sys/fs/cuse/cuse.c

   1 /* $FreeBSD$ */
   2 /*-
   3  * Copyright (c) 2010-2017 Hans Petter Selasky. All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 #include <sys/stdint.h>
  28 #include <sys/stddef.h>
  29 #include <sys/param.h>
  30 #include <sys/types.h>
  31 #include <sys/systm.h>
  32 #include <sys/conf.h>
  33 #include <sys/kernel.h>
  34 #include <sys/bus.h>
  35 #include <sys/linker_set.h>
  36 #include <sys/module.h>
  37 #include <sys/lock.h>
  38 #include <sys/mutex.h>
  39 #include <sys/condvar.h>
  40 #include <sys/sysctl.h>
  41 #include <sys/unistd.h>
  42 #include <sys/malloc.h>
  43 #include <sys/priv.h>
  44 #include <sys/uio.h>
  45 #include <sys/poll.h>
  46 #include <sys/sx.h>
  47 #include <sys/rwlock.h>
  48 #include <sys/queue.h>
  49 #include <sys/fcntl.h>
  50 #include <sys/proc.h>
  51 #include <sys/vnode.h>
  52 #include <sys/selinfo.h>
  53 #include <sys/ptrace.h>
  54 #include <sys/sysent.h>
  55
  56 #include <machine/bus.h>
  57
  58 #include <vm/vm.h>
  59 #include <vm/pmap.h>
  60 #include <vm/vm_object.h>
  61 #include <vm/vm_page.h>
  62 #include <vm/vm_pager.h>
  63
  64 #include <fs/cuse/cuse_defs.h>
  65 #include <fs/cuse/cuse_ioctl.h>
  66
  67 MODULE_VERSION(cuse, 1);
  68
  69 /*
  70  * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by
  71  * declaring support for the cuse4bsd interface in cuse.ko:
  72  */
  73 MODULE_VERSION(cuse4bsd, 1);
  74
  75 #ifdef FEATURE
  76 FEATURE(cuse, "Userspace character devices");
  77 #endif
  78
  79 struct cuse_command;
  80 struct cuse_server;
  81 struct cuse_client;
  82
  83 struct cuse_client_command {
  84         TAILQ_ENTRY(cuse_client_command) entry;
  85         struct cuse_command sub;
  86         struct sx sx;
  87         struct cv cv;
  88         struct thread *entered;
  89         struct cuse_client *client;
  90         struct proc *proc_curr;
  91         int     proc_refs;
  92         int     got_signal;
  93         int     error;
  94         int     command;
  95 };
  96
  97 struct cuse_memory {
  98         TAILQ_ENTRY(cuse_memory) entry;
  99         vm_object_t object;
 100         uint32_t page_count;
 101         uint32_t alloc_nr;
 102 };
 103
 104 struct cuse_server_dev {
 105         TAILQ_ENTRY(cuse_server_dev) entry;
 106         struct cuse_server *server;
 107         struct cdev *kern_dev;
 108         struct cuse_dev *user_dev;
 109 };
 110
 111 struct cuse_server {
 112         TAILQ_ENTRY(cuse_server) entry;
 113         TAILQ_HEAD(, cuse_client_command) head;
 114         TAILQ_HEAD(, cuse_server_dev) hdev;
 115         TAILQ_HEAD(, cuse_client) hcli;
 116         TAILQ_HEAD(, cuse_memory) hmem;
 117         struct cv cv;
 118         struct selinfo selinfo;
 119         pid_t   pid;
 120         int     is_closing;
 121         int     refs;
 122 };
 123
 124 struct cuse_client {
 125         TAILQ_ENTRY(cuse_client) entry;
 126         TAILQ_ENTRY(cuse_client) entry_ref;
 127         struct cuse_client_command cmds[CUSE_CMD_MAX];
 128         struct cuse_server *server;
 129         struct cuse_server_dev *server_dev;
 130
 131         uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4);
 132
 133         int     fflags;                 /* file flags */
 134         int     cflags;                 /* client flags */
 135 #define CUSE_CLI_IS_CLOSING 0x01
 136 #define CUSE_CLI_KNOTE_NEED_READ 0x02
 137 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04
 138 #define CUSE_CLI_KNOTE_HAS_READ 0x08
 139 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10
 140 };
 141
 142 #define CUSE_CLIENT_CLOSING(pcc) \
 143     ((pcc)->cflags & CUSE_CLI_IS_CLOSING)
 144
 145 static  MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory");
 146
 147 static TAILQ_HEAD(, cuse_server) cuse_server_head;
 148 static struct mtx cuse_mtx;
 149 static struct cdev *cuse_dev;
 150 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX];
 151 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX];
 152
 153 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs);
 154 static void cuse_client_kqfilter_read_detach(struct knote *kn);
 155 static void cuse_client_kqfilter_write_detach(struct knote *kn);
 156 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint);
 157 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint);
 158
 159 static struct filterops cuse_client_kqfilter_read_ops = {
 160         .f_isfd = 1,
 161         .f_detach = cuse_client_kqfilter_read_detach,
 162         .f_event = cuse_client_kqfilter_read_event,
 163 };
 164
 165 static struct filterops cuse_client_kqfilter_write_ops = {
 166         .f_isfd = 1,
 167         .f_detach = cuse_client_kqfilter_write_detach,
 168         .f_event = cuse_client_kqfilter_write_event,
 169 };
 170
 171 static d_open_t cuse_client_open;
 172 static d_close_t cuse_client_close;
 173 static d_ioctl_t cuse_client_ioctl;
 174 static d_read_t cuse_client_read;
 175 static d_write_t cuse_client_write;
 176 static d_poll_t cuse_client_poll;
 177 static d_mmap_single_t cuse_client_mmap_single;
 178 static d_kqfilter_t cuse_client_kqfilter;
 179
 180 static struct cdevsw cuse_client_devsw = {
 181         .d_version = D_VERSION,
 182         .d_open = cuse_client_open,
 183         .d_close = cuse_client_close,
 184         .d_ioctl = cuse_client_ioctl,
 185         .d_name = "cuse_client",
 186         .d_flags = D_TRACKCLOSE,
 187         .d_read = cuse_client_read,
 188         .d_write = cuse_client_write,
 189         .d_poll = cuse_client_poll,
 190         .d_mmap_single = cuse_client_mmap_single,
 191         .d_kqfilter = cuse_client_kqfilter,
 192 };
 193
 194 static d_open_t cuse_server_open;
 195 static d_close_t cuse_server_close;
 196 static d_ioctl_t cuse_server_ioctl;
 197 static d_read_t cuse_server_read;
 198 static d_write_t cuse_server_write;
 199 static d_poll_t cuse_server_poll;
 200 static d_mmap_single_t cuse_server_mmap_single;
 201
 202 static struct cdevsw cuse_server_devsw = {
 203         .d_version = D_VERSION,
 204         .d_open = cuse_server_open,
 205         .d_close = cuse_server_close,
 206         .d_ioctl = cuse_server_ioctl,
 207         .d_name = "cuse_server",
 208         .d_flags = D_TRACKCLOSE,
 209         .d_read = cuse_server_read,
 210         .d_write = cuse_server_write,
 211         .d_poll = cuse_server_poll,
 212         .d_mmap_single = cuse_server_mmap_single,
 213 };
 214
 215 static void cuse_client_is_closing(struct cuse_client *);
 216 static int cuse_free_unit_by_id_locked(struct cuse_server *, int);
 217
 218 static void
 219 cuse_lock(void)
 220 {
 221         mtx_lock(&cuse_mtx);
 222 }
 223
 224 static void
 225 cuse_unlock(void)
 226 {
 227         mtx_unlock(&cuse_mtx);
 228 }
 229
 230 static void
 231 cuse_cmd_lock(struct cuse_client_command *pccmd)
 232 {
 233         sx_xlock(&pccmd->sx);
 234 }
 235
 236 static void
 237 cuse_cmd_unlock(struct cuse_client_command *pccmd)
 238 {
 239         sx_xunlock(&pccmd->sx);
 240 }
 241
 242 static void
 243 cuse_kern_init(void *arg)
 244 {
 245         TAILQ_INIT(&cuse_server_head);
 246
 247         mtx_init(&cuse_mtx, "cuse-mtx", NULL, MTX_DEF);
 248
 249         cuse_dev = make_dev(&cuse_server_devsw, 0,
 250             UID_ROOT, GID_OPERATOR, 0600, "cuse");
 251
 252         printf("Cuse v%d.%d.%d @ /dev/cuse\n",
 253             (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF,
 254             (CUSE_VERSION >> 0) & 0xFF);
 255 }
 256 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL);
 257
 258 static void
 259 cuse_kern_uninit(void *arg)
 260 {
 261         void *ptr;
 262
 263         while (1) {
 264
 265                 printf("Cuse: Please exit all /dev/cuse instances "
 266                     "and processes which have used this device.\n");
 267
 268                 pause("DRAIN", 2 * hz);
 269
 270                 cuse_lock();
 271                 ptr = TAILQ_FIRST(&cuse_server_head);
 272                 cuse_unlock();
 273
 274                 if (ptr == NULL)
 275                         break;
 276         }
 277
 278         if (cuse_dev != NULL)
 279                 destroy_dev(cuse_dev);
 280
 281         mtx_destroy(&cuse_mtx);
 282 }
 283 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0);
 284
 285 static int
 286 cuse_server_get(struct cuse_server **ppcs)
 287 {
 288         struct cuse_server *pcs;
 289         int error;
 290
 291         error = devfs_get_cdevpriv((void **)&pcs);
 292         if (error != 0) {
 293                 *ppcs = NULL;
 294                 return (error);
 295         }
 296         /* check if closing */
 297         cuse_lock();
 298         if (pcs->is_closing) {
 299                 cuse_unlock();
 300                 *ppcs = NULL;
 301                 return (EINVAL);
 302         }
 303         cuse_unlock();
 304         *ppcs = pcs;
 305         return (0);
 306 }
 307
 308 static void
 309 cuse_server_is_closing(struct cuse_server *pcs)
 310 {
 311         struct cuse_client *pcc;
 312
 313         if (pcs->is_closing)
 314                 return;
 315
 316         pcs->is_closing = 1;
 317
 318         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 319                 cuse_client_is_closing(pcc);
 320         }
 321 }
 322
 323 static struct cuse_client_command *
 324 cuse_server_find_command(struct cuse_server *pcs, struct thread *td)
 325 {
 326         struct cuse_client *pcc;
 327         int n;
 328
 329         if (pcs->is_closing)
 330                 goto done;
 331
 332         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 333                 if (CUSE_CLIENT_CLOSING(pcc))
 334                         continue;
 335                 for (n = 0; n != CUSE_CMD_MAX; n++) {
 336                         if (pcc->cmds[n].entered == td)
 337                                 return (&pcc->cmds[n]);
 338                 }
 339         }
 340 done:
 341         return (NULL);
 342 }
 343
 344 static void
 345 cuse_str_filter(char *ptr)
 346 {
 347         int c;
 348
 349         while (((c = *ptr) != 0)) {
 350
 351                 if ((c >= 'a') && (c <= 'z')) {
 352                         ptr++;
 353                         continue;
 354                 }
 355                 if ((c >= 'A') && (c <= 'Z')) {
 356                         ptr++;
 357                         continue;
 358                 }
 359                 if ((c >= '0') && (c <= '9')) {
 360                         ptr++;
 361                         continue;
 362                 }
 363                 if ((c == '.') || (c == '_') || (c == '/')) {
 364                         ptr++;
 365                         continue;
 366                 }
 367                 *ptr = '_';
 368
 369                 ptr++;
 370         }
 371 }
 372
 373 static int
 374 cuse_convert_error(int error)
 375 {
 376         ;                               /* indent fix */
 377         switch (error) {
 378         case CUSE_ERR_NONE:
 379                 return (0);
 380         case CUSE_ERR_BUSY:
 381                 return (EBUSY);
 382         case CUSE_ERR_WOULDBLOCK:
 383                 return (EWOULDBLOCK);
 384         case CUSE_ERR_INVALID:
 385                 return (EINVAL);
 386         case CUSE_ERR_NO_MEMORY:
 387                 return (ENOMEM);
 388         case CUSE_ERR_FAULT:
 389                 return (EFAULT);
 390         case CUSE_ERR_SIGNAL:
 391                 return (EINTR);
 392         case CUSE_ERR_NO_DEVICE:
 393                 return (ENODEV);
 394         default:
 395                 return (ENXIO);
 396         }
 397 }
 398
 399 static void
 400 cuse_vm_memory_free(struct cuse_memory *mem)
 401 {
 402         /* last user is gone - free */
 403         vm_object_deallocate(mem->object);
 404
 405         /* free CUSE memory */
 406         free(mem, M_CUSE);
 407 }
 408
 409 static int
 410 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr,
 411     uint32_t page_count)
 412 {
 413         struct cuse_memory *temp;
 414         struct cuse_memory *mem;
 415         vm_object_t object;
 416         int error;
 417
 418         mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO);
 419         if (mem == NULL)
 420                 return (ENOMEM);
 421
 422         object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count,
 423             VM_PROT_DEFAULT, 0, curthread->td_ucred);
 424         if (object == NULL) {
 425                 error = ENOMEM;
 426                 goto error_0;
 427         }
 428
 429         cuse_lock();
 430         /* check if allocation number already exists */
 431         TAILQ_FOREACH(temp, &pcs->hmem, entry) {
 432                 if (temp->alloc_nr == alloc_nr)
 433                         break;
 434         }
 435         if (temp != NULL) {
 436                 cuse_unlock();
 437                 error = EBUSY;
 438                 goto error_1;
 439         }
 440         mem->object = object;
 441         mem->page_count = page_count;
 442         mem->alloc_nr = alloc_nr;
 443         TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry);
 444         cuse_unlock();
 445
 446         return (0);
 447
 448 error_1:
 449         vm_object_deallocate(object);
 450 error_0:
 451         free(mem, M_CUSE);
 452         return (error);
 453 }
 454
 455 static int
 456 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr)
 457 {
 458         struct cuse_memory *mem;
 459
 460         cuse_lock();
 461         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
 462                 if (mem->alloc_nr == alloc_nr)
 463                         break;
 464         }
 465         if (mem == NULL) {
 466                 cuse_unlock();
 467                 return (EINVAL);
 468         }
 469         TAILQ_REMOVE(&pcs->hmem, mem, entry);
 470         cuse_unlock();
 471
 472         cuse_vm_memory_free(mem);
 473
 474         return (0);
 475 }
 476
 477 static int
 478 cuse_client_get(struct cuse_client **ppcc)
 479 {
 480         struct cuse_client *pcc;
 481         int error;
 482
 483         /* try to get private data */
 484         error = devfs_get_cdevpriv((void **)&pcc);
 485         if (error != 0) {
 486                 *ppcc = NULL;
 487                 return (error);
 488         }
 489         /* check if closing */
 490         cuse_lock();
 491         if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) {
 492                 cuse_unlock();
 493                 *ppcc = NULL;
 494                 return (EINVAL);
 495         }
 496         cuse_unlock();
 497         *ppcc = pcc;
 498         return (0);
 499 }
 500
 501 static void
 502 cuse_client_is_closing(struct cuse_client *pcc)
 503 {
 504         struct cuse_client_command *pccmd;
 505         uint32_t n;
 506
 507         if (CUSE_CLIENT_CLOSING(pcc))
 508                 return;
 509
 510         pcc->cflags |= CUSE_CLI_IS_CLOSING;
 511         pcc->server_dev = NULL;
 512
 513         for (n = 0; n != CUSE_CMD_MAX; n++) {
 514
 515                 pccmd = &pcc->cmds[n];
 516
 517                 if (pccmd->entry.tqe_prev != NULL) {
 518                         TAILQ_REMOVE(&pcc->server->head, pccmd, entry);
 519                         pccmd->entry.tqe_prev = NULL;
 520                 }
 521                 cv_broadcast(&pccmd->cv);
 522         }
 523 }
 524
 525 static void
 526 cuse_client_send_command_locked(struct cuse_client_command *pccmd,
 527     uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag)
 528 {
 529         unsigned long cuse_fflags = 0;
 530         struct cuse_server *pcs;
 531
 532         if (fflags & FREAD)
 533                 cuse_fflags |= CUSE_FFLAG_READ;
 534
 535         if (fflags & FWRITE)
 536                 cuse_fflags |= CUSE_FFLAG_WRITE;
 537
 538         if (ioflag & IO_NDELAY)
 539                 cuse_fflags |= CUSE_FFLAG_NONBLOCK;
 540 #if defined(__LP64__)
 541         if (SV_CURPROC_FLAG(SV_ILP32))
 542                 cuse_fflags |= CUSE_FFLAG_COMPAT32;
 543 #endif
 544         pccmd->sub.fflags = cuse_fflags;
 545         pccmd->sub.data_pointer = data_ptr;
 546         pccmd->sub.argument = arg;
 547
 548         pcs = pccmd->client->server;
 549
 550         if ((pccmd->entry.tqe_prev == NULL) &&
 551             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
 552             (pcs->is_closing == 0)) {
 553                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
 554                 cv_signal(&pcs->cv);
 555         }
 556 }
 557
 558 static void
 559 cuse_client_got_signal(struct cuse_client_command *pccmd)
 560 {
 561         struct cuse_server *pcs;
 562
 563         pccmd->got_signal = 1;
 564
 565         pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL];
 566
 567         pcs = pccmd->client->server;
 568
 569         if ((pccmd->entry.tqe_prev == NULL) &&
 570             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
 571             (pcs->is_closing == 0)) {
 572                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
 573                 cv_signal(&pcs->cv);
 574         }
 575 }
 576
 577 static int
 578 cuse_client_receive_command_locked(struct cuse_client_command *pccmd,
 579     uint8_t *arg_ptr, uint32_t arg_len)
 580 {
 581         int error;
 582
 583         error = 0;
 584
 585         pccmd->proc_curr = curthread->td_proc;
 586
 587         if (CUSE_CLIENT_CLOSING(pccmd->client) ||
 588             pccmd->client->server->is_closing) {
 589                 error = CUSE_ERR_OTHER;
 590                 goto done;
 591         }
 592         while (pccmd->command == CUSE_CMD_NONE) {
 593                 if (error != 0) {
 594                         cv_wait(&pccmd->cv, &cuse_mtx);
 595                 } else {
 596                         error = cv_wait_sig(&pccmd->cv, &cuse_mtx);
 597
 598                         if (error != 0)
 599                                 cuse_client_got_signal(pccmd);
 600                 }
 601                 if (CUSE_CLIENT_CLOSING(pccmd->client) ||
 602                     pccmd->client->server->is_closing) {
 603                         error = CUSE_ERR_OTHER;
 604                         goto done;
 605                 }
 606         }
 607
 608         error = pccmd->error;
 609         pccmd->command = CUSE_CMD_NONE;
 610         cv_signal(&pccmd->cv);
 611
 612 done:
 613
 614         /* wait until all process references are gone */
 615
 616         pccmd->proc_curr = NULL;
 617
 618         while (pccmd->proc_refs != 0)
 619                 cv_wait(&pccmd->cv, &cuse_mtx);
 620
 621         return (error);
 622 }
 623
 624 /*------------------------------------------------------------------------*
 625  *      CUSE SERVER PART
 626  *------------------------------------------------------------------------*/
 627
 628 static void
 629 cuse_server_free_dev(struct cuse_server_dev *pcsd)
 630 {
 631         struct cuse_server *pcs;
 632         struct cuse_client *pcc;
 633
 634         /* get server pointer */
 635         pcs = pcsd->server;
 636
 637         /* prevent creation of more devices */
 638         cuse_lock();
 639         if (pcsd->kern_dev != NULL)
 640                 pcsd->kern_dev->si_drv1 = NULL;
 641
 642         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 643                 if (pcc->server_dev == pcsd)
 644                         cuse_client_is_closing(pcc);
 645         }
 646         cuse_unlock();
 647
 648         /* destroy device, if any */
 649         if (pcsd->kern_dev != NULL) {
 650                 /* destroy device synchronously */
 651                 destroy_dev(pcsd->kern_dev);
 652         }
 653         free(pcsd, M_CUSE);
 654 }
 655
 656 static void
 657 cuse_server_unref(struct cuse_server *pcs)
 658 {
 659         struct cuse_server_dev *pcsd;
 660         struct cuse_memory *mem;
 661
 662         cuse_lock();
 663         pcs->refs--;
 664         if (pcs->refs != 0) {
 665                 cuse_unlock();
 666                 return;
 667         }
 668         cuse_server_is_closing(pcs);
 669         /* final client wakeup, if any */
 670         cuse_server_wakeup_all_client_locked(pcs);
 671
 672         TAILQ_REMOVE(&cuse_server_head, pcs, entry);
 673
 674         while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) {
 675                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
 676                 cuse_unlock();
 677                 cuse_server_free_dev(pcsd);
 678                 cuse_lock();
 679         }
 680
 681         cuse_free_unit_by_id_locked(pcs, -1);
 682
 683         while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) {
 684                 TAILQ_REMOVE(&pcs->hmem, mem, entry);
 685                 cuse_unlock();
 686                 cuse_vm_memory_free(mem);
 687                 cuse_lock();
 688         }
 689
 690         knlist_clear(&pcs->selinfo.si_note, 1);
 691         knlist_destroy(&pcs->selinfo.si_note);
 692
 693         cuse_unlock();
 694
 695         seldrain(&pcs->selinfo);
 696
 697         cv_destroy(&pcs->cv);
 698
 699         free(pcs, M_CUSE);
 700 }
 701
 702 static int
 703 cuse_server_do_close(struct cuse_server *pcs)
 704 {
 705         int retval;
 706
 707         cuse_lock();
 708         cuse_server_is_closing(pcs);
 709         /* final client wakeup, if any */
 710         cuse_server_wakeup_all_client_locked(pcs);
 711
 712         knlist_clear(&pcs->selinfo.si_note, 1);
 713
 714         retval = pcs->refs;
 715         cuse_unlock();
 716
 717         return (retval);
 718 }
 719
 720 static void
 721 cuse_server_free(void *arg)
 722 {
 723         struct cuse_server *pcs = arg;
 724
 725         /*
 726          * The final server unref should be done by the server thread
 727          * to prevent deadlock in the client cdevpriv destructor,
 728          * which cannot destroy itself.
 729          */
 730         while (cuse_server_do_close(pcs) != 1)
 731                 pause("W", hz);
 732
 733         /* drop final refcount */
 734         cuse_server_unref(pcs);
 735 }
 736
 737 static int
 738 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
 739 {
 740         struct cuse_server *pcs;
 741
 742         pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO);
 743         if (pcs == NULL)
 744                 return (ENOMEM);
 745
 746         if (devfs_set_cdevpriv(pcs, &cuse_server_free)) {
 747                 printf("Cuse: Cannot set cdevpriv.\n");
 748                 free(pcs, M_CUSE);
 749                 return (ENOMEM);
 750         }
 751         /* store current process ID */
 752         pcs->pid = curproc->p_pid;
 753
 754         TAILQ_INIT(&pcs->head);
 755         TAILQ_INIT(&pcs->hdev);
 756         TAILQ_INIT(&pcs->hcli);
 757         TAILQ_INIT(&pcs->hmem);
 758
 759         cv_init(&pcs->cv, "cuse-server-cv");
 760
 761         knlist_init_mtx(&pcs->selinfo.si_note, &cuse_mtx);
 762
 763         cuse_lock();
 764         pcs->refs++;
 765         TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry);
 766         cuse_unlock();
 767
 768         return (0);
 769 }
 770
 771 static int
 772 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 773 {
 774         struct cuse_server *pcs;
 775
 776         if (cuse_server_get(&pcs) == 0)
 777                 cuse_server_do_close(pcs);
 778
 779         return (0);
 780 }
 781
 782 static int
 783 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag)
 784 {
 785         return (ENXIO);
 786 }
 787
 788 static int
 789 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag)
 790 {
 791         return (ENXIO);
 792 }
 793
 794 static int
 795 cuse_server_ioctl_copy_locked(struct cuse_client_command *pccmd,
 796     struct cuse_data_chunk *pchk, int isread)
 797 {
 798         struct proc *p_proc;
 799         uint32_t offset;
 800         int error;
 801
 802         offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR;
 803
 804         if (pchk->length > CUSE_BUFFER_MAX)
 805                 return (EFAULT);
 806
 807         if (offset >= CUSE_BUFFER_MAX)
 808                 return (EFAULT);
 809
 810         if ((offset + pchk->length) > CUSE_BUFFER_MAX)
 811                 return (EFAULT);
 812
 813         p_proc = pccmd->proc_curr;
 814         if (p_proc == NULL)
 815                 return (ENXIO);
 816
 817         if (pccmd->proc_refs < 0)
 818                 return (ENOMEM);
 819
 820         pccmd->proc_refs++;
 821
 822         cuse_unlock();
 823
 824         if (isread == 0) {
 825                 error = copyin(
 826                     (void *)pchk->local_ptr,
 827                     pccmd->client->ioctl_buffer + offset,
 828                     pchk->length);
 829         } else {
 830                 error = copyout(
 831                     pccmd->client->ioctl_buffer + offset,
 832                     (void *)pchk->local_ptr,
 833                     pchk->length);
 834         }
 835
 836         cuse_lock();
 837
 838         pccmd->proc_refs--;
 839
 840         if (pccmd->proc_curr == NULL)
 841                 cv_signal(&pccmd->cv);
 842
 843         return (error);
 844 }
 845
 846 static int
 847 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s,
 848     struct proc *proc_d, vm_offset_t data_d, size_t len)
 849 {
 850         struct thread *td;
 851         struct proc *proc_cur;
 852         int error;
 853
 854         td = curthread;
 855         proc_cur = td->td_proc;
 856
 857         if (proc_cur == proc_d) {
 858                 struct iovec iov = {
 859                         .iov_base = (caddr_t)data_d,
 860                         .iov_len = len,
 861                 };
 862                 struct uio uio = {
 863                         .uio_iov = &iov,
 864                         .uio_iovcnt = 1,
 865                         .uio_offset = (off_t)data_s,
 866                         .uio_resid = len,
 867                         .uio_segflg = UIO_USERSPACE,
 868                         .uio_rw = UIO_READ,
 869                         .uio_td = td,
 870                 };
 871
 872                 PHOLD(proc_s);
 873                 error = proc_rwmem(proc_s, &uio);
 874                 PRELE(proc_s);
 875
 876         } else if (proc_cur == proc_s) {
 877                 struct iovec iov = {
 878                         .iov_base = (caddr_t)data_s,
 879                         .iov_len = len,
 880                 };
 881                 struct uio uio = {
 882                         .uio_iov = &iov,
 883                         .uio_iovcnt = 1,
 884                         .uio_offset = (off_t)data_d,
 885                         .uio_resid = len,
 886                         .uio_segflg = UIO_USERSPACE,
 887                         .uio_rw = UIO_WRITE,
 888                         .uio_td = td,
 889                 };
 890
 891                 PHOLD(proc_d);
 892                 error = proc_rwmem(proc_d, &uio);
 893                 PRELE(proc_d);
 894         } else {
 895                 error = EINVAL;
 896         }
 897         return (error);
 898 }
 899
 900 static int
 901 cuse_server_data_copy_locked(struct cuse_client_command *pccmd,
 902     struct cuse_data_chunk *pchk, int isread)
 903 {
 904         struct proc *p_proc;
 905         int error;
 906
 907         p_proc = pccmd->proc_curr;
 908         if (p_proc == NULL)
 909                 return (ENXIO);
 910
 911         if (pccmd->proc_refs < 0)
 912                 return (ENOMEM);
 913
 914         pccmd->proc_refs++;
 915
 916         cuse_unlock();
 917
 918         if (isread == 0) {
 919                 error = cuse_proc2proc_copy(
 920                     curthread->td_proc, pchk->local_ptr,
 921                     p_proc, pchk->peer_ptr,
 922                     pchk->length);
 923         } else {
 924                 error = cuse_proc2proc_copy(
 925                     p_proc, pchk->peer_ptr,
 926                     curthread->td_proc, pchk->local_ptr,
 927                     pchk->length);
 928         }
 929
 930         cuse_lock();
 931
 932         pccmd->proc_refs--;
 933
 934         if (pccmd->proc_curr == NULL)
 935                 cv_signal(&pccmd->cv);
 936
 937         return (error);
 938 }
 939
 940 static int
 941 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id)
 942 {
 943         int n;
 944         int x = 0;
 945         int match;
 946
 947         do {
 948                 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) {
 949                         if (cuse_alloc_unit[n] != NULL) {
 950                                 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK)
 951                                         continue;
 952                                 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) {
 953                                         x++;
 954                                         match = 1;
 955                                 }
 956                         }
 957                 }
 958         } while (match);
 959
 960         if (x < 256) {
 961                 for (n = 0; n != CUSE_DEVICES_MAX; n++) {
 962                         if (cuse_alloc_unit[n] == NULL) {
 963                                 cuse_alloc_unit[n] = pcs;
 964                                 cuse_alloc_unit_id[n] = id | x;
 965                                 return (x);
 966                         }
 967                 }
 968         }
 969         return (-1);
 970 }
 971
 972 static void
 973 cuse_server_wakeup_locked(struct cuse_server *pcs)
 974 {
 975         selwakeup(&pcs->selinfo);
 976         KNOTE_LOCKED(&pcs->selinfo.si_note, 0);
 977 }
 978
 979 static void
 980 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs)
 981 {
 982         struct cuse_client *pcc;
 983
 984         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 985                 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ |
 986                     CUSE_CLI_KNOTE_NEED_WRITE);
 987         }
 988         cuse_server_wakeup_locked(pcs);
 989 }
 990
 991 static int
 992 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id)
 993 {
 994         int n;
 995         int found = 0;
 996
 997         for (n = 0; n != CUSE_DEVICES_MAX; n++) {
 998                 if (cuse_alloc_unit[n] == pcs) {
 999                         if (cuse_alloc_unit_id[n] == id || id == -1) {
1000                                 cuse_alloc_unit[n] = NULL;
1001                                 cuse_alloc_unit_id[n] = 0;
1002                                 found = 1;
1003                         }
1004                 }
1005         }
1006
1007         return (found ? 0 : EINVAL);
1008 }
1009
1010 static int
1011 cuse_server_ioctl(struct cdev *dev, unsigned long cmd,
1012     caddr_t data, int fflag, struct thread *td)
1013 {
1014         struct cuse_server *pcs;
1015         int error;
1016
1017         error = cuse_server_get(&pcs);
1018         if (error != 0)
1019                 return (error);
1020
1021         switch (cmd) {
1022                 struct cuse_client_command *pccmd;
1023                 struct cuse_client *pcc;
1024                 struct cuse_command *pcmd;
1025                 struct cuse_alloc_info *pai;
1026                 struct cuse_create_dev *pcd;
1027                 struct cuse_server_dev *pcsd;
1028                 struct cuse_data_chunk *pchk;
1029                 int n;
1030
1031         case CUSE_IOCTL_GET_COMMAND:
1032                 pcmd = (void *)data;
1033
1034                 cuse_lock();
1035
1036                 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) {
1037                         error = cv_wait_sig(&pcs->cv, &cuse_mtx);
1038
1039                         if (pcs->is_closing)
1040                                 error = ENXIO;
1041
1042                         if (error) {
1043                                 cuse_unlock();
1044                                 return (error);
1045                         }
1046                 }
1047
1048                 TAILQ_REMOVE(&pcs->head, pccmd, entry);
1049                 pccmd->entry.tqe_prev = NULL;
1050
1051                 pccmd->entered = curthread;
1052
1053                 *pcmd = pccmd->sub;
1054
1055                 cuse_unlock();
1056
1057                 break;
1058
1059         case CUSE_IOCTL_SYNC_COMMAND:
1060
1061                 cuse_lock();
1062                 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) {
1063
1064                         /* send sync command */
1065                         pccmd->entered = NULL;
1066                         pccmd->error = *(int *)data;
1067                         pccmd->command = CUSE_CMD_SYNC;
1068
1069                         /* signal peer, if any */
1070                         cv_signal(&pccmd->cv);
1071                 }
1072                 cuse_unlock();
1073
1074                 break;
1075
1076         case CUSE_IOCTL_ALLOC_UNIT:
1077
1078                 cuse_lock();
1079                 n = cuse_alloc_unit_by_id_locked(pcs,
1080                     CUSE_ID_DEFAULT(0));
1081                 cuse_unlock();
1082
1083                 if (n < 0)
1084                         error = ENOMEM;
1085                 else
1086                         *(int *)data = n;
1087                 break;
1088
1089         case CUSE_IOCTL_ALLOC_UNIT_BY_ID:
1090
1091                 n = *(int *)data;
1092
1093                 n = (n & CUSE_ID_MASK);
1094
1095                 cuse_lock();
1096                 n = cuse_alloc_unit_by_id_locked(pcs, n);
1097                 cuse_unlock();
1098
1099                 if (n < 0)
1100                         error = ENOMEM;
1101                 else
1102                         *(int *)data = n;
1103                 break;
1104
1105         case CUSE_IOCTL_FREE_UNIT:
1106
1107                 n = *(int *)data;
1108
1109                 n = CUSE_ID_DEFAULT(n);
1110
1111                 cuse_lock();
1112                 error = cuse_free_unit_by_id_locked(pcs, n);
1113                 cuse_unlock();
1114                 break;
1115
1116         case CUSE_IOCTL_FREE_UNIT_BY_ID:
1117
1118                 n = *(int *)data;
1119
1120                 cuse_lock();
1121                 error = cuse_free_unit_by_id_locked(pcs, n);
1122                 cuse_unlock();
1123                 break;
1124
1125         case CUSE_IOCTL_ALLOC_MEMORY:
1126
1127                 pai = (void *)data;
1128
1129                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1130                         error = ENOMEM;
1131                         break;
1132                 }
1133                 if (pai->page_count >= CUSE_ALLOC_PAGES_MAX) {
1134                         error = ENOMEM;
1135                         break;
1136                 }
1137                 error = cuse_server_alloc_memory(pcs,
1138                     pai->alloc_nr, pai->page_count);
1139                 break;
1140
1141         case CUSE_IOCTL_FREE_MEMORY:
1142                 pai = (void *)data;
1143
1144                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
1145                         error = ENOMEM;
1146                         break;
1147                 }
1148                 error = cuse_server_free_memory(pcs, pai->alloc_nr);
1149                 break;
1150
1151         case CUSE_IOCTL_GET_SIG:
1152
1153                 cuse_lock();
1154                 pccmd = cuse_server_find_command(pcs, curthread);
1155
1156                 if (pccmd != NULL) {
1157                         n = pccmd->got_signal;
1158                         pccmd->got_signal = 0;
1159                 } else {
1160                         n = 0;
1161                 }
1162                 cuse_unlock();
1163
1164                 *(int *)data = n;
1165
1166                 break;
1167
1168         case CUSE_IOCTL_SET_PFH:
1169
1170                 cuse_lock();
1171                 pccmd = cuse_server_find_command(pcs, curthread);
1172
1173                 if (pccmd != NULL) {
1174                         pcc = pccmd->client;
1175                         for (n = 0; n != CUSE_CMD_MAX; n++) {
1176                                 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data;
1177                         }
1178                 } else {
1179                         error = ENXIO;
1180                 }
1181                 cuse_unlock();
1182                 break;
1183
1184         case CUSE_IOCTL_CREATE_DEV:
1185
1186                 error = priv_check(curthread, PRIV_DRIVER);
1187                 if (error)
1188                         break;
1189
1190                 pcd = (void *)data;
1191
1192                 /* filter input */
1193
1194                 pcd->devname[sizeof(pcd->devname) - 1] = 0;
1195
1196                 if (pcd->devname[0] == 0) {
1197                         error = EINVAL;
1198                         break;
1199                 }
1200                 cuse_str_filter(pcd->devname);
1201
1202                 pcd->permissions &= 0777;
1203
1204                 /* try to allocate a character device */
1205
1206                 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO);
1207
1208                 if (pcsd == NULL) {
1209                         error = ENOMEM;
1210                         break;
1211                 }
1212                 pcsd->server = pcs;
1213
1214                 pcsd->user_dev = pcd->dev;
1215
1216                 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME,
1217                     &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id,
1218                     pcd->permissions, "%s", pcd->devname);
1219
1220                 if (pcsd->kern_dev == NULL) {
1221                         free(pcsd, M_CUSE);
1222                         error = ENOMEM;
1223                         break;
1224                 }
1225                 pcsd->kern_dev->si_drv1 = pcsd;
1226
1227                 cuse_lock();
1228                 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry);
1229                 cuse_unlock();
1230
1231                 break;
1232
1233         case CUSE_IOCTL_DESTROY_DEV:
1234
1235                 error = priv_check(curthread, PRIV_DRIVER);
1236                 if (error)
1237                         break;
1238
1239                 cuse_lock();
1240
1241                 error = EINVAL;
1242
1243                 pcsd = TAILQ_FIRST(&pcs->hdev);
1244                 while (pcsd != NULL) {
1245                         if (pcsd->user_dev == *(struct cuse_dev **)data) {
1246                                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
1247                                 cuse_unlock();
1248                                 cuse_server_free_dev(pcsd);
1249                                 cuse_lock();
1250                                 error = 0;
1251                                 pcsd = TAILQ_FIRST(&pcs->hdev);
1252                         } else {
1253                                 pcsd = TAILQ_NEXT(pcsd, entry);
1254                         }
1255                 }
1256
1257                 cuse_unlock();
1258                 break;
1259
1260         case CUSE_IOCTL_WRITE_DATA:
1261         case CUSE_IOCTL_READ_DATA:
1262
1263                 cuse_lock();
1264                 pchk = (struct cuse_data_chunk *)data;
1265
1266                 pccmd = cuse_server_find_command(pcs, curthread);
1267
1268                 if (pccmd == NULL) {
1269                         error = ENXIO;  /* invalid request */
1270                 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) {
1271                         error = EFAULT; /* NULL pointer */
1272                 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) {
1273                         error = cuse_server_ioctl_copy_locked(pccmd,
1274                             pchk, cmd == CUSE_IOCTL_READ_DATA);
1275                 } else {
1276                         error = cuse_server_data_copy_locked(pccmd,
1277                             pchk, cmd == CUSE_IOCTL_READ_DATA);
1278                 }
1279                 cuse_unlock();
1280                 break;
1281
1282         case CUSE_IOCTL_SELWAKEUP:
1283                 cuse_lock();
1284                 /*
1285                  * We don't know which direction caused the event.
1286                  * Wakeup both!
1287                  */
1288                 cuse_server_wakeup_all_client_locked(pcs);
1289                 cuse_unlock();
1290                 break;
1291
1292         default:
1293                 error = ENXIO;
1294                 break;
1295         }
1296         return (error);
1297 }
1298
1299 static int
1300 cuse_server_poll(struct cdev *dev, int events, struct thread *td)
1301 {
1302         return (events & (POLLHUP | POLLPRI | POLLIN |
1303             POLLRDNORM | POLLOUT | POLLWRNORM));
1304 }
1305
1306 static int
1307 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1308     vm_size_t size, struct vm_object **object, int nprot)
1309 {
1310         uint32_t page_nr = *offset / PAGE_SIZE;
1311         uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1312         struct cuse_memory *mem;
1313         struct cuse_server *pcs;
1314         int error;
1315
1316         error = cuse_server_get(&pcs);
1317         if (error != 0)
1318                 return (error);
1319
1320         cuse_lock();
1321         /* lookup memory structure */
1322         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
1323                 if (mem->alloc_nr == alloc_nr)
1324                         break;
1325         }
1326         if (mem == NULL) {
1327                 cuse_unlock();
1328                 return (ENOMEM);
1329         }
1330         /* verify page offset */
1331         page_nr %= CUSE_ALLOC_PAGES_MAX;
1332         if (page_nr >= mem->page_count) {
1333                 cuse_unlock();
1334                 return (ENXIO);
1335         }
1336         /* verify mmap size */
1337         if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1338             (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1339                 cuse_unlock();
1340                 return (EINVAL);
1341         }
1342         vm_object_reference(mem->object);
1343         *object = mem->object;
1344         cuse_unlock();
1345
1346         /* set new VM object offset to use */
1347         *offset = page_nr * PAGE_SIZE;
1348
1349         /* success */
1350         return (0);
1351 }
1352
1353 /*------------------------------------------------------------------------*
1354  *      CUSE CLIENT PART
1355  *------------------------------------------------------------------------*/
1356 static void
1357 cuse_client_free(void *arg)
1358 {
1359         struct cuse_client *pcc = arg;
1360         struct cuse_client_command *pccmd;
1361         struct cuse_server *pcs;
1362         int n;
1363
1364         cuse_lock();
1365         cuse_client_is_closing(pcc);
1366         TAILQ_REMOVE(&pcc->server->hcli, pcc, entry);
1367         cuse_unlock();
1368
1369         for (n = 0; n != CUSE_CMD_MAX; n++) {
1370
1371                 pccmd = &pcc->cmds[n];
1372
1373                 sx_destroy(&pccmd->sx);
1374                 cv_destroy(&pccmd->cv);
1375         }
1376
1377         pcs = pcc->server;
1378
1379         free(pcc, M_CUSE);
1380
1381         /* drop reference on server */
1382         cuse_server_unref(pcs);
1383 }
1384
1385 static int
1386 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
1387 {
1388         struct cuse_client_command *pccmd;
1389         struct cuse_server_dev *pcsd;
1390         struct cuse_client *pcc;
1391         struct cuse_server *pcs;
1392         struct cuse_dev *pcd;
1393         int error;
1394         int n;
1395
1396         cuse_lock();
1397         pcsd = dev->si_drv1;
1398         if (pcsd != NULL) {
1399                 pcs = pcsd->server;
1400                 pcd = pcsd->user_dev;
1401                 /*
1402                  * Check that the refcount didn't wrap and that the
1403                  * same process is not both client and server. This
1404                  * can easily lead to deadlocks when destroying the
1405                  * CUSE character device nodes:
1406                  */
1407                 pcs->refs++;
1408                 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) {
1409                         /* overflow or wrong PID */
1410                         pcs->refs--;
1411                         pcsd = NULL;
1412                 }
1413         } else {
1414                 pcs = NULL;
1415                 pcd = NULL;
1416         }
1417         cuse_unlock();
1418
1419         if (pcsd == NULL)
1420                 return (EINVAL);
1421
1422         pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO);
1423         if (pcc == NULL) {
1424                 /* drop reference on server */
1425                 cuse_server_unref(pcs);
1426                 return (ENOMEM);
1427         }
1428         if (devfs_set_cdevpriv(pcc, &cuse_client_free)) {
1429                 printf("Cuse: Cannot set cdevpriv.\n");
1430                 /* drop reference on server */
1431                 cuse_server_unref(pcs);
1432                 free(pcc, M_CUSE);
1433                 return (ENOMEM);
1434         }
1435         pcc->fflags = fflags;
1436         pcc->server_dev = pcsd;
1437         pcc->server = pcs;
1438
1439         for (n = 0; n != CUSE_CMD_MAX; n++) {
1440
1441                 pccmd = &pcc->cmds[n];
1442
1443                 pccmd->sub.dev = pcd;
1444                 pccmd->sub.command = n;
1445                 pccmd->client = pcc;
1446
1447                 sx_init(&pccmd->sx, "cuse-client-sx");
1448                 cv_init(&pccmd->cv, "cuse-client-cv");
1449         }
1450
1451         cuse_lock();
1452
1453         /* cuse_client_free() assumes that the client is listed somewhere! */
1454         /* always enqueue */
1455
1456         TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry);
1457
1458         /* check if server is closing */
1459         if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) {
1460                 error = EINVAL;
1461         } else {
1462                 error = 0;
1463         }
1464         cuse_unlock();
1465
1466         if (error) {
1467                 devfs_clear_cdevpriv(); /* XXX bugfix */
1468                 return (error);
1469         }
1470         pccmd = &pcc->cmds[CUSE_CMD_OPEN];
1471
1472         cuse_cmd_lock(pccmd);
1473
1474         cuse_lock();
1475         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1476
1477         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1478         cuse_unlock();
1479
1480         if (error < 0) {
1481                 error = cuse_convert_error(error);
1482         } else {
1483                 error = 0;
1484         }
1485
1486         cuse_cmd_unlock(pccmd);
1487
1488         if (error)
1489                 devfs_clear_cdevpriv(); /* XXX bugfix */
1490
1491         return (error);
1492 }
1493
1494 static int
1495 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
1496 {
1497         struct cuse_client_command *pccmd;
1498         struct cuse_client *pcc;
1499         int error;
1500
1501         error = cuse_client_get(&pcc);
1502         if (error != 0)
1503                 return (0);
1504
1505         pccmd = &pcc->cmds[CUSE_CMD_CLOSE];
1506
1507         cuse_cmd_lock(pccmd);
1508
1509         cuse_lock();
1510         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
1511
1512         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1513         cuse_unlock();
1514
1515         cuse_cmd_unlock(pccmd);
1516
1517         cuse_lock();
1518         cuse_client_is_closing(pcc);
1519         cuse_unlock();
1520
1521         return (0);
1522 }
1523
1524 static void
1525 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc)
1526 {
1527         int temp;
1528
1529         cuse_lock();
1530         temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ |
1531             CUSE_CLI_KNOTE_HAS_WRITE));
1532         pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ |
1533             CUSE_CLI_KNOTE_NEED_WRITE);
1534         cuse_unlock();
1535
1536         if (temp != 0) {
1537                 /* get the latest polling state from the server */
1538                 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL);
1539
1540                 if (temp & (POLLIN | POLLOUT)) {
1541                         cuse_lock();
1542                         if (temp & POLLIN)
1543                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ;
1544                         if (temp & POLLOUT)
1545                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE;
1546
1547                         /* make sure the "knote" gets woken up */
1548                         cuse_server_wakeup_locked(pcc->server);
1549                         cuse_unlock();
1550                 }
1551         }
1552 }
1553
1554 static int
1555 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag)
1556 {
1557         struct cuse_client_command *pccmd;
1558         struct cuse_client *pcc;
1559         int error;
1560         int len;
1561
1562         error = cuse_client_get(&pcc);
1563         if (error != 0)
1564                 return (error);
1565
1566         pccmd = &pcc->cmds[CUSE_CMD_READ];
1567
1568         if (uio->uio_segflg != UIO_USERSPACE) {
1569                 return (EINVAL);
1570         }
1571         uio->uio_segflg = UIO_NOCOPY;
1572
1573         cuse_cmd_lock(pccmd);
1574
1575         while (uio->uio_resid != 0) {
1576
1577                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1578                         error = ENOMEM;
1579                         break;
1580                 }
1581                 len = uio->uio_iov->iov_len;
1582
1583                 cuse_lock();
1584                 cuse_client_send_command_locked(pccmd,
1585                     (uintptr_t)uio->uio_iov->iov_base,
1586                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1587
1588                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1589                 cuse_unlock();
1590
1591                 if (error < 0) {
1592                         error = cuse_convert_error(error);
1593                         break;
1594                 } else if (error == len) {
1595                         error = uiomove(NULL, error, uio);
1596                         if (error)
1597                                 break;
1598                 } else {
1599                         error = uiomove(NULL, error, uio);
1600                         break;
1601                 }
1602         }
1603         cuse_cmd_unlock(pccmd);
1604
1605         uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1606
1607         if (error == EWOULDBLOCK)
1608                 cuse_client_kqfilter_poll(dev, pcc);
1609
1610         return (error);
1611 }
1612
1613 static int
1614 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag)
1615 {
1616         struct cuse_client_command *pccmd;
1617         struct cuse_client *pcc;
1618         int error;
1619         int len;
1620
1621         error = cuse_client_get(&pcc);
1622         if (error != 0)
1623                 return (error);
1624
1625         pccmd = &pcc->cmds[CUSE_CMD_WRITE];
1626
1627         if (uio->uio_segflg != UIO_USERSPACE) {
1628                 return (EINVAL);
1629         }
1630         uio->uio_segflg = UIO_NOCOPY;
1631
1632         cuse_cmd_lock(pccmd);
1633
1634         while (uio->uio_resid != 0) {
1635
1636                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
1637                         error = ENOMEM;
1638                         break;
1639                 }
1640                 len = uio->uio_iov->iov_len;
1641
1642                 cuse_lock();
1643                 cuse_client_send_command_locked(pccmd,
1644                     (uintptr_t)uio->uio_iov->iov_base,
1645                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
1646
1647                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
1648                 cuse_unlock();
1649
1650                 if (error < 0) {
1651                         error = cuse_convert_error(error);
1652                         break;
1653                 } else if (error == len) {
1654                         error = uiomove(NULL, error, uio);
1655                         if (error)
1656                                 break;
1657                 } else {
1658                         error = uiomove(NULL, error, uio);
1659                         break;
1660                 }
1661         }
1662         cuse_cmd_unlock(pccmd);
1663
1664         uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
1665
1666         if (error == EWOULDBLOCK)
1667                 cuse_client_kqfilter_poll(dev, pcc);
1668
1669         return (error);
1670 }
1671
1672 int
1673 cuse_client_ioctl(struct cdev *dev, unsigned long cmd,
1674     caddr_t data, int fflag, struct thread *td)
1675 {
1676         struct cuse_client_command *pccmd;
1677         struct cuse_client *pcc;
1678         int error;
1679         int len;
1680
1681         error = cuse_client_get(&pcc);
1682         if (error != 0)
1683                 return (error);
1684
1685         len = IOCPARM_LEN(cmd);
1686         if (len > CUSE_BUFFER_MAX)
1687                 return (ENOMEM);
1688
1689         pccmd = &pcc->cmds[CUSE_CMD_IOCTL];
1690
1691         cuse_cmd_lock(pccmd);
1692
1693         if (cmd & (IOC_IN | IOC_VOID))
1694                 memcpy(pcc->ioctl_buffer, data, len);
1695
1696         /*
1697          * When the ioctl-length is zero drivers can pass information
1698          * through the data pointer of the ioctl. Make sure this information
1699          * is forwarded to the driver.
1700          */
1701
1702         cuse_lock();
1703         cuse_client_send_command_locked(pccmd,
1704             (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR,
1705             (unsigned long)cmd, pcc->fflags,
1706             (fflag & O_NONBLOCK) ? IO_NDELAY : 0);
1707
1708         error = cuse_client_receive_command_locked(pccmd, data, len);
1709         cuse_unlock();
1710
1711         if (error < 0) {
1712                 error = cuse_convert_error(error);
1713         } else {
1714                 error = 0;
1715         }
1716
1717         if (cmd & IOC_OUT)
1718                 memcpy(data, pcc->ioctl_buffer, len);
1719
1720         cuse_cmd_unlock(pccmd);
1721
1722         if (error == EWOULDBLOCK)
1723                 cuse_client_kqfilter_poll(dev, pcc);
1724
1725         return (error);
1726 }
1727
1728 static int
1729 cuse_client_poll(struct cdev *dev, int events, struct thread *td)
1730 {
1731         struct cuse_client_command *pccmd;
1732         struct cuse_client *pcc;
1733         unsigned long temp;
1734         int error;
1735         int revents;
1736
1737         error = cuse_client_get(&pcc);
1738         if (error != 0)
1739                 goto pollnval;
1740
1741         temp = 0;
1742
1743         if (events & (POLLPRI | POLLIN | POLLRDNORM))
1744                 temp |= CUSE_POLL_READ;
1745
1746         if (events & (POLLOUT | POLLWRNORM))
1747                 temp |= CUSE_POLL_WRITE;
1748
1749         if (events & POLLHUP)
1750                 temp |= CUSE_POLL_ERROR;
1751
1752         pccmd = &pcc->cmds[CUSE_CMD_POLL];
1753
1754         cuse_cmd_lock(pccmd);
1755
1756         /* Need to selrecord() first to not loose any events. */
1757         if (temp != 0 && td != NULL)
1758                 selrecord(td, &pcc->server->selinfo);
1759
1760         cuse_lock();
1761         cuse_client_send_command_locked(pccmd,
1762             0, temp, pcc->fflags, IO_NDELAY);
1763
1764         error = cuse_client_receive_command_locked(pccmd, 0, 0);
1765         cuse_unlock();
1766
1767         cuse_cmd_unlock(pccmd);
1768
1769         if (error < 0) {
1770                 goto pollnval;
1771         } else {
1772                 revents = 0;
1773                 if (error & CUSE_POLL_READ)
1774                         revents |= (events & (POLLPRI | POLLIN | POLLRDNORM));
1775                 if (error & CUSE_POLL_WRITE)
1776                         revents |= (events & (POLLOUT | POLLWRNORM));
1777                 if (error & CUSE_POLL_ERROR)
1778                         revents |= (events & POLLHUP);
1779         }
1780         return (revents);
1781
1782 pollnval:
1783         /* XXX many clients don't understand POLLNVAL */
1784         return (events & (POLLHUP | POLLPRI | POLLIN |
1785             POLLRDNORM | POLLOUT | POLLWRNORM));
1786 }
1787
1788 static int
1789 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
1790     vm_size_t size, struct vm_object **object, int nprot)
1791 {
1792         uint32_t page_nr = *offset / PAGE_SIZE;
1793         uint32_t alloc_nr = page_nr / CUSE_ALLOC_PAGES_MAX;
1794         struct cuse_memory *mem;
1795         struct cuse_client *pcc;
1796         int error;
1797
1798         error = cuse_client_get(&pcc);
1799         if (error != 0)
1800                 return (error);
1801
1802         cuse_lock();
1803         /* lookup memory structure */
1804         TAILQ_FOREACH(mem, &pcc->server->hmem, entry) {
1805                 if (mem->alloc_nr == alloc_nr)
1806                         break;
1807         }
1808         if (mem == NULL) {
1809                 cuse_unlock();
1810                 return (ENOMEM);
1811         }
1812         /* verify page offset */
1813         page_nr %= CUSE_ALLOC_PAGES_MAX;
1814         if (page_nr >= mem->page_count) {
1815                 cuse_unlock();
1816                 return (ENXIO);
1817         }
1818         /* verify mmap size */
1819         if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE) ||
1820             (size > ((mem->page_count - page_nr) * PAGE_SIZE))) {
1821                 cuse_unlock();
1822                 return (EINVAL);
1823         }
1824         vm_object_reference(mem->object);
1825         *object = mem->object;
1826         cuse_unlock();
1827
1828         /* set new VM object offset to use */
1829         *offset = page_nr * PAGE_SIZE;
1830
1831         /* success */
1832         return (0);
1833 }
1834
1835 static void
1836 cuse_client_kqfilter_read_detach(struct knote *kn)
1837 {
1838         struct cuse_client *pcc;
1839
1840         cuse_lock();
1841         pcc = kn->kn_hook;
1842         knlist_remove(&pcc->server->selinfo.si_note, kn, 1);
1843         cuse_unlock();
1844 }
1845
1846 static void
1847 cuse_client_kqfilter_write_detach(struct knote *kn)
1848 {
1849         struct cuse_client *pcc;
1850
1851         cuse_lock();
1852         pcc = kn->kn_hook;
1853         knlist_remove(&pcc->server->selinfo.si_note, kn, 1);
1854         cuse_unlock();
1855 }
1856
1857 static int
1858 cuse_client_kqfilter_read_event(struct knote *kn, long hint)
1859 {
1860         struct cuse_client *pcc;
1861
1862         mtx_assert(&cuse_mtx, MA_OWNED);
1863
1864         pcc = kn->kn_hook;
1865         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0);
1866 }
1867
1868 static int
1869 cuse_client_kqfilter_write_event(struct knote *kn, long hint)
1870 {
1871         struct cuse_client *pcc;
1872
1873         mtx_assert(&cuse_mtx, MA_OWNED);
1874
1875         pcc = kn->kn_hook;
1876         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0);
1877 }
1878
1879 static int
1880 cuse_client_kqfilter(struct cdev *dev, struct knote *kn)
1881 {
1882         struct cuse_client *pcc;
1883         struct cuse_server *pcs;
1884         int error;
1885
1886         error = cuse_client_get(&pcc);
1887         if (error != 0)
1888                 return (error);
1889
1890         cuse_lock();
1891         pcs = pcc->server;
1892         switch (kn->kn_filter) {
1893         case EVFILT_READ:
1894                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ;
1895                 kn->kn_hook = pcc;
1896                 kn->kn_fop = &cuse_client_kqfilter_read_ops;
1897                 knlist_add(&pcs->selinfo.si_note, kn, 1);
1898                 break;
1899         case EVFILT_WRITE:
1900                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE;
1901                 kn->kn_hook = pcc;
1902                 kn->kn_fop = &cuse_client_kqfilter_write_ops;
1903                 knlist_add(&pcs->selinfo.si_note, kn, 1);
1904                 break;
1905         default:
1906                 error = EINVAL;
1907                 break;
1908         }
1909         cuse_unlock();
1910
1911         if (error == 0)
1912                 cuse_client_kqfilter_poll(dev, pcc);
1913         return (error);
1914 }