2 * Present a block device as a raw image through FUSE
4 * Copyright (c) 2020 Max Reitz <mreitz@redhat.com>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; under version 2 or later of the License.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 #define FUSE_USE_VERSION 31
21 #include "qemu/osdep.h"
22 #include "block/aio.h"
23 #include "block/block.h"
24 #include "block/export.h"
25 #include "block/fuse.h"
26 #include "block/qapi.h"
27 #include "qapi/error.h"
28 #include "qapi/qapi-commands-block.h"
29 #include "sysemu/block-backend.h"
32 #include <fuse_lowlevel.h>
38 /* Prevent overly long bounce buffer allocations */
39 #define FUSE_MAX_BOUNCE_BYTES (MIN(BDRV_REQUEST_MAX_BYTES, 64 * 1024 * 1024))
42 typedef struct FuseExport
{
45 struct fuse_session
*fuse_session
;
46 struct fuse_buf fuse_buf
;
47 bool mounted
, fd_handler_set_up
;
52 /* Whether allow_other was used as a mount option or not */
60 static GHashTable
*exports
;
61 static const struct fuse_lowlevel_ops fuse_ops
;
63 static void fuse_export_shutdown(BlockExport
*exp
);
64 static void fuse_export_delete(BlockExport
*exp
);
66 static void init_exports_table(void);
68 static int setup_fuse_export(FuseExport
*exp
, const char *mountpoint
,
69 bool allow_other
, Error
**errp
);
70 static void read_from_fuse_export(void *opaque
);
72 static bool is_regular_file(const char *path
, Error
**errp
);
75 static int fuse_export_create(BlockExport
*blk_exp
,
76 BlockExportOptions
*blk_exp_args
,
79 FuseExport
*exp
= container_of(blk_exp
, FuseExport
, common
);
80 BlockExportOptionsFuse
*args
= &blk_exp_args
->u
.fuse
;
83 assert(blk_exp_args
->type
== BLOCK_EXPORT_TYPE_FUSE
);
85 /* For growable exports, take the RESIZE permission */
87 uint64_t blk_perm
, blk_shared_perm
;
89 blk_get_perm(exp
->common
.blk
, &blk_perm
, &blk_shared_perm
);
91 ret
= blk_set_perm(exp
->common
.blk
, blk_perm
| BLK_PERM_RESIZE
,
92 blk_shared_perm
, errp
);
101 * It is important to do this check before calling is_regular_file() --
102 * that function will do a stat(), which we would have to handle if we
103 * already exported something on @mountpoint. But we cannot, because
104 * we are currently caught up here.
105 * (Note that ideally we would want to resolve relative paths here,
106 * but bdrv_make_absolute_filename() might do the wrong thing for
107 * paths that contain colons, and realpath() would resolve symlinks,
108 * which we do not want: The mount point is not going to be the
109 * symlink's destination, but the link itself.)
110 * So this will not catch all potential clashes, but hopefully at
111 * least the most common one of specifying exactly the same path
114 if (g_hash_table_contains(exports
, args
->mountpoint
)) {
115 error_setg(errp
, "There already is a FUSE export on '%s'",
121 if (!is_regular_file(args
->mountpoint
, errp
)) {
126 exp
->mountpoint
= g_strdup(args
->mountpoint
);
127 exp
->writable
= blk_exp_args
->writable
;
128 exp
->growable
= args
->growable
;
131 if (!args
->has_allow_other
) {
132 args
->allow_other
= FUSE_EXPORT_ALLOW_OTHER_AUTO
;
135 exp
->st_mode
= S_IFREG
| S_IRUSR
;
137 exp
->st_mode
|= S_IWUSR
;
139 exp
->st_uid
= getuid();
140 exp
->st_gid
= getgid();
142 if (args
->allow_other
== FUSE_EXPORT_ALLOW_OTHER_AUTO
) {
143 /* Ignore errors on our first attempt */
144 ret
= setup_fuse_export(exp
, args
->mountpoint
, true, NULL
);
145 exp
->allow_other
= ret
== 0;
147 ret
= setup_fuse_export(exp
, args
->mountpoint
, false, errp
);
150 exp
->allow_other
= args
->allow_other
== FUSE_EXPORT_ALLOW_OTHER_ON
;
151 ret
= setup_fuse_export(exp
, args
->mountpoint
, exp
->allow_other
, errp
);
160 fuse_export_delete(blk_exp
);
165 * Allocates the global @exports hash table.
167 static void init_exports_table(void)
173 exports
= g_hash_table_new_full(g_str_hash
, g_str_equal
, g_free
, NULL
);
177 * Create exp->fuse_session and mount it.
179 static int setup_fuse_export(FuseExport
*exp
, const char *mountpoint
,
180 bool allow_other
, Error
**errp
)
182 const char *fuse_argv
[4];
184 struct fuse_args fuse_args
;
188 * max_read needs to match what fuse_init() sets.
189 * max_write need not be supplied.
191 mount_opts
= g_strdup_printf("max_read=%zu,default_permissions%s",
192 FUSE_MAX_BOUNCE_BYTES
,
193 allow_other
? ",allow_other" : "");
195 fuse_argv
[0] = ""; /* Dummy program name */
197 fuse_argv
[2] = mount_opts
;
199 fuse_args
= (struct fuse_args
)FUSE_ARGS_INIT(3, (char **)fuse_argv
);
201 exp
->fuse_session
= fuse_session_new(&fuse_args
, &fuse_ops
,
202 sizeof(fuse_ops
), exp
);
204 if (!exp
->fuse_session
) {
205 error_setg(errp
, "Failed to set up FUSE session");
210 ret
= fuse_session_mount(exp
->fuse_session
, mountpoint
);
212 error_setg(errp
, "Failed to mount FUSE session to export");
218 g_hash_table_insert(exports
, g_strdup(mountpoint
), NULL
);
220 aio_set_fd_handler(exp
->common
.ctx
,
221 fuse_session_fd(exp
->fuse_session
), true,
222 read_from_fuse_export
, NULL
, NULL
, exp
);
223 exp
->fd_handler_set_up
= true;
228 fuse_export_shutdown(&exp
->common
);
233 * Callback to be invoked when the FUSE session FD can be read from.
234 * (This is basically the FUSE event loop.)
236 static void read_from_fuse_export(void *opaque
)
238 FuseExport
*exp
= opaque
;
241 blk_exp_ref(&exp
->common
);
244 ret
= fuse_session_receive_buf(exp
->fuse_session
, &exp
->fuse_buf
);
245 } while (ret
== -EINTR
);
250 fuse_session_process_buf(exp
->fuse_session
, &exp
->fuse_buf
);
253 blk_exp_unref(&exp
->common
);
256 static void fuse_export_shutdown(BlockExport
*blk_exp
)
258 FuseExport
*exp
= container_of(blk_exp
, FuseExport
, common
);
260 if (exp
->fuse_session
) {
261 fuse_session_exit(exp
->fuse_session
);
263 if (exp
->fd_handler_set_up
) {
264 aio_set_fd_handler(exp
->common
.ctx
,
265 fuse_session_fd(exp
->fuse_session
), true,
266 NULL
, NULL
, NULL
, NULL
);
267 exp
->fd_handler_set_up
= false;
271 if (exp
->mountpoint
) {
273 * Safe to drop now, because we will not handle any requests
274 * for this export anymore anyway.
276 g_hash_table_remove(exports
, exp
->mountpoint
);
280 static void fuse_export_delete(BlockExport
*blk_exp
)
282 FuseExport
*exp
= container_of(blk_exp
, FuseExport
, common
);
284 if (exp
->fuse_session
) {
286 fuse_session_unmount(exp
->fuse_session
);
289 fuse_session_destroy(exp
->fuse_session
);
292 free(exp
->fuse_buf
.mem
);
293 g_free(exp
->mountpoint
);
297 * Check whether @path points to a regular file. If not, put an
298 * appropriate message into *errp.
300 static bool is_regular_file(const char *path
, Error
**errp
)
305 ret
= stat(path
, &statbuf
);
307 error_setg_errno(errp
, errno
, "Failed to stat '%s'", path
);
311 if (!S_ISREG(statbuf
.st_mode
)) {
312 error_setg(errp
, "'%s' is not a regular file", path
);
320 * A chance to set change some parameters supplied to FUSE_INIT.
322 static void fuse_init(void *userdata
, struct fuse_conn_info
*conn
)
325 * MIN_NON_ZERO() would not be wrong here, but what we set here
326 * must equal what has been passed to fuse_session_new().
327 * Therefore, as long as max_read must be passed as a mount option
328 * (which libfuse claims will be changed at some point), we have
329 * to set max_read to a fixed value here.
331 conn
->max_read
= FUSE_MAX_BOUNCE_BYTES
;
333 conn
->max_write
= MIN_NON_ZERO(BDRV_REQUEST_MAX_BYTES
, conn
->max_write
);
337 * Let clients look up files. Always return ENOENT because we only
338 * care about the mountpoint itself.
340 static void fuse_lookup(fuse_req_t req
, fuse_ino_t parent
, const char *name
)
342 fuse_reply_err(req
, ENOENT
);
346 * Let clients get file attributes (i.e., stat() the file).
348 static void fuse_getattr(fuse_req_t req
, fuse_ino_t inode
,
349 struct fuse_file_info
*fi
)
352 int64_t length
, allocated_blocks
;
353 time_t now
= time(NULL
);
354 FuseExport
*exp
= fuse_req_userdata(req
);
356 length
= blk_getlength(exp
->common
.blk
);
358 fuse_reply_err(req
, -length
);
362 allocated_blocks
= bdrv_get_allocated_file_size(blk_bs(exp
->common
.blk
));
363 if (allocated_blocks
<= 0) {
364 allocated_blocks
= DIV_ROUND_UP(length
, 512);
366 allocated_blocks
= DIV_ROUND_UP(allocated_blocks
, 512);
369 statbuf
= (struct stat
) {
371 .st_mode
= exp
->st_mode
,
373 .st_uid
= exp
->st_uid
,
374 .st_gid
= exp
->st_gid
,
376 .st_blksize
= blk_bs(exp
->common
.blk
)->bl
.request_alignment
,
377 .st_blocks
= allocated_blocks
,
383 fuse_reply_attr(req
, &statbuf
, 1.);
386 static int fuse_do_truncate(const FuseExport
*exp
, int64_t size
,
387 bool req_zero_write
, PreallocMode prealloc
)
389 uint64_t blk_perm
, blk_shared_perm
;
390 BdrvRequestFlags truncate_flags
= 0;
393 if (req_zero_write
) {
394 truncate_flags
|= BDRV_REQ_ZERO_WRITE
;
397 /* Growable exports have a permanent RESIZE permission */
398 if (!exp
->growable
) {
399 blk_get_perm(exp
->common
.blk
, &blk_perm
, &blk_shared_perm
);
401 ret
= blk_set_perm(exp
->common
.blk
, blk_perm
| BLK_PERM_RESIZE
,
402 blk_shared_perm
, NULL
);
408 ret
= blk_truncate(exp
->common
.blk
, size
, true, prealloc
,
409 truncate_flags
, NULL
);
411 if (!exp
->growable
) {
412 /* Must succeed, because we are only giving up the RESIZE permission */
413 blk_set_perm(exp
->common
.blk
, blk_perm
, blk_shared_perm
, &error_abort
);
420 * Let clients set file attributes. Only resizing and changing
421 * permissions (st_mode, st_uid, st_gid) is allowed.
422 * Changing permissions is only allowed as far as it will actually
423 * permit access: Read-only exports cannot be given +w, and exports
424 * without allow_other cannot be given a different UID or GID, and
425 * they cannot be given non-owner access.
427 static void fuse_setattr(fuse_req_t req
, fuse_ino_t inode
, struct stat
*statbuf
,
428 int to_set
, struct fuse_file_info
*fi
)
430 FuseExport
*exp
= fuse_req_userdata(req
);
434 supported_attrs
= FUSE_SET_ATTR_SIZE
| FUSE_SET_ATTR_MODE
;
435 if (exp
->allow_other
) {
436 supported_attrs
|= FUSE_SET_ATTR_UID
| FUSE_SET_ATTR_GID
;
439 if (to_set
& ~supported_attrs
) {
440 fuse_reply_err(req
, ENOTSUP
);
444 /* Do some argument checks first before committing to anything */
445 if (to_set
& FUSE_SET_ATTR_MODE
) {
447 * Without allow_other, non-owners can never access the export, so do
448 * not allow setting permissions for them
450 if (!exp
->allow_other
&&
451 (statbuf
->st_mode
& (S_IRWXG
| S_IRWXO
)) != 0)
453 fuse_reply_err(req
, EPERM
);
457 /* +w for read-only exports makes no sense, disallow it */
458 if (!exp
->writable
&&
459 (statbuf
->st_mode
& (S_IWUSR
| S_IWGRP
| S_IWOTH
)) != 0)
461 fuse_reply_err(req
, EROFS
);
466 if (to_set
& FUSE_SET_ATTR_SIZE
) {
467 if (!exp
->writable
) {
468 fuse_reply_err(req
, EACCES
);
472 ret
= fuse_do_truncate(exp
, statbuf
->st_size
, true, PREALLOC_MODE_OFF
);
474 fuse_reply_err(req
, -ret
);
479 if (to_set
& FUSE_SET_ATTR_MODE
) {
480 /* Ignore FUSE-supplied file type, only change the mode */
481 exp
->st_mode
= (statbuf
->st_mode
& 07777) | S_IFREG
;
484 if (to_set
& FUSE_SET_ATTR_UID
) {
485 exp
->st_uid
= statbuf
->st_uid
;
488 if (to_set
& FUSE_SET_ATTR_GID
) {
489 exp
->st_gid
= statbuf
->st_gid
;
492 fuse_getattr(req
, inode
, fi
);
496 * Let clients open a file (i.e., the exported image).
498 static void fuse_open(fuse_req_t req
, fuse_ino_t inode
,
499 struct fuse_file_info
*fi
)
501 fuse_reply_open(req
, fi
);
505 * Handle client reads from the exported image.
507 static void fuse_read(fuse_req_t req
, fuse_ino_t inode
,
508 size_t size
, off_t offset
, struct fuse_file_info
*fi
)
510 FuseExport
*exp
= fuse_req_userdata(req
);
515 /* Limited by max_read, should not happen */
516 if (size
> FUSE_MAX_BOUNCE_BYTES
) {
517 fuse_reply_err(req
, EINVAL
);
522 * Clients will expect short reads at EOF, so we have to limit
523 * offset+size to the image length.
525 length
= blk_getlength(exp
->common
.blk
);
527 fuse_reply_err(req
, -length
);
531 if (offset
+ size
> length
) {
532 size
= length
- offset
;
535 buf
= qemu_try_blockalign(blk_bs(exp
->common
.blk
), size
);
537 fuse_reply_err(req
, ENOMEM
);
541 ret
= blk_pread(exp
->common
.blk
, offset
, buf
, size
);
543 fuse_reply_buf(req
, buf
, size
);
545 fuse_reply_err(req
, -ret
);
552 * Handle client writes to the exported image.
554 static void fuse_write(fuse_req_t req
, fuse_ino_t inode
, const char *buf
,
555 size_t size
, off_t offset
, struct fuse_file_info
*fi
)
557 FuseExport
*exp
= fuse_req_userdata(req
);
561 /* Limited by max_write, should not happen */
562 if (size
> BDRV_REQUEST_MAX_BYTES
) {
563 fuse_reply_err(req
, EINVAL
);
567 if (!exp
->writable
) {
568 fuse_reply_err(req
, EACCES
);
573 * Clients will expect short writes at EOF, so we have to limit
574 * offset+size to the image length.
576 length
= blk_getlength(exp
->common
.blk
);
578 fuse_reply_err(req
, -length
);
582 if (offset
+ size
> length
) {
584 ret
= fuse_do_truncate(exp
, offset
+ size
, true, PREALLOC_MODE_OFF
);
586 fuse_reply_err(req
, -ret
);
590 size
= length
- offset
;
594 ret
= blk_pwrite(exp
->common
.blk
, offset
, buf
, size
, 0);
596 fuse_reply_write(req
, size
);
598 fuse_reply_err(req
, -ret
);
603 * Let clients perform various fallocate() operations.
605 static void fuse_fallocate(fuse_req_t req
, fuse_ino_t inode
, int mode
,
606 off_t offset
, off_t length
,
607 struct fuse_file_info
*fi
)
609 FuseExport
*exp
= fuse_req_userdata(req
);
613 if (!exp
->writable
) {
614 fuse_reply_err(req
, EACCES
);
618 blk_len
= blk_getlength(exp
->common
.blk
);
620 fuse_reply_err(req
, -blk_len
);
624 if (mode
& FALLOC_FL_KEEP_SIZE
) {
625 length
= MIN(length
, blk_len
- offset
);
628 if (mode
& FALLOC_FL_PUNCH_HOLE
) {
629 if (!(mode
& FALLOC_FL_KEEP_SIZE
)) {
630 fuse_reply_err(req
, EINVAL
);
635 int size
= MIN(length
, BDRV_REQUEST_MAX_BYTES
);
637 ret
= blk_pdiscard(exp
->common
.blk
, offset
, size
);
640 } while (ret
== 0 && length
> 0);
642 #ifdef CONFIG_FALLOCATE_ZERO_RANGE
643 else if (mode
& FALLOC_FL_ZERO_RANGE
) {
644 if (!(mode
& FALLOC_FL_KEEP_SIZE
) && offset
+ length
> blk_len
) {
645 /* No need for zeroes, we are going to write them ourselves */
646 ret
= fuse_do_truncate(exp
, offset
+ length
, false,
649 fuse_reply_err(req
, -ret
);
655 int size
= MIN(length
, BDRV_REQUEST_MAX_BYTES
);
657 ret
= blk_pwrite_zeroes(exp
->common
.blk
,
661 } while (ret
== 0 && length
> 0);
663 #endif /* CONFIG_FALLOCATE_ZERO_RANGE */
665 /* We can only fallocate at the EOF with a truncate */
666 if (offset
< blk_len
) {
667 fuse_reply_err(req
, EOPNOTSUPP
);
671 if (offset
> blk_len
) {
672 /* No preallocation needed here */
673 ret
= fuse_do_truncate(exp
, offset
, true, PREALLOC_MODE_OFF
);
675 fuse_reply_err(req
, -ret
);
680 ret
= fuse_do_truncate(exp
, offset
+ length
, true,
681 PREALLOC_MODE_FALLOC
);
686 fuse_reply_err(req
, ret
< 0 ? -ret
: 0);
690 * Let clients fsync the exported image.
692 static void fuse_fsync(fuse_req_t req
, fuse_ino_t inode
, int datasync
,
693 struct fuse_file_info
*fi
)
695 FuseExport
*exp
= fuse_req_userdata(req
);
698 ret
= blk_flush(exp
->common
.blk
);
699 fuse_reply_err(req
, ret
< 0 ? -ret
: 0);
703 * Called before an FD to the exported image is closed. (libfuse
704 * notes this to be a way to return last-minute errors.)
706 static void fuse_flush(fuse_req_t req
, fuse_ino_t inode
,
707 struct fuse_file_info
*fi
)
709 fuse_fsync(req
, inode
, 1, fi
);
712 #ifdef CONFIG_FUSE_LSEEK
714 * Let clients inquire allocation status.
716 static void fuse_lseek(fuse_req_t req
, fuse_ino_t inode
, off_t offset
,
717 int whence
, struct fuse_file_info
*fi
)
719 FuseExport
*exp
= fuse_req_userdata(req
);
721 if (whence
!= SEEK_HOLE
&& whence
!= SEEK_DATA
) {
722 fuse_reply_err(req
, EINVAL
);
730 ret
= bdrv_block_status_above(blk_bs(exp
->common
.blk
), NULL
,
731 offset
, INT64_MAX
, &pnum
, NULL
, NULL
);
733 fuse_reply_err(req
, -ret
);
737 if (!pnum
&& (ret
& BDRV_BLOCK_EOF
)) {
741 * If blk_getlength() rounds (e.g. by sectors), then the
742 * export length will be rounded, too. However,
743 * bdrv_block_status_above() may return EOF at unaligned
744 * offsets. We must not let this become visible and thus
745 * always simulate a hole between @offset (the real EOF)
746 * and @blk_len (the client-visible EOF).
749 blk_len
= blk_getlength(exp
->common
.blk
);
751 fuse_reply_err(req
, -blk_len
);
755 if (offset
> blk_len
|| whence
== SEEK_DATA
) {
756 fuse_reply_err(req
, ENXIO
);
758 fuse_reply_lseek(req
, offset
);
763 if (ret
& BDRV_BLOCK_DATA
) {
764 if (whence
== SEEK_DATA
) {
765 fuse_reply_lseek(req
, offset
);
769 if (whence
== SEEK_HOLE
) {
770 fuse_reply_lseek(req
, offset
);
775 /* Safety check against infinite loops */
777 fuse_reply_err(req
, ENXIO
);
786 static const struct fuse_lowlevel_ops fuse_ops
= {
788 .lookup
= fuse_lookup
,
789 .getattr
= fuse_getattr
,
790 .setattr
= fuse_setattr
,
794 .fallocate
= fuse_fallocate
,
797 #ifdef CONFIG_FUSE_LSEEK
802 const BlockExportDriver blk_exp_fuse
= {
803 .type
= BLOCK_EXPORT_TYPE_FUSE
,
804 .instance_size
= sizeof(FuseExport
),
805 .create
= fuse_export_create
,
806 .delete = fuse_export_delete
,
807 .request_shutdown
= fuse_export_shutdown
,