fs/fuse/dev.c

   1 /*
   2   FUSE: Filesystem in Userspace
   3   Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
   4
   5   This program can be distributed under the terms of the GNU GPL.
   6   See the file COPYING.
   7 */
   8
   9 #include "fuse_i.h"
  10
  11 #include <linux/init.h>
  12 #include <linux/module.h>
  13 #include <linux/poll.h>
  14 #include <linux/uio.h>
  15 #include <linux/miscdevice.h>
  16 #include <linux/pagemap.h>
  17 #include <linux/file.h>
  18 #include <linux/slab.h>
  19 #include <linux/pipe_fs_i.h>
  20 #include <linux/swap.h>
  21 #include <linux/splice.h>
  22
  23 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
  24 MODULE_ALIAS("devname:fuse");
  25
  26 static struct kmem_cache *fuse_req_cachep;
  27
  28 static struct fuse_conn *fuse_get_conn(struct file *file)
  29 {
  30         /*
  31          * Lockless access is OK, because file->private data is set
  32          * once during mount and is valid until the file is released.
  33          */
  34         return file->private_data;
  35 }
  36
  37 static void fuse_request_init(struct fuse_req *req, struct page **pages,
  38                               struct fuse_page_desc *page_descs,
  39                               unsigned npages)
  40 {
  41         memset(req, 0, sizeof(*req));
  42         memset(pages, 0, sizeof(*pages) * npages);
  43         memset(page_descs, 0, sizeof(*page_descs) * npages);
  44         INIT_LIST_HEAD(&req->list);
  45         INIT_LIST_HEAD(&req->intr_entry);
  46         init_waitqueue_head(&req->waitq);
  47         atomic_set(&req->count, 1);
  48         req->pages = pages;
  49         req->page_descs = page_descs;
  50         req->max_pages = npages;
  51 }
  52
  53 static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
  54 {
  55         struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
  56         if (req) {
  57                 struct page **pages;
  58                 struct fuse_page_desc *page_descs;
  59
  60                 if (npages <= FUSE_REQ_INLINE_PAGES) {
  61                         pages = req->inline_pages;
  62                         page_descs = req->inline_page_descs;
  63                 } else {
  64                         pages = kmalloc(sizeof(struct page *) * npages, flags);
  65                         page_descs = kmalloc(sizeof(struct fuse_page_desc) *
  66                                              npages, flags);
  67                 }
  68
  69                 if (!pages || !page_descs) {
  70                         kfree(pages);
  71                         kfree(page_descs);
  72                         kmem_cache_free(fuse_req_cachep, req);
  73                         return NULL;
  74                 }
  75
  76                 fuse_request_init(req, pages, page_descs, npages);
  77         }
  78         return req;
  79 }
  80
  81 struct fuse_req *fuse_request_alloc(unsigned npages)
  82 {
  83         return __fuse_request_alloc(npages, GFP_KERNEL);
  84 }
  85 EXPORT_SYMBOL_GPL(fuse_request_alloc);
  86
  87 struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
  88 {
  89         return __fuse_request_alloc(npages, GFP_NOFS);
  90 }
  91
  92 void fuse_request_free(struct fuse_req *req)
  93 {
  94         if (req->pages != req->inline_pages) {
  95                 kfree(req->pages);
  96                 kfree(req->page_descs);
  97         }
  98         kmem_cache_free(fuse_req_cachep, req);
  99 }
 100
 101 static void block_sigs(sigset_t *oldset)
 102 {
 103         sigset_t mask;
 104
 105         siginitsetinv(&mask, sigmask(SIGKILL));
 106         sigprocmask(SIG_BLOCK, &mask, oldset);
 107 }
 108
 109 static void restore_sigs(sigset_t *oldset)
 110 {
 111         sigprocmask(SIG_SETMASK, oldset, NULL);
 112 }
 113
 114 static void __fuse_get_request(struct fuse_req *req)
 115 {
 116         atomic_inc(&req->count);
 117 }
 118
 119 /* Must be called with > 1 refcount */
 120 static void __fuse_put_request(struct fuse_req *req)
 121 {
 122         BUG_ON(atomic_read(&req->count) < 2);
 123         atomic_dec(&req->count);
 124 }
 125
 126 static void fuse_req_init_context(struct fuse_req *req)
 127 {
 128         req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
 129         req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
 130         req->in.h.pid = current->pid;
 131 }
 132
 133 static bool fuse_block_alloc(struct fuse_conn *fc, bool for_background)
 134 {
 135         return !fc->initialized || (for_background && fc->blocked);
 136 }
 137
 138 static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages,
 139                                        bool for_background)
 140 {
 141         struct fuse_req *req;
 142         int err;
 143         atomic_inc(&fc->num_waiting);
 144
 145         if (fuse_block_alloc(fc, for_background)) {
 146                 sigset_t oldset;
 147                 int intr;
 148
 149                 block_sigs(&oldset);
 150                 intr = wait_event_interruptible_exclusive(fc->blocked_waitq,
 151                                 !fuse_block_alloc(fc, for_background));
 152                 restore_sigs(&oldset);
 153                 err = -EINTR;
 154                 if (intr)
 155                         goto out;
 156         }
 157
 158         err = -ENOTCONN;
 159         if (!fc->connected)
 160                 goto out;
 161
 162         req = fuse_request_alloc(npages);
 163         err = -ENOMEM;
 164         if (!req) {
 165                 if (for_background)
 166                         wake_up(&fc->blocked_waitq);
 167                 goto out;
 168         }
 169
 170         fuse_req_init_context(req);
 171         req->waiting = 1;
 172         req->background = for_background;
 173         return req;
 174
 175  out:
 176         atomic_dec(&fc->num_waiting);
 177         return ERR_PTR(err);
 178 }
 179
 180 struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
 181 {
 182         return __fuse_get_req(fc, npages, false);
 183 }
 184 EXPORT_SYMBOL_GPL(fuse_get_req);
 185
 186 struct fuse_req *fuse_get_req_for_background(struct fuse_conn *fc,
 187                                              unsigned npages)
 188 {
 189         return __fuse_get_req(fc, npages, true);
 190 }
 191 EXPORT_SYMBOL_GPL(fuse_get_req_for_background);
 192
 193 /*
 194  * Return request in fuse_file->reserved_req.  However that may
 195  * currently be in use.  If that is the case, wait for it to become
 196  * available.
 197  */
 198 static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
 199                                          struct file *file)
 200 {
 201         struct fuse_req *req = NULL;
 202         struct fuse_file *ff = file->private_data;
 203
 204         do {
 205                 wait_event(fc->reserved_req_waitq, ff->reserved_req);
 206                 spin_lock(&fc->lock);
 207                 if (ff->reserved_req) {
 208                         req = ff->reserved_req;
 209                         ff->reserved_req = NULL;
 210                         req->stolen_file = get_file(file);
 211                 }
 212                 spin_unlock(&fc->lock);
 213         } while (!req);
 214
 215         return req;
 216 }
 217
 218 /*
 219  * Put stolen request back into fuse_file->reserved_req
 220  */
 221 static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
 222 {
 223         struct file *file = req->stolen_file;
 224         struct fuse_file *ff = file->private_data;
 225
 226         spin_lock(&fc->lock);
 227         fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
 228         BUG_ON(ff->reserved_req);
 229         ff->reserved_req = req;
 230         wake_up_all(&fc->reserved_req_waitq);
 231         spin_unlock(&fc->lock);
 232         fput(file);
 233 }
 234
 235 /*
 236  * Gets a requests for a file operation, always succeeds
 237  *
 238  * This is used for sending the FLUSH request, which must get to
 239  * userspace, due to POSIX locks which may need to be unlocked.
 240  *
 241  * If allocation fails due to OOM, use the reserved request in
 242  * fuse_file.
 243  *
 244  * This is very unlikely to deadlock accidentally, since the
 245  * filesystem should not have it's own file open.  If deadlock is
 246  * intentional, it can still be broken by "aborting" the filesystem.
 247  */
 248 struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
 249                                              struct file *file)
 250 {
 251         struct fuse_req *req;
 252
 253         atomic_inc(&fc->num_waiting);
 254         wait_event(fc->blocked_waitq, fc->initialized);
 255         req = fuse_request_alloc(0);
 256         if (!req)
 257                 req = get_reserved_req(fc, file);
 258
 259         fuse_req_init_context(req);
 260         req->waiting = 1;
 261         req->background = 0;
 262         return req;
 263 }
 264
 265 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 266 {
 267         if (atomic_dec_and_test(&req->count)) {
 268                 if (unlikely(req->background)) {
 269                         /*
 270                          * We get here in the unlikely case that a background
 271                          * request was allocated but not sent
 272                          */
 273                         spin_lock(&fc->lock);
 274                         if (!fc->blocked)
 275                                 wake_up(&fc->blocked_waitq);
 276                         spin_unlock(&fc->lock);
 277                 }
 278
 279                 if (req->waiting)
 280                         atomic_dec(&fc->num_waiting);
 281
 282                 if (req->stolen_file)
 283                         put_reserved_req(fc, req);
 284                 else
 285                         fuse_request_free(req);
 286         }
 287 }
 288 EXPORT_SYMBOL_GPL(fuse_put_request);
 289
 290 static unsigned len_args(unsigned numargs, struct fuse_arg *args)
 291 {
 292         unsigned nbytes = 0;
 293         unsigned i;
 294
 295         for (i = 0; i < numargs; i++)
 296                 nbytes += args[i].size;
 297
 298         return nbytes;
 299 }
 300
 301 static u64 fuse_get_unique(struct fuse_conn *fc)
 302 {
 303         fc->reqctr++;
 304         /* zero is special */
 305         if (fc->reqctr == 0)
 306                 fc->reqctr = 1;
 307
 308         return fc->reqctr;
 309 }
 310
 311 static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
 312 {
 313         req->in.h.len = sizeof(struct fuse_in_header) +
 314                 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
 315         list_add_tail(&req->list, &fc->pending);
 316         req->state = FUSE_REQ_PENDING;
 317         if (!req->waiting) {
 318                 req->waiting = 1;
 319                 atomic_inc(&fc->num_waiting);
 320         }
 321         wake_up(&fc->waitq);
 322         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 323 }
 324
 325 void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
 326                        u64 nodeid, u64 nlookup)
 327 {
 328         forget->forget_one.nodeid = nodeid;
 329         forget->forget_one.nlookup = nlookup;
 330
 331         spin_lock(&fc->lock);
 332         if (fc->connected) {
 333                 fc->forget_list_tail->next = forget;
 334                 fc->forget_list_tail = forget;
 335                 wake_up(&fc->waitq);
 336                 kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 337         } else {
 338                 kfree(forget);
 339         }
 340         spin_unlock(&fc->lock);
 341 }
 342
 343 static void flush_bg_queue(struct fuse_conn *fc)
 344 {
 345         while (fc->active_background < fc->max_background &&
 346                !list_empty(&fc->bg_queue)) {
 347                 struct fuse_req *req;
 348
 349                 req = list_entry(fc->bg_queue.next, struct fuse_req, list);
 350                 list_del(&req->list);
 351                 fc->active_background++;
 352                 req->in.h.unique = fuse_get_unique(fc);
 353                 queue_request(fc, req);
 354         }
 355 }
 356
 357 /*
 358  * This function is called when a request is finished.  Either a reply
 359  * has arrived or it was aborted (and not yet sent) or some error
 360  * occurred during communication with userspace, or the device file
 361  * was closed.  The requester thread is woken up (if still waiting),
 362  * the 'end' callback is called if given, else the reference to the
 363  * request is released
 364  *
 365  * Called with fc->lock, unlocks it
 366  */
 367 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 368 __releases(fc->lock)
 369 {
 370         void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
 371         req->end = NULL;
 372         list_del(&req->list);
 373         list_del(&req->intr_entry);
 374         req->state = FUSE_REQ_FINISHED;
 375         if (req->background) {
 376                 req->background = 0;
 377
 378                 if (fc->num_background == fc->max_background)
 379                         fc->blocked = 0;
 380
 381                 /* Wake up next waiter, if any */
 382                 if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
 383                         wake_up(&fc->blocked_waitq);
 384
 385                 if (fc->num_background == fc->congestion_threshold &&
 386                     fc->connected && fc->bdi_initialized) {
 387                         clear_bdi_congested(&fc->bdi, BLK_RW_SYNC);
 388                         clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
 389                 }
 390                 fc->num_background--;
 391                 fc->active_background--;
 392                 flush_bg_queue(fc);
 393         }
 394         spin_unlock(&fc->lock);
 395         wake_up(&req->waitq);
 396         if (end)
 397                 end(fc, req);
 398         fuse_put_request(fc, req);
 399 }
 400
 401 static void wait_answer_interruptible(struct fuse_conn *fc,
 402                                       struct fuse_req *req)
 403 __releases(fc->lock)
 404 __acquires(fc->lock)
 405 {
 406         if (signal_pending(current))
 407                 return;
 408
 409         spin_unlock(&fc->lock);
 410         wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
 411         spin_lock(&fc->lock);
 412 }
 413
 414 static void queue_interrupt(struct fuse_conn *fc, struct fuse_req *req)
 415 {
 416         list_add_tail(&req->intr_entry, &fc->interrupts);
 417         wake_up(&fc->waitq);
 418         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 419 }
 420
 421 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 422 __releases(fc->lock)
 423 __acquires(fc->lock)
 424 {
 425         if (!fc->no_interrupt) {
 426                 /* Any signal may interrupt this */
 427                 wait_answer_interruptible(fc, req);
 428
 429                 if (req->aborted)
 430                         goto aborted;
 431                 if (req->state == FUSE_REQ_FINISHED)
 432                         return;
 433
 434                 req->interrupted = 1;
 435                 if (req->state == FUSE_REQ_SENT)
 436                         queue_interrupt(fc, req);
 437         }
 438
 439         if (!req->force) {
 440                 sigset_t oldset;
 441
 442                 /* Only fatal signals may interrupt this */
 443                 block_sigs(&oldset);
 444                 wait_answer_interruptible(fc, req);
 445                 restore_sigs(&oldset);
 446
 447                 if (req->aborted)
 448                         goto aborted;
 449                 if (req->state == FUSE_REQ_FINISHED)
 450                         return;
 451
 452                 /* Request is not yet in userspace, bail out */
 453                 if (req->state == FUSE_REQ_PENDING) {
 454                         list_del(&req->list);
 455                         __fuse_put_request(req);
 456                         req->out.h.error = -EINTR;
 457                         return;
 458                 }
 459         }
 460
 461         /*
 462          * Either request is already in userspace, or it was forced.
 463          * Wait it out.
 464          */
 465         spin_unlock(&fc->lock);
 466         wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);
 467         spin_lock(&fc->lock);
 468
 469         if (!req->aborted)
 470                 return;
 471
 472  aborted:
 473         BUG_ON(req->state != FUSE_REQ_FINISHED);
 474         if (req->locked) {
 475                 /* This is uninterruptible sleep, because data is
 476                    being copied to/from the buffers of req.  During
 477                    locked state, there mustn't be any filesystem
 478                    operation (e.g. page fault), since that could lead
 479                    to deadlock */
 480                 spin_unlock(&fc->lock);
 481                 wait_event(req->waitq, !req->locked);
 482                 spin_lock(&fc->lock);
 483         }
 484 }
 485
 486 static void __fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
 487 {
 488         BUG_ON(req->background);
 489         spin_lock(&fc->lock);
 490         if (!fc->connected)
 491                 req->out.h.error = -ENOTCONN;
 492         else if (fc->conn_error)
 493                 req->out.h.error = -ECONNREFUSED;
 494         else {
 495                 req->in.h.unique = fuse_get_unique(fc);
 496                 queue_request(fc, req);
 497                 /* acquire extra reference, since request is still needed
 498                    after request_end() */
 499                 __fuse_get_request(req);
 500
 501                 request_wait_answer(fc, req);
 502         }
 503         spin_unlock(&fc->lock);
 504 }
 505
 506 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
 507 {
 508         req->isreply = 1;
 509         __fuse_request_send(fc, req);
 510 }
 511 EXPORT_SYMBOL_GPL(fuse_request_send);
 512
 513 static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
 514                                             struct fuse_req *req)
 515 {
 516         BUG_ON(!req->background);
 517         fc->num_background++;
 518         if (fc->num_background == fc->max_background)
 519                 fc->blocked = 1;
 520         if (fc->num_background == fc->congestion_threshold &&
 521             fc->bdi_initialized) {
 522                 set_bdi_congested(&fc->bdi, BLK_RW_SYNC);
 523                 set_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
 524         }
 525         list_add_tail(&req->list, &fc->bg_queue);
 526         flush_bg_queue(fc);
 527 }
 528
 529 static void fuse_request_send_nowait(struct fuse_conn *fc, struct fuse_req *req)
 530 {
 531         spin_lock(&fc->lock);
 532         if (fc->connected) {
 533                 fuse_request_send_nowait_locked(fc, req);
 534                 spin_unlock(&fc->lock);
 535         } else {
 536                 req->out.h.error = -ENOTCONN;
 537                 request_end(fc, req);
 538         }
 539 }
 540
 541 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
 542 {
 543         req->isreply = 1;
 544         fuse_request_send_nowait(fc, req);
 545 }
 546 EXPORT_SYMBOL_GPL(fuse_request_send_background);
 547
 548 static int fuse_request_send_notify_reply(struct fuse_conn *fc,
 549                                           struct fuse_req *req, u64 unique)
 550 {
 551         int err = -ENODEV;
 552
 553         req->isreply = 0;
 554         req->in.h.unique = unique;
 555         spin_lock(&fc->lock);
 556         if (fc->connected) {
 557                 queue_request(fc, req);
 558                 err = 0;
 559         }
 560         spin_unlock(&fc->lock);
 561
 562         return err;
 563 }
 564
 565 /*
 566  * Called under fc->lock
 567  *
 568  * fc->connected must have been checked previously
 569  */
 570 void fuse_request_send_background_locked(struct fuse_conn *fc,
 571                                          struct fuse_req *req)
 572 {
 573         req->isreply = 1;
 574         fuse_request_send_nowait_locked(fc, req);
 575 }
 576
 577 void fuse_force_forget(struct file *file, u64 nodeid)
 578 {
 579         struct inode *inode = file_inode(file);
 580         struct fuse_conn *fc = get_fuse_conn(inode);
 581         struct fuse_req *req;
 582         struct fuse_forget_in inarg;
 583
 584         memset(&inarg, 0, sizeof(inarg));
 585         inarg.nlookup = 1;
 586         req = fuse_get_req_nofail_nopages(fc, file);
 587         req->in.h.opcode = FUSE_FORGET;
 588         req->in.h.nodeid = nodeid;
 589         req->in.numargs = 1;
 590         req->in.args[0].size = sizeof(inarg);
 591         req->in.args[0].value = &inarg;
 592         req->isreply = 0;
 593         __fuse_request_send(fc, req);
 594         /* ignore errors */
 595         fuse_put_request(fc, req);
 596 }
 597
 598 /*
 599  * Lock the request.  Up to the next unlock_request() there mustn't be
 600  * anything that could cause a page-fault.  If the request was already
 601  * aborted bail out.
 602  */
 603 static int lock_request(struct fuse_conn *fc, struct fuse_req *req)
 604 {
 605         int err = 0;
 606         if (req) {
 607                 spin_lock(&fc->lock);
 608                 if (req->aborted)
 609                         err = -ENOENT;
 610                 else
 611                         req->locked = 1;
 612                 spin_unlock(&fc->lock);
 613         }
 614         return err;
 615 }
 616
 617 /*
 618  * Unlock request.  If it was aborted during being locked, the
 619  * requester thread is currently waiting for it to be unlocked, so
 620  * wake it up.
 621  */
 622 static void unlock_request(struct fuse_conn *fc, struct fuse_req *req)
 623 {
 624         if (req) {
 625                 spin_lock(&fc->lock);
 626                 req->locked = 0;
 627                 if (req->aborted)
 628                         wake_up(&req->waitq);
 629                 spin_unlock(&fc->lock);
 630         }
 631 }
 632
 633 struct fuse_copy_state {
 634         struct fuse_conn *fc;
 635         int write;
 636         struct fuse_req *req;
 637         const struct iovec *iov;
 638         struct pipe_buffer *pipebufs;
 639         struct pipe_buffer *currbuf;
 640         struct pipe_inode_info *pipe;
 641         unsigned long nr_segs;
 642         unsigned long seglen;
 643         unsigned long addr;
 644         struct page *pg;
 645         void *mapaddr;
 646         void *buf;
 647         unsigned len;
 648         unsigned move_pages:1;
 649 };
 650
 651 static void fuse_copy_init(struct fuse_copy_state *cs, struct fuse_conn *fc,
 652                            int write,
 653                            const struct iovec *iov, unsigned long nr_segs)
 654 {
 655         memset(cs, 0, sizeof(*cs));
 656         cs->fc = fc;
 657         cs->write = write;
 658         cs->iov = iov;
 659         cs->nr_segs = nr_segs;
 660 }
 661
 662 /* Unmap and put previous page of userspace buffer */
 663 static void fuse_copy_finish(struct fuse_copy_state *cs)
 664 {
 665         if (cs->currbuf) {
 666                 struct pipe_buffer *buf = cs->currbuf;
 667
 668                 if (!cs->write) {
 669                         buf->ops->unmap(cs->pipe, buf, cs->mapaddr);
 670                 } else {
 671                         kunmap(buf->page);
 672                         buf->len = PAGE_SIZE - cs->len;
 673                 }
 674                 cs->currbuf = NULL;
 675                 cs->mapaddr = NULL;
 676         } else if (cs->mapaddr) {
 677                 kunmap(cs->pg);
 678                 if (cs->write) {
 679                         flush_dcache_page(cs->pg);
 680                         set_page_dirty_lock(cs->pg);
 681                 }
 682                 put_page(cs->pg);
 683                 cs->mapaddr = NULL;
 684         }
 685 }
 686
 687 /*
 688  * Get another pagefull of userspace buffer, and map it to kernel
 689  * address space, and lock request
 690  */
 691 static int fuse_copy_fill(struct fuse_copy_state *cs)
 692 {
 693         unsigned long offset;
 694         int err;
 695
 696         unlock_request(cs->fc, cs->req);
 697         fuse_copy_finish(cs);
 698         if (cs->pipebufs) {
 699                 struct pipe_buffer *buf = cs->pipebufs;
 700
 701                 if (!cs->write) {
 702                         err = buf->ops->confirm(cs->pipe, buf);
 703                         if (err)
 704                                 return err;
 705
 706                         BUG_ON(!cs->nr_segs);
 707                         cs->currbuf = buf;
 708                         cs->mapaddr = buf->ops->map(cs->pipe, buf, 0);
 709                         cs->len = buf->len;
 710                         cs->buf = cs->mapaddr + buf->offset;
 711                         cs->pipebufs++;
 712                         cs->nr_segs--;
 713                 } else {
 714                         struct page *page;
 715
 716                         if (cs->nr_segs == cs->pipe->buffers)
 717                                 return -EIO;
 718
 719                         page = alloc_page(GFP_HIGHUSER);
 720                         if (!page)
 721                                 return -ENOMEM;
 722
 723                         buf->page = page;
 724                         buf->offset = 0;
 725                         buf->len = 0;
 726
 727                         cs->currbuf = buf;
 728                         cs->mapaddr = kmap(page);
 729                         cs->buf = cs->mapaddr;
 730                         cs->len = PAGE_SIZE;
 731                         cs->pipebufs++;
 732                         cs->nr_segs++;
 733                 }
 734         } else {
 735                 if (!cs->seglen) {
 736                         BUG_ON(!cs->nr_segs);
 737                         cs->seglen = cs->iov[0].iov_len;
 738                         cs->addr = (unsigned long) cs->iov[0].iov_base;
 739                         cs->iov++;
 740                         cs->nr_segs--;
 741                 }
 742                 err = get_user_pages_fast(cs->addr, 1, cs->write, &cs->pg);
 743                 if (err < 0)
 744                         return err;
 745                 BUG_ON(err != 1);
 746                 offset = cs->addr % PAGE_SIZE;
 747                 cs->mapaddr = kmap(cs->pg);
 748                 cs->buf = cs->mapaddr + offset;
 749                 cs->len = min(PAGE_SIZE - offset, cs->seglen);
 750                 cs->seglen -= cs->len;
 751                 cs->addr += cs->len;
 752         }
 753
 754         return lock_request(cs->fc, cs->req);
 755 }
 756
 757 /* Do as much copy to/from userspace buffer as we can */
 758 static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
 759 {
 760         unsigned ncpy = min(*size, cs->len);
 761         if (val) {
 762                 if (cs->write)
 763                         memcpy(cs->buf, *val, ncpy);
 764                 else
 765                         memcpy(*val, cs->buf, ncpy);
 766                 *val += ncpy;
 767         }
 768         *size -= ncpy;
 769         cs->len -= ncpy;
 770         cs->buf += ncpy;
 771         return ncpy;
 772 }
 773
 774 static int fuse_check_page(struct page *page)
 775 {
 776         if (page_mapcount(page) ||
 777             page->mapping != NULL ||
 778             page_count(page) != 1 ||
 779             (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
 780              ~(1 << PG_locked |
 781                1 << PG_referenced |
 782                1 << PG_uptodate |
 783                1 << PG_lru |
 784                1 << PG_active |
 785                1 << PG_reclaim))) {
 786                 printk(KERN_WARNING "fuse: trying to steal weird page\n");
 787                 printk(KERN_WARNING "  page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
 788                 return 1;
 789         }
 790         return 0;
 791 }
 792
 793 static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
 794 {
 795         int err;
 796         struct page *oldpage = *pagep;
 797         struct page *newpage;
 798         struct pipe_buffer *buf = cs->pipebufs;
 799
 800         unlock_request(cs->fc, cs->req);
 801         fuse_copy_finish(cs);
 802
 803         err = buf->ops->confirm(cs->pipe, buf);
 804         if (err)
 805                 return err;
 806
 807         BUG_ON(!cs->nr_segs);
 808         cs->currbuf = buf;
 809         cs->len = buf->len;
 810         cs->pipebufs++;
 811         cs->nr_segs--;
 812
 813         if (cs->len != PAGE_SIZE)
 814                 goto out_fallback;
 815
 816         if (buf->ops->steal(cs->pipe, buf) != 0)
 817                 goto out_fallback;
 818
 819         newpage = buf->page;
 820
 821         if (WARN_ON(!PageUptodate(newpage)))
 822                 return -EIO;
 823
 824         ClearPageMappedToDisk(newpage);
 825
 826         if (fuse_check_page(newpage) != 0)
 827                 goto out_fallback_unlock;
 828
 829         /*
 830          * This is a new and locked page, it shouldn't be mapped or
 831          * have any special flags on it
 832          */
 833         if (WARN_ON(page_mapped(oldpage)))
 834                 goto out_fallback_unlock;
 835         if (WARN_ON(page_has_private(oldpage)))
 836                 goto out_fallback_unlock;
 837         if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
 838                 goto out_fallback_unlock;
 839         if (WARN_ON(PageMlocked(oldpage)))
 840                 goto out_fallback_unlock;
 841
 842         err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
 843         if (err) {
 844                 unlock_page(newpage);
 845                 return err;
 846         }
 847
 848         page_cache_get(newpage);
 849
 850         if (!(buf->flags & PIPE_BUF_FLAG_LRU))
 851                 lru_cache_add_file(newpage);
 852
 853         err = 0;
 854         spin_lock(&cs->fc->lock);
 855         if (cs->req->aborted)
 856                 err = -ENOENT;
 857         else
 858                 *pagep = newpage;
 859         spin_unlock(&cs->fc->lock);
 860
 861         if (err) {
 862                 unlock_page(newpage);
 863                 page_cache_release(newpage);
 864                 return err;
 865         }
 866
 867         unlock_page(oldpage);
 868         page_cache_release(oldpage);
 869         cs->len = 0;
 870
 871         return 0;
 872
 873 out_fallback_unlock:
 874         unlock_page(newpage);
 875 out_fallback:
 876         cs->mapaddr = buf->ops->map(cs->pipe, buf, 1);
 877         cs->buf = cs->mapaddr + buf->offset;
 878
 879         err = lock_request(cs->fc, cs->req);
 880         if (err)
 881                 return err;
 882
 883         return 1;
 884 }
 885
 886 static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
 887                          unsigned offset, unsigned count)
 888 {
 889         struct pipe_buffer *buf;
 890
 891         if (cs->nr_segs == cs->pipe->buffers)
 892                 return -EIO;
 893
 894         unlock_request(cs->fc, cs->req);
 895         fuse_copy_finish(cs);
 896
 897         buf = cs->pipebufs;
 898         page_cache_get(page);
 899         buf->page = page;
 900         buf->offset = offset;
 901         buf->len = count;
 902
 903         cs->pipebufs++;
 904         cs->nr_segs++;
 905         cs->len = 0;
 906
 907         return 0;
 908 }
 909
 910 /*
 911  * Copy a page in the request to/from the userspace buffer.  Must be
 912  * done atomically
 913  */
 914 static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
 915                           unsigned offset, unsigned count, int zeroing)
 916 {
 917         int err;
 918         struct page *page = *pagep;
 919
 920         if (page && zeroing && count < PAGE_SIZE)
 921                 clear_highpage(page);
 922
 923         while (count) {
 924                 if (cs->write && cs->pipebufs && page) {
 925                         return fuse_ref_page(cs, page, offset, count);
 926                 } else if (!cs->len) {
 927                         if (cs->move_pages && page &&
 928                             offset == 0 && count == PAGE_SIZE) {
 929                                 err = fuse_try_move_page(cs, pagep);
 930                                 if (err <= 0)
 931                                         return err;
 932                         } else {
 933                                 err = fuse_copy_fill(cs);
 934                                 if (err)
 935                                         return err;
 936                         }
 937                 }
 938                 if (page) {
 939                         void *mapaddr = kmap_atomic(page);
 940                         void *buf = mapaddr + offset;
 941                         offset += fuse_copy_do(cs, &buf, &count);
 942                         kunmap_atomic(mapaddr);
 943                 } else
 944                         offset += fuse_copy_do(cs, NULL, &count);
 945         }
 946         if (page && !cs->write)
 947                 flush_dcache_page(page);
 948         return 0;
 949 }
 950
 951 /* Copy pages in the request to/from userspace buffer */
 952 static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
 953                            int zeroing)
 954 {
 955         unsigned i;
 956         struct fuse_req *req = cs->req;
 957
 958         for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
 959                 int err;
 960                 unsigned offset = req->page_descs[i].offset;
 961                 unsigned count = min(nbytes, req->page_descs[i].length);
 962
 963                 err = fuse_copy_page(cs, &req->pages[i], offset, count,
 964                                      zeroing);
 965                 if (err)
 966                         return err;
 967
 968                 nbytes -= count;
 969         }
 970         return 0;
 971 }
 972
 973 /* Copy a single argument in the request to/from userspace buffer */
 974 static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
 975 {
 976         while (size) {
 977                 if (!cs->len) {
 978                         int err = fuse_copy_fill(cs);
 979                         if (err)
 980                                 return err;
 981                 }
 982                 fuse_copy_do(cs, &val, &size);
 983         }
 984         return 0;
 985 }
 986
 987 /* Copy request arguments to/from userspace buffer */
 988 static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
 989                           unsigned argpages, struct fuse_arg *args,
 990                           int zeroing)
 991 {
 992         int err = 0;
 993         unsigned i;
 994
 995         for (i = 0; !err && i < numargs; i++)  {
 996                 struct fuse_arg *arg = &args[i];
 997                 if (i == numargs - 1 && argpages)
 998                         err = fuse_copy_pages(cs, arg->size, zeroing);
 999                 else
1000                         err = fuse_copy_one(cs, arg->value, arg->size);
1001         }
1002         return err;
1003 }
1004
1005 static int forget_pending(struct fuse_conn *fc)
1006 {
1007         return fc->forget_list_head.next != NULL;
1008 }
1009
1010 static int request_pending(struct fuse_conn *fc)
1011 {
1012         return !list_empty(&fc->pending) || !list_empty(&fc->interrupts) ||
1013                 forget_pending(fc);
1014 }
1015
1016 /* Wait until a request is available on the pending list */
1017 static void request_wait(struct fuse_conn *fc)
1018 __releases(fc->lock)
1019 __acquires(fc->lock)
1020 {
1021         DECLARE_WAITQUEUE(wait, current);
1022
1023         add_wait_queue_exclusive(&fc->waitq, &wait);
1024         while (fc->connected && !request_pending(fc)) {
1025                 set_current_state(TASK_INTERRUPTIBLE);
1026                 if (signal_pending(current))
1027                         break;
1028
1029                 spin_unlock(&fc->lock);
1030                 schedule();
1031                 spin_lock(&fc->lock);
1032         }
1033         set_current_state(TASK_RUNNING);
1034         remove_wait_queue(&fc->waitq, &wait);
1035 }
1036
1037 /*
1038  * Transfer an interrupt request to userspace
1039  *
1040  * Unlike other requests this is assembled on demand, without a need
1041  * to allocate a separate fuse_req structure.
1042  *
1043  * Called with fc->lock held, releases it
1044  */
1045 static int fuse_read_interrupt(struct fuse_conn *fc, struct fuse_copy_state *cs,
1046                                size_t nbytes, struct fuse_req *req)
1047 __releases(fc->lock)
1048 {
1049         struct fuse_in_header ih;
1050         struct fuse_interrupt_in arg;
1051         unsigned reqsize = sizeof(ih) + sizeof(arg);
1052         int err;
1053
1054         list_del_init(&req->intr_entry);
1055         req->intr_unique = fuse_get_unique(fc);
1056         memset(&ih, 0, sizeof(ih));
1057         memset(&arg, 0, sizeof(arg));
1058         ih.len = reqsize;
1059         ih.opcode = FUSE_INTERRUPT;
1060         ih.unique = req->intr_unique;
1061         arg.unique = req->in.h.unique;
1062
1063         spin_unlock(&fc->lock);
1064         if (nbytes < reqsize)
1065                 return -EINVAL;
1066
1067         err = fuse_copy_one(cs, &ih, sizeof(ih));
1068         if (!err)
1069                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1070         fuse_copy_finish(cs);
1071
1072         return err ? err : reqsize;
1073 }
1074
1075 static struct fuse_forget_link *dequeue_forget(struct fuse_conn *fc,
1076                                                unsigned max,
1077                                                unsigned *countp)
1078 {
1079         struct fuse_forget_link *head = fc->forget_list_head.next;
1080         struct fuse_forget_link **newhead = &head;
1081         unsigned count;
1082
1083         for (count = 0; *newhead != NULL && count < max; count++)
1084                 newhead = &(*newhead)->next;
1085
1086         fc->forget_list_head.next = *newhead;
1087         *newhead = NULL;
1088         if (fc->forget_list_head.next == NULL)
1089                 fc->forget_list_tail = &fc->forget_list_head;
1090
1091         if (countp != NULL)
1092                 *countp = count;
1093
1094         return head;
1095 }
1096
1097 static int fuse_read_single_forget(struct fuse_conn *fc,
1098                                    struct fuse_copy_state *cs,
1099                                    size_t nbytes)
1100 __releases(fc->lock)
1101 {
1102         int err;
1103         struct fuse_forget_link *forget = dequeue_forget(fc, 1, NULL);
1104         struct fuse_forget_in arg = {
1105                 .nlookup = forget->forget_one.nlookup,
1106         };
1107         struct fuse_in_header ih = {
1108                 .opcode = FUSE_FORGET,
1109                 .nodeid = forget->forget_one.nodeid,
1110                 .unique = fuse_get_unique(fc),
1111                 .len = sizeof(ih) + sizeof(arg),
1112         };
1113
1114         spin_unlock(&fc->lock);
1115         kfree(forget);
1116         if (nbytes < ih.len)
1117                 return -EINVAL;
1118
1119         err = fuse_copy_one(cs, &ih, sizeof(ih));
1120         if (!err)
1121                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1122         fuse_copy_finish(cs);
1123
1124         if (err)
1125                 return err;
1126
1127         return ih.len;
1128 }
1129
1130 static int fuse_read_batch_forget(struct fuse_conn *fc,
1131                                    struct fuse_copy_state *cs, size_t nbytes)
1132 __releases(fc->lock)
1133 {
1134         int err;
1135         unsigned max_forgets;
1136         unsigned count;
1137         struct fuse_forget_link *head;
1138         struct fuse_batch_forget_in arg = { .count = 0 };
1139         struct fuse_in_header ih = {
1140                 .opcode = FUSE_BATCH_FORGET,
1141                 .unique = fuse_get_unique(fc),
1142                 .len = sizeof(ih) + sizeof(arg),
1143         };
1144
1145         if (nbytes < ih.len) {
1146                 spin_unlock(&fc->lock);
1147                 return -EINVAL;
1148         }
1149
1150         max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
1151         head = dequeue_forget(fc, max_forgets, &count);
1152         spin_unlock(&fc->lock);
1153
1154         arg.count = count;
1155         ih.len += count * sizeof(struct fuse_forget_one);
1156         err = fuse_copy_one(cs, &ih, sizeof(ih));
1157         if (!err)
1158                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1159
1160         while (head) {
1161                 struct fuse_forget_link *forget = head;
1162
1163                 if (!err) {
1164                         err = fuse_copy_one(cs, &forget->forget_one,
1165                                             sizeof(forget->forget_one));
1166                 }
1167                 head = forget->next;
1168                 kfree(forget);
1169         }
1170
1171         fuse_copy_finish(cs);
1172
1173         if (err)
1174                 return err;
1175
1176         return ih.len;
1177 }
1178
1179 static int fuse_read_forget(struct fuse_conn *fc, struct fuse_copy_state *cs,
1180                             size_t nbytes)
1181 __releases(fc->lock)
1182 {
1183         if (fc->minor < 16 || fc->forget_list_head.next->next == NULL)
1184                 return fuse_read_single_forget(fc, cs, nbytes);
1185         else
1186                 return fuse_read_batch_forget(fc, cs, nbytes);
1187 }
1188
1189 /*
1190  * Read a single request into the userspace filesystem's buffer.  This
1191  * function waits until a request is available, then removes it from
1192  * the pending list and copies request data to userspace buffer.  If
1193  * no reply is needed (FORGET) or request has been aborted or there
1194  * was an error during the copying then it's finished by calling
1195  * request_end().  Otherwise add it to the processing list, and set
1196  * the 'sent' flag.
1197  */
1198 static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
1199                                 struct fuse_copy_state *cs, size_t nbytes)
1200 {
1201         int err;
1202         struct fuse_req *req;
1203         struct fuse_in *in;
1204         unsigned reqsize;
1205
1206  restart:
1207         spin_lock(&fc->lock);
1208         err = -EAGAIN;
1209         if ((file->f_flags & O_NONBLOCK) && fc->connected &&
1210             !request_pending(fc))
1211                 goto err_unlock;
1212
1213         request_wait(fc);
1214         err = -ENODEV;
1215         if (!fc->connected)
1216                 goto err_unlock;
1217         err = -ERESTARTSYS;
1218         if (!request_pending(fc))
1219                 goto err_unlock;
1220
1221         if (!list_empty(&fc->interrupts)) {
1222                 req = list_entry(fc->interrupts.next, struct fuse_req,
1223                                  intr_entry);
1224                 return fuse_read_interrupt(fc, cs, nbytes, req);
1225         }
1226
1227         if (forget_pending(fc)) {
1228                 if (list_empty(&fc->pending) || fc->forget_batch-- > 0)
1229                         return fuse_read_forget(fc, cs, nbytes);
1230
1231                 if (fc->forget_batch <= -8)
1232                         fc->forget_batch = 16;
1233         }
1234
1235         req = list_entry(fc->pending.next, struct fuse_req, list);
1236         req->state = FUSE_REQ_READING;
1237         list_move(&req->list, &fc->io);
1238
1239         in = &req->in;
1240         reqsize = in->h.len;
1241         /* If request is too large, reply with an error and restart the read */
1242         if (nbytes < reqsize) {
1243                 req->out.h.error = -EIO;
1244                 /* SETXATTR is special, since it may contain too large data */
1245                 if (in->h.opcode == FUSE_SETXATTR)
1246                         req->out.h.error = -E2BIG;
1247                 request_end(fc, req);
1248                 goto restart;
1249         }
1250         spin_unlock(&fc->lock);
1251         cs->req = req;
1252         err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1253         if (!err)
1254                 err = fuse_copy_args(cs, in->numargs, in->argpages,
1255                                      (struct fuse_arg *) in->args, 0);
1256         fuse_copy_finish(cs);
1257         spin_lock(&fc->lock);
1258         req->locked = 0;
1259         if (req->aborted) {
1260                 request_end(fc, req);
1261                 return -ENODEV;
1262         }
1263         if (err) {
1264                 req->out.h.error = -EIO;
1265                 request_end(fc, req);
1266                 return err;
1267         }
1268         if (!req->isreply)
1269                 request_end(fc, req);
1270         else {
1271                 req->state = FUSE_REQ_SENT;
1272                 list_move_tail(&req->list, &fc->processing);
1273                 if (req->interrupted)
1274                         queue_interrupt(fc, req);
1275                 spin_unlock(&fc->lock);
1276         }
1277         return reqsize;
1278
1279  err_unlock:
1280         spin_unlock(&fc->lock);
1281         return err;
1282 }
1283
1284 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
1285                               unsigned long nr_segs, loff_t pos)
1286 {
1287         struct fuse_copy_state cs;
1288         struct file *file = iocb->ki_filp;
1289         struct fuse_conn *fc = fuse_get_conn(file);
1290         if (!fc)
1291                 return -EPERM;
1292
1293         fuse_copy_init(&cs, fc, 1, iov, nr_segs);
1294
1295         return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
1296 }
1297
1298 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
1299                                    struct pipe_buffer *buf)
1300 {
1301         return 1;
1302 }
1303
1304 static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = {
1305         .can_merge = 0,
1306         .map = generic_pipe_buf_map,
1307         .unmap = generic_pipe_buf_unmap,
1308         .confirm = generic_pipe_buf_confirm,
1309         .release = generic_pipe_buf_release,
1310         .steal = fuse_dev_pipe_buf_steal,
1311         .get = generic_pipe_buf_get,
1312 };
1313
1314 static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1315                                     struct pipe_inode_info *pipe,
1316                                     size_t len, unsigned int flags)
1317 {
1318         int ret;
1319         int page_nr = 0;
1320         int do_wakeup = 0;
1321         struct pipe_buffer *bufs;
1322         struct fuse_copy_state cs;
1323         struct fuse_conn *fc = fuse_get_conn(in);
1324         if (!fc)
1325                 return -EPERM;
1326
1327         bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1328         if (!bufs)
1329                 return -ENOMEM;
1330
1331         fuse_copy_init(&cs, fc, 1, NULL, 0);
1332         cs.pipebufs = bufs;
1333         cs.pipe = pipe;
1334         ret = fuse_dev_do_read(fc, in, &cs, len);
1335         if (ret < 0)
1336                 goto out;
1337
1338         ret = 0;
1339         pipe_lock(pipe);
1340
1341         if (!pipe->readers) {
1342                 send_sig(SIGPIPE, current, 0);
1343                 if (!ret)
1344                         ret = -EPIPE;
1345                 goto out_unlock;
1346         }
1347
1348         if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
1349                 ret = -EIO;
1350                 goto out_unlock;
1351         }
1352
1353         while (page_nr < cs.nr_segs) {
1354                 int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
1355                 struct pipe_buffer *buf = pipe->bufs + newbuf;
1356
1357                 buf->page = bufs[page_nr].page;
1358                 buf->offset = bufs[page_nr].offset;
1359                 buf->len = bufs[page_nr].len;
1360                 buf->ops = &fuse_dev_pipe_buf_ops;
1361
1362                 pipe->nrbufs++;
1363                 page_nr++;
1364                 ret += buf->len;
1365
1366                 if (pipe->inode)
1367                         do_wakeup = 1;
1368         }
1369
1370 out_unlock:
1371         pipe_unlock(pipe);
1372
1373         if (do_wakeup) {
1374                 smp_mb();
1375                 if (waitqueue_active(&pipe->wait))
1376                         wake_up_interruptible(&pipe->wait);
1377                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
1378         }
1379
1380 out:
1381         for (; page_nr < cs.nr_segs; page_nr++)
1382                 page_cache_release(bufs[page_nr].page);
1383
1384         kfree(bufs);
1385         return ret;
1386 }
1387
1388 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
1389                             struct fuse_copy_state *cs)
1390 {
1391         struct fuse_notify_poll_wakeup_out outarg;
1392         int err = -EINVAL;
1393
1394         if (size != sizeof(outarg))
1395                 goto err;
1396
1397         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1398         if (err)
1399                 goto err;
1400
1401         fuse_copy_finish(cs);
1402         return fuse_notify_poll_wakeup(fc, &outarg);
1403
1404 err:
1405         fuse_copy_finish(cs);
1406         return err;
1407 }
1408
1409 static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
1410                                    struct fuse_copy_state *cs)
1411 {
1412         struct fuse_notify_inval_inode_out outarg;
1413         int err = -EINVAL;
1414
1415         if (size != sizeof(outarg))
1416                 goto err;
1417
1418         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1419         if (err)
1420                 goto err;
1421         fuse_copy_finish(cs);
1422
1423         down_read(&fc->killsb);
1424         err = -ENOENT;
1425         if (fc->sb) {
1426                 err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
1427                                                outarg.off, outarg.len);
1428         }
1429         up_read(&fc->killsb);
1430         return err;
1431
1432 err:
1433         fuse_copy_finish(cs);
1434         return err;
1435 }
1436
1437 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
1438                                    struct fuse_copy_state *cs)
1439 {
1440         struct fuse_notify_inval_entry_out outarg;
1441         int err = -ENOMEM;
1442         char *buf;
1443         struct qstr name;
1444
1445         buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1446         if (!buf)
1447                 goto err;
1448
1449         err = -EINVAL;
1450         if (size < sizeof(outarg))
1451                 goto err;
1452
1453         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1454         if (err)
1455                 goto err;
1456
1457         err = -ENAMETOOLONG;
1458         if (outarg.namelen > FUSE_NAME_MAX)
1459                 goto err;
1460
1461         err = -EINVAL;
1462         if (size != sizeof(outarg) + outarg.namelen + 1)
1463                 goto err;
1464
1465         name.name = buf;
1466         name.len = outarg.namelen;
1467         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1468         if (err)
1469                 goto err;
1470         fuse_copy_finish(cs);
1471         buf[outarg.namelen] = 0;
1472         name.hash = full_name_hash(name.name, name.len);
1473
1474         down_read(&fc->killsb);
1475         err = -ENOENT;
1476         if (fc->sb)
1477                 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
1478         up_read(&fc->killsb);
1479         kfree(buf);
1480         return err;
1481
1482 err:
1483         kfree(buf);
1484         fuse_copy_finish(cs);
1485         return err;
1486 }
1487
1488 static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
1489                               struct fuse_copy_state *cs)
1490 {
1491         struct fuse_notify_delete_out outarg;
1492         int err = -ENOMEM;
1493         char *buf;
1494         struct qstr name;
1495
1496         buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1497         if (!buf)
1498                 goto err;
1499
1500         err = -EINVAL;
1501         if (size < sizeof(outarg))
1502                 goto err;
1503
1504         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1505         if (err)
1506                 goto err;
1507
1508         err = -ENAMETOOLONG;
1509         if (outarg.namelen > FUSE_NAME_MAX)
1510                 goto err;
1511
1512         err = -EINVAL;
1513         if (size != sizeof(outarg) + outarg.namelen + 1)
1514                 goto err;
1515
1516         name.name = buf;
1517         name.len = outarg.namelen;
1518         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1519         if (err)
1520                 goto err;
1521         fuse_copy_finish(cs);
1522         buf[outarg.namelen] = 0;
1523         name.hash = full_name_hash(name.name, name.len);
1524
1525         down_read(&fc->killsb);
1526         err = -ENOENT;
1527         if (fc->sb)
1528                 err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
1529                                                outarg.child, &name);
1530         up_read(&fc->killsb);
1531         kfree(buf);
1532         return err;
1533
1534 err:
1535         kfree(buf);
1536         fuse_copy_finish(cs);
1537         return err;
1538 }
1539
1540 static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
1541                              struct fuse_copy_state *cs)
1542 {
1543         struct fuse_notify_store_out outarg;
1544         struct inode *inode;
1545         struct address_space *mapping;
1546         u64 nodeid;
1547         int err;
1548         pgoff_t index;
1549         unsigned int offset;
1550         unsigned int num;
1551         loff_t file_size;
1552         loff_t end;
1553
1554         err = -EINVAL;
1555         if (size < sizeof(outarg))
1556                 goto out_finish;
1557
1558         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1559         if (err)
1560                 goto out_finish;
1561
1562         err = -EINVAL;
1563         if (size - sizeof(outarg) != outarg.size)
1564                 goto out_finish;
1565
1566         nodeid = outarg.nodeid;
1567
1568         down_read(&fc->killsb);
1569
1570         err = -ENOENT;
1571         if (!fc->sb)
1572                 goto out_up_killsb;
1573
1574         inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1575         if (!inode)
1576                 goto out_up_killsb;
1577
1578         mapping = inode->i_mapping;
1579         index = outarg.offset >> PAGE_CACHE_SHIFT;
1580         offset = outarg.offset & ~PAGE_CACHE_MASK;
1581         file_size = i_size_read(inode);
1582         end = outarg.offset + outarg.size;
1583         if (end > file_size) {
1584                 file_size = end;
1585                 fuse_write_update_size(inode, file_size);
1586         }
1587
1588         num = outarg.size;
1589         while (num) {
1590                 struct page *page;
1591                 unsigned int this_num;
1592
1593                 err = -ENOMEM;
1594                 page = find_or_create_page(mapping, index,
1595                                            mapping_gfp_mask(mapping));
1596                 if (!page)
1597                         goto out_iput;
1598
1599                 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1600                 err = fuse_copy_page(cs, &page, offset, this_num, 0);
1601                 if (!err && offset == 0 && (num != 0 || file_size == end))
1602                         SetPageUptodate(page);
1603                 unlock_page(page);
1604                 page_cache_release(page);
1605
1606                 if (err)
1607                         goto out_iput;
1608
1609                 num -= this_num;
1610                 offset = 0;
1611                 index++;
1612         }
1613
1614         err = 0;
1615
1616 out_iput:
1617         iput(inode);
1618 out_up_killsb:
1619         up_read(&fc->killsb);
1620 out_finish:
1621         fuse_copy_finish(cs);
1622         return err;
1623 }
1624
1625 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
1626 {
1627         release_pages(req->pages, req->num_pages, 0);
1628 }
1629
1630 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
1631                          struct fuse_notify_retrieve_out *outarg)
1632 {
1633         int err;
1634         struct address_space *mapping = inode->i_mapping;
1635         struct fuse_req *req;
1636         pgoff_t index;
1637         loff_t file_size;
1638         unsigned int num;
1639         unsigned int offset;
1640         size_t total_len = 0;
1641         int num_pages;
1642
1643         offset = outarg->offset & ~PAGE_CACHE_MASK;
1644         file_size = i_size_read(inode);
1645
1646         num = outarg->size;
1647         if (outarg->offset > file_size)
1648                 num = 0;
1649         else if (outarg->offset + num > file_size)
1650                 num = file_size - outarg->offset;
1651
1652         num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1653         num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);
1654
1655         req = fuse_get_req(fc, num_pages);
1656         if (IS_ERR(req))
1657                 return PTR_ERR(req);
1658
1659         req->in.h.opcode = FUSE_NOTIFY_REPLY;
1660         req->in.h.nodeid = outarg->nodeid;
1661         req->in.numargs = 2;
1662         req->in.argpages = 1;
1663         req->page_descs[0].offset = offset;
1664         req->end = fuse_retrieve_end;
1665
1666         index = outarg->offset >> PAGE_CACHE_SHIFT;
1667
1668         while (num && req->num_pages < num_pages) {
1669                 struct page *page;
1670                 unsigned int this_num;
1671
1672                 page = find_get_page(mapping, index);
1673                 if (!page)
1674                         break;
1675
1676                 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1677                 req->pages[req->num_pages] = page;
1678                 req->page_descs[req->num_pages].length = this_num;
1679                 req->num_pages++;
1680
1681                 offset = 0;
1682                 num -= this_num;
1683                 total_len += this_num;
1684                 index++;
1685         }
1686         req->misc.retrieve_in.offset = outarg->offset;
1687         req->misc.retrieve_in.size = total_len;
1688         req->in.args[0].size = sizeof(req->misc.retrieve_in);
1689         req->in.args[0].value = &req->misc.retrieve_in;
1690         req->in.args[1].size = total_len;
1691
1692         err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
1693         if (err)
1694                 fuse_retrieve_end(fc, req);
1695
1696         return err;
1697 }
1698
1699 static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
1700                                 struct fuse_copy_state *cs)
1701 {
1702         struct fuse_notify_retrieve_out outarg;
1703         struct inode *inode;
1704         int err;
1705
1706         err = -EINVAL;
1707         if (size != sizeof(outarg))
1708                 goto copy_finish;
1709
1710         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1711         if (err)
1712                 goto copy_finish;
1713
1714         fuse_copy_finish(cs);
1715
1716         down_read(&fc->killsb);
1717         err = -ENOENT;
1718         if (fc->sb) {
1719                 u64 nodeid = outarg.nodeid;
1720
1721                 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1722                 if (inode) {
1723                         err = fuse_retrieve(fc, inode, &outarg);
1724                         iput(inode);
1725                 }
1726         }
1727         up_read(&fc->killsb);
1728
1729         return err;
1730
1731 copy_finish:
1732         fuse_copy_finish(cs);
1733         return err;
1734 }
1735
1736 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
1737                        unsigned int size, struct fuse_copy_state *cs)
1738 {
1739         switch (code) {
1740         case FUSE_NOTIFY_POLL:
1741                 return fuse_notify_poll(fc, size, cs);
1742
1743         case FUSE_NOTIFY_INVAL_INODE:
1744                 return fuse_notify_inval_inode(fc, size, cs);
1745
1746         case FUSE_NOTIFY_INVAL_ENTRY:
1747                 return fuse_notify_inval_entry(fc, size, cs);
1748
1749         case FUSE_NOTIFY_STORE:
1750                 return fuse_notify_store(fc, size, cs);
1751
1752         case FUSE_NOTIFY_RETRIEVE:
1753                 return fuse_notify_retrieve(fc, size, cs);
1754
1755         case FUSE_NOTIFY_DELETE:
1756                 return fuse_notify_delete(fc, size, cs);
1757
1758         default:
1759                 fuse_copy_finish(cs);
1760                 return -EINVAL;
1761         }
1762 }
1763
1764 /* Look up request on processing list by unique ID */
1765 static struct fuse_req *request_find(struct fuse_conn *fc, u64 unique)
1766 {
1767         struct list_head *entry;
1768
1769         list_for_each(entry, &fc->processing) {
1770                 struct fuse_req *req;
1771                 req = list_entry(entry, struct fuse_req, list);
1772                 if (req->in.h.unique == unique || req->intr_unique == unique)
1773                         return req;
1774         }
1775         return NULL;
1776 }
1777
1778 static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
1779                          unsigned nbytes)
1780 {
1781         unsigned reqsize = sizeof(struct fuse_out_header);
1782
1783         if (out->h.error)
1784                 return nbytes != reqsize ? -EINVAL : 0;
1785
1786         reqsize += len_args(out->numargs, out->args);
1787
1788         if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
1789                 return -EINVAL;
1790         else if (reqsize > nbytes) {
1791                 struct fuse_arg *lastarg = &out->args[out->numargs-1];
1792                 unsigned diffsize = reqsize - nbytes;
1793                 if (diffsize > lastarg->size)
1794                         return -EINVAL;
1795                 lastarg->size -= diffsize;
1796         }
1797         return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
1798                               out->page_zeroing);
1799 }
1800
1801 /*
1802  * Write a single reply to a request.  First the header is copied from
1803  * the write buffer.  The request is then searched on the processing
1804  * list by the unique ID found in the header.  If found, then remove
1805  * it from the list and copy the rest of the buffer to the request.
1806  * The request is finished by calling request_end()
1807  */
1808 static ssize_t fuse_dev_do_write(struct fuse_conn *fc,
1809                                  struct fuse_copy_state *cs, size_t nbytes)
1810 {
1811         int err;
1812         struct fuse_req *req;
1813         struct fuse_out_header oh;
1814
1815         if (nbytes < sizeof(struct fuse_out_header))
1816                 return -EINVAL;
1817
1818         err = fuse_copy_one(cs, &oh, sizeof(oh));
1819         if (err)
1820                 goto err_finish;
1821
1822         err = -EINVAL;
1823         if (oh.len != nbytes)
1824                 goto err_finish;
1825
1826         /*
1827          * Zero oh.unique indicates unsolicited notification message
1828          * and error contains notification code.
1829          */
1830         if (!oh.unique) {
1831                 err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1832                 return err ? err : nbytes;
1833         }
1834
1835         err = -EINVAL;
1836         if (oh.error <= -1000 || oh.error > 0)
1837                 goto err_finish;
1838
1839         spin_lock(&fc->lock);
1840         err = -ENOENT;
1841         if (!fc->connected)
1842                 goto err_unlock;
1843
1844         req = request_find(fc, oh.unique);
1845         if (!req)
1846                 goto err_unlock;
1847
1848         if (req->aborted) {
1849                 spin_unlock(&fc->lock);
1850                 fuse_copy_finish(cs);
1851                 spin_lock(&fc->lock);
1852                 request_end(fc, req);
1853                 return -ENOENT;
1854         }
1855         /* Is it an interrupt reply? */
1856         if (req->intr_unique == oh.unique) {
1857                 err = -EINVAL;
1858                 if (nbytes != sizeof(struct fuse_out_header))
1859                         goto err_unlock;
1860
1861                 if (oh.error == -ENOSYS)
1862                         fc->no_interrupt = 1;
1863                 else if (oh.error == -EAGAIN)
1864                         queue_interrupt(fc, req);
1865
1866                 spin_unlock(&fc->lock);
1867                 fuse_copy_finish(cs);
1868                 return nbytes;
1869         }
1870
1871         req->state = FUSE_REQ_WRITING;
1872         list_move(&req->list, &fc->io);
1873         req->out.h = oh;
1874         req->locked = 1;
1875         cs->req = req;
1876         if (!req->out.page_replace)
1877                 cs->move_pages = 0;
1878         spin_unlock(&fc->lock);
1879
1880         err = copy_out_args(cs, &req->out, nbytes);
1881         fuse_copy_finish(cs);
1882
1883         spin_lock(&fc->lock);
1884         req->locked = 0;
1885         if (!err) {
1886                 if (req->aborted)
1887                         err = -ENOENT;
1888         } else if (!req->aborted)
1889                 req->out.h.error = -EIO;
1890         request_end(fc, req);
1891
1892         return err ? err : nbytes;
1893
1894  err_unlock:
1895         spin_unlock(&fc->lock);
1896  err_finish:
1897         fuse_copy_finish(cs);
1898         return err;
1899 }
1900
1901 static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
1902                               unsigned long nr_segs, loff_t pos)
1903 {
1904         struct fuse_copy_state cs;
1905         struct fuse_conn *fc = fuse_get_conn(iocb->ki_filp);
1906         if (!fc)
1907                 return -EPERM;
1908
1909         fuse_copy_init(&cs, fc, 0, iov, nr_segs);
1910
1911         return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
1912 }
1913
1914 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
1915                                      struct file *out, loff_t *ppos,
1916                                      size_t len, unsigned int flags)
1917 {
1918         unsigned nbuf;
1919         unsigned idx;
1920         struct pipe_buffer *bufs;
1921         struct fuse_copy_state cs;
1922         struct fuse_conn *fc;
1923         size_t rem;
1924         ssize_t ret;
1925
1926         fc = fuse_get_conn(out);
1927         if (!fc)
1928                 return -EPERM;
1929
1930         bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1931         if (!bufs)
1932                 return -ENOMEM;
1933
1934         pipe_lock(pipe);
1935         nbuf = 0;
1936         rem = 0;
1937         for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
1938                 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
1939
1940         ret = -EINVAL;
1941         if (rem < len) {
1942                 pipe_unlock(pipe);
1943                 goto out;
1944         }
1945
1946         rem = len;
1947         while (rem) {
1948                 struct pipe_buffer *ibuf;
1949                 struct pipe_buffer *obuf;
1950
1951                 BUG_ON(nbuf >= pipe->buffers);
1952                 BUG_ON(!pipe->nrbufs);
1953                 ibuf = &pipe->bufs[pipe->curbuf];
1954                 obuf = &bufs[nbuf];
1955
1956                 if (rem >= ibuf->len) {
1957                         *obuf = *ibuf;
1958                         ibuf->ops = NULL;
1959                         pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
1960                         pipe->nrbufs--;
1961                 } else {
1962                         ibuf->ops->get(pipe, ibuf);
1963                         *obuf = *ibuf;
1964                         obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
1965                         obuf->len = rem;
1966                         ibuf->offset += obuf->len;
1967                         ibuf->len -= obuf->len;
1968                 }
1969                 nbuf++;
1970                 rem -= obuf->len;
1971         }
1972         pipe_unlock(pipe);
1973
1974         fuse_copy_init(&cs, fc, 0, NULL, nbuf);
1975         cs.pipebufs = bufs;
1976         cs.pipe = pipe;
1977
1978         if (flags & SPLICE_F_MOVE)
1979                 cs.move_pages = 1;
1980
1981         ret = fuse_dev_do_write(fc, &cs, len);
1982
1983         for (idx = 0; idx < nbuf; idx++) {
1984                 struct pipe_buffer *buf = &bufs[idx];
1985                 buf->ops->release(pipe, buf);
1986         }
1987 out:
1988         kfree(bufs);
1989         return ret;
1990 }
1991
1992 static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
1993 {
1994         unsigned mask = POLLOUT | POLLWRNORM;
1995         struct fuse_conn *fc = fuse_get_conn(file);
1996         if (!fc)
1997                 return POLLERR;
1998
1999         poll_wait(file, &fc->waitq, wait);
2000
2001         spin_lock(&fc->lock);
2002         if (!fc->connected)
2003                 mask = POLLERR;
2004         else if (request_pending(fc))
2005                 mask |= POLLIN | POLLRDNORM;
2006         spin_unlock(&fc->lock);
2007
2008         return mask;
2009 }
2010
2011 /*
2012  * Abort all requests on the given list (pending or processing)
2013  *
2014  * This function releases and reacquires fc->lock
2015  */
2016 static void end_requests(struct fuse_conn *fc, struct list_head *head)
2017 __releases(fc->lock)
2018 __acquires(fc->lock)
2019 {
2020         while (!list_empty(head)) {
2021                 struct fuse_req *req;
2022                 req = list_entry(head->next, struct fuse_req, list);
2023                 req->out.h.error = -ECONNABORTED;
2024                 request_end(fc, req);
2025                 spin_lock(&fc->lock);
2026         }
2027 }
2028
2029 /*
2030  * Abort requests under I/O
2031  *
2032  * The requests are set to aborted and finished, and the request
2033  * waiter is woken up.  This will make request_wait_answer() wait
2034  * until the request is unlocked and then return.
2035  *
2036  * If the request is asynchronous, then the end function needs to be
2037  * called after waiting for the request to be unlocked (if it was
2038  * locked).
2039  */
2040 static void end_io_requests(struct fuse_conn *fc)
2041 __releases(fc->lock)
2042 __acquires(fc->lock)
2043 {
2044         while (!list_empty(&fc->io)) {
2045                 struct fuse_req *req =
2046                         list_entry(fc->io.next, struct fuse_req, list);
2047                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
2048
2049                 req->aborted = 1;
2050                 req->out.h.error = -ECONNABORTED;
2051                 req->state = FUSE_REQ_FINISHED;
2052                 list_del_init(&req->list);
2053                 wake_up(&req->waitq);
2054                 if (end) {
2055                         req->end = NULL;
2056                         __fuse_get_request(req);
2057                         spin_unlock(&fc->lock);
2058                         wait_event(req->waitq, !req->locked);
2059                         end(fc, req);
2060                         fuse_put_request(fc, req);
2061                         spin_lock(&fc->lock);
2062                 }
2063         }
2064 }
2065
2066 static void end_queued_requests(struct fuse_conn *fc)
2067 __releases(fc->lock)
2068 __acquires(fc->lock)
2069 {
2070         fc->max_background = UINT_MAX;
2071         flush_bg_queue(fc);
2072         end_requests(fc, &fc->pending);
2073         end_requests(fc, &fc->processing);
2074         while (forget_pending(fc))
2075                 kfree(dequeue_forget(fc, 1, NULL));
2076 }
2077
2078 static void end_polls(struct fuse_conn *fc)
2079 {
2080         struct rb_node *p;
2081
2082         p = rb_first(&fc->polled_files);
2083
2084         while (p) {
2085                 struct fuse_file *ff;
2086                 ff = rb_entry(p, struct fuse_file, polled_node);
2087                 wake_up_interruptible_all(&ff->poll_wait);
2088
2089                 p = rb_next(p);
2090         }
2091 }
2092
2093 /*
2094  * Abort all requests.
2095  *
2096  * Emergency exit in case of a malicious or accidental deadlock, or
2097  * just a hung filesystem.
2098  *
2099  * The same effect is usually achievable through killing the
2100  * filesystem daemon and all users of the filesystem.  The exception
2101  * is the combination of an asynchronous request and the tricky
2102  * deadlock (see Documentation/filesystems/fuse.txt).
2103  *
2104  * During the aborting, progression of requests from the pending and
2105  * processing lists onto the io list, and progression of new requests
2106  * onto the pending list is prevented by req->connected being false.
2107  *
2108  * Progression of requests under I/O to the processing list is
2109  * prevented by the req->aborted flag being true for these requests.
2110  * For this reason requests on the io list must be aborted first.
2111  */
2112 void fuse_abort_conn(struct fuse_conn *fc)
2113 {
2114         spin_lock(&fc->lock);
2115         if (fc->connected) {
2116                 fc->connected = 0;
2117                 fc->blocked = 0;
2118                 fc->initialized = 1;
2119                 end_io_requests(fc);
2120                 end_queued_requests(fc);
2121                 end_polls(fc);
2122                 wake_up_all(&fc->waitq);
2123                 wake_up_all(&fc->blocked_waitq);
2124                 kill_fasync(&fc->fasync, SIGIO, POLL_IN);
2125         }
2126         spin_unlock(&fc->lock);
2127 }
2128 EXPORT_SYMBOL_GPL(fuse_abort_conn);
2129
2130 int fuse_dev_release(struct inode *inode, struct file *file)
2131 {
2132         struct fuse_conn *fc = fuse_get_conn(file);
2133         if (fc) {
2134                 spin_lock(&fc->lock);
2135                 fc->connected = 0;
2136                 fc->blocked = 0;
2137                 fc->initialized = 1;
2138                 end_queued_requests(fc);
2139                 end_polls(fc);
2140                 wake_up_all(&fc->blocked_waitq);
2141                 spin_unlock(&fc->lock);
2142                 fuse_conn_put(fc);
2143         }
2144
2145         return 0;
2146 }
2147 EXPORT_SYMBOL_GPL(fuse_dev_release);
2148
2149 static int fuse_dev_fasync(int fd, struct file *file, int on)
2150 {
2151         struct fuse_conn *fc = fuse_get_conn(file);
2152         if (!fc)
2153                 return -EPERM;
2154
2155         /* No locking - fasync_helper does its own locking */
2156         return fasync_helper(fd, file, on, &fc->fasync);
2157 }
2158
2159 const struct file_operations fuse_dev_operations = {
2160         .owner          = THIS_MODULE,
2161         .llseek         = no_llseek,
2162         .read           = do_sync_read,
2163         .aio_read       = fuse_dev_read,
2164         .splice_read    = fuse_dev_splice_read,
2165         .write          = do_sync_write,
2166         .aio_write      = fuse_dev_write,
2167         .splice_write   = fuse_dev_splice_write,
2168         .poll           = fuse_dev_poll,
2169         .release        = fuse_dev_release,
2170         .fasync         = fuse_dev_fasync,
2171 };
2172 EXPORT_SYMBOL_GPL(fuse_dev_operations);
2173
2174 static struct miscdevice fuse_miscdevice = {
2175         .minor = FUSE_MINOR,
2176         .name  = "fuse",
2177         .fops = &fuse_dev_operations,
2178 };
2179
2180 int __init fuse_dev_init(void)
2181 {
2182         int err = -ENOMEM;
2183         fuse_req_cachep = kmem_cache_create("fuse_request",
2184                                             sizeof(struct fuse_req),
2185                                             0, 0, NULL);
2186         if (!fuse_req_cachep)
2187                 goto out;
2188
2189         err = misc_register(&fuse_miscdevice);
2190         if (err)
2191                 goto out_cache_clean;
2192
2193         return 0;
2194
2195  out_cache_clean:
2196         kmem_cache_destroy(fuse_req_cachep);
2197  out:
2198         return err;
2199 }
2200
2201 void fuse_dev_cleanup(void)
2202 {
2203         misc_deregister(&fuse_miscdevice);
2204         kmem_cache_destroy(fuse_req_cachep);
2205 }