Home | History | Annotate | Line # | Download | only in puffs
puffs_msgif.c revision 1.36
      1 /*	$NetBSD: puffs_msgif.c,v 1.36 2007/05/08 21:16:55 pooka Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 2005, 2006, 2007  Antti Kantee.  All Rights Reserved.
      5  *
      6  * Development of this software was supported by the
      7  * Google Summer of Code program and the Ulla Tuominen Foundation.
      8  * The Google SoC project was mentored by Bill Studenmund.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. The name of the company nor the name of the author may be used to
     19  *    endorse or promote products derived from this software without specific
     20  *    prior written permission.
     21  *
     22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
     23  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
     24  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
     25  * DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
     28  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     32  * SUCH DAMAGE.
     33  */
     34 
     35 #include <sys/cdefs.h>
     36 __KERNEL_RCSID(0, "$NetBSD: puffs_msgif.c,v 1.36 2007/05/08 21:16:55 pooka Exp $");
     37 
     38 #include <sys/param.h>
     39 #include <sys/fstrans.h>
     40 #include <sys/malloc.h>
     41 #include <sys/mount.h>
     42 #include <sys/vnode.h>
     43 #include <sys/lock.h>
     44 
     45 #include <fs/puffs/puffs_msgif.h>
     46 #include <fs/puffs/puffs_sys.h>
     47 
     48 /*
     49  * waitq data structures
     50  */
     51 
     52 /*
     53  * While a request is going to userspace, park the caller within the
     54  * kernel.  This is the kernel counterpart of "struct puffs_req".
     55  */
     56 struct puffs_park {
     57 	struct puffs_req	*park_preq;	/* req followed by buf	*/
     58 	uint64_t		park_id;	/* duplicate of preq_id */
     59 
     60 	size_t			park_copylen;	/* userspace copylength	*/
     61 	size_t			park_maxlen;	/* max size in comeback */
     62 
     63 	parkdone_fn		park_done;
     64 	void			*park_donearg;
     65 
     66 	int			park_flags;
     67 	int			park_refcount;
     68 
     69 	kcondvar_t		park_cv;
     70 	kmutex_t		park_mtx;
     71 
     72 	TAILQ_ENTRY(puffs_park) park_entries;
     73 };
     74 #define PARKFLAG_WAITERGONE	0x01
     75 #define PARKFLAG_DONE		0x02
     76 #define PARKFLAG_ONQUEUE1	0x04
     77 #define PARKFLAG_ONQUEUE2	0x08
     78 #define PARKFLAG_CALL		0x10
     79 #define PARKFLAG_WANTREPLY	0x20
     80 
     81 static struct pool_cache parkpc;
     82 static struct pool parkpool;
     83 
     84 static int
     85 makepark(void *arg, void *obj, int flags)
     86 {
     87 	struct puffs_park *park = obj;
     88 
     89 	mutex_init(&park->park_mtx, MUTEX_DEFAULT, IPL_NONE);
     90 	cv_init(&park->park_cv, "puffsrpl");
     91 
     92 	return 0;
     93 }
     94 
     95 static void
     96 nukepark(void *arg, void *obj)
     97 {
     98 	struct puffs_park *park = obj;
     99 
    100 	cv_destroy(&park->park_cv);
    101 	mutex_destroy(&park->park_mtx);
    102 }
    103 
    104 void
    105 puffs_msgif_init()
    106 {
    107 
    108 	pool_init(&parkpool, sizeof(struct puffs_park), 0, 0, 0,
    109 	    "puffprkl", &pool_allocator_nointr, IPL_NONE);
    110 	pool_cache_init(&parkpc, &parkpool, makepark, nukepark, NULL);
    111 }
    112 
    113 void
    114 puffs_msgif_destroy()
    115 {
    116 
    117 	pool_cache_destroy(&parkpc);
    118 	pool_destroy(&parkpool);
    119 }
    120 
    121 void *
    122 puffs_park_alloc(int waitok)
    123 {
    124 	struct puffs_park *park;
    125 
    126 	park = pool_cache_get(&parkpc, waitok ? PR_WAITOK : PR_NOWAIT);
    127 	if (park) {
    128 		park->park_refcount = 1;
    129 		mutex_enter(&park->park_mtx);
    130 	}
    131 
    132 	return park;
    133 }
    134 
    135 static void
    136 puffs_park_reference(struct puffs_park *park)
    137 {
    138 
    139 	mutex_enter(&park->park_mtx);
    140 	park->park_refcount++;
    141 }
    142 
    143 void
    144 puffs_park_release(void *arg, int fullnuke)
    145 {
    146 	struct puffs_park *park = arg;
    147 
    148 	KASSERT(mutex_owned(&park->park_mtx));
    149 	--park->park_refcount;
    150 
    151 	mutex_exit(&park->park_mtx);
    152 	if (park->park_refcount == 0 || fullnuke)
    153 		pool_cache_put(&parkpc, park);
    154 }
    155 
    156 #ifdef PUFFSDEBUG
    157 static void
    158 parkdump(struct puffs_park *park)
    159 {
    160 
    161 	DPRINTF(("park %p, preq %p, id %" PRIu64 "\n"
    162 	    "\tcopy %zu, max %zu - done: %p/%p\n"
    163 	    "\tflags 0x%08x, refcount %d, cv/mtx: %p/%p\n",
    164 	    park, park->park_preq, park->park_id,
    165 	    park->park_copylen, park->park_maxlen,
    166 	    park->park_done, park->park_donearg,
    167 	    park->park_flags, park->park_refcount,
    168 	    &park->park_cv, &park->park_mtx));
    169 }
    170 
    171 static void
    172 parkqdump(struct puffs_wq *q, int dumpall)
    173 {
    174 	struct puffs_park *park;
    175 	int total = 0;
    176 
    177 	TAILQ_FOREACH(park, q, park_entries) {
    178 		if (dumpall)
    179 			parkdump(park);
    180 		total++;
    181 	}
    182 	DPRINTF(("puffs waitqueue at %p dumped, %d total\n", q, total));
    183 
    184 }
    185 #endif /* PUFFSDEBUG */
    186 
    187 /*
    188  * Converts a non-FAF op to a FAF.  This simply involves making copies
    189  * of the park and request structures and tagging the request as a FAF.
    190  * It is safe to block here, since the original op is not a FAF.
    191  */
    192 static void
    193 puffs_reqtofaf(struct puffs_park *park)
    194 {
    195 	struct puffs_req *newpreq;
    196 
    197 	KASSERT((park->park_preq->preq_opclass & PUFFSOPFLAG_FAF) == 0);
    198 
    199 	MALLOC(newpreq, struct puffs_req *, park->park_copylen,
    200 	    M_PUFFS, M_ZERO | M_WAITOK);
    201 
    202 	memcpy(newpreq, park->park_preq, park->park_copylen);
    203 
    204 	park->park_preq = newpreq;
    205 	park->park_preq->preq_opclass |= PUFFSOPFLAG_FAF;
    206 	park->park_flags &= ~PARKFLAG_WANTREPLY;
    207 }
    208 
    209 
    210 /*
    211  * kernel-user-kernel waitqueues
    212  */
    213 
    214 static int touser(struct puffs_mount *, struct puffs_park *, uint64_t);
    215 
    216 uint64_t
    217 puffs_getreqid(struct puffs_mount *pmp)
    218 {
    219 	uint64_t rv;
    220 
    221 	mutex_enter(&pmp->pmp_lock);
    222 	rv = pmp->pmp_nextreq++;
    223 	mutex_exit(&pmp->pmp_lock);
    224 
    225 	return rv;
    226 }
    227 
    228 /* vfs request */
    229 int
    230 puffs_vfstouser(struct puffs_mount *pmp, int optype, void *kbuf, size_t buflen)
    231 {
    232 	struct puffs_park *park;
    233 
    234 	park = puffs_park_alloc(1);
    235 	park->park_preq = kbuf;
    236 
    237 	park->park_preq->preq_opclass = PUFFSOP_VFS;
    238 	park->park_preq->preq_optype = optype;
    239 
    240 	park->park_maxlen = park->park_copylen = buflen;
    241 	park->park_flags = 0;
    242 
    243 	return touser(pmp, park, puffs_getreqid(pmp));
    244 }
    245 
    246 void
    247 puffs_suspendtouser(struct puffs_mount *pmp, int status)
    248 {
    249 	struct puffs_vfsreq_suspend *pvfsr_susp;
    250 	struct puffs_park *park;
    251 
    252 	pvfsr_susp = malloc(sizeof(struct puffs_vfsreq_suspend),
    253 	    M_PUFFS, M_WAITOK | M_ZERO);
    254 	park = puffs_park_alloc(1);
    255 
    256 	pvfsr_susp->pvfsr_status = status;
    257 	park->park_preq = (struct puffs_req *)pvfsr_susp;
    258 
    259 	park->park_preq->preq_opclass = PUFFSOP_VFS | PUFFSOPFLAG_FAF;
    260 	park->park_preq->preq_optype = PUFFS_VFS_SUSPEND;
    261 
    262 	park->park_maxlen = park->park_copylen
    263 	    = sizeof(struct puffs_vfsreq_suspend);
    264 	park->park_flags = 0;
    265 
    266 	(void)touser(pmp, park, 0);
    267 }
    268 
    269 /*
    270  * vnode level request
    271  */
    272 int
    273 puffs_vntouser(struct puffs_mount *pmp, int optype,
    274 	void *kbuf, size_t buflen, size_t maxdelta,
    275 	struct vnode *vp_opc, struct vnode *vp_aux)
    276 {
    277 	struct puffs_park *park;
    278 	struct puffs_req *preq;
    279 	void *cookie = VPTOPNC(vp_opc);
    280 	struct puffs_node *pnode;
    281 	int rv;
    282 
    283 	park = puffs_park_alloc(1);
    284 	park->park_preq = kbuf;
    285 
    286 	park->park_preq->preq_opclass = PUFFSOP_VN;
    287 	park->park_preq->preq_optype = optype;
    288 	park->park_preq->preq_cookie = cookie;
    289 
    290 	park->park_copylen = buflen;
    291 	park->park_maxlen = buflen + maxdelta;
    292 	park->park_flags = 0;
    293 
    294 	rv = touser(pmp, park, puffs_getreqid(pmp));
    295 
    296 	/*
    297 	 * Check if the user server requests that inactive be called
    298 	 * when the time is right.
    299 	 */
    300 	preq = park->park_preq;
    301 	if (preq->preq_setbacks & PUFFS_SETBACK_INACT_N1) {
    302 		pnode = vp_opc->v_data;
    303 		pnode->pn_stat |= PNODE_DOINACT;
    304 	}
    305 	if (preq->preq_setbacks & PUFFS_SETBACK_INACT_N2) {
    306 		/* if no vp_aux, just ignore */
    307 		if (vp_aux) {
    308 			pnode = vp_aux->v_data;
    309 			pnode->pn_stat |= PNODE_DOINACT;
    310 		}
    311 	}
    312 
    313 	return rv;
    314 }
    315 
    316 /*
    317  * vnode level request, caller-controller req id
    318  */
    319 int
    320 puffs_vntouser_req(struct puffs_mount *pmp, int optype,
    321 	void *kbuf, size_t buflen, size_t maxdelta,
    322 	uint64_t reqid, struct vnode *vp_opc, struct vnode *vp_aux)
    323 {
    324 	struct puffs_park *park;
    325 	void *cookie = VPTOPNC(vp_opc);
    326 
    327 	park = puffs_park_alloc(1);
    328 	park->park_preq = kbuf;
    329 
    330 	park->park_preq->preq_opclass = PUFFSOP_VN;
    331 	park->park_preq->preq_optype = optype;
    332 	park->park_preq->preq_cookie = cookie;
    333 
    334 	park->park_copylen = buflen;
    335 	park->park_maxlen = buflen + maxdelta;
    336 	park->park_flags = 0;
    337 
    338 	return touser(pmp, park, reqid);
    339 }
    340 
    341 void
    342 puffs_vntouser_call(struct puffs_mount *pmp, int optype,
    343 	void *kbuf, size_t buflen, size_t maxdelta,
    344 	parkdone_fn donefn, void *donearg,
    345 	struct vnode *vp_opc, struct vnode *vp_aux)
    346 {
    347 	struct puffs_park *park;
    348 	void *cookie = VPTOPNC(vp_opc);
    349 
    350 	park = puffs_park_alloc(1);
    351 	park->park_preq = kbuf;
    352 
    353 	park->park_preq->preq_opclass = PUFFSOP_VN;
    354 	park->park_preq->preq_optype = optype;
    355 	park->park_preq->preq_cookie = cookie;
    356 
    357 	park->park_copylen = buflen;
    358 	park->park_maxlen = buflen + maxdelta;
    359 	park->park_done = donefn;
    360 	park->park_donearg = donearg;
    361 	park->park_flags = PARKFLAG_CALL;
    362 
    363 	(void) touser(pmp, park, puffs_getreqid(pmp));
    364 }
    365 
    366 /*
    367  * Notice: kbuf will be free'd later.  I must be allocated from the
    368  * kernel heap and it's ownership is shifted to this function from
    369  * now on, i.e. the caller is not allowed to use it anymore!
    370  */
    371 void
    372 puffs_vntouser_faf(struct puffs_mount *pmp, int optype,
    373 	void *kbuf, size_t buflen, struct vnode *vp_opc)
    374 {
    375 	struct puffs_park *park;
    376 	void *cookie = VPTOPNC(vp_opc);
    377 
    378 	/* XXX: is it allowable to sleep here? */
    379 	park = puffs_park_alloc(0);
    380 	if (park == NULL)
    381 		return; /* 2bad */
    382 
    383 	park->park_preq = kbuf;
    384 
    385 	park->park_preq->preq_opclass = PUFFSOP_VN | PUFFSOPFLAG_FAF;
    386 	park->park_preq->preq_optype = optype;
    387 	park->park_preq->preq_cookie = cookie;
    388 
    389 	park->park_maxlen = park->park_copylen = buflen;
    390 	park->park_flags = 0;
    391 
    392 	(void)touser(pmp, park, 0);
    393 }
    394 
    395 void
    396 puffs_cacheop(struct puffs_mount *pmp, struct puffs_park *park,
    397 	struct puffs_cacheinfo *pcinfo, size_t pcilen, void *cookie)
    398 {
    399 
    400 	park->park_preq = (struct puffs_req *)pcinfo;
    401 	park->park_preq->preq_opclass = PUFFSOP_CACHE | PUFFSOPFLAG_FAF;
    402 	park->park_preq->preq_optype = PCACHE_TYPE_WRITE; /* XXX */
    403 	park->park_preq->preq_cookie = cookie;
    404 
    405 	park->park_maxlen = park->park_copylen = pcilen;
    406 	park->park_flags = 0;
    407 
    408 	(void)touser(pmp, park, 0);
    409 }
    410 
    411 /*
    412  * Wait for the userspace ping-pong game in calling process context.
    413  *
    414  * This unlocks vnodes if they are supplied.  vp1 is the vnode
    415  * before in the locking order, i.e. the one which must be locked
    416  * before accessing vp2.  This is done here so that operations are
    417  * already ordered in the queue when vnodes are unlocked (I'm not
    418  * sure if that's really necessary, but it can't hurt).  Okok, maybe
    419  * there's a slight ugly-factor also, but let's not worry about that.
    420  */
    421 static int
    422 touser(struct puffs_mount *pmp, struct puffs_park *park, uint64_t reqid)
    423 {
    424 	struct lwp *l = curlwp;
    425 	struct mount *mp;
    426 	struct puffs_req *preq;
    427 	int rv = 0;
    428 
    429 	mp = PMPTOMP(pmp);
    430 	preq = park->park_preq;
    431 	preq->preq_id = park->park_id = reqid;
    432 	preq->preq_buflen = ALIGN(park->park_maxlen);
    433 
    434 	if (PUFFSOP_WANTREPLY(preq->preq_opclass))
    435 		park->park_flags |= PARKFLAG_WANTREPLY;
    436 
    437 	/*
    438 	 * To support PCATCH, yet another movie: check if there are signals
    439 	 * pending and we are issueing a non-FAF.  If so, return an error
    440 	 * directly UNLESS we are issueing INACTIVE.  In that case, convert
    441 	 * it to a FAF, fire off to the file server and return an error.
    442 	 * Yes, this is bordering disgusting.  Barfbags are on me.
    443 	 */
    444 	if ((park->park_flags & PARKFLAG_WANTREPLY)
    445 	   && (park->park_flags & PARKFLAG_CALL) == 0
    446 	   && (l->l_flag & LW_PENDSIG) != 0 && sigispending(l, 0)) {
    447 		if (PUFFSOP_OPCLASS(preq->preq_opclass) == PUFFSOP_VN
    448 		    && preq->preq_optype == PUFFS_VN_INACTIVE) {
    449 			puffs_reqtofaf(park);
    450 			DPRINTF(("puffs touser: converted to FAF %p\n", park));
    451 			rv = EINTR;
    452 		} else {
    453 			puffs_park_release(park, 0);
    454 			return EINTR;
    455 		}
    456 	}
    457 
    458 	/*
    459 	 * test for suspension lock.
    460 	 *
    461 	 * Note that we *DO NOT* keep the lock, since that might block
    462 	 * lock acquiring PLUS it would give userlandia control over
    463 	 * the lock.  The operation queue enforces a strict ordering:
    464 	 * when the fs server gets in the op stream, it knows things
    465 	 * are in order.  The kernel locks can't guarantee that for
    466 	 * userspace, in any case.
    467 	 *
    468 	 * BUT: this presents a problem for ops which have a consistency
    469 	 * clause based on more than one operation.  Unfortunately such
    470 	 * operations (read, write) do not reliably work yet.
    471 	 *
    472 	 * Ya, Ya, it's wrong wong wrong, me be fixink this someday.
    473 	 *
    474 	 * XXX: and there is one more problem.  We sometimes need to
    475 	 * take a lazy lock in case the fs is suspending and we are
    476 	 * executing as the fs server context.  This might happen
    477 	 * e.g. in the case that the user server triggers a reclaim
    478 	 * in the kernel while the fs is suspending.  It's not a very
    479 	 * likely event, but it needs to be fixed some day.
    480 	 */
    481 
    482 	/*
    483 	 * MOREXXX: once PUFFS_WCACHEINFO is enabled, we can't take
    484 	 * the mutex here, since getpages() might be called locked.
    485 	 */
    486 	fstrans_start(mp, FSTRANS_NORMAL);
    487 	mutex_enter(&pmp->pmp_lock);
    488 	fstrans_done(mp);
    489 
    490 	if (pmp->pmp_status != PUFFSTAT_RUNNING) {
    491 		mutex_exit(&pmp->pmp_lock);
    492 		puffs_park_release(park, 0);
    493 		return ENXIO;
    494 	}
    495 
    496 #ifdef PUFFSDEBUG
    497 	parkqdump(&pmp->pmp_req_touser, puffsdebug > 1);
    498 	parkqdump(&pmp->pmp_req_replywait, puffsdebug > 1);
    499 #endif
    500 
    501 	TAILQ_INSERT_TAIL(&pmp->pmp_req_touser, park, park_entries);
    502 	park->park_flags |= PARKFLAG_ONQUEUE1;
    503 	puffs_mp_reference(pmp);
    504 	pmp->pmp_req_touser_count++;
    505 	mutex_exit(&pmp->pmp_lock);
    506 
    507 	DPRINTF(("touser: req %" PRIu64 ", preq: %p, park: %p, "
    508 	    "c/t: 0x%x/0x%x, f: 0x%x\n", preq->preq_id, preq, park,
    509 	    preq->preq_opclass, preq->preq_optype, park->park_flags));
    510 
    511 	cv_broadcast(&pmp->pmp_req_waiter_cv);
    512 	selnotify(pmp->pmp_sel, 0);
    513 
    514 	if ((park->park_flags & PARKFLAG_WANTREPLY)
    515 	    && (park->park_flags & PARKFLAG_CALL) == 0) {
    516 		int error;
    517 
    518 		error = cv_wait_sig(&park->park_cv, &park->park_mtx);
    519 		if (error) {
    520 			park->park_flags |= PARKFLAG_WAITERGONE;
    521 			if (park->park_flags & PARKFLAG_DONE) {
    522 				rv = preq->preq_rv;
    523 				puffs_park_release(park, 0);
    524 			} else {
    525 				/*
    526 				 * ok, we marked it as going away, but
    527 				 * still need to do queue ops.  take locks
    528 				 * in correct order.
    529 				 *
    530 				 * We don't want to release our reference
    531 				 * if it's on replywait queue to avoid error
    532 				 * to file server.  putop() code will DTRT.
    533 				 */
    534 				KASSERT(park->park_flags &
    535 				    (PARKFLAG_ONQUEUE1 | PARKFLAG_ONQUEUE2));
    536 				mutex_exit(&park->park_mtx);
    537 
    538 				mutex_enter(&pmp->pmp_lock);
    539 				mutex_enter(&park->park_mtx);
    540 				if (park->park_flags & PARKFLAG_ONQUEUE1) {
    541 					TAILQ_REMOVE(&pmp->pmp_req_touser,
    542 					    park, park_entries);
    543 					pmp->pmp_req_touser_count--;
    544 					park->park_flags &= ~PARKFLAG_ONQUEUE1;
    545 				}
    546 				if ((park->park_flags & PARKFLAG_ONQUEUE2) == 0)
    547 					puffs_park_release(park, 0);
    548 				else
    549 					mutex_exit(&park->park_mtx);
    550 				mutex_exit(&pmp->pmp_lock);
    551 
    552 				rv = error;
    553 			}
    554 		} else {
    555 			rv = preq->preq_rv;
    556 			puffs_park_release(park, 0);
    557 		}
    558 
    559 		/*
    560 		 * retake the lock and release.  This makes sure (haha,
    561 		 * I'm humorous) that we don't process the same vnode in
    562 		 * multiple threads due to the locks hacks we have in
    563 		 * puffs_lock().  In reality this is well protected by
    564 		 * the biglock, but once that's gone, well, hopefully
    565 		 * this will be fixed for real.  (and when you read this
    566 		 * comment in 2017 and subsequently barf, my condolences ;).
    567 		 */
    568 		if (rv == 0 && !fstrans_is_owner(mp)) {
    569 			fstrans_start(mp, FSTRANS_NORMAL);
    570 			fstrans_done(mp);
    571 		}
    572 	} else {
    573 		mutex_exit(&park->park_mtx);
    574 	}
    575 
    576 	mutex_enter(&pmp->pmp_lock);
    577 	puffs_mp_release(pmp);
    578 	mutex_exit(&pmp->pmp_lock);
    579 
    580 	return rv;
    581 }
    582 
    583 
    584 /*
    585  * getop: scan through queued requests until:
    586  *  1) max number of requests satisfied
    587  *     OR
    588  *  2) buffer runs out of space
    589  *     OR
    590  *  3) nonblocking is set AND there are no operations available
    591  *     OR
    592  *  4) at least one operation was transferred AND there are no more waiting
    593  */
    594 int
    595 puffs_getop(struct puffs_mount *pmp, struct puffs_reqh_get *phg, int nonblock)
    596 {
    597 	struct puffs_park *park;
    598 	struct puffs_req *preq;
    599 	uint8_t *bufpos;
    600 	int error, donesome;
    601 
    602 	donesome = error = 0;
    603 	bufpos = phg->phg_buf;
    604 
    605 	mutex_enter(&pmp->pmp_lock);
    606 	while (phg->phg_nops == 0 || donesome != phg->phg_nops) {
    607  again:
    608 		if (pmp->pmp_status != PUFFSTAT_RUNNING) {
    609 			/* if we got some, they don't really matter anymore */
    610 			error = ENXIO;
    611 			goto out;
    612 		}
    613 		if (TAILQ_EMPTY(&pmp->pmp_req_touser)) {
    614 			if (donesome)
    615 				goto out;
    616 
    617 			if (nonblock) {
    618 				error = EWOULDBLOCK;
    619 				goto out;
    620 			}
    621 
    622 			error = cv_wait_sig(&pmp->pmp_req_waiter_cv,
    623 			    &pmp->pmp_lock);
    624 			if (error)
    625 				goto out;
    626 			else
    627 				goto again;
    628 		}
    629 
    630 		park = TAILQ_FIRST(&pmp->pmp_req_touser);
    631 		puffs_park_reference(park);
    632 
    633 		/* If it's a goner, don't process any furher */
    634 		if (park->park_flags & PARKFLAG_WAITERGONE) {
    635 			puffs_park_release(park, 0);
    636 			continue;
    637 		}
    638 
    639 		preq = park->park_preq;
    640 		if (phg->phg_buflen < preq->preq_buflen) {
    641 			if (!donesome)
    642 				error = E2BIG;
    643 			puffs_park_release(park, 0);
    644 			goto out;
    645 		}
    646 
    647 		TAILQ_REMOVE(&pmp->pmp_req_touser, park, park_entries);
    648 		KASSERT(park->park_flags & PARKFLAG_ONQUEUE1);
    649 		park->park_flags &= ~PARKFLAG_ONQUEUE1;
    650 		pmp->pmp_req_touser_count--;
    651 		KASSERT(pmp->pmp_req_touser_count >= 0);
    652 		mutex_exit(&pmp->pmp_lock);
    653 
    654 		DPRINTF(("puffsgetop: get op %" PRIu64 " (%d.), from %p "
    655 		    "len %zu (buflen %zu), target %p\n", preq->preq_id,
    656 		    donesome, preq, park->park_copylen, preq->preq_buflen,
    657 		    bufpos));
    658 
    659 		if ((error = copyout(preq, bufpos, park->park_copylen)) != 0) {
    660 			DPRINTF(("puffs_getop: copyout failed: %d\n", error));
    661 			/*
    662 			 * ok, user server is probably trying to cheat.
    663 			 * stuff op back & return error to user.  We need
    664 			 * to take locks in the correct order.
    665 			 */
    666 			mutex_exit(&park->park_mtx);
    667 
    668 			/*
    669 			 * XXX: ONQUEUE1 | ONQUEUE2 invariant doesn't
    670 			 * hold here
    671 			 */
    672 
    673 			mutex_enter(&pmp->pmp_lock);
    674 			mutex_enter(&park->park_mtx);
    675 			if ((park->park_flags & PARKFLAG_WAITERGONE) == 0) {
    676 				 TAILQ_INSERT_HEAD(&pmp->pmp_req_touser, park,
    677 				     park_entries);
    678 				 park->park_flags |= PARKFLAG_ONQUEUE1;
    679 				 pmp->pmp_req_touser_count++;
    680 			}
    681 
    682 			if (donesome)
    683 				error = 0;
    684 			puffs_park_release(park, 0);
    685 			goto out;
    686 		}
    687 		bufpos += preq->preq_buflen;
    688 		phg->phg_buflen -= preq->preq_buflen;
    689 		donesome++;
    690 
    691 		/* XXXfixme: taking this lock in the wrong order */
    692 		mutex_enter(&pmp->pmp_lock);
    693 
    694 		if (park->park_flags & PARKFLAG_WANTREPLY) {
    695 			TAILQ_INSERT_TAIL(&pmp->pmp_req_replywait, park,
    696 			    park_entries);
    697 			park->park_flags |= PARKFLAG_ONQUEUE2;
    698 			puffs_park_release(park, 0);
    699 		} else {
    700 			free(preq, M_PUFFS);
    701 			puffs_park_release(park, 1);
    702 		}
    703 	}
    704 
    705  out:
    706 	phg->phg_more = pmp->pmp_req_touser_count;
    707 	mutex_exit(&pmp->pmp_lock);
    708 
    709 	phg->phg_nops = donesome;
    710 
    711 	return error;
    712 }
    713 
    714 int
    715 puffs_putop(struct puffs_mount *pmp, struct puffs_reqh_put *php)
    716 {
    717 	struct puffs_park *park;
    718 	struct puffs_req tmpreq;
    719 	struct puffs_req *nextpreq;
    720 	void *userbuf;
    721 	uint64_t id;
    722 	size_t reqlen;
    723 	int donesome, error, wgone, release;
    724 
    725 	donesome = error = wgone = 0;
    726 
    727 	id = php->php_id;
    728 	userbuf = php->php_buf;
    729 	reqlen = php->php_buflen;
    730 
    731 	mutex_enter(&pmp->pmp_lock);
    732 	while (donesome != php->php_nops) {
    733 		release = 0;
    734 #ifdef PUFFSDEBUG
    735 		DPRINTF(("puffsputop: searching for %" PRIu64 ", ubuf: %p, "
    736 		    "len %zu\n", id, userbuf, reqlen));
    737 #endif
    738 		TAILQ_FOREACH(park, &pmp->pmp_req_replywait, park_entries) {
    739 			if (park->park_id == id)
    740 				break;
    741 		}
    742 
    743 		if (park == NULL) {
    744 			DPRINTF(("puffsputop: no request: %" PRIu64 "\n", id));
    745 			error = EINVAL;
    746 			break;
    747 		}
    748 
    749 		puffs_park_reference(park);
    750 		if (reqlen == 0 || reqlen > park->park_maxlen) {
    751 			DPRINTF(("puffsputop: invalid buffer length: "
    752 			    "%zu\n", reqlen));
    753 			error = E2BIG;
    754 			puffs_park_release(park, 0);
    755 			break;
    756 		}
    757 		wgone = park->park_flags & PARKFLAG_WAITERGONE;
    758 
    759 		/* check if it's still on the queue after acquiring lock */
    760 		if (park->park_flags & PARKFLAG_ONQUEUE2) {
    761 			TAILQ_REMOVE(&pmp->pmp_req_replywait, park,
    762 			    park_entries);
    763 			park->park_flags &= ~PARKFLAG_ONQUEUE2;
    764 		}
    765 
    766 		mutex_exit(&pmp->pmp_lock);
    767 
    768 		/*
    769 		 * If the caller has gone south, go to next, collect
    770 		 * $200 and free the structure there instead of wakeup.
    771 		 * We also need to copyin the header info.  Flag structure
    772 		 * release to mode total and utter destruction.
    773 		 */
    774 		if (wgone) {
    775 			DPRINTF(("puffs_putop: bad service - waiter gone for "
    776 			    "park %p\n", park));
    777 			error = copyin(userbuf, &tmpreq,
    778 			    sizeof(struct puffs_req));
    779 			release = 1;
    780 			if (error)
    781 				goto loopout;
    782 			nextpreq = &tmpreq;
    783 			goto next;
    784 		}
    785 
    786 		DPRINTF(("puffsputpop: copyin from %p to %p, len %zu\n",
    787 		    userbuf, park->park_preq, reqlen));
    788 		error = copyin(userbuf, park->park_preq, reqlen);
    789 		if (error)
    790 			goto loopout;
    791 		nextpreq = park->park_preq;
    792 
    793  next:
    794 		/* all's well, prepare for next op */
    795 		id = nextpreq->preq_id;
    796 		reqlen = nextpreq->preq_buflen;
    797 		userbuf = nextpreq->preq_nextbuf;
    798 		donesome++;
    799 
    800  loopout:
    801 		if (error && !wgone)
    802 			park->park_preq->preq_rv = error;
    803 
    804 		if (park->park_flags & PARKFLAG_CALL) {
    805 			park->park_done(park->park_preq, park->park_donearg);
    806 			release = 1;
    807 		}
    808 
    809 		if (!wgone) {
    810 			DPRINTF(("puffs_putop: flagging done for "
    811 			    "park %p\n", park));
    812 
    813 			cv_signal(&park->park_cv);
    814 		}
    815 		park->park_flags |= PARKFLAG_DONE;
    816 		puffs_park_release(park, release);
    817 
    818 		mutex_enter(&pmp->pmp_lock);
    819 		if (error)
    820 			break;
    821 		wgone = 0;
    822 	}
    823 
    824 	mutex_exit(&pmp->pmp_lock);
    825 	php->php_nops -= donesome;
    826 
    827 	return error;
    828 }
    829 
    830 /*
    831  * We're dead, kaput, RIP, slightly more than merely pining for the
    832  * fjords, belly-up, fallen, lifeless, finished, expired, gone to meet
    833  * our maker, ceased to be, etcetc.  YASD.  It's a dead FS!
    834  *
    835  * Caller must hold puffs mutex.
    836  */
    837 void
    838 puffs_userdead(struct puffs_mount *pmp)
    839 {
    840 	struct puffs_park *park, *park_next;
    841 
    842 	/*
    843 	 * Mark filesystem status as dying so that operations don't
    844 	 * attempt to march to userspace any longer.
    845 	 */
    846 	pmp->pmp_status = PUFFSTAT_DYING;
    847 
    848 	/* signal waiters on REQUEST TO file server queue */
    849 	for (park = TAILQ_FIRST(&pmp->pmp_req_touser); park; park = park_next) {
    850 		uint8_t opclass;
    851 
    852 		puffs_park_reference(park);
    853 		park_next = TAILQ_NEXT(park, park_entries);
    854 
    855 		KASSERT(park->park_flags & PARKFLAG_ONQUEUE1);
    856 		TAILQ_REMOVE(&pmp->pmp_req_touser, park, park_entries);
    857 		park->park_flags &= ~PARKFLAG_ONQUEUE1;
    858 		pmp->pmp_req_touser_count--;
    859 
    860 		/*
    861 		 * If the waiter is gone, we may *NOT* access preq anymore.
    862 		 */
    863 		if (park->park_flags & PARKFLAG_WAITERGONE) {
    864 			KASSERT((park->park_flags & PARKFLAG_CALL) == 0);
    865 			KASSERT(park->park_flags & PARKFLAG_WANTREPLY);
    866 			puffs_park_release(park, 0);
    867 		} else {
    868 			opclass = park->park_preq->preq_opclass;
    869 			park->park_preq->preq_rv = ENXIO;
    870 
    871 			if (park->park_flags & PARKFLAG_CALL) {
    872 				park->park_done(park->park_preq,
    873 				    park->park_donearg);
    874 				puffs_park_release(park, 1);
    875 			} else if ((park->park_flags & PARKFLAG_WANTREPLY)==0) {
    876 				free(park->park_preq, M_PUFFS);
    877 				puffs_park_release(park, 1);
    878 			} else {
    879 				park->park_preq->preq_rv = ENXIO;
    880 				cv_signal(&park->park_cv);
    881 				puffs_park_release(park, 0);
    882 			}
    883 		}
    884 	}
    885 
    886 	/* signal waiters on RESPONSE FROM file server queue */
    887 	for (park=TAILQ_FIRST(&pmp->pmp_req_replywait); park; park=park_next) {
    888 		puffs_park_reference(park);
    889 		park_next = TAILQ_NEXT(park, park_entries);
    890 
    891 		KASSERT(park->park_flags & PARKFLAG_ONQUEUE2);
    892 		KASSERT(park->park_flags & PARKFLAG_WANTREPLY);
    893 
    894 		TAILQ_REMOVE(&pmp->pmp_req_replywait, park, park_entries);
    895 		park->park_flags &= ~PARKFLAG_ONQUEUE2;
    896 
    897 		/*
    898 		 * If the waiter is gone, we may *NOT* access preq anymore.
    899 		 */
    900 		if (park->park_flags & PARKFLAG_WAITERGONE) {
    901 			KASSERT((park->park_flags & PARKFLAG_CALL) == 0);
    902 			puffs_park_release(park, 0);
    903 		} else {
    904 			park->park_preq->preq_rv = ENXIO;
    905 			if (park->park_flags & PARKFLAG_CALL) {
    906 				park->park_done(park->park_preq,
    907 				    park->park_donearg);
    908 				puffs_park_release(park, 1);
    909 			} else {
    910 				cv_signal(&park->park_cv);
    911 				puffs_park_release(park, 0);
    912 			}
    913 		}
    914 	}
    915 }
    916 
    917 /* this is probably going to die away at some point? */
    918 /*
    919  * XXX: currently bitrotted
    920  */
    921 #if 0
    922 static int
    923 puffssizeop(struct puffs_mount *pmp, struct puffs_sizeop *psop_user)
    924 {
    925 	struct puffs_sizepark *pspark;
    926 	void *kernbuf;
    927 	size_t copylen;
    928 	int error;
    929 
    930 	/* locate correct op */
    931 	mutex_enter(&pmp->pmp_lock);
    932 	TAILQ_FOREACH(pspark, &pmp->pmp_req_sizepark, pkso_entries) {
    933 		if (pspark->pkso_reqid == psop_user->pso_reqid) {
    934 			TAILQ_REMOVE(&pmp->pmp_req_sizepark, pspark,
    935 			    pkso_entries);
    936 			break;
    937 		}
    938 	}
    939 	mutex_exit(&pmp->pmp_lock);
    940 
    941 	if (pspark == NULL)
    942 		return EINVAL;
    943 
    944 	error = 0;
    945 	copylen = MIN(pspark->pkso_bufsize, psop_user->pso_bufsize);
    946 
    947 	/*
    948 	 * XXX: uvm stuff to avoid bouncy-bouncy copying?
    949 	 */
    950 	if (PUFFS_SIZEOP_UIO(pspark->pkso_reqtype)) {
    951 		kernbuf = malloc(copylen, M_PUFFS, M_WAITOK | M_ZERO);
    952 		if (pspark->pkso_reqtype == PUFFS_SIZEOPREQ_UIO_IN) {
    953 			error = copyin(psop_user->pso_userbuf,
    954 			    kernbuf, copylen);
    955 			if (error) {
    956 				printf("psop ERROR1 %d\n", error);
    957 				goto escape;
    958 			}
    959 		}
    960 		error = uiomove(kernbuf, copylen, pspark->pkso_uio);
    961 		if (error) {
    962 			printf("uiomove from kernel %p, len %d failed: %d\n",
    963 			    kernbuf, (int)copylen, error);
    964 			goto escape;
    965 		}
    966 
    967 		if (pspark->pkso_reqtype == PUFFS_SIZEOPREQ_UIO_OUT) {
    968 			error = copyout(kernbuf,
    969 			    psop_user->pso_userbuf, copylen);
    970 			if (error) {
    971 				printf("psop ERROR2 %d\n", error);
    972 				goto escape;
    973 			}
    974 		}
    975  escape:
    976 		free(kernbuf, M_PUFFS);
    977 	} else if (PUFFS_SIZEOP_BUF(pspark->pkso_reqtype)) {
    978 		copylen = MAX(pspark->pkso_bufsize, psop_user->pso_bufsize);
    979 		if (pspark->pkso_reqtype == PUFFS_SIZEOPREQ_BUF_IN) {
    980 			error = copyin(psop_user->pso_userbuf,
    981 			pspark->pkso_copybuf, copylen);
    982 		} else {
    983 			error = copyout(pspark->pkso_copybuf,
    984 			    psop_user->pso_userbuf, copylen);
    985 		}
    986 	}
    987 #ifdef DIAGNOSTIC
    988 	else
    989 		panic("puffssizeop: invalid reqtype %d\n",
    990 		    pspark->pkso_reqtype);
    991 #endif /* DIAGNOSTIC */
    992 
    993 	return error;
    994 }
    995 #endif
    996