kdbus.h: remove features bitfield from make calls (ABI break)

After discussion in the systemd hackfest, we agreed on flags
negotiation via the flags fields, so there's no need for a bitmask
called 'features' anymore. Drop it.

Signed-off-by: Daniel Mack <daniel@zonque.org>
queue: set O_CLOEXEC on installed file descriptors

The receiver can still opt-out for this with fcntl(), but by default,
we should really set O_CLOEXEC.

Signed-off-by: Daniel Mack <daniel@zonque.org>
tree-wide: rework flags negotiation (ABI break)

We are obliged to reject all bits in flags fields that are not known
to the kernel. In order to let userspace know which flags the kernel
knowns about, we agreed to always write back to the flags field in the
ioctl buffer, even if the call succeeded. The kernel will, however,
will always set the KDBUS_FLAG_KERNEL bit, which consequently is always
invalid when submitted by userspace.

Move some checks from other place to handle.c, and update the testsuite
and documentation accordingly.

Signed-off-by: Daniel Mack <daniel@zonque.org>
message, queue: pin files over their entire lifetime

Make sure the passed fds and memfds are pinned throughout their usage
in kdbus, that is, until they are installed. That closes a race gap in
which a user could possibly replace an fd after submitting a message to
the kernel and the message's delivery and the fd's installation.

While at it, also move the seal check for memfds from queue.c to
message.c and introduce a method to free an array of struct file*.

Now, the incoming QA check in message.c will make sure the files are of
the correct type, memfds are sealed etc. After that, when queue entry
items are created, we call get_file() on each of the passed files to
add increase the reference count once more, and decrement them when the
entry is installed in the receiver's task.

Also, the reference taken my the kmsg are dropped from
kdbus_kmsg_free().

Signed-off-by: Daniel Mack <daniel@zonque.org>
queue: consolidate kdbus_queue_entry_*fds_install()

Combine code from kdbus_queue_entry_fds_install() and
kdbus_queue_entry_memfds_install() and make simplify the caller site.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: split kdbus_conn_wait_reply() off kdbus_conn_kmsg_send()

Move the helper to wait synchronously for a reply into
kdbus_conn_wait_reply(). This reduces the size of kdbus_conn_kmsg_send()
further and makes it much easier to review.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
bus: make conn_rwlock a low-level lock

conn_rwlock protects the connection lists on a bus. Those lists are
usually only accessed deep down in our call-paths, so we can safely order
conn_rwlock _after_ bus->lock and ep->lock. We can even order it after
registry->lock and thus fix a dead-lock in list_names where we used to
have:
    down_read(&bus->conn_rwlock);
    down_read(&reg->rwlock);

.. which dead-locks against kmsg_send():
    kdbus_name_lock(reg); (=> down_read(&reg->rwlock))
    down_read(&bus->conn_rwlock);

The new lock-order isn't particularly beautiful, but there's currently no
way around it. We have to lock destination names on kmsg_send() to make
sure an activator does not get activated concurrently. We could lock
conn_rwlock in kmsg_send() early, but this is kinda ugly regarding
kdbus_conn_wait_reply(). Therefore, for now, lock conn_rwlock late. We can
always change the lock order again later.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
metadata: split KDBUS_ATTACH_COMM in _PID and _TID (ABI break)

Allow users to specify KDBUS_ATTACH_COMM_PID and KDBUS_ATTACH_COMM_TID
separately. This also makes the attachment maintainance in metdata.c
cleaner.

Users that use _KDBUS_ATTACH_ALL just need to recompile.

Signed-off-by: Daniel Mack <daniel@zonque.org>
util.c: degrade (valid & KDBUS_FLAG_KERNEL) to warning

Don't BUG_ON(valid & KDBUS_FLAG_KERNEL), a warning is sufficient.

Signed-off-by: Daniel Mack <daniel@zonque.org>
connection: make attach_flags atomic

Instead of requiring connection locks, make conn->attach_flags a 64bit
atomic. This isn't particularly fast on archs that don't optimize
atomic64, but it simplifies the locking in kdbus. Requiring the connection
lock is just annoying. Furthermore, most 'real' archs should provide 64bit
atomics, anyway.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
TODO: remove external-API entry

We decided on how to handle external API compatibility:
 * unknown flags are rejected and properly overwritten by the kernel
 * unknown items have to be ignored by *BOTH* sides

Drop this entry from the TODO list.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
handle: allocate handle after domain lookup

Just a small cleanup that orders memory allocation after the domain
has been looked up. That saves us an extra kfree() in the error path.

Signed-off-by: Daniel Mack <daniel@zonque.org>
test-fd: add tests for fd and memfd accounting

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
message: account both memfds and fds against KDBUS_MSG_MAX_FDS

Ensure that the number of memfds and normal fds will not exceed
KDBUS_MSG_MAX_FDS per message.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
message: revert commit 65b277d6c0 since KDBUS_MSG_MAX_FDS is only for normal fds

As noted by Daniel, the KDBUS_MSG_MAX_FDS is only for normal fds,
messages that carry payloads as memfds will be accounted against
KDBUS_MSG_MAX_ITEMS, so revert and restore the previous logic.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
test-fd: fix the fd passing test and use KDBUS_MSG_MAX_FDS for normal fds

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
message: minor optimization no need to pass invalid fds to fget()

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
util: fput files refs in reverse order

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
message: document the verify fd and increment usage count logic

We explicitly verify the fd and then just increment the usage counter.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
handle: use dynamic major/minor allocation (ABI break)

Instead of requiring 1 major per domain, we now allocate major/minor
combinations dynamically. So far, only a single major is allocated during
module init, but the code can easily be extended to even make those
dynamic. However, device-cgroups require us to have a fixed major. User
space must be aware that major/minor numbers no longer have any specific
meaning. Each major/minor combination might be assigned to any domain
and/or endpoint! Apart from this semantics change, the ABI stays the same.

Furthermore, this patch reworks the kdbus_domain_new() and kdbus_ep_new()
functions to avoid races against UEVENT_ADD. Both objects must be active
before we call device_add() and thus produce UEVENT_ADD.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>