file.c 49.8 KB
Newer Older
M
Miklos Szeredi 已提交
1 2
/*
  FUSE: Filesystem in Userspace
M
Miklos Szeredi 已提交
3
  Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
M
Miklos Szeredi 已提交
4 5 6 7 8 9 10 11 12 13

  This program can be distributed under the terms of the GNU GPL.
  See the file COPYING.
*/

#include "fuse_i.h"

#include <linux/pagemap.h>
#include <linux/slab.h>
#include <linux/kernel.h>
A
Alexey Dobriyan 已提交
14
#include <linux/sched.h>
15
#include <linux/module.h>
16
#include <linux/compat.h>
M
Miklos Szeredi 已提交
17

18
static const struct file_operations fuse_direct_io_file_operations;
19

20 21
static int fuse_send_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
			  int opcode, struct fuse_open_out *outargp)
M
Miklos Szeredi 已提交
22 23
{
	struct fuse_open_in inarg;
M
Miklos Szeredi 已提交
24 25 26
	struct fuse_req *req;
	int err;

27 28 29
	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);
M
Miklos Szeredi 已提交
30 31

	memset(&inarg, 0, sizeof(inarg));
32 33 34
	inarg.flags = file->f_flags & ~(O_CREAT | O_EXCL | O_NOCTTY);
	if (!fc->atomic_o_trunc)
		inarg.flags &= ~O_TRUNC;
35 36
	req->in.h.opcode = opcode;
	req->in.h.nodeid = nodeid;
M
Miklos Szeredi 已提交
37 38 39 40 41 42
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
	req->out.numargs = 1;
	req->out.args[0].size = sizeof(*outargp);
	req->out.args[0].value = outargp;
43
	fuse_request_send(fc, req);
M
Miklos Szeredi 已提交
44 45 46 47 48 49
	err = req->out.h.error;
	fuse_put_request(fc, req);

	return err;
}

T
Tejun Heo 已提交
50
struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
M
Miklos Szeredi 已提交
51 52
{
	struct fuse_file *ff;
T
Tejun Heo 已提交
53

M
Miklos Szeredi 已提交
54
	ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
T
Tejun Heo 已提交
55 56 57
	if (unlikely(!ff))
		return NULL;

58
	ff->fc = fc;
T
Tejun Heo 已提交
59 60 61 62
	ff->reserved_req = fuse_request_alloc();
	if (unlikely(!ff->reserved_req)) {
		kfree(ff);
		return NULL;
M
Miklos Szeredi 已提交
63
	}
T
Tejun Heo 已提交
64 65 66 67 68 69 70 71 72 73

	INIT_LIST_HEAD(&ff->write_entry);
	atomic_set(&ff->count, 0);
	RB_CLEAR_NODE(&ff->polled_node);
	init_waitqueue_head(&ff->poll_wait);

	spin_lock(&fc->lock);
	ff->kh = ++fc->khctr;
	spin_unlock(&fc->lock);

M
Miklos Szeredi 已提交
74 75 76 77 78
	return ff;
}

void fuse_file_free(struct fuse_file *ff)
{
79
	fuse_request_free(ff->reserved_req);
M
Miklos Szeredi 已提交
80 81 82
	kfree(ff);
}

83
struct fuse_file *fuse_file_get(struct fuse_file *ff)
84 85 86 87 88
{
	atomic_inc(&ff->count);
	return ff;
}

M
Miklos Szeredi 已提交
89 90
static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
{
91
	path_put(&req->misc.release.path);
M
Miklos Szeredi 已提交
92 93
}

94 95 96 97
static void fuse_file_put(struct fuse_file *ff)
{
	if (atomic_dec_and_test(&ff->count)) {
		struct fuse_req *req = ff->reserved_req;
98

M
Miklos Szeredi 已提交
99
		req->end = fuse_release_end;
100
		fuse_request_send_background(ff->fc, req);
101 102 103 104
		kfree(ff);
	}
}

105 106
int fuse_do_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
		 bool isdir)
107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132
{
	struct fuse_open_out outarg;
	struct fuse_file *ff;
	int err;
	int opcode = isdir ? FUSE_OPENDIR : FUSE_OPEN;

	ff = fuse_file_alloc(fc);
	if (!ff)
		return -ENOMEM;

	err = fuse_send_open(fc, nodeid, file, opcode, &outarg);
	if (err) {
		fuse_file_free(ff);
		return err;
	}

	if (isdir)
		outarg.open_flags &= ~FOPEN_DIRECT_IO;

	ff->fh = outarg.fh;
	ff->nodeid = nodeid;
	ff->open_flags = outarg.open_flags;
	file->private_data = fuse_file_get(ff);

	return 0;
}
133
EXPORT_SYMBOL_GPL(fuse_do_open);
134

135
void fuse_finish_open(struct inode *inode, struct file *file)
M
Miklos Szeredi 已提交
136
{
137
	struct fuse_file *ff = file->private_data;
138
	struct fuse_conn *fc = get_fuse_conn(inode);
139 140

	if (ff->open_flags & FOPEN_DIRECT_IO)
M
Miklos Szeredi 已提交
141
		file->f_op = &fuse_direct_io_file_operations;
142
	if (!(ff->open_flags & FOPEN_KEEP_CACHE))
M
Miklos Szeredi 已提交
143
		invalidate_inode_pages2(inode->i_mapping);
144
	if (ff->open_flags & FOPEN_NONSEEKABLE)
T
Tejun Heo 已提交
145
		nonseekable_open(inode, file);
146 147 148 149 150 151 152 153 154
	if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
		struct fuse_inode *fi = get_fuse_inode(inode);

		spin_lock(&fc->lock);
		fi->attr_version = ++fc->attr_version;
		i_size_write(inode, 0);
		spin_unlock(&fc->lock);
		fuse_invalidate_attr(inode);
	}
M
Miklos Szeredi 已提交
155 156
}

157
int fuse_open_common(struct inode *inode, struct file *file, bool isdir)
M
Miklos Szeredi 已提交
158
{
T
Tejun Heo 已提交
159
	struct fuse_conn *fc = get_fuse_conn(inode);
M
Miklos Szeredi 已提交
160 161
	int err;

M
Miklos Szeredi 已提交
162 163 164 165
	/* VFS checks this, but only _after_ ->open() */
	if (file->f_flags & O_DIRECT)
		return -EINVAL;

M
Miklos Szeredi 已提交
166 167 168 169
	err = generic_file_open(inode, file);
	if (err)
		return err;

170
	err = fuse_do_open(fc, get_node_id(inode), file, isdir);
M
Miklos Szeredi 已提交
171
	if (err)
172
		return err;
M
Miklos Szeredi 已提交
173

174 175 176
	fuse_finish_open(inode, file);

	return 0;
M
Miklos Szeredi 已提交
177 178
}

179
static void fuse_prepare_release(struct fuse_file *ff, int flags, int opcode)
180
{
181
	struct fuse_conn *fc = ff->fc;
182
	struct fuse_req *req = ff->reserved_req;
183
	struct fuse_release_in *inarg = &req->misc.release.in;
M
Miklos Szeredi 已提交
184

185 186 187 188 189 190 191 192
	spin_lock(&fc->lock);
	list_del(&ff->write_entry);
	if (!RB_EMPTY_NODE(&ff->polled_node))
		rb_erase(&ff->polled_node, &fc->polled_files);
	spin_unlock(&fc->lock);

	wake_up_interruptible_sync(&ff->poll_wait);

M
Miklos Szeredi 已提交
193
	inarg->fh = ff->fh;
M
Miklos Szeredi 已提交
194
	inarg->flags = flags;
195
	req->in.h.opcode = opcode;
196
	req->in.h.nodeid = ff->nodeid;
M
Miklos Szeredi 已提交
197 198 199
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(struct fuse_release_in);
	req->in.args[0].value = inarg;
M
Miklos Szeredi 已提交
200 201
}

202
void fuse_release_common(struct file *file, int opcode)
M
Miklos Szeredi 已提交
203
{
T
Tejun Heo 已提交
204 205
	struct fuse_file *ff;
	struct fuse_req *req;
M
Miklos Szeredi 已提交
206

T
Tejun Heo 已提交
207 208
	ff = file->private_data;
	if (unlikely(!ff))
209
		return;
T
Tejun Heo 已提交
210 211

	req = ff->reserved_req;
212
	fuse_prepare_release(ff, file->f_flags, opcode);
T
Tejun Heo 已提交
213 214

	/* Hold vfsmount and dentry until release is finished */
215 216
	path_get(&file->f_path);
	req->misc.release.path = file->f_path;
T
Tejun Heo 已提交
217 218 219 220 221 222 223

	/*
	 * Normally this will send the RELEASE request, however if
	 * some asynchronous READ or WRITE requests are outstanding,
	 * the sending will be delayed.
	 */
	fuse_file_put(ff);
M
Miklos Szeredi 已提交
224 225
}

226 227
static int fuse_open(struct inode *inode, struct file *file)
{
228
	return fuse_open_common(inode, file, false);
229 230 231 232
}

static int fuse_release(struct inode *inode, struct file *file)
{
233 234 235 236 237 238 239 240 241 242 243 244 245 246
	fuse_release_common(file, FUSE_RELEASE);

	/* return value is ignored by VFS */
	return 0;
}

void fuse_sync_release(struct fuse_file *ff, int flags)
{
	WARN_ON(atomic_read(&ff->count) > 1);
	fuse_prepare_release(ff, flags, FUSE_RELEASE);
	ff->reserved_req->force = 1;
	fuse_request_send(ff->fc, ff->reserved_req);
	fuse_put_request(ff->fc, ff->reserved_req);
	kfree(ff);
247
}
248
EXPORT_SYMBOL_GPL(fuse_sync_release);
249

250
/*
251 252
 * Scramble the ID space with XTEA, so that the value of the files_struct
 * pointer is not exposed to userspace.
253
 */
254
u64 fuse_lock_owner_id(struct fuse_conn *fc, fl_owner_t id)
255
{
256 257 258 259 260 261 262 263 264 265 266 267 268 269
	u32 *k = fc->scramble_key;
	u64 v = (unsigned long) id;
	u32 v0 = v;
	u32 v1 = v >> 32;
	u32 sum = 0;
	int i;

	for (i = 0; i < 32; i++) {
		v0 += ((v1 << 4 ^ v1 >> 5) + v1) ^ (sum + k[sum & 3]);
		sum += 0x9E3779B9;
		v1 += ((v0 << 4 ^ v0 >> 5) + v0) ^ (sum + k[sum>>11 & 3]);
	}

	return (u64) v0 + ((u64) v1 << 32);
270 271
}

M
Miklos Szeredi 已提交
272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
/*
 * Check if page is under writeback
 *
 * This is currently done by walking the list of writepage requests
 * for the inode, which can be pretty inefficient.
 */
static bool fuse_page_is_writeback(struct inode *inode, pgoff_t index)
{
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_inode *fi = get_fuse_inode(inode);
	struct fuse_req *req;
	bool found = false;

	spin_lock(&fc->lock);
	list_for_each_entry(req, &fi->writepages, writepages_entry) {
		pgoff_t curr_index;

		BUG_ON(req->inode != inode);
		curr_index = req->misc.write.in.offset >> PAGE_CACHE_SHIFT;
		if (curr_index == index) {
			found = true;
			break;
		}
	}
	spin_unlock(&fc->lock);

	return found;
}

/*
 * Wait for page writeback to be completed.
 *
 * Since fuse doesn't rely on the VM writeback tracking, this has to
 * use some other means.
 */
static int fuse_wait_on_page_writeback(struct inode *inode, pgoff_t index)
{
	struct fuse_inode *fi = get_fuse_inode(inode);

	wait_event(fi->page_waitq, !fuse_page_is_writeback(inode, index));
	return 0;
}

315
static int fuse_flush(struct file *file, fl_owner_t id)
M
Miklos Szeredi 已提交
316
{
J
Josef Sipek 已提交
317
	struct inode *inode = file->f_path.dentry->d_inode;
M
Miklos Szeredi 已提交
318 319 320 321 322 323
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_file *ff = file->private_data;
	struct fuse_req *req;
	struct fuse_flush_in inarg;
	int err;

324 325 326
	if (is_bad_inode(inode))
		return -EIO;

M
Miklos Szeredi 已提交
327 328 329
	if (fc->no_flush)
		return 0;

330
	req = fuse_get_req_nofail(fc, file);
M
Miklos Szeredi 已提交
331 332
	memset(&inarg, 0, sizeof(inarg));
	inarg.fh = ff->fh;
333
	inarg.lock_owner = fuse_lock_owner_id(fc, id);
M
Miklos Szeredi 已提交
334 335 336 337 338
	req->in.h.opcode = FUSE_FLUSH;
	req->in.h.nodeid = get_node_id(inode);
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
339
	req->force = 1;
340
	fuse_request_send(fc, req);
M
Miklos Szeredi 已提交
341 342 343 344 345 346 347 348 349
	err = req->out.h.error;
	fuse_put_request(fc, req);
	if (err == -ENOSYS) {
		fc->no_flush = 1;
		err = 0;
	}
	return err;
}

M
Miklos Szeredi 已提交
350 351 352 353 354 355 356 357 358 359 360 361 362 363 364
/*
 * Wait for all pending writepages on the inode to finish.
 *
 * This is currently done by blocking further writes with FUSE_NOWRITE
 * and waiting for all sent writes to complete.
 *
 * This must be called under i_mutex, otherwise the FUSE_NOWRITE usage
 * could conflict with truncation.
 */
static void fuse_sync_writes(struct inode *inode)
{
	fuse_set_nowrite(inode);
	fuse_release_nowrite(inode);
}

365
int fuse_fsync_common(struct file *file, int datasync, int isdir)
M
Miklos Szeredi 已提交
366
{
367
	struct inode *inode = file->f_mapping->host;
M
Miklos Szeredi 已提交
368 369 370 371 372 373
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_file *ff = file->private_data;
	struct fuse_req *req;
	struct fuse_fsync_in inarg;
	int err;

374 375 376
	if (is_bad_inode(inode))
		return -EIO;

377
	if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
M
Miklos Szeredi 已提交
378 379
		return 0;

M
Miklos Szeredi 已提交
380 381 382 383 384 385 386 387 388 389 390
	/*
	 * Start writeback against all dirty pages of the inode, then
	 * wait for all outstanding writes, before sending the FSYNC
	 * request.
	 */
	err = write_inode_now(inode, 0);
	if (err)
		return err;

	fuse_sync_writes(inode);

391 392 393
	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);
M
Miklos Szeredi 已提交
394 395 396 397

	memset(&inarg, 0, sizeof(inarg));
	inarg.fh = ff->fh;
	inarg.fsync_flags = datasync ? 1 : 0;
398
	req->in.h.opcode = isdir ? FUSE_FSYNCDIR : FUSE_FSYNC;
M
Miklos Szeredi 已提交
399 400 401 402
	req->in.h.nodeid = get_node_id(inode);
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
403
	fuse_request_send(fc, req);
M
Miklos Szeredi 已提交
404 405 406
	err = req->out.h.error;
	fuse_put_request(fc, req);
	if (err == -ENOSYS) {
407 408 409 410
		if (isdir)
			fc->no_fsyncdir = 1;
		else
			fc->no_fsync = 1;
M
Miklos Szeredi 已提交
411 412 413 414 415
		err = 0;
	}
	return err;
}

416
static int fuse_fsync(struct file *file, int datasync)
417
{
418
	return fuse_fsync_common(file, datasync, 0);
419 420
}

421 422
void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
		    size_t count, int opcode)
M
Miklos Szeredi 已提交
423
{
424
	struct fuse_read_in *inarg = &req->misc.read.in;
425
	struct fuse_file *ff = file->private_data;
M
Miklos Szeredi 已提交
426

427 428 429
	inarg->fh = ff->fh;
	inarg->offset = pos;
	inarg->size = count;
430
	inarg->flags = file->f_flags;
431
	req->in.h.opcode = opcode;
432
	req->in.h.nodeid = ff->nodeid;
M
Miklos Szeredi 已提交
433 434
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(struct fuse_read_in);
435
	req->in.args[0].value = inarg;
M
Miklos Szeredi 已提交
436 437 438 439 440
	req->out.argvar = 1;
	req->out.numargs = 1;
	req->out.args[0].size = count;
}

441
static size_t fuse_send_read(struct fuse_req *req, struct file *file,
442
			     loff_t pos, size_t count, fl_owner_t owner)
443
{
444 445
	struct fuse_file *ff = file->private_data;
	struct fuse_conn *fc = ff->fc;
446

447
	fuse_read_fill(req, file, pos, count, FUSE_READ);
448
	if (owner != NULL) {
449
		struct fuse_read_in *inarg = &req->misc.read.in;
450 451 452 453

		inarg->read_flags |= FUSE_READ_LOCKOWNER;
		inarg->lock_owner = fuse_lock_owner_id(fc, owner);
	}
454
	fuse_request_send(fc, req);
455
	return req->out.args[0].size;
456 457
}

458 459 460 461 462 463 464 465 466 467 468 469 470 471
static void fuse_read_update_size(struct inode *inode, loff_t size,
				  u64 attr_ver)
{
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_inode *fi = get_fuse_inode(inode);

	spin_lock(&fc->lock);
	if (attr_ver == fi->attr_version && size < inode->i_size) {
		fi->attr_version = ++fc->attr_version;
		i_size_write(inode, size);
	}
	spin_unlock(&fc->lock);
}

M
Miklos Szeredi 已提交
472 473 474 475
static int fuse_readpage(struct file *file, struct page *page)
{
	struct inode *inode = page->mapping->host;
	struct fuse_conn *fc = get_fuse_conn(inode);
476
	struct fuse_req *req;
477 478 479 480
	size_t num_read;
	loff_t pos = page_offset(page);
	size_t count = PAGE_CACHE_SIZE;
	u64 attr_ver;
481 482 483 484 485 486
	int err;

	err = -EIO;
	if (is_bad_inode(inode))
		goto out;

M
Miklos Szeredi 已提交
487 488 489 490 491 492 493
	/*
	 * Page writeback can extend beyond the liftime of the
	 * page-cache page, so make sure we read a properly synced
	 * page.
	 */
	fuse_wait_on_page_writeback(inode, page->index);

494 495 496
	req = fuse_get_req(fc);
	err = PTR_ERR(req);
	if (IS_ERR(req))
M
Miklos Szeredi 已提交
497 498
		goto out;

499 500
	attr_ver = fuse_get_attr_version(fc);

M
Miklos Szeredi 已提交
501
	req->out.page_zeroing = 1;
502
	req->out.argpages = 1;
M
Miklos Szeredi 已提交
503 504
	req->num_pages = 1;
	req->pages[0] = page;
505
	num_read = fuse_send_read(req, file, pos, count, NULL);
M
Miklos Szeredi 已提交
506 507
	err = req->out.h.error;
	fuse_put_request(fc, req);
508 509 510 511 512 513 514 515

	if (!err) {
		/*
		 * Short read means EOF.  If file size is larger, truncate it
		 */
		if (num_read < count)
			fuse_read_update_size(inode, pos + num_read, attr_ver);

M
Miklos Szeredi 已提交
516
		SetPageUptodate(page);
517 518
	}

519
	fuse_invalidate_attr(inode); /* atime changed */
M
Miklos Szeredi 已提交
520 521 522 523 524
 out:
	unlock_page(page);
	return err;
}

525
static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
526
{
527
	int i;
528 529
	size_t count = req->misc.read.in.size;
	size_t num_read = req->out.args[0].size;
530
	struct address_space *mapping = NULL;
531

532 533
	for (i = 0; mapping == NULL && i < req->num_pages; i++)
		mapping = req->pages[i]->mapping;
534

535 536 537 538 539 540 541 542 543 544 545 546 547 548 549
	if (mapping) {
		struct inode *inode = mapping->host;

		/*
		 * Short read means EOF. If file size is larger, truncate it
		 */
		if (!req->out.h.error && num_read < count) {
			loff_t pos;

			pos = page_offset(req->pages[0]) + num_read;
			fuse_read_update_size(inode, pos,
					      req->misc.read.attr_ver);
		}
		fuse_invalidate_attr(inode); /* atime changed */
	}
550

551 552 553 554
	for (i = 0; i < req->num_pages; i++) {
		struct page *page = req->pages[i];
		if (!req->out.h.error)
			SetPageUptodate(page);
555 556
		else
			SetPageError(page);
557
		unlock_page(page);
558
		page_cache_release(page);
559
	}
560 561
	if (req->ff)
		fuse_file_put(req->ff);
562 563
}

564
static void fuse_send_readpages(struct fuse_req *req, struct file *file)
565
{
566 567
	struct fuse_file *ff = file->private_data;
	struct fuse_conn *fc = ff->fc;
568 569
	loff_t pos = page_offset(req->pages[0]);
	size_t count = req->num_pages << PAGE_CACHE_SHIFT;
570 571

	req->out.argpages = 1;
572
	req->out.page_zeroing = 1;
573
	req->out.page_replace = 1;
574
	fuse_read_fill(req, file, pos, count, FUSE_READ);
575
	req->misc.read.attr_ver = fuse_get_attr_version(fc);
576
	if (fc->async_read) {
577
		req->ff = fuse_file_get(ff);
578
		req->end = fuse_readpages_end;
579
		fuse_request_send_background(fc, req);
580
	} else {
581
		fuse_request_send(fc, req);
582
		fuse_readpages_end(fc, req);
583
		fuse_put_request(fc, req);
584
	}
585 586
}

587
struct fuse_fill_data {
588
	struct fuse_req *req;
589
	struct file *file;
590 591 592 593 594
	struct inode *inode;
};

static int fuse_readpages_fill(void *_data, struct page *page)
{
595
	struct fuse_fill_data *data = _data;
596 597 598 599
	struct fuse_req *req = data->req;
	struct inode *inode = data->inode;
	struct fuse_conn *fc = get_fuse_conn(inode);

M
Miklos Szeredi 已提交
600 601
	fuse_wait_on_page_writeback(inode, page->index);

602 603 604 605
	if (req->num_pages &&
	    (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
	     (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
	     req->pages[req->num_pages - 1]->index + 1 != page->index)) {
606
		fuse_send_readpages(req, data->file);
607 608
		data->req = req = fuse_get_req(fc);
		if (IS_ERR(req)) {
609
			unlock_page(page);
610
			return PTR_ERR(req);
611 612
		}
	}
613
	page_cache_get(page);
614
	req->pages[req->num_pages] = page;
M
Miklos Szeredi 已提交
615
	req->num_pages++;
616 617 618 619 620 621 622 623
	return 0;
}

static int fuse_readpages(struct file *file, struct address_space *mapping,
			  struct list_head *pages, unsigned nr_pages)
{
	struct inode *inode = mapping->host;
	struct fuse_conn *fc = get_fuse_conn(inode);
624
	struct fuse_fill_data data;
625
	int err;
626

627
	err = -EIO;
628
	if (is_bad_inode(inode))
629
		goto out;
630

631
	data.file = file;
632
	data.inode = inode;
633
	data.req = fuse_get_req(fc);
634
	err = PTR_ERR(data.req);
635
	if (IS_ERR(data.req))
636
		goto out;
637 638

	err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
639 640
	if (!err) {
		if (data.req->num_pages)
641
			fuse_send_readpages(data.req, file);
642 643 644
		else
			fuse_put_request(fc, data.req);
	}
645
out:
646
	return err;
647 648
}

M
Miklos Szeredi 已提交
649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667
static ssize_t fuse_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
				  unsigned long nr_segs, loff_t pos)
{
	struct inode *inode = iocb->ki_filp->f_mapping->host;

	if (pos + iov_length(iov, nr_segs) > i_size_read(inode)) {
		int err;
		/*
		 * If trying to read past EOF, make sure the i_size
		 * attribute is up-to-date.
		 */
		err = fuse_update_attributes(inode, NULL, iocb->ki_filp, NULL);
		if (err)
			return err;
	}

	return generic_file_aio_read(iocb, iov, nr_segs, pos);
}

668
static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
669
			    loff_t pos, size_t count)
M
Miklos Szeredi 已提交
670
{
671 672
	struct fuse_write_in *inarg = &req->misc.write.in;
	struct fuse_write_out *outarg = &req->misc.write.out;
M
Miklos Szeredi 已提交
673

674 675 676
	inarg->fh = ff->fh;
	inarg->offset = pos;
	inarg->size = count;
M
Miklos Szeredi 已提交
677
	req->in.h.opcode = FUSE_WRITE;
678
	req->in.h.nodeid = ff->nodeid;
M
Miklos Szeredi 已提交
679
	req->in.numargs = 2;
680
	if (ff->fc->minor < 9)
681 682 683
		req->in.args[0].size = FUSE_COMPAT_WRITE_IN_SIZE;
	else
		req->in.args[0].size = sizeof(struct fuse_write_in);
684
	req->in.args[0].value = inarg;
M
Miklos Szeredi 已提交
685 686 687
	req->in.args[1].size = count;
	req->out.numargs = 1;
	req->out.args[0].size = sizeof(struct fuse_write_out);
688 689 690 691
	req->out.args[0].value = outarg;
}

static size_t fuse_send_write(struct fuse_req *req, struct file *file,
692
			      loff_t pos, size_t count, fl_owner_t owner)
693
{
694 695
	struct fuse_file *ff = file->private_data;
	struct fuse_conn *fc = ff->fc;
696 697
	struct fuse_write_in *inarg = &req->misc.write.in;

698
	fuse_write_fill(req, ff, pos, count);
699
	inarg->flags = file->f_flags;
700 701 702 703
	if (owner != NULL) {
		inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
		inarg->lock_owner = fuse_lock_owner_id(fc, owner);
	}
704
	fuse_request_send(fc, req);
705
	return req->misc.write.out.size;
M
Miklos Szeredi 已提交
706 707
}

N
Nick Piggin 已提交
708 709 710
static int fuse_write_begin(struct file *file, struct address_space *mapping,
			loff_t pos, unsigned len, unsigned flags,
			struct page **pagep, void **fsdata)
M
Miklos Szeredi 已提交
711
{
N
Nick Piggin 已提交
712 713
	pgoff_t index = pos >> PAGE_CACHE_SHIFT;

714
	*pagep = grab_cache_page_write_begin(mapping, index, flags);
N
Nick Piggin 已提交
715 716
	if (!*pagep)
		return -ENOMEM;
M
Miklos Szeredi 已提交
717 718 719
	return 0;
}

M
Miklos Szeredi 已提交
720
void fuse_write_update_size(struct inode *inode, loff_t pos)
721 722 723 724 725 726 727 728 729 730 731
{
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_inode *fi = get_fuse_inode(inode);

	spin_lock(&fc->lock);
	fi->attr_version = ++fc->attr_version;
	if (pos > inode->i_size)
		i_size_write(inode, pos);
	spin_unlock(&fc->lock);
}

N
Nick Piggin 已提交
732 733
static int fuse_buffered_write(struct file *file, struct inode *inode,
			       loff_t pos, unsigned count, struct page *page)
M
Miklos Szeredi 已提交
734 735
{
	int err;
736
	size_t nres;
M
Miklos Szeredi 已提交
737
	struct fuse_conn *fc = get_fuse_conn(inode);
N
Nick Piggin 已提交
738
	unsigned offset = pos & (PAGE_CACHE_SIZE - 1);
739 740 741 742 743
	struct fuse_req *req;

	if (is_bad_inode(inode))
		return -EIO;

M
Miklos Szeredi 已提交
744 745 746 747 748 749
	/*
	 * Make sure writepages on the same page are not mixed up with
	 * plain writes.
	 */
	fuse_wait_on_page_writeback(inode, page->index);

750 751 752
	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);
M
Miklos Szeredi 已提交
753

754
	req->in.argpages = 1;
M
Miklos Szeredi 已提交
755 756 757
	req->num_pages = 1;
	req->pages[0] = page;
	req->page_offset = offset;
758
	nres = fuse_send_write(req, file, pos, count, NULL);
M
Miklos Szeredi 已提交
759 760
	err = req->out.h.error;
	fuse_put_request(fc, req);
N
Nick Piggin 已提交
761
	if (!err && !nres)
M
Miklos Szeredi 已提交
762 763
		err = -EIO;
	if (!err) {
N
Nick Piggin 已提交
764
		pos += nres;
765
		fuse_write_update_size(inode, pos);
N
Nick Piggin 已提交
766
		if (count == PAGE_CACHE_SIZE)
M
Miklos Szeredi 已提交
767
			SetPageUptodate(page);
768 769
	}
	fuse_invalidate_attr(inode);
N
Nick Piggin 已提交
770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785
	return err ? err : nres;
}

static int fuse_write_end(struct file *file, struct address_space *mapping,
			loff_t pos, unsigned len, unsigned copied,
			struct page *page, void *fsdata)
{
	struct inode *inode = mapping->host;
	int res = 0;

	if (copied)
		res = fuse_buffered_write(file, inode, pos, copied, page);

	unlock_page(page);
	page_cache_release(page);
	return res;
M
Miklos Szeredi 已提交
786 787
}

N
Nick Piggin 已提交
788 789 790 791 792 793 794 795 796 797 798
static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file,
				    struct inode *inode, loff_t pos,
				    size_t count)
{
	size_t res;
	unsigned offset;
	unsigned i;

	for (i = 0; i < req->num_pages; i++)
		fuse_wait_on_page_writeback(inode, req->pages[i]->index);

799
	res = fuse_send_write(req, file, pos, count, NULL);
N
Nick Piggin 已提交
800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830

	offset = req->page_offset;
	count = res;
	for (i = 0; i < req->num_pages; i++) {
		struct page *page = req->pages[i];

		if (!req->out.h.error && !offset && count >= PAGE_CACHE_SIZE)
			SetPageUptodate(page);

		if (count > PAGE_CACHE_SIZE - offset)
			count -= PAGE_CACHE_SIZE - offset;
		else
			count = 0;
		offset = 0;

		unlock_page(page);
		page_cache_release(page);
	}

	return res;
}

static ssize_t fuse_fill_write_pages(struct fuse_req *req,
			       struct address_space *mapping,
			       struct iov_iter *ii, loff_t pos)
{
	struct fuse_conn *fc = get_fuse_conn(mapping->host);
	unsigned offset = pos & (PAGE_CACHE_SIZE - 1);
	size_t count = 0;
	int err;

831
	req->in.argpages = 1;
N
Nick Piggin 已提交
832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848
	req->page_offset = offset;

	do {
		size_t tmp;
		struct page *page;
		pgoff_t index = pos >> PAGE_CACHE_SHIFT;
		size_t bytes = min_t(size_t, PAGE_CACHE_SIZE - offset,
				     iov_iter_count(ii));

		bytes = min_t(size_t, bytes, fc->max_write - count);

 again:
		err = -EFAULT;
		if (iov_iter_fault_in_readable(ii, bytes))
			break;

		err = -ENOMEM;
849
		page = grab_cache_page_write_begin(mapping, index, 0);
N
Nick Piggin 已提交
850 851 852
		if (!page)
			break;

853 854 855
		if (mapping_writably_mapped(mapping))
			flush_dcache_page(page);

N
Nick Piggin 已提交
856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878
		pagefault_disable();
		tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
		pagefault_enable();
		flush_dcache_page(page);

		if (!tmp) {
			unlock_page(page);
			page_cache_release(page);
			bytes = min(bytes, iov_iter_single_seg_count(ii));
			goto again;
		}

		err = 0;
		req->pages[req->num_pages] = page;
		req->num_pages++;

		iov_iter_advance(ii, tmp);
		count += tmp;
		pos += tmp;
		offset += tmp;
		if (offset == PAGE_CACHE_SIZE)
			offset = 0;

879 880
		if (!fc->big_writes)
			break;
N
Nick Piggin 已提交
881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967
	} while (iov_iter_count(ii) && count < fc->max_write &&
		 req->num_pages < FUSE_MAX_PAGES_PER_REQ && offset == 0);

	return count > 0 ? count : err;
}

static ssize_t fuse_perform_write(struct file *file,
				  struct address_space *mapping,
				  struct iov_iter *ii, loff_t pos)
{
	struct inode *inode = mapping->host;
	struct fuse_conn *fc = get_fuse_conn(inode);
	int err = 0;
	ssize_t res = 0;

	if (is_bad_inode(inode))
		return -EIO;

	do {
		struct fuse_req *req;
		ssize_t count;

		req = fuse_get_req(fc);
		if (IS_ERR(req)) {
			err = PTR_ERR(req);
			break;
		}

		count = fuse_fill_write_pages(req, mapping, ii, pos);
		if (count <= 0) {
			err = count;
		} else {
			size_t num_written;

			num_written = fuse_send_write_pages(req, file, inode,
							    pos, count);
			err = req->out.h.error;
			if (!err) {
				res += num_written;
				pos += num_written;

				/* break out of the loop on short write */
				if (num_written != count)
					err = -EIO;
			}
		}
		fuse_put_request(fc, req);
	} while (!err && iov_iter_count(ii));

	if (res > 0)
		fuse_write_update_size(inode, pos);

	fuse_invalidate_attr(inode);

	return res > 0 ? res : err;
}

static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
				   unsigned long nr_segs, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct address_space *mapping = file->f_mapping;
	size_t count = 0;
	ssize_t written = 0;
	struct inode *inode = mapping->host;
	ssize_t err;
	struct iov_iter i;

	WARN_ON(iocb->ki_pos != pos);

	err = generic_segment_checks(iov, &nr_segs, &count, VERIFY_READ);
	if (err)
		return err;

	mutex_lock(&inode->i_mutex);
	vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);

	/* We can write back this queue in page reclaim */
	current->backing_dev_info = mapping->backing_dev_info;

	err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode));
	if (err)
		goto out;

	if (count == 0)
		goto out;

968
	err = file_remove_suid(file);
N
Nick Piggin 已提交
969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985
	if (err)
		goto out;

	file_update_time(file);

	iov_iter_init(&i, iov, nr_segs, count, 0);
	written = fuse_perform_write(file, mapping, &i, pos);
	if (written >= 0)
		iocb->ki_pos = pos + written;

out:
	current->backing_dev_info = NULL;
	mutex_unlock(&inode->i_mutex);

	return written ? written : err;
}

M
Miklos Szeredi 已提交
986 987 988 989 990 991 992 993 994 995 996 997 998
static void fuse_release_user_pages(struct fuse_req *req, int write)
{
	unsigned i;

	for (i = 0; i < req->num_pages; i++) {
		struct page *page = req->pages[i];
		if (write)
			set_page_dirty_lock(page);
		put_page(page);
	}
}

static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
999
			       size_t *nbytesp, int write)
M
Miklos Szeredi 已提交
1000
{
1001
	size_t nbytes = *nbytesp;
M
Miklos Szeredi 已提交
1002 1003 1004 1005
	unsigned long user_addr = (unsigned long) buf;
	unsigned offset = user_addr & ~PAGE_MASK;
	int npages;

1006 1007 1008 1009 1010 1011 1012 1013 1014
	/* Special case for kernel I/O: can copy directly into the buffer */
	if (segment_eq(get_fs(), KERNEL_DS)) {
		if (write)
			req->in.args[1].value = (void *) user_addr;
		else
			req->out.args[0].value = (void *) user_addr;

		return 0;
	}
M
Miklos Szeredi 已提交
1015

1016
	nbytes = min_t(size_t, nbytes, FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
M
Miklos Szeredi 已提交
1017
	npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1018
	npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
M
Miklos Szeredi 已提交
1019
	npages = get_user_pages_fast(user_addr, npages, !write, req->pages);
M
Miklos Szeredi 已提交
1020 1021 1022 1023 1024
	if (npages < 0)
		return npages;

	req->num_pages = npages;
	req->page_offset = offset;
1025 1026 1027 1028 1029 1030 1031 1032 1033

	if (write)
		req->in.argpages = 1;
	else
		req->out.argpages = 1;

	nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
	*nbytesp = min(*nbytesp, nbytes);

M
Miklos Szeredi 已提交
1034 1035 1036
	return 0;
}

1037 1038
ssize_t fuse_direct_io(struct file *file, const char __user *buf,
		       size_t count, loff_t *ppos, int write)
M
Miklos Szeredi 已提交
1039
{
1040 1041
	struct fuse_file *ff = file->private_data;
	struct fuse_conn *fc = ff->fc;
M
Miklos Szeredi 已提交
1042 1043 1044
	size_t nmax = write ? fc->max_write : fc->max_read;
	loff_t pos = *ppos;
	ssize_t res = 0;
1045 1046
	struct fuse_req *req;

1047 1048 1049
	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);
M
Miklos Szeredi 已提交
1050 1051 1052

	while (count) {
		size_t nres;
1053
		fl_owner_t owner = current->files;
1054 1055
		size_t nbytes = min(count, nmax);
		int err = fuse_get_user_pages(req, buf, &nbytes, write);
M
Miklos Szeredi 已提交
1056 1057 1058 1059
		if (err) {
			res = err;
			break;
		}
1060

M
Miklos Szeredi 已提交
1061
		if (write)
1062
			nres = fuse_send_write(req, file, pos, nbytes, owner);
M
Miklos Szeredi 已提交
1063
		else
1064 1065
			nres = fuse_send_read(req, file, pos, nbytes, owner);

M
Miklos Szeredi 已提交
1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
		fuse_release_user_pages(req, !write);
		if (req->out.h.error) {
			if (!res)
				res = req->out.h.error;
			break;
		} else if (nres > nbytes) {
			res = -EIO;
			break;
		}
		count -= nres;
		res += nres;
		pos += nres;
		buf += nres;
		if (nres != nbytes)
			break;
1081 1082 1083 1084 1085 1086
		if (count) {
			fuse_put_request(fc, req);
			req = fuse_get_req(fc);
			if (IS_ERR(req))
				break;
		}
M
Miklos Szeredi 已提交
1087
	}
1088 1089
	if (!IS_ERR(req))
		fuse_put_request(fc, req);
1090
	if (res > 0)
M
Miklos Szeredi 已提交
1091 1092 1093 1094
		*ppos = pos;

	return res;
}
1095
EXPORT_SYMBOL_GPL(fuse_direct_io);
M
Miklos Szeredi 已提交
1096 1097 1098 1099

static ssize_t fuse_direct_read(struct file *file, char __user *buf,
				     size_t count, loff_t *ppos)
{
1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110
	ssize_t res;
	struct inode *inode = file->f_path.dentry->d_inode;

	if (is_bad_inode(inode))
		return -EIO;

	res = fuse_direct_io(file, buf, count, ppos, 0);

	fuse_invalidate_attr(inode);

	return res;
M
Miklos Szeredi 已提交
1111 1112 1113 1114 1115
}

static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
				 size_t count, loff_t *ppos)
{
J
Josef Sipek 已提交
1116
	struct inode *inode = file->f_path.dentry->d_inode;
M
Miklos Szeredi 已提交
1117
	ssize_t res;
1118 1119 1120 1121

	if (is_bad_inode(inode))
		return -EIO;

M
Miklos Szeredi 已提交
1122
	/* Don't allow parallel writes to the same file */
1123
	mutex_lock(&inode->i_mutex);
1124
	res = generic_write_checks(file, ppos, &count, 0);
1125
	if (!res) {
1126
		res = fuse_direct_io(file, buf, count, ppos, 1);
1127 1128 1129
		if (res > 0)
			fuse_write_update_size(inode, *ppos);
	}
1130
	mutex_unlock(&inode->i_mutex);
1131 1132 1133

	fuse_invalidate_attr(inode);

M
Miklos Szeredi 已提交
1134 1135 1136
	return res;
}

M
Miklos Szeredi 已提交
1137
static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
1138
{
M
Miklos Szeredi 已提交
1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157
	__free_page(req->pages[0]);
	fuse_file_put(req->ff);
}

static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
{
	struct inode *inode = req->inode;
	struct fuse_inode *fi = get_fuse_inode(inode);
	struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;

	list_del(&req->writepages_entry);
	dec_bdi_stat(bdi, BDI_WRITEBACK);
	dec_zone_page_state(req->pages[0], NR_WRITEBACK_TEMP);
	bdi_writeout_inc(bdi);
	wake_up(&fi->page_waitq);
}

/* Called under fc->lock, may release and reacquire it */
static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
1158 1159
__releases(fc->lock)
__acquires(fc->lock)
M
Miklos Szeredi 已提交
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174
{
	struct fuse_inode *fi = get_fuse_inode(req->inode);
	loff_t size = i_size_read(req->inode);
	struct fuse_write_in *inarg = &req->misc.write.in;

	if (!fc->connected)
		goto out_free;

	if (inarg->offset + PAGE_CACHE_SIZE <= size) {
		inarg->size = PAGE_CACHE_SIZE;
	} else if (inarg->offset < size) {
		inarg->size = size & (PAGE_CACHE_SIZE - 1);
	} else {
		/* Got truncated off completely */
		goto out_free;
M
Miklos Szeredi 已提交
1175
	}
M
Miklos Szeredi 已提交
1176 1177 1178

	req->in.args[1].size = inarg->size;
	fi->writectr++;
1179
	fuse_request_send_background_locked(fc, req);
M
Miklos Szeredi 已提交
1180 1181 1182 1183 1184 1185
	return;

 out_free:
	fuse_writepage_finish(fc, req);
	spin_unlock(&fc->lock);
	fuse_writepage_free(fc, req);
1186
	fuse_put_request(fc, req);
M
Miklos Szeredi 已提交
1187
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
1188 1189
}

M
Miklos Szeredi 已提交
1190 1191 1192 1193 1194 1195 1196
/*
 * If fi->writectr is positive (no truncate or fsync going on) send
 * all queued writepage requests.
 *
 * Called with fc->lock
 */
void fuse_flush_writepages(struct inode *inode)
M
Miklos Szeredi 已提交
1197 1198
__releases(fc->lock)
__acquires(fc->lock)
M
Miklos Szeredi 已提交
1199
{
M
Miklos Szeredi 已提交
1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_inode *fi = get_fuse_inode(inode);
	struct fuse_req *req;

	while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
		req = list_entry(fi->queued_writes.next, struct fuse_req, list);
		list_del_init(&req->list);
		fuse_send_writepage(fc, req);
	}
}

static void fuse_writepage_end(struct fuse_conn *fc, struct fuse_req *req)
{
	struct inode *inode = req->inode;
	struct fuse_inode *fi = get_fuse_inode(inode);

	mapping_set_error(inode->i_mapping, req->out.h.error);
	spin_lock(&fc->lock);
	fi->writectr--;
	fuse_writepage_finish(fc, req);
	spin_unlock(&fc->lock);
	fuse_writepage_free(fc, req);
}

static int fuse_writepage_locked(struct page *page)
{
	struct address_space *mapping = page->mapping;
	struct inode *inode = mapping->host;
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_inode *fi = get_fuse_inode(inode);
	struct fuse_req *req;
	struct fuse_file *ff;
	struct page *tmp_page;

	set_page_writeback(page);

	req = fuse_request_alloc_nofs();
	if (!req)
		goto err;

	tmp_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
	if (!tmp_page)
		goto err_free;

	spin_lock(&fc->lock);
	BUG_ON(list_empty(&fi->write_files));
	ff = list_entry(fi->write_files.next, struct fuse_file, write_entry);
	req->ff = fuse_file_get(ff);
	spin_unlock(&fc->lock);

1250
	fuse_write_fill(req, ff, page_offset(page), 0);
M
Miklos Szeredi 已提交
1251 1252

	copy_highpage(tmp_page, page);
1253
	req->misc.write.in.write_flags |= FUSE_WRITE_CACHE;
1254
	req->in.argpages = 1;
M
Miklos Szeredi 已提交
1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325
	req->num_pages = 1;
	req->pages[0] = tmp_page;
	req->page_offset = 0;
	req->end = fuse_writepage_end;
	req->inode = inode;

	inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
	inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
	end_page_writeback(page);

	spin_lock(&fc->lock);
	list_add(&req->writepages_entry, &fi->writepages);
	list_add_tail(&req->list, &fi->queued_writes);
	fuse_flush_writepages(inode);
	spin_unlock(&fc->lock);

	return 0;

err_free:
	fuse_request_free(req);
err:
	end_page_writeback(page);
	return -ENOMEM;
}

static int fuse_writepage(struct page *page, struct writeback_control *wbc)
{
	int err;

	err = fuse_writepage_locked(page);
	unlock_page(page);

	return err;
}

static int fuse_launder_page(struct page *page)
{
	int err = 0;
	if (clear_page_dirty_for_io(page)) {
		struct inode *inode = page->mapping->host;
		err = fuse_writepage_locked(page);
		if (!err)
			fuse_wait_on_page_writeback(inode, page->index);
	}
	return err;
}

/*
 * Write back dirty pages now, because there may not be any suitable
 * open files later
 */
static void fuse_vma_close(struct vm_area_struct *vma)
{
	filemap_write_and_wait(vma->vm_file->f_mapping);
}

/*
 * Wait for writeback against this page to complete before allowing it
 * to be marked dirty again, and hence written back again, possibly
 * before the previous writepage completed.
 *
 * Block here, instead of in ->writepage(), so that the userspace fs
 * can only block processes actually operating on the filesystem.
 *
 * Otherwise unprivileged userspace fs would be able to block
 * unrelated:
 *
 * - page migration
 * - sync(2)
 * - try_to_free_pages() with order > PAGE_ALLOC_COSTLY_ORDER
 */
1326
static int fuse_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
M
Miklos Szeredi 已提交
1327
{
1328
	struct page *page = vmf->page;
M
Miklos Szeredi 已提交
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338
	/*
	 * Don't use page->mapping as it may become NULL from a
	 * concurrent truncate.
	 */
	struct inode *inode = vma->vm_file->f_mapping->host;

	fuse_wait_on_page_writeback(inode, page->index);
	return 0;
}

1339
static const struct vm_operations_struct fuse_file_vm_ops = {
M
Miklos Szeredi 已提交
1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362
	.close		= fuse_vma_close,
	.fault		= filemap_fault,
	.page_mkwrite	= fuse_page_mkwrite,
};

static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma)
{
	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) {
		struct inode *inode = file->f_dentry->d_inode;
		struct fuse_conn *fc = get_fuse_conn(inode);
		struct fuse_inode *fi = get_fuse_inode(inode);
		struct fuse_file *ff = file->private_data;
		/*
		 * file may be written through mmap, so chain it onto the
		 * inodes's write_file list
		 */
		spin_lock(&fc->lock);
		if (list_empty(&ff->write_entry))
			list_add(&ff->write_entry, &fi->write_files);
		spin_unlock(&fc->lock);
	}
	file_accessed(file);
	vma->vm_ops = &fuse_file_vm_ops;
M
Miklos Szeredi 已提交
1363 1364 1365
	return 0;
}

1366 1367 1368 1369 1370 1371
static int fuse_direct_mmap(struct file *file, struct vm_area_struct *vma)
{
	/* Can't provide the coherency needed for MAP_SHARED */
	if (vma->vm_flags & VM_MAYSHARE)
		return -ENODEV;

1372 1373
	invalidate_inode_pages2(file->f_mapping);

1374 1375 1376
	return generic_file_mmap(file, vma);
}

1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402
static int convert_fuse_file_lock(const struct fuse_file_lock *ffl,
				  struct file_lock *fl)
{
	switch (ffl->type) {
	case F_UNLCK:
		break;

	case F_RDLCK:
	case F_WRLCK:
		if (ffl->start > OFFSET_MAX || ffl->end > OFFSET_MAX ||
		    ffl->end < ffl->start)
			return -EIO;

		fl->fl_start = ffl->start;
		fl->fl_end = ffl->end;
		fl->fl_pid = ffl->pid;
		break;

	default:
		return -EIO;
	}
	fl->fl_type = ffl->type;
	return 0;
}

static void fuse_lk_fill(struct fuse_req *req, struct file *file,
1403 1404
			 const struct file_lock *fl, int opcode, pid_t pid,
			 int flock)
1405
{
J
Josef Sipek 已提交
1406
	struct inode *inode = file->f_path.dentry->d_inode;
1407
	struct fuse_conn *fc = get_fuse_conn(inode);
1408 1409 1410 1411
	struct fuse_file *ff = file->private_data;
	struct fuse_lk_in *arg = &req->misc.lk_in;

	arg->fh = ff->fh;
1412
	arg->owner = fuse_lock_owner_id(fc, fl->fl_owner);
1413 1414 1415 1416
	arg->lk.start = fl->fl_start;
	arg->lk.end = fl->fl_end;
	arg->lk.type = fl->fl_type;
	arg->lk.pid = pid;
1417 1418
	if (flock)
		arg->lk_flags |= FUSE_LK_FLOCK;
1419 1420 1421 1422 1423 1424 1425 1426 1427
	req->in.h.opcode = opcode;
	req->in.h.nodeid = get_node_id(inode);
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(*arg);
	req->in.args[0].value = arg;
}

static int fuse_getlk(struct file *file, struct file_lock *fl)
{
J
Josef Sipek 已提交
1428
	struct inode *inode = file->f_path.dentry->d_inode;
1429 1430 1431 1432 1433 1434 1435 1436 1437
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_req *req;
	struct fuse_lk_out outarg;
	int err;

	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);

1438
	fuse_lk_fill(req, file, fl, FUSE_GETLK, 0, 0);
1439 1440 1441
	req->out.numargs = 1;
	req->out.args[0].size = sizeof(outarg);
	req->out.args[0].value = &outarg;
1442
	fuse_request_send(fc, req);
1443 1444 1445 1446 1447 1448 1449 1450
	err = req->out.h.error;
	fuse_put_request(fc, req);
	if (!err)
		err = convert_fuse_file_lock(&outarg.lk, fl);

	return err;
}

1451
static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
1452
{
J
Josef Sipek 已提交
1453
	struct inode *inode = file->f_path.dentry->d_inode;
1454 1455 1456 1457 1458 1459
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_req *req;
	int opcode = (fl->fl_flags & FL_SLEEP) ? FUSE_SETLKW : FUSE_SETLK;
	pid_t pid = fl->fl_type != F_UNLCK ? current->tgid : 0;
	int err;

M
Miklos Szeredi 已提交
1460 1461 1462 1463 1464
	if (fl->fl_lmops && fl->fl_lmops->fl_grant) {
		/* NLM needs asynchronous locks, which we don't support yet */
		return -ENOLCK;
	}

1465 1466 1467 1468 1469 1470 1471 1472
	/* Unlock on close is handled by the flush method */
	if (fl->fl_flags & FL_CLOSE)
		return 0;

	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return PTR_ERR(req);

1473
	fuse_lk_fill(req, file, fl, opcode, pid, flock);
1474
	fuse_request_send(fc, req);
1475
	err = req->out.h.error;
1476 1477 1478
	/* locking is restartable */
	if (err == -EINTR)
		err = -ERESTARTSYS;
1479 1480 1481 1482 1483 1484
	fuse_put_request(fc, req);
	return err;
}

static int fuse_file_lock(struct file *file, int cmd, struct file_lock *fl)
{
J
Josef Sipek 已提交
1485
	struct inode *inode = file->f_path.dentry->d_inode;
1486 1487 1488
	struct fuse_conn *fc = get_fuse_conn(inode);
	int err;

M
Miklos Szeredi 已提交
1489 1490 1491
	if (cmd == F_CANCELLK) {
		err = 0;
	} else if (cmd == F_GETLK) {
1492
		if (fc->no_lock) {
1493
			posix_test_lock(file, fl);
1494 1495 1496 1497 1498
			err = 0;
		} else
			err = fuse_getlk(file, fl);
	} else {
		if (fc->no_lock)
M
Miklos Szeredi 已提交
1499
			err = posix_lock_file(file, fl, NULL);
1500
		else
1501
			err = fuse_setlk(file, fl, 0);
1502 1503 1504 1505
	}
	return err;
}

1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522
static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
{
	struct inode *inode = file->f_path.dentry->d_inode;
	struct fuse_conn *fc = get_fuse_conn(inode);
	int err;

	if (fc->no_lock) {
		err = flock_lock_file_wait(file, fl);
	} else {
		/* emulate flock with POSIX locks */
		fl->fl_owner = (fl_owner_t) file;
		err = fuse_setlk(file, fl, 1);
	}

	return err;
}

M
Miklos Szeredi 已提交
1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549
static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
{
	struct inode *inode = mapping->host;
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_req *req;
	struct fuse_bmap_in inarg;
	struct fuse_bmap_out outarg;
	int err;

	if (!inode->i_sb->s_bdev || fc->no_bmap)
		return 0;

	req = fuse_get_req(fc);
	if (IS_ERR(req))
		return 0;

	memset(&inarg, 0, sizeof(inarg));
	inarg.block = block;
	inarg.blocksize = inode->i_sb->s_blocksize;
	req->in.h.opcode = FUSE_BMAP;
	req->in.h.nodeid = get_node_id(inode);
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
	req->out.numargs = 1;
	req->out.args[0].size = sizeof(outarg);
	req->out.args[0].value = &outarg;
1550
	fuse_request_send(fc, req);
M
Miklos Szeredi 已提交
1551 1552 1553 1554 1555 1556 1557 1558
	err = req->out.h.error;
	fuse_put_request(fc, req);
	if (err == -ENOSYS)
		fc->no_bmap = 1;

	return err ? 0 : outarg.block;
}

M
Miklos Szeredi 已提交
1559 1560 1561 1562 1563 1564 1565 1566
static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
{
	loff_t retval;
	struct inode *inode = file->f_path.dentry->d_inode;

	mutex_lock(&inode->i_mutex);
	switch (origin) {
	case SEEK_END:
M
Miklos Szeredi 已提交
1567 1568
		retval = fuse_update_attributes(inode, NULL, file, NULL);
		if (retval)
1569
			goto exit;
M
Miklos Szeredi 已提交
1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582
		offset += i_size_read(inode);
		break;
	case SEEK_CUR:
		offset += file->f_pos;
	}
	retval = -EINVAL;
	if (offset >= 0 && offset <= inode->i_sb->s_maxbytes) {
		if (offset != file->f_pos) {
			file->f_pos = offset;
			file->f_version = 0;
		}
		retval = offset;
	}
1583
exit:
M
Miklos Szeredi 已提交
1584 1585 1586 1587
	mutex_unlock(&inode->i_mutex);
	return retval;
}

T
Tejun Heo 已提交
1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601
static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
			unsigned int nr_segs, size_t bytes, bool to_user)
{
	struct iov_iter ii;
	int page_idx = 0;

	if (!bytes)
		return 0;

	iov_iter_init(&ii, iov, nr_segs, bytes, 0);

	while (iov_iter_count(&ii)) {
		struct page *page = pages[page_idx++];
		size_t todo = min_t(size_t, PAGE_SIZE, iov_iter_count(&ii));
D
Dan Carpenter 已提交
1602
		void *kaddr;
T
Tejun Heo 已提交
1603

D
Dan Carpenter 已提交
1604
		kaddr = kmap(page);
T
Tejun Heo 已提交
1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624

		while (todo) {
			char __user *uaddr = ii.iov->iov_base + ii.iov_offset;
			size_t iov_len = ii.iov->iov_len - ii.iov_offset;
			size_t copy = min(todo, iov_len);
			size_t left;

			if (!to_user)
				left = copy_from_user(kaddr, uaddr, copy);
			else
				left = copy_to_user(uaddr, kaddr, copy);

			if (unlikely(left))
				return -EFAULT;

			iov_iter_advance(&ii, copy);
			todo -= copy;
			kaddr += copy;
		}

1625
		kunmap(page);
T
Tejun Heo 已提交
1626 1627 1628 1629 1630
	}

	return 0;
}

1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668
/*
 * CUSE servers compiled on 32bit broke on 64bit kernels because the
 * ABI was defined to be 'struct iovec' which is different on 32bit
 * and 64bit.  Fortunately we can determine which structure the server
 * used from the size of the reply.
 */
static int fuse_copy_ioctl_iovec(struct iovec *dst, void *src,
				 size_t transferred, unsigned count,
				 bool is_compat)
{
#ifdef CONFIG_COMPAT
	if (count * sizeof(struct compat_iovec) == transferred) {
		struct compat_iovec *ciov = src;
		unsigned i;

		/*
		 * With this interface a 32bit server cannot support
		 * non-compat (i.e. ones coming from 64bit apps) ioctl
		 * requests
		 */
		if (!is_compat)
			return -EINVAL;

		for (i = 0; i < count; i++) {
			dst[i].iov_base = compat_ptr(ciov[i].iov_base);
			dst[i].iov_len = ciov[i].iov_len;
		}
		return 0;
	}
#endif

	if (count * sizeof(struct iovec) != transferred)
		return -EIO;

	memcpy(dst, src, transferred);
	return 0;
}

M
Miklos Szeredi 已提交
1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682
/* Make sure iov_length() won't overflow */
static int fuse_verify_ioctl_iov(struct iovec *iov, size_t count)
{
	size_t n;
	u32 max = FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT;

	for (n = 0; n < count; n++) {
		if (iov->iov_len > (size_t) max)
			return -ENOMEM;
		max -= iov->iov_len;
	}
	return 0;
}

T
Tejun Heo 已提交
1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728
/*
 * For ioctls, there is no generic way to determine how much memory
 * needs to be read and/or written.  Furthermore, ioctls are allowed
 * to dereference the passed pointer, so the parameter requires deep
 * copying but FUSE has no idea whatsoever about what to copy in or
 * out.
 *
 * This is solved by allowing FUSE server to retry ioctl with
 * necessary in/out iovecs.  Let's assume the ioctl implementation
 * needs to read in the following structure.
 *
 * struct a {
 *	char	*buf;
 *	size_t	buflen;
 * }
 *
 * On the first callout to FUSE server, inarg->in_size and
 * inarg->out_size will be NULL; then, the server completes the ioctl
 * with FUSE_IOCTL_RETRY set in out->flags, out->in_iovs set to 1 and
 * the actual iov array to
 *
 * { { .iov_base = inarg.arg,	.iov_len = sizeof(struct a) } }
 *
 * which tells FUSE to copy in the requested area and retry the ioctl.
 * On the second round, the server has access to the structure and
 * from that it can tell what to look for next, so on the invocation,
 * it sets FUSE_IOCTL_RETRY, out->in_iovs to 2 and iov array to
 *
 * { { .iov_base = inarg.arg,	.iov_len = sizeof(struct a)	},
 *   { .iov_base = a.buf,	.iov_len = a.buflen		} }
 *
 * FUSE will copy both struct a and the pointed buffer from the
 * process doing the ioctl and retry ioctl with both struct a and the
 * buffer.
 *
 * This time, FUSE server has everything it needs and completes ioctl
 * without FUSE_IOCTL_RETRY which finishes the ioctl call.
 *
 * Copying data out works the same way.
 *
 * Note that if FUSE_IOCTL_UNRESTRICTED is clear, the kernel
 * automatically initializes in and out iovs by decoding @cmd with
 * _IOC_* macros and the server is not allowed to request RETRY.  This
 * limits ioctl data transfers to well-formed ioctls and is the forced
 * behavior for all FUSE servers.
 */
1729 1730
long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
		   unsigned int flags)
T
Tejun Heo 已提交
1731 1732
{
	struct fuse_file *ff = file->private_data;
1733
	struct fuse_conn *fc = ff->fc;
T
Tejun Heo 已提交
1734 1735 1736 1737 1738 1739 1740 1741 1742
	struct fuse_ioctl_in inarg = {
		.fh = ff->fh,
		.cmd = cmd,
		.arg = arg,
		.flags = flags
	};
	struct fuse_ioctl_out outarg;
	struct fuse_req *req = NULL;
	struct page **pages = NULL;
M
Miklos Szeredi 已提交
1743
	struct iovec *iov_page = NULL;
T
Tejun Heo 已提交
1744 1745 1746 1747 1748 1749 1750 1751 1752 1753
	struct iovec *in_iov = NULL, *out_iov = NULL;
	unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages;
	size_t in_size, out_size, transferred;
	int err;

	/* assume all the iovs returned by client always fits in a page */
	BUILD_BUG_ON(sizeof(struct iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);

	err = -ENOMEM;
	pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL);
M
Miklos Szeredi 已提交
1754
	iov_page = (struct iovec *) __get_free_page(GFP_KERNEL);
T
Tejun Heo 已提交
1755 1756 1757 1758 1759 1760 1761 1762
	if (!pages || !iov_page)
		goto out;

	/*
	 * If restricted, initialize IO parameters as encoded in @cmd.
	 * RETRY from server is not allowed.
	 */
	if (!(flags & FUSE_IOCTL_UNRESTRICTED)) {
M
Miklos Szeredi 已提交
1763
		struct iovec *iov = iov_page;
T
Tejun Heo 已提交
1764

M
Miklos Szeredi 已提交
1765
		iov->iov_base = (void __user *)arg;
T
Tejun Heo 已提交
1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811
		iov->iov_len = _IOC_SIZE(cmd);

		if (_IOC_DIR(cmd) & _IOC_WRITE) {
			in_iov = iov;
			in_iovs = 1;
		}

		if (_IOC_DIR(cmd) & _IOC_READ) {
			out_iov = iov;
			out_iovs = 1;
		}
	}

 retry:
	inarg.in_size = in_size = iov_length(in_iov, in_iovs);
	inarg.out_size = out_size = iov_length(out_iov, out_iovs);

	/*
	 * Out data can be used either for actual out data or iovs,
	 * make sure there always is at least one page.
	 */
	out_size = max_t(size_t, out_size, PAGE_SIZE);
	max_pages = DIV_ROUND_UP(max(in_size, out_size), PAGE_SIZE);

	/* make sure there are enough buffer pages and init request with them */
	err = -ENOMEM;
	if (max_pages > FUSE_MAX_PAGES_PER_REQ)
		goto out;
	while (num_pages < max_pages) {
		pages[num_pages] = alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
		if (!pages[num_pages])
			goto out;
		num_pages++;
	}

	req = fuse_get_req(fc);
	if (IS_ERR(req)) {
		err = PTR_ERR(req);
		req = NULL;
		goto out;
	}
	memcpy(req->pages, pages, sizeof(req->pages[0]) * num_pages);
	req->num_pages = num_pages;

	/* okay, let's send it to the client */
	req->in.h.opcode = FUSE_IOCTL;
1812
	req->in.h.nodeid = ff->nodeid;
T
Tejun Heo 已提交
1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
	if (in_size) {
		req->in.numargs++;
		req->in.args[1].size = in_size;
		req->in.argpages = 1;

		err = fuse_ioctl_copy_user(pages, in_iov, in_iovs, in_size,
					   false);
		if (err)
			goto out;
	}

	req->out.numargs = 2;
	req->out.args[0].size = sizeof(outarg);
	req->out.args[0].value = &outarg;
	req->out.args[1].size = out_size;
	req->out.argpages = 1;
	req->out.argvar = 1;

1834
	fuse_request_send(fc, req);
T
Tejun Heo 已提交
1835 1836 1837 1838 1839 1840 1841 1842 1843
	err = req->out.h.error;
	transferred = req->out.args[1].size;
	fuse_put_request(fc, req);
	req = NULL;
	if (err)
		goto out;

	/* did it ask for retry? */
	if (outarg.flags & FUSE_IOCTL_RETRY) {
M
Miklos Szeredi 已提交
1844
		void *vaddr;
T
Tejun Heo 已提交
1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864

		/* no retry if in restricted mode */
		err = -EIO;
		if (!(flags & FUSE_IOCTL_UNRESTRICTED))
			goto out;

		in_iovs = outarg.in_iovs;
		out_iovs = outarg.out_iovs;

		/*
		 * Make sure things are in boundary, separate checks
		 * are to protect against overflow.
		 */
		err = -ENOMEM;
		if (in_iovs > FUSE_IOCTL_MAX_IOV ||
		    out_iovs > FUSE_IOCTL_MAX_IOV ||
		    in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
			goto out;

		vaddr = kmap_atomic(pages[0], KM_USER0);
M
Miklos Szeredi 已提交
1865
		err = fuse_copy_ioctl_iovec(iov_page, vaddr,
1866 1867
					    transferred, in_iovs + out_iovs,
					    (flags & FUSE_IOCTL_COMPAT) != 0);
T
Tejun Heo 已提交
1868
		kunmap_atomic(vaddr, KM_USER0);
1869 1870
		if (err)
			goto out;
T
Tejun Heo 已提交
1871

M
Miklos Szeredi 已提交
1872
		in_iov = iov_page;
T
Tejun Heo 已提交
1873 1874
		out_iov = in_iov + in_iovs;

M
Miklos Szeredi 已提交
1875 1876 1877 1878 1879 1880 1881 1882
		err = fuse_verify_ioctl_iov(in_iov, in_iovs);
		if (err)
			goto out;

		err = fuse_verify_ioctl_iov(out_iov, out_iovs);
		if (err)
			goto out;

T
Tejun Heo 已提交
1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893
		goto retry;
	}

	err = -EIO;
	if (transferred > inarg.out_size)
		goto out;

	err = fuse_ioctl_copy_user(pages, out_iov, out_iovs, transferred, true);
 out:
	if (req)
		fuse_put_request(fc, req);
M
Miklos Szeredi 已提交
1894
	free_page((unsigned long) iov_page);
T
Tejun Heo 已提交
1895 1896 1897 1898 1899 1900
	while (num_pages)
		__free_page(pages[--num_pages]);
	kfree(pages);

	return err ? err : outarg.result;
}
1901
EXPORT_SYMBOL_GPL(fuse_do_ioctl);
T
Tejun Heo 已提交
1902

1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917
static long fuse_file_ioctl_common(struct file *file, unsigned int cmd,
				   unsigned long arg, unsigned int flags)
{
	struct inode *inode = file->f_dentry->d_inode;
	struct fuse_conn *fc = get_fuse_conn(inode);

	if (!fuse_allow_task(fc, current))
		return -EACCES;

	if (is_bad_inode(inode))
		return -EIO;

	return fuse_do_ioctl(file, cmd, arg, flags);
}

T
Tejun Heo 已提交
1918 1919 1920
static long fuse_file_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg)
{
1921
	return fuse_file_ioctl_common(file, cmd, arg, 0);
T
Tejun Heo 已提交
1922 1923 1924 1925 1926
}

static long fuse_file_compat_ioctl(struct file *file, unsigned int cmd,
				   unsigned long arg)
{
1927
	return fuse_file_ioctl_common(file, cmd, arg, FUSE_IOCTL_COMPAT);
T
Tejun Heo 已提交
1928 1929
}

T
Tejun Heo 已提交
1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980
/*
 * All files which have been polled are linked to RB tree
 * fuse_conn->polled_files which is indexed by kh.  Walk the tree and
 * find the matching one.
 */
static struct rb_node **fuse_find_polled_node(struct fuse_conn *fc, u64 kh,
					      struct rb_node **parent_out)
{
	struct rb_node **link = &fc->polled_files.rb_node;
	struct rb_node *last = NULL;

	while (*link) {
		struct fuse_file *ff;

		last = *link;
		ff = rb_entry(last, struct fuse_file, polled_node);

		if (kh < ff->kh)
			link = &last->rb_left;
		else if (kh > ff->kh)
			link = &last->rb_right;
		else
			return link;
	}

	if (parent_out)
		*parent_out = last;
	return link;
}

/*
 * The file is about to be polled.  Make sure it's on the polled_files
 * RB tree.  Note that files once added to the polled_files tree are
 * not removed before the file is released.  This is because a file
 * polled once is likely to be polled again.
 */
static void fuse_register_polled_file(struct fuse_conn *fc,
				      struct fuse_file *ff)
{
	spin_lock(&fc->lock);
	if (RB_EMPTY_NODE(&ff->polled_node)) {
		struct rb_node **link, *parent;

		link = fuse_find_polled_node(fc, ff->kh, &parent);
		BUG_ON(*link);
		rb_link_node(&ff->polled_node, parent, link);
		rb_insert_color(&ff->polled_node, &fc->polled_files);
	}
	spin_unlock(&fc->lock);
}

1981
unsigned fuse_file_poll(struct file *file, poll_table *wait)
T
Tejun Heo 已提交
1982 1983
{
	struct fuse_file *ff = file->private_data;
1984
	struct fuse_conn *fc = ff->fc;
T
Tejun Heo 已提交
1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005
	struct fuse_poll_in inarg = { .fh = ff->fh, .kh = ff->kh };
	struct fuse_poll_out outarg;
	struct fuse_req *req;
	int err;

	if (fc->no_poll)
		return DEFAULT_POLLMASK;

	poll_wait(file, &ff->poll_wait, wait);

	/*
	 * Ask for notification iff there's someone waiting for it.
	 * The client may ignore the flag and always notify.
	 */
	if (waitqueue_active(&ff->poll_wait)) {
		inarg.flags |= FUSE_POLL_SCHEDULE_NOTIFY;
		fuse_register_polled_file(fc, ff);
	}

	req = fuse_get_req(fc);
	if (IS_ERR(req))
2006
		return POLLERR;
T
Tejun Heo 已提交
2007 2008

	req->in.h.opcode = FUSE_POLL;
2009
	req->in.h.nodeid = ff->nodeid;
T
Tejun Heo 已提交
2010 2011 2012 2013 2014 2015
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
	req->out.numargs = 1;
	req->out.args[0].size = sizeof(outarg);
	req->out.args[0].value = &outarg;
2016
	fuse_request_send(fc, req);
T
Tejun Heo 已提交
2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027
	err = req->out.h.error;
	fuse_put_request(fc, req);

	if (!err)
		return outarg.revents;
	if (err == -ENOSYS) {
		fc->no_poll = 1;
		return DEFAULT_POLLMASK;
	}
	return POLLERR;
}
2028
EXPORT_SYMBOL_GPL(fuse_file_poll);
T
Tejun Heo 已提交
2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053

/*
 * This is called from fuse_handle_notify() on FUSE_NOTIFY_POLL and
 * wakes up the poll waiters.
 */
int fuse_notify_poll_wakeup(struct fuse_conn *fc,
			    struct fuse_notify_poll_wakeup_out *outarg)
{
	u64 kh = outarg->kh;
	struct rb_node **link;

	spin_lock(&fc->lock);

	link = fuse_find_polled_node(fc, kh, NULL);
	if (*link) {
		struct fuse_file *ff;

		ff = rb_entry(*link, struct fuse_file, polled_node);
		wake_up_interruptible_sync(&ff->poll_wait);
	}

	spin_unlock(&fc->lock);
	return 0;
}

2054
static const struct file_operations fuse_file_operations = {
M
Miklos Szeredi 已提交
2055
	.llseek		= fuse_file_llseek,
2056
	.read		= do_sync_read,
M
Miklos Szeredi 已提交
2057
	.aio_read	= fuse_file_aio_read,
2058
	.write		= do_sync_write,
N
Nick Piggin 已提交
2059
	.aio_write	= fuse_file_aio_write,
M
Miklos Szeredi 已提交
2060 2061 2062 2063 2064
	.mmap		= fuse_file_mmap,
	.open		= fuse_open,
	.flush		= fuse_flush,
	.release	= fuse_release,
	.fsync		= fuse_fsync,
2065
	.lock		= fuse_file_lock,
2066
	.flock		= fuse_file_flock,
2067
	.splice_read	= generic_file_splice_read,
T
Tejun Heo 已提交
2068 2069
	.unlocked_ioctl	= fuse_file_ioctl,
	.compat_ioctl	= fuse_file_compat_ioctl,
T
Tejun Heo 已提交
2070
	.poll		= fuse_file_poll,
M
Miklos Szeredi 已提交
2071 2072
};

2073
static const struct file_operations fuse_direct_io_file_operations = {
M
Miklos Szeredi 已提交
2074
	.llseek		= fuse_file_llseek,
M
Miklos Szeredi 已提交
2075 2076
	.read		= fuse_direct_read,
	.write		= fuse_direct_write,
2077
	.mmap		= fuse_direct_mmap,
M
Miklos Szeredi 已提交
2078 2079 2080 2081
	.open		= fuse_open,
	.flush		= fuse_flush,
	.release	= fuse_release,
	.fsync		= fuse_fsync,
2082
	.lock		= fuse_file_lock,
2083
	.flock		= fuse_file_flock,
T
Tejun Heo 已提交
2084 2085
	.unlocked_ioctl	= fuse_file_ioctl,
	.compat_ioctl	= fuse_file_compat_ioctl,
T
Tejun Heo 已提交
2086
	.poll		= fuse_file_poll,
2087
	/* no splice_read */
M
Miklos Szeredi 已提交
2088 2089
};

2090
static const struct address_space_operations fuse_file_aops  = {
M
Miklos Szeredi 已提交
2091
	.readpage	= fuse_readpage,
M
Miklos Szeredi 已提交
2092 2093
	.writepage	= fuse_writepage,
	.launder_page	= fuse_launder_page,
N
Nick Piggin 已提交
2094 2095
	.write_begin	= fuse_write_begin,
	.write_end	= fuse_write_end,
2096
	.readpages	= fuse_readpages,
M
Miklos Szeredi 已提交
2097
	.set_page_dirty	= __set_page_dirty_nobuffers,
M
Miklos Szeredi 已提交
2098
	.bmap		= fuse_bmap,
M
Miklos Szeredi 已提交
2099 2100 2101 2102
};

void fuse_init_file_inode(struct inode *inode)
{
2103 2104
	inode->i_fop = &fuse_file_operations;
	inode->i_data.a_ops = &fuse_file_aops;
M
Miklos Szeredi 已提交
2105
}