dcs = kmem_cache_alloc(dcookie_cache,
  							GFP_KERNEL);

  	struct dentry *d;

  	if (!dcs)
  		return NULL;

  	d = path->dentry;
  	spin_lock(&d->d_lock);
  	d->d_flags |= DCACHE_COOKIE;
  	spin_unlock(&d->d_lock);

  	dcs->path = *path;
  	path_get(path);

  	hash_dcookie(dcs);

  	return dcs;
  }
  
  
  /* This is the main kernel-side routine that retrieves the cookie
   * value for a dentry/vfsmnt pair.
   */

  int get_dcookie(const struct path *path, unsigned long *cookie)

  {
  	int err = 0;
  	struct dcookie_struct * dcs;

  	mutex_lock(&dcookie_mutex);

  
  	if (!is_live()) {
  		err = -EINVAL;
  		goto out;
  	}

  	if (path->dentry->d_flags & DCACHE_COOKIE) {
  		dcs = find_dcookie((unsigned long)path->dentry);
  	} else {

  		dcs = alloc_dcookie(path);

  		if (!dcs) {
  			err = -ENOMEM;
  			goto out;
  		}

  	}
  
  	*cookie = dcookie_value(dcs);
  
  out:

  	mutex_unlock(&dcookie_mutex);

  	return err;
  }
  
  
  /* And here is where the userspace process can look up the cookie value
   * to retrieve the path.
   */

  static int do_lookup_dcookie(u64 cookie64, char __user *buf, size_t len)

  {
  	unsigned long cookie = (unsigned long)cookie64;
  	int err = -EINVAL;
  	char * kbuf;
  	char * path;
  	size_t pathlen;
  	struct dcookie_struct * dcs;
  
  	/* we could leak path information to users
  	 * without dir read permission without this
  	 */
  	if (!capable(CAP_SYS_ADMIN))
  		return -EPERM;

  	mutex_lock(&dcookie_mutex);

  
  	if (!is_live()) {
  		err = -EINVAL;
  		goto out;
  	}
  
  	if (!(dcs = find_dcookie(cookie)))
  		goto out;
  
  	err = -ENOMEM;
  	kbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
  	if (!kbuf)
  		goto out;
  
  	/* FIXME: (deleted) ? */

  	path = d_path(&dcs->path, kbuf, PAGE_SIZE);

  	mutex_unlock(&dcookie_mutex);

  	if (IS_ERR(path)) {
  		err = PTR_ERR(path);
  		goto out_free;
  	}
  
  	err = -ERANGE;
   
  	pathlen = kbuf + PAGE_SIZE - path;
  	if (pathlen <= len) {
  		err = pathlen;
  		if (copy_to_user(buf, path, pathlen))
  			err = -EFAULT;
  	}
  
  out_free:
  	kfree(kbuf);

  	return err;

  out:

  	mutex_unlock(&dcookie_mutex);

  	return err;
  }

  SYSCALL_DEFINE3(lookup_dcookie, u64, cookie64, char __user *, buf, size_t, len)
  {
  	return do_lookup_dcookie(cookie64, buf, len);
  }

  #ifdef CONFIG_COMPAT

  COMPAT_SYSCALL_DEFINE4(lookup_dcookie, u32, w0, u32, w1, char __user *, buf, compat_size_t, len)

  {
  #ifdef __BIG_ENDIAN

  	return do_lookup_dcookie(((u64)w0 << 32) | w1, buf, len);

  #else

  	return do_lookup_dcookie(((u64)w1 << 32) | w0, buf, len);

  #endif
  }
  #endif

  static int dcookie_init(void)
  {
  	struct list_head * d;
  	unsigned int i, hash_bits;
  	int err = -ENOMEM;
  
  	dcookie_cache = kmem_cache_create("dcookie_cache",
  		sizeof(struct dcookie_struct),

  		0, 0, NULL);

  
  	if (!dcookie_cache)
  		goto out;
  
  	dcookie_hashtable = kmalloc(PAGE_SIZE, GFP_KERNEL);
  	if (!dcookie_hashtable)
  		goto out_kmem;
  
  	err = 0;
  
  	/*
  	 * Find the power-of-two list-heads that can fit into the allocation..
  	 * We don't guarantee that "sizeof(struct list_head)" is necessarily
  	 * a power-of-two.
  	 */
  	hash_size = PAGE_SIZE / sizeof(struct list_head);
  	hash_bits = 0;
  	do {
  		hash_bits++;
  	} while ((hash_size >> hash_bits) != 0);
  	hash_bits--;
  
  	/*
  	 * Re-calculate the actual number of entries and the mask
  	 * from the number of bits we can fit.
  	 */
  	hash_size = 1UL << hash_bits;
  
  	/* And initialize the newly allocated array */
  	d = dcookie_hashtable;
  	i = hash_size;
  	do {
  		INIT_LIST_HEAD(d);
  		d++;
  		i--;
  	} while (i);
  
  out:
  	return err;
  out_kmem:
  	kmem_cache_destroy(dcookie_cache);
  	goto out;
  }
  
  
  static void free_dcookie(struct dcookie_struct * dcs)
  {

  	struct dentry *d = dcs->path.dentry;
  
  	spin_lock(&d->d_lock);
  	d->d_flags &= ~DCACHE_COOKIE;
  	spin_unlock(&d->d_lock);

  	path_put(&dcs->path);

  	kmem_cache_free(dcookie_cache, dcs);
  }
  
  
  static void dcookie_exit(void)
  {
  	struct list_head * list;
  	struct list_head * pos;
  	struct list_head * pos2;
  	struct dcookie_struct * dcs;
  	size_t i;
  
  	for (i = 0; i < hash_size; ++i) {
  		list = dcookie_hashtable + i;
  		list_for_each_safe(pos, pos2, list) {
  			dcs = list_entry(pos, struct dcookie_struct, hash_list);
  			list_del(&dcs->hash_list);
  			free_dcookie(dcs);
  		}
  	}
  
  	kfree(dcookie_hashtable);
  	kmem_cache_destroy(dcookie_cache);
  }
  
  
  struct dcookie_user {
  	struct list_head next;
  };
   
  struct dcookie_user * dcookie_register(void)
  {
  	struct dcookie_user * user;

  	mutex_lock(&dcookie_mutex);

  
  	user = kmalloc(sizeof(struct dcookie_user), GFP_KERNEL);
  	if (!user)
  		goto out;
  
  	if (!is_live() && dcookie_init())
  		goto out_free;
  
  	list_add(&user->next, &dcookie_users);
  
  out:

  	mutex_unlock(&dcookie_mutex);

  	return user;
  out_free:
  	kfree(user);
  	user = NULL;
  	goto out;
  }
  
  
  void dcookie_unregister(struct dcookie_user * user)
  {

  	mutex_lock(&dcookie_mutex);

  
  	list_del(&user->next);
  	kfree(user);
  
  	if (!is_live())
  		dcookie_exit();

  	mutex_unlock(&dcookie_mutex);

  }
  
  EXPORT_SYMBOL_GPL(dcookie_register);
  EXPORT_SYMBOL_GPL(dcookie_unregister);
  EXPORT_SYMBOL_GPL(get_dcookie);