cuse.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /* $FreeBSD$ */
    2 /*-
    3  * Copyright (c) 2010-2022 Hans Petter Selasky
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   24  * SUCH DAMAGE.
   25  */
   26 
   27 #include <sys/stdint.h>
   28 #include <sys/stddef.h>
   29 #include <sys/param.h>
   30 #include <sys/types.h>
   31 #include <sys/systm.h>
   32 #include <sys/conf.h>
   33 #include <sys/kernel.h>
   34 #include <sys/bus.h>
   35 #include <sys/linker_set.h>
   36 #include <sys/module.h>
   37 #include <sys/lock.h>
   38 #include <sys/mutex.h>
   39 #include <sys/condvar.h>
   40 #include <sys/sysctl.h>
   41 #include <sys/unistd.h>
   42 #include <sys/malloc.h>
   43 #include <sys/priv.h>
   44 #include <sys/uio.h>
   45 #include <sys/poll.h>
   46 #include <sys/sx.h>
   47 #include <sys/rwlock.h>
   48 #include <sys/queue.h>
   49 #include <sys/fcntl.h>
   50 #include <sys/proc.h>
   51 #include <sys/vnode.h>
   52 #include <sys/selinfo.h>
   53 #include <sys/ptrace.h>
   54 #include <sys/sysent.h>
   55 
   56 #include <machine/bus.h>
   57 
   58 #include <vm/vm.h>
   59 #include <vm/pmap.h>
   60 #include <vm/vm_object.h>
   61 #include <vm/vm_page.h>
   62 #include <vm/vm_pager.h>
   63 
   64 #include <fs/cuse/cuse_defs.h>
   65 #include <fs/cuse/cuse_ioctl.h>
   66 
   67 /* set this define to zero to disable this feature */
   68 #define CUSE_COPY_BUFFER_MAX \
   69         CUSE_BUFFER_MAX
   70 
   71 #define CUSE_ALLOC_PAGES_MAX \
   72         (CUSE_ALLOC_BYTES_MAX / PAGE_SIZE)
   73 
   74 #if (CUSE_ALLOC_PAGES_MAX == 0)
   75 #error "PAGE_SIZE is too big!"
   76 #endif
   77 
   78 static int
   79 cuse_modevent(module_t mod, int type, void *data)
   80 {
   81         switch (type) {
   82         case MOD_LOAD:
   83         case MOD_UNLOAD:
   84                 return (0);
   85         default:
   86                 return (EOPNOTSUPP);
   87         }
   88 }
   89 
   90 static moduledata_t cuse_mod = {
   91         .name = "cuse",
   92         .evhand = &cuse_modevent,
   93 };
   94 
   95 DECLARE_MODULE(cuse, cuse_mod, SI_SUB_DEVFS, SI_ORDER_FIRST);
   96 MODULE_VERSION(cuse, 1);
   97 
   98 /*
   99  * Prevent cuse4bsd.ko and cuse.ko from loading at the same time by
  100  * declaring support for the cuse4bsd interface in cuse.ko:
  101  */
  102 MODULE_VERSION(cuse4bsd, 1);
  103 
  104 #ifdef FEATURE
  105 FEATURE(cuse, "Userspace character devices");
  106 #endif
  107 
  108 struct cuse_command;
  109 struct cuse_server;
  110 struct cuse_client;
  111 
  112 struct cuse_client_command {
  113         TAILQ_ENTRY(cuse_client_command) entry;
  114         struct cuse_command sub;
  115         struct sx sx;
  116         struct cv cv;
  117         struct thread *entered;
  118         struct cuse_client *client;
  119         struct proc *proc_curr;
  120         int     proc_refs;
  121         int     got_signal;
  122         int     error;
  123         int     command;
  124 };
  125 
  126 struct cuse_memory {
  127         TAILQ_ENTRY(cuse_memory) entry;
  128         vm_object_t object;
  129         uint32_t page_count;
  130         uint32_t alloc_nr;
  131 };
  132 
  133 struct cuse_server_dev {
  134         TAILQ_ENTRY(cuse_server_dev) entry;
  135         struct cuse_server *server;
  136         struct cdev *kern_dev;
  137         struct cuse_dev *user_dev;
  138 };
  139 
  140 struct cuse_server {
  141         TAILQ_ENTRY(cuse_server) entry;
  142         TAILQ_HEAD(, cuse_client_command) head;
  143         TAILQ_HEAD(, cuse_server_dev) hdev;
  144         TAILQ_HEAD(, cuse_client) hcli;
  145         TAILQ_HEAD(, cuse_memory) hmem;
  146         struct mtx mtx;
  147         struct cv cv;
  148         struct selinfo selinfo;
  149         pid_t   pid;
  150         int     is_closing;
  151         int     refs;
  152 };
  153 
  154 struct cuse_client {
  155         TAILQ_ENTRY(cuse_client) entry;
  156         TAILQ_ENTRY(cuse_client) entry_ref;
  157         struct cuse_client_command cmds[CUSE_CMD_MAX];
  158         struct cuse_server *server;
  159         struct cuse_server_dev *server_dev;
  160 
  161         uintptr_t read_base;
  162         uintptr_t write_base;
  163         int read_length;
  164         int write_length;
  165         uint8_t read_buffer[CUSE_COPY_BUFFER_MAX] __aligned(4);
  166         uint8_t write_buffer[CUSE_COPY_BUFFER_MAX] __aligned(4);
  167         uint8_t ioctl_buffer[CUSE_BUFFER_MAX] __aligned(4);
  168 
  169         int     fflags;                 /* file flags */
  170         int     cflags;                 /* client flags */
  171 #define CUSE_CLI_IS_CLOSING 0x01
  172 #define CUSE_CLI_KNOTE_NEED_READ 0x02
  173 #define CUSE_CLI_KNOTE_NEED_WRITE 0x04
  174 #define CUSE_CLI_KNOTE_HAS_READ 0x08
  175 #define CUSE_CLI_KNOTE_HAS_WRITE 0x10
  176 };
  177 
  178 #define CUSE_CLIENT_CLOSING(pcc) \
  179     ((pcc)->cflags & CUSE_CLI_IS_CLOSING)
  180 
  181 static  MALLOC_DEFINE(M_CUSE, "cuse", "CUSE memory");
  182 
  183 static TAILQ_HEAD(, cuse_server) cuse_server_head;
  184 static struct mtx cuse_global_mtx;
  185 static struct cdev *cuse_dev;
  186 static struct cuse_server *cuse_alloc_unit[CUSE_DEVICES_MAX];
  187 static int cuse_alloc_unit_id[CUSE_DEVICES_MAX];
  188 
  189 static void cuse_server_wakeup_all_client_locked(struct cuse_server *pcs);
  190 static void cuse_client_kqfilter_read_detach(struct knote *kn);
  191 static void cuse_client_kqfilter_write_detach(struct knote *kn);
  192 static int cuse_client_kqfilter_read_event(struct knote *kn, long hint);
  193 static int cuse_client_kqfilter_write_event(struct knote *kn, long hint);
  194 
  195 static struct filterops cuse_client_kqfilter_read_ops = {
  196         .f_isfd = 1,
  197         .f_detach = cuse_client_kqfilter_read_detach,
  198         .f_event = cuse_client_kqfilter_read_event,
  199 };
  200 
  201 static struct filterops cuse_client_kqfilter_write_ops = {
  202         .f_isfd = 1,
  203         .f_detach = cuse_client_kqfilter_write_detach,
  204         .f_event = cuse_client_kqfilter_write_event,
  205 };
  206 
  207 static d_open_t cuse_client_open;
  208 static d_close_t cuse_client_close;
  209 static d_ioctl_t cuse_client_ioctl;
  210 static d_read_t cuse_client_read;
  211 static d_write_t cuse_client_write;
  212 static d_poll_t cuse_client_poll;
  213 static d_mmap_single_t cuse_client_mmap_single;
  214 static d_kqfilter_t cuse_client_kqfilter;
  215 
  216 static struct cdevsw cuse_client_devsw = {
  217         .d_version = D_VERSION,
  218         .d_open = cuse_client_open,
  219         .d_close = cuse_client_close,
  220         .d_ioctl = cuse_client_ioctl,
  221         .d_name = "cuse_client",
  222         .d_flags = D_TRACKCLOSE,
  223         .d_read = cuse_client_read,
  224         .d_write = cuse_client_write,
  225         .d_poll = cuse_client_poll,
  226         .d_mmap_single = cuse_client_mmap_single,
  227         .d_kqfilter = cuse_client_kqfilter,
  228 };
  229 
  230 static d_open_t cuse_server_open;
  231 static d_close_t cuse_server_close;
  232 static d_ioctl_t cuse_server_ioctl;
  233 static d_read_t cuse_server_read;
  234 static d_write_t cuse_server_write;
  235 static d_poll_t cuse_server_poll;
  236 static d_mmap_single_t cuse_server_mmap_single;
  237 
  238 static struct cdevsw cuse_server_devsw = {
  239         .d_version = D_VERSION,
  240         .d_open = cuse_server_open,
  241         .d_close = cuse_server_close,
  242         .d_ioctl = cuse_server_ioctl,
  243         .d_name = "cuse_server",
  244         .d_flags = D_TRACKCLOSE,
  245         .d_read = cuse_server_read,
  246         .d_write = cuse_server_write,
  247         .d_poll = cuse_server_poll,
  248         .d_mmap_single = cuse_server_mmap_single,
  249 };
  250 
  251 static void cuse_client_is_closing(struct cuse_client *);
  252 static int cuse_free_unit_by_id_locked(struct cuse_server *, int);
  253 
  254 static void
  255 cuse_global_lock(void)
  256 {
  257         mtx_lock(&cuse_global_mtx);
  258 }
  259 
  260 static void
  261 cuse_global_unlock(void)
  262 {
  263         mtx_unlock(&cuse_global_mtx);
  264 }
  265 
  266 static void
  267 cuse_server_lock(struct cuse_server *pcs)
  268 {
  269         mtx_lock(&pcs->mtx);
  270 }
  271 
  272 static void
  273 cuse_server_unlock(struct cuse_server *pcs)
  274 {
  275         mtx_unlock(&pcs->mtx);
  276 }
  277 
  278 static bool
  279 cuse_server_is_locked(struct cuse_server *pcs)
  280 {
  281         return (mtx_owned(&pcs->mtx));
  282 }
  283 
  284 static void
  285 cuse_cmd_lock(struct cuse_client_command *pccmd)
  286 {
  287         sx_xlock(&pccmd->sx);
  288 }
  289 
  290 static void
  291 cuse_cmd_unlock(struct cuse_client_command *pccmd)
  292 {
  293         sx_xunlock(&pccmd->sx);
  294 }
  295 
  296 static void
  297 cuse_kern_init(void *arg)
  298 {
  299         TAILQ_INIT(&cuse_server_head);
  300 
  301         mtx_init(&cuse_global_mtx, "cuse-global-mtx", NULL, MTX_DEF);
  302 
  303         cuse_dev = make_dev(&cuse_server_devsw, 0,
  304             UID_ROOT, GID_OPERATOR, 0600, "cuse");
  305 
  306         printf("Cuse v%d.%d.%d @ /dev/cuse\n",
  307             (CUSE_VERSION >> 16) & 0xFF, (CUSE_VERSION >> 8) & 0xFF,
  308             (CUSE_VERSION >> 0) & 0xFF);
  309 }
  310 SYSINIT(cuse_kern_init, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_init, NULL);
  311 
  312 static void
  313 cuse_kern_uninit(void *arg)
  314 {
  315         void *ptr;
  316 
  317         while (1) {
  318                 printf("Cuse: Please exit all /dev/cuse instances "
  319                     "and processes which have used this device.\n");
  320 
  321                 pause("DRAIN", 2 * hz);
  322 
  323                 cuse_global_lock();
  324                 ptr = TAILQ_FIRST(&cuse_server_head);
  325                 cuse_global_unlock();
  326 
  327                 if (ptr == NULL)
  328                         break;
  329         }
  330 
  331         if (cuse_dev != NULL)
  332                 destroy_dev(cuse_dev);
  333 
  334         mtx_destroy(&cuse_global_mtx);
  335 }
  336 SYSUNINIT(cuse_kern_uninit, SI_SUB_DEVFS, SI_ORDER_ANY, cuse_kern_uninit, 0);
  337 
  338 static int
  339 cuse_server_get(struct cuse_server **ppcs)
  340 {
  341         struct cuse_server *pcs;
  342         int error;
  343 
  344         error = devfs_get_cdevpriv((void **)&pcs);
  345         if (error != 0) {
  346                 *ppcs = NULL;
  347                 return (error);
  348         }
  349         if (pcs->is_closing) {
  350                 *ppcs = NULL;
  351                 return (EINVAL);
  352         }
  353         *ppcs = pcs;
  354         return (0);
  355 }
  356 
  357 static void
  358 cuse_server_is_closing(struct cuse_server *pcs)
  359 {
  360         struct cuse_client *pcc;
  361 
  362         if (pcs->is_closing)
  363                 return;
  364 
  365         pcs->is_closing = 1;
  366 
  367         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
  368                 cuse_client_is_closing(pcc);
  369         }
  370 }
  371 
  372 static struct cuse_client_command *
  373 cuse_server_find_command(struct cuse_server *pcs, struct thread *td)
  374 {
  375         struct cuse_client *pcc;
  376         int n;
  377 
  378         if (pcs->is_closing)
  379                 goto done;
  380 
  381         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
  382                 if (CUSE_CLIENT_CLOSING(pcc))
  383                         continue;
  384                 for (n = 0; n != CUSE_CMD_MAX; n++) {
  385                         if (pcc->cmds[n].entered == td)
  386                                 return (&pcc->cmds[n]);
  387                 }
  388         }
  389 done:
  390         return (NULL);
  391 }
  392 
  393 static void
  394 cuse_str_filter(char *ptr)
  395 {
  396         int c;
  397 
  398         while (((c = *ptr) != 0)) {
  399                 if ((c >= 'a') && (c <= 'z')) {
  400                         ptr++;
  401                         continue;
  402                 }
  403                 if ((c >= 'A') && (c <= 'Z')) {
  404                         ptr++;
  405                         continue;
  406                 }
  407                 if ((c >= '') && (c <= '9')) {
  408                         ptr++;
  409                         continue;
  410                 }
  411                 if ((c == '.') || (c == '_') || (c == '/')) {
  412                         ptr++;
  413                         continue;
  414                 }
  415                 *ptr = '_';
  416 
  417                 ptr++;
  418         }
  419 }
  420 
  421 static int
  422 cuse_convert_error(int error)
  423 {
  424         ;                               /* indent fix */
  425         switch (error) {
  426         case CUSE_ERR_NONE:
  427                 return (0);
  428         case CUSE_ERR_BUSY:
  429                 return (EBUSY);
  430         case CUSE_ERR_WOULDBLOCK:
  431                 return (EWOULDBLOCK);
  432         case CUSE_ERR_INVALID:
  433                 return (EINVAL);
  434         case CUSE_ERR_NO_MEMORY:
  435                 return (ENOMEM);
  436         case CUSE_ERR_FAULT:
  437                 return (EFAULT);
  438         case CUSE_ERR_SIGNAL:
  439                 return (EINTR);
  440         case CUSE_ERR_NO_DEVICE:
  441                 return (ENODEV);
  442         default:
  443                 return (ENXIO);
  444         }
  445 }
  446 
  447 static void
  448 cuse_vm_memory_free(struct cuse_memory *mem)
  449 {
  450         /* last user is gone - free */
  451         vm_object_deallocate(mem->object);
  452 
  453         /* free CUSE memory */
  454         free(mem, M_CUSE);
  455 }
  456 
  457 static int
  458 cuse_server_alloc_memory(struct cuse_server *pcs, uint32_t alloc_nr,
  459     uint32_t page_count)
  460 {
  461         struct cuse_memory *temp;
  462         struct cuse_memory *mem;
  463         vm_object_t object;
  464         int error;
  465 
  466         mem = malloc(sizeof(*mem), M_CUSE, M_WAITOK | M_ZERO);
  467 
  468         object = vm_pager_allocate(OBJT_SWAP, NULL, PAGE_SIZE * page_count,
  469             VM_PROT_DEFAULT, 0, curthread->td_ucred);
  470         if (object == NULL) {
  471                 error = ENOMEM;
  472                 goto error_0;
  473         }
  474 
  475         cuse_server_lock(pcs);
  476         /* check if allocation number already exists */
  477         TAILQ_FOREACH(temp, &pcs->hmem, entry) {
  478                 if (temp->alloc_nr == alloc_nr)
  479                         break;
  480         }
  481         if (temp != NULL) {
  482                 cuse_server_unlock(pcs);
  483                 error = EBUSY;
  484                 goto error_1;
  485         }
  486         mem->object = object;
  487         mem->page_count = page_count;
  488         mem->alloc_nr = alloc_nr;
  489         TAILQ_INSERT_TAIL(&pcs->hmem, mem, entry);
  490         cuse_server_unlock(pcs);
  491 
  492         return (0);
  493 
  494 error_1:
  495         vm_object_deallocate(object);
  496 error_0:
  497         free(mem, M_CUSE);
  498         return (error);
  499 }
  500 
  501 static int
  502 cuse_server_free_memory(struct cuse_server *pcs, uint32_t alloc_nr)
  503 {
  504         struct cuse_memory *mem;
  505 
  506         cuse_server_lock(pcs);
  507         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
  508                 if (mem->alloc_nr == alloc_nr)
  509                         break;
  510         }
  511         if (mem == NULL) {
  512                 cuse_server_unlock(pcs);
  513                 return (EINVAL);
  514         }
  515         TAILQ_REMOVE(&pcs->hmem, mem, entry);
  516         cuse_server_unlock(pcs);
  517 
  518         cuse_vm_memory_free(mem);
  519 
  520         return (0);
  521 }
  522 
  523 static int
  524 cuse_client_get(struct cuse_client **ppcc)
  525 {
  526         struct cuse_client *pcc;
  527         int error;
  528 
  529         /* try to get private data */
  530         error = devfs_get_cdevpriv((void **)&pcc);
  531         if (error != 0) {
  532                 *ppcc = NULL;
  533                 return (error);
  534         }
  535         if (CUSE_CLIENT_CLOSING(pcc) || pcc->server->is_closing) {
  536                 *ppcc = NULL;
  537                 return (EINVAL);
  538         }
  539         *ppcc = pcc;
  540         return (0);
  541 }
  542 
  543 static void
  544 cuse_client_is_closing(struct cuse_client *pcc)
  545 {
  546         struct cuse_client_command *pccmd;
  547         uint32_t n;
  548 
  549         if (CUSE_CLIENT_CLOSING(pcc))
  550                 return;
  551 
  552         pcc->cflags |= CUSE_CLI_IS_CLOSING;
  553         pcc->server_dev = NULL;
  554 
  555         for (n = 0; n != CUSE_CMD_MAX; n++) {
  556                 pccmd = &pcc->cmds[n];
  557 
  558                 if (pccmd->entry.tqe_prev != NULL) {
  559                         TAILQ_REMOVE(&pcc->server->head, pccmd, entry);
  560                         pccmd->entry.tqe_prev = NULL;
  561                 }
  562                 cv_broadcast(&pccmd->cv);
  563         }
  564 }
  565 
  566 static void
  567 cuse_client_send_command_locked(struct cuse_client_command *pccmd,
  568     uintptr_t data_ptr, unsigned long arg, int fflags, int ioflag)
  569 {
  570         unsigned long cuse_fflags = 0;
  571         struct cuse_server *pcs;
  572 
  573         if (fflags & FREAD)
  574                 cuse_fflags |= CUSE_FFLAG_READ;
  575 
  576         if (fflags & FWRITE)
  577                 cuse_fflags |= CUSE_FFLAG_WRITE;
  578 
  579         if (ioflag & IO_NDELAY)
  580                 cuse_fflags |= CUSE_FFLAG_NONBLOCK;
  581 #if defined(__LP64__)
  582         if (SV_CURPROC_FLAG(SV_ILP32))
  583                 cuse_fflags |= CUSE_FFLAG_COMPAT32;
  584 #endif
  585         pccmd->sub.fflags = cuse_fflags;
  586         pccmd->sub.data_pointer = data_ptr;
  587         pccmd->sub.argument = arg;
  588 
  589         pcs = pccmd->client->server;
  590 
  591         if ((pccmd->entry.tqe_prev == NULL) &&
  592             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
  593             (pcs->is_closing == 0)) {
  594                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
  595                 cv_signal(&pcs->cv);
  596         }
  597 }
  598 
  599 static void
  600 cuse_client_got_signal(struct cuse_client_command *pccmd)
  601 {
  602         struct cuse_server *pcs;
  603 
  604         pccmd->got_signal = 1;
  605 
  606         pccmd = &pccmd->client->cmds[CUSE_CMD_SIGNAL];
  607 
  608         pcs = pccmd->client->server;
  609 
  610         if ((pccmd->entry.tqe_prev == NULL) &&
  611             (CUSE_CLIENT_CLOSING(pccmd->client) == 0) &&
  612             (pcs->is_closing == 0)) {
  613                 TAILQ_INSERT_TAIL(&pcs->head, pccmd, entry);
  614                 cv_signal(&pcs->cv);
  615         }
  616 }
  617 
  618 static int
  619 cuse_client_receive_command_locked(struct cuse_client_command *pccmd,
  620     uint8_t *arg_ptr, uint32_t arg_len)
  621 {
  622         struct cuse_server *pcs;
  623         int error;
  624 
  625         pcs = pccmd->client->server;
  626         error = 0;
  627 
  628         pccmd->proc_curr = curthread->td_proc;
  629 
  630         if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
  631                 error = CUSE_ERR_OTHER;
  632                 goto done;
  633         }
  634         while (pccmd->command == CUSE_CMD_NONE) {
  635                 if (error != 0) {
  636                         cv_wait(&pccmd->cv, &pcs->mtx);
  637                 } else {
  638                         error = cv_wait_sig(&pccmd->cv, &pcs->mtx);
  639 
  640                         if (error != 0)
  641                                 cuse_client_got_signal(pccmd);
  642                 }
  643                 if (CUSE_CLIENT_CLOSING(pccmd->client) || pcs->is_closing) {
  644                         error = CUSE_ERR_OTHER;
  645                         goto done;
  646                 }
  647         }
  648 
  649         error = pccmd->error;
  650         pccmd->command = CUSE_CMD_NONE;
  651         cv_signal(&pccmd->cv);
  652 
  653 done:
  654 
  655         /* wait until all process references are gone */
  656 
  657         pccmd->proc_curr = NULL;
  658 
  659         while (pccmd->proc_refs != 0)
  660                 cv_wait(&pccmd->cv, &pcs->mtx);
  661 
  662         return (error);
  663 }
  664 
  665 /*------------------------------------------------------------------------*
  666  *      CUSE SERVER PART
  667  *------------------------------------------------------------------------*/
  668 
  669 static void
  670 cuse_server_free_dev(struct cuse_server_dev *pcsd)
  671 {
  672         struct cuse_server *pcs;
  673         struct cuse_client *pcc;
  674 
  675         /* get server pointer */
  676         pcs = pcsd->server;
  677 
  678         /* prevent creation of more devices */
  679         cuse_server_lock(pcs);
  680         if (pcsd->kern_dev != NULL)
  681                 pcsd->kern_dev->si_drv1 = NULL;
  682 
  683         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
  684                 if (pcc->server_dev == pcsd)
  685                         cuse_client_is_closing(pcc);
  686         }
  687         cuse_server_unlock(pcs);
  688 
  689         /* destroy device, if any */
  690         if (pcsd->kern_dev != NULL) {
  691                 /* destroy device synchronously */
  692                 destroy_dev(pcsd->kern_dev);
  693         }
  694         free(pcsd, M_CUSE);
  695 }
  696 
  697 static void
  698 cuse_server_unref(struct cuse_server *pcs)
  699 {
  700         struct cuse_server_dev *pcsd;
  701         struct cuse_memory *mem;
  702 
  703         cuse_server_lock(pcs);
  704         if (--(pcs->refs) != 0) {
  705                 cuse_server_unlock(pcs);
  706                 return;
  707         }
  708         cuse_server_is_closing(pcs);
  709         /* final client wakeup, if any */
  710         cuse_server_wakeup_all_client_locked(pcs);
  711 
  712         cuse_global_lock();
  713         TAILQ_REMOVE(&cuse_server_head, pcs, entry);
  714         cuse_global_unlock();
  715 
  716         while ((pcsd = TAILQ_FIRST(&pcs->hdev)) != NULL) {
  717                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
  718                 cuse_server_unlock(pcs);
  719                 cuse_server_free_dev(pcsd);
  720                 cuse_server_lock(pcs);
  721         }
  722 
  723         cuse_free_unit_by_id_locked(pcs, -1);
  724 
  725         while ((mem = TAILQ_FIRST(&pcs->hmem)) != NULL) {
  726                 TAILQ_REMOVE(&pcs->hmem, mem, entry);
  727                 cuse_server_unlock(pcs);
  728                 cuse_vm_memory_free(mem);
  729                 cuse_server_lock(pcs);
  730         }
  731 
  732         knlist_clear(&pcs->selinfo.si_note, 1);
  733         knlist_destroy(&pcs->selinfo.si_note);
  734 
  735         cuse_server_unlock(pcs);
  736 
  737         seldrain(&pcs->selinfo);
  738 
  739         cv_destroy(&pcs->cv);
  740 
  741         mtx_destroy(&pcs->mtx);
  742 
  743         free(pcs, M_CUSE);
  744 }
  745 
  746 static int
  747 cuse_server_do_close(struct cuse_server *pcs)
  748 {
  749         int retval;
  750 
  751         cuse_server_lock(pcs);
  752         cuse_server_is_closing(pcs);
  753         /* final client wakeup, if any */
  754         cuse_server_wakeup_all_client_locked(pcs);
  755 
  756         knlist_clear(&pcs->selinfo.si_note, 1);
  757 
  758         retval = pcs->refs;
  759         cuse_server_unlock(pcs);
  760 
  761         return (retval);
  762 }
  763 
  764 static void
  765 cuse_server_free(void *arg)
  766 {
  767         struct cuse_server *pcs = arg;
  768 
  769         /*
  770          * The final server unref should be done by the server thread
  771          * to prevent deadlock in the client cdevpriv destructor,
  772          * which cannot destroy itself.
  773          */
  774         while (cuse_server_do_close(pcs) != 1)
  775                 pause("W", hz);
  776 
  777         /* drop final refcount */
  778         cuse_server_unref(pcs);
  779 }
  780 
  781 static int
  782 cuse_server_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
  783 {
  784         struct cuse_server *pcs;
  785 
  786         pcs = malloc(sizeof(*pcs), M_CUSE, M_WAITOK | M_ZERO);
  787 
  788         if (devfs_set_cdevpriv(pcs, &cuse_server_free)) {
  789                 printf("Cuse: Cannot set cdevpriv.\n");
  790                 free(pcs, M_CUSE);
  791                 return (ENOMEM);
  792         }
  793         /* store current process ID */
  794         pcs->pid = curproc->p_pid;
  795 
  796         TAILQ_INIT(&pcs->head);
  797         TAILQ_INIT(&pcs->hdev);
  798         TAILQ_INIT(&pcs->hcli);
  799         TAILQ_INIT(&pcs->hmem);
  800 
  801         cv_init(&pcs->cv, "cuse-server-cv");
  802 
  803         mtx_init(&pcs->mtx, "cuse-server-mtx", NULL, MTX_DEF);
  804 
  805         knlist_init_mtx(&pcs->selinfo.si_note, &pcs->mtx);
  806 
  807         cuse_global_lock();
  808         pcs->refs++;
  809         TAILQ_INSERT_TAIL(&cuse_server_head, pcs, entry);
  810         cuse_global_unlock();
  811 
  812         return (0);
  813 }
  814 
  815 static int
  816 cuse_server_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
  817 {
  818         struct cuse_server *pcs;
  819 
  820         if (cuse_server_get(&pcs) == 0)
  821                 cuse_server_do_close(pcs);
  822 
  823         return (0);
  824 }
  825 
  826 static int
  827 cuse_server_read(struct cdev *dev, struct uio *uio, int ioflag)
  828 {
  829         return (ENXIO);
  830 }
  831 
  832 static int
  833 cuse_server_write(struct cdev *dev, struct uio *uio, int ioflag)
  834 {
  835         return (ENXIO);
  836 }
  837 
  838 static int
  839 cuse_server_ioctl_copy_locked(struct cuse_server *pcs,
  840     struct cuse_client_command *pccmd,
  841     struct cuse_data_chunk *pchk, bool isread)
  842 {
  843         struct proc *p_proc;
  844         uint32_t offset;
  845         int error;
  846 
  847         offset = pchk->peer_ptr - CUSE_BUF_MIN_PTR;
  848 
  849         if (pchk->length > CUSE_BUFFER_MAX)
  850                 return (EFAULT);
  851 
  852         if (offset >= CUSE_BUFFER_MAX)
  853                 return (EFAULT);
  854 
  855         if ((offset + pchk->length) > CUSE_BUFFER_MAX)
  856                 return (EFAULT);
  857 
  858         p_proc = pccmd->proc_curr;
  859         if (p_proc == NULL)
  860                 return (ENXIO);
  861 
  862         if (pccmd->proc_refs < 0)
  863                 return (ENOMEM);
  864 
  865         pccmd->proc_refs++;
  866 
  867         cuse_server_unlock(pcs);
  868 
  869         if (!isread) {
  870                 error = copyin(
  871                     (void *)pchk->local_ptr,
  872                     pccmd->client->ioctl_buffer + offset,
  873                     pchk->length);
  874         } else {
  875                 error = copyout(
  876                     pccmd->client->ioctl_buffer + offset,
  877                     (void *)pchk->local_ptr,
  878                     pchk->length);
  879         }
  880 
  881         cuse_server_lock(pcs);
  882 
  883         pccmd->proc_refs--;
  884 
  885         if (pccmd->proc_curr == NULL)
  886                 cv_signal(&pccmd->cv);
  887 
  888         return (error);
  889 }
  890 
  891 static int
  892 cuse_proc2proc_copy(struct proc *proc_s, vm_offset_t data_s,
  893     struct proc *proc_d, vm_offset_t data_d, size_t len)
  894 {
  895         struct thread *td;
  896         struct proc *proc_cur;
  897         int error;
  898 
  899         td = curthread;
  900         proc_cur = td->td_proc;
  901 
  902         if (proc_cur == proc_d) {
  903                 struct iovec iov = {
  904                         .iov_base = (caddr_t)data_d,
  905                         .iov_len = len,
  906                 };
  907                 struct uio uio = {
  908                         .uio_iov = &iov,
  909                         .uio_iovcnt = 1,
  910                         .uio_offset = (off_t)data_s,
  911                         .uio_resid = len,
  912                         .uio_segflg = UIO_USERSPACE,
  913                         .uio_rw = UIO_READ,
  914                         .uio_td = td,
  915                 };
  916 
  917                 PHOLD(proc_s);
  918                 error = proc_rwmem(proc_s, &uio);
  919                 PRELE(proc_s);
  920 
  921         } else if (proc_cur == proc_s) {
  922                 struct iovec iov = {
  923                         .iov_base = (caddr_t)data_s,
  924                         .iov_len = len,
  925                 };
  926                 struct uio uio = {
  927                         .uio_iov = &iov,
  928                         .uio_iovcnt = 1,
  929                         .uio_offset = (off_t)data_d,
  930                         .uio_resid = len,
  931                         .uio_segflg = UIO_USERSPACE,
  932                         .uio_rw = UIO_WRITE,
  933                         .uio_td = td,
  934                 };
  935 
  936                 PHOLD(proc_d);
  937                 error = proc_rwmem(proc_d, &uio);
  938                 PRELE(proc_d);
  939         } else {
  940                 error = EINVAL;
  941         }
  942         return (error);
  943 }
  944 
  945 static int
  946 cuse_server_data_copy_locked(struct cuse_server *pcs,
  947     struct cuse_client_command *pccmd,
  948     struct cuse_data_chunk *pchk, bool isread)
  949 {
  950         struct proc *p_proc;
  951         int error;
  952 
  953         p_proc = pccmd->proc_curr;
  954         if (p_proc == NULL)
  955                 return (ENXIO);
  956 
  957         if (pccmd->proc_refs < 0)
  958                 return (ENOMEM);
  959 
  960         pccmd->proc_refs++;
  961 
  962         cuse_server_unlock(pcs);
  963 
  964         if (!isread) {
  965                 error = cuse_proc2proc_copy(
  966                     curthread->td_proc, pchk->local_ptr,
  967                     p_proc, pchk->peer_ptr,
  968                     pchk->length);
  969         } else {
  970                 error = cuse_proc2proc_copy(
  971                     p_proc, pchk->peer_ptr,
  972                     curthread->td_proc, pchk->local_ptr,
  973                     pchk->length);
  974         }
  975 
  976         cuse_server_lock(pcs);
  977 
  978         pccmd->proc_refs--;
  979 
  980         if (pccmd->proc_curr == NULL)
  981                 cv_signal(&pccmd->cv);
  982 
  983         return (error);
  984 }
  985 
  986 static int
  987 cuse_server_data_copy_optimized_locked(struct cuse_server *pcs,
  988     struct cuse_client_command *pccmd,
  989     struct cuse_data_chunk *pchk, bool isread)
  990 {
  991         uintptr_t offset;
  992         int error;
  993 
  994         /*
  995          * Check if data is stored locally to avoid accessing
  996          * other process's data space:
  997          */
  998         if (isread) {
  999                 offset = pchk->peer_ptr - pccmd->client->write_base;
 1000 
 1001                 if (offset < (uintptr_t)pccmd->client->write_length &&
 1002                     pchk->length <= (unsigned long)pccmd->client->write_length &&
 1003                     offset + pchk->length <= (uintptr_t)pccmd->client->write_length) {
 1004                         cuse_server_unlock(pcs);
 1005                         error = copyout(pccmd->client->write_buffer + offset,
 1006                             (void *)pchk->local_ptr, pchk->length);
 1007                         goto done;
 1008                 }
 1009         } else {
 1010                 offset = pchk->peer_ptr - pccmd->client->read_base;
 1011 
 1012                 if (offset < (uintptr_t)pccmd->client->read_length &&
 1013                     pchk->length <= (unsigned long)pccmd->client->read_length &&
 1014                     offset + pchk->length <= (uintptr_t)pccmd->client->read_length) {
 1015                         cuse_server_unlock(pcs);
 1016                         error = copyin((void *)pchk->local_ptr,
 1017                             pccmd->client->read_buffer + offset, pchk->length);
 1018                         goto done;
 1019                 }
 1020         }
 1021 
 1022         /* use process to process copy function */
 1023         error = cuse_server_data_copy_locked(pcs, pccmd, pchk, isread);
 1024 done:
 1025         return (error);
 1026 }
 1027 
 1028 static int
 1029 cuse_alloc_unit_by_id_locked(struct cuse_server *pcs, int id)
 1030 {
 1031         int n;
 1032         int x = 0;
 1033         int match;
 1034 
 1035         do {
 1036                 for (match = n = 0; n != CUSE_DEVICES_MAX; n++) {
 1037                         if (cuse_alloc_unit[n] != NULL) {
 1038                                 if ((cuse_alloc_unit_id[n] ^ id) & CUSE_ID_MASK)
 1039                                         continue;
 1040                                 if ((cuse_alloc_unit_id[n] & ~CUSE_ID_MASK) == x) {
 1041                                         x++;
 1042                                         match = 1;
 1043                                 }
 1044                         }
 1045                 }
 1046         } while (match);
 1047 
 1048         if (x < 256) {
 1049                 for (n = 0; n != CUSE_DEVICES_MAX; n++) {
 1050                         if (cuse_alloc_unit[n] == NULL) {
 1051                                 cuse_alloc_unit[n] = pcs;
 1052                                 cuse_alloc_unit_id[n] = id | x;
 1053                                 return (x);
 1054                         }
 1055                 }
 1056         }
 1057         return (-1);
 1058 }
 1059 
 1060 static void
 1061 cuse_server_wakeup_locked(struct cuse_server *pcs)
 1062 {
 1063         selwakeup(&pcs->selinfo);
 1064         KNOTE_LOCKED(&pcs->selinfo.si_note, 0);
 1065 }
 1066 
 1067 static void
 1068 cuse_server_wakeup_all_client_locked(struct cuse_server *pcs)
 1069 {
 1070         struct cuse_client *pcc;
 1071 
 1072         TAILQ_FOREACH(pcc, &pcs->hcli, entry) {
 1073                 pcc->cflags |= (CUSE_CLI_KNOTE_NEED_READ |
 1074                     CUSE_CLI_KNOTE_NEED_WRITE);
 1075         }
 1076         cuse_server_wakeup_locked(pcs);
 1077 }
 1078 
 1079 static int
 1080 cuse_free_unit_by_id_locked(struct cuse_server *pcs, int id)
 1081 {
 1082         int n;
 1083         int found = 0;
 1084 
 1085         for (n = 0; n != CUSE_DEVICES_MAX; n++) {
 1086                 if (cuse_alloc_unit[n] == pcs) {
 1087                         if (cuse_alloc_unit_id[n] == id || id == -1) {
 1088                                 cuse_alloc_unit[n] = NULL;
 1089                                 cuse_alloc_unit_id[n] = 0;
 1090                                 found = 1;
 1091                         }
 1092                 }
 1093         }
 1094 
 1095         return (found ? 0 : EINVAL);
 1096 }
 1097 
 1098 static int
 1099 cuse_server_ioctl(struct cdev *dev, unsigned long cmd,
 1100     caddr_t data, int fflag, struct thread *td)
 1101 {
 1102         struct cuse_server *pcs;
 1103         int error;
 1104 
 1105         error = cuse_server_get(&pcs);
 1106         if (error != 0)
 1107                 return (error);
 1108 
 1109         switch (cmd) {
 1110                 struct cuse_client_command *pccmd;
 1111                 struct cuse_client *pcc;
 1112                 struct cuse_command *pcmd;
 1113                 struct cuse_alloc_info *pai;
 1114                 struct cuse_create_dev *pcd;
 1115                 struct cuse_server_dev *pcsd;
 1116                 struct cuse_data_chunk *pchk;
 1117                 int n;
 1118 
 1119         case CUSE_IOCTL_GET_COMMAND:
 1120                 pcmd = (void *)data;
 1121 
 1122                 cuse_server_lock(pcs);
 1123 
 1124                 while ((pccmd = TAILQ_FIRST(&pcs->head)) == NULL) {
 1125                         error = cv_wait_sig(&pcs->cv, &pcs->mtx);
 1126 
 1127                         if (pcs->is_closing)
 1128                                 error = ENXIO;
 1129 
 1130                         if (error) {
 1131                                 cuse_server_unlock(pcs);
 1132                                 return (error);
 1133                         }
 1134                 }
 1135 
 1136                 TAILQ_REMOVE(&pcs->head, pccmd, entry);
 1137                 pccmd->entry.tqe_prev = NULL;
 1138 
 1139                 pccmd->entered = curthread;
 1140 
 1141                 *pcmd = pccmd->sub;
 1142 
 1143                 cuse_server_unlock(pcs);
 1144 
 1145                 break;
 1146 
 1147         case CUSE_IOCTL_SYNC_COMMAND:
 1148 
 1149                 cuse_server_lock(pcs);
 1150                 while ((pccmd = cuse_server_find_command(pcs, curthread)) != NULL) {
 1151                         /* send sync command */
 1152                         pccmd->entered = NULL;
 1153                         pccmd->error = *(int *)data;
 1154                         pccmd->command = CUSE_CMD_SYNC;
 1155 
 1156                         /* signal peer, if any */
 1157                         cv_signal(&pccmd->cv);
 1158                 }
 1159                 cuse_server_unlock(pcs);
 1160 
 1161                 break;
 1162 
 1163         case CUSE_IOCTL_ALLOC_UNIT:
 1164 
 1165                 cuse_server_lock(pcs);
 1166                 n = cuse_alloc_unit_by_id_locked(pcs,
 1167                     CUSE_ID_DEFAULT(0));
 1168                 cuse_server_unlock(pcs);
 1169 
 1170                 if (n < 0)
 1171                         error = ENOMEM;
 1172                 else
 1173                         *(int *)data = n;
 1174                 break;
 1175 
 1176         case CUSE_IOCTL_ALLOC_UNIT_BY_ID:
 1177 
 1178                 n = *(int *)data;
 1179 
 1180                 n = (n & CUSE_ID_MASK);
 1181 
 1182                 cuse_server_lock(pcs);
 1183                 n = cuse_alloc_unit_by_id_locked(pcs, n);
 1184                 cuse_server_unlock(pcs);
 1185 
 1186                 if (n < 0)
 1187                         error = ENOMEM;
 1188                 else
 1189                         *(int *)data = n;
 1190                 break;
 1191 
 1192         case CUSE_IOCTL_FREE_UNIT:
 1193 
 1194                 n = *(int *)data;
 1195 
 1196                 n = CUSE_ID_DEFAULT(n);
 1197 
 1198                 cuse_server_lock(pcs);
 1199                 error = cuse_free_unit_by_id_locked(pcs, n);
 1200                 cuse_server_unlock(pcs);
 1201                 break;
 1202 
 1203         case CUSE_IOCTL_FREE_UNIT_BY_ID:
 1204 
 1205                 n = *(int *)data;
 1206 
 1207                 cuse_server_lock(pcs);
 1208                 error = cuse_free_unit_by_id_locked(pcs, n);
 1209                 cuse_server_unlock(pcs);
 1210                 break;
 1211 
 1212         case CUSE_IOCTL_ALLOC_MEMORY:
 1213 
 1214                 pai = (void *)data;
 1215 
 1216                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
 1217                         error = ENOMEM;
 1218                         break;
 1219                 }
 1220                 if (pai->page_count > CUSE_ALLOC_PAGES_MAX) {
 1221                         error = ENOMEM;
 1222                         break;
 1223                 }
 1224                 error = cuse_server_alloc_memory(pcs,
 1225                     pai->alloc_nr, pai->page_count);
 1226                 break;
 1227 
 1228         case CUSE_IOCTL_FREE_MEMORY:
 1229                 pai = (void *)data;
 1230 
 1231                 if (pai->alloc_nr >= CUSE_ALLOC_UNIT_MAX) {
 1232                         error = ENOMEM;
 1233                         break;
 1234                 }
 1235                 error = cuse_server_free_memory(pcs, pai->alloc_nr);
 1236                 break;
 1237 
 1238         case CUSE_IOCTL_GET_SIG:
 1239 
 1240                 cuse_server_lock(pcs);
 1241                 pccmd = cuse_server_find_command(pcs, curthread);
 1242 
 1243                 if (pccmd != NULL) {
 1244                         n = pccmd->got_signal;
 1245                         pccmd->got_signal = 0;
 1246                 } else {
 1247                         n = 0;
 1248                 }
 1249                 cuse_server_unlock(pcs);
 1250 
 1251                 *(int *)data = n;
 1252 
 1253                 break;
 1254 
 1255         case CUSE_IOCTL_SET_PFH:
 1256 
 1257                 cuse_server_lock(pcs);
 1258                 pccmd = cuse_server_find_command(pcs, curthread);
 1259 
 1260                 if (pccmd != NULL) {
 1261                         pcc = pccmd->client;
 1262                         for (n = 0; n != CUSE_CMD_MAX; n++) {
 1263                                 pcc->cmds[n].sub.per_file_handle = *(uintptr_t *)data;
 1264                         }
 1265                 } else {
 1266                         error = ENXIO;
 1267                 }
 1268                 cuse_server_unlock(pcs);
 1269                 break;
 1270 
 1271         case CUSE_IOCTL_CREATE_DEV:
 1272 
 1273                 error = priv_check(curthread, PRIV_DRIVER);
 1274                 if (error)
 1275                         break;
 1276 
 1277                 pcd = (void *)data;
 1278 
 1279                 /* filter input */
 1280 
 1281                 pcd->devname[sizeof(pcd->devname) - 1] = 0;
 1282 
 1283                 if (pcd->devname[0] == 0) {
 1284                         error = EINVAL;
 1285                         break;
 1286                 }
 1287                 cuse_str_filter(pcd->devname);
 1288 
 1289                 pcd->permissions &= 0777;
 1290 
 1291                 /* try to allocate a character device */
 1292 
 1293                 pcsd = malloc(sizeof(*pcsd), M_CUSE, M_WAITOK | M_ZERO);
 1294 
 1295                 pcsd->server = pcs;
 1296 
 1297                 pcsd->user_dev = pcd->dev;
 1298 
 1299                 pcsd->kern_dev = make_dev_credf(MAKEDEV_CHECKNAME,
 1300                     &cuse_client_devsw, 0, NULL, pcd->user_id, pcd->group_id,
 1301                     pcd->permissions, "%s", pcd->devname);
 1302 
 1303                 if (pcsd->kern_dev == NULL) {
 1304                         free(pcsd, M_CUSE);
 1305                         error = ENOMEM;
 1306                         break;
 1307                 }
 1308                 pcsd->kern_dev->si_drv1 = pcsd;
 1309 
 1310                 cuse_server_lock(pcs);
 1311                 TAILQ_INSERT_TAIL(&pcs->hdev, pcsd, entry);
 1312                 cuse_server_unlock(pcs);
 1313 
 1314                 break;
 1315 
 1316         case CUSE_IOCTL_DESTROY_DEV:
 1317 
 1318                 error = priv_check(curthread, PRIV_DRIVER);
 1319                 if (error)
 1320                         break;
 1321 
 1322                 cuse_server_lock(pcs);
 1323 
 1324                 error = EINVAL;
 1325 
 1326                 pcsd = TAILQ_FIRST(&pcs->hdev);
 1327                 while (pcsd != NULL) {
 1328                         if (pcsd->user_dev == *(struct cuse_dev **)data) {
 1329                                 TAILQ_REMOVE(&pcs->hdev, pcsd, entry);
 1330                                 cuse_server_unlock(pcs);
 1331                                 cuse_server_free_dev(pcsd);
 1332                                 cuse_server_lock(pcs);
 1333                                 error = 0;
 1334                                 pcsd = TAILQ_FIRST(&pcs->hdev);
 1335                         } else {
 1336                                 pcsd = TAILQ_NEXT(pcsd, entry);
 1337                         }
 1338                 }
 1339 
 1340                 cuse_server_unlock(pcs);
 1341                 break;
 1342 
 1343         case CUSE_IOCTL_WRITE_DATA:
 1344         case CUSE_IOCTL_READ_DATA:
 1345 
 1346                 cuse_server_lock(pcs);
 1347                 pchk = (struct cuse_data_chunk *)data;
 1348 
 1349                 pccmd = cuse_server_find_command(pcs, curthread);
 1350 
 1351                 if (pccmd == NULL) {
 1352                         error = ENXIO;  /* invalid request */
 1353                 } else if (pchk->peer_ptr < CUSE_BUF_MIN_PTR) {
 1354                         error = EFAULT; /* NULL pointer */
 1355                 } else if (pchk->length == 0) {
 1356                         /* NOP */
 1357                 } else if (pchk->peer_ptr < CUSE_BUF_MAX_PTR) {
 1358                         error = cuse_server_ioctl_copy_locked(pcs, pccmd,
 1359                             pchk, cmd == CUSE_IOCTL_READ_DATA);
 1360                 } else {
 1361                         error = cuse_server_data_copy_optimized_locked(
 1362                             pcs, pccmd, pchk, cmd == CUSE_IOCTL_READ_DATA);
 1363                 }
 1364 
 1365                 /*
 1366                  * Sometimes the functions above drop the server lock
 1367                  * early as an optimization:
 1368                  */
 1369                 if (cuse_server_is_locked(pcs))
 1370                         cuse_server_unlock(pcs);
 1371                 break;
 1372 
 1373         case CUSE_IOCTL_SELWAKEUP:
 1374                 cuse_server_lock(pcs);
 1375                 /*
 1376                  * We don't know which direction caused the event.
 1377                  * Wakeup both!
 1378                  */
 1379                 cuse_server_wakeup_all_client_locked(pcs);
 1380                 cuse_server_unlock(pcs);
 1381                 break;
 1382 
 1383         default:
 1384                 error = ENXIO;
 1385                 break;
 1386         }
 1387         return (error);
 1388 }
 1389 
 1390 static int
 1391 cuse_server_poll(struct cdev *dev, int events, struct thread *td)
 1392 {
 1393         return (events & (POLLHUP | POLLPRI | POLLIN |
 1394             POLLRDNORM | POLLOUT | POLLWRNORM));
 1395 }
 1396 
 1397 static int
 1398 cuse_common_mmap_single(struct cuse_server *pcs,
 1399     vm_ooffset_t *offset, vm_size_t size, struct vm_object **object)
 1400 {
 1401         struct cuse_memory *mem;
 1402         int error;
 1403 
 1404         /* verify size */
 1405         if ((size % PAGE_SIZE) != 0 || (size < PAGE_SIZE))
 1406                 return (EINVAL);
 1407 
 1408         cuse_server_lock(pcs);
 1409         error = ENOMEM;
 1410 
 1411         /* lookup memory structure, if any */
 1412         TAILQ_FOREACH(mem, &pcs->hmem, entry) {
 1413                 vm_ooffset_t min_off;
 1414                 vm_ooffset_t max_off;
 1415 
 1416                 min_off = (mem->alloc_nr << CUSE_ALLOC_UNIT_SHIFT);
 1417                 max_off = min_off + (PAGE_SIZE * mem->page_count);
 1418 
 1419                 if (*offset >= min_off && *offset < max_off) {
 1420                         /* range check size */
 1421                         if (size > (max_off - *offset)) {
 1422                                 error = EINVAL;
 1423                         } else {
 1424                                 /* get new VM object offset to use */
 1425                                 *offset -= min_off;
 1426                                 vm_object_reference(mem->object);
 1427                                 *object = mem->object;
 1428                                 error = 0;
 1429                         }
 1430                         break;
 1431                 }
 1432         }
 1433         cuse_server_unlock(pcs);
 1434         return (error);
 1435 }
 1436 
 1437 static int
 1438 cuse_server_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
 1439     vm_size_t size, struct vm_object **object, int nprot)
 1440 {
 1441         struct cuse_server *pcs;
 1442         int error;
 1443 
 1444         error = cuse_server_get(&pcs);
 1445         if (error != 0)
 1446                 return (error);
 1447 
 1448         return (cuse_common_mmap_single(pcs, offset, size, object));
 1449 }
 1450 
 1451 /*------------------------------------------------------------------------*
 1452  *      CUSE CLIENT PART
 1453  *------------------------------------------------------------------------*/
 1454 static void
 1455 cuse_client_free(void *arg)
 1456 {
 1457         struct cuse_client *pcc = arg;
 1458         struct cuse_client_command *pccmd;
 1459         struct cuse_server *pcs;
 1460         int n;
 1461 
 1462         pcs = pcc->server;
 1463 
 1464         cuse_server_lock(pcs);
 1465         cuse_client_is_closing(pcc);
 1466         TAILQ_REMOVE(&pcs->hcli, pcc, entry);
 1467         cuse_server_unlock(pcs);
 1468 
 1469         for (n = 0; n != CUSE_CMD_MAX; n++) {
 1470                 pccmd = &pcc->cmds[n];
 1471 
 1472                 sx_destroy(&pccmd->sx);
 1473                 cv_destroy(&pccmd->cv);
 1474         }
 1475 
 1476         free(pcc, M_CUSE);
 1477 
 1478         /* drop reference on server */
 1479         cuse_server_unref(pcs);
 1480 }
 1481 
 1482 static int
 1483 cuse_client_open(struct cdev *dev, int fflags, int devtype, struct thread *td)
 1484 {
 1485         struct cuse_client_command *pccmd;
 1486         struct cuse_server_dev *pcsd;
 1487         struct cuse_client *pcc;
 1488         struct cuse_server *pcs;
 1489         struct cuse_dev *pcd;
 1490         int error;
 1491         int n;
 1492 
 1493         pcsd = dev->si_drv1;
 1494         if (pcsd != NULL) {
 1495                 pcs = pcsd->server;
 1496                 pcd = pcsd->user_dev;
 1497 
 1498                 cuse_server_lock(pcs);
 1499                 /*
 1500                  * Check that the refcount didn't wrap and that the
 1501                  * same process is not both client and server. This
 1502                  * can easily lead to deadlocks when destroying the
 1503                  * CUSE character device nodes:
 1504                  */
 1505                 pcs->refs++;
 1506                 if (pcs->refs < 0 || pcs->pid == curproc->p_pid) {
 1507                         /* overflow or wrong PID */
 1508                         pcs->refs--;
 1509                         cuse_server_unlock(pcs);
 1510                         return (EINVAL);
 1511                 }
 1512                 cuse_server_unlock(pcs);
 1513         } else {
 1514                 return (EINVAL);
 1515         }
 1516 
 1517         pcc = malloc(sizeof(*pcc), M_CUSE, M_WAITOK | M_ZERO);
 1518         if (devfs_set_cdevpriv(pcc, &cuse_client_free)) {
 1519                 printf("Cuse: Cannot set cdevpriv.\n");
 1520                 /* drop reference on server */
 1521                 cuse_server_unref(pcs);
 1522                 free(pcc, M_CUSE);
 1523                 return (ENOMEM);
 1524         }
 1525         pcc->fflags = fflags;
 1526         pcc->server_dev = pcsd;
 1527         pcc->server = pcs;
 1528 
 1529         for (n = 0; n != CUSE_CMD_MAX; n++) {
 1530                 pccmd = &pcc->cmds[n];
 1531 
 1532                 pccmd->sub.dev = pcd;
 1533                 pccmd->sub.command = n;
 1534                 pccmd->client = pcc;
 1535 
 1536                 sx_init(&pccmd->sx, "cuse-client-sx");
 1537                 cv_init(&pccmd->cv, "cuse-client-cv");
 1538         }
 1539 
 1540         cuse_server_lock(pcs);
 1541 
 1542         /* cuse_client_free() assumes that the client is listed somewhere! */
 1543         /* always enqueue */
 1544 
 1545         TAILQ_INSERT_TAIL(&pcs->hcli, pcc, entry);
 1546 
 1547         /* check if server is closing */
 1548         if ((pcs->is_closing != 0) || (dev->si_drv1 == NULL)) {
 1549                 error = EINVAL;
 1550         } else {
 1551                 error = 0;
 1552         }
 1553         cuse_server_unlock(pcs);
 1554 
 1555         if (error) {
 1556                 devfs_clear_cdevpriv(); /* XXX bugfix */
 1557                 return (error);
 1558         }
 1559         pccmd = &pcc->cmds[CUSE_CMD_OPEN];
 1560 
 1561         cuse_cmd_lock(pccmd);
 1562 
 1563         cuse_server_lock(pcs);
 1564         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
 1565 
 1566         error = cuse_client_receive_command_locked(pccmd, 0, 0);
 1567         cuse_server_unlock(pcs);
 1568 
 1569         if (error < 0) {
 1570                 error = cuse_convert_error(error);
 1571         } else {
 1572                 error = 0;
 1573         }
 1574 
 1575         cuse_cmd_unlock(pccmd);
 1576 
 1577         if (error)
 1578                 devfs_clear_cdevpriv(); /* XXX bugfix */
 1579 
 1580         return (error);
 1581 }
 1582 
 1583 static int
 1584 cuse_client_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
 1585 {
 1586         struct cuse_client_command *pccmd;
 1587         struct cuse_client *pcc;
 1588         struct cuse_server *pcs;
 1589         int error;
 1590 
 1591         error = cuse_client_get(&pcc);
 1592         if (error != 0)
 1593                 return (0);
 1594 
 1595         pccmd = &pcc->cmds[CUSE_CMD_CLOSE];
 1596         pcs = pcc->server;
 1597 
 1598         cuse_cmd_lock(pccmd);
 1599 
 1600         cuse_server_lock(pcs);
 1601         cuse_client_send_command_locked(pccmd, 0, 0, pcc->fflags, 0);
 1602 
 1603         error = cuse_client_receive_command_locked(pccmd, 0, 0);
 1604         cuse_cmd_unlock(pccmd);
 1605 
 1606         cuse_client_is_closing(pcc);
 1607         cuse_server_unlock(pcs);
 1608 
 1609         return (0);
 1610 }
 1611 
 1612 static void
 1613 cuse_client_kqfilter_poll(struct cdev *dev, struct cuse_client *pcc)
 1614 {
 1615         struct cuse_server *pcs = pcc->server;
 1616         int temp;
 1617 
 1618         cuse_server_lock(pcs);
 1619         temp = (pcc->cflags & (CUSE_CLI_KNOTE_HAS_READ |
 1620             CUSE_CLI_KNOTE_HAS_WRITE));
 1621         pcc->cflags &= ~(CUSE_CLI_KNOTE_NEED_READ |
 1622             CUSE_CLI_KNOTE_NEED_WRITE);
 1623         cuse_server_unlock(pcs);
 1624 
 1625         if (temp != 0) {
 1626                 /* get the latest polling state from the server */
 1627                 temp = cuse_client_poll(dev, POLLIN | POLLOUT, NULL);
 1628 
 1629                 if (temp & (POLLIN | POLLOUT)) {
 1630                         cuse_server_lock(pcs);
 1631                         if (temp & POLLIN)
 1632                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_READ;
 1633                         if (temp & POLLOUT)
 1634                                 pcc->cflags |= CUSE_CLI_KNOTE_NEED_WRITE;
 1635 
 1636                         /* make sure the "knote" gets woken up */
 1637                         cuse_server_wakeup_locked(pcc->server);
 1638                         cuse_server_unlock(pcs);
 1639                 }
 1640         }
 1641 }
 1642 
 1643 static int
 1644 cuse_client_read(struct cdev *dev, struct uio *uio, int ioflag)
 1645 {
 1646         struct cuse_client_command *pccmd;
 1647         struct cuse_client *pcc;
 1648         struct cuse_server *pcs;
 1649         int error;
 1650         int temp;
 1651         int len;
 1652 
 1653         error = cuse_client_get(&pcc);
 1654         if (error != 0)
 1655                 return (error);
 1656 
 1657         pccmd = &pcc->cmds[CUSE_CMD_READ];
 1658         pcs = pcc->server;
 1659 
 1660         if (uio->uio_segflg != UIO_USERSPACE) {
 1661                 return (EINVAL);
 1662         }
 1663         uio->uio_segflg = UIO_NOCOPY;
 1664 
 1665         cuse_cmd_lock(pccmd);
 1666 
 1667         while (uio->uio_resid != 0) {
 1668                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
 1669                         error = ENOMEM;
 1670                         break;
 1671                 }
 1672                 len = uio->uio_iov->iov_len;
 1673 
 1674                 cuse_server_lock(pcs);
 1675                 if (len <= CUSE_COPY_BUFFER_MAX) {
 1676                         /* set read buffer region for small reads */
 1677                         pcc->read_base = (uintptr_t)uio->uio_iov->iov_base;
 1678                         pcc->read_length = len;
 1679                 }
 1680                 cuse_client_send_command_locked(pccmd,
 1681                     (uintptr_t)uio->uio_iov->iov_base,
 1682                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
 1683 
 1684                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
 1685                 /*
 1686                  * After finishing reading data, disable the read
 1687                  * region for the cuse_server_data_copy_optimized_locked()
 1688                  * function:
 1689                  */
 1690                 pcc->read_base = 0;
 1691                 pcc->read_length = 0;
 1692                 cuse_server_unlock(pcs);
 1693 
 1694                 /*
 1695                  * The return value indicates the read length, when
 1696                  * not negative. Range check it just in case to avoid
 1697                  * passing invalid length values to uiomove().
 1698                  */
 1699                 if (error > len) {
 1700                         error = ERANGE;
 1701                         break;
 1702                 } else if (error > 0 && len <= CUSE_COPY_BUFFER_MAX) {
 1703                         temp = copyout(pcc->read_buffer,
 1704                             uio->uio_iov->iov_base, error);
 1705                         if (temp != 0) {
 1706                                 error = temp;
 1707                                 break;
 1708                         }
 1709                 }
 1710                 if (error < 0) {
 1711                         error = cuse_convert_error(error);
 1712                         break;
 1713                 } else if (error == len) {
 1714                         error = uiomove(NULL, error, uio);
 1715                         if (error)
 1716                                 break;
 1717                 } else {
 1718                         error = uiomove(NULL, error, uio);
 1719                         break;
 1720                 }
 1721         }
 1722         cuse_cmd_unlock(pccmd);
 1723 
 1724         uio->uio_segflg = UIO_USERSPACE;/* restore segment flag */
 1725 
 1726         if (error == EWOULDBLOCK)
 1727                 cuse_client_kqfilter_poll(dev, pcc);
 1728 
 1729         return (error);
 1730 }
 1731 
 1732 static int
 1733 cuse_client_write(struct cdev *dev, struct uio *uio, int ioflag)
 1734 {
 1735         struct cuse_client_command *pccmd;
 1736         struct cuse_client *pcc;
 1737         struct cuse_server *pcs;
 1738         int error;
 1739         int len;
 1740 
 1741         error = cuse_client_get(&pcc);
 1742         if (error != 0)
 1743                 return (error);
 1744 
 1745         pccmd = &pcc->cmds[CUSE_CMD_WRITE];
 1746         pcs = pcc->server;
 1747 
 1748         if (uio->uio_segflg != UIO_USERSPACE) {
 1749                 return (EINVAL);
 1750         }
 1751         uio->uio_segflg = UIO_NOCOPY;
 1752 
 1753         cuse_cmd_lock(pccmd);
 1754 
 1755         while (uio->uio_resid != 0) {
 1756                 if (uio->uio_iov->iov_len > CUSE_LENGTH_MAX) {
 1757                         error = ENOMEM;
 1758                         break;
 1759                 }
 1760                 len = uio->uio_iov->iov_len;
 1761 
 1762                 if (len <= CUSE_COPY_BUFFER_MAX) {
 1763                         error = copyin(uio->uio_iov->iov_base,
 1764                             pcc->write_buffer, len);
 1765                         if (error != 0)
 1766                                 break;
 1767                 }
 1768 
 1769                 cuse_server_lock(pcs);
 1770                 if (len <= CUSE_COPY_BUFFER_MAX) {
 1771                         /* set write buffer region for small writes */
 1772                         pcc->write_base = (uintptr_t)uio->uio_iov->iov_base;
 1773                         pcc->write_length = len;
 1774                 }
 1775                 cuse_client_send_command_locked(pccmd,
 1776                     (uintptr_t)uio->uio_iov->iov_base,
 1777                     (unsigned long)(unsigned int)len, pcc->fflags, ioflag);
 1778 
 1779                 error = cuse_client_receive_command_locked(pccmd, 0, 0);
 1780 
 1781                 /*
 1782                  * After finishing writing data, disable the write
 1783                  * region for the cuse_server_data_copy_optimized_locked()
 1784                  * function:
 1785                  */
 1786                 pcc->write_base = 0;
 1787                 pcc->write_length = 0;
 1788                 cuse_server_unlock(pcs);
 1789 
 1790                 /*
 1791                  * The return value indicates the write length, when
 1792                  * not negative. Range check it just in case to avoid
 1793                  * passing invalid length values to uiomove().
 1794                  */
 1795                 if (error > len) {
 1796                         error = ERANGE;
 1797                         break;
 1798                 } else if (error < 0) {
 1799                         error = cuse_convert_error(error);
 1800                         break;
 1801                 } else if (error == len) {
 1802                         error = uiomove(NULL, error, uio);
 1803                         if (error)
 1804                                 break;
 1805                 } else {
 1806                         error = uiomove(NULL, error, uio);
 1807                         break;
 1808                 }
 1809         }
 1810         cuse_cmd_unlock(pccmd);
 1811 
 1812         /* restore segment flag */
 1813         uio->uio_segflg = UIO_USERSPACE;
 1814 
 1815         if (error == EWOULDBLOCK)
 1816                 cuse_client_kqfilter_poll(dev, pcc);
 1817 
 1818         return (error);
 1819 }
 1820 
 1821 int
 1822 cuse_client_ioctl(struct cdev *dev, unsigned long cmd,
 1823     caddr_t data, int fflag, struct thread *td)
 1824 {
 1825         struct cuse_client_command *pccmd;
 1826         struct cuse_client *pcc;
 1827         struct cuse_server *pcs;
 1828         int error;
 1829         int len;
 1830 
 1831         error = cuse_client_get(&pcc);
 1832         if (error != 0)
 1833                 return (error);
 1834 
 1835         len = IOCPARM_LEN(cmd);
 1836         if (len > CUSE_BUFFER_MAX)
 1837                 return (ENOMEM);
 1838 
 1839         pccmd = &pcc->cmds[CUSE_CMD_IOCTL];
 1840         pcs = pcc->server;
 1841 
 1842         cuse_cmd_lock(pccmd);
 1843 
 1844         if (cmd & (IOC_IN | IOC_VOID))
 1845                 memcpy(pcc->ioctl_buffer, data, len);
 1846 
 1847         /*
 1848          * When the ioctl-length is zero drivers can pass information
 1849          * through the data pointer of the ioctl. Make sure this information
 1850          * is forwarded to the driver.
 1851          */
 1852 
 1853         cuse_server_lock(pcs);
 1854         cuse_client_send_command_locked(pccmd,
 1855             (len == 0) ? *(long *)data : CUSE_BUF_MIN_PTR,
 1856             (unsigned long)cmd, pcc->fflags,
 1857             (fflag & O_NONBLOCK) ? IO_NDELAY : 0);
 1858 
 1859         error = cuse_client_receive_command_locked(pccmd, data, len);
 1860         cuse_server_unlock(pcs);
 1861 
 1862         if (error < 0) {
 1863                 error = cuse_convert_error(error);
 1864         } else {
 1865                 error = 0;
 1866         }
 1867 
 1868         if (cmd & IOC_OUT)
 1869                 memcpy(data, pcc->ioctl_buffer, len);
 1870 
 1871         cuse_cmd_unlock(pccmd);
 1872 
 1873         if (error == EWOULDBLOCK)
 1874                 cuse_client_kqfilter_poll(dev, pcc);
 1875 
 1876         return (error);
 1877 }
 1878 
 1879 static int
 1880 cuse_client_poll(struct cdev *dev, int events, struct thread *td)
 1881 {
 1882         struct cuse_client_command *pccmd;
 1883         struct cuse_client *pcc;
 1884         struct cuse_server *pcs;
 1885         unsigned long temp;
 1886         int error;
 1887         int revents;
 1888 
 1889         error = cuse_client_get(&pcc);
 1890         if (error != 0)
 1891                 goto pollnval;
 1892 
 1893         temp = 0;
 1894         pcs = pcc->server;
 1895 
 1896         if (events & (POLLPRI | POLLIN | POLLRDNORM))
 1897                 temp |= CUSE_POLL_READ;
 1898 
 1899         if (events & (POLLOUT | POLLWRNORM))
 1900                 temp |= CUSE_POLL_WRITE;
 1901 
 1902         if (events & POLLHUP)
 1903                 temp |= CUSE_POLL_ERROR;
 1904 
 1905         pccmd = &pcc->cmds[CUSE_CMD_POLL];
 1906 
 1907         cuse_cmd_lock(pccmd);
 1908 
 1909         /* Need to selrecord() first to not loose any events. */
 1910         if (temp != 0 && td != NULL)
 1911                 selrecord(td, &pcs->selinfo);
 1912 
 1913         cuse_server_lock(pcs);
 1914         cuse_client_send_command_locked(pccmd,
 1915             0, temp, pcc->fflags, IO_NDELAY);
 1916 
 1917         error = cuse_client_receive_command_locked(pccmd, 0, 0);
 1918         cuse_server_unlock(pcs);
 1919 
 1920         cuse_cmd_unlock(pccmd);
 1921 
 1922         if (error < 0) {
 1923                 goto pollnval;
 1924         } else {
 1925                 revents = 0;
 1926                 if (error & CUSE_POLL_READ)
 1927                         revents |= (events & (POLLPRI | POLLIN | POLLRDNORM));
 1928                 if (error & CUSE_POLL_WRITE)
 1929                         revents |= (events & (POLLOUT | POLLWRNORM));
 1930                 if (error & CUSE_POLL_ERROR)
 1931                         revents |= (events & POLLHUP);
 1932         }
 1933         return (revents);
 1934 
 1935 pollnval:
 1936         /* XXX many clients don't understand POLLNVAL */
 1937         return (events & (POLLHUP | POLLPRI | POLLIN |
 1938             POLLRDNORM | POLLOUT | POLLWRNORM));
 1939 }
 1940 
 1941 static int
 1942 cuse_client_mmap_single(struct cdev *dev, vm_ooffset_t *offset,
 1943     vm_size_t size, struct vm_object **object, int nprot)
 1944 {
 1945         struct cuse_client *pcc;
 1946         int error;
 1947 
 1948         error = cuse_client_get(&pcc);
 1949         if (error != 0)
 1950                 return (error);
 1951 
 1952         return (cuse_common_mmap_single(pcc->server, offset, size, object));
 1953 }
 1954 
 1955 static void
 1956 cuse_client_kqfilter_read_detach(struct knote *kn)
 1957 {
 1958         struct cuse_client *pcc;
 1959         struct cuse_server *pcs;
 1960 
 1961         pcc = kn->kn_hook;
 1962         pcs = pcc->server;
 1963 
 1964         cuse_server_lock(pcs);
 1965         knlist_remove(&pcs->selinfo.si_note, kn, 1);
 1966         cuse_server_unlock(pcs);
 1967 }
 1968 
 1969 static void
 1970 cuse_client_kqfilter_write_detach(struct knote *kn)
 1971 {
 1972         struct cuse_client *pcc;
 1973         struct cuse_server *pcs;
 1974 
 1975         pcc = kn->kn_hook;
 1976         pcs = pcc->server;
 1977 
 1978         cuse_server_lock(pcs);
 1979         knlist_remove(&pcs->selinfo.si_note, kn, 1);
 1980         cuse_server_unlock(pcs);
 1981 }
 1982 
 1983 static int
 1984 cuse_client_kqfilter_read_event(struct knote *kn, long hint)
 1985 {
 1986         struct cuse_client *pcc;
 1987 
 1988         pcc = kn->kn_hook;
 1989 
 1990         mtx_assert(&pcc->server->mtx, MA_OWNED);
 1991 
 1992         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_READ) ? 1 : 0);
 1993 }
 1994 
 1995 static int
 1996 cuse_client_kqfilter_write_event(struct knote *kn, long hint)
 1997 {
 1998         struct cuse_client *pcc;
 1999 
 2000         pcc = kn->kn_hook;
 2001 
 2002         mtx_assert(&pcc->server->mtx, MA_OWNED);
 2003 
 2004         return ((pcc->cflags & CUSE_CLI_KNOTE_NEED_WRITE) ? 1 : 0);
 2005 }
 2006 
 2007 static int
 2008 cuse_client_kqfilter(struct cdev *dev, struct knote *kn)
 2009 {
 2010         struct cuse_client *pcc;
 2011         struct cuse_server *pcs;
 2012         int error;
 2013 
 2014         error = cuse_client_get(&pcc);
 2015         if (error != 0)
 2016                 return (error);
 2017 
 2018         pcs = pcc->server;
 2019 
 2020         cuse_server_lock(pcs);
 2021         switch (kn->kn_filter) {
 2022         case EVFILT_READ:
 2023                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_READ;
 2024                 kn->kn_hook = pcc;
 2025                 kn->kn_fop = &cuse_client_kqfilter_read_ops;
 2026                 knlist_add(&pcs->selinfo.si_note, kn, 1);
 2027                 break;
 2028         case EVFILT_WRITE:
 2029                 pcc->cflags |= CUSE_CLI_KNOTE_HAS_WRITE;
 2030                 kn->kn_hook = pcc;
 2031                 kn->kn_fop = &cuse_client_kqfilter_write_ops;
 2032                 knlist_add(&pcs->selinfo.si_note, kn, 1);
 2033                 break;
 2034         default:
 2035                 error = EINVAL;
 2036                 break;
 2037         }
 2038         cuse_server_unlock(pcs);
 2039 
 2040         if (error == 0)
 2041                 cuse_client_kqfilter_poll(dev, pcc);
 2042         return (error);
 2043 }
Cache object: c66b0d43f0dd39d86a487b4fdaf96923
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/fs/cuse/cuse.c

FreeBSD/Linux Kernel Cross Reference
sys/fs/cuse/cuse.c
