3 * Copyright (c) 2010-2020 Hans Petter Selasky. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 #include <sys/stdint.h>
28 #include <sys/stddef.h>
29 #include <sys/param.h>
30 #include <sys/types.h>
31 #include <sys/systm.h>
33 #include <sys/kernel.h>
35 #include <sys/linker_set.h>
36 #include <sys/module.h>
38 #include <sys/mutex.h>
39 #include <sys/condvar.h>
40 #include <sys/sysctl.h>
41 #include <sys/unistd.h>
42 #include <sys/malloc.h>
47 #include <sys/rwlock.h>
48 #include <sys/queue.h>
49 #include <sys/fcntl.h>
51 #include <sys/vnode.h>
52 #include <sys/selinfo.h>
53 #include <sys/ptrace.h>
54 #include <sys/sysent.h>
56 #include <machine/bus.h>
60 #include <vm/vm_object.h>
61 #include <vm/vm_page.h>
62 #include <vm/vm_pager.h>
64 #include <fs/cuse/cuse_defs.h>
65 #include <fs/cuse/cuse_ioctl.h>
67 MODULE_VERSION(cuse, 1);
70 * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by
71 * declaring support for the cuse4bsd interface in cuse.ko:
73 MODULE_VERSION(cuse4bsd, 1);
76 FEATURE(cuse, "Userspace character devices");
83 struct cuse_client_command {
84 TAILQ_ENTRY(cuse_client_command) entry;
85 struct cuse_command sub;
88 struct thread *entered;
89 struct cuse_client *client;
90 struct proc *proc_curr;
98 TAILQ_ENTRY(cuse_memory) entry;
104 struct cuse_server_dev {
105 TAILQ_ENTRY(cuse_server_dev) entry;
106 struct cuse_server *server;
107 struct cdev *kern_dev;
108 struct cuse_dev *user_dev;
112 TAILQ_ENTRY(cuse_server) entry;
113 TAILQ_HEAD(, cuse_client_command) head;
114 TAILQ_HEAD(, cuse_server_dev) hdev;
115 TAILQ_HEAD(, cuse_client) hcli;
116 TAILQ_HEAD(, cuse_memory) hmem;
119 struct selinfo selinfo;
126 TAILQ_ENTRY(cuse_client) entry;
127 TAILQ_ENTRY(cuse_client) entry_ref;
128 struct cuse_client_command cmds[CUSE_CMD_MAX];
129 struct cuse_server *server;
130 struct cuse_server_dev *server_dev;
132 uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4);
134 int fflags; /* file flags */
135 int cflags; /* client flags */
136 #define CUSE_CLI_IS_CLOSING 0x01
137 #define CUSE_CLI_KNOTE_NEED_READ 0x02
138 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04
139 #define CUSE_CLI_KNOTE_HAS_READ 0x08
140 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10
143 #define CUSE_CLIENT_CLOSING(pcc) \
144 ((pcc)->cflags & CUSE_CLI_IS_CLOSING)
146 static MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory");
148 static TAILQ_HEAD(, cuse_server) cuse_server_head;
149 static struct mtx cuse_global_mtx;
150 static struct cdev *cuse_dev;
151 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX];
152 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX];
154 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs);
155 static void cuse_client_kqfilter_read_detach(struct knote *kn);
156 static void cuse_client_kqfilter_write_detach(struct knote *kn);
157 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint);
158 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint);
160 static struct filterops cuse_client_kqfilter_read_ops = {
162 .f_detach = cuse_client_kqfilter_read_detach,
163 .f_event = cuse_client_kqfilter_read_event,
166 static struct filterops cuse_client_kqfilter_write_ops = {
168 .f_detach = cuse_client_kqfilter_write_detach,
169 .f_event = cuse_client_kqfilter_write_event,
172 static d_open_t cuse_client_open;
173 static d_close_t cuse_client_close;
174 static d_ioctl_t cuse_client_ioctl;
175 static d_read_t cuse_client_read;
176 static d_write_t cuse_client_write;
177 static d_poll_t cuse_client_poll;
178 static d_mmap_single_t cuse_client_mmap_single;
179 static d_kqfilter_t cuse_client_kqfilter;
181 static struct cdevsw cuse_client_devsw = {
182 .d_version = D_VERSION,
183 .d_open = cuse_client_open,
184 .d_close = cuse_client_close,
185 .d_ioctl = cuse_client_ioctl,
186 .d_name = "cuse_client",
187 .d_flags = D_TRACKCLOSE,
188 .d_read = cuse_client_read,
189 .d_write = cuse_client_write,
190 .d_poll = cuse_client_poll,
191 .d_mmap_single = cuse_client_mmap_single,
192 .d_kqfilter = cuse_client_kqfilter,
195 static d_open_t cuse_server_open;
196 static d_close_t cuse_server_close;
197 static d_ioctl_t cuse_server_ioctl;
198 static d_read_t cuse_server_read;
199 static d_write_t cuse_server_write;
200 static d_poll_t cuse_server_poll;
201 static d_mmap_single_t cuse_server_mmap_single;
203 static struct cdevsw cuse_server_devsw = {
204 .d_version = D_VERSION,
205 .d_open = cuse_server_open,
206 .d_close = cuse_server_close,
207 .d_ioctl = cuse_server_ioctl,
208 .d_name = "cuse_server",
209 .d_flags = D_TRACKCLOSE,
210 .d_read = cuse_server_read,
211 .d_write = cuse_server_write,
212 .d_poll = cuse_server_poll,
213 .d_mmap_single = cuse_server_mmap_single,
216 static void cuse_client_is_closing(struct cuse_client *);
217 static int cuse_free_unit_by_id_locked(struct cuse_server *, int);
220 cuse_global_lock(void)
222 mtx_lock(&cuse_global_mtx);
226 cuse_global_unlock(void)
228 mtx_unlock(&cuse_global_mtx);
232 cuse_server_lock(struct cuse_server *pcs)
238 cuse_server_unlock(struct cuse_server *pcs)
240 mtx_unlock(&pcs->mtx);
244 cuse_cmd_lock(struct cuse_client_command *pccmd)
246 sx_xlock(&pccmd->sx);
250 cuse_cmd_unlock(struct cuse_client_command *pccmd)
252 sx_xunlock(&pccmd->sx);
256 cuse_kern_init(void *arg)
258 TAILQ_INIT(&cuse_server_head);
260 mtx_init(&cuse_global_mtx, "cuse-global-mtx", NULL, MTX_DEF);
262 cuse_dev = make_dev(&cuse_server_devsw, 0,
263 UID_ROOT, GID_OPERATOR, 0600, "cuse");
265 printf("Cuse v%d.%d.%d @ /dev/cuse\n",
266 (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF,
267 (CUSE_VERSION >> 0) & 0xFF);
269 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL);
272 cuse_kern_uninit(void *arg)
278 printf("Cuse: Please exit all /dev/cuse instances "
279 "and processes which have used this device.\n");
281 pause("DRAIN", 2 * hz);
284 ptr = TAILQ_FIRST(&cuse_server_head);
285 cuse_global_unlock();
291 if (cuse_dev != NULL)
292 destroy_dev(cuse_dev);
294 mtx_destroy(&cuse_global_mtx);
296 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0);
299 cuse_server_get(struct cuse_server **ppcs)
301 struct cuse_server *pcs;
304 error = devfs_get_cdevpriv((void **)&pcs);
309 if (pcs->is_closing) {
318 cuse_server_is_closing(struct cuse_server *pcs)
320 struct cuse_client *pcc;
327 TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
328 cuse_client_is_closing(pcc);
332 static struct cuse_client_command *
333 cuse_server_find_command(struct cuse_server *pcs, struct thread *td)
335 struct cuse_client *pcc;
341 TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
342 if (CUSE_CLIENT_CLOSING(pcc))
344 for (n = 0; n != CUSE_CMD_MAX; n++) {
345 if (pcc->cmds[n].entered == td)
346 return (&pcc->cmds[n]);
354 cuse_str_filter(char *ptr)
358 while (((c = *ptr) != 0)) {
360 if ((c >= 'a') && (c <= 'z')) {
364 if ((c >= 'A') && (c <= 'Z')) {
368 if ((c >= '0') && (c <= '9')) {
372 if ((c == '.') || (c == '_') || (c == '/')) {
383 cuse_convert_error(int error)
391 case CUSE_ERR_WOULDBLOCK:
392 return (EWOULDBLOCK);
393 case CUSE_ERR_INVALID:
395 case CUSE_ERR_NO_MEMORY:
399 case CUSE_ERR_SIGNAL:
401 case CUSE_ERR_NO_DEVICE:
409 cuse_vm_memory_free(struct cuse_memory *mem)
411 /* last user is gone - free */
412 vm_object_deallocate(mem->object);
414 /* free CUSE memory */
419 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr,
422 struct cuse_memory *temp;
423 struct cuse_memory *mem;
427 mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO);
431 object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count,
432 VM_PROT_DEFAULT, 0, curthread->td_ucred);
433 if (object == NULL) {
438 cuse_server_lock(pcs);
439 /* check if allocation number already exists */
440 TAILQ_FOREACH(temp, &pcs->hmem, entry) {
441 if (temp->alloc_nr == alloc_nr)
445 cuse_server_unlock(pcs);
449 mem->object = object;
450 mem->page_count = page_count;
451 mem->alloc_nr = alloc_nr;
452 TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry);
453 cuse_server_unlock(pcs);
458 vm_object_deallocate(object);
465 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr)
467 struct cuse_memory *mem;
469 cuse_server_lock(pcs);
470 TAILQ_FOREACH(mem, &pcs->hmem, entry) {
471 if (mem->alloc_nr == alloc_nr)
475 cuse_server_unlock(pcs);
478 TAILQ_REMOVE(&pcs->hmem, mem, entry);
479 cuse_server_unlock(pcs);
481 cuse_vm_memory_free(mem);
487 cuse_client_get(struct cuse_client **ppcc)
489 struct cuse_client *pcc;
492 /* try to get private data */
493 error = devfs_get_cdevpriv((void **)&pcc);
498 if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) {
507 cuse_client_is_closing(struct cuse_client *pcc)
509 struct cuse_client_command *pccmd;
512 if (CUSE_CLIENT_CLOSING(pcc))
515 pcc->cflags |= CUSE_CLI_IS_CLOSING;
516 pcc->server_dev = NULL;
518 for (n = 0; n != CUSE_CMD_MAX; n++) {
520 pccmd = &pcc->cmds[n];
522 if (pccmd->entry.tqe_prev != NULL) {
523 TAILQ_REMOVE(&pcc->server->head, pccmd, entry);
524 pccmd->entry.tqe_prev = NULL;
526 cv_broadcast(&pccmd->cv);
531 cuse_client_send_command_locked(struct cuse_client_command *pccmd,
532 uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag)
534 unsigned long cuse_fflags = 0;
535 struct cuse_server *pcs;
538 cuse_fflags |= CUSE_FFLAG_READ;
541 cuse_fflags |= CUSE_FFLAG_WRITE;
543 if (ioflag & IO_NDELAY)
544 cuse_fflags |= CUSE_FFLAG_NONBLOCK;
545 #if defined(__LP64__)
546 if (SV_CURPROC_FLAG(SV_ILP32))
547 cuse_fflags |= CUSE_FFLAG_COMPAT32;
549 pccmd->sub.fflags = cuse_fflags;
550 pccmd->sub.data_pointer = data_ptr;
551 pccmd->sub.argument = arg;
553 pcs = pccmd->client->server;
555 if ((pccmd->entry.tqe_prev == NULL) &&
556 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
557 (pcs->is_closing == 0)) {
558 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
564 cuse_client_got_signal(struct cuse_client_command *pccmd)
566 struct cuse_server *pcs;
568 pccmd->got_signal = 1;
570 pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL];
572 pcs = pccmd->client->server;
574 if ((pccmd->entry.tqe_prev == NULL) &&
575 (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
576 (pcs->is_closing == 0)) {
577 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
583 cuse_client_receive_command_locked(struct cuse_client_command *pccmd,
584 uint8_t *arg_ptr, uint32_t arg_len)
586 struct cuse_server *pcs;
589 pcs = pccmd->client->server;
592 pccmd->proc_curr = curthread->td_proc;
594 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
595 error = CUSE_ERR_OTHER;
598 while (pccmd->command == CUSE_CMD_NONE) {
600 cv_wait(&pccmd->cv, &pcs->mtx);
602 error = cv_wait_sig(&pccmd->cv, &pcs->mtx);
605 cuse_client_got_signal(pccmd);
607 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
608 error = CUSE_ERR_OTHER;
613 error = pccmd->error;
614 pccmd->command = CUSE_CMD_NONE;
615 cv_signal(&pccmd->cv);
619 /* wait until all process references are gone */
621 pccmd->proc_curr = NULL;
623 while (pccmd->proc_refs != 0)
624 cv_wait(&pccmd->cv, &pcs->mtx);
629 /*------------------------------------------------------------------------*
631 *------------------------------------------------------------------------*/
634 cuse_server_free_dev(struct cuse_server_dev *pcsd)
636 struct cuse_server *pcs;
637 struct cuse_client *pcc;
639 /* get server pointer */
642 /* prevent creation of more devices */
643 cuse_server_lock(pcs);
644 if (pcsd->kern_dev != NULL)
645 pcsd->kern_dev->si_drv1 = NULL;
647 TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
648 if (pcc->server_dev == pcsd)
649 cuse_client_is_closing(pcc);
651 cuse_server_unlock(pcs);
653 /* destroy device, if any */
654 if (pcsd->kern_dev != NULL) {
655 /* destroy device synchronously */
656 destroy_dev(pcsd->kern_dev);
662 cuse_server_unref(struct cuse_server *pcs)
664 struct cuse_server_dev *pcsd;
665 struct cuse_memory *mem;
667 cuse_server_lock(pcs);
668 if (--(pcs->refs) != 0) {
669 cuse_server_unlock(pcs);
672 cuse_server_is_closing(pcs);
673 /* final client wakeup, if any */
674 cuse_server_wakeup_all_client_locked(pcs);
677 TAILQ_REMOVE(&cuse_server_head, pcs, entry);
678 cuse_global_unlock();
680 while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) {
681 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
682 cuse_server_unlock(pcs);
683 cuse_server_free_dev(pcsd);
684 cuse_server_lock(pcs);
687 cuse_free_unit_by_id_locked(pcs, -1);
689 while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) {
690 TAILQ_REMOVE(&pcs->hmem, mem, entry);
691 cuse_server_unlock(pcs);
692 cuse_vm_memory_free(mem);
693 cuse_server_lock(pcs);
696 knlist_clear(&pcs->selinfo.si_note, 1);
697 knlist_destroy(&pcs->selinfo.si_note);
699 cuse_server_unlock(pcs);
701 seldrain(&pcs->selinfo);
703 cv_destroy(&pcs->cv);
705 mtx_destroy(&pcs->mtx);
711 cuse_server_do_close(struct cuse_server *pcs)
715 cuse_server_lock(pcs);
716 cuse_server_is_closing(pcs);
717 /* final client wakeup, if any */
718 cuse_server_wakeup_all_client_locked(pcs);
720 knlist_clear(&pcs->selinfo.si_note, 1);
723 cuse_server_unlock(pcs);
729 cuse_server_free(void *arg)
731 struct cuse_server *pcs = arg;
734 * The final server unref should be done by the server thread
735 * to prevent deadlock in the client cdevpriv destructor,
736 * which cannot destroy itself.
738 while (cuse_server_do_close(pcs) != 1)
741 /* drop final refcount */
742 cuse_server_unref(pcs);
746 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
748 struct cuse_server *pcs;
750 pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO);
754 if (devfs_set_cdevpriv(pcs, &cuse_server_free)) {
755 printf("Cuse: Cannot set cdevpriv.\n");
759 /* store current process ID */
760 pcs->pid = curproc->p_pid;
762 TAILQ_INIT(&pcs->head);
763 TAILQ_INIT(&pcs->hdev);
764 TAILQ_INIT(&pcs->hcli);
765 TAILQ_INIT(&pcs->hmem);
767 cv_init(&pcs->cv, "cuse-server-cv");
769 mtx_init(&pcs->mtx, "cuse-server-mtx", NULL, MTX_DEF);
771 knlist_init_mtx(&pcs->selinfo.si_note, &pcs->mtx);
775 TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry);
776 cuse_global_unlock();
782 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
784 struct cuse_server *pcs;
786 if (cuse_server_get(&pcs) == 0)
787 cuse_server_do_close(pcs);
793 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag)
799 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag)
805 cuse_server_ioctl_copy_locked(struct cuse_server *pcs,
806 struct cuse_client_command *pccmd,
807 struct cuse_data_chunk *pchk, int isread)
813 offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR;
815 if (pchk->length > CUSE_BUFFER_MAX)
818 if (offset >= CUSE_BUFFER_MAX)
821 if ((offset + pchk->length) > CUSE_BUFFER_MAX)
824 p_proc = pccmd->proc_curr;
828 if (pccmd->proc_refs < 0)
833 cuse_server_unlock(pcs);
837 (void *)pchk->local_ptr,
838 pccmd->client->ioctl_buffer + offset,
842 pccmd->client->ioctl_buffer + offset,
843 (void *)pchk->local_ptr,
847 cuse_server_lock(pcs);
851 if (pccmd->proc_curr == NULL)
852 cv_signal(&pccmd->cv);
858 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s,
859 struct proc *proc_d, vm_offset_t data_d, size_t len)
862 struct proc *proc_cur;
866 proc_cur = td->td_proc;
868 if (proc_cur == proc_d) {
870 .iov_base = (caddr_t)data_d,
876 .uio_offset = (off_t)data_s,
878 .uio_segflg = UIO_USERSPACE,
884 error = proc_rwmem(proc_s, &uio);
887 } else if (proc_cur == proc_s) {
889 .iov_base = (caddr_t)data_s,
895 .uio_offset = (off_t)data_d,
897 .uio_segflg = UIO_USERSPACE,
903 error = proc_rwmem(proc_d, &uio);
912 cuse_server_data_copy_locked(struct cuse_server *pcs,
913 struct cuse_client_command *pccmd,
914 struct cuse_data_chunk *pchk, int isread)
919 p_proc = pccmd->proc_curr;
923 if (pccmd->proc_refs < 0)
928 cuse_server_unlock(pcs);
931 error = cuse_proc2proc_copy(
932 curthread->td_proc, pchk->local_ptr,
933 p_proc, pchk->peer_ptr,
936 error = cuse_proc2proc_copy(
937 p_proc, pchk->peer_ptr,
938 curthread->td_proc, pchk->local_ptr,
942 cuse_server_lock(pcs);
946 if (pccmd->proc_curr == NULL)
947 cv_signal(&pccmd->cv);
953 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id)
960 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) {
961 if (cuse_alloc_unit[n] != NULL) {
962 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK)
964 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) {
973 for (n = 0; n != CUSE_DEVICES_MAX; n++) {
974 if (cuse_alloc_unit[n] == NULL) {
975 cuse_alloc_unit[n] = pcs;
976 cuse_alloc_unit_id[n] = id | x;
985 cuse_server_wakeup_locked(struct cuse_server *pcs)
987 selwakeup(&pcs->selinfo);
988 KNOTE_LOCKED(&pcs->selinfo.si_note, 0);
992 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs)
994 struct cuse_client *pcc;
996 TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
997 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ |
998 CUSE_CLI_KNOTE_NEED_WRITE);
1000 cuse_server_wakeup_locked(pcs);
1004 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id)
1009 for (n = 0; n != CUSE_DEVICES_MAX; n++) {
1010 if (cuse_alloc_unit[n] == pcs) {
1011 if (cuse_alloc_unit_id[n] == id || id == -1) {
1012 cuse_alloc_unit[n] = NULL;
1013 cuse_alloc_unit_id[n] = 0;
1019 return (found ? 0 : EINVAL);
1023 cuse_server_ioctl(struct cdev *dev, unsigned long cmd,
1024 caddr_t data, int fflag, struct thread *td)
1026 struct cuse_server *pcs;
1029 error = cuse_server_get(&pcs);
1034 struct cuse_client_command *pccmd;
1035 struct cuse_client *pcc;
1036 struct cuse_command *pcmd;
1037 struct cuse_alloc_info *pai;
1038 struct cuse_create_dev *pcd;
1039 struct cuse_server_dev *pcsd;
1040 struct cuse_data_chunk *pchk;
1043 case CUSE_IOCTL_GET_COMMAND:
1044 pcmd = (void *)data;
1046 cuse_server_lock(pcs);
1048 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) {
1049 error = cv_wait_sig(&pcs->cv, &pcs->mtx);
1051 if (pcs->is_closing)
1055 cuse_server_unlock(pcs);
1060 TAILQ_REMOVE(&pcs->head, pccmd, entry);
1061 pccmd->entry.tqe_prev = NULL;
1063 pccmd->entered = curthread;
1067 cuse_server_unlock(pcs);
1071 case CUSE_IOCTL_SYNC_COMMAND:
1073 cuse_server_lock(pcs);
1074 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) {
1076 /* send sync command */
1077 pccmd->entered = NULL;
1078 pccmd->error = *(int *)data;
1079 pccmd->command = CUSE_CMD_SYNC;
1081 /* signal peer, if any */
1082 cv_signal(&pccmd->cv);
1084 cuse_server_unlock(pcs);
1088 case CUSE_IOCTL_ALLOC_UNIT:
1090 cuse_server_lock(pcs);
1091 n = cuse_alloc_unit_by_id_locked(pcs,
1092 CUSE_ID_DEFAULT(0));
1093 cuse_server_unlock(pcs);
1101 case CUSE_IOCTL_ALLOC_UNIT_BY_ID:
1105 n = (n & CUSE_ID_MASK);
1107 cuse_server_lock(pcs);
1108 n = cuse_alloc_unit_by_id_locked(pcs, n);
1109 cuse_server_unlock(pcs);
1117 case CUSE_IOCTL_FREE_UNIT:
1121 n = CUSE_ID_DEFAULT(n);
1123 cuse_server_lock(pcs);
1124 error = cuse_free_unit_by_id_locked(pcs, n);
1125 cuse_server_unlock(pcs);
1128 case CUSE_IOCTL_FREE_UNIT_BY_ID:
1132 cuse_server_lock(pcs);
1133 error = cuse_free_unit_by_id_locked(pcs, n);
1134 cuse_server_unlock(pcs);
1137 case CUSE_IOCTL_ALLOC_MEMORY:
1141 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1145 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) {
1149 error = cuse_server_alloc_memory(pcs,
1150 pai->alloc_nr, pai->page_count);
1153 case CUSE_IOCTL_FREE_MEMORY:
1156 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1160 error = cuse_server_free_memory(pcs, pai->alloc_nr);
1163 case CUSE_IOCTL_GET_SIG:
1165 cuse_server_lock(pcs);
1166 pccmd = cuse_server_find_command(pcs, curthread);
1168 if (pccmd != NULL) {
1169 n = pccmd->got_signal;
1170 pccmd->got_signal = 0;
1174 cuse_server_unlock(pcs);
1180 case CUSE_IOCTL_SET_PFH:
1182 cuse_server_lock(pcs);
1183 pccmd = cuse_server_find_command(pcs, curthread);
1185 if (pccmd != NULL) {
1186 pcc = pccmd->client;
1187 for (n = 0; n != CUSE_CMD_MAX; n++) {
1188 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data;
1193 cuse_server_unlock(pcs);
1196 case CUSE_IOCTL_CREATE_DEV:
1198 error = priv_check(curthread, PRIV_DRIVER);
1206 pcd->devname[sizeof(pcd->devname) - 1] = 0;
1208 if (pcd->devname[0] == 0) {
1212 cuse_str_filter(pcd->devname);
1214 pcd->permissions &= 0777;
1216 /* try to allocate a character device */
1218 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO);
1226 pcsd->user_dev = pcd->dev;
1228 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME,
1229 &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id,
1230 pcd->permissions, "%s", pcd->devname);
1232 if (pcsd->kern_dev == NULL) {
1237 pcsd->kern_dev->si_drv1 = pcsd;
1239 cuse_server_lock(pcs);
1240 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry);
1241 cuse_server_unlock(pcs);
1245 case CUSE_IOCTL_DESTROY_DEV:
1247 error = priv_check(curthread, PRIV_DRIVER);
1251 cuse_server_lock(pcs);
1255 pcsd = TAILQ_FIRST(&pcs->hdev);
1256 while (pcsd != NULL) {
1257 if (pcsd->user_dev == *(struct cuse_dev **)data) {
1258 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
1259 cuse_server_unlock(pcs);
1260 cuse_server_free_dev(pcsd);
1261 cuse_server_lock(pcs);
1263 pcsd = TAILQ_FIRST(&pcs->hdev);
1265 pcsd = TAILQ_NEXT(pcsd, entry);
1269 cuse_server_unlock(pcs);
1272 case CUSE_IOCTL_WRITE_DATA:
1273 case CUSE_IOCTL_READ_DATA:
1275 cuse_server_lock(pcs);
1276 pchk = (struct cuse_data_chunk *)data;
1278 pccmd = cuse_server_find_command(pcs, curthread);
1280 if (pccmd == NULL) {
1281 error = ENXIO; /* invalid request */
1282 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) {
1283 error = EFAULT; /* NULL pointer */
1284 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) {
1285 error = cuse_server_ioctl_copy_locked(pcs, pccmd,
1286 pchk, cmd == CUSE_IOCTL_READ_DATA);
1288 error = cuse_server_data_copy_locked(pcs, pccmd,
1289 pchk, cmd == CUSE_IOCTL_READ_DATA);
1291 cuse_server_unlock(pcs);
1294 case CUSE_IOCTL_SELWAKEUP:
1295 cuse_server_lock(pcs);
1297 * We don't know which direction caused the event.
1300 cuse_server_wakeup_all_client_locked(pcs);
1301 cuse_server_unlock(pcs);
1312 cuse_server_poll(struct cdev *dev, int events, struct thread *td)
1314 return (events & (POLLHUP | POLLPRI | POLLIN |
1315 POLLRDNORM | POLLOUT | POLLWRNORM));
1319 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1320 vm_size_t size, struct vm_object **object, int nprot)
1322 uint32_t page_nr = *offset / PAGE_SIZE;
1323 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1324 struct cuse_memory *mem;
1325 struct cuse_server *pcs;
1328 error = cuse_server_get(&pcs);
1332 cuse_server_lock(pcs);
1333 /* lookup memory structure */
1334 TAILQ_FOREACH(mem, &pcs->hmem, entry) {
1335 if (mem->alloc_nr == alloc_nr)
1339 cuse_server_unlock(pcs);
1342 /* verify page offset */
1343 page_nr %= CUSE_ALLOC_PAGES_MAX;
1344 if (page_nr >= mem->page_count) {
1345 cuse_server_unlock(pcs);
1348 /* verify mmap size */
1349 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1350 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1351 cuse_server_unlock(pcs);
1354 vm_object_reference(mem->object);
1355 *object = mem->object;
1356 cuse_server_unlock(pcs);
1358 /* set new VM object offset to use */
1359 *offset = page_nr * PAGE_SIZE;
1365 /*------------------------------------------------------------------------*
1367 *------------------------------------------------------------------------*/
1369 cuse_client_free(void *arg)
1371 struct cuse_client *pcc = arg;
1372 struct cuse_client_command *pccmd;
1373 struct cuse_server *pcs;
1378 cuse_server_lock(pcs);
1379 cuse_client_is_closing(pcc);
1380 TAILQ_REMOVE(&pcs->hcli, pcc, entry);
1381 cuse_server_unlock(pcs);
1383 for (n = 0; n != CUSE_CMD_MAX; n++) {
1385 pccmd = &pcc->cmds[n];
1387 sx_destroy(&pccmd->sx);
1388 cv_destroy(&pccmd->cv);
1393 /* drop reference on server */
1394 cuse_server_unref(pcs);
1398 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
1400 struct cuse_client_command *pccmd;
1401 struct cuse_server_dev *pcsd;
1402 struct cuse_client *pcc;
1403 struct cuse_server *pcs;
1404 struct cuse_dev *pcd;
1408 pcsd = dev->si_drv1;
1411 pcd = pcsd->user_dev;
1413 cuse_server_lock(pcs);
1415 * Check that the refcount didn't wrap and that the
1416 * same process is not both client and server. This
1417 * can easily lead to deadlocks when destroying the
1418 * CUSE character device nodes:
1421 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) {
1422 /* overflow or wrong PID */
1424 cuse_server_unlock(pcs);
1427 cuse_server_unlock(pcs);
1432 pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO);
1434 /* drop reference on server */
1435 cuse_server_unref(pcs);
1438 if (devfs_set_cdevpriv(pcc, &cuse_client_free)) {
1439 printf("Cuse: Cannot set cdevpriv.\n");
1440 /* drop reference on server */
1441 cuse_server_unref(pcs);
1445 pcc->fflags = fflags;
1446 pcc->server_dev = pcsd;
1449 for (n = 0; n != CUSE_CMD_MAX; n++) {
1451 pccmd = &pcc->cmds[n];
1453 pccmd->sub.dev = pcd;
1454 pccmd->sub.command = n;
1455 pccmd->client = pcc;
1457 sx_init(&pccmd->sx, "cuse-client-sx");
1458 cv_init(&pccmd->cv, "cuse-client-cv");
1461 cuse_server_lock(pcs);
1463 /* cuse_client_free() assumes that the client is listed somewhere! */
1464 /* always enqueue */
1466 TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry);
1468 /* check if server is closing */
1469 if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) {
1474 cuse_server_unlock(pcs);
1477 devfs_clear_cdevpriv(); /* XXX bugfix */
1480 pccmd = &pcc->cmds[CUSE_CMD_OPEN];
1482 cuse_cmd_lock(pccmd);
1484 cuse_server_lock(pcs);
1485 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1487 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1488 cuse_server_unlock(pcs);
1491 error = cuse_convert_error(error);
1496 cuse_cmd_unlock(pccmd);
1499 devfs_clear_cdevpriv(); /* XXX bugfix */
1505 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
1507 struct cuse_client_command *pccmd;
1508 struct cuse_client *pcc;
1509 struct cuse_server *pcs;
1512 error = cuse_client_get(&pcc);
1516 pccmd = &pcc->cmds[CUSE_CMD_CLOSE];
1519 cuse_cmd_lock(pccmd);
1521 cuse_server_lock(pcs);
1522 cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1524 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1525 cuse_cmd_unlock(pccmd);
1527 cuse_client_is_closing(pcc);
1528 cuse_server_unlock(pcs);
1534 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc)
1536 struct cuse_server *pcs = pcc->server;
1539 cuse_server_lock(pcs);
1540 temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ |
1541 CUSE_CLI_KNOTE_HAS_WRITE));
1542 pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ |
1543 CUSE_CLI_KNOTE_NEED_WRITE);
1544 cuse_server_unlock(pcs);
1547 /* get the latest polling state from the server */
1548 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL);
1550 if (temp & (POLLIN | POLLOUT)) {
1551 cuse_server_lock(pcs);
1553 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ;
1555 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE;
1557 /* make sure the "knote" gets woken up */
1558 cuse_server_wakeup_locked(pcc->server);
1559 cuse_server_unlock(pcs);
1565 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag)
1567 struct cuse_client_command *pccmd;
1568 struct cuse_client *pcc;
1569 struct cuse_server *pcs;
1573 error = cuse_client_get(&pcc);
1577 pccmd = &pcc->cmds[CUSE_CMD_READ];
1580 if (uio->uio_segflg != UIO_USERSPACE) {
1583 uio->uio_segflg = UIO_NOCOPY;
1585 cuse_cmd_lock(pccmd);
1587 while (uio->uio_resid != 0) {
1589 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1593 len = uio->uio_iov->iov_len;
1595 cuse_server_lock(pcs);
1596 cuse_client_send_command_locked(pccmd,
1597 (uintptr_t)uio->uio_iov->iov_base,
1598 (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1600 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1601 cuse_server_unlock(pcs);
1604 error = cuse_convert_error(error);
1606 } else if (error == len) {
1607 error = uiomove(NULL, error, uio);
1611 error = uiomove(NULL, error, uio);
1615 cuse_cmd_unlock(pccmd);
1617 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1619 if (error == EWOULDBLOCK)
1620 cuse_client_kqfilter_poll(dev, pcc);
1626 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag)
1628 struct cuse_client_command *pccmd;
1629 struct cuse_client *pcc;
1630 struct cuse_server *pcs;
1634 error = cuse_client_get(&pcc);
1638 pccmd = &pcc->cmds[CUSE_CMD_WRITE];
1641 if (uio->uio_segflg != UIO_USERSPACE) {
1644 uio->uio_segflg = UIO_NOCOPY;
1646 cuse_cmd_lock(pccmd);
1648 while (uio->uio_resid != 0) {
1650 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1654 len = uio->uio_iov->iov_len;
1656 cuse_server_lock(pcs);
1657 cuse_client_send_command_locked(pccmd,
1658 (uintptr_t)uio->uio_iov->iov_base,
1659 (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1661 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1662 cuse_server_unlock(pcs);
1665 error = cuse_convert_error(error);
1667 } else if (error == len) {
1668 error = uiomove(NULL, error, uio);
1672 error = uiomove(NULL, error, uio);
1676 cuse_cmd_unlock(pccmd);
1678 uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1680 if (error == EWOULDBLOCK)
1681 cuse_client_kqfilter_poll(dev, pcc);
1687 cuse_client_ioctl(struct cdev *dev, unsigned long cmd,
1688 caddr_t data, int fflag, struct thread *td)
1690 struct cuse_client_command *pccmd;
1691 struct cuse_client *pcc;
1692 struct cuse_server *pcs;
1696 error = cuse_client_get(&pcc);
1700 len = IOCPARM_LEN(cmd);
1701 if (len > CUSE_BUFFER_MAX)
1704 pccmd = &pcc->cmds[CUSE_CMD_IOCTL];
1707 cuse_cmd_lock(pccmd);
1709 if (cmd & (IOC_IN | IOC_VOID))
1710 memcpy(pcc->ioctl_buffer, data, len);
1713 * When the ioctl-length is zero drivers can pass information
1714 * through the data pointer of the ioctl. Make sure this information
1715 * is forwarded to the driver.
1718 cuse_server_lock(pcs);
1719 cuse_client_send_command_locked(pccmd,
1720 (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR,
1721 (unsigned long)cmd, pcc->fflags,
1722 (fflag & O_NONBLOCK) ? IO_NDELAY : 0);
1724 error = cuse_client_receive_command_locked(pccmd, data, len);
1725 cuse_server_unlock(pcs);
1728 error = cuse_convert_error(error);
1734 memcpy(data, pcc->ioctl_buffer, len);
1736 cuse_cmd_unlock(pccmd);
1738 if (error == EWOULDBLOCK)
1739 cuse_client_kqfilter_poll(dev, pcc);
1745 cuse_client_poll(struct cdev *dev, int events, struct thread *td)
1747 struct cuse_client_command *pccmd;
1748 struct cuse_client *pcc;
1749 struct cuse_server *pcs;
1754 error = cuse_client_get(&pcc);
1761 if (events & (POLLPRI | POLLIN | POLLRDNORM))
1762 temp |= CUSE_POLL_READ;
1764 if (events & (POLLOUT | POLLWRNORM))
1765 temp |= CUSE_POLL_WRITE;
1767 if (events & POLLHUP)
1768 temp |= CUSE_POLL_ERROR;
1770 pccmd = &pcc->cmds[CUSE_CMD_POLL];
1772 cuse_cmd_lock(pccmd);
1774 /* Need to selrecord() first to not loose any events. */
1775 if (temp != 0 && td != NULL)
1776 selrecord(td, &pcs->selinfo);
1778 cuse_server_lock(pcs);
1779 cuse_client_send_command_locked(pccmd,
1780 0, temp, pcc->fflags, IO_NDELAY);
1782 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1783 cuse_server_unlock(pcs);
1785 cuse_cmd_unlock(pccmd);
1791 if (error & CUSE_POLL_READ)
1792 revents |= (events & (POLLPRI | POLLIN | POLLRDNORM));
1793 if (error & CUSE_POLL_WRITE)
1794 revents |= (events & (POLLOUT | POLLWRNORM));
1795 if (error & CUSE_POLL_ERROR)
1796 revents |= (events & POLLHUP);
1801 /* XXX many clients don't understand POLLNVAL */
1802 return (events & (POLLHUP | POLLPRI | POLLIN |
1803 POLLRDNORM | POLLOUT | POLLWRNORM));
1807 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1808 vm_size_t size, struct vm_object **object, int nprot)
1810 uint32_t page_nr = *offset / PAGE_SIZE;
1811 uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1812 struct cuse_memory *mem;
1813 struct cuse_client *pcc;
1814 struct cuse_server *pcs;
1817 error = cuse_client_get(&pcc);
1823 cuse_server_lock(pcs);
1824 /* lookup memory structure */
1825 TAILQ_FOREACH(mem, &pcs->hmem, entry) {
1826 if (mem->alloc_nr == alloc_nr)
1830 cuse_server_unlock(pcs);
1833 /* verify page offset */
1834 page_nr %= CUSE_ALLOC_PAGES_MAX;
1835 if (page_nr >= mem->page_count) {
1836 cuse_server_unlock(pcs);
1839 /* verify mmap size */
1840 if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1841 (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1842 cuse_server_unlock(pcs);
1845 vm_object_reference(mem->object);
1846 *object = mem->object;
1847 cuse_server_unlock(pcs);
1849 /* set new VM object offset to use */
1850 *offset = page_nr * PAGE_SIZE;
1857 cuse_client_kqfilter_read_detach(struct knote *kn)
1859 struct cuse_client *pcc;
1860 struct cuse_server *pcs;
1865 cuse_server_lock(pcs);
1866 knlist_remove(&pcs->selinfo.si_note, kn, 1);
1867 cuse_server_unlock(pcs);
1871 cuse_client_kqfilter_write_detach(struct knote *kn)
1873 struct cuse_client *pcc;
1874 struct cuse_server *pcs;
1879 cuse_server_lock(pcs);
1880 knlist_remove(&pcs->selinfo.si_note, kn, 1);
1881 cuse_server_unlock(pcs);
1885 cuse_client_kqfilter_read_event(struct knote *kn, long hint)
1887 struct cuse_client *pcc;
1891 mtx_assert(&pcc->server->mtx, MA_OWNED);
1893 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0);
1897 cuse_client_kqfilter_write_event(struct knote *kn, long hint)
1899 struct cuse_client *pcc;
1903 mtx_assert(&pcc->server->mtx, MA_OWNED);
1905 return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0);
1909 cuse_client_kqfilter(struct cdev *dev, struct knote *kn)
1911 struct cuse_client *pcc;
1912 struct cuse_server *pcs;
1915 error = cuse_client_get(&pcc);
1921 cuse_server_lock(pcs);
1922 switch (kn->kn_filter) {
1924 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ;
1926 kn->kn_fop = &cuse_client_kqfilter_read_ops;
1927 knlist_add(&pcs->selinfo.si_note, kn, 1);
1930 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE;
1932 kn->kn_fop = &cuse_client_kqfilter_write_ops;
1933 knlist_add(&pcs->selinfo.si_note, kn, 1);
1939 cuse_server_unlock(pcs);
1942 cuse_client_kqfilter_poll(dev, pcc);