cuse.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * CUSE: Character device in Userspace
  4. *
  5. * Copyright (C) 2008-2009 SUSE Linux Products GmbH
  6. * Copyright (C) 2008-2009 Tejun Heo <tj@kernel.org>
  7. *
  8. * CUSE enables character devices to be implemented from userland much
  9. * like FUSE allows filesystems. On initialization /dev/cuse is
  10. * created. By opening the file and replying to the CUSE_INIT request
  11. * userland CUSE server can create a character device. After that the
  12. * operation is very similar to FUSE.
  13. *
  14. * A CUSE instance involves the following objects.
  15. *
  16. * cuse_conn : contains fuse_conn and serves as bonding structure
  17. * channel : file handle connected to the userland CUSE server
  18. * cdev : the implemented character device
  19. * dev : generic device for cdev
  20. *
  21. * Note that 'channel' is what 'dev' is in FUSE. As CUSE deals with
  22. * devices, it's called 'channel' to reduce confusion.
  23. *
  24. * channel determines when the character device dies. When channel is
  25. * closed, everything begins to destruct. The cuse_conn is taken off
  26. * the lookup table preventing further access from cdev, cdev and
  27. * generic device are removed and the base reference of cuse_conn is
  28. * put.
  29. *
  30. * On each open, the matching cuse_conn is looked up and if found an
  31. * additional reference is taken which is released when the file is
  32. * closed.
  33. */
  34. #define pr_fmt(fmt) "CUSE: " fmt
  35. #include <linux/fuse.h>
  36. #include <linux/cdev.h>
  37. #include <linux/device.h>
  38. #include <linux/file.h>
  39. #include <linux/fs.h>
  40. #include <linux/kdev_t.h>
  41. #include <linux/kthread.h>
  42. #include <linux/list.h>
  43. #include <linux/magic.h>
  44. #include <linux/miscdevice.h>
  45. #include <linux/mutex.h>
  46. #include <linux/slab.h>
  47. #include <linux/stat.h>
  48. #include <linux/module.h>
  49. #include <linux/uio.h>
  50. #include <linux/user_namespace.h>
  51. #include "fuse_i.h"
  52. #define CUSE_CONNTBL_LEN 64
  53. struct cuse_conn {
  54. struct list_head list; /* linked on cuse_conntbl */
  55. struct fuse_mount fm; /* Dummy mount referencing fc */
  56. struct fuse_conn fc; /* fuse connection */
  57. struct cdev *cdev; /* associated character device */
  58. struct device *dev; /* device representing @cdev */
  59. /* init parameters, set once during initialization */
  60. bool unrestricted_ioctl;
  61. };
  62. static DEFINE_MUTEX(cuse_lock); /* protects registration */
  63. static struct list_head cuse_conntbl[CUSE_CONNTBL_LEN];
  64. static struct class *cuse_class;
  65. static struct cuse_conn *fc_to_cc(struct fuse_conn *fc)
  66. {
  67. return container_of(fc, struct cuse_conn, fc);
  68. }
  69. static struct list_head *cuse_conntbl_head(dev_t devt)
  70. {
  71. return &cuse_conntbl[(MAJOR(devt) + MINOR(devt)) % CUSE_CONNTBL_LEN];
  72. }
  73. /**************************************************************************
  74. * CUSE frontend operations
  75. *
  76. * These are file operations for the character device.
  77. *
  78. * On open, CUSE opens a file from the FUSE mnt and stores it to
  79. * private_data of the open file. All other ops call FUSE ops on the
  80. * FUSE file.
  81. */
  82. static ssize_t cuse_read_iter(struct kiocb *kiocb, struct iov_iter *to)
  83. {
  84. struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb);
  85. loff_t pos = 0;
  86. return fuse_direct_io(&io, to, &pos, FUSE_DIO_CUSE);
  87. }
  88. static ssize_t cuse_write_iter(struct kiocb *kiocb, struct iov_iter *from)
  89. {
  90. struct fuse_io_priv io = FUSE_IO_PRIV_SYNC(kiocb);
  91. loff_t pos = 0;
  92. /*
  93. * No locking or generic_write_checks(), the server is
  94. * responsible for locking and sanity checks.
  95. */
  96. return fuse_direct_io(&io, from, &pos,
  97. FUSE_DIO_WRITE | FUSE_DIO_CUSE);
  98. }
  99. static int cuse_open(struct inode *inode, struct file *file)
  100. {
  101. dev_t devt = inode->i_cdev->dev;
  102. struct cuse_conn *cc = NULL, *pos;
  103. int rc;
  104. /* look up and get the connection */
  105. mutex_lock(&cuse_lock);
  106. list_for_each_entry(pos, cuse_conntbl_head(devt), list)
  107. if (pos->dev->devt == devt) {
  108. fuse_conn_get(&pos->fc);
  109. cc = pos;
  110. break;
  111. }
  112. mutex_unlock(&cuse_lock);
  113. /* dead? */
  114. if (!cc)
  115. return -ENODEV;
  116. /*
  117. * Generic permission check is already done against the chrdev
  118. * file, proceed to open.
  119. */
  120. rc = fuse_do_open(&cc->fm, 0, file, 0);
  121. if (rc)
  122. fuse_conn_put(&cc->fc);
  123. return rc;
  124. }
  125. static int cuse_release(struct inode *inode, struct file *file)
  126. {
  127. struct fuse_file *ff = file->private_data;
  128. struct fuse_mount *fm = ff->fm;
  129. fuse_sync_release(NULL, ff, file->f_flags);
  130. fuse_conn_put(fm->fc);
  131. return 0;
  132. }
  133. static long cuse_file_ioctl(struct file *file, unsigned int cmd,
  134. unsigned long arg)
  135. {
  136. struct fuse_file *ff = file->private_data;
  137. struct cuse_conn *cc = fc_to_cc(ff->fm->fc);
  138. unsigned int flags = 0;
  139. if (cc->unrestricted_ioctl)
  140. flags |= FUSE_IOCTL_UNRESTRICTED;
  141. return fuse_do_ioctl(file, cmd, arg, flags);
  142. }
  143. static long cuse_file_compat_ioctl(struct file *file, unsigned int cmd,
  144. unsigned long arg)
  145. {
  146. struct fuse_file *ff = file->private_data;
  147. struct cuse_conn *cc = fc_to_cc(ff->fm->fc);
  148. unsigned int flags = FUSE_IOCTL_COMPAT;
  149. if (cc->unrestricted_ioctl)
  150. flags |= FUSE_IOCTL_UNRESTRICTED;
  151. return fuse_do_ioctl(file, cmd, arg, flags);
  152. }
  153. static const struct file_operations cuse_frontend_fops = {
  154. .owner = THIS_MODULE,
  155. .read_iter = cuse_read_iter,
  156. .write_iter = cuse_write_iter,
  157. .open = cuse_open,
  158. .release = cuse_release,
  159. .unlocked_ioctl = cuse_file_ioctl,
  160. .compat_ioctl = cuse_file_compat_ioctl,
  161. .poll = fuse_file_poll,
  162. .llseek = noop_llseek,
  163. };
  164. /**************************************************************************
  165. * CUSE channel initialization and destruction
  166. */
  167. struct cuse_devinfo {
  168. const char *name;
  169. };
  170. /**
  171. * cuse_parse_one - parse one key=value pair
  172. * @pp: i/o parameter for the current position
  173. * @end: points to one past the end of the packed string
  174. * @keyp: out parameter for key
  175. * @valp: out parameter for value
  176. *
  177. * *@pp points to packed strings - "key0=val0\0key1=val1\0" which ends
  178. * at @end - 1. This function parses one pair and set *@keyp to the
  179. * start of the key and *@valp to the start of the value. Note that
  180. * the original string is modified such that the key string is
  181. * terminated with '\0'. *@pp is updated to point to the next string.
  182. *
  183. * RETURNS:
  184. * 1 on successful parse, 0 on EOF, -errno on failure.
  185. */
  186. static int cuse_parse_one(char **pp, char *end, char **keyp, char **valp)
  187. {
  188. char *p = *pp;
  189. char *key, *val;
  190. while (p < end && *p == '\0')
  191. p++;
  192. if (p == end)
  193. return 0;
  194. if (end[-1] != '\0') {
  195. pr_err("info not properly terminated\n");
  196. return -EINVAL;
  197. }
  198. key = val = p;
  199. p += strlen(p);
  200. if (valp) {
  201. strsep(&val, "=");
  202. if (!val)
  203. val = key + strlen(key);
  204. key = strstrip(key);
  205. val = strstrip(val);
  206. } else
  207. key = strstrip(key);
  208. if (!strlen(key)) {
  209. pr_err("zero length info key specified\n");
  210. return -EINVAL;
  211. }
  212. *pp = p;
  213. *keyp = key;
  214. if (valp)
  215. *valp = val;
  216. return 1;
  217. }
  218. /**
  219. * cuse_parse_dev_info - parse device info
  220. * @p: device info string
  221. * @len: length of device info string
  222. * @devinfo: out parameter for parsed device info
  223. *
  224. * Parse @p to extract device info and store it into @devinfo. String
  225. * pointed to by @p is modified by parsing and @devinfo points into
  226. * them, so @p shouldn't be freed while @devinfo is in use.
  227. *
  228. * RETURNS:
  229. * 0 on success, -errno on failure.
  230. */
  231. static int cuse_parse_devinfo(char *p, size_t len, struct cuse_devinfo *devinfo)
  232. {
  233. char *end = p + len;
  234. char *key, *val;
  235. int rc;
  236. while (true) {
  237. rc = cuse_parse_one(&p, end, &key, &val);
  238. if (rc < 0)
  239. return rc;
  240. if (!rc)
  241. break;
  242. if (strcmp(key, "DEVNAME") == 0)
  243. devinfo->name = val;
  244. else
  245. pr_warn("unknown device info \"%s\"\n", key);
  246. }
  247. if (!devinfo->name || !strlen(devinfo->name)) {
  248. pr_err("DEVNAME unspecified\n");
  249. return -EINVAL;
  250. }
  251. return 0;
  252. }
  253. static void cuse_gendev_release(struct device *dev)
  254. {
  255. kfree(dev);
  256. }
  257. struct cuse_init_args {
  258. struct fuse_args_pages ap;
  259. struct cuse_init_in in;
  260. struct cuse_init_out out;
  261. struct page *page;
  262. struct fuse_page_desc desc;
  263. };
  264. /**
  265. * cuse_process_init_reply - finish initializing CUSE channel
  266. *
  267. * This function creates the character device and sets up all the
  268. * required data structures for it. Please read the comment at the
  269. * top of this file for high level overview.
  270. */
  271. static void cuse_process_init_reply(struct fuse_mount *fm,
  272. struct fuse_args *args, int error)
  273. {
  274. struct fuse_conn *fc = fm->fc;
  275. struct cuse_init_args *ia = container_of(args, typeof(*ia), ap.args);
  276. struct fuse_args_pages *ap = &ia->ap;
  277. struct cuse_conn *cc = fc_to_cc(fc), *pos;
  278. struct cuse_init_out *arg = &ia->out;
  279. struct page *page = ap->pages[0];
  280. struct cuse_devinfo devinfo = { };
  281. struct device *dev;
  282. struct cdev *cdev;
  283. dev_t devt;
  284. int rc, i;
  285. if (error || arg->major != FUSE_KERNEL_VERSION || arg->minor < 11)
  286. goto err;
  287. fc->minor = arg->minor;
  288. fc->max_read = max_t(unsigned, arg->max_read, 4096);
  289. fc->max_write = max_t(unsigned, arg->max_write, 4096);
  290. /* parse init reply */
  291. cc->unrestricted_ioctl = arg->flags & CUSE_UNRESTRICTED_IOCTL;
  292. rc = cuse_parse_devinfo(page_address(page), ap->args.out_args[1].size,
  293. &devinfo);
  294. if (rc)
  295. goto err;
  296. /* determine and reserve devt */
  297. devt = MKDEV(arg->dev_major, arg->dev_minor);
  298. if (!MAJOR(devt))
  299. rc = alloc_chrdev_region(&devt, MINOR(devt), 1, devinfo.name);
  300. else
  301. rc = register_chrdev_region(devt, 1, devinfo.name);
  302. if (rc) {
  303. pr_err("failed to register chrdev region\n");
  304. goto err;
  305. }
  306. /* devt determined, create device */
  307. rc = -ENOMEM;
  308. dev = kzalloc(sizeof(*dev), GFP_KERNEL);
  309. if (!dev)
  310. goto err_region;
  311. device_initialize(dev);
  312. dev_set_uevent_suppress(dev, 1);
  313. dev->class = cuse_class;
  314. dev->devt = devt;
  315. dev->release = cuse_gendev_release;
  316. dev_set_drvdata(dev, cc);
  317. dev_set_name(dev, "%s", devinfo.name);
  318. mutex_lock(&cuse_lock);
  319. /* make sure the device-name is unique */
  320. for (i = 0; i < CUSE_CONNTBL_LEN; ++i) {
  321. list_for_each_entry(pos, &cuse_conntbl[i], list)
  322. if (!strcmp(dev_name(pos->dev), dev_name(dev)))
  323. goto err_unlock;
  324. }
  325. rc = device_add(dev);
  326. if (rc)
  327. goto err_unlock;
  328. /* register cdev */
  329. rc = -ENOMEM;
  330. cdev = cdev_alloc();
  331. if (!cdev)
  332. goto err_unlock;
  333. cdev->owner = THIS_MODULE;
  334. cdev->ops = &cuse_frontend_fops;
  335. rc = cdev_add(cdev, devt, 1);
  336. if (rc)
  337. goto err_cdev;
  338. cc->dev = dev;
  339. cc->cdev = cdev;
  340. /* make the device available */
  341. list_add(&cc->list, cuse_conntbl_head(devt));
  342. mutex_unlock(&cuse_lock);
  343. /* announce device availability */
  344. dev_set_uevent_suppress(dev, 0);
  345. kobject_uevent(&dev->kobj, KOBJ_ADD);
  346. out:
  347. kfree(ia);
  348. __free_page(page);
  349. return;
  350. err_cdev:
  351. cdev_del(cdev);
  352. err_unlock:
  353. mutex_unlock(&cuse_lock);
  354. put_device(dev);
  355. err_region:
  356. unregister_chrdev_region(devt, 1);
  357. err:
  358. fuse_abort_conn(fc);
  359. goto out;
  360. }
  361. static int cuse_send_init(struct cuse_conn *cc)
  362. {
  363. int rc;
  364. struct page *page;
  365. struct fuse_mount *fm = &cc->fm;
  366. struct cuse_init_args *ia;
  367. struct fuse_args_pages *ap;
  368. BUILD_BUG_ON(CUSE_INIT_INFO_MAX > PAGE_SIZE);
  369. rc = -ENOMEM;
  370. page = alloc_page(GFP_KERNEL | __GFP_ZERO);
  371. if (!page)
  372. goto err;
  373. ia = kzalloc(sizeof(*ia), GFP_KERNEL);
  374. if (!ia)
  375. goto err_free_page;
  376. ap = &ia->ap;
  377. ia->in.major = FUSE_KERNEL_VERSION;
  378. ia->in.minor = FUSE_KERNEL_MINOR_VERSION;
  379. ia->in.flags |= CUSE_UNRESTRICTED_IOCTL;
  380. ap->args.opcode = CUSE_INIT;
  381. ap->args.in_numargs = 1;
  382. ap->args.in_args[0].size = sizeof(ia->in);
  383. ap->args.in_args[0].value = &ia->in;
  384. ap->args.out_numargs = 2;
  385. ap->args.out_args[0].size = sizeof(ia->out);
  386. ap->args.out_args[0].value = &ia->out;
  387. ap->args.out_args[1].size = CUSE_INIT_INFO_MAX;
  388. ap->args.out_argvar = true;
  389. ap->args.out_pages = true;
  390. ap->num_pages = 1;
  391. ap->pages = &ia->page;
  392. ap->descs = &ia->desc;
  393. ia->page = page;
  394. ia->desc.length = ap->args.out_args[1].size;
  395. ap->args.end = cuse_process_init_reply;
  396. rc = fuse_simple_background(fm, &ap->args, GFP_KERNEL);
  397. if (rc) {
  398. kfree(ia);
  399. err_free_page:
  400. __free_page(page);
  401. }
  402. err:
  403. return rc;
  404. }
  405. static void cuse_fc_release(struct fuse_conn *fc)
  406. {
  407. struct cuse_conn *cc = fc_to_cc(fc);
  408. kfree_rcu(cc, fc.rcu);
  409. }
  410. /**
  411. * cuse_channel_open - open method for /dev/cuse
  412. * @inode: inode for /dev/cuse
  413. * @file: file struct being opened
  414. *
  415. * Userland CUSE server can create a CUSE device by opening /dev/cuse
  416. * and replying to the initialization request kernel sends. This
  417. * function is responsible for handling CUSE device initialization.
  418. * Because the fd opened by this function is used during
  419. * initialization, this function only creates cuse_conn and sends
  420. * init. The rest is delegated to a kthread.
  421. *
  422. * RETURNS:
  423. * 0 on success, -errno on failure.
  424. */
  425. static int cuse_channel_open(struct inode *inode, struct file *file)
  426. {
  427. struct fuse_dev *fud;
  428. struct cuse_conn *cc;
  429. int rc;
  430. /* set up cuse_conn */
  431. cc = kzalloc(sizeof(*cc), GFP_KERNEL);
  432. if (!cc)
  433. return -ENOMEM;
  434. /*
  435. * Limit the cuse channel to requests that can
  436. * be represented in file->f_cred->user_ns.
  437. */
  438. fuse_conn_init(&cc->fc, &cc->fm, file->f_cred->user_ns,
  439. &fuse_dev_fiq_ops, NULL);
  440. fud = fuse_dev_alloc_install(&cc->fc);
  441. if (!fud) {
  442. kfree(cc);
  443. return -ENOMEM;
  444. }
  445. INIT_LIST_HEAD(&cc->list);
  446. cc->fc.release = cuse_fc_release;
  447. cc->fc.initialized = 1;
  448. rc = cuse_send_init(cc);
  449. if (rc) {
  450. fuse_dev_free(fud);
  451. fuse_conn_put(&cc->fc);
  452. return rc;
  453. }
  454. file->private_data = fud;
  455. return 0;
  456. }
  457. /**
  458. * cuse_channel_release - release method for /dev/cuse
  459. * @inode: inode for /dev/cuse
  460. * @file: file struct being closed
  461. *
  462. * Disconnect the channel, deregister CUSE device and initiate
  463. * destruction by putting the default reference.
  464. *
  465. * RETURNS:
  466. * 0 on success, -errno on failure.
  467. */
  468. static int cuse_channel_release(struct inode *inode, struct file *file)
  469. {
  470. struct fuse_dev *fud = file->private_data;
  471. struct cuse_conn *cc = fc_to_cc(fud->fc);
  472. int rc;
  473. /* remove from the conntbl, no more access from this point on */
  474. mutex_lock(&cuse_lock);
  475. list_del_init(&cc->list);
  476. mutex_unlock(&cuse_lock);
  477. /* remove device */
  478. if (cc->dev)
  479. device_unregister(cc->dev);
  480. if (cc->cdev) {
  481. unregister_chrdev_region(cc->cdev->dev, 1);
  482. cdev_del(cc->cdev);
  483. }
  484. /* Base reference is now owned by "fud" */
  485. fuse_conn_put(&cc->fc);
  486. rc = fuse_dev_release(inode, file); /* puts the base reference */
  487. return rc;
  488. }
  489. static struct file_operations cuse_channel_fops; /* initialized during init */
  490. /**************************************************************************
  491. * Misc stuff and module initializatiion
  492. *
  493. * CUSE exports the same set of attributes to sysfs as fusectl.
  494. */
  495. static ssize_t cuse_class_waiting_show(struct device *dev,
  496. struct device_attribute *attr, char *buf)
  497. {
  498. struct cuse_conn *cc = dev_get_drvdata(dev);
  499. return sprintf(buf, "%d\n", atomic_read(&cc->fc.num_waiting));
  500. }
  501. static DEVICE_ATTR(waiting, 0400, cuse_class_waiting_show, NULL);
  502. static ssize_t cuse_class_abort_store(struct device *dev,
  503. struct device_attribute *attr,
  504. const char *buf, size_t count)
  505. {
  506. struct cuse_conn *cc = dev_get_drvdata(dev);
  507. fuse_abort_conn(&cc->fc);
  508. return count;
  509. }
  510. static DEVICE_ATTR(abort, 0200, NULL, cuse_class_abort_store);
  511. static struct attribute *cuse_class_dev_attrs[] = {
  512. &dev_attr_waiting.attr,
  513. &dev_attr_abort.attr,
  514. NULL,
  515. };
  516. ATTRIBUTE_GROUPS(cuse_class_dev);
  517. static struct miscdevice cuse_miscdev = {
  518. .minor = CUSE_MINOR,
  519. .name = "cuse",
  520. .fops = &cuse_channel_fops,
  521. };
  522. MODULE_ALIAS_MISCDEV(CUSE_MINOR);
  523. MODULE_ALIAS("devname:cuse");
  524. static int __init cuse_init(void)
  525. {
  526. int i, rc;
  527. /* init conntbl */
  528. for (i = 0; i < CUSE_CONNTBL_LEN; i++)
  529. INIT_LIST_HEAD(&cuse_conntbl[i]);
  530. /* inherit and extend fuse_dev_operations */
  531. cuse_channel_fops = fuse_dev_operations;
  532. cuse_channel_fops.owner = THIS_MODULE;
  533. cuse_channel_fops.open = cuse_channel_open;
  534. cuse_channel_fops.release = cuse_channel_release;
  535. /* CUSE is not prepared for FUSE_DEV_IOC_CLONE */
  536. cuse_channel_fops.unlocked_ioctl = NULL;
  537. cuse_class = class_create(THIS_MODULE, "cuse");
  538. if (IS_ERR(cuse_class))
  539. return PTR_ERR(cuse_class);
  540. cuse_class->dev_groups = cuse_class_dev_groups;
  541. rc = misc_register(&cuse_miscdev);
  542. if (rc) {
  543. class_destroy(cuse_class);
  544. return rc;
  545. }
  546. return 0;
  547. }
  548. static void __exit cuse_exit(void)
  549. {
  550. misc_deregister(&cuse_miscdev);
  551. class_destroy(cuse_class);
  552. }
  553. module_init(cuse_init);
  554. module_exit(cuse_exit);
  555. MODULE_AUTHOR("Tejun Heo <tj@kernel.org>");
  556. MODULE_DESCRIPTION("Character device in Userspace");
  557. MODULE_LICENSE("GPL");