1 /* $FreeBSD$ */ 2 /*- 3 * Copyright (c) 2010-2020 Hans Petter Selasky. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/stdint.h> 28 #include <sys/stddef.h> 29 #include <sys/param.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/conf.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/linker_set.h> 36 #include <sys/module.h> 37 #include <sys/lock.h> 38 #include <sys/mutex.h> 39 #include <sys/condvar.h> 40 #include <sys/sysctl.h> 41 #include <sys/unistd.h> 42 #include <sys/malloc.h> 43 #include <sys/priv.h> 44 #include <sys/uio.h> 45 #include <sys/poll.h> 46 #include <sys/sx.h> 47 #include <sys/rwlock.h> 48 #include <sys/queue.h> 49 #include <sys/fcntl.h> 50 #include <sys/proc.h> 51 #include <sys/vnode.h> 52 #include <sys/selinfo.h> 53 #include <sys/ptrace.h> 54 #include <sys/sysent.h> 55 56 #include <machine/bus.h> 57 58 #include <vm/vm.h> 59 #include <vm/pmap.h> 60 #include <vm/vm_object.h> 61 #include <vm/vm_page.h> 62 #include <vm/vm_pager.h> 63 64 #include <fs/cuse/cuse_defs.h> 65 #include <fs/cuse/cuse_ioctl.h> 66 67 static int 68 cuse_modevent(module_t mod, int type, void *data) 69 { 70 switch (type) { 71 case MOD_LOAD: 72 case MOD_UNLOAD: 73 return (0); 74 default: 75 return (EOPNOTSUPP); 76 } 77 } 78 79 static moduledata_t cuse_mod = { 80 .name = "cuse", 81 .evhand = &cuse_modevent, 82 }; 83 84 DECLARE_MODULE(cuse, cuse_mod, SI_SUB_DEVFS, SI_ORDER_FIRST); 85 MODULE_VERSION(cuse, 1); 86 87 /* 88 * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by 89 * declaring support for the cuse4bsd interface in cuse.ko: 90 */ 91 MODULE_VERSION(cuse4bsd, 1); 92 93 #ifdef FEATURE 94 FEATURE(cuse, "Userspace character devices"); 95 #endif 96 97 struct cuse_command; 98 struct cuse_server; 99 struct cuse_client; 100 101 struct cuse_client_command { 102 TAILQ_ENTRY(cuse_client_command) entry; 103 struct cuse_command sub; 104 struct sx sx; 105 struct cv cv; 106 struct thread *entered; 107 struct cuse_client *client; 108 struct proc *proc_curr; 109 int proc_refs; 110 int got_signal; 111 int error; 112 int command; 113 }; 114 115 struct cuse_memory { 116 TAILQ_ENTRY(cuse_memory) entry; 117 vm_object_t object; 118 uint32_t page_count; 119 uint32_t alloc_nr; 120 }; 121 122 struct cuse_server_dev { 123 TAILQ_ENTRY(cuse_server_dev) entry; 124 struct cuse_server *server; 125 struct cdev *kern_dev; 126 struct cuse_dev *user_dev; 127 }; 128 129 struct cuse_server { 130 TAILQ_ENTRY(cuse_server) entry; 131 TAILQ_HEAD(, cuse_client_command) head; 132 TAILQ_HEAD(, cuse_server_dev) hdev; 133 TAILQ_HEAD(, cuse_client) hcli; 134 TAILQ_HEAD(, cuse_memory) hmem; 135 struct mtx mtx; 136 struct cv cv; 137 struct selinfo selinfo; 138 pid_t pid; 139 int is_closing; 140 int refs; 141 }; 142 143 struct cuse_client { 144 TAILQ_ENTRY(cuse_client) entry; 145 TAILQ_ENTRY(cuse_client) entry_ref; 146 struct cuse_client_command cmds[CUSE_CMD_MAX]; 147 struct cuse_server *server; 148 struct cuse_server_dev *server_dev; 149 150 uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4); 151 152 int fflags; /* file flags */ 153 int cflags; /* client flags */ 154 #define CUSE_CLI_IS_CLOSING 0x01 155 #define CUSE_CLI_KNOTE_NEED_READ 0x02 156 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04 157 #define CUSE_CLI_KNOTE_HAS_READ 0x08 158 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10 159 }; 160 161 #define CUSE_CLIENT_CLOSING(pcc) \ 162 ((pcc)->cflags & CUSE_CLI_IS_CLOSING) 163 164 static MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory"); 165 166 static TAILQ_HEAD(, cuse_server) cuse_server_head; 167 static struct mtx cuse_global_mtx; 168 static struct cdev *cuse_dev; 169 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX]; 170 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX]; 171 172 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs); 173 static void cuse_client_kqfilter_read_detach(struct knote *kn); 174 static void cuse_client_kqfilter_write_detach(struct knote *kn); 175 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint); 176 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint); 177 178 static struct filterops cuse_client_kqfilter_read_ops = { 179 .f_isfd = 1, 180 .f_detach = cuse_client_kqfilter_read_detach, 181 .f_event = cuse_client_kqfilter_read_event, 182 }; 183 184 static struct filterops cuse_client_kqfilter_write_ops = { 185 .f_isfd = 1, 186 .f_detach = cuse_client_kqfilter_write_detach, 187 .f_event = cuse_client_kqfilter_write_event, 188 }; 189 190 static d_open_t cuse_client_open; 191 static d_close_t cuse_client_close; 192 static d_ioctl_t cuse_client_ioctl; 193 static d_read_t cuse_client_read; 194 static d_write_t cuse_client_write; 195 static d_poll_t cuse_client_poll; 196 static d_mmap_single_t cuse_client_mmap_single; 197 static d_kqfilter_t cuse_client_kqfilter; 198 199 static struct cdevsw cuse_client_devsw = { 200 .d_version = D_VERSION, 201 .d_open = cuse_client_open, 202 .d_close = cuse_client_close, 203 .d_ioctl = cuse_client_ioctl, 204 .d_name = "cuse_client", 205 .d_flags = D_TRACKCLOSE, 206 .d_read = cuse_client_read, 207 .d_write = cuse_client_write, 208 .d_poll = cuse_client_poll, 209 .d_mmap_single = cuse_client_mmap_single, 210 .d_kqfilter = cuse_client_kqfilter, 211 }; 212 213 static d_open_t cuse_server_open; 214 static d_close_t cuse_server_close; 215 static d_ioctl_t cuse_server_ioctl; 216 static d_read_t cuse_server_read; 217 static d_write_t cuse_server_write; 218 static d_poll_t cuse_server_poll; 219 static d_mmap_single_t cuse_server_mmap_single; 220 221 static struct cdevsw cuse_server_devsw = { 222 .d_version = D_VERSION, 223 .d_open = cuse_server_open, 224 .d_close = cuse_server_close, 225 .d_ioctl = cuse_server_ioctl, 226 .d_name = "cuse_server", 227 .d_flags = D_TRACKCLOSE, 228 .d_read = cuse_server_read, 229 .d_write = cuse_server_write, 230 .d_poll = cuse_server_poll, 231 .d_mmap_single = cuse_server_mmap_single, 232 }; 233 234 static void cuse_client_is_closing(struct cuse_client *); 235 static int cuse_free_unit_by_id_locked(struct cuse_server *, int); 236 237 static void 238 cuse_global_lock(void) 239 { 240 mtx_lock(&cuse_global_mtx); 241 } 242 243 static void 244 cuse_global_unlock(void) 245 { 246 mtx_unlock(&cuse_global_mtx); 247 } 248 249 static void 250 cuse_server_lock(struct cuse_server *pcs) 251 { 252 mtx_lock(&pcs->mtx); 253 } 254 255 static void 256 cuse_server_unlock(struct cuse_server *pcs) 257 { 258 mtx_unlock(&pcs->mtx); 259 } 260 261 static void 262 cuse_cmd_lock(struct cuse_client_command *pccmd) 263 { 264 sx_xlock(&pccmd->sx); 265 } 266 267 static void 268 cuse_cmd_unlock(struct cuse_client_command *pccmd) 269 { 270 sx_xunlock(&pccmd->sx); 271 } 272 273 static void 274 cuse_kern_init(void *arg) 275 { 276 TAILQ_INIT(&cuse_server_head); 277 278 mtx_init(&cuse_global_mtx, "cuse-global-mtx", NULL, MTX_DEF); 279 280 cuse_dev = make_dev(&cuse_server_devsw, 0, 281 UID_ROOT, GID_OPERATOR, 0600, "cuse"); 282 283 printf("Cuse v%d.%d.%d @ /dev/cuse\n", 284 (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF, 285 (CUSE_VERSION >> 0) & 0xFF); 286 } 287 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL); 288 289 static void 290 cuse_kern_uninit(void *arg) 291 { 292 void *ptr; 293 294 while (1) { 295 printf("Cuse: Please exit all /dev/cuse instances " 296 "and processes which have used this device.\n"); 297 298 pause("DRAIN", 2 * hz); 299 300 cuse_global_lock(); 301 ptr = TAILQ_FIRST(&cuse_server_head); 302 cuse_global_unlock(); 303 304 if (ptr == NULL) 305 break; 306 } 307 308 if (cuse_dev != NULL) 309 destroy_dev(cuse_dev); 310 311 mtx_destroy(&cuse_global_mtx); 312 } 313 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0); 314 315 static int 316 cuse_server_get(struct cuse_server **ppcs) 317 { 318 struct cuse_server *pcs; 319 int error; 320 321 error = devfs_get_cdevpriv((void **)&pcs); 322 if (error != 0) { 323 *ppcs = NULL; 324 return (error); 325 } 326 if (pcs->is_closing) { 327 *ppcs = NULL; 328 return (EINVAL); 329 } 330 *ppcs = pcs; 331 return (0); 332 } 333 334 static void 335 cuse_server_is_closing(struct cuse_server *pcs) 336 { 337 struct cuse_client *pcc; 338 339 if (pcs->is_closing) 340 return; 341 342 pcs->is_closing = 1; 343 344 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 345 cuse_client_is_closing(pcc); 346 } 347 } 348 349 static struct cuse_client_command * 350 cuse_server_find_command(struct cuse_server *pcs, struct thread *td) 351 { 352 struct cuse_client *pcc; 353 int n; 354 355 if (pcs->is_closing) 356 goto done; 357 358 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 359 if (CUSE_CLIENT_CLOSING(pcc)) 360 continue; 361 for (n = 0; n != CUSE_CMD_MAX; n++) { 362 if (pcc->cmds[n].entered == td) 363 return (&pcc->cmds[n]); 364 } 365 } 366 done: 367 return (NULL); 368 } 369 370 static void 371 cuse_str_filter(char *ptr) 372 { 373 int c; 374 375 while (((c = *ptr) != 0)) { 376 if ((c >= 'a') && (c <= 'z')) { 377 ptr++; 378 continue; 379 } 380 if ((c >= 'A') && (c <= 'Z')) { 381 ptr++; 382 continue; 383 } 384 if ((c >= '0') && (c <= '9')) { 385 ptr++; 386 continue; 387 } 388 if ((c == '.') || (c == '_') || (c == '/')) { 389 ptr++; 390 continue; 391 } 392 *ptr = '_'; 393 394 ptr++; 395 } 396 } 397 398 static int 399 cuse_convert_error(int error) 400 { 401 ; /* indent fix */ 402 switch (error) { 403 case CUSE_ERR_NONE: 404 return (0); 405 case CUSE_ERR_BUSY: 406 return (EBUSY); 407 case CUSE_ERR_WOULDBLOCK: 408 return (EWOULDBLOCK); 409 case CUSE_ERR_INVALID: 410 return (EINVAL); 411 case CUSE_ERR_NO_MEMORY: 412 return (ENOMEM); 413 case CUSE_ERR_FAULT: 414 return (EFAULT); 415 case CUSE_ERR_SIGNAL: 416 return (EINTR); 417 case CUSE_ERR_NO_DEVICE: 418 return (ENODEV); 419 default: 420 return (ENXIO); 421 } 422 } 423 424 static void 425 cuse_vm_memory_free(struct cuse_memory *mem) 426 { 427 /* last user is gone - free */ 428 vm_object_deallocate(mem->object); 429 430 /* free CUSE memory */ 431 free(mem, M_CUSE); 432 } 433 434 static int 435 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr, 436 uint32_t page_count) 437 { 438 struct cuse_memory *temp; 439 struct cuse_memory *mem; 440 vm_object_t object; 441 int error; 442 443 mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO); 444 445 object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count, 446 VM_PROT_DEFAULT, 0, curthread->td_ucred); 447 if (object == NULL) { 448 error = ENOMEM; 449 goto error_0; 450 } 451 452 cuse_server_lock(pcs); 453 /* check if allocation number already exists */ 454 TAILQ_FOREACH(temp, &pcs->hmem, entry) { 455 if (temp->alloc_nr == alloc_nr) 456 break; 457 } 458 if (temp != NULL) { 459 cuse_server_unlock(pcs); 460 error = EBUSY; 461 goto error_1; 462 } 463 mem->object = object; 464 mem->page_count = page_count; 465 mem->alloc_nr = alloc_nr; 466 TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry); 467 cuse_server_unlock(pcs); 468 469 return (0); 470 471 error_1: 472 vm_object_deallocate(object); 473 error_0: 474 free(mem, M_CUSE); 475 return (error); 476 } 477 478 static int 479 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr) 480 { 481 struct cuse_memory *mem; 482 483 cuse_server_lock(pcs); 484 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 485 if (mem->alloc_nr == alloc_nr) 486 break; 487 } 488 if (mem == NULL) { 489 cuse_server_unlock(pcs); 490 return (EINVAL); 491 } 492 TAILQ_REMOVE(&pcs->hmem, mem, entry); 493 cuse_server_unlock(pcs); 494 495 cuse_vm_memory_free(mem); 496 497 return (0); 498 } 499 500 static int 501 cuse_client_get(struct cuse_client **ppcc) 502 { 503 struct cuse_client *pcc; 504 int error; 505 506 /* try to get private data */ 507 error = devfs_get_cdevpriv((void **)&pcc); 508 if (error != 0) { 509 *ppcc = NULL; 510 return (error); 511 } 512 if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) { 513 *ppcc = NULL; 514 return (EINVAL); 515 } 516 *ppcc = pcc; 517 return (0); 518 } 519 520 static void 521 cuse_client_is_closing(struct cuse_client *pcc) 522 { 523 struct cuse_client_command *pccmd; 524 uint32_t n; 525 526 if (CUSE_CLIENT_CLOSING(pcc)) 527 return; 528 529 pcc->cflags |= CUSE_CLI_IS_CLOSING; 530 pcc->server_dev = NULL; 531 532 for (n = 0; n != CUSE_CMD_MAX; n++) { 533 pccmd = &pcc->cmds[n]; 534 535 if (pccmd->entry.tqe_prev != NULL) { 536 TAILQ_REMOVE(&pcc->server->head, pccmd, entry); 537 pccmd->entry.tqe_prev = NULL; 538 } 539 cv_broadcast(&pccmd->cv); 540 } 541 } 542 543 static void 544 cuse_client_send_command_locked(struct cuse_client_command *pccmd, 545 uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag) 546 { 547 unsigned long cuse_fflags = 0; 548 struct cuse_server *pcs; 549 550 if (fflags & FREAD) 551 cuse_fflags |= CUSE_FFLAG_READ; 552 553 if (fflags & FWRITE) 554 cuse_fflags |= CUSE_FFLAG_WRITE; 555 556 if (ioflag & IO_NDELAY) 557 cuse_fflags |= CUSE_FFLAG_NONBLOCK; 558 #if defined(__LP64__) 559 if (SV_CURPROC_FLAG(SV_ILP32)) 560 cuse_fflags |= CUSE_FFLAG_COMPAT32; 561 #endif 562 pccmd->sub.fflags = cuse_fflags; 563 pccmd->sub.data_pointer = data_ptr; 564 pccmd->sub.argument = arg; 565 566 pcs = pccmd->client->server; 567 568 if ((pccmd->entry.tqe_prev == NULL) && 569 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 570 (pcs->is_closing == 0)) { 571 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 572 cv_signal(&pcs->cv); 573 } 574 } 575 576 static void 577 cuse_client_got_signal(struct cuse_client_command *pccmd) 578 { 579 struct cuse_server *pcs; 580 581 pccmd->got_signal = 1; 582 583 pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL]; 584 585 pcs = pccmd->client->server; 586 587 if ((pccmd->entry.tqe_prev == NULL) && 588 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 589 (pcs->is_closing == 0)) { 590 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 591 cv_signal(&pcs->cv); 592 } 593 } 594 595 static int 596 cuse_client_receive_command_locked(struct cuse_client_command *pccmd, 597 uint8_t *arg_ptr, uint32_t arg_len) 598 { 599 struct cuse_server *pcs; 600 int error; 601 602 pcs = pccmd->client->server; 603 error = 0; 604 605 pccmd->proc_curr = curthread->td_proc; 606 607 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) { 608 error = CUSE_ERR_OTHER; 609 goto done; 610 } 611 while (pccmd->command == CUSE_CMD_NONE) { 612 if (error != 0) { 613 cv_wait(&pccmd->cv, &pcs->mtx); 614 } else { 615 error = cv_wait_sig(&pccmd->cv, &pcs->mtx); 616 617 if (error != 0) 618 cuse_client_got_signal(pccmd); 619 } 620 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) { 621 error = CUSE_ERR_OTHER; 622 goto done; 623 } 624 } 625 626 error = pccmd->error; 627 pccmd->command = CUSE_CMD_NONE; 628 cv_signal(&pccmd->cv); 629 630 done: 631 632 /* wait until all process references are gone */ 633 634 pccmd->proc_curr = NULL; 635 636 while (pccmd->proc_refs != 0) 637 cv_wait(&pccmd->cv, &pcs->mtx); 638 639 return (error); 640 } 641 642 /*------------------------------------------------------------------------* 643 * CUSE SERVER PART 644 *------------------------------------------------------------------------*/ 645 646 static void 647 cuse_server_free_dev(struct cuse_server_dev *pcsd) 648 { 649 struct cuse_server *pcs; 650 struct cuse_client *pcc; 651 652 /* get server pointer */ 653 pcs = pcsd->server; 654 655 /* prevent creation of more devices */ 656 cuse_server_lock(pcs); 657 if (pcsd->kern_dev != NULL) 658 pcsd->kern_dev->si_drv1 = NULL; 659 660 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 661 if (pcc->server_dev == pcsd) 662 cuse_client_is_closing(pcc); 663 } 664 cuse_server_unlock(pcs); 665 666 /* destroy device, if any */ 667 if (pcsd->kern_dev != NULL) { 668 /* destroy device synchronously */ 669 destroy_dev(pcsd->kern_dev); 670 } 671 free(pcsd, M_CUSE); 672 } 673 674 static void 675 cuse_server_unref(struct cuse_server *pcs) 676 { 677 struct cuse_server_dev *pcsd; 678 struct cuse_memory *mem; 679 680 cuse_server_lock(pcs); 681 if (--(pcs->refs) != 0) { 682 cuse_server_unlock(pcs); 683 return; 684 } 685 cuse_server_is_closing(pcs); 686 /* final client wakeup, if any */ 687 cuse_server_wakeup_all_client_locked(pcs); 688 689 cuse_global_lock(); 690 TAILQ_REMOVE(&cuse_server_head, pcs, entry); 691 cuse_global_unlock(); 692 693 while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) { 694 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 695 cuse_server_unlock(pcs); 696 cuse_server_free_dev(pcsd); 697 cuse_server_lock(pcs); 698 } 699 700 cuse_free_unit_by_id_locked(pcs, -1); 701 702 while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) { 703 TAILQ_REMOVE(&pcs->hmem, mem, entry); 704 cuse_server_unlock(pcs); 705 cuse_vm_memory_free(mem); 706 cuse_server_lock(pcs); 707 } 708 709 knlist_clear(&pcs->selinfo.si_note, 1); 710 knlist_destroy(&pcs->selinfo.si_note); 711 712 cuse_server_unlock(pcs); 713 714 seldrain(&pcs->selinfo); 715 716 cv_destroy(&pcs->cv); 717 718 mtx_destroy(&pcs->mtx); 719 720 free(pcs, M_CUSE); 721 } 722 723 static int 724 cuse_server_do_close(struct cuse_server *pcs) 725 { 726 int retval; 727 728 cuse_server_lock(pcs); 729 cuse_server_is_closing(pcs); 730 /* final client wakeup, if any */ 731 cuse_server_wakeup_all_client_locked(pcs); 732 733 knlist_clear(&pcs->selinfo.si_note, 1); 734 735 retval = pcs->refs; 736 cuse_server_unlock(pcs); 737 738 return (retval); 739 } 740 741 static void 742 cuse_server_free(void *arg) 743 { 744 struct cuse_server *pcs = arg; 745 746 /* 747 * The final server unref should be done by the server thread 748 * to prevent deadlock in the client cdevpriv destructor, 749 * which cannot destroy itself. 750 */ 751 while (cuse_server_do_close(pcs) != 1) 752 pause("W", hz); 753 754 /* drop final refcount */ 755 cuse_server_unref(pcs); 756 } 757 758 static int 759 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 760 { 761 struct cuse_server *pcs; 762 763 pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO); 764 765 if (devfs_set_cdevpriv(pcs, &cuse_server_free)) { 766 printf("Cuse: Cannot set cdevpriv.\n"); 767 free(pcs, M_CUSE); 768 return (ENOMEM); 769 } 770 /* store current process ID */ 771 pcs->pid = curproc->p_pid; 772 773 TAILQ_INIT(&pcs->head); 774 TAILQ_INIT(&pcs->hdev); 775 TAILQ_INIT(&pcs->hcli); 776 TAILQ_INIT(&pcs->hmem); 777 778 cv_init(&pcs->cv, "cuse-server-cv"); 779 780 mtx_init(&pcs->mtx, "cuse-server-mtx", NULL, MTX_DEF); 781 782 knlist_init_mtx(&pcs->selinfo.si_note, &pcs->mtx); 783 784 cuse_global_lock(); 785 pcs->refs++; 786 TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry); 787 cuse_global_unlock(); 788 789 return (0); 790 } 791 792 static int 793 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 794 { 795 struct cuse_server *pcs; 796 797 if (cuse_server_get(&pcs) == 0) 798 cuse_server_do_close(pcs); 799 800 return (0); 801 } 802 803 static int 804 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag) 805 { 806 return (ENXIO); 807 } 808 809 static int 810 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag) 811 { 812 return (ENXIO); 813 } 814 815 static int 816 cuse_server_ioctl_copy_locked(struct cuse_server *pcs, 817 struct cuse_client_command *pccmd, 818 struct cuse_data_chunk *pchk, int isread) 819 { 820 struct proc *p_proc; 821 uint32_t offset; 822 int error; 823 824 offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR; 825 826 if (pchk->length > CUSE_BUFFER_MAX) 827 return (EFAULT); 828 829 if (offset >= CUSE_BUFFER_MAX) 830 return (EFAULT); 831 832 if ((offset + pchk->length) > CUSE_BUFFER_MAX) 833 return (EFAULT); 834 835 p_proc = pccmd->proc_curr; 836 if (p_proc == NULL) 837 return (ENXIO); 838 839 if (pccmd->proc_refs < 0) 840 return (ENOMEM); 841 842 pccmd->proc_refs++; 843 844 cuse_server_unlock(pcs); 845 846 if (isread == 0) { 847 error = copyin( 848 (void *)pchk->local_ptr, 849 pccmd->client->ioctl_buffer + offset, 850 pchk->length); 851 } else { 852 error = copyout( 853 pccmd->client->ioctl_buffer + offset, 854 (void *)pchk->local_ptr, 855 pchk->length); 856 } 857 858 cuse_server_lock(pcs); 859 860 pccmd->proc_refs--; 861 862 if (pccmd->proc_curr == NULL) 863 cv_signal(&pccmd->cv); 864 865 return (error); 866 } 867 868 static int 869 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, 870 struct proc *proc_d, vm_offset_t data_d, size_t len) 871 { 872 struct thread *td; 873 struct proc *proc_cur; 874 int error; 875 876 td = curthread; 877 proc_cur = td->td_proc; 878 879 if (proc_cur == proc_d) { 880 struct iovec iov = { 881 .iov_base = (caddr_t)data_d, 882 .iov_len = len, 883 }; 884 struct uio uio = { 885 .uio_iov = &iov, 886 .uio_iovcnt = 1, 887 .uio_offset = (off_t)data_s, 888 .uio_resid = len, 889 .uio_segflg = UIO_USERSPACE, 890 .uio_rw = UIO_READ, 891 .uio_td = td, 892 }; 893 894 PHOLD(proc_s); 895 error = proc_rwmem(proc_s, &uio); 896 PRELE(proc_s); 897 898 } else if (proc_cur == proc_s) { 899 struct iovec iov = { 900 .iov_base = (caddr_t)data_s, 901 .iov_len = len, 902 }; 903 struct uio uio = { 904 .uio_iov = &iov, 905 .uio_iovcnt = 1, 906 .uio_offset = (off_t)data_d, 907 .uio_resid = len, 908 .uio_segflg = UIO_USERSPACE, 909 .uio_rw = UIO_WRITE, 910 .uio_td = td, 911 }; 912 913 PHOLD(proc_d); 914 error = proc_rwmem(proc_d, &uio); 915 PRELE(proc_d); 916 } else { 917 error = EINVAL; 918 } 919 return (error); 920 } 921 922 static int 923 cuse_server_data_copy_locked(struct cuse_server *pcs, 924 struct cuse_client_command *pccmd, 925 struct cuse_data_chunk *pchk, int isread) 926 { 927 struct proc *p_proc; 928 int error; 929 930 p_proc = pccmd->proc_curr; 931 if (p_proc == NULL) 932 return (ENXIO); 933 934 if (pccmd->proc_refs < 0) 935 return (ENOMEM); 936 937 pccmd->proc_refs++; 938 939 cuse_server_unlock(pcs); 940 941 if (isread == 0) { 942 error = cuse_proc2proc_copy( 943 curthread->td_proc, pchk->local_ptr, 944 p_proc, pchk->peer_ptr, 945 pchk->length); 946 } else { 947 error = cuse_proc2proc_copy( 948 p_proc, pchk->peer_ptr, 949 curthread->td_proc, pchk->local_ptr, 950 pchk->length); 951 } 952 953 cuse_server_lock(pcs); 954 955 pccmd->proc_refs--; 956 957 if (pccmd->proc_curr == NULL) 958 cv_signal(&pccmd->cv); 959 960 return (error); 961 } 962 963 static int 964 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id) 965 { 966 int n; 967 int x = 0; 968 int match; 969 970 do { 971 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) { 972 if (cuse_alloc_unit[n] != NULL) { 973 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK) 974 continue; 975 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) { 976 x++; 977 match = 1; 978 } 979 } 980 } 981 } while (match); 982 983 if (x < 256) { 984 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 985 if (cuse_alloc_unit[n] == NULL) { 986 cuse_alloc_unit[n] = pcs; 987 cuse_alloc_unit_id[n] = id | x; 988 return (x); 989 } 990 } 991 } 992 return (-1); 993 } 994 995 static void 996 cuse_server_wakeup_locked(struct cuse_server *pcs) 997 { 998 selwakeup(&pcs->selinfo); 999 KNOTE_LOCKED(&pcs->selinfo.si_note, 0); 1000 } 1001 1002 static void 1003 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs) 1004 { 1005 struct cuse_client *pcc; 1006 1007 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 1008 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ | 1009 CUSE_CLI_KNOTE_NEED_WRITE); 1010 } 1011 cuse_server_wakeup_locked(pcs); 1012 } 1013 1014 static int 1015 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id) 1016 { 1017 int n; 1018 int found = 0; 1019 1020 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 1021 if (cuse_alloc_unit[n] == pcs) { 1022 if (cuse_alloc_unit_id[n] == id || id == -1) { 1023 cuse_alloc_unit[n] = NULL; 1024 cuse_alloc_unit_id[n] = 0; 1025 found = 1; 1026 } 1027 } 1028 } 1029 1030 return (found ? 0 : EINVAL); 1031 } 1032 1033 static int 1034 cuse_server_ioctl(struct cdev *dev, unsigned long cmd, 1035 caddr_t data, int fflag, struct thread *td) 1036 { 1037 struct cuse_server *pcs; 1038 int error; 1039 1040 error = cuse_server_get(&pcs); 1041 if (error != 0) 1042 return (error); 1043 1044 switch (cmd) { 1045 struct cuse_client_command *pccmd; 1046 struct cuse_client *pcc; 1047 struct cuse_command *pcmd; 1048 struct cuse_alloc_info *pai; 1049 struct cuse_create_dev *pcd; 1050 struct cuse_server_dev *pcsd; 1051 struct cuse_data_chunk *pchk; 1052 int n; 1053 1054 case CUSE_IOCTL_GET_COMMAND: 1055 pcmd = (void *)data; 1056 1057 cuse_server_lock(pcs); 1058 1059 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) { 1060 error = cv_wait_sig(&pcs->cv, &pcs->mtx); 1061 1062 if (pcs->is_closing) 1063 error = ENXIO; 1064 1065 if (error) { 1066 cuse_server_unlock(pcs); 1067 return (error); 1068 } 1069 } 1070 1071 TAILQ_REMOVE(&pcs->head, pccmd, entry); 1072 pccmd->entry.tqe_prev = NULL; 1073 1074 pccmd->entered = curthread; 1075 1076 *pcmd = pccmd->sub; 1077 1078 cuse_server_unlock(pcs); 1079 1080 break; 1081 1082 case CUSE_IOCTL_SYNC_COMMAND: 1083 1084 cuse_server_lock(pcs); 1085 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) { 1086 /* send sync command */ 1087 pccmd->entered = NULL; 1088 pccmd->error = *(int *)data; 1089 pccmd->command = CUSE_CMD_SYNC; 1090 1091 /* signal peer, if any */ 1092 cv_signal(&pccmd->cv); 1093 } 1094 cuse_server_unlock(pcs); 1095 1096 break; 1097 1098 case CUSE_IOCTL_ALLOC_UNIT: 1099 1100 cuse_server_lock(pcs); 1101 n = cuse_alloc_unit_by_id_locked(pcs, 1102 CUSE_ID_DEFAULT(0)); 1103 cuse_server_unlock(pcs); 1104 1105 if (n < 0) 1106 error = ENOMEM; 1107 else 1108 *(int *)data = n; 1109 break; 1110 1111 case CUSE_IOCTL_ALLOC_UNIT_BY_ID: 1112 1113 n = *(int *)data; 1114 1115 n = (n & CUSE_ID_MASK); 1116 1117 cuse_server_lock(pcs); 1118 n = cuse_alloc_unit_by_id_locked(pcs, n); 1119 cuse_server_unlock(pcs); 1120 1121 if (n < 0) 1122 error = ENOMEM; 1123 else 1124 *(int *)data = n; 1125 break; 1126 1127 case CUSE_IOCTL_FREE_UNIT: 1128 1129 n = *(int *)data; 1130 1131 n = CUSE_ID_DEFAULT(n); 1132 1133 cuse_server_lock(pcs); 1134 error = cuse_free_unit_by_id_locked(pcs, n); 1135 cuse_server_unlock(pcs); 1136 break; 1137 1138 case CUSE_IOCTL_FREE_UNIT_BY_ID: 1139 1140 n = *(int *)data; 1141 1142 cuse_server_lock(pcs); 1143 error = cuse_free_unit_by_id_locked(pcs, n); 1144 cuse_server_unlock(pcs); 1145 break; 1146 1147 case CUSE_IOCTL_ALLOC_MEMORY: 1148 1149 pai = (void *)data; 1150 1151 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1152 error = ENOMEM; 1153 break; 1154 } 1155 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) { 1156 error = ENOMEM; 1157 break; 1158 } 1159 error = cuse_server_alloc_memory(pcs, 1160 pai->alloc_nr, pai->page_count); 1161 break; 1162 1163 case CUSE_IOCTL_FREE_MEMORY: 1164 pai = (void *)data; 1165 1166 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1167 error = ENOMEM; 1168 break; 1169 } 1170 error = cuse_server_free_memory(pcs, pai->alloc_nr); 1171 break; 1172 1173 case CUSE_IOCTL_GET_SIG: 1174 1175 cuse_server_lock(pcs); 1176 pccmd = cuse_server_find_command(pcs, curthread); 1177 1178 if (pccmd != NULL) { 1179 n = pccmd->got_signal; 1180 pccmd->got_signal = 0; 1181 } else { 1182 n = 0; 1183 } 1184 cuse_server_unlock(pcs); 1185 1186 *(int *)data = n; 1187 1188 break; 1189 1190 case CUSE_IOCTL_SET_PFH: 1191 1192 cuse_server_lock(pcs); 1193 pccmd = cuse_server_find_command(pcs, curthread); 1194 1195 if (pccmd != NULL) { 1196 pcc = pccmd->client; 1197 for (n = 0; n != CUSE_CMD_MAX; n++) { 1198 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data; 1199 } 1200 } else { 1201 error = ENXIO; 1202 } 1203 cuse_server_unlock(pcs); 1204 break; 1205 1206 case CUSE_IOCTL_CREATE_DEV: 1207 1208 error = priv_check(curthread, PRIV_DRIVER); 1209 if (error) 1210 break; 1211 1212 pcd = (void *)data; 1213 1214 /* filter input */ 1215 1216 pcd->devname[sizeof(pcd->devname) - 1] = 0; 1217 1218 if (pcd->devname[0] == 0) { 1219 error = EINVAL; 1220 break; 1221 } 1222 cuse_str_filter(pcd->devname); 1223 1224 pcd->permissions &= 0777; 1225 1226 /* try to allocate a character device */ 1227 1228 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO); 1229 1230 pcsd->server = pcs; 1231 1232 pcsd->user_dev = pcd->dev; 1233 1234 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME, 1235 &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id, 1236 pcd->permissions, "%s", pcd->devname); 1237 1238 if (pcsd->kern_dev == NULL) { 1239 free(pcsd, M_CUSE); 1240 error = ENOMEM; 1241 break; 1242 } 1243 pcsd->kern_dev->si_drv1 = pcsd; 1244 1245 cuse_server_lock(pcs); 1246 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry); 1247 cuse_server_unlock(pcs); 1248 1249 break; 1250 1251 case CUSE_IOCTL_DESTROY_DEV: 1252 1253 error = priv_check(curthread, PRIV_DRIVER); 1254 if (error) 1255 break; 1256 1257 cuse_server_lock(pcs); 1258 1259 error = EINVAL; 1260 1261 pcsd = TAILQ_FIRST(&pcs->hdev); 1262 while (pcsd != NULL) { 1263 if (pcsd->user_dev == *(struct cuse_dev **)data) { 1264 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 1265 cuse_server_unlock(pcs); 1266 cuse_server_free_dev(pcsd); 1267 cuse_server_lock(pcs); 1268 error = 0; 1269 pcsd = TAILQ_FIRST(&pcs->hdev); 1270 } else { 1271 pcsd = TAILQ_NEXT(pcsd, entry); 1272 } 1273 } 1274 1275 cuse_server_unlock(pcs); 1276 break; 1277 1278 case CUSE_IOCTL_WRITE_DATA: 1279 case CUSE_IOCTL_READ_DATA: 1280 1281 cuse_server_lock(pcs); 1282 pchk = (struct cuse_data_chunk *)data; 1283 1284 pccmd = cuse_server_find_command(pcs, curthread); 1285 1286 if (pccmd == NULL) { 1287 error = ENXIO; /* invalid request */ 1288 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) { 1289 error = EFAULT; /* NULL pointer */ 1290 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) { 1291 error = cuse_server_ioctl_copy_locked(pcs, pccmd, 1292 pchk, cmd == CUSE_IOCTL_READ_DATA); 1293 } else { 1294 error = cuse_server_data_copy_locked(pcs, pccmd, 1295 pchk, cmd == CUSE_IOCTL_READ_DATA); 1296 } 1297 cuse_server_unlock(pcs); 1298 break; 1299 1300 case CUSE_IOCTL_SELWAKEUP: 1301 cuse_server_lock(pcs); 1302 /* 1303 * We don't know which direction caused the event. 1304 * Wakeup both! 1305 */ 1306 cuse_server_wakeup_all_client_locked(pcs); 1307 cuse_server_unlock(pcs); 1308 break; 1309 1310 default: 1311 error = ENXIO; 1312 break; 1313 } 1314 return (error); 1315 } 1316 1317 static int 1318 cuse_server_poll(struct cdev *dev, int events, struct thread *td) 1319 { 1320 return (events & (POLLHUP | POLLPRI | POLLIN | 1321 POLLRDNORM | POLLOUT | POLLWRNORM)); 1322 } 1323 1324 static int 1325 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1326 vm_size_t size, struct vm_object **object, int nprot) 1327 { 1328 uint32_t page_nr = *offset / PAGE_SIZE; 1329 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1330 struct cuse_memory *mem; 1331 struct cuse_server *pcs; 1332 int error; 1333 1334 error = cuse_server_get(&pcs); 1335 if (error != 0) 1336 return (error); 1337 1338 cuse_server_lock(pcs); 1339 /* lookup memory structure */ 1340 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 1341 if (mem->alloc_nr == alloc_nr) 1342 break; 1343 } 1344 if (mem == NULL) { 1345 cuse_server_unlock(pcs); 1346 return (ENOMEM); 1347 } 1348 /* verify page offset */ 1349 page_nr %= CUSE_ALLOC_PAGES_MAX; 1350 if (page_nr >= mem->page_count) { 1351 cuse_server_unlock(pcs); 1352 return (ENXIO); 1353 } 1354 /* verify mmap size */ 1355 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1356 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1357 cuse_server_unlock(pcs); 1358 return (EINVAL); 1359 } 1360 vm_object_reference(mem->object); 1361 *object = mem->object; 1362 cuse_server_unlock(pcs); 1363 1364 /* set new VM object offset to use */ 1365 *offset = page_nr * PAGE_SIZE; 1366 1367 /* success */ 1368 return (0); 1369 } 1370 1371 /*------------------------------------------------------------------------* 1372 * CUSE CLIENT PART 1373 *------------------------------------------------------------------------*/ 1374 static void 1375 cuse_client_free(void *arg) 1376 { 1377 struct cuse_client *pcc = arg; 1378 struct cuse_client_command *pccmd; 1379 struct cuse_server *pcs; 1380 int n; 1381 1382 pcs = pcc->server; 1383 1384 cuse_server_lock(pcs); 1385 cuse_client_is_closing(pcc); 1386 TAILQ_REMOVE(&pcs->hcli, pcc, entry); 1387 cuse_server_unlock(pcs); 1388 1389 for (n = 0; n != CUSE_CMD_MAX; n++) { 1390 pccmd = &pcc->cmds[n]; 1391 1392 sx_destroy(&pccmd->sx); 1393 cv_destroy(&pccmd->cv); 1394 } 1395 1396 free(pcc, M_CUSE); 1397 1398 /* drop reference on server */ 1399 cuse_server_unref(pcs); 1400 } 1401 1402 static int 1403 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 1404 { 1405 struct cuse_client_command *pccmd; 1406 struct cuse_server_dev *pcsd; 1407 struct cuse_client *pcc; 1408 struct cuse_server *pcs; 1409 struct cuse_dev *pcd; 1410 int error; 1411 int n; 1412 1413 pcsd = dev->si_drv1; 1414 if (pcsd != NULL) { 1415 pcs = pcsd->server; 1416 pcd = pcsd->user_dev; 1417 1418 cuse_server_lock(pcs); 1419 /* 1420 * Check that the refcount didn't wrap and that the 1421 * same process is not both client and server. This 1422 * can easily lead to deadlocks when destroying the 1423 * CUSE character device nodes: 1424 */ 1425 pcs->refs++; 1426 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) { 1427 /* overflow or wrong PID */ 1428 pcs->refs--; 1429 cuse_server_unlock(pcs); 1430 return (EINVAL); 1431 } 1432 cuse_server_unlock(pcs); 1433 } else { 1434 return (EINVAL); 1435 } 1436 1437 pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO); 1438 if (devfs_set_cdevpriv(pcc, &cuse_client_free)) { 1439 printf("Cuse: Cannot set cdevpriv.\n"); 1440 /* drop reference on server */ 1441 cuse_server_unref(pcs); 1442 free(pcc, M_CUSE); 1443 return (ENOMEM); 1444 } 1445 pcc->fflags = fflags; 1446 pcc->server_dev = pcsd; 1447 pcc->server = pcs; 1448 1449 for (n = 0; n != CUSE_CMD_MAX; n++) { 1450 pccmd = &pcc->cmds[n]; 1451 1452 pccmd->sub.dev = pcd; 1453 pccmd->sub.command = n; 1454 pccmd->client = pcc; 1455 1456 sx_init(&pccmd->sx, "cuse-client-sx"); 1457 cv_init(&pccmd->cv, "cuse-client-cv"); 1458 } 1459 1460 cuse_server_lock(pcs); 1461 1462 /* cuse_client_free() assumes that the client is listed somewhere! */ 1463 /* always enqueue */ 1464 1465 TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry); 1466 1467 /* check if server is closing */ 1468 if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) { 1469 error = EINVAL; 1470 } else { 1471 error = 0; 1472 } 1473 cuse_server_unlock(pcs); 1474 1475 if (error) { 1476 devfs_clear_cdevpriv(); /* XXX bugfix */ 1477 return (error); 1478 } 1479 pccmd = &pcc->cmds[CUSE_CMD_OPEN]; 1480 1481 cuse_cmd_lock(pccmd); 1482 1483 cuse_server_lock(pcs); 1484 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1485 1486 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1487 cuse_server_unlock(pcs); 1488 1489 if (error < 0) { 1490 error = cuse_convert_error(error); 1491 } else { 1492 error = 0; 1493 } 1494 1495 cuse_cmd_unlock(pccmd); 1496 1497 if (error) 1498 devfs_clear_cdevpriv(); /* XXX bugfix */ 1499 1500 return (error); 1501 } 1502 1503 static int 1504 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 1505 { 1506 struct cuse_client_command *pccmd; 1507 struct cuse_client *pcc; 1508 struct cuse_server *pcs; 1509 int error; 1510 1511 error = cuse_client_get(&pcc); 1512 if (error != 0) 1513 return (0); 1514 1515 pccmd = &pcc->cmds[CUSE_CMD_CLOSE]; 1516 pcs = pcc->server; 1517 1518 cuse_cmd_lock(pccmd); 1519 1520 cuse_server_lock(pcs); 1521 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1522 1523 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1524 cuse_cmd_unlock(pccmd); 1525 1526 cuse_client_is_closing(pcc); 1527 cuse_server_unlock(pcs); 1528 1529 return (0); 1530 } 1531 1532 static void 1533 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc) 1534 { 1535 struct cuse_server *pcs = pcc->server; 1536 int temp; 1537 1538 cuse_server_lock(pcs); 1539 temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ | 1540 CUSE_CLI_KNOTE_HAS_WRITE)); 1541 pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ | 1542 CUSE_CLI_KNOTE_NEED_WRITE); 1543 cuse_server_unlock(pcs); 1544 1545 if (temp != 0) { 1546 /* get the latest polling state from the server */ 1547 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL); 1548 1549 if (temp & (POLLIN | POLLOUT)) { 1550 cuse_server_lock(pcs); 1551 if (temp & POLLIN) 1552 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ; 1553 if (temp & POLLOUT) 1554 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE; 1555 1556 /* make sure the "knote" gets woken up */ 1557 cuse_server_wakeup_locked(pcc->server); 1558 cuse_server_unlock(pcs); 1559 } 1560 } 1561 } 1562 1563 static int 1564 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) 1565 { 1566 struct cuse_client_command *pccmd; 1567 struct cuse_client *pcc; 1568 struct cuse_server *pcs; 1569 int error; 1570 int len; 1571 1572 error = cuse_client_get(&pcc); 1573 if (error != 0) 1574 return (error); 1575 1576 pccmd = &pcc->cmds[CUSE_CMD_READ]; 1577 pcs = pcc->server; 1578 1579 if (uio->uio_segflg != UIO_USERSPACE) { 1580 return (EINVAL); 1581 } 1582 uio->uio_segflg = UIO_NOCOPY; 1583 1584 cuse_cmd_lock(pccmd); 1585 1586 while (uio->uio_resid != 0) { 1587 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1588 error = ENOMEM; 1589 break; 1590 } 1591 len = uio->uio_iov->iov_len; 1592 1593 cuse_server_lock(pcs); 1594 cuse_client_send_command_locked(pccmd, 1595 (uintptr_t)uio->uio_iov->iov_base, 1596 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1597 1598 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1599 cuse_server_unlock(pcs); 1600 1601 if (error < 0) { 1602 error = cuse_convert_error(error); 1603 break; 1604 } else if (error == len) { 1605 error = uiomove(NULL, error, uio); 1606 if (error) 1607 break; 1608 } else { 1609 error = uiomove(NULL, error, uio); 1610 break; 1611 } 1612 } 1613 cuse_cmd_unlock(pccmd); 1614 1615 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1616 1617 if (error == EWOULDBLOCK) 1618 cuse_client_kqfilter_poll(dev, pcc); 1619 1620 return (error); 1621 } 1622 1623 static int 1624 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) 1625 { 1626 struct cuse_client_command *pccmd; 1627 struct cuse_client *pcc; 1628 struct cuse_server *pcs; 1629 int error; 1630 int len; 1631 1632 error = cuse_client_get(&pcc); 1633 if (error != 0) 1634 return (error); 1635 1636 pccmd = &pcc->cmds[CUSE_CMD_WRITE]; 1637 pcs = pcc->server; 1638 1639 if (uio->uio_segflg != UIO_USERSPACE) { 1640 return (EINVAL); 1641 } 1642 uio->uio_segflg = UIO_NOCOPY; 1643 1644 cuse_cmd_lock(pccmd); 1645 1646 while (uio->uio_resid != 0) { 1647 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1648 error = ENOMEM; 1649 break; 1650 } 1651 len = uio->uio_iov->iov_len; 1652 1653 cuse_server_lock(pcs); 1654 cuse_client_send_command_locked(pccmd, 1655 (uintptr_t)uio->uio_iov->iov_base, 1656 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1657 1658 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1659 cuse_server_unlock(pcs); 1660 1661 if (error < 0) { 1662 error = cuse_convert_error(error); 1663 break; 1664 } else if (error == len) { 1665 error = uiomove(NULL, error, uio); 1666 if (error) 1667 break; 1668 } else { 1669 error = uiomove(NULL, error, uio); 1670 break; 1671 } 1672 } 1673 cuse_cmd_unlock(pccmd); 1674 1675 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1676 1677 if (error == EWOULDBLOCK) 1678 cuse_client_kqfilter_poll(dev, pcc); 1679 1680 return (error); 1681 } 1682 1683 int 1684 cuse_client_ioctl(struct cdev *dev, unsigned long cmd, 1685 caddr_t data, int fflag, struct thread *td) 1686 { 1687 struct cuse_client_command *pccmd; 1688 struct cuse_client *pcc; 1689 struct cuse_server *pcs; 1690 int error; 1691 int len; 1692 1693 error = cuse_client_get(&pcc); 1694 if (error != 0) 1695 return (error); 1696 1697 len = IOCPARM_LEN(cmd); 1698 if (len > CUSE_BUFFER_MAX) 1699 return (ENOMEM); 1700 1701 pccmd = &pcc->cmds[CUSE_CMD_IOCTL]; 1702 pcs = pcc->server; 1703 1704 cuse_cmd_lock(pccmd); 1705 1706 if (cmd & (IOC_IN | IOC_VOID)) 1707 memcpy(pcc->ioctl_buffer, data, len); 1708 1709 /* 1710 * When the ioctl-length is zero drivers can pass information 1711 * through the data pointer of the ioctl. Make sure this information 1712 * is forwarded to the driver. 1713 */ 1714 1715 cuse_server_lock(pcs); 1716 cuse_client_send_command_locked(pccmd, 1717 (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR, 1718 (unsigned long)cmd, pcc->fflags, 1719 (fflag & O_NONBLOCK) ? IO_NDELAY : 0); 1720 1721 error = cuse_client_receive_command_locked(pccmd, data, len); 1722 cuse_server_unlock(pcs); 1723 1724 if (error < 0) { 1725 error = cuse_convert_error(error); 1726 } else { 1727 error = 0; 1728 } 1729 1730 if (cmd & IOC_OUT) 1731 memcpy(data, pcc->ioctl_buffer, len); 1732 1733 cuse_cmd_unlock(pccmd); 1734 1735 if (error == EWOULDBLOCK) 1736 cuse_client_kqfilter_poll(dev, pcc); 1737 1738 return (error); 1739 } 1740 1741 static int 1742 cuse_client_poll(struct cdev *dev, int events, struct thread *td) 1743 { 1744 struct cuse_client_command *pccmd; 1745 struct cuse_client *pcc; 1746 struct cuse_server *pcs; 1747 unsigned long temp; 1748 int error; 1749 int revents; 1750 1751 error = cuse_client_get(&pcc); 1752 if (error != 0) 1753 goto pollnval; 1754 1755 temp = 0; 1756 pcs = pcc->server; 1757 1758 if (events & (POLLPRI | POLLIN | POLLRDNORM)) 1759 temp |= CUSE_POLL_READ; 1760 1761 if (events & (POLLOUT | POLLWRNORM)) 1762 temp |= CUSE_POLL_WRITE; 1763 1764 if (events & POLLHUP) 1765 temp |= CUSE_POLL_ERROR; 1766 1767 pccmd = &pcc->cmds[CUSE_CMD_POLL]; 1768 1769 cuse_cmd_lock(pccmd); 1770 1771 /* Need to selrecord() first to not loose any events. */ 1772 if (temp != 0 && td != NULL) 1773 selrecord(td, &pcs->selinfo); 1774 1775 cuse_server_lock(pcs); 1776 cuse_client_send_command_locked(pccmd, 1777 0, temp, pcc->fflags, IO_NDELAY); 1778 1779 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1780 cuse_server_unlock(pcs); 1781 1782 cuse_cmd_unlock(pccmd); 1783 1784 if (error < 0) { 1785 goto pollnval; 1786 } else { 1787 revents = 0; 1788 if (error & CUSE_POLL_READ) 1789 revents |= (events & (POLLPRI | POLLIN | POLLRDNORM)); 1790 if (error & CUSE_POLL_WRITE) 1791 revents |= (events & (POLLOUT | POLLWRNORM)); 1792 if (error & CUSE_POLL_ERROR) 1793 revents |= (events & POLLHUP); 1794 } 1795 return (revents); 1796 1797 pollnval: 1798 /* XXX many clients don't understand POLLNVAL */ 1799 return (events & (POLLHUP | POLLPRI | POLLIN | 1800 POLLRDNORM | POLLOUT | POLLWRNORM)); 1801 } 1802 1803 static int 1804 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1805 vm_size_t size, struct vm_object **object, int nprot) 1806 { 1807 uint32_t page_nr = *offset / PAGE_SIZE; 1808 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1809 struct cuse_memory *mem; 1810 struct cuse_client *pcc; 1811 struct cuse_server *pcs; 1812 int error; 1813 1814 error = cuse_client_get(&pcc); 1815 if (error != 0) 1816 return (error); 1817 1818 pcs = pcc->server; 1819 1820 cuse_server_lock(pcs); 1821 /* lookup memory structure */ 1822 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 1823 if (mem->alloc_nr == alloc_nr) 1824 break; 1825 } 1826 if (mem == NULL) { 1827 cuse_server_unlock(pcs); 1828 return (ENOMEM); 1829 } 1830 /* verify page offset */ 1831 page_nr %= CUSE_ALLOC_PAGES_MAX; 1832 if (page_nr >= mem->page_count) { 1833 cuse_server_unlock(pcs); 1834 return (ENXIO); 1835 } 1836 /* verify mmap size */ 1837 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1838 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1839 cuse_server_unlock(pcs); 1840 return (EINVAL); 1841 } 1842 vm_object_reference(mem->object); 1843 *object = mem->object; 1844 cuse_server_unlock(pcs); 1845 1846 /* set new VM object offset to use */ 1847 *offset = page_nr * PAGE_SIZE; 1848 1849 /* success */ 1850 return (0); 1851 } 1852 1853 static void 1854 cuse_client_kqfilter_read_detach(struct knote *kn) 1855 { 1856 struct cuse_client *pcc; 1857 struct cuse_server *pcs; 1858 1859 pcc = kn->kn_hook; 1860 pcs = pcc->server; 1861 1862 cuse_server_lock(pcs); 1863 knlist_remove(&pcs->selinfo.si_note, kn, 1); 1864 cuse_server_unlock(pcs); 1865 } 1866 1867 static void 1868 cuse_client_kqfilter_write_detach(struct knote *kn) 1869 { 1870 struct cuse_client *pcc; 1871 struct cuse_server *pcs; 1872 1873 pcc = kn->kn_hook; 1874 pcs = pcc->server; 1875 1876 cuse_server_lock(pcs); 1877 knlist_remove(&pcs->selinfo.si_note, kn, 1); 1878 cuse_server_unlock(pcs); 1879 } 1880 1881 static int 1882 cuse_client_kqfilter_read_event(struct knote *kn, long hint) 1883 { 1884 struct cuse_client *pcc; 1885 1886 pcc = kn->kn_hook; 1887 1888 mtx_assert(&pcc->server->mtx, MA_OWNED); 1889 1890 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0); 1891 } 1892 1893 static int 1894 cuse_client_kqfilter_write_event(struct knote *kn, long hint) 1895 { 1896 struct cuse_client *pcc; 1897 1898 pcc = kn->kn_hook; 1899 1900 mtx_assert(&pcc->server->mtx, MA_OWNED); 1901 1902 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0); 1903 } 1904 1905 static int 1906 cuse_client_kqfilter(struct cdev *dev, struct knote *kn) 1907 { 1908 struct cuse_client *pcc; 1909 struct cuse_server *pcs; 1910 int error; 1911 1912 error = cuse_client_get(&pcc); 1913 if (error != 0) 1914 return (error); 1915 1916 pcs = pcc->server; 1917 1918 cuse_server_lock(pcs); 1919 switch (kn->kn_filter) { 1920 case EVFILT_READ: 1921 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ; 1922 kn->kn_hook = pcc; 1923 kn->kn_fop = &cuse_client_kqfilter_read_ops; 1924 knlist_add(&pcs->selinfo.si_note, kn, 1); 1925 break; 1926 case EVFILT_WRITE: 1927 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE; 1928 kn->kn_hook = pcc; 1929 kn->kn_fop = &cuse_client_kqfilter_write_ops; 1930 knlist_add(&pcs->selinfo.si_note, kn, 1); 1931 break; 1932 default: 1933 error = EINVAL; 1934 break; 1935 } 1936 cuse_server_unlock(pcs); 1937 1938 if (error == 0) 1939 cuse_client_kqfilter_poll(dev, pcc); 1940 return (error); 1941 } 1942