fs/fuse/file.c

   1 /*
   2   FUSE: Filesystem in Userspace
   3   Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
   4
   5   This program can be distributed under the terms of the GNU GPL.
   6   See the file COPYING.
   7 */
   8
   9 #include "fuse_i.h"
  10
  11 #include <linux/pagemap.h>
  12 #include <linux/slab.h>
  13 #include <linux/kernel.h>
  14 #include <linux/sched.h>
  15 #include <linux/module.h>
  16 #include <linux/compat.h>
  17 #include <linux/swap.h>
  18
  19 static const struct file_operations fuse_direct_io_file_operations;
  20
  21 static int fuse_send_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
  22                           int opcode, struct fuse_open_out *outargp)
  23 {
  24         struct fuse_open_in inarg;
  25         struct fuse_req *req;
  26         int err;
  27
  28         req = fuse_get_req(fc);
  29         if (IS_ERR(req))
  30                 return PTR_ERR(req);
  31
  32         memset(&inarg, 0, sizeof(inarg));
  33         inarg.flags = file->f_flags & ~(O_CREAT | O_EXCL | O_NOCTTY);
  34         if (!fc->atomic_o_trunc)
  35                 inarg.flags &= ~O_TRUNC;
  36         req->in.h.opcode = opcode;
  37         req->in.h.nodeid = nodeid;
  38         req->in.numargs = 1;
  39         req->in.args[0].size = sizeof(inarg);
  40         req->in.args[0].value = &inarg;
  41         req->out.numargs = 1;
  42         req->out.args[0].size = sizeof(*outargp);
  43         req->out.args[0].value = outargp;
  44         fuse_request_send(fc, req);
  45         err = req->out.h.error;
  46         fuse_put_request(fc, req);
  47
  48         return err;
  49 }
  50
  51 struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
  52 {
  53         struct fuse_file *ff;
  54
  55         ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
  56         if (unlikely(!ff))
  57                 return NULL;
  58
  59         ff->fc = fc;
  60         ff->reserved_req = fuse_request_alloc();
  61         if (unlikely(!ff->reserved_req)) {
  62                 kfree(ff);
  63                 return NULL;
  64         }
  65
  66         INIT_LIST_HEAD(&ff->write_entry);
  67         atomic_set(&ff->count, 0);
  68         RB_CLEAR_NODE(&ff->polled_node);
  69         init_waitqueue_head(&ff->poll_wait);
  70
  71         spin_lock(&fc->lock);
  72         ff->kh = ++fc->khctr;
  73         spin_unlock(&fc->lock);
  74
  75         return ff;
  76 }
  77
  78 void fuse_file_free(struct fuse_file *ff)
  79 {
  80         fuse_request_free(ff->reserved_req);
  81         kfree(ff);
  82 }
  83
  84 struct fuse_file *fuse_file_get(struct fuse_file *ff)
  85 {
  86         atomic_inc(&ff->count);
  87         return ff;
  88 }
  89
  90 static void fuse_release_async(struct work_struct *work)
  91 {
  92         struct fuse_req *req;
  93         struct fuse_conn *fc;
  94         struct path path;
  95
  96         req = container_of(work, struct fuse_req, misc.release.work);
  97         path = req->misc.release.path;
  98         fc = get_fuse_conn(path.dentry->d_inode);
  99
 100         fuse_put_request(fc, req);
 101         path_put(&path);
 102 }
 103
 104 static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
 105 {
 106         if (fc->destroy_req) {
 107                 /*
 108                  * If this is a fuseblk mount, then it's possible that
 109                  * releasing the path will result in releasing the
 110                  * super block and sending the DESTROY request.  If
 111                  * the server is single threaded, this would hang.
 112                  * For this reason do the path_put() in a separate
 113                  * thread.
 114                  */
 115                 atomic_inc(&req->count);
 116                 INIT_WORK(&req->misc.release.work, fuse_release_async);
 117                 schedule_work(&req->misc.release.work);
 118         } else {
 119                 path_put(&req->misc.release.path);
 120         }
 121 }
 122
 123 static void fuse_file_put(struct fuse_file *ff, bool sync)
 124 {
 125         if (atomic_dec_and_test(&ff->count)) {
 126                 struct fuse_req *req = ff->reserved_req;
 127
 128                 if (sync) {
 129                         fuse_request_send(ff->fc, req);
 130                         path_put(&req->misc.release.path);
 131                         fuse_put_request(ff->fc, req);
 132                 } else {
 133                         req->end = fuse_release_end;
 134                         fuse_request_send_background(ff->fc, req);
 135                 }
 136                 kfree(ff);
 137         }
 138 }
 139
 140 int fuse_do_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
 141                  bool isdir)
 142 {
 143         struct fuse_open_out outarg;
 144         struct fuse_file *ff;
 145         int err;
 146         int opcode = isdir ? FUSE_OPENDIR : FUSE_OPEN;
 147
 148         ff = fuse_file_alloc(fc);
 149         if (!ff)
 150                 return -ENOMEM;
 151
 152         err = fuse_send_open(fc, nodeid, file, opcode, &outarg);
 153         if (err) {
 154                 fuse_file_free(ff);
 155                 return err;
 156         }
 157
 158         if (isdir)
 159                 outarg.open_flags &= ~FOPEN_DIRECT_IO;
 160
 161         ff->fh = outarg.fh;
 162         ff->nodeid = nodeid;
 163         ff->open_flags = outarg.open_flags;
 164         file->private_data = fuse_file_get(ff);
 165
 166         return 0;
 167 }
 168 EXPORT_SYMBOL_GPL(fuse_do_open);
 169
 170 void fuse_finish_open(struct inode *inode, struct file *file)
 171 {
 172         struct fuse_file *ff = file->private_data;
 173         struct fuse_conn *fc = get_fuse_conn(inode);
 174
 175         if (ff->open_flags & FOPEN_DIRECT_IO)
 176                 file->f_op = &fuse_direct_io_file_operations;
 177         if (!(ff->open_flags & FOPEN_KEEP_CACHE))
 178                 invalidate_inode_pages2(inode->i_mapping);
 179         if (ff->open_flags & FOPEN_NONSEEKABLE)
 180                 nonseekable_open(inode, file);
 181         if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
 182                 struct fuse_inode *fi = get_fuse_inode(inode);
 183
 184                 spin_lock(&fc->lock);
 185                 fi->attr_version = ++fc->attr_version;
 186                 i_size_write(inode, 0);
 187                 spin_unlock(&fc->lock);
 188                 fuse_invalidate_attr(inode);
 189         }
 190 }
 191
 192 int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
 193 {
 194         struct fuse_conn *fc = get_fuse_conn(inode);
 195         int err;
 196
 197         /* VFS checks this, but only _after_ ->open() */
 198         if (file->f_flags & O_DIRECT)
 199                 return -EINVAL;
 200
 201         err = generic_file_open(inode, file);
 202         if (err)
 203                 return err;
 204
 205         err = fuse_do_open(fc, get_node_id(inode), file, isdir);
 206         if (err)
 207                 return err;
 208
 209         fuse_finish_open(inode, file);
 210
 211         return 0;
 212 }
 213
 214 static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
 215 {
 216         struct fuse_conn *fc = ff->fc;
 217         struct fuse_req *req = ff->reserved_req;
 218         struct fuse_release_in *inarg = &req->misc.release.in;
 219
 220         spin_lock(&fc->lock);
 221         list_del(&ff->write_entry);
 222         if (!RB_EMPTY_NODE(&ff->polled_node))
 223                 rb_erase(&ff->polled_node, &fc->polled_files);
 224         spin_unlock(&fc->lock);
 225
 226         wake_up_interruptible_all(&ff->poll_wait);
 227
 228         inarg->fh = ff->fh;
 229         inarg->flags = flags;
 230         req->in.h.opcode = opcode;
 231         req->in.h.nodeid = ff->nodeid;
 232         req->in.numargs = 1;
 233         req->in.args[0].size = sizeof(struct fuse_release_in);
 234         req->in.args[0].value = inarg;
 235 }
 236
 237 void fuse_release_common(struct file *file, int opcode)
 238 {
 239         struct fuse_file *ff;
 240         struct fuse_req *req;
 241
 242         ff = file->private_data;
 243         if (unlikely(!ff))
 244                 return;
 245
 246         req = ff->reserved_req;
 247         fuse_prepare_release(ff, file->f_flags, opcode);
 248
 249         if (ff->flock) {
 250                 struct fuse_release_in *inarg = &req->misc.release.in;
 251                 inarg->release_flags |= FUSE_RELEASE_FLOCK_UNLOCK;
 252                 inarg->lock_owner = fuse_lock_owner_id(ff->fc,
 253                                                        (fl_owner_t) file);
 254         }
 255         /* Hold vfsmount and dentry until release is finished */
 256         path_get(&file->f_path);
 257         req->misc.release.path = file->f_path;
 258
 259         /*
 260          * Normally this will send the RELEASE request, however if
 261          * some asynchronous READ or WRITE requests are outstanding,
 262          * the sending will be delayed.
 263          *
 264          * Make the release synchronous if this is a fuseblk mount,
 265          * synchronous RELEASE is allowed (and desirable) in this case
 266          * because the server can be trusted not to screw up.
 267          */
 268         fuse_file_put(ff, ff->fc->destroy_req != NULL);
 269 }
 270
 271 static int fuse_open(struct inode *inode, struct file *file)
 272 {
 273         return fuse_open_common(inode, file, false);
 274 }
 275
 276 static int fuse_release(struct inode *inode, struct file *file)
 277 {
 278         fuse_release_common(file, FUSE_RELEASE);
 279
 280         /* return value is ignored by VFS */
 281         return 0;
 282 }
 283
 284 void fuse_sync_release(struct fuse_file *ff, int flags)
 285 {
 286         WARN_ON(atomic_read(&ff->count) > 1);
 287         fuse_prepare_release(ff, flags, FUSE_RELEASE);
 288         ff->reserved_req->force = 1;
 289         fuse_request_send(ff->fc, ff->reserved_req);
 290         fuse_put_request(ff->fc, ff->reserved_req);
 291         kfree(ff);
 292 }
 293 EXPORT_SYMBOL_GPL(fuse_sync_release);
 294
 295 /*
 296  * Scramble the ID space with XTEA, so that the value of the files_struct
 297  * pointer is not exposed to userspace.
 298  */
 299 u64 fuse_lock_owner_id(struct fuse_conn *fc, fl_owner_t id)
 300 {
 301         u32 *k = fc->scramble_key;
 302         u64 v = (unsigned long) id;
 303         u32 v0 = v;
 304         u32 v1 = v >> 32;
 305         u32 sum = 0;
 306         int i;
 307
 308         for (i = 0; i < 32; i++) {
 309                 v0 += ((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k[sum & 3]);
 310                 sum += 0x9E3779B9;
 311                 v1 += ((v0 << 4 ^ v0 >> 5) + v0) ^ (sum + k[sum>>11 & 3]);
 312         }
 313
 314         return (u64) v0 + ((u64) v1 << 32);
 315 }
 316
 317 /*
 318  * Check if page is under writeback
 319  *
 320  * This is currently done by walking the list of writepage requests
 321  * for the inode, which can be pretty inefficient.
 322  */
 323 static bool fuse_page_is_writeback(struct inode *inode, pgoff_t index)
 324 {
 325         struct fuse_conn *fc = get_fuse_conn(inode);
 326         struct fuse_inode *fi = get_fuse_inode(inode);
 327         struct fuse_req *req;
 328         bool found = false;
 329
 330         spin_lock(&fc->lock);
 331         list_for_each_entry(req, &fi->writepages, writepages_entry) {
 332                 pgoff_t curr_index;
 333
 334                 BUG_ON(req->inode != inode);
 335                 curr_index = req->misc.write.in.offset >> PAGE_CACHE_SHIFT;
 336                 if (curr_index == index) {
 337                         found = true;
 338                         break;
 339                 }
 340         }
 341         spin_unlock(&fc->lock);
 342
 343         return found;
 344 }
 345
 346 /*
 347  * Wait for page writeback to be completed.
 348  *
 349  * Since fuse doesn't rely on the VM writeback tracking, this has to
 350  * use some other means.
 351  */
 352 static int fuse_wait_on_page_writeback(struct inode *inode, pgoff_t index)
 353 {
 354         struct fuse_inode *fi = get_fuse_inode(inode);
 355
 356         wait_event(fi->page_waitq, !fuse_page_is_writeback(inode, index));
 357         return 0;
 358 }
 359
 360 static int fuse_flush(struct file *file, fl_owner_t id)
 361 {
 362         struct inode *inode = file->f_path.dentry->d_inode;
 363         struct fuse_conn *fc = get_fuse_conn(inode);
 364         struct fuse_file *ff = file->private_data;
 365         struct fuse_req *req;
 366         struct fuse_flush_in inarg;
 367         int err;
 368
 369         if (is_bad_inode(inode))
 370                 return -EIO;
 371
 372         if (fc->no_flush)
 373                 return 0;
 374
 375         req = fuse_get_req_nofail(fc, file);
 376         memset(&inarg, 0, sizeof(inarg));
 377         inarg.fh = ff->fh;
 378         inarg.lock_owner = fuse_lock_owner_id(fc, id);
 379         req->in.h.opcode = FUSE_FLUSH;
 380         req->in.h.nodeid = get_node_id(inode);
 381         req->in.numargs = 1;
 382         req->in.args[0].size = sizeof(inarg);
 383         req->in.args[0].value = &inarg;
 384         req->force = 1;
 385         fuse_request_send(fc, req);
 386         err = req->out.h.error;
 387         fuse_put_request(fc, req);
 388         if (err == -ENOSYS) {
 389                 fc->no_flush = 1;
 390                 err = 0;
 391         }
 392         return err;
 393 }
 394
 395 /*
 396  * Wait for all pending writepages on the inode to finish.
 397  *
 398  * This is currently done by blocking further writes with FUSE_NOWRITE
 399  * and waiting for all sent writes to complete.
 400  *
 401  * This must be called under i_mutex, otherwise the FUSE_NOWRITE usage
 402  * could conflict with truncation.
 403  */
 404 static void fuse_sync_writes(struct inode *inode)
 405 {
 406         fuse_set_nowrite(inode);
 407         fuse_release_nowrite(inode);
 408 }
 409
 410 int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
 411                       int datasync, int isdir)
 412 {
 413         struct inode *inode = file->f_mapping->host;
 414         struct fuse_conn *fc = get_fuse_conn(inode);
 415         struct fuse_file *ff = file->private_data;
 416         struct fuse_req *req;
 417         struct fuse_fsync_in inarg;
 418         int err;
 419
 420         if (is_bad_inode(inode))
 421                 return -EIO;
 422
 423         err = filemap_write_and_wait_range(inode->i_mapping, start, end);
 424         if (err)
 425                 return err;
 426
 427         if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
 428                 return 0;
 429
 430         mutex_lock(&inode->i_mutex);
 431
 432         /*
 433          * Start writeback against all dirty pages of the inode, then
 434          * wait for all outstanding writes, before sending the FSYNC
 435          * request.
 436          */
 437         err = write_inode_now(inode, 0);
 438         if (err)
 439                 goto out;
 440
 441         fuse_sync_writes(inode);
 442
 443         req = fuse_get_req(fc);
 444         if (IS_ERR(req)) {
 445                 err = PTR_ERR(req);
 446                 goto out;
 447         }
 448
 449         memset(&inarg, 0, sizeof(inarg));
 450         inarg.fh = ff->fh;
 451         inarg.fsync_flags = datasync ? 1 : 0;
 452         req->in.h.opcode = isdir ? FUSE_FSYNCDIR : FUSE_FSYNC;
 453         req->in.h.nodeid = get_node_id(inode);
 454         req->in.numargs = 1;
 455         req->in.args[0].size = sizeof(inarg);
 456         req->in.args[0].value = &inarg;
 457         fuse_request_send(fc, req);
 458         err = req->out.h.error;
 459         fuse_put_request(fc, req);
 460         if (err == -ENOSYS) {
 461                 if (isdir)
 462                         fc->no_fsyncdir = 1;
 463                 else
 464                         fc->no_fsync = 1;
 465                 err = 0;
 466         }
 467 out:
 468         mutex_unlock(&inode->i_mutex);
 469         return err;
 470 }
 471
 472 static int fuse_fsync(struct file *file, loff_t start, loff_t end,
 473                       int datasync)
 474 {
 475         return fuse_fsync_common(file, start, end, datasync, 0);
 476 }
 477
 478 void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
 479                     size_t count, int opcode)
 480 {
 481         struct fuse_read_in *inarg = &req->misc.read.in;
 482         struct fuse_file *ff = file->private_data;
 483
 484         inarg->fh = ff->fh;
 485         inarg->offset = pos;
 486         inarg->size = count;
 487         inarg->flags = file->f_flags;
 488         req->in.h.opcode = opcode;
 489         req->in.h.nodeid = ff->nodeid;
 490         req->in.numargs = 1;
 491         req->in.args[0].size = sizeof(struct fuse_read_in);
 492         req->in.args[0].value = inarg;
 493         req->out.argvar = 1;
 494         req->out.numargs = 1;
 495         req->out.args[0].size = count;
 496 }
 497
 498 static size_t fuse_send_read(struct fuse_req *req, struct file *file,
 499                              loff_t pos, size_t count, fl_owner_t owner)
 500 {
 501         struct fuse_file *ff = file->private_data;
 502         struct fuse_conn *fc = ff->fc;
 503
 504         fuse_read_fill(req, file, pos, count, FUSE_READ);
 505         if (owner != NULL) {
 506                 struct fuse_read_in *inarg = &req->misc.read.in;
 507
 508                 inarg->read_flags |= FUSE_READ_LOCKOWNER;
 509                 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
 510         }
 511         fuse_request_send(fc, req);
 512         return req->out.args[0].size;
 513 }
 514
 515 static void fuse_read_update_size(struct inode *inode, loff_t size,
 516                                   u64 attr_ver)
 517 {
 518         struct fuse_conn *fc = get_fuse_conn(inode);
 519         struct fuse_inode *fi = get_fuse_inode(inode);
 520
 521         spin_lock(&fc->lock);
 522         if (attr_ver == fi->attr_version && size < inode->i_size &&
 523             !test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
 524                 fi->attr_version = ++fc->attr_version;
 525                 i_size_write(inode, size);
 526         }
 527         spin_unlock(&fc->lock);
 528 }
 529
 530 static int fuse_readpage(struct file *file, struct page *page)
 531 {
 532         struct inode *inode = page->mapping->host;
 533         struct fuse_conn *fc = get_fuse_conn(inode);
 534         struct fuse_req *req;
 535         size_t num_read;
 536         loff_t pos = page_offset(page);
 537         size_t count = PAGE_CACHE_SIZE;
 538         u64 attr_ver;
 539         int err;
 540
 541         err = -EIO;
 542         if (is_bad_inode(inode))
 543                 goto out;
 544
 545         /*
 546          * Page writeback can extend beyond the lifetime of the
 547          * page-cache page, so make sure we read a properly synced
 548          * page.
 549          */
 550         fuse_wait_on_page_writeback(inode, page->index);
 551
 552         req = fuse_get_req(fc);
 553         err = PTR_ERR(req);
 554         if (IS_ERR(req))
 555                 goto out;
 556
 557         attr_ver = fuse_get_attr_version(fc);
 558
 559         req->out.page_zeroing = 1;
 560         req->out.argpages = 1;
 561         req->num_pages = 1;
 562         req->pages[0] = page;
 563         num_read = fuse_send_read(req, file, pos, count, NULL);
 564         err = req->out.h.error;
 565         fuse_put_request(fc, req);
 566
 567         if (!err) {
 568                 /*
 569                  * Short read means EOF.  If file size is larger, truncate it
 570                  */
 571                 if (num_read < count)
 572                         fuse_read_update_size(inode, pos + num_read, attr_ver);
 573
 574                 SetPageUptodate(page);
 575         }
 576
 577         fuse_invalidate_attr(inode); /* atime changed */
 578  out:
 579         unlock_page(page);
 580         return err;
 581 }
 582
 583 static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
 584 {
 585         int i;
 586         size_t count = req->misc.read.in.size;
 587         size_t num_read = req->out.args[0].size;
 588         struct address_space *mapping = NULL;
 589
 590         for (i = 0; mapping == NULL && i < req->num_pages; i++)
 591                 mapping = req->pages[i]->mapping;
 592
 593         if (mapping) {
 594                 struct inode *inode = mapping->host;
 595
 596                 /*
 597                  * Short read means EOF. If file size is larger, truncate it
 598                  */
 599                 if (!req->out.h.error && num_read < count) {
 600                         loff_t pos;
 601
 602                         pos = page_offset(req->pages[0]) + num_read;
 603                         fuse_read_update_size(inode, pos,
 604                                               req->misc.read.attr_ver);
 605                 }
 606                 fuse_invalidate_attr(inode); /* atime changed */
 607         }
 608
 609         for (i = 0; i < req->num_pages; i++) {
 610                 struct page *page = req->pages[i];
 611                 if (!req->out.h.error)
 612                         SetPageUptodate(page);
 613                 else
 614                         SetPageError(page);
 615                 unlock_page(page);
 616                 page_cache_release(page);
 617         }
 618         if (req->ff)
 619                 fuse_file_put(req->ff, false);
 620 }
 621
 622 static void fuse_send_readpages(struct fuse_req *req, struct file *file)
 623 {
 624         struct fuse_file *ff = file->private_data;
 625         struct fuse_conn *fc = ff->fc;
 626         loff_t pos = page_offset(req->pages[0]);
 627         size_t count = req->num_pages << PAGE_CACHE_SHIFT;
 628
 629         req->out.argpages = 1;
 630         req->out.page_zeroing = 1;
 631         req->out.page_replace = 1;
 632         fuse_read_fill(req, file, pos, count, FUSE_READ);
 633         req->misc.read.attr_ver = fuse_get_attr_version(fc);
 634         if (fc->async_read) {
 635                 req->ff = fuse_file_get(ff);
 636                 req->end = fuse_readpages_end;
 637                 fuse_request_send_background(fc, req);
 638         } else {
 639                 fuse_request_send(fc, req);
 640                 fuse_readpages_end(fc, req);
 641                 fuse_put_request(fc, req);
 642         }
 643 }
 644
 645 struct fuse_fill_data {
 646         struct fuse_req *req;
 647         struct file *file;
 648         struct inode *inode;
 649 };
 650
 651 static int fuse_readpages_fill(void *_data, struct page *page)
 652 {
 653         struct fuse_fill_data *data = _data;
 654         struct fuse_req *req = data->req;
 655         struct inode *inode = data->inode;
 656         struct fuse_conn *fc = get_fuse_conn(inode);
 657
 658         fuse_wait_on_page_writeback(inode, page->index);
 659
 660         if (req->num_pages &&
 661             (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
 662              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
 663              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
 664                 fuse_send_readpages(req, data->file);
 665                 data->req = req = fuse_get_req(fc);
 666                 if (IS_ERR(req)) {
 667                         unlock_page(page);
 668                         return PTR_ERR(req);
 669                 }
 670         }
 671         page_cache_get(page);
 672         req->pages[req->num_pages] = page;
 673         req->num_pages++;
 674         return 0;
 675 }
 676
 677 static int fuse_readpages(struct file *file, struct address_space *mapping,
 678                           struct list_head *pages, unsigned nr_pages)
 679 {
 680         struct inode *inode = mapping->host;
 681         struct fuse_conn *fc = get_fuse_conn(inode);
 682         struct fuse_fill_data data;
 683         int err;
 684
 685         err = -EIO;
 686         if (is_bad_inode(inode))
 687                 goto out;
 688
 689         data.file = file;
 690         data.inode = inode;
 691         data.req = fuse_get_req(fc);
 692         err = PTR_ERR(data.req);
 693         if (IS_ERR(data.req))
 694                 goto out;
 695
 696         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
 697         if (!err) {
 698                 if (data.req->num_pages)
 699                         fuse_send_readpages(data.req, file);
 700                 else
 701                         fuse_put_request(fc, data.req);
 702         }
 703 out:
 704         return err;
 705 }
 706
 707 static ssize_t fuse_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
 708                                   unsigned long nr_segs, loff_t pos)
 709 {
 710         struct inode *inode = iocb->ki_filp->f_mapping->host;
 711
 712         if (pos + iov_length(iov, nr_segs) > i_size_read(inode)) {
 713                 int err;
 714                 /*
 715                  * If trying to read past EOF, make sure the i_size
 716                  * attribute is up-to-date.
 717                  */
 718                 err = fuse_update_attributes(inode, NULL, iocb->ki_filp, NULL);
 719                 if (err)
 720                         return err;
 721         }
 722
 723         return generic_file_aio_read(iocb, iov, nr_segs, pos);
 724 }
 725
 726 static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
 727                             loff_t pos, size_t count)
 728 {
 729         struct fuse_write_in *inarg = &req->misc.write.in;
 730         struct fuse_write_out *outarg = &req->misc.write.out;
 731
 732         inarg->fh = ff->fh;
 733         inarg->offset = pos;
 734         inarg->size = count;
 735         req->in.h.opcode = FUSE_WRITE;
 736         req->in.h.nodeid = ff->nodeid;
 737         req->in.numargs = 2;
 738         if (ff->fc->minor < 9)
 739                 req->in.args[0].size = FUSE_COMPAT_WRITE_IN_SIZE;
 740         else
 741                 req->in.args[0].size = sizeof(struct fuse_write_in);
 742         req->in.args[0].value = inarg;
 743         req->in.args[1].size = count;
 744         req->out.numargs = 1;
 745         req->out.args[0].size = sizeof(struct fuse_write_out);
 746         req->out.args[0].value = outarg;
 747 }
 748
 749 static size_t fuse_send_write(struct fuse_req *req, struct file *file,
 750                               loff_t pos, size_t count, fl_owner_t owner)
 751 {
 752         struct fuse_file *ff = file->private_data;
 753         struct fuse_conn *fc = ff->fc;
 754         struct fuse_write_in *inarg = &req->misc.write.in;
 755
 756         fuse_write_fill(req, ff, pos, count);
 757         inarg->flags = file->f_flags;
 758         if (owner != NULL) {
 759                 inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
 760                 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
 761         }
 762         fuse_request_send(fc, req);
 763         return req->misc.write.out.size;
 764 }
 765
 766 void fuse_write_update_size(struct inode *inode, loff_t pos)
 767 {
 768         struct fuse_conn *fc = get_fuse_conn(inode);
 769         struct fuse_inode *fi = get_fuse_inode(inode);
 770
 771         spin_lock(&fc->lock);
 772         fi->attr_version = ++fc->attr_version;
 773         if (pos > inode->i_size)
 774                 i_size_write(inode, pos);
 775         spin_unlock(&fc->lock);
 776 }
 777
 778 static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file,
 779                                     struct inode *inode, loff_t pos,
 780                                     size_t count)
 781 {
 782         size_t res;
 783         unsigned offset;
 784         unsigned i;
 785
 786         for (i = 0; i < req->num_pages; i++)
 787                 fuse_wait_on_page_writeback(inode, req->pages[i]->index);
 788
 789         res = fuse_send_write(req, file, pos, count, NULL);
 790
 791         offset = req->page_offset;
 792         count = res;
 793         for (i = 0; i < req->num_pages; i++) {
 794                 struct page *page = req->pages[i];
 795
 796                 if (!req->out.h.error && !offset && count >= PAGE_CACHE_SIZE)
 797                         SetPageUptodate(page);
 798
 799                 if (count > PAGE_CACHE_SIZE - offset)
 800                         count -= PAGE_CACHE_SIZE - offset;
 801                 else
 802                         count = 0;
 803                 offset = 0;
 804
 805                 unlock_page(page);
 806                 page_cache_release(page);
 807         }
 808
 809         return res;
 810 }
 811
 812 static ssize_t fuse_fill_write_pages(struct fuse_req *req,
 813                                struct address_space *mapping,
 814                                struct iov_iter *ii, loff_t pos)
 815 {
 816         struct fuse_conn *fc = get_fuse_conn(mapping->host);
 817         unsigned offset = pos & (PAGE_CACHE_SIZE - 1);
 818         size_t count = 0;
 819         int err;
 820
 821         req->in.argpages = 1;
 822         req->page_offset = offset;
 823
 824         do {
 825                 size_t tmp;
 826                 struct page *page;
 827                 pgoff_t index = pos >> PAGE_CACHE_SHIFT;
 828                 size_t bytes = min_t(size_t, PAGE_CACHE_SIZE - offset,
 829                                      iov_iter_count(ii));
 830
 831                 bytes = min_t(size_t, bytes, fc->max_write - count);
 832
 833  again:
 834                 err = -EFAULT;
 835                 if (iov_iter_fault_in_readable(ii, bytes))
 836                         break;
 837
 838                 err = -ENOMEM;
 839                 page = grab_cache_page_write_begin(mapping, index, 0);
 840                 if (!page)
 841                         break;
 842
 843                 if (mapping_writably_mapped(mapping))
 844                         flush_dcache_page(page);
 845
 846                 pagefault_disable();
 847                 tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
 848                 pagefault_enable();
 849                 flush_dcache_page(page);
 850
 851                 mark_page_accessed(page);
 852
 853                 iov_iter_advance(ii, tmp);
 854                 if (!tmp) {
 855                         unlock_page(page);
 856                         page_cache_release(page);
 857                         bytes = min(bytes, iov_iter_single_seg_count(ii));
 858                         goto again;
 859                 }
 860
 861                 err = 0;
 862                 req->pages[req->num_pages] = page;
 863                 req->num_pages++;
 864
 865                 count += tmp;
 866                 pos += tmp;
 867                 offset += tmp;
 868                 if (offset == PAGE_CACHE_SIZE)
 869                         offset = 0;
 870
 871                 if (!fc->big_writes)
 872                         break;
 873         } while (iov_iter_count(ii) && count < fc->max_write &&
 874                  req->num_pages < FUSE_MAX_PAGES_PER_REQ && offset == 0);
 875
 876         return count > 0 ? count : err;
 877 }
 878
 879 static ssize_t fuse_perform_write(struct file *file,
 880                                   struct address_space *mapping,
 881                                   struct iov_iter *ii, loff_t pos)
 882 {
 883         struct inode *inode = mapping->host;
 884         struct fuse_conn *fc = get_fuse_conn(inode);
 885         struct fuse_inode *fi = get_fuse_inode(inode);
 886         int err = 0;
 887         ssize_t res = 0;
 888
 889         if (is_bad_inode(inode))
 890                 return -EIO;
 891
 892         if (inode->i_size < pos + iov_iter_count(ii))
 893                 set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
 894
 895         do {
 896                 struct fuse_req *req;
 897                 ssize_t count;
 898
 899                 req = fuse_get_req(fc);
 900                 if (IS_ERR(req)) {
 901                         err = PTR_ERR(req);
 902                         break;
 903                 }
 904
 905                 count = fuse_fill_write_pages(req, mapping, ii, pos);
 906                 if (count <= 0) {
 907                         err = count;
 908                 } else {
 909                         size_t num_written;
 910
 911                         num_written = fuse_send_write_pages(req, file, inode,
 912                                                             pos, count);
 913                         err = req->out.h.error;
 914                         if (!err) {
 915                                 res += num_written;
 916                                 pos += num_written;
 917
 918                                 /* break out of the loop on short write */
 919                                 if (num_written != count)
 920                                         err = -EIO;
 921                         }
 922                 }
 923                 fuse_put_request(fc, req);
 924         } while (!err && iov_iter_count(ii));
 925
 926         if (res > 0)
 927                 fuse_write_update_size(inode, pos);
 928
 929         clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
 930         fuse_invalidate_attr(inode);
 931
 932         return res > 0 ? res : err;
 933 }
 934
 935 static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 936                                    unsigned long nr_segs, loff_t pos)
 937 {
 938         struct file *file = iocb->ki_filp;
 939         struct address_space *mapping = file->f_mapping;
 940         size_t count = 0;
 941         ssize_t written = 0;
 942         struct inode *inode = mapping->host;
 943         ssize_t err;
 944         struct iov_iter i;
 945
 946         WARN_ON(iocb->ki_pos != pos);
 947
 948         err = generic_segment_checks(iov, &nr_segs, &count, VERIFY_READ);
 949         if (err)
 950                 return err;
 951
 952         mutex_lock(&inode->i_mutex);
 953         vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
 954
 955         /* We can write back this queue in page reclaim */
 956         current->backing_dev_info = mapping->backing_dev_info;
 957
 958         err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode));
 959         if (err)
 960                 goto out;
 961
 962         if (count == 0)
 963                 goto out;
 964
 965         err = file_remove_suid(file);
 966         if (err)
 967                 goto out;
 968
 969         file_update_time(file);
 970
 971         iov_iter_init(&i, iov, nr_segs, count, 0);
 972         written = fuse_perform_write(file, mapping, &i, pos);
 973         if (written >= 0)
 974                 iocb->ki_pos = pos + written;
 975
 976 out:
 977         current->backing_dev_info = NULL;
 978         mutex_unlock(&inode->i_mutex);
 979
 980         return written ? written : err;
 981 }
 982
 983 static void fuse_release_user_pages(struct fuse_req *req, int write)
 984 {
 985         unsigned i;
 986
 987         for (i = 0; i < req->num_pages; i++) {
 988                 struct page *page = req->pages[i];
 989                 if (write)
 990                         set_page_dirty_lock(page);
 991                 put_page(page);
 992         }
 993 }
 994
 995 static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
 996                                size_t *nbytesp, int write)
 997 {
 998         size_t nbytes = *nbytesp;
 999         unsigned long user_addr = (unsigned long) buf;
1000         unsigned offset = user_addr & ~PAGE_MASK;
1001         int npages;
1002
1003         /* Special case for kernel I/O: can copy directly into the buffer */
1004         if (segment_eq(get_fs(), KERNEL_DS)) {
1005                 if (write)
1006                         req->in.args[1].value = (void *) user_addr;
1007                 else
1008                         req->out.args[0].value = (void *) user_addr;
1009
1010                 return 0;
1011         }
1012
1013         nbytes = min_t(size_t, nbytes, FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
1014         npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1015         npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
1016         npages = get_user_pages_fast(user_addr, npages, !write, req->pages);
1017         if (npages < 0)
1018                 return npages;
1019
1020         req->num_pages = npages;
1021         req->page_offset = offset;
1022
1023         if (write)
1024                 req->in.argpages = 1;
1025         else
1026                 req->out.argpages = 1;
1027
1028         nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
1029         *nbytesp = min(*nbytesp, nbytes);
1030
1031         return 0;
1032 }
1033
1034 ssize_t fuse_direct_io(struct file *file, const char __user *buf,
1035                        size_t count, loff_t *ppos, int write)
1036 {
1037         struct fuse_file *ff = file->private_data;
1038         struct fuse_conn *fc = ff->fc;
1039         size_t nmax = write ? fc->max_write : fc->max_read;
1040         loff_t pos = *ppos;
1041         ssize_t res = 0;
1042         struct fuse_req *req;
1043
1044         req = fuse_get_req(fc);
1045         if (IS_ERR(req))
1046                 return PTR_ERR(req);
1047
1048         while (count) {
1049                 size_t nres;
1050                 fl_owner_t owner = current->files;
1051                 size_t nbytes = min(count, nmax);
1052                 int err = fuse_get_user_pages(req, buf, &nbytes, write);
1053                 if (err) {
1054                         res = err;
1055                         break;
1056                 }
1057
1058                 if (write)
1059                         nres = fuse_send_write(req, file, pos, nbytes, owner);
1060                 else
1061                         nres = fuse_send_read(req, file, pos, nbytes, owner);
1062
1063                 fuse_release_user_pages(req, !write);
1064                 if (req->out.h.error) {
1065                         if (!res)
1066                                 res = req->out.h.error;
1067                         break;
1068                 } else if (nres > nbytes) {
1069                         res = -EIO;
1070                         break;
1071                 }
1072                 count -= nres;
1073                 res += nres;
1074                 pos += nres;
1075                 buf += nres;
1076                 if (nres != nbytes)
1077                         break;
1078                 if (count) {
1079                         fuse_put_request(fc, req);
1080                         req = fuse_get_req(fc);
1081                         if (IS_ERR(req))
1082                                 break;
1083                 }
1084         }
1085         if (!IS_ERR(req))
1086                 fuse_put_request(fc, req);
1087         if (res > 0)
1088                 *ppos = pos;
1089
1090         return res;
1091 }
1092 EXPORT_SYMBOL_GPL(fuse_direct_io);
1093
1094 static ssize_t fuse_direct_read(struct file *file, char __user *buf,
1095                                      size_t count, loff_t *ppos)
1096 {
1097         ssize_t res;
1098         struct inode *inode = file->f_path.dentry->d_inode;
1099
1100         if (is_bad_inode(inode))
1101                 return -EIO;
1102
1103         res = fuse_direct_io(file, buf, count, ppos, 0);
1104
1105         fuse_invalidate_attr(inode);
1106
1107         return res;
1108 }
1109
1110 static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
1111                                  size_t count, loff_t *ppos)
1112 {
1113         struct inode *inode = file->f_path.dentry->d_inode;
1114         ssize_t res;
1115
1116         if (is_bad_inode(inode))
1117                 return -EIO;
1118
1119         /* Don't allow parallel writes to the same file */
1120         mutex_lock(&inode->i_mutex);
1121         res = generic_write_checks(file, ppos, &count, 0);
1122         if (!res) {
1123                 res = fuse_direct_io(file, buf, count, ppos, 1);
1124                 if (res > 0)
1125                         fuse_write_update_size(inode, *ppos);
1126         }
1127         mutex_unlock(&inode->i_mutex);
1128
1129         fuse_invalidate_attr(inode);
1130
1131         return res;
1132 }
1133
1134 static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
1135 {
1136         __free_page(req->pages[0]);
1137         fuse_file_put(req->ff, false);
1138 }
1139
1140 static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
1141 {
1142         struct inode *inode = req->inode;
1143         struct fuse_inode *fi = get_fuse_inode(inode);
1144         struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
1145
1146         list_del(&req->writepages_entry);
1147         dec_bdi_stat(bdi, BDI_WRITEBACK);
1148         dec_zone_page_state(req->pages[0], NR_WRITEBACK_TEMP);
1149         bdi_writeout_inc(bdi);
1150         wake_up(&fi->page_waitq);
1151 }
1152
1153 /* Called under fc->lock, may release and reacquire it */
1154 static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
1155 __releases(fc->lock)
1156 __acquires(fc->lock)
1157 {
1158         struct fuse_inode *fi = get_fuse_inode(req->inode);
1159         loff_t size = i_size_read(req->inode);
1160         struct fuse_write_in *inarg = &req->misc.write.in;
1161
1162         if (!fc->connected)
1163                 goto out_free;
1164
1165         if (inarg->offset + PAGE_CACHE_SIZE <= size) {
1166                 inarg->size = PAGE_CACHE_SIZE;
1167         } else if (inarg->offset < size) {
1168                 inarg->size = size & (PAGE_CACHE_SIZE - 1);
1169         } else {
1170                 /* Got truncated off completely */
1171                 goto out_free;
1172         }
1173
1174         req->in.args[1].size = inarg->size;
1175         fi->writectr++;
1176         fuse_request_send_background_locked(fc, req);
1177         return;
1178
1179  out_free:
1180         fuse_writepage_finish(fc, req);
1181         spin_unlock(&fc->lock);
1182         fuse_writepage_free(fc, req);
1183         fuse_put_request(fc, req);
1184         spin_lock(&fc->lock);
1185 }
1186
1187 /*
1188  * If fi->writectr is positive (no truncate or fsync going on) send
1189  * all queued writepage requests.
1190  *
1191  * Called with fc->lock
1192  */
1193 void fuse_flush_writepages(struct inode *inode)
1194 __releases(fc->lock)
1195 __acquires(fc->lock)
1196 {
1197         struct fuse_conn *fc = get_fuse_conn(inode);
1198         struct fuse_inode *fi = get_fuse_inode(inode);
1199         struct fuse_req *req;
1200
1201         while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
1202                 req = list_entry(fi->queued_writes.next, struct fuse_req, list);
1203                 list_del_init(&req->list);
1204                 fuse_send_writepage(fc, req);
1205         }
1206 }
1207
1208 static void fuse_writepage_end(struct fuse_conn *fc, struct fuse_req *req)
1209 {
1210         struct inode *inode = req->inode;
1211         struct fuse_inode *fi = get_fuse_inode(inode);
1212
1213         mapping_set_error(inode->i_mapping, req->out.h.error);
1214         spin_lock(&fc->lock);
1215         fi->writectr--;
1216         fuse_writepage_finish(fc, req);
1217         spin_unlock(&fc->lock);
1218         fuse_writepage_free(fc, req);
1219 }
1220
1221 static int fuse_writepage_locked(struct page *page)
1222 {
1223         struct address_space *mapping = page->mapping;
1224         struct inode *inode = mapping->host;
1225         struct fuse_conn *fc = get_fuse_conn(inode);
1226         struct fuse_inode *fi = get_fuse_inode(inode);
1227         struct fuse_req *req;
1228         struct fuse_file *ff;
1229         struct page *tmp_page;
1230
1231         set_page_writeback(page);
1232
1233         req = fuse_request_alloc_nofs();
1234         if (!req)
1235                 goto err;
1236
1237         tmp_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
1238         if (!tmp_page)
1239                 goto err_free;
1240
1241         spin_lock(&fc->lock);
1242         BUG_ON(list_empty(&fi->write_files));
1243         ff = list_entry(fi->write_files.next, struct fuse_file, write_entry);
1244         req->ff = fuse_file_get(ff);
1245         spin_unlock(&fc->lock);
1246
1247         fuse_write_fill(req, ff, page_offset(page), 0);
1248
1249         copy_highpage(tmp_page, page);
1250         req->misc.write.in.write_flags |= FUSE_WRITE_CACHE;
1251         req->in.argpages = 1;
1252         req->num_pages = 1;
1253         req->pages[0] = tmp_page;
1254         req->page_offset = 0;
1255         req->end = fuse_writepage_end;
1256         req->inode = inode;
1257
1258         inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
1259         inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
1260
1261         spin_lock(&fc->lock);
1262         list_add(&req->writepages_entry, &fi->writepages);
1263         list_add_tail(&req->list, &fi->queued_writes);
1264         fuse_flush_writepages(inode);
1265         spin_unlock(&fc->lock);
1266
1267         end_page_writeback(page);
1268
1269         return 0;
1270
1271 err_free:
1272         fuse_request_free(req);
1273 err:
1274         end_page_writeback(page);
1275         return -ENOMEM;
1276 }
1277
1278 static int fuse_writepage(struct page *page, struct writeback_control *wbc)
1279 {
1280         int err;
1281
1282         err = fuse_writepage_locked(page);
1283         unlock_page(page);
1284
1285         return err;
1286 }
1287
1288 static int fuse_launder_page(struct page *page)
1289 {
1290         int err = 0;
1291         if (clear_page_dirty_for_io(page)) {
1292                 struct inode *inode = page->mapping->host;
1293                 err = fuse_writepage_locked(page);
1294                 if (!err)
1295                         fuse_wait_on_page_writeback(inode, page->index);
1296         }
1297         return err;
1298 }
1299
1300 /*
1301  * Write back dirty pages now, because there may not be any suitable
1302  * open files later
1303  */
1304 static void fuse_vma_close(struct vm_area_struct *vma)
1305 {
1306         filemap_write_and_wait(vma->vm_file->f_mapping);
1307 }
1308
1309 /*
1310  * Wait for writeback against this page to complete before allowing it
1311  * to be marked dirty again, and hence written back again, possibly
1312  * before the previous writepage completed.
1313  *
1314  * Block here, instead of in ->writepage(), so that the userspace fs
1315  * can only block processes actually operating on the filesystem.
1316  *
1317  * Otherwise unprivileged userspace fs would be able to block
1318  * unrelated:
1319  *
1320  * - page migration
1321  * - sync(2)
1322  * - try_to_free_pages() with order > PAGE_ALLOC_COSTLY_ORDER
1323  */
1324 static int fuse_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
1325 {
1326         struct page *page = vmf->page;
1327         /*
1328          * Don't use page->mapping as it may become NULL from a
1329          * concurrent truncate.
1330          */
1331         struct inode *inode = vma->vm_file->f_mapping->host;
1332
1333         fuse_wait_on_page_writeback(inode, page->index);
1334         return 0;
1335 }
1336
1337 static const struct vm_operations_struct fuse_file_vm_ops = {
1338         .close          = fuse_vma_close,
1339         .fault          = filemap_fault,
1340         .page_mkwrite   = fuse_page_mkwrite,
1341 };
1342
1343 static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma)
1344 {
1345         if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) {
1346                 struct inode *inode = file->f_dentry->d_inode;
1347                 struct fuse_conn *fc = get_fuse_conn(inode);
1348                 struct fuse_inode *fi = get_fuse_inode(inode);
1349                 struct fuse_file *ff = file->private_data;
1350                 /*
1351                  * file may be written through mmap, so chain it onto the
1352                  * inodes's write_file list
1353                  */
1354                 spin_lock(&fc->lock);
1355                 if (list_empty(&ff->write_entry))
1356                         list_add(&ff->write_entry, &fi->write_files);
1357                 spin_unlock(&fc->lock);
1358         }
1359         file_accessed(file);
1360         vma->vm_ops = &fuse_file_vm_ops;
1361         return 0;
1362 }
1363
1364 static int fuse_direct_mmap(struct file *file, struct vm_area_struct *vma)
1365 {
1366         /* Can't provide the coherency needed for MAP_SHARED */
1367         if (vma->vm_flags & VM_MAYSHARE)
1368                 return -ENODEV;
1369
1370         invalidate_inode_pages2(file->f_mapping);
1371
1372         return generic_file_mmap(file, vma);
1373 }
1374
1375 static int convert_fuse_file_lock(const struct fuse_file_lock *ffl,
1376                                   struct file_lock *fl)
1377 {
1378         switch (ffl->type) {
1379         case F_UNLCK:
1380                 break;
1381
1382         case F_RDLCK:
1383         case F_WRLCK:
1384                 if (ffl->start > OFFSET_MAX || ffl->end > OFFSET_MAX ||
1385                     ffl->end < ffl->start)
1386                         return -EIO;
1387
1388                 fl->fl_start = ffl->start;
1389                 fl->fl_end = ffl->end;
1390                 fl->fl_pid = ffl->pid;
1391                 break;
1392
1393         default:
1394                 return -EIO;
1395         }
1396         fl->fl_type = ffl->type;
1397         return 0;
1398 }
1399
1400 static void fuse_lk_fill(struct fuse_req *req, struct file *file,
1401                          const struct file_lock *fl, int opcode, pid_t pid,
1402                          int flock)
1403 {
1404         struct inode *inode = file->f_path.dentry->d_inode;
1405         struct fuse_conn *fc = get_fuse_conn(inode);
1406         struct fuse_file *ff = file->private_data;
1407         struct fuse_lk_in *arg = &req->misc.lk_in;
1408
1409         arg->fh = ff->fh;
1410         arg->owner = fuse_lock_owner_id(fc, fl->fl_owner);
1411         arg->lk.start = fl->fl_start;
1412         arg->lk.end = fl->fl_end;
1413         arg->lk.type = fl->fl_type;
1414         arg->lk.pid = pid;
1415         if (flock)
1416                 arg->lk_flags |= FUSE_LK_FLOCK;
1417         req->in.h.opcode = opcode;
1418         req->in.h.nodeid = get_node_id(inode);
1419         req->in.numargs = 1;
1420         req->in.args[0].size = sizeof(*arg);
1421         req->in.args[0].value = arg;
1422 }
1423
1424 static int fuse_getlk(struct file *file, struct file_lock *fl)
1425 {
1426         struct inode *inode = file->f_path.dentry->d_inode;
1427         struct fuse_conn *fc = get_fuse_conn(inode);
1428         struct fuse_req *req;
1429         struct fuse_lk_out outarg;
1430         int err;
1431
1432         req = fuse_get_req(fc);
1433         if (IS_ERR(req))
1434                 return PTR_ERR(req);
1435
1436         fuse_lk_fill(req, file, fl, FUSE_GETLK, 0, 0);
1437         req->out.numargs = 1;
1438         req->out.args[0].size = sizeof(outarg);
1439         req->out.args[0].value = &outarg;
1440         fuse_request_send(fc, req);
1441         err = req->out.h.error;
1442         fuse_put_request(fc, req);
1443         if (!err)
1444                 err = convert_fuse_file_lock(&outarg.lk, fl);
1445
1446         return err;
1447 }
1448
1449 static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
1450 {
1451         struct inode *inode = file->f_path.dentry->d_inode;
1452         struct fuse_conn *fc = get_fuse_conn(inode);
1453         struct fuse_req *req;
1454         int opcode = (fl->fl_flags & FL_SLEEP) ? FUSE_SETLKW : FUSE_SETLK;
1455         pid_t pid = fl->fl_type != F_UNLCK ? current->tgid : 0;
1456         int err;
1457
1458         if (fl->fl_lmops && fl->fl_lmops->lm_grant) {
1459                 /* NLM needs asynchronous locks, which we don't support yet */
1460                 return -ENOLCK;
1461         }
1462
1463         /* Unlock on close is handled by the flush method */
1464         if (fl->fl_flags & FL_CLOSE)
1465                 return 0;
1466
1467         req = fuse_get_req(fc);
1468         if (IS_ERR(req))
1469                 return PTR_ERR(req);
1470
1471         fuse_lk_fill(req, file, fl, opcode, pid, flock);
1472         fuse_request_send(fc, req);
1473         err = req->out.h.error;
1474         /* locking is restartable */
1475         if (err == -EINTR)
1476                 err = -ERESTARTSYS;
1477         fuse_put_request(fc, req);
1478         return err;
1479 }
1480
1481 static int fuse_file_lock(struct file *file, int cmd, struct file_lock *fl)
1482 {
1483         struct inode *inode = file->f_path.dentry->d_inode;
1484         struct fuse_conn *fc = get_fuse_conn(inode);
1485         int err;
1486
1487         if (cmd == F_CANCELLK) {
1488                 err = 0;
1489         } else if (cmd == F_GETLK) {
1490                 if (fc->no_lock) {
1491                         posix_test_lock(file, fl);
1492                         err = 0;
1493                 } else
1494                         err = fuse_getlk(file, fl);
1495         } else {
1496                 if (fc->no_lock)
1497                         err = posix_lock_file(file, fl, NULL);
1498                 else
1499                         err = fuse_setlk(file, fl, 0);
1500         }
1501         return err;
1502 }
1503
1504 static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
1505 {
1506         struct inode *inode = file->f_path.dentry->d_inode;
1507         struct fuse_conn *fc = get_fuse_conn(inode);
1508         int err;
1509
1510         if (fc->no_flock) {
1511                 err = flock_lock_file_wait(file, fl);
1512         } else {
1513                 struct fuse_file *ff = file->private_data;
1514
1515                 /* emulate flock with POSIX locks */
1516                 fl->fl_owner = (fl_owner_t) file;
1517                 ff->flock = true;
1518                 err = fuse_setlk(file, fl, 1);
1519         }
1520
1521         return err;
1522 }
1523
1524 static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
1525 {
1526         struct inode *inode = mapping->host;
1527         struct fuse_conn *fc = get_fuse_conn(inode);
1528         struct fuse_req *req;
1529         struct fuse_bmap_in inarg;
1530         struct fuse_bmap_out outarg;
1531         int err;
1532
1533         if (!inode->i_sb->s_bdev || fc->no_bmap)
1534                 return 0;
1535
1536         req = fuse_get_req(fc);
1537         if (IS_ERR(req))
1538                 return 0;
1539
1540         memset(&inarg, 0, sizeof(inarg));
1541         inarg.block = block;
1542         inarg.blocksize = inode->i_sb->s_blocksize;
1543         req->in.h.opcode = FUSE_BMAP;
1544         req->in.h.nodeid = get_node_id(inode);
1545         req->in.numargs = 1;
1546         req->in.args[0].size = sizeof(inarg);
1547         req->in.args[0].value = &inarg;
1548         req->out.numargs = 1;
1549         req->out.args[0].size = sizeof(outarg);
1550         req->out.args[0].value = &outarg;
1551         fuse_request_send(fc, req);
1552         err = req->out.h.error;
1553         fuse_put_request(fc, req);
1554         if (err == -ENOSYS)
1555                 fc->no_bmap = 1;
1556
1557         return err ? 0 : outarg.block;
1558 }
1559
1560 static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
1561 {
1562         loff_t retval;
1563         struct inode *inode = file->f_path.dentry->d_inode;
1564
1565         mutex_lock(&inode->i_mutex);
1566         if (origin != SEEK_CUR && origin != SEEK_SET) {
1567                 retval = fuse_update_attributes(inode, NULL, file, NULL);
1568                 if (retval)
1569                         goto exit;
1570         }
1571
1572         switch (origin) {
1573         case SEEK_END:
1574                 offset += i_size_read(inode);
1575                 break;
1576         case SEEK_CUR:
1577                 if (offset == 0) {
1578                         retval = file->f_pos;
1579                         goto exit;
1580                 }
1581                 offset += file->f_pos;
1582                 break;
1583         case SEEK_DATA:
1584                 if (offset >= i_size_read(inode)) {
1585                         retval = -ENXIO;
1586                         goto exit;
1587                 }
1588                 break;
1589         case SEEK_HOLE:
1590                 if (offset >= i_size_read(inode)) {
1591                         retval = -ENXIO;
1592                         goto exit;
1593                 }
1594                 offset = i_size_read(inode);
1595                 break;
1596         }
1597         retval = -EINVAL;
1598         if (offset >= 0 && offset <= inode->i_sb->s_maxbytes) {
1599                 if (offset != file->f_pos) {
1600                         file->f_pos = offset;
1601                         file->f_version = 0;
1602                 }
1603                 retval = offset;
1604         }
1605 exit:
1606         mutex_unlock(&inode->i_mutex);
1607         return retval;
1608 }
1609
1610 static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
1611                         unsigned int nr_segs, size_t bytes, bool to_user)
1612 {
1613         struct iov_iter ii;
1614         int page_idx = 0;
1615
1616         if (!bytes)
1617                 return 0;
1618
1619         iov_iter_init(&ii, iov, nr_segs, bytes, 0);
1620
1621         while (iov_iter_count(&ii)) {
1622                 struct page *page = pages[page_idx++];
1623                 size_t todo = min_t(size_t, PAGE_SIZE, iov_iter_count(&ii));
1624                 void *kaddr;
1625
1626                 kaddr = kmap(page);
1627
1628                 while (todo) {
1629                         char __user *uaddr = ii.iov->iov_base + ii.iov_offset;
1630                         size_t iov_len = ii.iov->iov_len - ii.iov_offset;
1631                         size_t copy = min(todo, iov_len);
1632                         size_t left;
1633
1634                         if (!to_user)
1635                                 left = copy_from_user(kaddr, uaddr, copy);
1636                         else
1637                                 left = copy_to_user(uaddr, kaddr, copy);
1638
1639                         if (unlikely(left))
1640                                 return -EFAULT;
1641
1642                         iov_iter_advance(&ii, copy);
1643                         todo -= copy;
1644                         kaddr += copy;
1645                 }
1646
1647                 kunmap(page);
1648         }
1649
1650         return 0;
1651 }
1652
1653 /*
1654  * CUSE servers compiled on 32bit broke on 64bit kernels because the
1655  * ABI was defined to be 'struct iovec' which is different on 32bit
1656  * and 64bit.  Fortunately we can determine which structure the server
1657  * used from the size of the reply.
1658  */
1659 static int fuse_copy_ioctl_iovec_old(struct iovec *dst, void *src,
1660                                      size_t transferred, unsigned count,
1661                                      bool is_compat)
1662 {
1663 #ifdef CONFIG_COMPAT
1664         if (count * sizeof(struct compat_iovec) == transferred) {
1665                 struct compat_iovec *ciov = src;
1666                 unsigned i;
1667
1668                 /*
1669                  * With this interface a 32bit server cannot support
1670                  * non-compat (i.e. ones coming from 64bit apps) ioctl
1671                  * requests
1672                  */
1673                 if (!is_compat)
1674                         return -EINVAL;
1675
1676                 for (i = 0; i < count; i++) {
1677                         dst[i].iov_base = compat_ptr(ciov[i].iov_base);
1678                         dst[i].iov_len = ciov[i].iov_len;
1679                 }
1680                 return 0;
1681         }
1682 #endif
1683
1684         if (count * sizeof(struct iovec) != transferred)
1685                 return -EIO;
1686
1687         memcpy(dst, src, transferred);
1688         return 0;
1689 }
1690
1691 /* Make sure iov_length() won't overflow */
1692 static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
1693 {
1694         size_t n;
1695         u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;
1696
1697         for (n = 0; n < count; n++, iov++) {
1698                 if (iov->iov_len > (size_t) max)
1699                         return -ENOMEM;
1700                 max -= iov->iov_len;
1701         }
1702         return 0;
1703 }
1704
1705 static int fuse_copy_ioctl_iovec(struct fuse_conn *fc, struct iovec *dst,
1706                                  void *src, size_t transferred, unsigned count,
1707                                  bool is_compat)
1708 {
1709         unsigned i;
1710         struct fuse_ioctl_iovec *fiov = src;
1711
1712         if (fc->minor < 16) {
1713                 return fuse_copy_ioctl_iovec_old(dst, src, transferred,
1714                                                  count, is_compat);
1715         }
1716
1717         if (count * sizeof(struct fuse_ioctl_iovec) != transferred)
1718                 return -EIO;
1719
1720         for (i = 0; i < count; i++) {
1721                 /* Did the server supply an inappropriate value? */
1722                 if (fiov[i].base != (unsigned long) fiov[i].base ||
1723                     fiov[i].len != (unsigned long) fiov[i].len)
1724                         return -EIO;
1725
1726                 dst[i].iov_base = (void __user *) (unsigned long) fiov[i].base;
1727                 dst[i].iov_len = (size_t) fiov[i].len;
1728
1729 #ifdef CONFIG_COMPAT
1730                 if (is_compat &&
1731                     (ptr_to_compat(dst[i].iov_base) != fiov[i].base ||
1732                      (compat_size_t) dst[i].iov_len != fiov[i].len))
1733                         return -EIO;
1734 #endif
1735         }
1736
1737         return 0;
1738 }
1739
1740
1741 /*
1742  * For ioctls, there is no generic way to determine how much memory
1743  * needs to be read and/or written.  Furthermore, ioctls are allowed
1744  * to dereference the passed pointer, so the parameter requires deep
1745  * copying but FUSE has no idea whatsoever about what to copy in or
1746  * out.
1747  *
1748  * This is solved by allowing FUSE server to retry ioctl with
1749  * necessary in/out iovecs.  Let's assume the ioctl implementation
1750  * needs to read in the following structure.
1751  *
1752  * struct a {
1753  *      char    *buf;
1754  *      size_t  buflen;
1755  * }
1756  *
1757  * On the first callout to FUSE server, inarg->in_size and
1758  * inarg->out_size will be NULL; then, the server completes the ioctl
1759  * with FUSE_IOCTL_RETRY set in out->flags, out->in_iovs set to 1 and
1760  * the actual iov array to
1761  *
1762  * { { .iov_base = inarg.arg,   .iov_len = sizeof(struct a) } }
1763  *
1764  * which tells FUSE to copy in the requested area and retry the ioctl.
1765  * On the second round, the server has access to the structure and
1766  * from that it can tell what to look for next, so on the invocation,
1767  * it sets FUSE_IOCTL_RETRY, out->in_iovs to 2 and iov array to
1768  *
1769  * { { .iov_base = inarg.arg,   .iov_len = sizeof(struct a)     },
1770  *   { .iov_base = a.buf,       .iov_len = a.buflen             } }
1771  *
1772  * FUSE will copy both struct a and the pointed buffer from the
1773  * process doing the ioctl and retry ioctl with both struct a and the
1774  * buffer.
1775  *
1776  * This time, FUSE server has everything it needs and completes ioctl
1777  * without FUSE_IOCTL_RETRY which finishes the ioctl call.
1778  *
1779  * Copying data out works the same way.
1780  *
1781  * Note that if FUSE_IOCTL_UNRESTRICTED is clear, the kernel
1782  * automatically initializes in and out iovs by decoding @cmd with
1783  * _IOC_* macros and the server is not allowed to request RETRY.  This
1784  * limits ioctl data transfers to well-formed ioctls and is the forced
1785  * behavior for all FUSE servers.
1786  */
1787 long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
1788                    unsigned int flags)
1789 {
1790         struct fuse_file *ff = file->private_data;
1791         struct fuse_conn *fc = ff->fc;
1792         struct fuse_ioctl_in inarg = {
1793                 .fh = ff->fh,
1794                 .cmd = cmd,
1795                 .arg = arg,
1796                 .flags = flags
1797         };
1798         struct fuse_ioctl_out outarg;
1799         struct fuse_req *req = NULL;
1800         struct page **pages = NULL;
1801         struct iovec *iov_page = NULL;
1802         struct iovec *in_iov = NULL, *out_iov = NULL;
1803         unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages;
1804         size_t in_size, out_size, transferred;
1805         int err;
1806
1807 #if BITS_PER_LONG == 32
1808         inarg.flags |= FUSE_IOCTL_32BIT;
1809 #else
1810         if (flags & FUSE_IOCTL_COMPAT)
1811                 inarg.flags |= FUSE_IOCTL_32BIT;
1812 #endif
1813
1814         /* assume all the iovs returned by client always fits in a page */
1815         BUILD_BUG_ON(sizeof(struct fuse_ioctl_iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);
1816
1817         err = -ENOMEM;
1818         pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL);
1819         iov_page = (struct iovec *) __get_free_page(GFP_KERNEL);
1820         if (!pages || !iov_page)
1821                 goto out;
1822
1823         /*
1824          * If restricted, initialize IO parameters as encoded in @cmd.
1825          * RETRY from server is not allowed.
1826          */
1827         if (!(flags & FUSE_IOCTL_UNRESTRICTED)) {
1828                 struct iovec *iov = iov_page;
1829
1830                 iov->iov_base = (void __user *)arg;
1831                 iov->iov_len = _IOC_SIZE(cmd);
1832
1833                 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1834                         in_iov = iov;
1835                         in_iovs = 1;
1836                 }
1837
1838                 if (_IOC_DIR(cmd) & _IOC_READ) {
1839                         out_iov = iov;
1840                         out_iovs = 1;
1841                 }
1842         }
1843
1844  retry:
1845         inarg.in_size = in_size = iov_length(in_iov, in_iovs);
1846         inarg.out_size = out_size = iov_length(out_iov, out_iovs);
1847
1848         /*
1849          * Out data can be used either for actual out data or iovs,
1850          * make sure there always is at least one page.
1851          */
1852         out_size = max_t(size_t, out_size, PAGE_SIZE);
1853         max_pages = DIV_ROUND_UP(max(in_size, out_size), PAGE_SIZE);
1854
1855         /* make sure there are enough buffer pages and init request with them */
1856         err = -ENOMEM;
1857         if (max_pages > FUSE_MAX_PAGES_PER_REQ)
1858                 goto out;
1859         while (num_pages < max_pages) {
1860                 pages[num_pages] = alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
1861                 if (!pages[num_pages])
1862                         goto out;
1863                 num_pages++;
1864         }
1865
1866         req = fuse_get_req(fc);
1867         if (IS_ERR(req)) {
1868                 err = PTR_ERR(req);
1869                 req = NULL;
1870                 goto out;
1871         }
1872         memcpy(req->pages, pages, sizeof(req->pages[0]) * num_pages);
1873         req->num_pages = num_pages;
1874
1875         /* okay, let's send it to the client */
1876         req->in.h.opcode = FUSE_IOCTL;
1877         req->in.h.nodeid = ff->nodeid;
1878         req->in.numargs = 1;
1879         req->in.args[0].size = sizeof(inarg);
1880         req->in.args[0].value = &inarg;
1881         if (in_size) {
1882                 req->in.numargs++;
1883                 req->in.args[1].size = in_size;
1884                 req->in.argpages = 1;
1885
1886                 err = fuse_ioctl_copy_user(pages, in_iov, in_iovs, in_size,
1887                                            false);
1888                 if (err)
1889                         goto out;
1890         }
1891
1892         req->out.numargs = 2;
1893         req->out.args[0].size = sizeof(outarg);
1894         req->out.args[0].value = &outarg;
1895         req->out.args[1].size = out_size;
1896         req->out.argpages = 1;
1897         req->out.argvar = 1;
1898
1899         fuse_request_send(fc, req);
1900         err = req->out.h.error;
1901         transferred = req->out.args[1].size;
1902         fuse_put_request(fc, req);
1903         req = NULL;
1904         if (err)
1905                 goto out;
1906
1907         /* did it ask for retry? */
1908         if (outarg.flags & FUSE_IOCTL_RETRY) {
1909                 void *vaddr;
1910
1911                 /* no retry if in restricted mode */
1912                 err = -EIO;
1913                 if (!(flags & FUSE_IOCTL_UNRESTRICTED))
1914                         goto out;
1915
1916                 in_iovs = outarg.in_iovs;
1917                 out_iovs = outarg.out_iovs;
1918
1919                 /*
1920                  * Make sure things are in boundary, separate checks
1921                  * are to protect against overflow.
1922                  */
1923                 err = -ENOMEM;
1924                 if (in_iovs > FUSE_IOCTL_MAX_IOV ||
1925                     out_iovs > FUSE_IOCTL_MAX_IOV ||
1926                     in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
1927                         goto out;
1928
1929                 vaddr = kmap_atomic(pages[0], KM_USER0);
1930                 err = fuse_copy_ioctl_iovec(fc, iov_page, vaddr,
1931                                             transferred, in_iovs + out_iovs,
1932                                             (flags & FUSE_IOCTL_COMPAT) != 0);
1933                 kunmap_atomic(vaddr, KM_USER0);
1934                 if (err)
1935                         goto out;
1936
1937                 in_iov = iov_page;
1938                 out_iov = in_iov + in_iovs;
1939
1940                 err = fuse_verify_ioctl_iov(in_iov, in_iovs);
1941                 if (err)
1942                         goto out;
1943
1944                 err = fuse_verify_ioctl_iov(out_iov, out_iovs);
1945                 if (err)
1946                         goto out;
1947
1948                 goto retry;
1949         }
1950
1951         err = -EIO;
1952         if (transferred > inarg.out_size)
1953                 goto out;
1954
1955         err = fuse_ioctl_copy_user(pages, out_iov, out_iovs, transferred, true);
1956  out:
1957         if (req)
1958                 fuse_put_request(fc, req);
1959         free_page((unsigned long) iov_page);
1960         while (num_pages)
1961                 __free_page(pages[--num_pages]);
1962         kfree(pages);
1963
1964         return err ? err : outarg.result;
1965 }
1966 EXPORT_SYMBOL_GPL(fuse_do_ioctl);
1967
1968 static long fuse_file_ioctl_common(struct file *file, unsigned int cmd,
1969                                    unsigned long arg, unsigned int flags)
1970 {
1971         struct inode *inode = file->f_dentry->d_inode;
1972         struct fuse_conn *fc = get_fuse_conn(inode);
1973
1974         if (!fuse_allow_task(fc, current))
1975                 return -EACCES;
1976
1977         if (is_bad_inode(inode))
1978                 return -EIO;
1979
1980         return fuse_do_ioctl(file, cmd, arg, flags);
1981 }
1982
1983 static long fuse_file_ioctl(struct file *file, unsigned int cmd,
1984                             unsigned long arg)
1985 {
1986         return fuse_file_ioctl_common(file, cmd, arg, 0);
1987 }
1988
1989 static long fuse_file_compat_ioctl(struct file *file, unsigned int cmd,
1990                                    unsigned long arg)
1991 {
1992         return fuse_file_ioctl_common(file, cmd, arg, FUSE_IOCTL_COMPAT);
1993 }
1994
1995 /*
1996  * All files which have been polled are linked to RB tree
1997  * fuse_conn->polled_files which is indexed by kh.  Walk the tree and
1998  * find the matching one.
1999  */
2000 static struct rb_node **fuse_find_polled_node(struct fuse_conn *fc, u64 kh,
2001                                               struct rb_node **parent_out)
2002 {
2003         struct rb_node **link = &fc->polled_files.rb_node;
2004         struct rb_node *last = NULL;
2005
2006         while (*link) {
2007                 struct fuse_file *ff;
2008
2009                 last = *link;
2010                 ff = rb_entry(last, struct fuse_file, polled_node);
2011
2012                 if (kh < ff->kh)
2013                         link = &last->rb_left;
2014                 else if (kh > ff->kh)
2015                         link = &last->rb_right;
2016                 else
2017                         return link;
2018         }
2019
2020         if (parent_out)
2021                 *parent_out = last;
2022         return link;
2023 }
2024
2025 /*
2026  * The file is about to be polled.  Make sure it's on the polled_files
2027  * RB tree.  Note that files once added to the polled_files tree are
2028  * not removed before the file is released.  This is because a file
2029  * polled once is likely to be polled again.
2030  */
2031 static void fuse_register_polled_file(struct fuse_conn *fc,
2032                                       struct fuse_file *ff)
2033 {
2034         spin_lock(&fc->lock);
2035         if (RB_EMPTY_NODE(&ff->polled_node)) {
2036                 struct rb_node **link, *parent;
2037
2038                 link = fuse_find_polled_node(fc, ff->kh, &parent);
2039                 BUG_ON(*link);
2040                 rb_link_node(&ff->polled_node, parent, link);
2041                 rb_insert_color(&ff->polled_node, &fc->polled_files);
2042         }
2043         spin_unlock(&fc->lock);
2044 }
2045
2046 unsigned fuse_file_poll(struct file *file, poll_table *wait)
2047 {
2048         struct fuse_file *ff = file->private_data;
2049         struct fuse_conn *fc = ff->fc;
2050         struct fuse_poll_in inarg = { .fh = ff->fh, .kh = ff->kh };
2051         struct fuse_poll_out outarg;
2052         struct fuse_req *req;
2053         int err;
2054
2055         if (fc->no_poll)
2056                 return DEFAULT_POLLMASK;
2057
2058         poll_wait(file, &ff->poll_wait, wait);
2059
2060         /*
2061          * Ask for notification iff there's someone waiting for it.
2062          * The client may ignore the flag and always notify.
2063          */
2064         if (waitqueue_active(&ff->poll_wait)) {
2065                 inarg.flags |= FUSE_POLL_SCHEDULE_NOTIFY;
2066                 fuse_register_polled_file(fc, ff);
2067         }
2068
2069         req = fuse_get_req(fc);
2070         if (IS_ERR(req))
2071                 return POLLERR;
2072
2073         req->in.h.opcode = FUSE_POLL;
2074         req->in.h.nodeid = ff->nodeid;
2075         req->in.numargs = 1;
2076         req->in.args[0].size = sizeof(inarg);
2077         req->in.args[0].value = &inarg;
2078         req->out.numargs = 1;
2079         req->out.args[0].size = sizeof(outarg);
2080         req->out.args[0].value = &outarg;
2081         fuse_request_send(fc, req);
2082         err = req->out.h.error;
2083         fuse_put_request(fc, req);
2084
2085         if (!err)
2086                 return outarg.revents;
2087         if (err == -ENOSYS) {
2088                 fc->no_poll = 1;
2089                 return DEFAULT_POLLMASK;
2090         }
2091         return POLLERR;
2092 }
2093 EXPORT_SYMBOL_GPL(fuse_file_poll);
2094
2095 /*
2096  * This is called from fuse_handle_notify() on FUSE_NOTIFY_POLL and
2097  * wakes up the poll waiters.
2098  */
2099 int fuse_notify_poll_wakeup(struct fuse_conn *fc,
2100                             struct fuse_notify_poll_wakeup_out *outarg)
2101 {
2102         u64 kh = outarg->kh;
2103         struct rb_node **link;
2104
2105         spin_lock(&fc->lock);
2106
2107         link = fuse_find_polled_node(fc, kh, NULL);
2108         if (*link) {
2109                 struct fuse_file *ff;
2110
2111                 ff = rb_entry(*link, struct fuse_file, polled_node);
2112                 wake_up_interruptible_sync(&ff->poll_wait);
2113         }
2114
2115         spin_unlock(&fc->lock);
2116         return 0;
2117 }
2118
2119 static const struct file_operations fuse_file_operations = {
2120         .llseek         = fuse_file_llseek,
2121         .read           = do_sync_read,
2122         .aio_read       = fuse_file_aio_read,
2123         .write          = do_sync_write,
2124         .aio_write      = fuse_file_aio_write,
2125         .mmap           = fuse_file_mmap,
2126         .open           = fuse_open,
2127         .flush          = fuse_flush,
2128         .release        = fuse_release,
2129         .fsync          = fuse_fsync,
2130         .lock           = fuse_file_lock,
2131         .flock          = fuse_file_flock,
2132         .splice_read    = generic_file_splice_read,
2133         .unlocked_ioctl = fuse_file_ioctl,
2134         .compat_ioctl   = fuse_file_compat_ioctl,
2135         .poll           = fuse_file_poll,
2136 };
2137
2138 static const struct file_operations fuse_direct_io_file_operations = {
2139         .llseek         = fuse_file_llseek,
2140         .read           = fuse_direct_read,
2141         .write          = fuse_direct_write,
2142         .mmap           = fuse_direct_mmap,
2143         .open           = fuse_open,
2144         .flush          = fuse_flush,
2145         .release        = fuse_release,
2146         .fsync          = fuse_fsync,
2147         .lock           = fuse_file_lock,
2148         .flock          = fuse_file_flock,
2149         .unlocked_ioctl = fuse_file_ioctl,
2150         .compat_ioctl   = fuse_file_compat_ioctl,
2151         .poll           = fuse_file_poll,
2152         /* no splice_read */
2153 };
2154
2155 static const struct address_space_operations fuse_file_aops  = {
2156         .readpage       = fuse_readpage,
2157         .writepage      = fuse_writepage,
2158         .launder_page   = fuse_launder_page,
2159         .readpages      = fuse_readpages,
2160         .set_page_dirty = __set_page_dirty_nobuffers,
2161         .bmap           = fuse_bmap,
2162 };
2163
2164 void fuse_init_file_inode(struct inode *inode)
2165 {
2166         inode->i_fop = &fuse_file_operations;
2167         inode->i_data.a_ops = &fuse_file_aops;
2168 }