1 /* $FreeBSD$ */ 2 /*- 3 * Copyright (c) 2010-2017 Hans Petter Selasky. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27 #include <sys/stdint.h> 28 #include <sys/stddef.h> 29 #include <sys/param.h> 30 #include <sys/types.h> 31 #include <sys/systm.h> 32 #include <sys/conf.h> 33 #include <sys/kernel.h> 34 #include <sys/bus.h> 35 #include <sys/linker_set.h> 36 #include <sys/module.h> 37 #include <sys/lock.h> 38 #include <sys/mutex.h> 39 #include <sys/condvar.h> 40 #include <sys/sysctl.h> 41 #include <sys/unistd.h> 42 #include <sys/malloc.h> 43 #include <sys/priv.h> 44 #include <sys/uio.h> 45 #include <sys/poll.h> 46 #include <sys/sx.h> 47 #include <sys/rwlock.h> 48 #include <sys/queue.h> 49 #include <sys/fcntl.h> 50 #include <sys/proc.h> 51 #include <sys/vnode.h> 52 #include <sys/selinfo.h> 53 #include <sys/ptrace.h> 54 #include <sys/sysent.h> 55 56 #include <machine/bus.h> 57 58 #include <vm/vm.h> 59 #include <vm/pmap.h> 60 #include <vm/vm_object.h> 61 #include <vm/vm_page.h> 62 #include <vm/vm_pager.h> 63 64 #include <fs/cuse/cuse_defs.h> 65 #include <fs/cuse/cuse_ioctl.h> 66 67 MODULE_VERSION(cuse, 1); 68 69 /* 70 * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by 71 * declaring support for the cuse4bsd interface in cuse.ko: 72 */ 73 MODULE_VERSION(cuse4bsd, 1); 74 75 #ifdef FEATURE 76 FEATURE(cuse, "Userspace character devices"); 77 #endif 78 79 struct cuse_command; 80 struct cuse_server; 81 struct cuse_client; 82 83 struct cuse_client_command { 84 TAILQ_ENTRY(cuse_client_command) entry; 85 struct cuse_command sub; 86 struct sx sx; 87 struct cv cv; 88 struct thread *entered; 89 struct cuse_client *client; 90 struct proc *proc_curr; 91 int proc_refs; 92 int got_signal; 93 int error; 94 int command; 95 }; 96 97 struct cuse_memory { 98 TAILQ_ENTRY(cuse_memory) entry; 99 vm_object_t object; 100 uint32_t page_count; 101 uint32_t alloc_nr; 102 }; 103 104 struct cuse_server_dev { 105 TAILQ_ENTRY(cuse_server_dev) entry; 106 struct cuse_server *server; 107 struct cdev *kern_dev; 108 struct cuse_dev *user_dev; 109 }; 110 111 struct cuse_server { 112 TAILQ_ENTRY(cuse_server) entry; 113 TAILQ_HEAD(, cuse_client_command) head; 114 TAILQ_HEAD(, cuse_server_dev) hdev; 115 TAILQ_HEAD(, cuse_client) hcli; 116 TAILQ_HEAD(, cuse_memory) hmem; 117 struct cv cv; 118 struct selinfo selinfo; 119 pid_t pid; 120 int is_closing; 121 int refs; 122 }; 123 124 struct cuse_client { 125 TAILQ_ENTRY(cuse_client) entry; 126 TAILQ_ENTRY(cuse_client) entry_ref; 127 struct cuse_client_command cmds[CUSE_CMD_MAX]; 128 struct cuse_server *server; 129 struct cuse_server_dev *server_dev; 130 131 uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4); 132 133 int fflags; /* file flags */ 134 int cflags; /* client flags */ 135 #define CUSE_CLI_IS_CLOSING 0x01 136 #define CUSE_CLI_KNOTE_NEED_READ 0x02 137 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04 138 #define CUSE_CLI_KNOTE_HAS_READ 0x08 139 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10 140 }; 141 142 #define CUSE_CLIENT_CLOSING(pcc) \ 143 ((pcc)->cflags & CUSE_CLI_IS_CLOSING) 144 145 static MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory"); 146 147 static TAILQ_HEAD(, cuse_server) cuse_server_head; 148 static struct mtx cuse_mtx; 149 static struct cdev *cuse_dev; 150 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX]; 151 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX]; 152 153 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs); 154 static void cuse_client_kqfilter_read_detach(struct knote *kn); 155 static void cuse_client_kqfilter_write_detach(struct knote *kn); 156 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint); 157 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint); 158 159 static struct filterops cuse_client_kqfilter_read_ops = { 160 .f_isfd = 1, 161 .f_detach = cuse_client_kqfilter_read_detach, 162 .f_event = cuse_client_kqfilter_read_event, 163 }; 164 165 static struct filterops cuse_client_kqfilter_write_ops = { 166 .f_isfd = 1, 167 .f_detach = cuse_client_kqfilter_write_detach, 168 .f_event = cuse_client_kqfilter_write_event, 169 }; 170 171 static d_open_t cuse_client_open; 172 static d_close_t cuse_client_close; 173 static d_ioctl_t cuse_client_ioctl; 174 static d_read_t cuse_client_read; 175 static d_write_t cuse_client_write; 176 static d_poll_t cuse_client_poll; 177 static d_mmap_single_t cuse_client_mmap_single; 178 static d_kqfilter_t cuse_client_kqfilter; 179 180 static struct cdevsw cuse_client_devsw = { 181 .d_version = D_VERSION, 182 .d_open = cuse_client_open, 183 .d_close = cuse_client_close, 184 .d_ioctl = cuse_client_ioctl, 185 .d_name = "cuse_client", 186 .d_flags = D_TRACKCLOSE, 187 .d_read = cuse_client_read, 188 .d_write = cuse_client_write, 189 .d_poll = cuse_client_poll, 190 .d_mmap_single = cuse_client_mmap_single, 191 .d_kqfilter = cuse_client_kqfilter, 192 }; 193 194 static d_open_t cuse_server_open; 195 static d_close_t cuse_server_close; 196 static d_ioctl_t cuse_server_ioctl; 197 static d_read_t cuse_server_read; 198 static d_write_t cuse_server_write; 199 static d_poll_t cuse_server_poll; 200 static d_mmap_single_t cuse_server_mmap_single; 201 202 static struct cdevsw cuse_server_devsw = { 203 .d_version = D_VERSION, 204 .d_open = cuse_server_open, 205 .d_close = cuse_server_close, 206 .d_ioctl = cuse_server_ioctl, 207 .d_name = "cuse_server", 208 .d_flags = D_TRACKCLOSE, 209 .d_read = cuse_server_read, 210 .d_write = cuse_server_write, 211 .d_poll = cuse_server_poll, 212 .d_mmap_single = cuse_server_mmap_single, 213 }; 214 215 static void cuse_client_is_closing(struct cuse_client *); 216 static int cuse_free_unit_by_id_locked(struct cuse_server *, int); 217 218 static void 219 cuse_lock(void) 220 { 221 mtx_lock(&cuse_mtx); 222 } 223 224 static void 225 cuse_unlock(void) 226 { 227 mtx_unlock(&cuse_mtx); 228 } 229 230 static void 231 cuse_cmd_lock(struct cuse_client_command *pccmd) 232 { 233 sx_xlock(&pccmd->sx); 234 } 235 236 static void 237 cuse_cmd_unlock(struct cuse_client_command *pccmd) 238 { 239 sx_xunlock(&pccmd->sx); 240 } 241 242 static void 243 cuse_kern_init(void *arg) 244 { 245 TAILQ_INIT(&cuse_server_head); 246 247 mtx_init(&cuse_mtx, "cuse-mtx", NULL, MTX_DEF); 248 249 cuse_dev = make_dev(&cuse_server_devsw, 0, 250 UID_ROOT, GID_OPERATOR, 0600, "cuse"); 251 252 printf("Cuse v%d.%d.%d @ /dev/cuse\n", 253 (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF, 254 (CUSE_VERSION >> 0) & 0xFF); 255 } 256 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL); 257 258 static void 259 cuse_kern_uninit(void *arg) 260 { 261 void *ptr; 262 263 while (1) { 264 265 printf("Cuse: Please exit all /dev/cuse instances " 266 "and processes which have used this device.\n"); 267 268 pause("DRAIN", 2 * hz); 269 270 cuse_lock(); 271 ptr = TAILQ_FIRST(&cuse_server_head); 272 cuse_unlock(); 273 274 if (ptr == NULL) 275 break; 276 } 277 278 if (cuse_dev != NULL) 279 destroy_dev(cuse_dev); 280 281 mtx_destroy(&cuse_mtx); 282 } 283 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0); 284 285 static int 286 cuse_server_get(struct cuse_server **ppcs) 287 { 288 struct cuse_server *pcs; 289 int error; 290 291 error = devfs_get_cdevpriv((void **)&pcs); 292 if (error != 0) { 293 *ppcs = NULL; 294 return (error); 295 } 296 /* check if closing */ 297 cuse_lock(); 298 if (pcs->is_closing) { 299 cuse_unlock(); 300 *ppcs = NULL; 301 return (EINVAL); 302 } 303 cuse_unlock(); 304 *ppcs = pcs; 305 return (0); 306 } 307 308 static void 309 cuse_server_is_closing(struct cuse_server *pcs) 310 { 311 struct cuse_client *pcc; 312 313 if (pcs->is_closing) 314 return; 315 316 pcs->is_closing = 1; 317 318 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 319 cuse_client_is_closing(pcc); 320 } 321 } 322 323 static struct cuse_client_command * 324 cuse_server_find_command(struct cuse_server *pcs, struct thread *td) 325 { 326 struct cuse_client *pcc; 327 int n; 328 329 if (pcs->is_closing) 330 goto done; 331 332 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 333 if (CUSE_CLIENT_CLOSING(pcc)) 334 continue; 335 for (n = 0; n != CUSE_CMD_MAX; n++) { 336 if (pcc->cmds[n].entered == td) 337 return (&pcc->cmds[n]); 338 } 339 } 340 done: 341 return (NULL); 342 } 343 344 static void 345 cuse_str_filter(char *ptr) 346 { 347 int c; 348 349 while (((c = *ptr) != 0)) { 350 351 if ((c >= 'a') && (c <= 'z')) { 352 ptr++; 353 continue; 354 } 355 if ((c >= 'A') && (c <= 'Z')) { 356 ptr++; 357 continue; 358 } 359 if ((c >= '0') && (c <= '9')) { 360 ptr++; 361 continue; 362 } 363 if ((c == '.') || (c == '_') || (c == '/')) { 364 ptr++; 365 continue; 366 } 367 *ptr = '_'; 368 369 ptr++; 370 } 371 } 372 373 static int 374 cuse_convert_error(int error) 375 { 376 ; /* indent fix */ 377 switch (error) { 378 case CUSE_ERR_NONE: 379 return (0); 380 case CUSE_ERR_BUSY: 381 return (EBUSY); 382 case CUSE_ERR_WOULDBLOCK: 383 return (EWOULDBLOCK); 384 case CUSE_ERR_INVALID: 385 return (EINVAL); 386 case CUSE_ERR_NO_MEMORY: 387 return (ENOMEM); 388 case CUSE_ERR_FAULT: 389 return (EFAULT); 390 case CUSE_ERR_SIGNAL: 391 return (EINTR); 392 case CUSE_ERR_NO_DEVICE: 393 return (ENODEV); 394 default: 395 return (ENXIO); 396 } 397 } 398 399 static void 400 cuse_vm_memory_free(struct cuse_memory *mem) 401 { 402 /* last user is gone - free */ 403 vm_object_deallocate(mem->object); 404 405 /* free CUSE memory */ 406 free(mem, M_CUSE); 407 } 408 409 static int 410 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr, 411 uint32_t page_count) 412 { 413 struct cuse_memory *temp; 414 struct cuse_memory *mem; 415 vm_object_t object; 416 int error; 417 418 mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO); 419 if (mem == NULL) 420 return (ENOMEM); 421 422 object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count, 423 VM_PROT_DEFAULT, 0, curthread->td_ucred); 424 if (object == NULL) { 425 error = ENOMEM; 426 goto error_0; 427 } 428 429 cuse_lock(); 430 /* check if allocation number already exists */ 431 TAILQ_FOREACH(temp, &pcs->hmem, entry) { 432 if (temp->alloc_nr == alloc_nr) 433 break; 434 } 435 if (temp != NULL) { 436 cuse_unlock(); 437 error = EBUSY; 438 goto error_1; 439 } 440 mem->object = object; 441 mem->page_count = page_count; 442 mem->alloc_nr = alloc_nr; 443 TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry); 444 cuse_unlock(); 445 446 return (0); 447 448 error_1: 449 vm_object_deallocate(object); 450 error_0: 451 free(mem, M_CUSE); 452 return (error); 453 } 454 455 static int 456 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr) 457 { 458 struct cuse_memory *mem; 459 460 cuse_lock(); 461 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 462 if (mem->alloc_nr == alloc_nr) 463 break; 464 } 465 if (mem == NULL) { 466 cuse_unlock(); 467 return (EINVAL); 468 } 469 TAILQ_REMOVE(&pcs->hmem, mem, entry); 470 cuse_unlock(); 471 472 cuse_vm_memory_free(mem); 473 474 return (0); 475 } 476 477 static int 478 cuse_client_get(struct cuse_client **ppcc) 479 { 480 struct cuse_client *pcc; 481 int error; 482 483 /* try to get private data */ 484 error = devfs_get_cdevpriv((void **)&pcc); 485 if (error != 0) { 486 *ppcc = NULL; 487 return (error); 488 } 489 /* check if closing */ 490 cuse_lock(); 491 if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) { 492 cuse_unlock(); 493 *ppcc = NULL; 494 return (EINVAL); 495 } 496 cuse_unlock(); 497 *ppcc = pcc; 498 return (0); 499 } 500 501 static void 502 cuse_client_is_closing(struct cuse_client *pcc) 503 { 504 struct cuse_client_command *pccmd; 505 uint32_t n; 506 507 if (CUSE_CLIENT_CLOSING(pcc)) 508 return; 509 510 pcc->cflags |= CUSE_CLI_IS_CLOSING; 511 pcc->server_dev = NULL; 512 513 for (n = 0; n != CUSE_CMD_MAX; n++) { 514 515 pccmd = &pcc->cmds[n]; 516 517 if (pccmd->entry.tqe_prev != NULL) { 518 TAILQ_REMOVE(&pcc->server->head, pccmd, entry); 519 pccmd->entry.tqe_prev = NULL; 520 } 521 cv_broadcast(&pccmd->cv); 522 } 523 } 524 525 static void 526 cuse_client_send_command_locked(struct cuse_client_command *pccmd, 527 uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag) 528 { 529 unsigned long cuse_fflags = 0; 530 struct cuse_server *pcs; 531 532 if (fflags & FREAD) 533 cuse_fflags |= CUSE_FFLAG_READ; 534 535 if (fflags & FWRITE) 536 cuse_fflags |= CUSE_FFLAG_WRITE; 537 538 if (ioflag & IO_NDELAY) 539 cuse_fflags |= CUSE_FFLAG_NONBLOCK; 540 #if defined(__LP64__) 541 if (SV_CURPROC_FLAG(SV_ILP32)) 542 cuse_fflags |= CUSE_FFLAG_COMPAT32; 543 #endif 544 pccmd->sub.fflags = cuse_fflags; 545 pccmd->sub.data_pointer = data_ptr; 546 pccmd->sub.argument = arg; 547 548 pcs = pccmd->client->server; 549 550 if ((pccmd->entry.tqe_prev == NULL) && 551 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 552 (pcs->is_closing == 0)) { 553 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 554 cv_signal(&pcs->cv); 555 } 556 } 557 558 static void 559 cuse_client_got_signal(struct cuse_client_command *pccmd) 560 { 561 struct cuse_server *pcs; 562 563 pccmd->got_signal = 1; 564 565 pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL]; 566 567 pcs = pccmd->client->server; 568 569 if ((pccmd->entry.tqe_prev == NULL) && 570 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) && 571 (pcs->is_closing == 0)) { 572 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry); 573 cv_signal(&pcs->cv); 574 } 575 } 576 577 static int 578 cuse_client_receive_command_locked(struct cuse_client_command *pccmd, 579 uint8_t *arg_ptr, uint32_t arg_len) 580 { 581 int error; 582 583 error = 0; 584 585 pccmd->proc_curr = curthread->td_proc; 586 587 if (CUSE_CLIENT_CLOSING(pccmd->client) || 588 pccmd->client->server->is_closing) { 589 error = CUSE_ERR_OTHER; 590 goto done; 591 } 592 while (pccmd->command == CUSE_CMD_NONE) { 593 if (error != 0) { 594 cv_wait(&pccmd->cv, &cuse_mtx); 595 } else { 596 error = cv_wait_sig(&pccmd->cv, &cuse_mtx); 597 598 if (error != 0) 599 cuse_client_got_signal(pccmd); 600 } 601 if (CUSE_CLIENT_CLOSING(pccmd->client) || 602 pccmd->client->server->is_closing) { 603 error = CUSE_ERR_OTHER; 604 goto done; 605 } 606 } 607 608 error = pccmd->error; 609 pccmd->command = CUSE_CMD_NONE; 610 cv_signal(&pccmd->cv); 611 612 done: 613 614 /* wait until all process references are gone */ 615 616 pccmd->proc_curr = NULL; 617 618 while (pccmd->proc_refs != 0) 619 cv_wait(&pccmd->cv, &cuse_mtx); 620 621 return (error); 622 } 623 624 /*------------------------------------------------------------------------* 625 * CUSE SERVER PART 626 *------------------------------------------------------------------------*/ 627 628 static void 629 cuse_server_free_dev(struct cuse_server_dev *pcsd) 630 { 631 struct cuse_server *pcs; 632 struct cuse_client *pcc; 633 634 /* get server pointer */ 635 pcs = pcsd->server; 636 637 /* prevent creation of more devices */ 638 cuse_lock(); 639 if (pcsd->kern_dev != NULL) 640 pcsd->kern_dev->si_drv1 = NULL; 641 642 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 643 if (pcc->server_dev == pcsd) 644 cuse_client_is_closing(pcc); 645 } 646 cuse_unlock(); 647 648 /* destroy device, if any */ 649 if (pcsd->kern_dev != NULL) { 650 /* destroy device synchronously */ 651 destroy_dev(pcsd->kern_dev); 652 } 653 free(pcsd, M_CUSE); 654 } 655 656 static void 657 cuse_server_unref(struct cuse_server *pcs) 658 { 659 struct cuse_server_dev *pcsd; 660 struct cuse_memory *mem; 661 662 cuse_lock(); 663 pcs->refs--; 664 if (pcs->refs != 0) { 665 cuse_unlock(); 666 return; 667 } 668 cuse_server_is_closing(pcs); 669 /* final client wakeup, if any */ 670 cuse_server_wakeup_all_client_locked(pcs); 671 672 TAILQ_REMOVE(&cuse_server_head, pcs, entry); 673 674 while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) { 675 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 676 cuse_unlock(); 677 cuse_server_free_dev(pcsd); 678 cuse_lock(); 679 } 680 681 cuse_free_unit_by_id_locked(pcs, -1); 682 683 while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) { 684 TAILQ_REMOVE(&pcs->hmem, mem, entry); 685 cuse_unlock(); 686 cuse_vm_memory_free(mem); 687 cuse_lock(); 688 } 689 690 knlist_clear(&pcs->selinfo.si_note, 1); 691 knlist_destroy(&pcs->selinfo.si_note); 692 693 cuse_unlock(); 694 695 seldrain(&pcs->selinfo); 696 697 cv_destroy(&pcs->cv); 698 699 free(pcs, M_CUSE); 700 } 701 702 static int 703 cuse_server_do_close(struct cuse_server *pcs) 704 { 705 int retval; 706 707 cuse_lock(); 708 cuse_server_is_closing(pcs); 709 /* final client wakeup, if any */ 710 cuse_server_wakeup_all_client_locked(pcs); 711 712 knlist_clear(&pcs->selinfo.si_note, 1); 713 714 retval = pcs->refs; 715 cuse_unlock(); 716 717 return (retval); 718 } 719 720 static void 721 cuse_server_free(void *arg) 722 { 723 struct cuse_server *pcs = arg; 724 725 /* 726 * The final server unref should be done by the server thread 727 * to prevent deadlock in the client cdevpriv destructor, 728 * which cannot destroy itself. 729 */ 730 while (cuse_server_do_close(pcs) != 1) 731 pause("W", hz); 732 733 /* drop final refcount */ 734 cuse_server_unref(pcs); 735 } 736 737 static int 738 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 739 { 740 struct cuse_server *pcs; 741 742 pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO); 743 if (pcs == NULL) 744 return (ENOMEM); 745 746 if (devfs_set_cdevpriv(pcs, &cuse_server_free)) { 747 printf("Cuse: Cannot set cdevpriv.\n"); 748 free(pcs, M_CUSE); 749 return (ENOMEM); 750 } 751 /* store current process ID */ 752 pcs->pid = curproc->p_pid; 753 754 TAILQ_INIT(&pcs->head); 755 TAILQ_INIT(&pcs->hdev); 756 TAILQ_INIT(&pcs->hcli); 757 TAILQ_INIT(&pcs->hmem); 758 759 cv_init(&pcs->cv, "cuse-server-cv"); 760 761 knlist_init_mtx(&pcs->selinfo.si_note, &cuse_mtx); 762 763 cuse_lock(); 764 pcs->refs++; 765 TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry); 766 cuse_unlock(); 767 768 return (0); 769 } 770 771 static int 772 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 773 { 774 struct cuse_server *pcs; 775 776 if (cuse_server_get(&pcs) == 0) 777 cuse_server_do_close(pcs); 778 779 return (0); 780 } 781 782 static int 783 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag) 784 { 785 return (ENXIO); 786 } 787 788 static int 789 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag) 790 { 791 return (ENXIO); 792 } 793 794 static int 795 cuse_server_ioctl_copy_locked(struct cuse_client_command *pccmd, 796 struct cuse_data_chunk *pchk, int isread) 797 { 798 struct proc *p_proc; 799 uint32_t offset; 800 int error; 801 802 offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR; 803 804 if (pchk->length > CUSE_BUFFER_MAX) 805 return (EFAULT); 806 807 if (offset >= CUSE_BUFFER_MAX) 808 return (EFAULT); 809 810 if ((offset + pchk->length) > CUSE_BUFFER_MAX) 811 return (EFAULT); 812 813 p_proc = pccmd->proc_curr; 814 if (p_proc == NULL) 815 return (ENXIO); 816 817 if (pccmd->proc_refs < 0) 818 return (ENOMEM); 819 820 pccmd->proc_refs++; 821 822 cuse_unlock(); 823 824 if (isread == 0) { 825 error = copyin( 826 (void *)pchk->local_ptr, 827 pccmd->client->ioctl_buffer + offset, 828 pchk->length); 829 } else { 830 error = copyout( 831 pccmd->client->ioctl_buffer + offset, 832 (void *)pchk->local_ptr, 833 pchk->length); 834 } 835 836 cuse_lock(); 837 838 pccmd->proc_refs--; 839 840 if (pccmd->proc_curr == NULL) 841 cv_signal(&pccmd->cv); 842 843 return (error); 844 } 845 846 static int 847 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s, 848 struct proc *proc_d, vm_offset_t data_d, size_t len) 849 { 850 struct thread *td; 851 struct proc *proc_cur; 852 int error; 853 854 td = curthread; 855 proc_cur = td->td_proc; 856 857 if (proc_cur == proc_d) { 858 struct iovec iov = { 859 .iov_base = (caddr_t)data_d, 860 .iov_len = len, 861 }; 862 struct uio uio = { 863 .uio_iov = &iov, 864 .uio_iovcnt = 1, 865 .uio_offset = (off_t)data_s, 866 .uio_resid = len, 867 .uio_segflg = UIO_USERSPACE, 868 .uio_rw = UIO_READ, 869 .uio_td = td, 870 }; 871 872 PHOLD(proc_s); 873 error = proc_rwmem(proc_s, &uio); 874 PRELE(proc_s); 875 876 } else if (proc_cur == proc_s) { 877 struct iovec iov = { 878 .iov_base = (caddr_t)data_s, 879 .iov_len = len, 880 }; 881 struct uio uio = { 882 .uio_iov = &iov, 883 .uio_iovcnt = 1, 884 .uio_offset = (off_t)data_d, 885 .uio_resid = len, 886 .uio_segflg = UIO_USERSPACE, 887 .uio_rw = UIO_WRITE, 888 .uio_td = td, 889 }; 890 891 PHOLD(proc_d); 892 error = proc_rwmem(proc_d, &uio); 893 PRELE(proc_d); 894 } else { 895 error = EINVAL; 896 } 897 return (error); 898 } 899 900 static int 901 cuse_server_data_copy_locked(struct cuse_client_command *pccmd, 902 struct cuse_data_chunk *pchk, int isread) 903 { 904 struct proc *p_proc; 905 int error; 906 907 p_proc = pccmd->proc_curr; 908 if (p_proc == NULL) 909 return (ENXIO); 910 911 if (pccmd->proc_refs < 0) 912 return (ENOMEM); 913 914 pccmd->proc_refs++; 915 916 cuse_unlock(); 917 918 if (isread == 0) { 919 error = cuse_proc2proc_copy( 920 curthread->td_proc, pchk->local_ptr, 921 p_proc, pchk->peer_ptr, 922 pchk->length); 923 } else { 924 error = cuse_proc2proc_copy( 925 p_proc, pchk->peer_ptr, 926 curthread->td_proc, pchk->local_ptr, 927 pchk->length); 928 } 929 930 cuse_lock(); 931 932 pccmd->proc_refs--; 933 934 if (pccmd->proc_curr == NULL) 935 cv_signal(&pccmd->cv); 936 937 return (error); 938 } 939 940 static int 941 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id) 942 { 943 int n; 944 int x = 0; 945 int match; 946 947 do { 948 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) { 949 if (cuse_alloc_unit[n] != NULL) { 950 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK) 951 continue; 952 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) { 953 x++; 954 match = 1; 955 } 956 } 957 } 958 } while (match); 959 960 if (x < 256) { 961 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 962 if (cuse_alloc_unit[n] == NULL) { 963 cuse_alloc_unit[n] = pcs; 964 cuse_alloc_unit_id[n] = id | x; 965 return (x); 966 } 967 } 968 } 969 return (-1); 970 } 971 972 static void 973 cuse_server_wakeup_locked(struct cuse_server *pcs) 974 { 975 selwakeup(&pcs->selinfo); 976 KNOTE_LOCKED(&pcs->selinfo.si_note, 0); 977 } 978 979 static void 980 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs) 981 { 982 struct cuse_client *pcc; 983 984 TAILQ_FOREACH(pcc, &pcs->hcli, entry) { 985 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ | 986 CUSE_CLI_KNOTE_NEED_WRITE); 987 } 988 cuse_server_wakeup_locked(pcs); 989 } 990 991 static int 992 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id) 993 { 994 int n; 995 int found = 0; 996 997 for (n = 0; n != CUSE_DEVICES_MAX; n++) { 998 if (cuse_alloc_unit[n] == pcs) { 999 if (cuse_alloc_unit_id[n] == id || id == -1) { 1000 cuse_alloc_unit[n] = NULL; 1001 cuse_alloc_unit_id[n] = 0; 1002 found = 1; 1003 } 1004 } 1005 } 1006 1007 return (found ? 0 : EINVAL); 1008 } 1009 1010 static int 1011 cuse_server_ioctl(struct cdev *dev, unsigned long cmd, 1012 caddr_t data, int fflag, struct thread *td) 1013 { 1014 struct cuse_server *pcs; 1015 int error; 1016 1017 error = cuse_server_get(&pcs); 1018 if (error != 0) 1019 return (error); 1020 1021 switch (cmd) { 1022 struct cuse_client_command *pccmd; 1023 struct cuse_client *pcc; 1024 struct cuse_command *pcmd; 1025 struct cuse_alloc_info *pai; 1026 struct cuse_create_dev *pcd; 1027 struct cuse_server_dev *pcsd; 1028 struct cuse_data_chunk *pchk; 1029 int n; 1030 1031 case CUSE_IOCTL_GET_COMMAND: 1032 pcmd = (void *)data; 1033 1034 cuse_lock(); 1035 1036 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) { 1037 error = cv_wait_sig(&pcs->cv, &cuse_mtx); 1038 1039 if (pcs->is_closing) 1040 error = ENXIO; 1041 1042 if (error) { 1043 cuse_unlock(); 1044 return (error); 1045 } 1046 } 1047 1048 TAILQ_REMOVE(&pcs->head, pccmd, entry); 1049 pccmd->entry.tqe_prev = NULL; 1050 1051 pccmd->entered = curthread; 1052 1053 *pcmd = pccmd->sub; 1054 1055 cuse_unlock(); 1056 1057 break; 1058 1059 case CUSE_IOCTL_SYNC_COMMAND: 1060 1061 cuse_lock(); 1062 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) { 1063 1064 /* send sync command */ 1065 pccmd->entered = NULL; 1066 pccmd->error = *(int *)data; 1067 pccmd->command = CUSE_CMD_SYNC; 1068 1069 /* signal peer, if any */ 1070 cv_signal(&pccmd->cv); 1071 } 1072 cuse_unlock(); 1073 1074 break; 1075 1076 case CUSE_IOCTL_ALLOC_UNIT: 1077 1078 cuse_lock(); 1079 n = cuse_alloc_unit_by_id_locked(pcs, 1080 CUSE_ID_DEFAULT(0)); 1081 cuse_unlock(); 1082 1083 if (n < 0) 1084 error = ENOMEM; 1085 else 1086 *(int *)data = n; 1087 break; 1088 1089 case CUSE_IOCTL_ALLOC_UNIT_BY_ID: 1090 1091 n = *(int *)data; 1092 1093 n = (n & CUSE_ID_MASK); 1094 1095 cuse_lock(); 1096 n = cuse_alloc_unit_by_id_locked(pcs, n); 1097 cuse_unlock(); 1098 1099 if (n < 0) 1100 error = ENOMEM; 1101 else 1102 *(int *)data = n; 1103 break; 1104 1105 case CUSE_IOCTL_FREE_UNIT: 1106 1107 n = *(int *)data; 1108 1109 n = CUSE_ID_DEFAULT(n); 1110 1111 cuse_lock(); 1112 error = cuse_free_unit_by_id_locked(pcs, n); 1113 cuse_unlock(); 1114 break; 1115 1116 case CUSE_IOCTL_FREE_UNIT_BY_ID: 1117 1118 n = *(int *)data; 1119 1120 cuse_lock(); 1121 error = cuse_free_unit_by_id_locked(pcs, n); 1122 cuse_unlock(); 1123 break; 1124 1125 case CUSE_IOCTL_ALLOC_MEMORY: 1126 1127 pai = (void *)data; 1128 1129 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1130 error = ENOMEM; 1131 break; 1132 } 1133 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) { 1134 error = ENOMEM; 1135 break; 1136 } 1137 error = cuse_server_alloc_memory(pcs, 1138 pai->alloc_nr, pai->page_count); 1139 break; 1140 1141 case CUSE_IOCTL_FREE_MEMORY: 1142 pai = (void *)data; 1143 1144 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) { 1145 error = ENOMEM; 1146 break; 1147 } 1148 error = cuse_server_free_memory(pcs, pai->alloc_nr); 1149 break; 1150 1151 case CUSE_IOCTL_GET_SIG: 1152 1153 cuse_lock(); 1154 pccmd = cuse_server_find_command(pcs, curthread); 1155 1156 if (pccmd != NULL) { 1157 n = pccmd->got_signal; 1158 pccmd->got_signal = 0; 1159 } else { 1160 n = 0; 1161 } 1162 cuse_unlock(); 1163 1164 *(int *)data = n; 1165 1166 break; 1167 1168 case CUSE_IOCTL_SET_PFH: 1169 1170 cuse_lock(); 1171 pccmd = cuse_server_find_command(pcs, curthread); 1172 1173 if (pccmd != NULL) { 1174 pcc = pccmd->client; 1175 for (n = 0; n != CUSE_CMD_MAX; n++) { 1176 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data; 1177 } 1178 } else { 1179 error = ENXIO; 1180 } 1181 cuse_unlock(); 1182 break; 1183 1184 case CUSE_IOCTL_CREATE_DEV: 1185 1186 error = priv_check(curthread, PRIV_DRIVER); 1187 if (error) 1188 break; 1189 1190 pcd = (void *)data; 1191 1192 /* filter input */ 1193 1194 pcd->devname[sizeof(pcd->devname) - 1] = 0; 1195 1196 if (pcd->devname[0] == 0) { 1197 error = EINVAL; 1198 break; 1199 } 1200 cuse_str_filter(pcd->devname); 1201 1202 pcd->permissions &= 0777; 1203 1204 /* try to allocate a character device */ 1205 1206 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO); 1207 1208 if (pcsd == NULL) { 1209 error = ENOMEM; 1210 break; 1211 } 1212 pcsd->server = pcs; 1213 1214 pcsd->user_dev = pcd->dev; 1215 1216 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME, 1217 &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id, 1218 pcd->permissions, "%s", pcd->devname); 1219 1220 if (pcsd->kern_dev == NULL) { 1221 free(pcsd, M_CUSE); 1222 error = ENOMEM; 1223 break; 1224 } 1225 pcsd->kern_dev->si_drv1 = pcsd; 1226 1227 cuse_lock(); 1228 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry); 1229 cuse_unlock(); 1230 1231 break; 1232 1233 case CUSE_IOCTL_DESTROY_DEV: 1234 1235 error = priv_check(curthread, PRIV_DRIVER); 1236 if (error) 1237 break; 1238 1239 cuse_lock(); 1240 1241 error = EINVAL; 1242 1243 pcsd = TAILQ_FIRST(&pcs->hdev); 1244 while (pcsd != NULL) { 1245 if (pcsd->user_dev == *(struct cuse_dev **)data) { 1246 TAILQ_REMOVE(&pcs->hdev, pcsd, entry); 1247 cuse_unlock(); 1248 cuse_server_free_dev(pcsd); 1249 cuse_lock(); 1250 error = 0; 1251 pcsd = TAILQ_FIRST(&pcs->hdev); 1252 } else { 1253 pcsd = TAILQ_NEXT(pcsd, entry); 1254 } 1255 } 1256 1257 cuse_unlock(); 1258 break; 1259 1260 case CUSE_IOCTL_WRITE_DATA: 1261 case CUSE_IOCTL_READ_DATA: 1262 1263 cuse_lock(); 1264 pchk = (struct cuse_data_chunk *)data; 1265 1266 pccmd = cuse_server_find_command(pcs, curthread); 1267 1268 if (pccmd == NULL) { 1269 error = ENXIO; /* invalid request */ 1270 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) { 1271 error = EFAULT; /* NULL pointer */ 1272 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) { 1273 error = cuse_server_ioctl_copy_locked(pccmd, 1274 pchk, cmd == CUSE_IOCTL_READ_DATA); 1275 } else { 1276 error = cuse_server_data_copy_locked(pccmd, 1277 pchk, cmd == CUSE_IOCTL_READ_DATA); 1278 } 1279 cuse_unlock(); 1280 break; 1281 1282 case CUSE_IOCTL_SELWAKEUP: 1283 cuse_lock(); 1284 /* 1285 * We don't know which direction caused the event. 1286 * Wakeup both! 1287 */ 1288 cuse_server_wakeup_all_client_locked(pcs); 1289 cuse_unlock(); 1290 break; 1291 1292 default: 1293 error = ENXIO; 1294 break; 1295 } 1296 return (error); 1297 } 1298 1299 static int 1300 cuse_server_poll(struct cdev *dev, int events, struct thread *td) 1301 { 1302 return (events & (POLLHUP | POLLPRI | POLLIN | 1303 POLLRDNORM | POLLOUT | POLLWRNORM)); 1304 } 1305 1306 static int 1307 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1308 vm_size_t size, struct vm_object **object, int nprot) 1309 { 1310 uint32_t page_nr = *offset / PAGE_SIZE; 1311 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1312 struct cuse_memory *mem; 1313 struct cuse_server *pcs; 1314 int error; 1315 1316 error = cuse_server_get(&pcs); 1317 if (error != 0) 1318 return (error); 1319 1320 cuse_lock(); 1321 /* lookup memory structure */ 1322 TAILQ_FOREACH(mem, &pcs->hmem, entry) { 1323 if (mem->alloc_nr == alloc_nr) 1324 break; 1325 } 1326 if (mem == NULL) { 1327 cuse_unlock(); 1328 return (ENOMEM); 1329 } 1330 /* verify page offset */ 1331 page_nr %= CUSE_ALLOC_PAGES_MAX; 1332 if (page_nr >= mem->page_count) { 1333 cuse_unlock(); 1334 return (ENXIO); 1335 } 1336 /* verify mmap size */ 1337 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1338 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1339 cuse_unlock(); 1340 return (EINVAL); 1341 } 1342 vm_object_reference(mem->object); 1343 *object = mem->object; 1344 cuse_unlock(); 1345 1346 /* set new VM object offset to use */ 1347 *offset = page_nr * PAGE_SIZE; 1348 1349 /* success */ 1350 return (0); 1351 } 1352 1353 /*------------------------------------------------------------------------* 1354 * CUSE CLIENT PART 1355 *------------------------------------------------------------------------*/ 1356 static void 1357 cuse_client_free(void *arg) 1358 { 1359 struct cuse_client *pcc = arg; 1360 struct cuse_client_command *pccmd; 1361 struct cuse_server *pcs; 1362 int n; 1363 1364 cuse_lock(); 1365 cuse_client_is_closing(pcc); 1366 TAILQ_REMOVE(&pcc->server->hcli, pcc, entry); 1367 cuse_unlock(); 1368 1369 for (n = 0; n != CUSE_CMD_MAX; n++) { 1370 1371 pccmd = &pcc->cmds[n]; 1372 1373 sx_destroy(&pccmd->sx); 1374 cv_destroy(&pccmd->cv); 1375 } 1376 1377 pcs = pcc->server; 1378 1379 free(pcc, M_CUSE); 1380 1381 /* drop reference on server */ 1382 cuse_server_unref(pcs); 1383 } 1384 1385 static int 1386 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td) 1387 { 1388 struct cuse_client_command *pccmd; 1389 struct cuse_server_dev *pcsd; 1390 struct cuse_client *pcc; 1391 struct cuse_server *pcs; 1392 struct cuse_dev *pcd; 1393 int error; 1394 int n; 1395 1396 cuse_lock(); 1397 pcsd = dev->si_drv1; 1398 if (pcsd != NULL) { 1399 pcs = pcsd->server; 1400 pcd = pcsd->user_dev; 1401 /* 1402 * Check that the refcount didn't wrap and that the 1403 * same process is not both client and server. This 1404 * can easily lead to deadlocks when destroying the 1405 * CUSE character device nodes: 1406 */ 1407 pcs->refs++; 1408 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) { 1409 /* overflow or wrong PID */ 1410 pcs->refs--; 1411 pcsd = NULL; 1412 } 1413 } else { 1414 pcs = NULL; 1415 pcd = NULL; 1416 } 1417 cuse_unlock(); 1418 1419 if (pcsd == NULL) 1420 return (EINVAL); 1421 1422 pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO); 1423 if (pcc == NULL) { 1424 /* drop reference on server */ 1425 cuse_server_unref(pcs); 1426 return (ENOMEM); 1427 } 1428 if (devfs_set_cdevpriv(pcc, &cuse_client_free)) { 1429 printf("Cuse: Cannot set cdevpriv.\n"); 1430 /* drop reference on server */ 1431 cuse_server_unref(pcs); 1432 free(pcc, M_CUSE); 1433 return (ENOMEM); 1434 } 1435 pcc->fflags = fflags; 1436 pcc->server_dev = pcsd; 1437 pcc->server = pcs; 1438 1439 for (n = 0; n != CUSE_CMD_MAX; n++) { 1440 1441 pccmd = &pcc->cmds[n]; 1442 1443 pccmd->sub.dev = pcd; 1444 pccmd->sub.command = n; 1445 pccmd->client = pcc; 1446 1447 sx_init(&pccmd->sx, "cuse-client-sx"); 1448 cv_init(&pccmd->cv, "cuse-client-cv"); 1449 } 1450 1451 cuse_lock(); 1452 1453 /* cuse_client_free() assumes that the client is listed somewhere! */ 1454 /* always enqueue */ 1455 1456 TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry); 1457 1458 /* check if server is closing */ 1459 if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) { 1460 error = EINVAL; 1461 } else { 1462 error = 0; 1463 } 1464 cuse_unlock(); 1465 1466 if (error) { 1467 devfs_clear_cdevpriv(); /* XXX bugfix */ 1468 return (error); 1469 } 1470 pccmd = &pcc->cmds[CUSE_CMD_OPEN]; 1471 1472 cuse_cmd_lock(pccmd); 1473 1474 cuse_lock(); 1475 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1476 1477 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1478 cuse_unlock(); 1479 1480 if (error < 0) { 1481 error = cuse_convert_error(error); 1482 } else { 1483 error = 0; 1484 } 1485 1486 cuse_cmd_unlock(pccmd); 1487 1488 if (error) 1489 devfs_clear_cdevpriv(); /* XXX bugfix */ 1490 1491 return (error); 1492 } 1493 1494 static int 1495 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td) 1496 { 1497 struct cuse_client_command *pccmd; 1498 struct cuse_client *pcc; 1499 int error; 1500 1501 error = cuse_client_get(&pcc); 1502 if (error != 0) 1503 return (0); 1504 1505 pccmd = &pcc->cmds[CUSE_CMD_CLOSE]; 1506 1507 cuse_cmd_lock(pccmd); 1508 1509 cuse_lock(); 1510 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0); 1511 1512 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1513 cuse_unlock(); 1514 1515 cuse_cmd_unlock(pccmd); 1516 1517 cuse_lock(); 1518 cuse_client_is_closing(pcc); 1519 cuse_unlock(); 1520 1521 return (0); 1522 } 1523 1524 static void 1525 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc) 1526 { 1527 int temp; 1528 1529 cuse_lock(); 1530 temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ | 1531 CUSE_CLI_KNOTE_HAS_WRITE)); 1532 pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ | 1533 CUSE_CLI_KNOTE_NEED_WRITE); 1534 cuse_unlock(); 1535 1536 if (temp != 0) { 1537 /* get the latest polling state from the server */ 1538 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL); 1539 1540 if (temp & (POLLIN | POLLOUT)) { 1541 cuse_lock(); 1542 if (temp & POLLIN) 1543 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ; 1544 if (temp & POLLOUT) 1545 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE; 1546 1547 /* make sure the "knote" gets woken up */ 1548 cuse_server_wakeup_locked(pcc->server); 1549 cuse_unlock(); 1550 } 1551 } 1552 } 1553 1554 static int 1555 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag) 1556 { 1557 struct cuse_client_command *pccmd; 1558 struct cuse_client *pcc; 1559 int error; 1560 int len; 1561 1562 error = cuse_client_get(&pcc); 1563 if (error != 0) 1564 return (error); 1565 1566 pccmd = &pcc->cmds[CUSE_CMD_READ]; 1567 1568 if (uio->uio_segflg != UIO_USERSPACE) { 1569 return (EINVAL); 1570 } 1571 uio->uio_segflg = UIO_NOCOPY; 1572 1573 cuse_cmd_lock(pccmd); 1574 1575 while (uio->uio_resid != 0) { 1576 1577 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1578 error = ENOMEM; 1579 break; 1580 } 1581 len = uio->uio_iov->iov_len; 1582 1583 cuse_lock(); 1584 cuse_client_send_command_locked(pccmd, 1585 (uintptr_t)uio->uio_iov->iov_base, 1586 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1587 1588 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1589 cuse_unlock(); 1590 1591 if (error < 0) { 1592 error = cuse_convert_error(error); 1593 break; 1594 } else if (error == len) { 1595 error = uiomove(NULL, error, uio); 1596 if (error) 1597 break; 1598 } else { 1599 error = uiomove(NULL, error, uio); 1600 break; 1601 } 1602 } 1603 cuse_cmd_unlock(pccmd); 1604 1605 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1606 1607 if (error == EWOULDBLOCK) 1608 cuse_client_kqfilter_poll(dev, pcc); 1609 1610 return (error); 1611 } 1612 1613 static int 1614 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag) 1615 { 1616 struct cuse_client_command *pccmd; 1617 struct cuse_client *pcc; 1618 int error; 1619 int len; 1620 1621 error = cuse_client_get(&pcc); 1622 if (error != 0) 1623 return (error); 1624 1625 pccmd = &pcc->cmds[CUSE_CMD_WRITE]; 1626 1627 if (uio->uio_segflg != UIO_USERSPACE) { 1628 return (EINVAL); 1629 } 1630 uio->uio_segflg = UIO_NOCOPY; 1631 1632 cuse_cmd_lock(pccmd); 1633 1634 while (uio->uio_resid != 0) { 1635 1636 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) { 1637 error = ENOMEM; 1638 break; 1639 } 1640 len = uio->uio_iov->iov_len; 1641 1642 cuse_lock(); 1643 cuse_client_send_command_locked(pccmd, 1644 (uintptr_t)uio->uio_iov->iov_base, 1645 (unsigned long)(unsigned int)len, pcc->fflags, ioflag); 1646 1647 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1648 cuse_unlock(); 1649 1650 if (error < 0) { 1651 error = cuse_convert_error(error); 1652 break; 1653 } else if (error == len) { 1654 error = uiomove(NULL, error, uio); 1655 if (error) 1656 break; 1657 } else { 1658 error = uiomove(NULL, error, uio); 1659 break; 1660 } 1661 } 1662 cuse_cmd_unlock(pccmd); 1663 1664 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */ 1665 1666 if (error == EWOULDBLOCK) 1667 cuse_client_kqfilter_poll(dev, pcc); 1668 1669 return (error); 1670 } 1671 1672 int 1673 cuse_client_ioctl(struct cdev *dev, unsigned long cmd, 1674 caddr_t data, int fflag, struct thread *td) 1675 { 1676 struct cuse_client_command *pccmd; 1677 struct cuse_client *pcc; 1678 int error; 1679 int len; 1680 1681 error = cuse_client_get(&pcc); 1682 if (error != 0) 1683 return (error); 1684 1685 len = IOCPARM_LEN(cmd); 1686 if (len > CUSE_BUFFER_MAX) 1687 return (ENOMEM); 1688 1689 pccmd = &pcc->cmds[CUSE_CMD_IOCTL]; 1690 1691 cuse_cmd_lock(pccmd); 1692 1693 if (cmd & (IOC_IN | IOC_VOID)) 1694 memcpy(pcc->ioctl_buffer, data, len); 1695 1696 /* 1697 * When the ioctl-length is zero drivers can pass information 1698 * through the data pointer of the ioctl. Make sure this information 1699 * is forwarded to the driver. 1700 */ 1701 1702 cuse_lock(); 1703 cuse_client_send_command_locked(pccmd, 1704 (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR, 1705 (unsigned long)cmd, pcc->fflags, 1706 (fflag & O_NONBLOCK) ? IO_NDELAY : 0); 1707 1708 error = cuse_client_receive_command_locked(pccmd, data, len); 1709 cuse_unlock(); 1710 1711 if (error < 0) { 1712 error = cuse_convert_error(error); 1713 } else { 1714 error = 0; 1715 } 1716 1717 if (cmd & IOC_OUT) 1718 memcpy(data, pcc->ioctl_buffer, len); 1719 1720 cuse_cmd_unlock(pccmd); 1721 1722 if (error == EWOULDBLOCK) 1723 cuse_client_kqfilter_poll(dev, pcc); 1724 1725 return (error); 1726 } 1727 1728 static int 1729 cuse_client_poll(struct cdev *dev, int events, struct thread *td) 1730 { 1731 struct cuse_client_command *pccmd; 1732 struct cuse_client *pcc; 1733 unsigned long temp; 1734 int error; 1735 int revents; 1736 1737 error = cuse_client_get(&pcc); 1738 if (error != 0) 1739 goto pollnval; 1740 1741 temp = 0; 1742 1743 if (events & (POLLPRI | POLLIN | POLLRDNORM)) 1744 temp |= CUSE_POLL_READ; 1745 1746 if (events & (POLLOUT | POLLWRNORM)) 1747 temp |= CUSE_POLL_WRITE; 1748 1749 if (events & POLLHUP) 1750 temp |= CUSE_POLL_ERROR; 1751 1752 pccmd = &pcc->cmds[CUSE_CMD_POLL]; 1753 1754 cuse_cmd_lock(pccmd); 1755 1756 /* Need to selrecord() first to not loose any events. */ 1757 if (temp != 0 && td != NULL) 1758 selrecord(td, &pcc->server->selinfo); 1759 1760 cuse_lock(); 1761 cuse_client_send_command_locked(pccmd, 1762 0, temp, pcc->fflags, IO_NDELAY); 1763 1764 error = cuse_client_receive_command_locked(pccmd, 0, 0); 1765 cuse_unlock(); 1766 1767 cuse_cmd_unlock(pccmd); 1768 1769 if (error < 0) { 1770 goto pollnval; 1771 } else { 1772 revents = 0; 1773 if (error & CUSE_POLL_READ) 1774 revents |= (events & (POLLPRI | POLLIN | POLLRDNORM)); 1775 if (error & CUSE_POLL_WRITE) 1776 revents |= (events & (POLLOUT | POLLWRNORM)); 1777 if (error & CUSE_POLL_ERROR) 1778 revents |= (events & POLLHUP); 1779 } 1780 return (revents); 1781 1782 pollnval: 1783 /* XXX many clients don't understand POLLNVAL */ 1784 return (events & (POLLHUP | POLLPRI | POLLIN | 1785 POLLRDNORM | POLLOUT | POLLWRNORM)); 1786 } 1787 1788 static int 1789 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset, 1790 vm_size_t size, struct vm_object **object, int nprot) 1791 { 1792 uint32_t page_nr = *offset / PAGE_SIZE; 1793 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX; 1794 struct cuse_memory *mem; 1795 struct cuse_client *pcc; 1796 int error; 1797 1798 error = cuse_client_get(&pcc); 1799 if (error != 0) 1800 return (error); 1801 1802 cuse_lock(); 1803 /* lookup memory structure */ 1804 TAILQ_FOREACH(mem, &pcc->server->hmem, entry) { 1805 if (mem->alloc_nr == alloc_nr) 1806 break; 1807 } 1808 if (mem == NULL) { 1809 cuse_unlock(); 1810 return (ENOMEM); 1811 } 1812 /* verify page offset */ 1813 page_nr %= CUSE_ALLOC_PAGES_MAX; 1814 if (page_nr >= mem->page_count) { 1815 cuse_unlock(); 1816 return (ENXIO); 1817 } 1818 /* verify mmap size */ 1819 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) || 1820 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) { 1821 cuse_unlock(); 1822 return (EINVAL); 1823 } 1824 vm_object_reference(mem->object); 1825 *object = mem->object; 1826 cuse_unlock(); 1827 1828 /* set new VM object offset to use */ 1829 *offset = page_nr * PAGE_SIZE; 1830 1831 /* success */ 1832 return (0); 1833 } 1834 1835 static void 1836 cuse_client_kqfilter_read_detach(struct knote *kn) 1837 { 1838 struct cuse_client *pcc; 1839 1840 cuse_lock(); 1841 pcc = kn->kn_hook; 1842 knlist_remove(&pcc->server->selinfo.si_note, kn, 1); 1843 cuse_unlock(); 1844 } 1845 1846 static void 1847 cuse_client_kqfilter_write_detach(struct knote *kn) 1848 { 1849 struct cuse_client *pcc; 1850 1851 cuse_lock(); 1852 pcc = kn->kn_hook; 1853 knlist_remove(&pcc->server->selinfo.si_note, kn, 1); 1854 cuse_unlock(); 1855 } 1856 1857 static int 1858 cuse_client_kqfilter_read_event(struct knote *kn, long hint) 1859 { 1860 struct cuse_client *pcc; 1861 1862 mtx_assert(&cuse_mtx, MA_OWNED); 1863 1864 pcc = kn->kn_hook; 1865 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0); 1866 } 1867 1868 static int 1869 cuse_client_kqfilter_write_event(struct knote *kn, long hint) 1870 { 1871 struct cuse_client *pcc; 1872 1873 mtx_assert(&cuse_mtx, MA_OWNED); 1874 1875 pcc = kn->kn_hook; 1876 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0); 1877 } 1878 1879 static int 1880 cuse_client_kqfilter(struct cdev *dev, struct knote *kn) 1881 { 1882 struct cuse_client *pcc; 1883 struct cuse_server *pcs; 1884 int error; 1885 1886 error = cuse_client_get(&pcc); 1887 if (error != 0) 1888 return (error); 1889 1890 cuse_lock(); 1891 pcs = pcc->server; 1892 switch (kn->kn_filter) { 1893 case EVFILT_READ: 1894 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ; 1895 kn->kn_hook = pcc; 1896 kn->kn_fop = &cuse_client_kqfilter_read_ops; 1897 knlist_add(&pcs->selinfo.si_note, kn, 1); 1898 break; 1899 case EVFILT_WRITE: 1900 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE; 1901 kn->kn_hook = pcc; 1902 kn->kn_fop = &cuse_client_kqfilter_write_ops; 1903 knlist_add(&pcs->selinfo.si_note, kn, 1); 1904 break; 1905 default: 1906 error = EINVAL; 1907 break; 1908 } 1909 cuse_unlock(); 1910 1911 if (error == 0) 1912 cuse_client_kqfilter_poll(dev, pcc); 1913 return (error); 1914 } 1915