sys/fs/cuse/cuse.c

   1 /* $FreeBSD$ */
   2 /*-
   3  * Copyright (c) 2010-2020 Hans Petter Selasky. All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 #include <sys/stdint.h>
  28 #include <sys/stddef.h>
  29 #include <sys/param.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/conf.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/linker_set.h>
  36 #include <sys/module.h>
  37 #include <sys/lock.h>
  38 #include <sys/mutex.h>
  39 #include <sys/condvar.h>
  40 #include <sys/sysctl.h>
  41 #include <sys/unistd.h>
  42 #include <sys/malloc.h>
  43 #include <sys/priv.h>
  44 #include <sys/uio.h>
  45 #include <sys/poll.h>
  46 #include <sys/sx.h>
  47 #include <sys/rwlock.h>
  48 #include <sys/queue.h>
  49 #include <sys/fcntl.h>
  50 #include <sys/proc.h>
  51 #include <sys/vnode.h>
  52 #include <sys/selinfo.h>
  53 #include <sys/ptrace.h>
  54 #include <sys/sysent.h>
  55
  56 #include <machine/bus.h>
  57
  58 #include <vm/vm.h>
  59 #include <vm/pmap.h>
  60 #include <vm/vm_object.h>
  61 #include <vm/vm_page.h>
  62 #include <vm/vm_pager.h>
  63
  64 #include <fs/cuse/cuse_defs.h>
  65 #include <fs/cuse/cuse_ioctl.h>
  66
  67 MODULE_VERSION(cuse, 1);
  68
  69 /*
  70  * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by
  71  * declaring support for the cuse4bsd interface in cuse.ko:
  72  */
  73 MODULE_VERSION(cuse4bsd, 1);
  74
  75 #ifdef FEATURE
  76 FEATURE(cuse, "Userspace character devices");
  77 #endif
  78
  79 struct cuse_command;
  80 struct cuse_server;
  81 struct cuse_client;
  82
  83 struct cuse_client_command {
  84         TAILQ_ENTRY(cuse_client_command) entry;
  85         struct cuse_command sub;
  86         struct sx sx;
  87         struct cv cv;
  88         struct thread *entered;
  89         struct cuse_client *client;
  90         struct proc *proc_curr;
  91         int     proc_refs;
  92         int     got_signal;
  93         int     error;
  94         int     command;
  95 };
  96
  97 struct cuse_memory {
  98         TAILQ_ENTRY(cuse_memory) entry;
  99         vm_object_t object;
 100         uint32_t page_count;
 101         uint32_t alloc_nr;
 102 };
 103
 104 struct cuse_server_dev {
 105         TAILQ_ENTRY(cuse_server_dev) entry;
 106         struct cuse_server *server;
 107         struct cdev *kern_dev;
 108         struct cuse_dev *user_dev;
 109 };
 110
 111 struct cuse_server {
 112         TAILQ_ENTRY(cuse_server) entry;
 113         TAILQ_HEAD(, cuse_client_command) head;
 114         TAILQ_HEAD(, cuse_server_dev) hdev;
 115         TAILQ_HEAD(, cuse_client) hcli;
 116         TAILQ_HEAD(, cuse_memory) hmem;
 117         struct mtx mtx;
 118         struct cv cv;
 119         struct selinfo selinfo;
 120         pid_t   pid;
 121         int     is_closing;
 122         int     refs;
 123 };
 124
 125 struct cuse_client {
 126         TAILQ_ENTRY(cuse_client) entry;
 127         TAILQ_ENTRY(cuse_client) entry_ref;
 128         struct cuse_client_command cmds[CUSE_CMD_MAX];
 129         struct cuse_server *server;
 130         struct cuse_server_dev *server_dev;
 131
 132         uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4);
 133
 134         int     fflags;                 /* file flags */
 135         int     cflags;                 /* client flags */
 136 #define CUSE_CLI_IS_CLOSING 0x01
 137 #define CUSE_CLI_KNOTE_NEED_READ 0x02
 138 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04
 139 #define CUSE_CLI_KNOTE_HAS_READ 0x08
 140 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10
 141 };
 142
 143 #define CUSE_CLIENT_CLOSING(pcc) \
 144     ((pcc)->cflags & CUSE_CLI_IS_CLOSING)
 145
 146 static  MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory");
 147
 148 static TAILQ_HEAD(, cuse_server) cuse_server_head;
 149 static struct mtx cuse_global_mtx;
 150 static struct cdev *cuse_dev;
 151 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX];
 152 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX];
 153
 154 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs);
 155 static void cuse_client_kqfilter_read_detach(struct knote *kn);
 156 static void cuse_client_kqfilter_write_detach(struct knote *kn);
 157 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint);
 158 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint);
 159
 160 static struct filterops cuse_client_kqfilter_read_ops = {
 161         .f_isfd = 1,
 162         .f_detach = cuse_client_kqfilter_read_detach,
 163         .f_event = cuse_client_kqfilter_read_event,
 164 };
 165
 166 static struct filterops cuse_client_kqfilter_write_ops = {
 167         .f_isfd = 1,
 168         .f_detach = cuse_client_kqfilter_write_detach,
 169         .f_event = cuse_client_kqfilter_write_event,
 170 };
 171
 172 static d_open_t cuse_client_open;
 173 static d_close_t cuse_client_close;
 174 static d_ioctl_t cuse_client_ioctl;
 175 static d_read_t cuse_client_read;
 176 static d_write_t cuse_client_write;
 177 static d_poll_t cuse_client_poll;
 178 static d_mmap_single_t cuse_client_mmap_single;
 179 static d_kqfilter_t cuse_client_kqfilter;
 180
 181 static struct cdevsw cuse_client_devsw = {
 182         .d_version = D_VERSION,
 183         .d_open = cuse_client_open,
 184         .d_close = cuse_client_close,
 185         .d_ioctl = cuse_client_ioctl,
 186         .d_name = "cuse_client",
 187         .d_flags = D_TRACKCLOSE,
 188         .d_read = cuse_client_read,
 189         .d_write = cuse_client_write,
 190         .d_poll = cuse_client_poll,
 191         .d_mmap_single = cuse_client_mmap_single,
 192         .d_kqfilter = cuse_client_kqfilter,
 193 };
 194
 195 static d_open_t cuse_server_open;
 196 static d_close_t cuse_server_close;
 197 static d_ioctl_t cuse_server_ioctl;
 198 static d_read_t cuse_server_read;
 199 static d_write_t cuse_server_write;
 200 static d_poll_t cuse_server_poll;
 201 static d_mmap_single_t cuse_server_mmap_single;
 202
 203 static struct cdevsw cuse_server_devsw = {
 204         .d_version = D_VERSION,
 205         .d_open = cuse_server_open,
 206         .d_close = cuse_server_close,
 207         .d_ioctl = cuse_server_ioctl,
 208         .d_name = "cuse_server",
 209         .d_flags = D_TRACKCLOSE,
 210         .d_read = cuse_server_read,
 211         .d_write = cuse_server_write,
 212         .d_poll = cuse_server_poll,
 213         .d_mmap_single = cuse_server_mmap_single,
 214 };
 215
 216 static void cuse_client_is_closing(struct cuse_client *);
 217 static int cuse_free_unit_by_id_locked(struct cuse_server *, int);
 218
 219 static void
 220 cuse_global_lock(void)
 221 {
 222         mtx_lock(&cuse_global_mtx);
 223 }
 224
 225 static void
 226 cuse_global_unlock(void)
 227 {
 228         mtx_unlock(&cuse_global_mtx);
 229 }
 230
 231 static void
 232 cuse_server_lock(struct cuse_server *pcs)
 233 {
 234         mtx_lock(&pcs->mtx);
 235 }
 236
 237 static void
 238 cuse_server_unlock(struct cuse_server *pcs)
 239 {
 240         mtx_unlock(&pcs->mtx);
 241 }
 242
 243 static void
 244 cuse_cmd_lock(struct cuse_client_command *pccmd)
 245 {
 246         sx_xlock(&pccmd->sx);
 247 }
 248
 249 static void
 250 cuse_cmd_unlock(struct cuse_client_command *pccmd)
 251 {
 252         sx_xunlock(&pccmd->sx);
 253 }
 254
 255 static void
 256 cuse_kern_init(void *arg)
 257 {
 258         TAILQ_INIT(&cuse_server_head);
 259
 260         mtx_init(&cuse_global_mtx, "cuse-global-mtx", NULL, MTX_DEF);
 261
 262         cuse_dev = make_dev(&cuse_server_devsw, 0,
 263             UID_ROOT, GID_OPERATOR, 0600, "cuse");
 264
 265         printf("Cuse v%d.%d.%d @ /dev/cuse\n",
 266             (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF,
 267             (CUSE_VERSION >> 0) & 0xFF);
 268 }
 269 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL);
 270
 271 static void
 272 cuse_kern_uninit(void *arg)
 273 {
 274         void *ptr;
 275
 276         while (1) {
 277
 278                 printf("Cuse: Please exit all /dev/cuse instances "
 279                     "and processes which have used this device.\n");
 280
 281                 pause("DRAIN", 2 * hz);
 282
 283                 cuse_global_lock();
 284                 ptr = TAILQ_FIRST(&cuse_server_head);
 285                 cuse_global_unlock();
 286
 287                 if (ptr == NULL)
 288                         break;
 289         }
 290
 291         if (cuse_dev != NULL)
 292                 destroy_dev(cuse_dev);
 293
 294         mtx_destroy(&cuse_global_mtx);
 295 }
 296 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0);
 297
 298 static int
 299 cuse_server_get(struct cuse_server **ppcs)
 300 {
 301         struct cuse_server *pcs;
 302         int error;
 303
 304         error = devfs_get_cdevpriv((void **)&pcs);
 305         if (error != 0) {
 306                 *ppcs = NULL;
 307                 return (error);
 308         }
 309         if (pcs->is_closing) {
 310                 *ppcs = NULL;
 311                 return (EINVAL);
 312         }
 313         *ppcs = pcs;
 314         return (0);
 315 }
 316
 317 static void
 318 cuse_server_is_closing(struct cuse_server *pcs)
 319 {
 320         struct cuse_client *pcc;
 321
 322         if (pcs->is_closing)
 323                 return;
 324
 325         pcs->is_closing = 1;
 326
 327         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 328                 cuse_client_is_closing(pcc);
 329         }
 330 }
 331
 332 static struct cuse_client_command *
 333 cuse_server_find_command(struct cuse_server *pcs, struct thread *td)
 334 {
 335         struct cuse_client *pcc;
 336         int n;
 337
 338         if (pcs->is_closing)
 339                 goto done;
 340
 341         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 342                 if (CUSE_CLIENT_CLOSING(pcc))
 343                         continue;
 344                 for (n = 0; n != CUSE_CMD_MAX; n++) {
 345                         if (pcc->cmds[n].entered == td)
 346                                 return (&pcc->cmds[n]);
 347                 }
 348         }
 349 done:
 350         return (NULL);
 351 }
 352
 353 static void
 354 cuse_str_filter(char *ptr)
 355 {
 356         int c;
 357
 358         while (((c = *ptr) != 0)) {
 359
 360                 if ((c >= 'a') && (c <= 'z')) {
 361                         ptr++;
 362                         continue;
 363                 }
 364                 if ((c >= 'A') && (c <= 'Z')) {
 365                         ptr++;
 366                         continue;
 367                 }
 368                 if ((c >= '0') && (c <= '9')) {
 369                         ptr++;
 370                         continue;
 371                 }
 372                 if ((c == '.') || (c == '_') || (c == '/')) {
 373                         ptr++;
 374                         continue;
 375                 }
 376                 *ptr = '_';
 377
 378                 ptr++;
 379         }
 380 }
 381
 382 static int
 383 cuse_convert_error(int error)
 384 {
 385         ;                               /* indent fix */
 386         switch (error) {
 387         case CUSE_ERR_NONE:
 388                 return (0);
 389         case CUSE_ERR_BUSY:
 390                 return (EBUSY);
 391         case CUSE_ERR_WOULDBLOCK:
 392                 return (EWOULDBLOCK);
 393         case CUSE_ERR_INVALID:
 394                 return (EINVAL);
 395         case CUSE_ERR_NO_MEMORY:
 396                 return (ENOMEM);
 397         case CUSE_ERR_FAULT:
 398                 return (EFAULT);
 399         case CUSE_ERR_SIGNAL:
 400                 return (EINTR);
 401         case CUSE_ERR_NO_DEVICE:
 402                 return (ENODEV);
 403         default:
 404                 return (ENXIO);
 405         }
 406 }
 407
 408 static void
 409 cuse_vm_memory_free(struct cuse_memory *mem)
 410 {
 411         /* last user is gone - free */
 412         vm_object_deallocate(mem->object);
 413
 414         /* free CUSE memory */
 415         free(mem, M_CUSE);
 416 }
 417
 418 static int
 419 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr,
 420     uint32_t page_count)
 421 {
 422         struct cuse_memory *temp;
 423         struct cuse_memory *mem;
 424         vm_object_t object;
 425         int error;
 426
 427         mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO);
 428         if (mem == NULL)
 429                 return (ENOMEM);
 430
 431         object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count,
 432             VM_PROT_DEFAULT, 0, curthread->td_ucred);
 433         if (object == NULL) {
 434                 error = ENOMEM;
 435                 goto error_0;
 436         }
 437
 438         cuse_server_lock(pcs);
 439         /* check if allocation number already exists */
 440         TAILQ_FOREACH(temp, &pcs->hmem, entry) {
 441                 if (temp->alloc_nr == alloc_nr)
 442                         break;
 443         }
 444         if (temp != NULL) {
 445                 cuse_server_unlock(pcs);
 446                 error = EBUSY;
 447                 goto error_1;
 448         }
 449         mem->object = object;
 450         mem->page_count = page_count;
 451         mem->alloc_nr = alloc_nr;
 452         TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry);
 453         cuse_server_unlock(pcs);
 454
 455         return (0);
 456
 457 error_1:
 458         vm_object_deallocate(object);
 459 error_0:
 460         free(mem, M_CUSE);
 461         return (error);
 462 }
 463
 464 static int
 465 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr)
 466 {
 467         struct cuse_memory *mem;
 468
 469         cuse_server_lock(pcs);
 470         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
 471                 if (mem->alloc_nr == alloc_nr)
 472                         break;
 473         }
 474         if (mem == NULL) {
 475                 cuse_server_unlock(pcs);
 476                 return (EINVAL);
 477         }
 478         TAILQ_REMOVE(&pcs->hmem, mem, entry);
 479         cuse_server_unlock(pcs);
 480
 481         cuse_vm_memory_free(mem);
 482
 483         return (0);
 484 }
 485
 486 static int
 487 cuse_client_get(struct cuse_client **ppcc)
 488 {
 489         struct cuse_client *pcc;
 490         int error;
 491
 492         /* try to get private data */
 493         error = devfs_get_cdevpriv((void **)&pcc);
 494         if (error != 0) {
 495                 *ppcc = NULL;
 496                 return (error);
 497         }
 498         if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) {
 499                 *ppcc = NULL;
 500                 return (EINVAL);
 501         }
 502         *ppcc = pcc;
 503         return (0);
 504 }
 505
 506 static void
 507 cuse_client_is_closing(struct cuse_client *pcc)
 508 {
 509         struct cuse_client_command *pccmd;
 510         uint32_t n;
 511
 512         if (CUSE_CLIENT_CLOSING(pcc))
 513                 return;
 514
 515         pcc->cflags |= CUSE_CLI_IS_CLOSING;
 516         pcc->server_dev = NULL;
 517
 518         for (n = 0; n != CUSE_CMD_MAX; n++) {
 519
 520                 pccmd = &pcc->cmds[n];
 521
 522                 if (pccmd->entry.tqe_prev != NULL) {
 523                         TAILQ_REMOVE(&pcc->server->head, pccmd, entry);
 524                         pccmd->entry.tqe_prev = NULL;
 525                 }
 526                 cv_broadcast(&pccmd->cv);
 527         }
 528 }
 529
 530 static void
 531 cuse_client_send_command_locked(struct cuse_client_command *pccmd,
 532     uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag)
 533 {
 534         unsigned long cuse_fflags = 0;
 535         struct cuse_server *pcs;
 536
 537         if (fflags & FREAD)
 538                 cuse_fflags |= CUSE_FFLAG_READ;
 539
 540         if (fflags & FWRITE)
 541                 cuse_fflags |= CUSE_FFLAG_WRITE;
 542
 543         if (ioflag & IO_NDELAY)
 544                 cuse_fflags |= CUSE_FFLAG_NONBLOCK;
 545 #if defined(__LP64__)
 546         if (SV_CURPROC_FLAG(SV_ILP32))
 547                 cuse_fflags |= CUSE_FFLAG_COMPAT32;
 548 #endif
 549         pccmd->sub.fflags = cuse_fflags;
 550         pccmd->sub.data_pointer = data_ptr;
 551         pccmd->sub.argument = arg;
 552
 553         pcs = pccmd->client->server;
 554
 555         if ((pccmd->entry.tqe_prev == NULL) &&
 556             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
 557             (pcs->is_closing == 0)) {
 558                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
 559                 cv_signal(&pcs->cv);
 560         }
 561 }
 562
 563 static void
 564 cuse_client_got_signal(struct cuse_client_command *pccmd)
 565 {
 566         struct cuse_server *pcs;
 567
 568         pccmd->got_signal = 1;
 569
 570         pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL];
 571
 572         pcs = pccmd->client->server;
 573
 574         if ((pccmd->entry.tqe_prev == NULL) &&
 575             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
 576             (pcs->is_closing == 0)) {
 577                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
 578                 cv_signal(&pcs->cv);
 579         }
 580 }
 581
 582 static int
 583 cuse_client_receive_command_locked(struct cuse_client_command *pccmd,
 584     uint8_t *arg_ptr, uint32_t arg_len)
 585 {
 586         struct cuse_server *pcs;
 587         int error;
 588
 589         pcs = pccmd->client->server;
 590         error = 0;
 591
 592         pccmd->proc_curr = curthread->td_proc;
 593
 594         if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
 595                 error = CUSE_ERR_OTHER;
 596                 goto done;
 597         }
 598         while (pccmd->command == CUSE_CMD_NONE) {
 599                 if (error != 0) {
 600                         cv_wait(&pccmd->cv, &pcs->mtx);
 601                 } else {
 602                         error = cv_wait_sig(&pccmd->cv, &pcs->mtx);
 603
 604                         if (error != 0)
 605                                 cuse_client_got_signal(pccmd);
 606                 }
 607                 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
 608                         error = CUSE_ERR_OTHER;
 609                         goto done;
 610                 }
 611         }
 612
 613         error = pccmd->error;
 614         pccmd->command = CUSE_CMD_NONE;
 615         cv_signal(&pccmd->cv);
 616
 617 done:
 618
 619         /* wait until all process references are gone */
 620
 621         pccmd->proc_curr = NULL;
 622
 623         while (pccmd->proc_refs != 0)
 624                 cv_wait(&pccmd->cv, &pcs->mtx);
 625
 626         return (error);
 627 }
 628
 629 /*------------------------------------------------------------------------*
 630  *      CUSE SERVER PART
 631  *------------------------------------------------------------------------*/
 632
 633 static void
 634 cuse_server_free_dev(struct cuse_server_dev *pcsd)
 635 {
 636         struct cuse_server *pcs;
 637         struct cuse_client *pcc;
 638
 639         /* get server pointer */
 640         pcs = pcsd->server;
 641
 642         /* prevent creation of more devices */
 643         cuse_server_lock(pcs);
 644         if (pcsd->kern_dev != NULL)
 645                 pcsd->kern_dev->si_drv1 = NULL;
 646
 647         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 648                 if (pcc->server_dev == pcsd)
 649                         cuse_client_is_closing(pcc);
 650         }
 651         cuse_server_unlock(pcs);
 652
 653         /* destroy device, if any */
 654         if (pcsd->kern_dev != NULL) {
 655                 /* destroy device synchronously */
 656                 destroy_dev(pcsd->kern_dev);
 657         }
 658         free(pcsd, M_CUSE);
 659 }
 660
 661 static void
 662 cuse_server_unref(struct cuse_server *pcs)
 663 {
 664         struct cuse_server_dev *pcsd;
 665         struct cuse_memory *mem;
 666
 667         cuse_server_lock(pcs);
 668         if (--(pcs->refs) != 0) {
 669                 cuse_server_unlock(pcs);
 670                 return;
 671         }
 672         cuse_server_is_closing(pcs);
 673         /* final client wakeup, if any */
 674         cuse_server_wakeup_all_client_locked(pcs);
 675
 676         cuse_global_lock();
 677         TAILQ_REMOVE(&cuse_server_head, pcs, entry);
 678         cuse_global_unlock();
 679
 680         while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) {
 681                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
 682                 cuse_server_unlock(pcs);
 683                 cuse_server_free_dev(pcsd);
 684                 cuse_server_lock(pcs);
 685         }
 686
 687         cuse_free_unit_by_id_locked(pcs, -1);
 688
 689         while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) {
 690                 TAILQ_REMOVE(&pcs->hmem, mem, entry);
 691                 cuse_server_unlock(pcs);
 692                 cuse_vm_memory_free(mem);
 693                 cuse_server_lock(pcs);
 694         }
 695
 696         knlist_clear(&pcs->selinfo.si_note, 1);
 697         knlist_destroy(&pcs->selinfo.si_note);
 698
 699         cuse_server_unlock(pcs);
 700
 701         seldrain(&pcs->selinfo);
 702
 703         cv_destroy(&pcs->cv);
 704
 705         mtx_destroy(&pcs->mtx);
 706
 707         free(pcs, M_CUSE);
 708 }
 709
 710 static int
 711 cuse_server_do_close(struct cuse_server *pcs)
 712 {
 713         int retval;
 714
 715         cuse_server_lock(pcs);
 716         cuse_server_is_closing(pcs);
 717         /* final client wakeup, if any */
 718         cuse_server_wakeup_all_client_locked(pcs);
 719
 720         knlist_clear(&pcs->selinfo.si_note, 1);
 721
 722         retval = pcs->refs;
 723         cuse_server_unlock(pcs);
 724
 725         return (retval);
 726 }
 727
 728 static void
 729 cuse_server_free(void *arg)
 730 {
 731         struct cuse_server *pcs = arg;
 732
 733         /*
 734          * The final server unref should be done by the server thread
 735          * to prevent deadlock in the client cdevpriv destructor,
 736          * which cannot destroy itself.
 737          */
 738         while (cuse_server_do_close(pcs) != 1)
 739                 pause("W", hz);
 740
 741         /* drop final refcount */
 742         cuse_server_unref(pcs);
 743 }
 744
 745 static int
 746 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
 747 {
 748         struct cuse_server *pcs;
 749
 750         pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO);
 751         if (pcs == NULL)
 752                 return (ENOMEM);
 753
 754         if (devfs_set_cdevpriv(pcs, &cuse_server_free)) {
 755                 printf("Cuse: Cannot set cdevpriv.\n");
 756                 free(pcs, M_CUSE);
 757                 return (ENOMEM);
 758         }
 759         /* store current process ID */
 760         pcs->pid = curproc->p_pid;
 761
 762         TAILQ_INIT(&pcs->head);
 763         TAILQ_INIT(&pcs->hdev);
 764         TAILQ_INIT(&pcs->hcli);
 765         TAILQ_INIT(&pcs->hmem);
 766
 767         cv_init(&pcs->cv, "cuse-server-cv");
 768
 769         mtx_init(&pcs->mtx, "cuse-server-mtx", NULL, MTX_DEF);
 770
 771         knlist_init_mtx(&pcs->selinfo.si_note, &pcs->mtx);
 772
 773         cuse_global_lock();
 774         pcs->refs++;
 775         TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry);
 776         cuse_global_unlock();
 777
 778         return (0);
 779 }
 780
 781 static int
 782 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 783 {
 784         struct cuse_server *pcs;
 785
 786         if (cuse_server_get(&pcs) == 0)
 787                 cuse_server_do_close(pcs);
 788
 789         return (0);
 790 }
 791
 792 static int
 793 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag)
 794 {
 795         return (ENXIO);
 796 }
 797
 798 static int
 799 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag)
 800 {
 801         return (ENXIO);
 802 }
 803
 804 static int
 805 cuse_server_ioctl_copy_locked(struct cuse_server *pcs,
 806     struct cuse_client_command *pccmd,
 807     struct cuse_data_chunk *pchk, int isread)
 808 {
 809         struct proc *p_proc;
 810         uint32_t offset;
 811         int error;
 812
 813         offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR;
 814
 815         if (pchk->length > CUSE_BUFFER_MAX)
 816                 return (EFAULT);
 817
 818         if (offset >= CUSE_BUFFER_MAX)
 819                 return (EFAULT);
 820
 821         if ((offset + pchk->length) > CUSE_BUFFER_MAX)
 822                 return (EFAULT);
 823
 824         p_proc = pccmd->proc_curr;
 825         if (p_proc == NULL)
 826                 return (ENXIO);
 827
 828         if (pccmd->proc_refs < 0)
 829                 return (ENOMEM);
 830
 831         pccmd->proc_refs++;
 832
 833         cuse_server_unlock(pcs);
 834
 835         if (isread == 0) {
 836                 error = copyin(
 837                     (void *)pchk->local_ptr,
 838                     pccmd->client->ioctl_buffer + offset,
 839                     pchk->length);
 840         } else {
 841                 error = copyout(
 842                     pccmd->client->ioctl_buffer + offset,
 843                     (void *)pchk->local_ptr,
 844                     pchk->length);
 845         }
 846
 847         cuse_server_lock(pcs);
 848
 849         pccmd->proc_refs--;
 850
 851         if (pccmd->proc_curr == NULL)
 852                 cv_signal(&pccmd->cv);
 853
 854         return (error);
 855 }
 856
 857 static int
 858 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s,
 859     struct proc *proc_d, vm_offset_t data_d, size_t len)
 860 {
 861         struct thread *td;
 862         struct proc *proc_cur;
 863         int error;
 864
 865         td = curthread;
 866         proc_cur = td->td_proc;
 867
 868         if (proc_cur == proc_d) {
 869                 struct iovec iov = {
 870                         .iov_base = (caddr_t)data_d,
 871                         .iov_len = len,
 872                 };
 873                 struct uio uio = {
 874                         .uio_iov = &iov,
 875                         .uio_iovcnt = 1,
 876                         .uio_offset = (off_t)data_s,
 877                         .uio_resid = len,
 878                         .uio_segflg = UIO_USERSPACE,
 879                         .uio_rw = UIO_READ,
 880                         .uio_td = td,
 881                 };
 882
 883                 PHOLD(proc_s);
 884                 error = proc_rwmem(proc_s, &uio);
 885                 PRELE(proc_s);
 886
 887         } else if (proc_cur == proc_s) {
 888                 struct iovec iov = {
 889                         .iov_base = (caddr_t)data_s,
 890                         .iov_len = len,
 891                 };
 892                 struct uio uio = {
 893                         .uio_iov = &iov,
 894                         .uio_iovcnt = 1,
 895                         .uio_offset = (off_t)data_d,
 896                         .uio_resid = len,
 897                         .uio_segflg = UIO_USERSPACE,
 898                         .uio_rw = UIO_WRITE,
 899                         .uio_td = td,
 900                 };
 901
 902                 PHOLD(proc_d);
 903                 error = proc_rwmem(proc_d, &uio);
 904                 PRELE(proc_d);
 905         } else {
 906                 error = EINVAL;
 907         }
 908         return (error);
 909 }
 910
 911 static int
 912 cuse_server_data_copy_locked(struct cuse_server *pcs,
 913     struct cuse_client_command *pccmd,
 914     struct cuse_data_chunk *pchk, int isread)
 915 {
 916         struct proc *p_proc;
 917         int error;
 918
 919         p_proc = pccmd->proc_curr;
 920         if (p_proc == NULL)
 921                 return (ENXIO);
 922
 923         if (pccmd->proc_refs < 0)
 924                 return (ENOMEM);
 925
 926         pccmd->proc_refs++;
 927
 928         cuse_server_unlock(pcs);
 929
 930         if (isread == 0) {
 931                 error = cuse_proc2proc_copy(
 932                     curthread->td_proc, pchk->local_ptr,
 933                     p_proc, pchk->peer_ptr,
 934                     pchk->length);
 935         } else {
 936                 error = cuse_proc2proc_copy(
 937                     p_proc, pchk->peer_ptr,
 938                     curthread->td_proc, pchk->local_ptr,
 939                     pchk->length);
 940         }
 941
 942         cuse_server_lock(pcs);
 943
 944         pccmd->proc_refs--;
 945
 946         if (pccmd->proc_curr == NULL)
 947                 cv_signal(&pccmd->cv);
 948
 949         return (error);
 950 }
 951
 952 static int
 953 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id)
 954 {
 955         int n;
 956         int x = 0;
 957         int match;
 958
 959         do {
 960                 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) {
 961                         if (cuse_alloc_unit[n] != NULL) {
 962                                 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK)
 963                                         continue;
 964                                 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) {
 965                                         x++;
 966                                         match = 1;
 967                                 }
 968                         }
 969                 }
 970         } while (match);
 971
 972         if (x < 256) {
 973                 for (n = 0; n != CUSE_DEVICES_MAX; n++) {
 974                         if (cuse_alloc_unit[n] == NULL) {
 975                                 cuse_alloc_unit[n] = pcs;
 976                                 cuse_alloc_unit_id[n] = id | x;
 977                                 return (x);
 978                         }
 979                 }
 980         }
 981         return (-1);
 982 }
 983
 984 static void
 985 cuse_server_wakeup_locked(struct cuse_server *pcs)
 986 {
 987         selwakeup(&pcs->selinfo);
 988         KNOTE_LOCKED(&pcs->selinfo.si_note, 0);
 989 }
 990
 991 static void
 992 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs)
 993 {
 994         struct cuse_client *pcc;
 995
 996         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 997                 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ |
 998                     CUSE_CLI_KNOTE_NEED_WRITE);
 999         }
1000         cuse_server_wakeup_locked(pcs);
1001 }
1002
1003 static int
1004 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id)
1005 {
1006         int n;
1007         int found = 0;
1008
1009         for (n = 0; n != CUSE_DEVICES_MAX; n++) {
1010                 if (cuse_alloc_unit[n] == pcs) {
1011                         if (cuse_alloc_unit_id[n] == id || id == -1) {
1012                                 cuse_alloc_unit[n] = NULL;
1013                                 cuse_alloc_unit_id[n] = 0;
1014                                 found = 1;
1015                         }
1016                 }
1017         }
1018
1019         return (found ? 0 : EINVAL);
1020 }
1021
1022 static int
1023 cuse_server_ioctl(struct cdev *dev, unsigned long cmd,
1024     caddr_t data, int fflag, struct thread *td)
1025 {
1026         struct cuse_server *pcs;
1027         int error;
1028
1029         error = cuse_server_get(&pcs);
1030         if (error != 0)
1031                 return (error);
1032
1033         switch (cmd) {
1034                 struct cuse_client_command *pccmd;
1035                 struct cuse_client *pcc;
1036                 struct cuse_command *pcmd;
1037                 struct cuse_alloc_info *pai;
1038                 struct cuse_create_dev *pcd;
1039                 struct cuse_server_dev *pcsd;
1040                 struct cuse_data_chunk *pchk;
1041                 int n;
1042
1043         case CUSE_IOCTL_GET_COMMAND:
1044                 pcmd = (void *)data;
1045
1046                 cuse_server_lock(pcs);
1047
1048                 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) {
1049                         error = cv_wait_sig(&pcs->cv, &pcs->mtx);
1050
1051                         if (pcs->is_closing)
1052                                 error = ENXIO;
1053
1054                         if (error) {
1055                                 cuse_server_unlock(pcs);
1056                                 return (error);
1057                         }
1058                 }
1059
1060                 TAILQ_REMOVE(&pcs->head, pccmd, entry);
1061                 pccmd->entry.tqe_prev = NULL;
1062
1063                 pccmd->entered = curthread;
1064
1065                 *pcmd = pccmd->sub;
1066
1067                 cuse_server_unlock(pcs);
1068
1069                 break;
1070
1071         case CUSE_IOCTL_SYNC_COMMAND:
1072
1073                 cuse_server_lock(pcs);
1074                 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) {
1075
1076                         /* send sync command */
1077                         pccmd->entered = NULL;
1078                         pccmd->error = *(int *)data;
1079                         pccmd->command = CUSE_CMD_SYNC;
1080
1081                         /* signal peer, if any */
1082                         cv_signal(&pccmd->cv);
1083                 }
1084                 cuse_server_unlock(pcs);
1085
1086                 break;
1087
1088         case CUSE_IOCTL_ALLOC_UNIT:
1089
1090                 cuse_server_lock(pcs);
1091                 n = cuse_alloc_unit_by_id_locked(pcs,
1092                     CUSE_ID_DEFAULT(0));
1093                 cuse_server_unlock(pcs);
1094
1095                 if (n < 0)
1096                         error = ENOMEM;
1097                 else
1098                         *(int *)data = n;
1099                 break;
1100
1101         case CUSE_IOCTL_ALLOC_UNIT_BY_ID:
1102
1103                 n = *(int *)data;
1104
1105                 n = (n & CUSE_ID_MASK);
1106
1107                 cuse_server_lock(pcs);
1108                 n = cuse_alloc_unit_by_id_locked(pcs, n);
1109                 cuse_server_unlock(pcs);
1110
1111                 if (n < 0)
1112                         error = ENOMEM;
1113                 else
1114                         *(int *)data = n;
1115                 break;
1116
1117         case CUSE_IOCTL_FREE_UNIT:
1118
1119                 n = *(int *)data;
1120
1121                 n = CUSE_ID_DEFAULT(n);
1122
1123                 cuse_server_lock(pcs);
1124                 error = cuse_free_unit_by_id_locked(pcs, n);
1125                 cuse_server_unlock(pcs);
1126                 break;
1127
1128         case CUSE_IOCTL_FREE_UNIT_BY_ID:
1129
1130                 n = *(int *)data;
1131
1132                 cuse_server_lock(pcs);
1133                 error = cuse_free_unit_by_id_locked(pcs, n);
1134                 cuse_server_unlock(pcs);
1135                 break;
1136
1137         case CUSE_IOCTL_ALLOC_MEMORY:
1138
1139                 pai = (void *)data;
1140
1141                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1142                         error = ENOMEM;
1143                         break;
1144                 }
1145                 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) {
1146                         error = ENOMEM;
1147                         break;
1148                 }
1149                 error = cuse_server_alloc_memory(pcs,
1150                     pai->alloc_nr, pai->page_count);
1151                 break;
1152
1153         case CUSE_IOCTL_FREE_MEMORY:
1154                 pai = (void *)data;
1155
1156                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1157                         error = ENOMEM;
1158                         break;
1159                 }
1160                 error = cuse_server_free_memory(pcs, pai->alloc_nr);
1161                 break;
1162
1163         case CUSE_IOCTL_GET_SIG:
1164
1165                 cuse_server_lock(pcs);
1166                 pccmd = cuse_server_find_command(pcs, curthread);
1167
1168                 if (pccmd != NULL) {
1169                         n = pccmd->got_signal;
1170                         pccmd->got_signal = 0;
1171                 } else {
1172                         n = 0;
1173                 }
1174                 cuse_server_unlock(pcs);
1175
1176                 *(int *)data = n;
1177
1178                 break;
1179
1180         case CUSE_IOCTL_SET_PFH:
1181
1182                 cuse_server_lock(pcs);
1183                 pccmd = cuse_server_find_command(pcs, curthread);
1184
1185                 if (pccmd != NULL) {
1186                         pcc = pccmd->client;
1187                         for (n = 0; n != CUSE_CMD_MAX; n++) {
1188                                 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data;
1189                         }
1190                 } else {
1191                         error = ENXIO;
1192                 }
1193                 cuse_server_unlock(pcs);
1194                 break;
1195
1196         case CUSE_IOCTL_CREATE_DEV:
1197
1198                 error = priv_check(curthread, PRIV_DRIVER);
1199                 if (error)
1200                         break;
1201
1202                 pcd = (void *)data;
1203
1204                 /* filter input */
1205
1206                 pcd->devname[sizeof(pcd->devname) - 1] = 0;
1207
1208                 if (pcd->devname[0] == 0) {
1209                         error = EINVAL;
1210                         break;
1211                 }
1212                 cuse_str_filter(pcd->devname);
1213
1214                 pcd->permissions &= 0777;
1215
1216                 /* try to allocate a character device */
1217
1218                 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO);
1219
1220                 if (pcsd == NULL) {
1221                         error = ENOMEM;
1222                         break;
1223                 }
1224                 pcsd->server = pcs;
1225
1226                 pcsd->user_dev = pcd->dev;
1227
1228                 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME,
1229                     &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id,
1230                     pcd->permissions, "%s", pcd->devname);
1231
1232                 if (pcsd->kern_dev == NULL) {
1233                         free(pcsd, M_CUSE);
1234                         error = ENOMEM;
1235                         break;
1236                 }
1237                 pcsd->kern_dev->si_drv1 = pcsd;
1238
1239                 cuse_server_lock(pcs);
1240                 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry);
1241                 cuse_server_unlock(pcs);
1242
1243                 break;
1244
1245         case CUSE_IOCTL_DESTROY_DEV:
1246
1247                 error = priv_check(curthread, PRIV_DRIVER);
1248                 if (error)
1249                         break;
1250
1251                 cuse_server_lock(pcs);
1252
1253                 error = EINVAL;
1254
1255                 pcsd = TAILQ_FIRST(&pcs->hdev);
1256                 while (pcsd != NULL) {
1257                         if (pcsd->user_dev == *(struct cuse_dev **)data) {
1258                                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
1259                                 cuse_server_unlock(pcs);
1260                                 cuse_server_free_dev(pcsd);
1261                                 cuse_server_lock(pcs);
1262                                 error = 0;
1263                                 pcsd = TAILQ_FIRST(&pcs->hdev);
1264                         } else {
1265                                 pcsd = TAILQ_NEXT(pcsd, entry);
1266                         }
1267                 }
1268
1269                 cuse_server_unlock(pcs);
1270                 break;
1271
1272         case CUSE_IOCTL_WRITE_DATA:
1273         case CUSE_IOCTL_READ_DATA:
1274
1275                 cuse_server_lock(pcs);
1276                 pchk = (struct cuse_data_chunk *)data;
1277
1278                 pccmd = cuse_server_find_command(pcs, curthread);
1279
1280                 if (pccmd == NULL) {
1281                         error = ENXIO;  /* invalid request */
1282                 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) {
1283                         error = EFAULT; /* NULL pointer */
1284                 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) {
1285                         error = cuse_server_ioctl_copy_locked(pcs, pccmd,
1286                             pchk, cmd == CUSE_IOCTL_READ_DATA);
1287                 } else {
1288                         error = cuse_server_data_copy_locked(pcs, pccmd,
1289                             pchk, cmd == CUSE_IOCTL_READ_DATA);
1290                 }
1291                 cuse_server_unlock(pcs);
1292                 break;
1293
1294         case CUSE_IOCTL_SELWAKEUP:
1295                 cuse_server_lock(pcs);
1296                 /*
1297                  * We don't know which direction caused the event.
1298                  * Wakeup both!
1299                  */
1300                 cuse_server_wakeup_all_client_locked(pcs);
1301                 cuse_server_unlock(pcs);
1302                 break;
1303
1304         default:
1305                 error = ENXIO;
1306                 break;
1307         }
1308         return (error);
1309 }
1310
1311 static int
1312 cuse_server_poll(struct cdev *dev, int events, struct thread *td)
1313 {
1314         return (events & (POLLHUP | POLLPRI | POLLIN |
1315             POLLRDNORM | POLLOUT | POLLWRNORM));
1316 }
1317
1318 static int
1319 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1320     vm_size_t size, struct vm_object **object, int nprot)
1321 {
1322         uint32_t page_nr = *offset / PAGE_SIZE;
1323         uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1324         struct cuse_memory *mem;
1325         struct cuse_server *pcs;
1326         int error;
1327
1328         error = cuse_server_get(&pcs);
1329         if (error != 0)
1330                 return (error);
1331
1332         cuse_server_lock(pcs);
1333         /* lookup memory structure */
1334         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
1335                 if (mem->alloc_nr == alloc_nr)
1336                         break;
1337         }
1338         if (mem == NULL) {
1339                 cuse_server_unlock(pcs);
1340                 return (ENOMEM);
1341         }
1342         /* verify page offset */
1343         page_nr %= CUSE_ALLOC_PAGES_MAX;
1344         if (page_nr >= mem->page_count) {
1345                 cuse_server_unlock(pcs);
1346                 return (ENXIO);
1347         }
1348         /* verify mmap size */
1349         if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1350             (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1351                 cuse_server_unlock(pcs);
1352                 return (EINVAL);
1353         }
1354         vm_object_reference(mem->object);
1355         *object = mem->object;
1356         cuse_server_unlock(pcs);
1357
1358         /* set new VM object offset to use */
1359         *offset = page_nr * PAGE_SIZE;
1360
1361         /* success */
1362         return (0);
1363 }
1364
1365 /*------------------------------------------------------------------------*
1366  *      CUSE CLIENT PART
1367  *------------------------------------------------------------------------*/
1368 static void
1369 cuse_client_free(void *arg)
1370 {
1371         struct cuse_client *pcc = arg;
1372         struct cuse_client_command *pccmd;
1373         struct cuse_server *pcs;
1374         int n;
1375
1376         pcs = pcc->server;
1377
1378         cuse_server_lock(pcs);
1379         cuse_client_is_closing(pcc);
1380         TAILQ_REMOVE(&pcs->hcli, pcc, entry);
1381         cuse_server_unlock(pcs);
1382
1383         for (n = 0; n != CUSE_CMD_MAX; n++) {
1384
1385                 pccmd = &pcc->cmds[n];
1386
1387                 sx_destroy(&pccmd->sx);
1388                 cv_destroy(&pccmd->cv);
1389         }
1390
1391         free(pcc, M_CUSE);
1392
1393         /* drop reference on server */
1394         cuse_server_unref(pcs);
1395 }
1396
1397 static int
1398 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
1399 {
1400         struct cuse_client_command *pccmd;
1401         struct cuse_server_dev *pcsd;
1402         struct cuse_client *pcc;
1403         struct cuse_server *pcs;
1404         struct cuse_dev *pcd;
1405         int error;
1406         int n;
1407
1408         pcsd = dev->si_drv1;
1409         if (pcsd != NULL) {
1410                 pcs = pcsd->server;
1411                 pcd = pcsd->user_dev;
1412
1413                 cuse_server_lock(pcs);
1414                 /*
1415                  * Check that the refcount didn't wrap and that the
1416                  * same process is not both client and server. This
1417                  * can easily lead to deadlocks when destroying the
1418                  * CUSE character device nodes:
1419                  */
1420                 pcs->refs++;
1421                 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) {
1422                         /* overflow or wrong PID */
1423                         pcs->refs--;
1424                         cuse_server_unlock(pcs);
1425                         return (EINVAL);
1426                 }
1427                 cuse_server_unlock(pcs);
1428         } else {
1429                 return (EINVAL);
1430         }
1431
1432         pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO);
1433         if (pcc == NULL) {
1434                 /* drop reference on server */
1435                 cuse_server_unref(pcs);
1436                 return (ENOMEM);
1437         }
1438         if (devfs_set_cdevpriv(pcc, &cuse_client_free)) {
1439                 printf("Cuse: Cannot set cdevpriv.\n");
1440                 /* drop reference on server */
1441                 cuse_server_unref(pcs);
1442                 free(pcc, M_CUSE);
1443                 return (ENOMEM);
1444         }
1445         pcc->fflags = fflags;
1446         pcc->server_dev = pcsd;
1447         pcc->server = pcs;
1448
1449         for (n = 0; n != CUSE_CMD_MAX; n++) {
1450
1451                 pccmd = &pcc->cmds[n];
1452
1453                 pccmd->sub.dev = pcd;
1454                 pccmd->sub.command = n;
1455                 pccmd->client = pcc;
1456
1457                 sx_init(&pccmd->sx, "cuse-client-sx");
1458                 cv_init(&pccmd->cv, "cuse-client-cv");
1459         }
1460
1461         cuse_server_lock(pcs);
1462
1463         /* cuse_client_free() assumes that the client is listed somewhere! */
1464         /* always enqueue */
1465
1466         TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry);
1467
1468         /* check if server is closing */
1469         if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) {
1470                 error = EINVAL;
1471         } else {
1472                 error = 0;
1473         }
1474         cuse_server_unlock(pcs);
1475
1476         if (error) {
1477                 devfs_clear_cdevpriv(); /* XXX bugfix */
1478                 return (error);
1479         }
1480         pccmd = &pcc->cmds[CUSE_CMD_OPEN];
1481
1482         cuse_cmd_lock(pccmd);
1483
1484         cuse_server_lock(pcs);
1485         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1486
1487         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1488         cuse_server_unlock(pcs);
1489
1490         if (error < 0) {
1491                 error = cuse_convert_error(error);
1492         } else {
1493                 error = 0;
1494         }
1495
1496         cuse_cmd_unlock(pccmd);
1497
1498         if (error)
1499                 devfs_clear_cdevpriv(); /* XXX bugfix */
1500
1501         return (error);
1502 }
1503
1504 static int
1505 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
1506 {
1507         struct cuse_client_command *pccmd;
1508         struct cuse_client *pcc;
1509         struct cuse_server *pcs;
1510         int error;
1511
1512         error = cuse_client_get(&pcc);
1513         if (error != 0)
1514                 return (0);
1515
1516         pccmd = &pcc->cmds[CUSE_CMD_CLOSE];
1517         pcs = pcc->server;
1518
1519         cuse_cmd_lock(pccmd);
1520
1521         cuse_server_lock(pcs);
1522         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1523
1524         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1525         cuse_cmd_unlock(pccmd);
1526
1527         cuse_client_is_closing(pcc);
1528         cuse_server_unlock(pcs);
1529
1530         return (0);
1531 }
1532
1533 static void
1534 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc)
1535 {
1536         struct cuse_server *pcs = pcc->server;
1537         int temp;
1538
1539         cuse_server_lock(pcs);
1540         temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ |
1541             CUSE_CLI_KNOTE_HAS_WRITE));
1542         pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ |
1543             CUSE_CLI_KNOTE_NEED_WRITE);
1544         cuse_server_unlock(pcs);
1545
1546         if (temp != 0) {
1547                 /* get the latest polling state from the server */
1548                 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL);
1549
1550                 if (temp & (POLLIN | POLLOUT)) {
1551                         cuse_server_lock(pcs);
1552                         if (temp & POLLIN)
1553                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ;
1554                         if (temp & POLLOUT)
1555                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE;
1556
1557                         /* make sure the "knote" gets woken up */
1558                         cuse_server_wakeup_locked(pcc->server);
1559                         cuse_server_unlock(pcs);
1560                 }
1561         }
1562 }
1563
1564 static int
1565 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag)
1566 {
1567         struct cuse_client_command *pccmd;
1568         struct cuse_client *pcc;
1569         struct cuse_server *pcs;
1570         int error;
1571         int len;
1572
1573         error = cuse_client_get(&pcc);
1574         if (error != 0)
1575                 return (error);
1576
1577         pccmd = &pcc->cmds[CUSE_CMD_READ];
1578         pcs = pcc->server;
1579
1580         if (uio->uio_segflg != UIO_USERSPACE) {
1581                 return (EINVAL);
1582         }
1583         uio->uio_segflg = UIO_NOCOPY;
1584
1585         cuse_cmd_lock(pccmd);
1586
1587         while (uio->uio_resid != 0) {
1588
1589                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1590                         error = ENOMEM;
1591                         break;
1592                 }
1593                 len = uio->uio_iov->iov_len;
1594
1595                 cuse_server_lock(pcs);
1596                 cuse_client_send_command_locked(pccmd,
1597                     (uintptr_t)uio->uio_iov->iov_base,
1598                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1599
1600                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1601                 cuse_server_unlock(pcs);
1602
1603                 if (error < 0) {
1604                         error = cuse_convert_error(error);
1605                         break;
1606                 } else if (error == len) {
1607                         error = uiomove(NULL, error, uio);
1608                         if (error)
1609                                 break;
1610                 } else {
1611                         error = uiomove(NULL, error, uio);
1612                         break;
1613                 }
1614         }
1615         cuse_cmd_unlock(pccmd);
1616
1617         uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1618
1619         if (error == EWOULDBLOCK)
1620                 cuse_client_kqfilter_poll(dev, pcc);
1621
1622         return (error);
1623 }
1624
1625 static int
1626 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag)
1627 {
1628         struct cuse_client_command *pccmd;
1629         struct cuse_client *pcc;
1630         struct cuse_server *pcs;
1631         int error;
1632         int len;
1633
1634         error = cuse_client_get(&pcc);
1635         if (error != 0)
1636                 return (error);
1637
1638         pccmd = &pcc->cmds[CUSE_CMD_WRITE];
1639         pcs = pcc->server;
1640
1641         if (uio->uio_segflg != UIO_USERSPACE) {
1642                 return (EINVAL);
1643         }
1644         uio->uio_segflg = UIO_NOCOPY;
1645
1646         cuse_cmd_lock(pccmd);
1647
1648         while (uio->uio_resid != 0) {
1649
1650                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1651                         error = ENOMEM;
1652                         break;
1653                 }
1654                 len = uio->uio_iov->iov_len;
1655
1656                 cuse_server_lock(pcs);
1657                 cuse_client_send_command_locked(pccmd,
1658                     (uintptr_t)uio->uio_iov->iov_base,
1659                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1660
1661                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1662                 cuse_server_unlock(pcs);
1663
1664                 if (error < 0) {
1665                         error = cuse_convert_error(error);
1666                         break;
1667                 } else if (error == len) {
1668                         error = uiomove(NULL, error, uio);
1669                         if (error)
1670                                 break;
1671                 } else {
1672                         error = uiomove(NULL, error, uio);
1673                         break;
1674                 }
1675         }
1676         cuse_cmd_unlock(pccmd);
1677
1678         uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1679
1680         if (error == EWOULDBLOCK)
1681                 cuse_client_kqfilter_poll(dev, pcc);
1682
1683         return (error);
1684 }
1685
1686 int
1687 cuse_client_ioctl(struct cdev *dev, unsigned long cmd,
1688     caddr_t data, int fflag, struct thread *td)
1689 {
1690         struct cuse_client_command *pccmd;
1691         struct cuse_client *pcc;
1692         struct cuse_server *pcs;
1693         int error;
1694         int len;
1695
1696         error = cuse_client_get(&pcc);
1697         if (error != 0)
1698                 return (error);
1699
1700         len = IOCPARM_LEN(cmd);
1701         if (len > CUSE_BUFFER_MAX)
1702                 return (ENOMEM);
1703
1704         pccmd = &pcc->cmds[CUSE_CMD_IOCTL];
1705         pcs = pcc->server;
1706
1707         cuse_cmd_lock(pccmd);
1708
1709         if (cmd & (IOC_IN | IOC_VOID))
1710                 memcpy(pcc->ioctl_buffer, data, len);
1711
1712         /*
1713          * When the ioctl-length is zero drivers can pass information
1714          * through the data pointer of the ioctl. Make sure this information
1715          * is forwarded to the driver.
1716          */
1717
1718         cuse_server_lock(pcs);
1719         cuse_client_send_command_locked(pccmd,
1720             (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR,
1721             (unsigned long)cmd, pcc->fflags,
1722             (fflag & O_NONBLOCK) ? IO_NDELAY : 0);
1723
1724         error = cuse_client_receive_command_locked(pccmd, data, len);
1725         cuse_server_unlock(pcs);
1726
1727         if (error < 0) {
1728                 error = cuse_convert_error(error);
1729         } else {
1730                 error = 0;
1731         }
1732
1733         if (cmd & IOC_OUT)
1734                 memcpy(data, pcc->ioctl_buffer, len);
1735
1736         cuse_cmd_unlock(pccmd);
1737
1738         if (error == EWOULDBLOCK)
1739                 cuse_client_kqfilter_poll(dev, pcc);
1740
1741         return (error);
1742 }
1743
1744 static int
1745 cuse_client_poll(struct cdev *dev, int events, struct thread *td)
1746 {
1747         struct cuse_client_command *pccmd;
1748         struct cuse_client *pcc;
1749         struct cuse_server *pcs;
1750         unsigned long temp;
1751         int error;
1752         int revents;
1753
1754         error = cuse_client_get(&pcc);
1755         if (error != 0)
1756                 goto pollnval;
1757
1758         temp = 0;
1759         pcs = pcc->server;
1760
1761         if (events & (POLLPRI | POLLIN | POLLRDNORM))
1762                 temp |= CUSE_POLL_READ;
1763
1764         if (events & (POLLOUT | POLLWRNORM))
1765                 temp |= CUSE_POLL_WRITE;
1766
1767         if (events & POLLHUP)
1768                 temp |= CUSE_POLL_ERROR;
1769
1770         pccmd = &pcc->cmds[CUSE_CMD_POLL];
1771
1772         cuse_cmd_lock(pccmd);
1773
1774         /* Need to selrecord() first to not loose any events. */
1775         if (temp != 0 && td != NULL)
1776                 selrecord(td, &pcs->selinfo);
1777
1778         cuse_server_lock(pcs);
1779         cuse_client_send_command_locked(pccmd,
1780             0, temp, pcc->fflags, IO_NDELAY);
1781
1782         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1783         cuse_server_unlock(pcs);
1784
1785         cuse_cmd_unlock(pccmd);
1786
1787         if (error < 0) {
1788                 goto pollnval;
1789         } else {
1790                 revents = 0;
1791                 if (error & CUSE_POLL_READ)
1792                         revents |= (events & (POLLPRI | POLLIN | POLLRDNORM));
1793                 if (error & CUSE_POLL_WRITE)
1794                         revents |= (events & (POLLOUT | POLLWRNORM));
1795                 if (error & CUSE_POLL_ERROR)
1796                         revents |= (events & POLLHUP);
1797         }
1798         return (revents);
1799
1800 pollnval:
1801         /* XXX many clients don't understand POLLNVAL */
1802         return (events & (POLLHUP | POLLPRI | POLLIN |
1803             POLLRDNORM | POLLOUT | POLLWRNORM));
1804 }
1805
1806 static int
1807 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1808     vm_size_t size, struct vm_object **object, int nprot)
1809 {
1810         uint32_t page_nr = *offset / PAGE_SIZE;
1811         uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1812         struct cuse_memory *mem;
1813         struct cuse_client *pcc;
1814         struct cuse_server *pcs;
1815         int error;
1816
1817         error = cuse_client_get(&pcc);
1818         if (error != 0)
1819                 return (error);
1820
1821         pcs = pcc->server;
1822
1823         cuse_server_lock(pcs);
1824         /* lookup memory structure */
1825         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
1826                 if (mem->alloc_nr == alloc_nr)
1827                         break;
1828         }
1829         if (mem == NULL) {
1830                 cuse_server_unlock(pcs);
1831                 return (ENOMEM);
1832         }
1833         /* verify page offset */
1834         page_nr %= CUSE_ALLOC_PAGES_MAX;
1835         if (page_nr >= mem->page_count) {
1836                 cuse_server_unlock(pcs);
1837                 return (ENXIO);
1838         }
1839         /* verify mmap size */
1840         if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1841             (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1842                 cuse_server_unlock(pcs);
1843                 return (EINVAL);
1844         }
1845         vm_object_reference(mem->object);
1846         *object = mem->object;
1847         cuse_server_unlock(pcs);
1848
1849         /* set new VM object offset to use */
1850         *offset = page_nr * PAGE_SIZE;
1851
1852         /* success */
1853         return (0);
1854 }
1855
1856 static void
1857 cuse_client_kqfilter_read_detach(struct knote *kn)
1858 {
1859         struct cuse_client *pcc;
1860         struct cuse_server *pcs;
1861
1862         pcc = kn->kn_hook;
1863         pcs = pcc->server;
1864
1865         cuse_server_lock(pcs);
1866         knlist_remove(&pcs->selinfo.si_note, kn, 1);
1867         cuse_server_unlock(pcs);
1868 }
1869
1870 static void
1871 cuse_client_kqfilter_write_detach(struct knote *kn)
1872 {
1873         struct cuse_client *pcc;
1874         struct cuse_server *pcs;
1875
1876         pcc = kn->kn_hook;
1877         pcs = pcc->server;
1878
1879         cuse_server_lock(pcs);
1880         knlist_remove(&pcs->selinfo.si_note, kn, 1);
1881         cuse_server_unlock(pcs);
1882 }
1883
1884 static int
1885 cuse_client_kqfilter_read_event(struct knote *kn, long hint)
1886 {
1887         struct cuse_client *pcc;
1888
1889         pcc = kn->kn_hook;
1890
1891         mtx_assert(&pcc->server->mtx, MA_OWNED);
1892
1893         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0);
1894 }
1895
1896 static int
1897 cuse_client_kqfilter_write_event(struct knote *kn, long hint)
1898 {
1899         struct cuse_client *pcc;
1900
1901         pcc = kn->kn_hook;
1902
1903         mtx_assert(&pcc->server->mtx, MA_OWNED);
1904
1905         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0);
1906 }
1907
1908 static int
1909 cuse_client_kqfilter(struct cdev *dev, struct knote *kn)
1910 {
1911         struct cuse_client *pcc;
1912         struct cuse_server *pcs;
1913         int error;
1914
1915         error = cuse_client_get(&pcc);
1916         if (error != 0)
1917                 return (error);
1918
1919         pcs = pcc->server;
1920
1921         cuse_server_lock(pcs);
1922         switch (kn->kn_filter) {
1923         case EVFILT_READ:
1924                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ;
1925                 kn->kn_hook = pcc;
1926                 kn->kn_fop = &cuse_client_kqfilter_read_ops;
1927                 knlist_add(&pcs->selinfo.si_note, kn, 1);
1928                 break;
1929         case EVFILT_WRITE:
1930                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE;
1931                 kn->kn_hook = pcc;
1932                 kn->kn_fop = &cuse_client_kqfilter_write_ops;
1933                 knlist_add(&pcs->selinfo.si_note, kn, 1);
1934                 break;
1935         default:
1936                 error = EINVAL;
1937                 break;
1938         }
1939         cuse_server_unlock(pcs);
1940
1941         if (error == 0)
1942                 cuse_client_kqfilter_poll(dev, pcc);
1943         return (error);
1944 }