2 * Copyright © 2012 Collabora, Ltd.
4 * Permission is hereby granted, free of charge, to any person obtaining
5 * a copy of this software and associated documentation files (the
6 * "Software"), to deal in the Software without restriction, including
7 * without limitation the rights to use, copy, modify, merge, publish,
8 * distribute, sublicense, and/or sell copies of the Software, and to
9 * permit persons to whom the Software is furnished to do so, subject to
10 * the following conditions:
12 * The above copyright notice and this permission notice (including the
13 * next paragraph) shall be included in all copies or substantial
14 * portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
17 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
18 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
19 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
20 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
21 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
22 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
26 #include <sys/types.h>
27 #include <sys/socket.h>
31 #include <sys/epoll.h>
34 #include <libweston/zalloc.h>
36 #ifdef HAVE_MEMFD_CREATE
40 #include "os-compatibility.h"
42 #define READONLY_SEALS (F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
45 os_fd_set_cloexec(int fd)
52 flags = fcntl(fd, F_GETFD);
56 if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1)
63 set_cloexec_or_close(int fd)
65 if (os_fd_set_cloexec(fd) != 0) {
73 os_socketpair_cloexec(int domain, int type, int protocol, int *sv)
78 ret = socketpair(domain, type | SOCK_CLOEXEC, protocol, sv);
79 if (ret == 0 || errno != EINVAL)
83 ret = socketpair(domain, type, protocol, sv);
87 sv[0] = set_cloexec_or_close(sv[0]);
88 sv[1] = set_cloexec_or_close(sv[1]);
90 if (sv[0] != -1 && sv[1] != -1)
99 os_epoll_create_cloexec(void)
104 fd = epoll_create1(EPOLL_CLOEXEC);
111 fd = epoll_create(1);
112 return set_cloexec_or_close(fd);
116 create_tmpfile_cloexec(char *tmpname)
121 fd = mkostemp(tmpname, O_CLOEXEC);
125 fd = mkstemp(tmpname);
127 fd = set_cloexec_or_close(fd);
136 * Create a new, unique, anonymous file of the given size, and
137 * return the file descriptor for it. The file descriptor is set
138 * CLOEXEC. The file is immediately suitable for mmap()'ing
139 * the given size at offset zero.
141 * The file should not have a permanent backing store like a disk,
142 * but may have if XDG_RUNTIME_DIR is not properly implemented in OS.
144 * The file name is deleted from the file system.
146 * The file is suitable for buffer sharing between processes by
147 * transmitting the file descriptor over Unix sockets using the
148 * SCM_RIGHTS methods.
150 * If the C library implements posix_fallocate(), it is used to
151 * guarantee that disk space is available for the file at the
152 * given size. If disk space is insufficient, errno is set to ENOSPC.
153 * If posix_fallocate() is not supported, program may receive
154 * SIGBUS on accessing mmap()'ed file contents instead.
156 * If the C library implements memfd_create(), it is used to create the
157 * file purely in memory, without any backing file name on the file
158 * system, and then sealing off the possibility of shrinking it. This
159 * can then be checked before accessing mmap()'ed file contents, to
160 * make sure SIGBUS can't happen. It also avoids requiring
164 os_create_anonymous_file(off_t size)
166 static const char template[] = "/weston-shared-XXXXXX";
172 #ifdef HAVE_MEMFD_CREATE
173 fd = memfd_create("weston-shared", MFD_CLOEXEC | MFD_ALLOW_SEALING);
175 /* We can add this seal before calling posix_fallocate(), as
176 * the file is currently zero-sized anyway.
178 * There is also no need to check for the return value, we
179 * couldn't do anything with it anyway.
181 fcntl(fd, F_ADD_SEALS, F_SEAL_SHRINK);
185 path = getenv("XDG_RUNTIME_DIR");
191 name = malloc(strlen(path) + sizeof(template));
196 strcat(name, template);
198 fd = create_tmpfile_cloexec(name);
206 #ifdef HAVE_POSIX_FALLOCATE
208 ret = posix_fallocate(fd, 0, size);
209 } while (ret == EINTR);
217 ret = ftruncate(fd, size);
218 } while (ret < 0 && errno == EINTR);
228 #ifndef HAVE_STRCHRNUL
230 strchrnul(const char *s, int c)
232 while (*s && *s != c)
238 struct ro_anonymous_file {
243 /** Create a new anonymous read-only file of the given size and the given data
245 * \param size The size of \p data.
246 * \param data The data of the file with the size \p size.
247 * \return A new \c ro_anonymous_file, or NULL on failure.
249 * The intended use-case is for sending mid-sized data from the compositor
251 * If the function fails errno is set.
253 struct ro_anonymous_file *
254 os_ro_anonymous_file_create(size_t size,
257 struct ro_anonymous_file *file;
260 file = zalloc(sizeof *file);
267 file->fd = os_create_anonymous_file(size);
271 map = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, file->fd, 0);
272 if (map == MAP_FAILED)
275 memcpy(map, data, size);
279 #ifdef HAVE_MEMFD_CREATE
280 /* try to put seals on the file to make it read-only so that we can
281 * return the fd later directly when support_shared is not set.
282 * os_ro_anonymous_file_get_fd can handle the fd even if it is not
283 * sealed read-only and will instead create a new anonymous file on
286 fcntl(file->fd, F_ADD_SEALS, READONLY_SEALS);
298 /** Destroy an anonymous read-only file
300 * \param file The file to destroy.
303 os_ro_anonymous_file_destroy(struct ro_anonymous_file *file)
309 /** Get the size of an anonymous read-only file
311 * \param file The file to get the size of.
312 * \return The size of the file.
315 os_ro_anonymous_file_size(struct ro_anonymous_file *file)
320 /** Returns a file descriptor for the given file, ready to be send to a client.
322 * \param file The file for which to get a file descriptor.
323 * \param mapmode Describes the ways in which the returned file descriptor can
325 * \return A file descriptor for the given file that can be send to a client
328 * The returned file descriptor must not be shared between multiple clients.
329 * When \p mapmode is RO_ANONYMOUS_FILE_MAPMODE_PRIVATE the file descriptor is
330 * only guaranteed to be mmapable with \c MAP_PRIVATE, when \p mapmode is
331 * RO_ANONYMOUS_FILE_MAPMODE_SHARED the file descriptor can be mmaped with
332 * either MAP_PRIVATE or MAP_SHARED.
333 * When you're done with the fd you must call \c os_ro_anonymous_file_put_fd
334 * instead of calling \c close.
335 * If the function fails errno is set.
338 os_ro_anonymous_file_get_fd(struct ro_anonymous_file *file,
339 enum ro_anonymous_file_mapmode mapmode)
344 seals = fcntl(file->fd, F_GET_SEALS);
346 /* file was sealed for read-only and we don't have to support MAP_SHARED
347 * so we can simply pass the memfd fd
349 if (seals != -1 && mapmode == RO_ANONYMOUS_FILE_MAPMODE_PRIVATE &&
350 (seals & READONLY_SEALS) == READONLY_SEALS)
353 /* for all other cases we create a new anonymous file that can be mapped
354 * with MAP_SHARED and copy the contents to it and return that instead
356 fd = os_create_anonymous_file(file->size);
360 src = mmap(NULL, file->size, PROT_READ, MAP_PRIVATE, file->fd, 0);
361 if (src == MAP_FAILED) {
366 dst = mmap(NULL, file->size, PROT_WRITE, MAP_SHARED, fd, 0);
367 if (dst == MAP_FAILED) {
369 munmap(src, file->size);
373 memcpy(dst, src, file->size);
374 munmap(src, file->size);
375 munmap(dst, file->size);
380 /** Release a file descriptor returned by \c os_ro_anonymous_file_get_fd
382 * \param fd A file descriptor returned by \c os_ro_anonymous_file_get_fd.
383 * \return 0 on success, or -1 on failure.
385 * This function must be called for every file descriptor created with
386 * \c os_ro_anonymous_file_get_fd to not leake any resources.
387 * If the function fails errno is set.
390 os_ro_anonymous_file_put_fd(int fd)
392 int seals = fcntl(fd, F_GET_SEALS);
393 if (seals == -1 && errno != EINVAL)
396 /* If the fd cannot be sealed seals is -1 at this point
397 * or the file can be sealed but has not been sealed for writing.
398 * In both cases we created a new anonymous file that we have to
401 if (seals == -1 || !(seals & F_SEAL_WRITE))