2 FUSE: Filesystem in Userspace
3 Copyright (C) 2001-2005 Miklos Szeredi <miklos@szeredi.hu>
5 This program can be distributed under the terms of the GNU GPL.
11 #include <linux/init.h>
12 #include <linux/module.h>
13 #include <linux/poll.h>
14 #include <linux/uio.h>
15 #include <linux/miscdevice.h>
16 #include <linux/pagemap.h>
17 #include <linux/file.h>
18 #include <linux/slab.h>
20 MODULE_ALIAS_MISCDEV(FUSE_MINOR
);
22 static kmem_cache_t
*fuse_req_cachep
;
24 static inline struct fuse_conn
*fuse_get_conn(struct file
*file
)
27 spin_lock(&fuse_lock
);
28 fc
= file
->private_data
;
29 if (fc
&& !fc
->mounted
)
31 spin_unlock(&fuse_lock
);
35 static inline void fuse_request_init(struct fuse_req
*req
)
37 memset(req
, 0, sizeof(*req
));
38 INIT_LIST_HEAD(&req
->list
);
39 init_waitqueue_head(&req
->waitq
);
40 atomic_set(&req
->count
, 1);
43 struct fuse_req
*fuse_request_alloc(void)
45 struct fuse_req
*req
= kmem_cache_alloc(fuse_req_cachep
, SLAB_KERNEL
);
47 fuse_request_init(req
);
51 void fuse_request_free(struct fuse_req
*req
)
53 kmem_cache_free(fuse_req_cachep
, req
);
56 static inline void block_sigs(sigset_t
*oldset
)
60 siginitsetinv(&mask
, sigmask(SIGKILL
));
61 sigprocmask(SIG_BLOCK
, &mask
, oldset
);
64 static inline void restore_sigs(sigset_t
*oldset
)
66 sigprocmask(SIG_SETMASK
, oldset
, NULL
);
69 void fuse_reset_request(struct fuse_req
*req
)
71 int preallocated
= req
->preallocated
;
72 BUG_ON(atomic_read(&req
->count
) != 1);
73 fuse_request_init(req
);
74 req
->preallocated
= preallocated
;
77 static void __fuse_get_request(struct fuse_req
*req
)
79 atomic_inc(&req
->count
);
82 /* Must be called with > 1 refcount */
83 static void __fuse_put_request(struct fuse_req
*req
)
85 BUG_ON(atomic_read(&req
->count
) < 2);
86 atomic_dec(&req
->count
);
89 static struct fuse_req
*do_get_request(struct fuse_conn
*fc
)
93 spin_lock(&fuse_lock
);
94 BUG_ON(list_empty(&fc
->unused_list
));
95 req
= list_entry(fc
->unused_list
.next
, struct fuse_req
, list
);
96 list_del_init(&req
->list
);
97 spin_unlock(&fuse_lock
);
98 fuse_request_init(req
);
99 req
->preallocated
= 1;
100 req
->in
.h
.uid
= current
->fsuid
;
101 req
->in
.h
.gid
= current
->fsgid
;
102 req
->in
.h
.pid
= current
->pid
;
106 /* This can return NULL, but only in case it's interrupted by a SIGKILL */
107 struct fuse_req
*fuse_get_request(struct fuse_conn
*fc
)
113 intr
= down_interruptible(&fc
->outstanding_sem
);
114 restore_sigs(&oldset
);
115 return intr
? NULL
: do_get_request(fc
);
118 static void fuse_putback_request(struct fuse_conn
*fc
, struct fuse_req
*req
)
120 spin_lock(&fuse_lock
);
121 if (req
->preallocated
)
122 list_add(&req
->list
, &fc
->unused_list
);
124 fuse_request_free(req
);
126 /* If we are in debt decrease that first */
127 if (fc
->outstanding_debt
)
128 fc
->outstanding_debt
--;
130 up(&fc
->outstanding_sem
);
131 spin_unlock(&fuse_lock
);
134 void fuse_put_request(struct fuse_conn
*fc
, struct fuse_req
*req
)
136 if (atomic_dec_and_test(&req
->count
))
137 fuse_putback_request(fc
, req
);
140 void fuse_release_background(struct fuse_req
*req
)
146 spin_lock(&fuse_lock
);
147 list_del(&req
->bg_entry
);
148 spin_unlock(&fuse_lock
);
152 * This function is called when a request is finished. Either a reply
153 * has arrived or it was interrupted (and not yet sent) or some error
154 * occurred during communication with userspace, or the device file was
155 * closed. It decreases the reference count for the request. In case
156 * of a background request the reference to the stored objects are
157 * released. The requester thread is woken up (if still waiting), and
158 * finally the request is either freed or put on the unused_list
160 * Called with fuse_lock, unlocks it
162 static void request_end(struct fuse_conn
*fc
, struct fuse_req
*req
)
166 putback
= atomic_dec_and_test(&req
->count
);
167 spin_unlock(&fuse_lock
);
168 if (req
->background
) {
169 down_read(&fc
->sbput_sem
);
171 fuse_release_background(req
);
172 up_read(&fc
->sbput_sem
);
174 wake_up(&req
->waitq
);
175 if (req
->in
.h
.opcode
== FUSE_INIT
) {
178 if (req
->misc
.init_in_out
.major
!= FUSE_KERNEL_VERSION
)
181 /* After INIT reply is received other requests can go
182 out. So do (FUSE_MAX_OUTSTANDING - 1) number of
183 up()s on outstanding_sem. The last up() is done in
184 fuse_putback_request() */
185 for (i
= 1; i
< FUSE_MAX_OUTSTANDING
; i
++)
186 up(&fc
->outstanding_sem
);
189 fuse_putback_request(fc
, req
);
193 * Unfortunately request interruption not just solves the deadlock
194 * problem, it causes problems too. These stem from the fact, that an
195 * interrupted request is continued to be processed in userspace,
196 * while all the locks and object references (inode and file) held
197 * during the operation are released.
199 * To release the locks is exactly why there's a need to interrupt the
200 * request, so there's not a lot that can be done about this, except
201 * introduce additional locking in userspace.
203 * More important is to keep inode and file references until userspace
204 * has replied, otherwise FORGET and RELEASE could be sent while the
205 * inode/file is still used by the filesystem.
207 * For this reason the concept of "background" request is introduced.
208 * An interrupted request is backgrounded if it has been already sent
209 * to userspace. Backgrounding involves getting an extra reference to
210 * inode(s) or file used in the request, and adding the request to
211 * fc->background list. When a reply is received for a background
212 * request, the object references are released, and the request is
213 * removed from the list. If the filesystem is unmounted while there
214 * are still background requests, the list is walked and references
215 * are released as if a reply was received.
217 * There's one more use for a background request. The RELEASE message is
218 * always sent as background, since it doesn't return an error or
221 static void background_request(struct fuse_conn
*fc
, struct fuse_req
*req
)
224 list_add(&req
->bg_entry
, &fc
->background
);
226 req
->inode
= igrab(req
->inode
);
228 req
->inode2
= igrab(req
->inode2
);
233 /* Called with fuse_lock held. Releases, and then reacquires it. */
234 static void request_wait_answer(struct fuse_conn
*fc
, struct fuse_req
*req
)
238 spin_unlock(&fuse_lock
);
240 wait_event_interruptible(req
->waitq
, req
->finished
);
241 restore_sigs(&oldset
);
242 spin_lock(&fuse_lock
);
246 req
->out
.h
.error
= -EINTR
;
247 req
->interrupted
= 1;
249 /* This is uninterruptible sleep, because data is
250 being copied to/from the buffers of req. During
251 locked state, there mustn't be any filesystem
252 operation (e.g. page fault), since that could lead
254 spin_unlock(&fuse_lock
);
255 wait_event(req
->waitq
, !req
->locked
);
256 spin_lock(&fuse_lock
);
258 if (!req
->sent
&& !list_empty(&req
->list
)) {
259 list_del(&req
->list
);
260 __fuse_put_request(req
);
261 } else if (!req
->finished
&& req
->sent
)
262 background_request(fc
, req
);
265 static unsigned len_args(unsigned numargs
, struct fuse_arg
*args
)
270 for (i
= 0; i
< numargs
; i
++)
271 nbytes
+= args
[i
].size
;
276 static void queue_request(struct fuse_conn
*fc
, struct fuse_req
*req
)
279 /* zero is special */
282 req
->in
.h
.unique
= fc
->reqctr
;
283 req
->in
.h
.len
= sizeof(struct fuse_in_header
) +
284 len_args(req
->in
.numargs
, (struct fuse_arg
*) req
->in
.args
);
285 if (!req
->preallocated
) {
286 /* If request is not preallocated (either FORGET or
287 RELEASE), then still decrease outstanding_sem, so
288 user can't open infinite number of files while not
289 processing the RELEASE requests. However for
290 efficiency do it without blocking, so if down()
291 would block, just increase the debt instead */
292 if (down_trylock(&fc
->outstanding_sem
))
293 fc
->outstanding_debt
++;
295 list_add_tail(&req
->list
, &fc
->pending
);
300 * This can only be interrupted by a SIGKILL
302 void request_send(struct fuse_conn
*fc
, struct fuse_req
*req
)
305 spin_lock(&fuse_lock
);
307 req
->out
.h
.error
= -ENOTCONN
;
308 else if (fc
->conn_error
)
309 req
->out
.h
.error
= -ECONNREFUSED
;
311 queue_request(fc
, req
);
312 /* acquire extra reference, since request is still needed
313 after request_end() */
314 __fuse_get_request(req
);
316 request_wait_answer(fc
, req
);
318 spin_unlock(&fuse_lock
);
321 static void request_send_nowait(struct fuse_conn
*fc
, struct fuse_req
*req
)
323 spin_lock(&fuse_lock
);
325 queue_request(fc
, req
);
326 spin_unlock(&fuse_lock
);
328 req
->out
.h
.error
= -ENOTCONN
;
329 request_end(fc
, req
);
333 void request_send_noreply(struct fuse_conn
*fc
, struct fuse_req
*req
)
336 request_send_nowait(fc
, req
);
339 void request_send_background(struct fuse_conn
*fc
, struct fuse_req
*req
)
342 spin_lock(&fuse_lock
);
343 background_request(fc
, req
);
344 spin_unlock(&fuse_lock
);
345 request_send_nowait(fc
, req
);
348 void fuse_send_init(struct fuse_conn
*fc
)
350 /* This is called from fuse_read_super() so there's guaranteed
351 to be a request available */
352 struct fuse_req
*req
= do_get_request(fc
);
353 struct fuse_init_in_out
*arg
= &req
->misc
.init_in_out
;
354 arg
->major
= FUSE_KERNEL_VERSION
;
355 arg
->minor
= FUSE_KERNEL_MINOR_VERSION
;
356 req
->in
.h
.opcode
= FUSE_INIT
;
358 req
->in
.args
[0].size
= sizeof(*arg
);
359 req
->in
.args
[0].value
= arg
;
360 req
->out
.numargs
= 1;
361 req
->out
.args
[0].size
= sizeof(*arg
);
362 req
->out
.args
[0].value
= arg
;
363 request_send_background(fc
, req
);
367 * Lock the request. Up to the next unlock_request() there mustn't be
368 * anything that could cause a page-fault. If the request was already
369 * interrupted bail out.
371 static inline int lock_request(struct fuse_req
*req
)
375 spin_lock(&fuse_lock
);
376 if (req
->interrupted
)
380 spin_unlock(&fuse_lock
);
386 * Unlock request. If it was interrupted during being locked, the
387 * requester thread is currently waiting for it to be unlocked, so
390 static inline void unlock_request(struct fuse_req
*req
)
393 spin_lock(&fuse_lock
);
395 if (req
->interrupted
)
396 wake_up(&req
->waitq
);
397 spin_unlock(&fuse_lock
);
401 struct fuse_copy_state
{
403 struct fuse_req
*req
;
404 const struct iovec
*iov
;
405 unsigned long nr_segs
;
406 unsigned long seglen
;
414 static void fuse_copy_init(struct fuse_copy_state
*cs
, int write
,
415 struct fuse_req
*req
, const struct iovec
*iov
,
416 unsigned long nr_segs
)
418 memset(cs
, 0, sizeof(*cs
));
422 cs
->nr_segs
= nr_segs
;
425 /* Unmap and put previous page of userspace buffer */
426 static inline void fuse_copy_finish(struct fuse_copy_state
*cs
)
429 kunmap_atomic(cs
->mapaddr
, KM_USER0
);
431 flush_dcache_page(cs
->pg
);
432 set_page_dirty_lock(cs
->pg
);
440 * Get another pagefull of userspace buffer, and map it to kernel
441 * address space, and lock request
443 static int fuse_copy_fill(struct fuse_copy_state
*cs
)
445 unsigned long offset
;
448 unlock_request(cs
->req
);
449 fuse_copy_finish(cs
);
451 BUG_ON(!cs
->nr_segs
);
452 cs
->seglen
= cs
->iov
[0].iov_len
;
453 cs
->addr
= (unsigned long) cs
->iov
[0].iov_base
;
457 down_read(¤t
->mm
->mmap_sem
);
458 err
= get_user_pages(current
, current
->mm
, cs
->addr
, 1, cs
->write
, 0,
460 up_read(¤t
->mm
->mmap_sem
);
464 offset
= cs
->addr
% PAGE_SIZE
;
465 cs
->mapaddr
= kmap_atomic(cs
->pg
, KM_USER0
);
466 cs
->buf
= cs
->mapaddr
+ offset
;
467 cs
->len
= min(PAGE_SIZE
- offset
, cs
->seglen
);
468 cs
->seglen
-= cs
->len
;
471 return lock_request(cs
->req
);
474 /* Do as much copy to/from userspace buffer as we can */
475 static inline int fuse_copy_do(struct fuse_copy_state
*cs
, void **val
,
478 unsigned ncpy
= min(*size
, cs
->len
);
481 memcpy(cs
->buf
, *val
, ncpy
);
483 memcpy(*val
, cs
->buf
, ncpy
);
493 * Copy a page in the request to/from the userspace buffer. Must be
496 static inline int fuse_copy_page(struct fuse_copy_state
*cs
, struct page
*page
,
497 unsigned offset
, unsigned count
, int zeroing
)
499 if (page
&& zeroing
&& count
< PAGE_SIZE
) {
500 void *mapaddr
= kmap_atomic(page
, KM_USER1
);
501 memset(mapaddr
, 0, PAGE_SIZE
);
502 kunmap_atomic(mapaddr
, KM_USER1
);
506 if (!cs
->len
&& (err
= fuse_copy_fill(cs
)))
509 void *mapaddr
= kmap_atomic(page
, KM_USER1
);
510 void *buf
= mapaddr
+ offset
;
511 offset
+= fuse_copy_do(cs
, &buf
, &count
);
512 kunmap_atomic(mapaddr
, KM_USER1
);
514 offset
+= fuse_copy_do(cs
, NULL
, &count
);
516 if (page
&& !cs
->write
)
517 flush_dcache_page(page
);
521 /* Copy pages in the request to/from userspace buffer */
522 static int fuse_copy_pages(struct fuse_copy_state
*cs
, unsigned nbytes
,
526 struct fuse_req
*req
= cs
->req
;
527 unsigned offset
= req
->page_offset
;
528 unsigned count
= min(nbytes
, (unsigned) PAGE_SIZE
- offset
);
530 for (i
= 0; i
< req
->num_pages
&& (nbytes
|| zeroing
); i
++) {
531 struct page
*page
= req
->pages
[i
];
532 int err
= fuse_copy_page(cs
, page
, offset
, count
, zeroing
);
537 count
= min(nbytes
, (unsigned) PAGE_SIZE
);
543 /* Copy a single argument in the request to/from userspace buffer */
544 static int fuse_copy_one(struct fuse_copy_state
*cs
, void *val
, unsigned size
)
548 if (!cs
->len
&& (err
= fuse_copy_fill(cs
)))
550 fuse_copy_do(cs
, &val
, &size
);
555 /* Copy request arguments to/from userspace buffer */
556 static int fuse_copy_args(struct fuse_copy_state
*cs
, unsigned numargs
,
557 unsigned argpages
, struct fuse_arg
*args
,
563 for (i
= 0; !err
&& i
< numargs
; i
++) {
564 struct fuse_arg
*arg
= &args
[i
];
565 if (i
== numargs
- 1 && argpages
)
566 err
= fuse_copy_pages(cs
, arg
->size
, zeroing
);
568 err
= fuse_copy_one(cs
, arg
->value
, arg
->size
);
573 /* Wait until a request is available on the pending list */
574 static void request_wait(struct fuse_conn
*fc
)
576 DECLARE_WAITQUEUE(wait
, current
);
578 add_wait_queue_exclusive(&fc
->waitq
, &wait
);
579 while (fc
->mounted
&& list_empty(&fc
->pending
)) {
580 set_current_state(TASK_INTERRUPTIBLE
);
581 if (signal_pending(current
))
584 spin_unlock(&fuse_lock
);
586 spin_lock(&fuse_lock
);
588 set_current_state(TASK_RUNNING
);
589 remove_wait_queue(&fc
->waitq
, &wait
);
593 * Read a single request into the userspace filesystem's buffer. This
594 * function waits until a request is available, then removes it from
595 * the pending list and copies request data to userspace buffer. If
596 * no reply is needed (FORGET) or request has been interrupted or
597 * there was an error during the copying then it's finished by calling
598 * request_end(). Otherwise add it to the processing list, and set
601 static ssize_t
fuse_dev_readv(struct file
*file
, const struct iovec
*iov
,
602 unsigned long nr_segs
, loff_t
*off
)
605 struct fuse_conn
*fc
;
606 struct fuse_req
*req
;
608 struct fuse_copy_state cs
;
611 spin_lock(&fuse_lock
);
612 fc
= file
->private_data
;
621 if (list_empty(&fc
->pending
))
624 req
= list_entry(fc
->pending
.next
, struct fuse_req
, list
);
625 list_del_init(&req
->list
);
626 spin_unlock(&fuse_lock
);
629 reqsize
= req
->in
.h
.len
;
630 fuse_copy_init(&cs
, 1, req
, iov
, nr_segs
);
632 if (iov_length(iov
, nr_segs
) >= reqsize
) {
633 err
= fuse_copy_one(&cs
, &in
->h
, sizeof(in
->h
));
635 err
= fuse_copy_args(&cs
, in
->numargs
, in
->argpages
,
636 (struct fuse_arg
*) in
->args
, 0);
638 fuse_copy_finish(&cs
);
640 spin_lock(&fuse_lock
);
642 if (!err
&& req
->interrupted
)
645 if (!req
->interrupted
)
646 req
->out
.h
.error
= -EIO
;
647 request_end(fc
, req
);
651 request_end(fc
, req
);
654 list_add_tail(&req
->list
, &fc
->processing
);
655 spin_unlock(&fuse_lock
);
660 spin_unlock(&fuse_lock
);
664 static ssize_t
fuse_dev_read(struct file
*file
, char __user
*buf
,
665 size_t nbytes
, loff_t
*off
)
668 iov
.iov_len
= nbytes
;
670 return fuse_dev_readv(file
, &iov
, 1, off
);
673 /* Look up request on processing list by unique ID */
674 static struct fuse_req
*request_find(struct fuse_conn
*fc
, u64 unique
)
676 struct list_head
*entry
;
678 list_for_each(entry
, &fc
->processing
) {
679 struct fuse_req
*req
;
680 req
= list_entry(entry
, struct fuse_req
, list
);
681 if (req
->in
.h
.unique
== unique
)
687 static int copy_out_args(struct fuse_copy_state
*cs
, struct fuse_out
*out
,
690 unsigned reqsize
= sizeof(struct fuse_out_header
);
693 return nbytes
!= reqsize
? -EINVAL
: 0;
695 reqsize
+= len_args(out
->numargs
, out
->args
);
697 if (reqsize
< nbytes
|| (reqsize
> nbytes
&& !out
->argvar
))
699 else if (reqsize
> nbytes
) {
700 struct fuse_arg
*lastarg
= &out
->args
[out
->numargs
-1];
701 unsigned diffsize
= reqsize
- nbytes
;
702 if (diffsize
> lastarg
->size
)
704 lastarg
->size
-= diffsize
;
706 return fuse_copy_args(cs
, out
->numargs
, out
->argpages
, out
->args
,
711 * Write a single reply to a request. First the header is copied from
712 * the write buffer. The request is then searched on the processing
713 * list by the unique ID found in the header. If found, then remove
714 * it from the list and copy the rest of the buffer to the request.
715 * The request is finished by calling request_end()
717 static ssize_t
fuse_dev_writev(struct file
*file
, const struct iovec
*iov
,
718 unsigned long nr_segs
, loff_t
*off
)
721 unsigned nbytes
= iov_length(iov
, nr_segs
);
722 struct fuse_req
*req
;
723 struct fuse_out_header oh
;
724 struct fuse_copy_state cs
;
725 struct fuse_conn
*fc
= fuse_get_conn(file
);
729 fuse_copy_init(&cs
, 0, NULL
, iov
, nr_segs
);
730 if (nbytes
< sizeof(struct fuse_out_header
))
733 err
= fuse_copy_one(&cs
, &oh
, sizeof(oh
));
737 if (!oh
.unique
|| oh
.error
<= -1000 || oh
.error
> 0 ||
741 spin_lock(&fuse_lock
);
742 req
= request_find(fc
, oh
.unique
);
747 list_del_init(&req
->list
);
748 if (req
->interrupted
) {
749 request_end(fc
, req
);
750 fuse_copy_finish(&cs
);
756 spin_unlock(&fuse_lock
);
758 err
= copy_out_args(&cs
, &req
->out
, nbytes
);
759 fuse_copy_finish(&cs
);
761 spin_lock(&fuse_lock
);
764 if (req
->interrupted
)
766 } else if (!req
->interrupted
)
767 req
->out
.h
.error
= -EIO
;
768 request_end(fc
, req
);
770 return err
? err
: nbytes
;
773 spin_unlock(&fuse_lock
);
775 fuse_copy_finish(&cs
);
779 static ssize_t
fuse_dev_write(struct file
*file
, const char __user
*buf
,
780 size_t nbytes
, loff_t
*off
)
783 iov
.iov_len
= nbytes
;
784 iov
.iov_base
= (char __user
*) buf
;
785 return fuse_dev_writev(file
, &iov
, 1, off
);
788 static unsigned fuse_dev_poll(struct file
*file
, poll_table
*wait
)
790 struct fuse_conn
*fc
= fuse_get_conn(file
);
791 unsigned mask
= POLLOUT
| POLLWRNORM
;
796 poll_wait(file
, &fc
->waitq
, wait
);
798 spin_lock(&fuse_lock
);
799 if (!list_empty(&fc
->pending
))
800 mask
|= POLLIN
| POLLRDNORM
;
801 spin_unlock(&fuse_lock
);
806 /* Abort all requests on the given list (pending or processing) */
807 static void end_requests(struct fuse_conn
*fc
, struct list_head
*head
)
809 while (!list_empty(head
)) {
810 struct fuse_req
*req
;
811 req
= list_entry(head
->next
, struct fuse_req
, list
);
812 list_del_init(&req
->list
);
813 req
->out
.h
.error
= -ECONNABORTED
;
814 request_end(fc
, req
);
815 spin_lock(&fuse_lock
);
819 static int fuse_dev_release(struct inode
*inode
, struct file
*file
)
821 struct fuse_conn
*fc
;
823 spin_lock(&fuse_lock
);
824 fc
= file
->private_data
;
827 end_requests(fc
, &fc
->pending
);
828 end_requests(fc
, &fc
->processing
);
829 fuse_release_conn(fc
);
831 spin_unlock(&fuse_lock
);
835 struct file_operations fuse_dev_operations
= {
836 .owner
= THIS_MODULE
,
838 .read
= fuse_dev_read
,
839 .readv
= fuse_dev_readv
,
840 .write
= fuse_dev_write
,
841 .writev
= fuse_dev_writev
,
842 .poll
= fuse_dev_poll
,
843 .release
= fuse_dev_release
,
846 static struct miscdevice fuse_miscdevice
= {
849 .fops
= &fuse_dev_operations
,
852 int __init
fuse_dev_init(void)
855 fuse_req_cachep
= kmem_cache_create("fuse_request",
856 sizeof(struct fuse_req
),
858 if (!fuse_req_cachep
)
861 err
= misc_register(&fuse_miscdevice
);
863 goto out_cache_clean
;
868 kmem_cache_destroy(fuse_req_cachep
);
873 void fuse_dev_cleanup(void)
875 misc_deregister(&fuse_miscdevice
);
876 kmem_cache_destroy(fuse_req_cachep
);