1 /* $FreeBSD$ */ 2 /*- 3 * Copyright (c) 2010-2020 Hans Petter Selasky. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/stdint.h> 28 #include <sys/stddef.h> 29 #include <sys/param.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/conf.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/linker_set.h> 36 #include <sys/module.h> 37 #include <sys/lock.h> 38 #include <sys/mutex.h> 39 #include <sys/condvar.h> 40 #include <sys/sysctl.h> 41 #include <sys/unistd.h> 42 #include <sys/malloc.h> 43 #include <sys/priv.h> 44 #include <sys/uio.h> 45 #include <sys/poll.h> 46 #include <sys/sx.h> 47 #include <sys/rwlock.h> 48 #include <sys/queue.h> 49 #include <sys/fcntl.h> 50 #include <sys/proc.h> 51 #include <sys/vnode.h> 52 #include <sys/selinfo.h> 53 #include <sys/ptrace.h> 54 #include <sys/sysent.h> 55 56 #include <machine/bus.h> 57 58 #include <vm/vm.h> 59 #include <vm/pmap.h> 60 #include <vm/vm_object.h> 61 #include <vm/vm_page.h> 62 #include <vm/vm_pager.h> 63 64 #include <fs/cuse/cuse_defs.h> 65 #include <fs/cuse/cuse_ioctl.h> 66 67 MODULE_VERSION(cuse, 1); 68 69 /* 70 * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by 71 * declaring support for the cuse4bsd interface in cuse.ko: 72 */ 73 MODULE_VERSION(cuse4bsd, 1); 74 75 #ifdef FEATURE 76 FEATURE(cuse, "Userspace character devices"); 77 #endif 78 79 struct cuse_command; 80 struct cuse_server; 81 struct cuse_client; 82 83 struct cuse_client_command { 84 TAILQ_ENTRY(cuse_client_command) entry; 85 struct cuse_command sub; 86 struct sx sx; 87 struct cv cv; 88 struct thread *entered; 89 struct cuse_client *client; 90 struct proc *proc_curr; 91 int proc_refs; 92 int got_signal; 93 int error; 94 int command; 95 }; 96 97 struct cuse_memory { 98 TAILQ_ENTRY(cuse_memory) entry; 99 vm_object_t object; 100 uint32_t page_count; 101 uint32_t alloc_nr; 102 }; 103 104 struct cuse_server_dev { 105 TAILQ_ENTRY(cuse_server_dev) entry; 106 struct cuse_server *server; 107 struct cdev *kern_dev; 108 struct cuse_dev *user_dev; 109 }; 110 111 struct cuse_server { 112 TAILQ_ENTRY(cuse_server) entry; 113 TAILQ_HEAD(, cuse_client_command) head; 114 TAILQ_HEAD(, cuse_server_dev) hdev; 115 TAILQ_HEAD(, cuse_client) hcli; 116 TAILQ_HEAD(, cuse_memory) hmem; 117 struct mtx mtx; 118 struct cv cv; 119 struct selinfo selinfo; 120 pid_t pid; 121 int is_closing; 122 int refs; 123 }; 124 125 struct cuse_client { 126 TAILQ_ENTRY(cuse_client) entry; 127 TAILQ_ENTRY(cuse_client) entry_ref; 128 struct cuse_client_command cmds[CUSE_CMD_MAX]; 129 struct cuse_server *server; 130 struct cuse_server_dev *server_dev; 131 132 uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4); 133 134 int fflags; /* file flags */ 135 int cflags; /* client flags */ 136 #define CUSE_CLI_IS_CLOSING 0x01 137 #define CUSE_CLI_KNOTE_NEED_READ 0x02 138 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04 139 #define CUSE_CLI_KNOTE_HAS_READ 0x08 140 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10 141 }; 142 143 #define CUSE_CLIENT_CLOSING(pcc) \ 144 ((pcc)->cflags & CUSE_CLI_IS_CLOSING) 145 146 static MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory"); 147 148 static TAILQ_HEAD(, cuse_server) cuse_server_head; 149 static struct mtx cuse_global_mtx; 150 static struct cdev *cuse_dev; 151 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX]; 152 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX]; 153 154 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs); 155 static void cuse_client_kqfilter_read_detach(struct knote *kn); 156 static void cuse_client_kqfilter_write_detach(struct knote *kn); 157 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint); 158 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint); 159 160 static struct filterops cuse_client_kqfilter_read_ops = { 161 .f_isfd = 1, 162 .f_detach = cuse_client_kqfilter_read_detach, 163 .f_event = cuse_client_kqfilter_read_event, 164 }; 165 166 static struct filterops cuse_client_kqfilter_write_ops = { 167 .f_isfd = 1, 168 .f_detach = cuse_client_kqfilter_write_detach, 169 .f_event = cuse_client_kqfilter_write_event, 170 }; 171 172 static d_open_t cuse_client_open; 173 static d_close_t cuse_client_close; 174 static d_ioctl_t cuse_client_ioctl; 175 static d_read_t cuse_client_read; 176 static d_write_t cuse_client_write; 177 static d_poll_t cuse_client_poll; 178 static d_mmap_single_t cuse_client_mmap_single; 179 static d_kqfilter_t cuse_client_kqfilter; 180 181 static struct cdevsw cuse_client_devsw = { 182 .d_version = D_VERSION, 183 .d_open = cuse_client_open, 184 .d_close = cuse_client_close, 185 .d_ioctl = cuse_client_ioctl, 186 .d_name = "cuse_client", 187 .d_flags = D_TRACKCLOSE, 188 .d_read = cuse_client_read, 189 .d_write = cuse_client_write, 190 .d_poll = cuse_client_poll, 191 .d_mmap_single = cuse_client_mmap_single, 192 .d_kqfilter = cuse_client_kqfilter, 193 }; 194 195 static d_open_t cuse_server_open; 196 static d_close_t cuse_server_close; 197 static d_ioctl_t cuse_server_ioctl; 198 static d_read_t cuse_server_read; 199 static d_write_t cuse_server_write; 200 static d_poll_t cuse_server_poll; 201 static d_mmap_single_t cuse_server_mmap_single; 202 203 static struct cdevsw cuse_server_devsw = { 204 .d_version = D_VERSION, 205 .d_open = cuse_server_open, 206 .d_close = cuse_server_close, 207 .d_ioctl = cuse_server_ioctl, 208 .d_name = "cuse_server", 209 .d_flags = D_TRACKCLOSE, 210 .d_read = cuse_server_read, 211 .d_write = cuse_server_write, 212 .d_poll = cuse_server_poll, 213 .d_mmap_single = cuse_server_mmap_single, 214 }; 215 216 static void cuse_client_is_closing(struct cuse_client *); 217 static int cuse_free_unit_by_id_locked(struct cuse_server *, int); 218 219 static void 220 cuse_global_lock(void) 221 { 222 mtx_lock(&cuse_global_mtx); 223 } 224 225 static void 226 cuse_global_unlock(void) 227 { 228 mtx_unlock(&cuse_global_mtx); 229 } 230 231 static void 232 cuse_server_lock(struct cuse_server *pcs) 233 { 234 mtx_lock(&pcs->mtx); 235 } 236 237 static void 238 cuse_server_unlock(struct cuse_server *pcs) 239 { 240 mtx_unlock(&pcs->mtx); 241 } 242 243 static void 244 cuse_cmd_lock(struct cuse_client_command *pccmd) 245 { 246 sx_xlock(&pccmd->sx); 247 } 248 249 static void 250 cuse_cmd_unlock(struct cuse_client_command *pccmd) 251 { 252 sx_xunlock(&pccmd->sx); 253 } 254 255 static void 256 cuse_kern_init(void *arg) 257 { 258 TAILQ_INIT(&cuse_server_head); 259 260 mtx_init(&cuse_global_mtx, "cuse-global-mtx", NULL, MTX_DEF); 261 262 cuse_dev = make_dev(&cuse_server_devsw, 0, 263 UID_ROOT, GID_OPERATOR, 0600, "cuse"); 264 265 printf("Cuse v%d.%d.%d @ /dev/cuse\n", 266 (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF, 267 (CUSE_VERSION >> 0) & 0xFF); 268 } 269 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL); 270 271 static void 272 cuse_kern_uninit(void *arg) 273 { 274 void *ptr; 275 276 while (1) { 277 278 printf("Cuse: Please exit all /dev/cuse instances " 279 "and processes which have used this device.\n"); 280 281 pause("DRAIN", 2 * hz); 282 283 cuse_global_lock(); 284 ptr = TAILQ_FIRST(&cuse_server_head); 285 cuse_global_unlock(); 286 287 if (ptr == NULL) 288 break; 289 } 290 291 if (cuse_dev != NULL) 292 destroy_dev(cuse_dev); 293 294 mtx_destroy(&cuse_global_mtx); 295 } 296 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0); 297 298 static int 299 cuse_server_get(struct cuse_server **ppcs) 300 { 301 struct cuse_server *pcs; 302 int error; 303 304 error = devfs_get_cdevpriv((void **)&pcs); 305 if (error != 0) { 306 *ppcs = NULL; 307 return (error); 308 } 309 if (pcs->is_closing) { 310 *ppcs = NULL; 311 return (EINVAL); 312 } 313 *ppcs = pcs; 314 return (0); 315 } 316 317 static void 318 cuse_server_is_closing(struct cuse_server *pcs) 319 { 320 struct cuse_client *pcc; 321 322 if (pcs->is_closing) 323 return; 324 325 pcs->is_closing = 1; 326 327 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 328 cuse_client_is_closing(pcc); 329 } 330 } 331 332 static struct cuse_client_command * 333 cuse_server_find_command(struct cuse_server *pcs, struct thread *td) 334 { 335 struct cuse_client *pcc; 336 int n; 337 338 if (pcs->is_closing) 339 goto done; 340 341 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 342 if (CUSE_CLIENT_CLOSING(pcc)) 343 continue; 344 for (n = 0; n != CUSE_CMD_MAX; n++) { 345 if (pcc->cmds[n].entered == td) 346 return (&pcc->cmds[n]); 347 } 348 } 349 done: 350 return (NULL); 351 } 352 353 static void 354 cuse_str_filter(char *ptr) 355 { 356 int c; 357 358 while (((c = *ptr) != 0)) { 359 360 if ((c >= 'a') && (c <= 'z')) { 361 ptr++; 362 continue; 363 } 364 if ((c >= 'A') && (c <= 'Z')) { 365 ptr++; 366 continue; 367 } 368 if ((c >= '0') && (c <= '9')) { 369 ptr++; 370 continue; 371 } 372 if ((c == '.') || (c == '_') || (c == '/')) { 373 ptr++; 374 continue; 375 } 376 *ptr = '_'; 377 378 ptr++; 379 } 380 } 381 382 static int 383 cuse_convert_error(int error) 384 { 385 ; /* indent fix */ 386 switch (error) { 387 case CUSE_ERR_NONE: 388 return (0); 389 case CUSE_ERR_BUSY: 390 return (EBUSY); 391 case CUSE_ERR_WOULDBLOCK: 392 return (EWOULDBLOCK); 393 case CUSE_ERR_INVALID: 394 return (EINVAL); 395 case CUSE_ERR_NO_MEMORY: 396 return (ENOMEM); 397 case CUSE_ERR_FAULT: 398 return (EFAULT); 399 case CUSE_ERR_SIGNAL: 400 return (EINTR); 401 case CUSE_ERR_NO_DEVICE: 402 return (ENODEV); 403 default: 404 return (ENXIO); 405 } 406 } 407 408 static void 409 cuse_vm_memory_free(struct cuse_memory *mem) 410 { 411 /* last user is gone - free */ 412 vm_object_deallocate(mem->object); 413 414 /* free CUSE memory */ 415 free(mem, M_CUSE); 416 } 417 418 static int 419 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr, 420 uint32_t page_count) 421 { 422 struct cuse_memory *temp; 423 struct cuse_memory *mem; 424 vm_object_t object; 425 int error; 426 427 mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO); 428 if (mem == NULL) 429 return (ENOMEM); 430 431 object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count, 432 VM_PROT_DEFAULT, 0, curthread->td_ucred); 433 if (object == NULL) { 434 error = ENOMEM; 435 goto error_0; 436 } 437 438 cuse_server_lock(pcs); 439 /* check if allocation number already exists */ 440 TAILQ_FOREACH(temp, &pcs->hmem, entry) { 441 if (temp->alloc_nr == alloc_nr) 442 break; 443 } 444 if (temp != NULL) { 445 cuse_server_unlock(pcs); 446 error = EBUSY; 447 goto error_1; 448 } 449 mem->object = object; 450 mem->page_count = page_count; 451 mem->alloc_nr = alloc_nr; 452 TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry); 453 cuse_server_unlock(pcs); 454 455 return (0); 456 457 error_1: 458 vm_object_deallocate(object); 459 error_0: 460 free(mem, M_CUSE); 461 return (error); 462 } 463 464 static int 465 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr) 466 { 467 struct cuse_memory *mem; 468 469 cuse_server_lock(pcs); 470 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 471 if (mem->alloc_nr == alloc_nr) 472 break; 473 } 474 if (mem == NULL) { 475 cuse_server_unlock(pcs); 476 return (EINVAL); 477 } 478 TAILQ_REMOVE(&pcs->hmem, mem, entry); 479 cuse_server_unlock(pcs); 480 481 cuse_vm_memory_free(mem); 482 483 return (0); 484 } 485 486 static int 487 cuse_client_get(struct cuse_client **ppcc) 488 { 489 struct cuse_client *pcc; 490 int error; 491 492 /* try to get private data */ 493 error = devfs_get_cdevpriv((void **)&pcc); 494 if (error != 0) { 495 *ppcc = NULL; 496 return (error); 497 } 498 if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) { 499 *ppcc = NULL; 500 return (EINVAL); 501 } 502 *ppcc = pcc; 503 return (0); 504 } 505 506 static void 507 cuse_client_is_closing(struct cuse_client *pcc) 508 { 509 struct cuse_client_command *pccmd; 510 uint32_t n; 511 512 if (CUSE_CLIENT_CLOSING(pcc)) 513 return; 514 515 pcc->cflags |= CUSE_CLI_IS_CLOSING; 516 pcc->server_dev = NULL; 517 518 for (n = 0; n != CUSE_CMD_MAX; n++) { 519 520 pccmd = &pcc->cmds[n]; 521 522 if (pccmd->entry.tqe_prev != NULL) { 523 TAILQ_REMOVE(&pcc->server->head, pccmd, entry); 524 pccmd->entry.tqe_prev = NULL; 525 } 526 cv_broadcast(&pccmd->cv); 527 } 528 } 529 530 static void 531 cuse_client_send_command_locked(struct cuse_client_command *pccmd, 532 uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag) 533 { 534 unsigned long cuse_fflags = 0; 535 struct cuse_server *pcs; 536 537 if (fflags & FREAD) 538 cuse_fflags |= CUSE_FFLAG_READ; 539 540 if (fflags & FWRITE) 541 cuse_fflags |= CUSE_FFLAG_WRITE; 542 543 if (ioflag & IO_NDELAY) 544 cuse_fflags |= CUSE_FFLAG_NONBLOCK; 545 #if defined(__LP64__) 546 if (SV_CURPROC_FLAG(SV_ILP32)) 547 cuse_fflags |= CUSE_FFLAG_COMPAT32; 548 #endif 549 pccmd->sub.fflags = cuse_fflags; 550 pccmd->sub.data_pointer = data_ptr; 551 pccmd->sub.argument = arg; 552 553 pcs = pccmd->client->server; 554 555 if ((pccmd->entry.tqe_prev == NULL) && 556 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 557 (pcs->is_closing == 0)) { 558 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 559 cv_signal(&pcs->cv); 560 } 561 } 562 563 static void 564 cuse_client_got_signal(struct cuse_client_command *pccmd) 565 { 566 struct cuse_server *pcs; 567 568 pccmd->got_signal = 1; 569 570 pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL]; 571 572 pcs = pccmd->client->server; 573 574 if ((pccmd->entry.tqe_prev == NULL) && 575 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 576 (pcs->is_closing == 0)) { 577 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 578 cv_signal(&pcs->cv); 579 } 580 } 581 582 static int 583 cuse_client_receive_command_locked(struct cuse_client_command *pccmd, 584 uint8_t *arg_ptr, uint32_t arg_len) 585 { 586 struct cuse_server *pcs; 587 int error; 588 589 pcs = pccmd->client->server; 590 error = 0; 591 592 pccmd->proc_curr = curthread->td_proc; 593 594 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) { 595 error = CUSE_ERR_OTHER; 596 goto done; 597 } 598 while (pccmd->command == CUSE_CMD_NONE) { 599 if (error != 0) { 600 cv_wait(&pccmd->cv, &pcs->mtx); 601 } else { 602 error = cv_wait_sig(&pccmd->cv, &pcs->mtx); 603 604 if (error != 0) 605 cuse_client_got_signal(pccmd); 606 } 607 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) { 608 error = CUSE_ERR_OTHER; 609 goto done; 610 } 611 } 612 613 error = pccmd->error; 614 pccmd->command = CUSE_CMD_NONE; 615 cv_signal(&pccmd->cv); 616 617 done: 618 619 /* wait until all process references are gone */ 620 621 pccmd->proc_curr = NULL; 622 623 while (pccmd->proc_refs != 0) 624 cv_wait(&pccmd->cv, &pcs->mtx); 625 626 return (error); 627 } 628 629 /*------------------------------------------------------------------------* 630 * CUSE SERVER PART 631 *------------------------------------------------------------------------*/ 632 633 static void 634 cuse_server_free_dev(struct cuse_server_dev *pcsd) 635 { 636 struct cuse_server *pcs; 637 struct cuse_client *pcc; 638 639 /* get server pointer */ 640 pcs = pcsd->server; 641 642 /* prevent creation of more devices */ 643 cuse_server_lock(pcs); 644 if (pcsd->kern_dev != NULL) 645 pcsd->kern_dev->si_drv1 = NULL; 646 647 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 648 if (pcc->server_dev == pcsd) 649 cuse_client_is_closing(pcc); 650 } 651 cuse_server_unlock(pcs); 652 653 /* destroy device, if any */ 654 if (pcsd->kern_dev != NULL) { 655 /* destroy device synchronously */ 656 destroy_dev(pcsd->kern_dev); 657 } 658 free(pcsd, M_CUSE); 659 } 660 661 static void 662 cuse_server_unref(struct cuse_server *pcs) 663 { 664 struct cuse_server_dev *pcsd; 665 struct cuse_memory *mem; 666 667 cuse_server_lock(pcs); 668 if (--(pcs->refs) != 0) { 669 cuse_server_unlock(pcs); 670 return; 671 } 672 cuse_server_is_closing(pcs); 673 /* final client wakeup, if any */ 674 cuse_server_wakeup_all_client_locked(pcs); 675 676 cuse_global_lock(); 677 TAILQ_REMOVE(&cuse_server_head, pcs, entry); 678 cuse_global_unlock(); 679 680 while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) { 681 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 682 cuse_server_unlock(pcs); 683 cuse_server_free_dev(pcsd); 684 cuse_server_lock(pcs); 685 } 686 687 cuse_free_unit_by_id_locked(pcs, -1); 688 689 while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) { 690 TAILQ_REMOVE(&pcs->hmem, mem, entry); 691 cuse_server_unlock(pcs); 692 cuse_vm_memory_free(mem); 693 cuse_server_lock(pcs); 694 } 695 696 knlist_clear(&pcs->selinfo.si_note, 1); 697 knlist_destroy(&pcs->selinfo.si_note); 698 699 cuse_server_unlock(pcs); 700 701 seldrain(&pcs->selinfo); 702 703 cv_destroy(&pcs->cv); 704 705 mtx_destroy(&pcs->mtx); 706 707 free(pcs, M_CUSE); 708 } 709 710 static int 711 cuse_server_do_close(struct cuse_server *pcs) 712 { 713 int retval; 714 715 cuse_server_lock(pcs); 716 cuse_server_is_closing(pcs); 717 /* final client wakeup, if any */ 718 cuse_server_wakeup_all_client_locked(pcs); 719 720 knlist_clear(&pcs->selinfo.si_note, 1); 721 722 retval = pcs->refs; 723 cuse_server_unlock(pcs); 724 725 return (retval); 726 } 727 728 static void 729 cuse_server_free(void *arg) 730 { 731 struct cuse_server *pcs = arg; 732 733 /* 734 * The final server unref should be done by the server thread 735 * to prevent deadlock in the client cdevpriv destructor, 736 * which cannot destroy itself. 737 */ 738 while (cuse_server_do_close(pcs) != 1) 739 pause("W", hz); 740 741 /* drop final refcount */ 742 cuse_server_unref(pcs); 743 } 744 745 static int 746 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 747 { 748 struct cuse_server *pcs; 749 750 pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO); 751 if (pcs == NULL) 752 return (ENOMEM); 753 754 if (devfs_set_cdevpriv(pcs, &cuse_server_free)) { 755 printf("Cuse: Cannot set cdevpriv.\n"); 756 free(pcs, M_CUSE); 757 return (ENOMEM); 758 } 759 /* store current process ID */ 760 pcs->pid = curproc->p_pid; 761 762 TAILQ_INIT(&pcs->head); 763 TAILQ_INIT(&pcs->hdev); 764 TAILQ_INIT(&pcs->hcli); 765 TAILQ_INIT(&pcs->hmem); 766 767 cv_init(&pcs->cv, "cuse-server-cv"); 768 769 mtx_init(&pcs->mtx, "cuse-server-mtx", NULL, MTX_DEF); 770 771 knlist_init_mtx(&pcs->selinfo.si_note, &pcs->mtx); 772 773 cuse_global_lock(); 774 pcs->refs++; 775 TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry); 776 cuse_global_unlock(); 777 778 return (0); 779 } 780 781 static int 782 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 783 { 784 struct cuse_server *pcs; 785 786 if (cuse_server_get(&pcs) == 0) 787 cuse_server_do_close(pcs); 788 789 return (0); 790 } 791 792 static int 793 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag) 794 { 795 return (ENXIO); 796 } 797 798 static int 799 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag) 800 { 801 return (ENXIO); 802 } 803 804 static int 805 cuse_server_ioctl_copy_locked(struct cuse_server *pcs, 806 struct cuse_client_command *pccmd, 807 struct cuse_data_chunk *pchk, int isread) 808 { 809 struct proc *p_proc; 810 uint32_t offset; 811 int error; 812 813 offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR; 814 815 if (pchk->length > CUSE_BUFFER_MAX) 816 return (EFAULT); 817 818 if (offset >= CUSE_BUFFER_MAX) 819 return (EFAULT); 820 821 if ((offset + pchk->length) > CUSE_BUFFER_MAX) 822 return (EFAULT); 823 824 p_proc = pccmd->proc_curr; 825 if (p_proc == NULL) 826 return (ENXIO); 827 828 if (pccmd->proc_refs < 0) 829 return (ENOMEM); 830 831 pccmd->proc_refs++; 832 833 cuse_server_unlock(pcs); 834 835 if (isread == 0) { 836 error = copyin( 837 (void *)pchk->local_ptr, 838 pccmd->client->ioctl_buffer + offset, 839 pchk->length); 840 } else { 841 error = copyout( 842 pccmd->client->ioctl_buffer + offset, 843 (void *)pchk->local_ptr, 844 pchk->length); 845 } 846 847 cuse_server_lock(pcs); 848 849 pccmd->proc_refs--; 850 851 if (pccmd->proc_curr == NULL) 852 cv_signal(&pccmd->cv); 853 854 return (error); 855 } 856 857 static int 858 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, 859 struct proc *proc_d, vm_offset_t data_d, size_t len) 860 { 861 struct thread *td; 862 struct proc *proc_cur; 863 int error; 864 865 td = curthread; 866 proc_cur = td->td_proc; 867 868 if (proc_cur == proc_d) { 869 struct iovec iov = { 870 .iov_base = (caddr_t)data_d, 871 .iov_len = len, 872 }; 873 struct uio uio = { 874 .uio_iov = &iov, 875 .uio_iovcnt = 1, 876 .uio_offset = (off_t)data_s, 877 .uio_resid = len, 878 .uio_segflg = UIO_USERSPACE, 879 .uio_rw = UIO_READ, 880 .uio_td = td, 881 }; 882 883 PHOLD(proc_s); 884 error = proc_rwmem(proc_s, &uio); 885 PRELE(proc_s); 886 887 } else if (proc_cur == proc_s) { 888 struct iovec iov = { 889 .iov_base = (caddr_t)data_s, 890 .iov_len = len, 891 }; 892 struct uio uio = { 893 .uio_iov = &iov, 894 .uio_iovcnt = 1, 895 .uio_offset = (off_t)data_d, 896 .uio_resid = len, 897 .uio_segflg = UIO_USERSPACE, 898 .uio_rw = UIO_WRITE, 899 .uio_td = td, 900 }; 901 902 PHOLD(proc_d); 903 error = proc_rwmem(proc_d, &uio); 904 PRELE(proc_d); 905 } else { 906 error = EINVAL; 907 } 908 return (error); 909 } 910 911 static int 912 cuse_server_data_copy_locked(struct cuse_server *pcs, 913 struct cuse_client_command *pccmd, 914 struct cuse_data_chunk *pchk, int isread) 915 { 916 struct proc *p_proc; 917 int error; 918 919 p_proc = pccmd->proc_curr; 920 if (p_proc == NULL) 921 return (ENXIO); 922 923 if (pccmd->proc_refs < 0) 924 return (ENOMEM); 925 926 pccmd->proc_refs++; 927 928 cuse_server_unlock(pcs); 929 930 if (isread == 0) { 931 error = cuse_proc2proc_copy( 932 curthread->td_proc, pchk->local_ptr, 933 p_proc, pchk->peer_ptr, 934 pchk->length); 935 } else { 936 error = cuse_proc2proc_copy( 937 p_proc, pchk->peer_ptr, 938 curthread->td_proc, pchk->local_ptr, 939 pchk->length); 940 } 941 942 cuse_server_lock(pcs); 943 944 pccmd->proc_refs--; 945 946 if (pccmd->proc_curr == NULL) 947 cv_signal(&pccmd->cv); 948 949 return (error); 950 } 951 952 static int 953 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id) 954 { 955 int n; 956 int x = 0; 957 int match; 958 959 do { 960 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) { 961 if (cuse_alloc_unit[n] != NULL) { 962 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK) 963 continue; 964 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) { 965 x++; 966 match = 1; 967 } 968 } 969 } 970 } while (match); 971 972 if (x < 256) { 973 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 974 if (cuse_alloc_unit[n] == NULL) { 975 cuse_alloc_unit[n] = pcs; 976 cuse_alloc_unit_id[n] = id | x; 977 return (x); 978 } 979 } 980 } 981 return (-1); 982 } 983 984 static void 985 cuse_server_wakeup_locked(struct cuse_server *pcs) 986 { 987 selwakeup(&pcs->selinfo); 988 KNOTE_LOCKED(&pcs->selinfo.si_note, 0); 989 } 990 991 static void 992 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs) 993 { 994 struct cuse_client *pcc; 995 996 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 997 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ | 998 CUSE_CLI_KNOTE_NEED_WRITE); 999 } 1000 cuse_server_wakeup_locked(pcs); 1001 } 1002 1003 static int 1004 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id) 1005 { 1006 int n; 1007 int found = 0; 1008 1009 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 1010 if (cuse_alloc_unit[n] == pcs) { 1011 if (cuse_alloc_unit_id[n] == id || id == -1) { 1012 cuse_alloc_unit[n] = NULL; 1013 cuse_alloc_unit_id[n] = 0; 1014 found = 1; 1015 } 1016 } 1017 } 1018 1019 return (found ? 0 : EINVAL); 1020 } 1021 1022 static int 1023 cuse_server_ioctl(struct cdev *dev, unsigned long cmd, 1024 caddr_t data, int fflag, struct thread *td) 1025 { 1026 struct cuse_server *pcs; 1027 int error; 1028 1029 error = cuse_server_get(&pcs); 1030 if (error != 0) 1031 return (error); 1032 1033 switch (cmd) { 1034 struct cuse_client_command *pccmd; 1035 struct cuse_client *pcc; 1036 struct cuse_command *pcmd; 1037 struct cuse_alloc_info *pai; 1038 struct cuse_create_dev *pcd; 1039 struct cuse_server_dev *pcsd; 1040 struct cuse_data_chunk *pchk; 1041 int n; 1042 1043 case CUSE_IOCTL_GET_COMMAND: 1044 pcmd = (void *)data; 1045 1046 cuse_server_lock(pcs); 1047 1048 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) { 1049 error = cv_wait_sig(&pcs->cv, &pcs->mtx); 1050 1051 if (pcs->is_closing) 1052 error = ENXIO; 1053 1054 if (error) { 1055 cuse_server_unlock(pcs); 1056 return (error); 1057 } 1058 } 1059 1060 TAILQ_REMOVE(&pcs->head, pccmd, entry); 1061 pccmd->entry.tqe_prev = NULL; 1062 1063 pccmd->entered = curthread; 1064 1065 *pcmd = pccmd->sub; 1066 1067 cuse_server_unlock(pcs); 1068 1069 break; 1070 1071 case CUSE_IOCTL_SYNC_COMMAND: 1072 1073 cuse_server_lock(pcs); 1074 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) { 1075 1076 /* send sync command */ 1077 pccmd->entered = NULL; 1078 pccmd->error = *(int *)data; 1079 pccmd->command = CUSE_CMD_SYNC; 1080 1081 /* signal peer, if any */ 1082 cv_signal(&pccmd->cv); 1083 } 1084 cuse_server_unlock(pcs); 1085 1086 break; 1087 1088 case CUSE_IOCTL_ALLOC_UNIT: 1089 1090 cuse_server_lock(pcs); 1091 n = cuse_alloc_unit_by_id_locked(pcs, 1092 CUSE_ID_DEFAULT(0)); 1093 cuse_server_unlock(pcs); 1094 1095 if (n < 0) 1096 error = ENOMEM; 1097 else 1098 *(int *)data = n; 1099 break; 1100 1101 case CUSE_IOCTL_ALLOC_UNIT_BY_ID: 1102 1103 n = *(int *)data; 1104 1105 n = (n & CUSE_ID_MASK); 1106 1107 cuse_server_lock(pcs); 1108 n = cuse_alloc_unit_by_id_locked(pcs, n); 1109 cuse_server_unlock(pcs); 1110 1111 if (n < 0) 1112 error = ENOMEM; 1113 else 1114 *(int *)data = n; 1115 break; 1116 1117 case CUSE_IOCTL_FREE_UNIT: 1118 1119 n = *(int *)data; 1120 1121 n = CUSE_ID_DEFAULT(n); 1122 1123 cuse_server_lock(pcs); 1124 error = cuse_free_unit_by_id_locked(pcs, n); 1125 cuse_server_unlock(pcs); 1126 break; 1127 1128 case CUSE_IOCTL_FREE_UNIT_BY_ID: 1129 1130 n = *(int *)data; 1131 1132 cuse_server_lock(pcs); 1133 error = cuse_free_unit_by_id_locked(pcs, n); 1134 cuse_server_unlock(pcs); 1135 break; 1136 1137 case CUSE_IOCTL_ALLOC_MEMORY: 1138 1139 pai = (void *)data; 1140 1141 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1142 error = ENOMEM; 1143 break; 1144 } 1145 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) { 1146 error = ENOMEM; 1147 break; 1148 } 1149 error = cuse_server_alloc_memory(pcs, 1150 pai->alloc_nr, pai->page_count); 1151 break; 1152 1153 case CUSE_IOCTL_FREE_MEMORY: 1154 pai = (void *)data; 1155 1156 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1157 error = ENOMEM; 1158 break; 1159 } 1160 error = cuse_server_free_memory(pcs, pai->alloc_nr); 1161 break; 1162 1163 case CUSE_IOCTL_GET_SIG: 1164 1165 cuse_server_lock(pcs); 1166 pccmd = cuse_server_find_command(pcs, curthread); 1167 1168 if (pccmd != NULL) { 1169 n = pccmd->got_signal; 1170 pccmd->got_signal = 0; 1171 } else { 1172 n = 0; 1173 } 1174 cuse_server_unlock(pcs); 1175 1176 *(int *)data = n; 1177 1178 break; 1179 1180 case CUSE_IOCTL_SET_PFH: 1181 1182 cuse_server_lock(pcs); 1183 pccmd = cuse_server_find_command(pcs, curthread); 1184 1185 if (pccmd != NULL) { 1186 pcc = pccmd->client; 1187 for (n = 0; n != CUSE_CMD_MAX; n++) { 1188 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data; 1189 } 1190 } else { 1191 error = ENXIO; 1192 } 1193 cuse_server_unlock(pcs); 1194 break; 1195 1196 case CUSE_IOCTL_CREATE_DEV: 1197 1198 error = priv_check(curthread, PRIV_DRIVER); 1199 if (error) 1200 break; 1201 1202 pcd = (void *)data; 1203 1204 /* filter input */ 1205 1206 pcd->devname[sizeof(pcd->devname) - 1] = 0; 1207 1208 if (pcd->devname[0] == 0) { 1209 error = EINVAL; 1210 break; 1211 } 1212 cuse_str_filter(pcd->devname); 1213 1214 pcd->permissions &= 0777; 1215 1216 /* try to allocate a character device */ 1217 1218 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO); 1219 1220 if (pcsd == NULL) { 1221 error = ENOMEM; 1222 break; 1223 } 1224 pcsd->server = pcs; 1225 1226 pcsd->user_dev = pcd->dev; 1227 1228 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME, 1229 &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id, 1230 pcd->permissions, "%s", pcd->devname); 1231 1232 if (pcsd->kern_dev == NULL) { 1233 free(pcsd, M_CUSE); 1234 error = ENOMEM; 1235 break; 1236 } 1237 pcsd->kern_dev->si_drv1 = pcsd; 1238 1239 cuse_server_lock(pcs); 1240 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry); 1241 cuse_server_unlock(pcs); 1242 1243 break; 1244 1245 case CUSE_IOCTL_DESTROY_DEV: 1246 1247 error = priv_check(curthread, PRIV_DRIVER); 1248 if (error) 1249 break; 1250 1251 cuse_server_lock(pcs); 1252 1253 error = EINVAL; 1254 1255 pcsd = TAILQ_FIRST(&pcs->hdev); 1256 while (pcsd != NULL) { 1257 if (pcsd->user_dev == *(struct cuse_dev **)data) { 1258 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 1259 cuse_server_unlock(pcs); 1260 cuse_server_free_dev(pcsd); 1261 cuse_server_lock(pcs); 1262 error = 0; 1263 pcsd = TAILQ_FIRST(&pcs->hdev); 1264 } else { 1265 pcsd = TAILQ_NEXT(pcsd, entry); 1266 } 1267 } 1268 1269 cuse_server_unlock(pcs); 1270 break; 1271 1272 case CUSE_IOCTL_WRITE_DATA: 1273 case CUSE_IOCTL_READ_DATA: 1274 1275 cuse_server_lock(pcs); 1276 pchk = (struct cuse_data_chunk *)data; 1277 1278 pccmd = cuse_server_find_command(pcs, curthread); 1279 1280 if (pccmd == NULL) { 1281 error = ENXIO; /* invalid request */ 1282 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) { 1283 error = EFAULT; /* NULL pointer */ 1284 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) { 1285 error = cuse_server_ioctl_copy_locked(pcs, pccmd, 1286 pchk, cmd == CUSE_IOCTL_READ_DATA); 1287 } else { 1288 error = cuse_server_data_copy_locked(pcs, pccmd, 1289 pchk, cmd == CUSE_IOCTL_READ_DATA); 1290 } 1291 cuse_server_unlock(pcs); 1292 break; 1293 1294 case CUSE_IOCTL_SELWAKEUP: 1295 cuse_server_lock(pcs); 1296 /* 1297 * We don't know which direction caused the event. 1298 * Wakeup both! 1299 */ 1300 cuse_server_wakeup_all_client_locked(pcs); 1301 cuse_server_unlock(pcs); 1302 break; 1303 1304 default: 1305 error = ENXIO; 1306 break; 1307 } 1308 return (error); 1309 } 1310 1311 static int 1312 cuse_server_poll(struct cdev *dev, int events, struct thread *td) 1313 { 1314 return (events & (POLLHUP | POLLPRI | POLLIN | 1315 POLLRDNORM | POLLOUT | POLLWRNORM)); 1316 } 1317 1318 static int 1319 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1320 vm_size_t size, struct vm_object **object, int nprot) 1321 { 1322 uint32_t page_nr = *offset / PAGE_SIZE; 1323 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1324 struct cuse_memory *mem; 1325 struct cuse_server *pcs; 1326 int error; 1327 1328 error = cuse_server_get(&pcs); 1329 if (error != 0) 1330 return (error); 1331 1332 cuse_server_lock(pcs); 1333 /* lookup memory structure */ 1334 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 1335 if (mem->alloc_nr == alloc_nr) 1336 break; 1337 } 1338 if (mem == NULL) { 1339 cuse_server_unlock(pcs); 1340 return (ENOMEM); 1341 } 1342 /* verify page offset */ 1343 page_nr %= CUSE_ALLOC_PAGES_MAX; 1344 if (page_nr >= mem->page_count) { 1345 cuse_server_unlock(pcs); 1346 return (ENXIO); 1347 } 1348 /* verify mmap size */ 1349 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1350 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1351 cuse_server_unlock(pcs); 1352 return (EINVAL); 1353 } 1354 vm_object_reference(mem->object); 1355 *object = mem->object; 1356 cuse_server_unlock(pcs); 1357 1358 /* set new VM object offset to use */ 1359 *offset = page_nr * PAGE_SIZE; 1360 1361 /* success */ 1362 return (0); 1363 } 1364 1365 /*------------------------------------------------------------------------* 1366 * CUSE CLIENT PART 1367 *------------------------------------------------------------------------*/ 1368 static void 1369 cuse_client_free(void *arg) 1370 { 1371 struct cuse_client *pcc = arg; 1372 struct cuse_client_command *pccmd; 1373 struct cuse_server *pcs; 1374 int n; 1375 1376 pcs = pcc->server; 1377 1378 cuse_server_lock(pcs); 1379 cuse_client_is_closing(pcc); 1380 TAILQ_REMOVE(&pcs->hcli, pcc, entry); 1381 cuse_server_unlock(pcs); 1382 1383 for (n = 0; n != CUSE_CMD_MAX; n++) { 1384 1385 pccmd = &pcc->cmds[n]; 1386 1387 sx_destroy(&pccmd->sx); 1388 cv_destroy(&pccmd->cv); 1389 } 1390 1391 free(pcc, M_CUSE); 1392 1393 /* drop reference on server */ 1394 cuse_server_unref(pcs); 1395 } 1396 1397 static int 1398 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 1399 { 1400 struct cuse_client_command *pccmd; 1401 struct cuse_server_dev *pcsd; 1402 struct cuse_client *pcc; 1403 struct cuse_server *pcs; 1404 struct cuse_dev *pcd; 1405 int error; 1406 int n; 1407 1408 pcsd = dev->si_drv1; 1409 if (pcsd != NULL) { 1410 pcs = pcsd->server; 1411 pcd = pcsd->user_dev; 1412 1413 cuse_server_lock(pcs); 1414 /* 1415 * Check that the refcount didn't wrap and that the 1416 * same process is not both client and server. This 1417 * can easily lead to deadlocks when destroying the 1418 * CUSE character device nodes: 1419 */ 1420 pcs->refs++; 1421 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) { 1422 /* overflow or wrong PID */ 1423 pcs->refs--; 1424 cuse_server_unlock(pcs); 1425 return (EINVAL); 1426 } 1427 cuse_server_unlock(pcs); 1428 } else { 1429 return (EINVAL); 1430 } 1431 1432 pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO); 1433 if (pcc == NULL) { 1434 /* drop reference on server */ 1435 cuse_server_unref(pcs); 1436 return (ENOMEM); 1437 } 1438 if (devfs_set_cdevpriv(pcc, &cuse_client_free)) { 1439 printf("Cuse: Cannot set cdevpriv.\n"); 1440 /* drop reference on server */ 1441 cuse_server_unref(pcs); 1442 free(pcc, M_CUSE); 1443 return (ENOMEM); 1444 } 1445 pcc->fflags = fflags; 1446 pcc->server_dev = pcsd; 1447 pcc->server = pcs; 1448 1449 for (n = 0; n != CUSE_CMD_MAX; n++) { 1450 1451 pccmd = &pcc->cmds[n]; 1452 1453 pccmd->sub.dev = pcd; 1454 pccmd->sub.command = n; 1455 pccmd->client = pcc; 1456 1457 sx_init(&pccmd->sx, "cuse-client-sx"); 1458 cv_init(&pccmd->cv, "cuse-client-cv"); 1459 } 1460 1461 cuse_server_lock(pcs); 1462 1463 /* cuse_client_free() assumes that the client is listed somewhere! */ 1464 /* always enqueue */ 1465 1466 TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry); 1467 1468 /* check if server is closing */ 1469 if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) { 1470 error = EINVAL; 1471 } else { 1472 error = 0; 1473 } 1474 cuse_server_unlock(pcs); 1475 1476 if (error) { 1477 devfs_clear_cdevpriv(); /* XXX bugfix */ 1478 return (error); 1479 } 1480 pccmd = &pcc->cmds[CUSE_CMD_OPEN]; 1481 1482 cuse_cmd_lock(pccmd); 1483 1484 cuse_server_lock(pcs); 1485 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1486 1487 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1488 cuse_server_unlock(pcs); 1489 1490 if (error < 0) { 1491 error = cuse_convert_error(error); 1492 } else { 1493 error = 0; 1494 } 1495 1496 cuse_cmd_unlock(pccmd); 1497 1498 if (error) 1499 devfs_clear_cdevpriv(); /* XXX bugfix */ 1500 1501 return (error); 1502 } 1503 1504 static int 1505 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 1506 { 1507 struct cuse_client_command *pccmd; 1508 struct cuse_client *pcc; 1509 struct cuse_server *pcs; 1510 int error; 1511 1512 error = cuse_client_get(&pcc); 1513 if (error != 0) 1514 return (0); 1515 1516 pccmd = &pcc->cmds[CUSE_CMD_CLOSE]; 1517 pcs = pcc->server; 1518 1519 cuse_cmd_lock(pccmd); 1520 1521 cuse_server_lock(pcs); 1522 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1523 1524 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1525 cuse_cmd_unlock(pccmd); 1526 1527 cuse_client_is_closing(pcc); 1528 cuse_server_unlock(pcs); 1529 1530 return (0); 1531 } 1532 1533 static void 1534 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc) 1535 { 1536 struct cuse_server *pcs = pcc->server; 1537 int temp; 1538 1539 cuse_server_lock(pcs); 1540 temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ | 1541 CUSE_CLI_KNOTE_HAS_WRITE)); 1542 pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ | 1543 CUSE_CLI_KNOTE_NEED_WRITE); 1544 cuse_server_unlock(pcs); 1545 1546 if (temp != 0) { 1547 /* get the latest polling state from the server */ 1548 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL); 1549 1550 if (temp & (POLLIN | POLLOUT)) { 1551 cuse_server_lock(pcs); 1552 if (temp & POLLIN) 1553 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ; 1554 if (temp & POLLOUT) 1555 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE; 1556 1557 /* make sure the "knote" gets woken up */ 1558 cuse_server_wakeup_locked(pcc->server); 1559 cuse_server_unlock(pcs); 1560 } 1561 } 1562 } 1563 1564 static int 1565 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) 1566 { 1567 struct cuse_client_command *pccmd; 1568 struct cuse_client *pcc; 1569 struct cuse_server *pcs; 1570 int error; 1571 int len; 1572 1573 error = cuse_client_get(&pcc); 1574 if (error != 0) 1575 return (error); 1576 1577 pccmd = &pcc->cmds[CUSE_CMD_READ]; 1578 pcs = pcc->server; 1579 1580 if (uio->uio_segflg != UIO_USERSPACE) { 1581 return (EINVAL); 1582 } 1583 uio->uio_segflg = UIO_NOCOPY; 1584 1585 cuse_cmd_lock(pccmd); 1586 1587 while (uio->uio_resid != 0) { 1588 1589 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1590 error = ENOMEM; 1591 break; 1592 } 1593 len = uio->uio_iov->iov_len; 1594 1595 cuse_server_lock(pcs); 1596 cuse_client_send_command_locked(pccmd, 1597 (uintptr_t)uio->uio_iov->iov_base, 1598 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1599 1600 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1601 cuse_server_unlock(pcs); 1602 1603 if (error < 0) { 1604 error = cuse_convert_error(error); 1605 break; 1606 } else if (error == len) { 1607 error = uiomove(NULL, error, uio); 1608 if (error) 1609 break; 1610 } else { 1611 error = uiomove(NULL, error, uio); 1612 break; 1613 } 1614 } 1615 cuse_cmd_unlock(pccmd); 1616 1617 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1618 1619 if (error == EWOULDBLOCK) 1620 cuse_client_kqfilter_poll(dev, pcc); 1621 1622 return (error); 1623 } 1624 1625 static int 1626 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) 1627 { 1628 struct cuse_client_command *pccmd; 1629 struct cuse_client *pcc; 1630 struct cuse_server *pcs; 1631 int error; 1632 int len; 1633 1634 error = cuse_client_get(&pcc); 1635 if (error != 0) 1636 return (error); 1637 1638 pccmd = &pcc->cmds[CUSE_CMD_WRITE]; 1639 pcs = pcc->server; 1640 1641 if (uio->uio_segflg != UIO_USERSPACE) { 1642 return (EINVAL); 1643 } 1644 uio->uio_segflg = UIO_NOCOPY; 1645 1646 cuse_cmd_lock(pccmd); 1647 1648 while (uio->uio_resid != 0) { 1649 1650 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1651 error = ENOMEM; 1652 break; 1653 } 1654 len = uio->uio_iov->iov_len; 1655 1656 cuse_server_lock(pcs); 1657 cuse_client_send_command_locked(pccmd, 1658 (uintptr_t)uio->uio_iov->iov_base, 1659 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1660 1661 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1662 cuse_server_unlock(pcs); 1663 1664 if (error < 0) { 1665 error = cuse_convert_error(error); 1666 break; 1667 } else if (error == len) { 1668 error = uiomove(NULL, error, uio); 1669 if (error) 1670 break; 1671 } else { 1672 error = uiomove(NULL, error, uio); 1673 break; 1674 } 1675 } 1676 cuse_cmd_unlock(pccmd); 1677 1678 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1679 1680 if (error == EWOULDBLOCK) 1681 cuse_client_kqfilter_poll(dev, pcc); 1682 1683 return (error); 1684 } 1685 1686 int 1687 cuse_client_ioctl(struct cdev *dev, unsigned long cmd, 1688 caddr_t data, int fflag, struct thread *td) 1689 { 1690 struct cuse_client_command *pccmd; 1691 struct cuse_client *pcc; 1692 struct cuse_server *pcs; 1693 int error; 1694 int len; 1695 1696 error = cuse_client_get(&pcc); 1697 if (error != 0) 1698 return (error); 1699 1700 len = IOCPARM_LEN(cmd); 1701 if (len > CUSE_BUFFER_MAX) 1702 return (ENOMEM); 1703 1704 pccmd = &pcc->cmds[CUSE_CMD_IOCTL]; 1705 pcs = pcc->server; 1706 1707 cuse_cmd_lock(pccmd); 1708 1709 if (cmd & (IOC_IN | IOC_VOID)) 1710 memcpy(pcc->ioctl_buffer, data, len); 1711 1712 /* 1713 * When the ioctl-length is zero drivers can pass information 1714 * through the data pointer of the ioctl. Make sure this information 1715 * is forwarded to the driver. 1716 */ 1717 1718 cuse_server_lock(pcs); 1719 cuse_client_send_command_locked(pccmd, 1720 (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR, 1721 (unsigned long)cmd, pcc->fflags, 1722 (fflag & O_NONBLOCK) ? IO_NDELAY : 0); 1723 1724 error = cuse_client_receive_command_locked(pccmd, data, len); 1725 cuse_server_unlock(pcs); 1726 1727 if (error < 0) { 1728 error = cuse_convert_error(error); 1729 } else { 1730 error = 0; 1731 } 1732 1733 if (cmd & IOC_OUT) 1734 memcpy(data, pcc->ioctl_buffer, len); 1735 1736 cuse_cmd_unlock(pccmd); 1737 1738 if (error == EWOULDBLOCK) 1739 cuse_client_kqfilter_poll(dev, pcc); 1740 1741 return (error); 1742 } 1743 1744 static int 1745 cuse_client_poll(struct cdev *dev, int events, struct thread *td) 1746 { 1747 struct cuse_client_command *pccmd; 1748 struct cuse_client *pcc; 1749 struct cuse_server *pcs; 1750 unsigned long temp; 1751 int error; 1752 int revents; 1753 1754 error = cuse_client_get(&pcc); 1755 if (error != 0) 1756 goto pollnval; 1757 1758 temp = 0; 1759 pcs = pcc->server; 1760 1761 if (events & (POLLPRI | POLLIN | POLLRDNORM)) 1762 temp |= CUSE_POLL_READ; 1763 1764 if (events & (POLLOUT | POLLWRNORM)) 1765 temp |= CUSE_POLL_WRITE; 1766 1767 if (events & POLLHUP) 1768 temp |= CUSE_POLL_ERROR; 1769 1770 pccmd = &pcc->cmds[CUSE_CMD_POLL]; 1771 1772 cuse_cmd_lock(pccmd); 1773 1774 /* Need to selrecord() first to not loose any events. */ 1775 if (temp != 0 && td != NULL) 1776 selrecord(td, &pcs->selinfo); 1777 1778 cuse_server_lock(pcs); 1779 cuse_client_send_command_locked(pccmd, 1780 0, temp, pcc->fflags, IO_NDELAY); 1781 1782 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1783 cuse_server_unlock(pcs); 1784 1785 cuse_cmd_unlock(pccmd); 1786 1787 if (error < 0) { 1788 goto pollnval; 1789 } else { 1790 revents = 0; 1791 if (error & CUSE_POLL_READ) 1792 revents |= (events & (POLLPRI | POLLIN | POLLRDNORM)); 1793 if (error & CUSE_POLL_WRITE) 1794 revents |= (events & (POLLOUT | POLLWRNORM)); 1795 if (error & CUSE_POLL_ERROR) 1796 revents |= (events & POLLHUP); 1797 } 1798 return (revents); 1799 1800 pollnval: 1801 /* XXX many clients don't understand POLLNVAL */ 1802 return (events & (POLLHUP | POLLPRI | POLLIN | 1803 POLLRDNORM | POLLOUT | POLLWRNORM)); 1804 } 1805 1806 static int 1807 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1808 vm_size_t size, struct vm_object **object, int nprot) 1809 { 1810 uint32_t page_nr = *offset / PAGE_SIZE; 1811 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1812 struct cuse_memory *mem; 1813 struct cuse_client *pcc; 1814 struct cuse_server *pcs; 1815 int error; 1816 1817 error = cuse_client_get(&pcc); 1818 if (error != 0) 1819 return (error); 1820 1821 pcs = pcc->server; 1822 1823 cuse_server_lock(pcs); 1824 /* lookup memory structure */ 1825 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 1826 if (mem->alloc_nr == alloc_nr) 1827 break; 1828 } 1829 if (mem == NULL) { 1830 cuse_server_unlock(pcs); 1831 return (ENOMEM); 1832 } 1833 /* verify page offset */ 1834 page_nr %= CUSE_ALLOC_PAGES_MAX; 1835 if (page_nr >= mem->page_count) { 1836 cuse_server_unlock(pcs); 1837 return (ENXIO); 1838 } 1839 /* verify mmap size */ 1840 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1841 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1842 cuse_server_unlock(pcs); 1843 return (EINVAL); 1844 } 1845 vm_object_reference(mem->object); 1846 *object = mem->object; 1847 cuse_server_unlock(pcs); 1848 1849 /* set new VM object offset to use */ 1850 *offset = page_nr * PAGE_SIZE; 1851 1852 /* success */ 1853 return (0); 1854 } 1855 1856 static void 1857 cuse_client_kqfilter_read_detach(struct knote *kn) 1858 { 1859 struct cuse_client *pcc; 1860 struct cuse_server *pcs; 1861 1862 pcc = kn->kn_hook; 1863 pcs = pcc->server; 1864 1865 cuse_server_lock(pcs); 1866 knlist_remove(&pcs->selinfo.si_note, kn, 1); 1867 cuse_server_unlock(pcs); 1868 } 1869 1870 static void 1871 cuse_client_kqfilter_write_detach(struct knote *kn) 1872 { 1873 struct cuse_client *pcc; 1874 struct cuse_server *pcs; 1875 1876 pcc = kn->kn_hook; 1877 pcs = pcc->server; 1878 1879 cuse_server_lock(pcs); 1880 knlist_remove(&pcs->selinfo.si_note, kn, 1); 1881 cuse_server_unlock(pcs); 1882 } 1883 1884 static int 1885 cuse_client_kqfilter_read_event(struct knote *kn, long hint) 1886 { 1887 struct cuse_client *pcc; 1888 1889 pcc = kn->kn_hook; 1890 1891 mtx_assert(&pcc->server->mtx, MA_OWNED); 1892 1893 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0); 1894 } 1895 1896 static int 1897 cuse_client_kqfilter_write_event(struct knote *kn, long hint) 1898 { 1899 struct cuse_client *pcc; 1900 1901 pcc = kn->kn_hook; 1902 1903 mtx_assert(&pcc->server->mtx, MA_OWNED); 1904 1905 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0); 1906 } 1907 1908 static int 1909 cuse_client_kqfilter(struct cdev *dev, struct knote *kn) 1910 { 1911 struct cuse_client *pcc; 1912 struct cuse_server *pcs; 1913 int error; 1914 1915 error = cuse_client_get(&pcc); 1916 if (error != 0) 1917 return (error); 1918 1919 pcs = pcc->server; 1920 1921 cuse_server_lock(pcs); 1922 switch (kn->kn_filter) { 1923 case EVFILT_READ: 1924 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ; 1925 kn->kn_hook = pcc; 1926 kn->kn_fop = &cuse_client_kqfilter_read_ops; 1927 knlist_add(&pcs->selinfo.si_note, kn, 1); 1928 break; 1929 case EVFILT_WRITE: 1930 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE; 1931 kn->kn_hook = pcc; 1932 kn->kn_fop = &cuse_client_kqfilter_write_ops; 1933 knlist_add(&pcs->selinfo.si_note, kn, 1); 1934 break; 1935 default: 1936 error = EINVAL; 1937 break; 1938 } 1939 cuse_server_unlock(pcs); 1940 1941 if (error == 0) 1942 cuse_client_kqfilter_poll(dev, pcc); 1943 return (error); 1944 } 1945