dev.c 47.9 KB
Newer Older
M
Miklos Szeredi 已提交
1 2
/*
  FUSE: Filesystem in Userspace
M
Miklos Szeredi 已提交
3
  Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
M
Miklos Szeredi 已提交
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

  This program can be distributed under the terms of the GNU GPL.
  See the file COPYING.
*/

#include "fuse_i.h"

#include <linux/init.h>
#include <linux/module.h>
#include <linux/poll.h>
#include <linux/uio.h>
#include <linux/miscdevice.h>
#include <linux/pagemap.h>
#include <linux/file.h>
#include <linux/slab.h>
19
#include <linux/pipe_fs_i.h>
20 21
#include <linux/swap.h>
#include <linux/splice.h>
M
Miklos Szeredi 已提交
22 23

MODULE_ALIAS_MISCDEV(FUSE_MINOR);
24
MODULE_ALIAS("devname:fuse");
M
Miklos Szeredi 已提交
25

26
static struct kmem_cache *fuse_req_cachep;
M
Miklos Szeredi 已提交
27

28
static struct fuse_conn *fuse_get_conn(struct file *file)
M
Miklos Szeredi 已提交
29
{
M
Miklos Szeredi 已提交
30 31 32 33 34
	/*
	 * Lockless access is OK, because file->private data is set
	 * once during mount and is valid until the file is released.
	 */
	return file->private_data;
M
Miklos Szeredi 已提交
35 36
}

37
static void fuse_request_init(struct fuse_req *req, struct page **pages,
38
			      struct fuse_page_desc *page_descs,
39
			      unsigned npages)
M
Miklos Szeredi 已提交
40 41
{
	memset(req, 0, sizeof(*req));
42
	memset(pages, 0, sizeof(*pages) * npages);
43
	memset(page_descs, 0, sizeof(*page_descs) * npages);
M
Miklos Szeredi 已提交
44
	INIT_LIST_HEAD(&req->list);
45
	INIT_LIST_HEAD(&req->intr_entry);
M
Miklos Szeredi 已提交
46 47
	init_waitqueue_head(&req->waitq);
	atomic_set(&req->count, 1);
48
	req->pages = pages;
49
	req->page_descs = page_descs;
50
	req->max_pages = npages;
M
Miklos Szeredi 已提交
51 52
}

53
static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
M
Miklos Szeredi 已提交
54
{
55 56 57
	struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
	if (req) {
		struct page **pages;
58
		struct fuse_page_desc *page_descs;
59

60
		if (npages <= FUSE_REQ_INLINE_PAGES) {
61
			pages = req->inline_pages;
62 63
			page_descs = req->inline_page_descs;
		} else {
64
			pages = kmalloc(sizeof(struct page *) * npages, flags);
65 66 67
			page_descs = kmalloc(sizeof(struct fuse_page_desc) *
					     npages, flags);
		}
68

69 70 71
		if (!pages || !page_descs) {
			kfree(pages);
			kfree(page_descs);
72 73 74 75
			kmem_cache_free(fuse_req_cachep, req);
			return NULL;
		}

76
		fuse_request_init(req, pages, page_descs, npages);
77
	}
M
Miklos Szeredi 已提交
78 79
	return req;
}
80 81 82 83 84

struct fuse_req *fuse_request_alloc(unsigned npages)
{
	return __fuse_request_alloc(npages, GFP_KERNEL);
}
85
EXPORT_SYMBOL_GPL(fuse_request_alloc);
M
Miklos Szeredi 已提交
86

87
struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
M
Miklos Szeredi 已提交
88
{
89
	return __fuse_request_alloc(npages, GFP_NOFS);
M
Miklos Szeredi 已提交
90 91
}

M
Miklos Szeredi 已提交
92 93
void fuse_request_free(struct fuse_req *req)
{
94
	if (req->pages != req->inline_pages) {
95
		kfree(req->pages);
96 97
		kfree(req->page_descs);
	}
M
Miklos Szeredi 已提交
98 99 100
	kmem_cache_free(fuse_req_cachep, req);
}

101
static void block_sigs(sigset_t *oldset)
M
Miklos Szeredi 已提交
102 103 104 105 106 107 108
{
	sigset_t mask;

	siginitsetinv(&mask, sigmask(SIGKILL));
	sigprocmask(SIG_BLOCK, &mask, oldset);
}

109
static void restore_sigs(sigset_t *oldset)
M
Miklos Szeredi 已提交
110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125
{
	sigprocmask(SIG_SETMASK, oldset, NULL);
}

static void __fuse_get_request(struct fuse_req *req)
{
	atomic_inc(&req->count);
}

/* Must be called with > 1 refcount */
static void __fuse_put_request(struct fuse_req *req)
{
	BUG_ON(atomic_read(&req->count) < 2);
	atomic_dec(&req->count);
}

126 127
static void fuse_req_init_context(struct fuse_req *req)
{
128 129
	req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
	req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
130 131 132
	req->in.h.pid = current->pid;
}

M
Maxim Patlasov 已提交
133
struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
M
Miklos Szeredi 已提交
134
{
135 136
	struct fuse_req *req;
	sigset_t oldset;
137
	int intr;
138 139
	int err;

140
	atomic_inc(&fc->num_waiting);
141
	block_sigs(&oldset);
142
	intr = wait_event_interruptible(fc->blocked_waitq, !fc->blocked);
143
	restore_sigs(&oldset);
144 145 146
	err = -EINTR;
	if (intr)
		goto out;
147

148 149 150 151
	err = -ENOTCONN;
	if (!fc->connected)
		goto out;

M
Maxim Patlasov 已提交
152
	req = fuse_request_alloc(npages);
153
	err = -ENOMEM;
154
	if (!req)
155
		goto out;
M
Miklos Szeredi 已提交
156

157
	fuse_req_init_context(req);
158
	req->waiting = 1;
M
Miklos Szeredi 已提交
159
	return req;
160 161 162 163

 out:
	atomic_dec(&fc->num_waiting);
	return ERR_PTR(err);
M
Miklos Szeredi 已提交
164
}
165
EXPORT_SYMBOL_GPL(fuse_get_req);
M
Miklos Szeredi 已提交
166

167 168 169 170 171 172 173 174 175 176 177 178
/*
 * Return request in fuse_file->reserved_req.  However that may
 * currently be in use.  If that is the case, wait for it to become
 * available.
 */
static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
					 struct file *file)
{
	struct fuse_req *req = NULL;
	struct fuse_file *ff = file->private_data;

	do {
179
		wait_event(fc->reserved_req_waitq, ff->reserved_req);
180 181 182 183
		spin_lock(&fc->lock);
		if (ff->reserved_req) {
			req = ff->reserved_req;
			ff->reserved_req = NULL;
A
Al Viro 已提交
184
			req->stolen_file = get_file(file);
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200
		}
		spin_unlock(&fc->lock);
	} while (!req);

	return req;
}

/*
 * Put stolen request back into fuse_file->reserved_req
 */
static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
{
	struct file *file = req->stolen_file;
	struct fuse_file *ff = file->private_data;

	spin_lock(&fc->lock);
201
	fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
202 203
	BUG_ON(ff->reserved_req);
	ff->reserved_req = req;
204
	wake_up_all(&fc->reserved_req_waitq);
205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
	spin_unlock(&fc->lock);
	fput(file);
}

/*
 * Gets a requests for a file operation, always succeeds
 *
 * This is used for sending the FLUSH request, which must get to
 * userspace, due to POSIX locks which may need to be unlocked.
 *
 * If allocation fails due to OOM, use the reserved request in
 * fuse_file.
 *
 * This is very unlikely to deadlock accidentally, since the
 * filesystem should not have it's own file open.  If deadlock is
 * intentional, it can still be broken by "aborting" the filesystem.
 */
M
Maxim Patlasov 已提交
222 223
struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
					     struct file *file)
224 225 226 227 228
{
	struct fuse_req *req;

	atomic_inc(&fc->num_waiting);
	wait_event(fc->blocked_waitq, !fc->blocked);
M
Maxim Patlasov 已提交
229
	req = fuse_request_alloc(0);
230 231 232 233 234 235 236 237
	if (!req)
		req = get_reserved_req(fc, file);

	fuse_req_init_context(req);
	req->waiting = 1;
	return req;
}

M
Miklos Szeredi 已提交
238
void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
239 240
{
	if (atomic_dec_and_test(&req->count)) {
241 242
		if (req->waiting)
			atomic_dec(&fc->num_waiting);
243 244 245 246 247

		if (req->stolen_file)
			put_reserved_req(fc, req);
		else
			fuse_request_free(req);
248 249
	}
}
250
EXPORT_SYMBOL_GPL(fuse_put_request);
251

252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286
static unsigned len_args(unsigned numargs, struct fuse_arg *args)
{
	unsigned nbytes = 0;
	unsigned i;

	for (i = 0; i < numargs; i++)
		nbytes += args[i].size;

	return nbytes;
}

static u64 fuse_get_unique(struct fuse_conn *fc)
{
	fc->reqctr++;
	/* zero is special */
	if (fc->reqctr == 0)
		fc->reqctr = 1;

	return fc->reqctr;
}

static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
{
	req->in.h.len = sizeof(struct fuse_in_header) +
		len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
	list_add_tail(&req->list, &fc->pending);
	req->state = FUSE_REQ_PENDING;
	if (!req->waiting) {
		req->waiting = 1;
		atomic_inc(&fc->num_waiting);
	}
	wake_up(&fc->waitq);
	kill_fasync(&fc->fasync, SIGIO, POLL_IN);
}

287 288 289
void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
		       u64 nodeid, u64 nlookup)
{
290 291
	forget->forget_one.nodeid = nodeid;
	forget->forget_one.nlookup = nlookup;
292 293

	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
294 295 296 297 298 299 300 301
	if (fc->connected) {
		fc->forget_list_tail->next = forget;
		fc->forget_list_tail = forget;
		wake_up(&fc->waitq);
		kill_fasync(&fc->fasync, SIGIO, POLL_IN);
	} else {
		kfree(forget);
	}
302 303 304
	spin_unlock(&fc->lock);
}

305 306
static void flush_bg_queue(struct fuse_conn *fc)
{
307
	while (fc->active_background < fc->max_background &&
308 309 310 311 312 313
	       !list_empty(&fc->bg_queue)) {
		struct fuse_req *req;

		req = list_entry(fc->bg_queue.next, struct fuse_req, list);
		list_del(&req->list);
		fc->active_background++;
M
Miklos Szeredi 已提交
314
		req->in.h.unique = fuse_get_unique(fc);
315 316 317 318
		queue_request(fc, req);
	}
}

M
Miklos Szeredi 已提交
319 320
/*
 * This function is called when a request is finished.  Either a reply
321
 * has arrived or it was aborted (and not yet sent) or some error
M
Miklos Szeredi 已提交
322
 * occurred during communication with userspace, or the device file
323 324 325
 * was closed.  The requester thread is woken up (if still waiting),
 * the 'end' callback is called if given, else the reference to the
 * request is released
326
 *
327
 * Called with fc->lock, unlocks it
M
Miklos Szeredi 已提交
328 329
 */
static void request_end(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
330
__releases(fc->lock)
M
Miklos Szeredi 已提交
331
{
332 333
	void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
	req->end = NULL;
334
	list_del(&req->list);
335
	list_del(&req->intr_entry);
336
	req->state = FUSE_REQ_FINISHED;
337
	if (req->background) {
338
		if (fc->num_background == fc->max_background) {
339 340 341
			fc->blocked = 0;
			wake_up_all(&fc->blocked_waitq);
		}
342
		if (fc->num_background == fc->congestion_threshold &&
343
		    fc->connected && fc->bdi_initialized) {
344 345
			clear_bdi_congested(&fc->bdi, BLK_RW_SYNC);
			clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
346
		}
347
		fc->num_background--;
348 349
		fc->active_background--;
		flush_bg_queue(fc);
M
Miklos Szeredi 已提交
350
	}
351 352 353 354
	spin_unlock(&fc->lock);
	wake_up(&req->waitq);
	if (end)
		end(fc, req);
355
	fuse_put_request(fc, req);
M
Miklos Szeredi 已提交
356 357
}

358 359
static void wait_answer_interruptible(struct fuse_conn *fc,
				      struct fuse_req *req)
M
Miklos Szeredi 已提交
360 361
__releases(fc->lock)
__acquires(fc->lock)
362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377
{
	if (signal_pending(current))
		return;

	spin_unlock(&fc->lock);
	wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
	spin_lock(&fc->lock);
}

static void queue_interrupt(struct fuse_conn *fc, struct fuse_req *req)
{
	list_add_tail(&req->intr_entry, &fc->interrupts);
	wake_up(&fc->waitq);
	kill_fasync(&fc->fasync, SIGIO, POLL_IN);
}

378
static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
379 380
__releases(fc->lock)
__acquires(fc->lock)
M
Miklos Szeredi 已提交
381
{
382 383 384
	if (!fc->no_interrupt) {
		/* Any signal may interrupt this */
		wait_answer_interruptible(fc, req);
M
Miklos Szeredi 已提交
385

386 387 388 389 390 391 392 393 394 395
		if (req->aborted)
			goto aborted;
		if (req->state == FUSE_REQ_FINISHED)
			return;

		req->interrupted = 1;
		if (req->state == FUSE_REQ_SENT)
			queue_interrupt(fc, req);
	}

M
Miklos Szeredi 已提交
396
	if (!req->force) {
397 398 399
		sigset_t oldset;

		/* Only fatal signals may interrupt this */
400
		block_sigs(&oldset);
401
		wait_answer_interruptible(fc, req);
402
		restore_sigs(&oldset);
M
Miklos Szeredi 已提交
403 404 405 406 407 408 409 410 411 412 413 414 415

		if (req->aborted)
			goto aborted;
		if (req->state == FUSE_REQ_FINISHED)
			return;

		/* Request is not yet in userspace, bail out */
		if (req->state == FUSE_REQ_PENDING) {
			list_del(&req->list);
			__fuse_put_request(req);
			req->out.h.error = -EINTR;
			return;
		}
416
	}
M
Miklos Szeredi 已提交
417

M
Miklos Szeredi 已提交
418 419 420 421 422 423 424
	/*
	 * Either request is already in userspace, or it was forced.
	 * Wait it out.
	 */
	spin_unlock(&fc->lock);
	wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);
	spin_lock(&fc->lock);
425

M
Miklos Szeredi 已提交
426 427
	if (!req->aborted)
		return;
428 429

 aborted:
M
Miklos Szeredi 已提交
430
	BUG_ON(req->state != FUSE_REQ_FINISHED);
M
Miklos Szeredi 已提交
431 432 433 434 435 436
	if (req->locked) {
		/* This is uninterruptible sleep, because data is
		   being copied to/from the buffers of req.  During
		   locked state, there mustn't be any filesystem
		   operation (e.g. page fault), since that could lead
		   to deadlock */
437
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
438
		wait_event(req->waitq, !req->locked);
439
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
440 441 442
	}
}

443
void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
444 445
{
	req->isreply = 1;
446
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
447
	if (!fc->connected)
M
Miklos Szeredi 已提交
448 449 450 451
		req->out.h.error = -ENOTCONN;
	else if (fc->conn_error)
		req->out.h.error = -ECONNREFUSED;
	else {
M
Miklos Szeredi 已提交
452
		req->in.h.unique = fuse_get_unique(fc);
M
Miklos Szeredi 已提交
453 454 455 456 457
		queue_request(fc, req);
		/* acquire extra reference, since request is still needed
		   after request_end() */
		__fuse_get_request(req);

458
		request_wait_answer(fc, req);
M
Miklos Szeredi 已提交
459
	}
460
	spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
461
}
462
EXPORT_SYMBOL_GPL(fuse_request_send);
M
Miklos Szeredi 已提交
463

464 465
static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
					    struct fuse_req *req)
466 467 468
{
	req->background = 1;
	fc->num_background++;
469
	if (fc->num_background == fc->max_background)
470
		fc->blocked = 1;
471
	if (fc->num_background == fc->congestion_threshold &&
472
	    fc->bdi_initialized) {
473 474
		set_bdi_congested(&fc->bdi, BLK_RW_SYNC);
		set_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
475 476 477 478 479
	}
	list_add_tail(&req->list, &fc->bg_queue);
	flush_bg_queue(fc);
}

480
static void fuse_request_send_nowait(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
481
{
482
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
483
	if (fc->connected) {
484
		fuse_request_send_nowait_locked(fc, req);
485
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
486 487 488 489 490 491
	} else {
		req->out.h.error = -ENOTCONN;
		request_end(fc, req);
	}
}

492
void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
493 494
{
	req->isreply = 1;
495
	fuse_request_send_nowait(fc, req);
M
Miklos Szeredi 已提交
496
}
497
EXPORT_SYMBOL_GPL(fuse_request_send_background);
M
Miklos Szeredi 已提交
498

M
Miklos Szeredi 已提交
499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515
static int fuse_request_send_notify_reply(struct fuse_conn *fc,
					  struct fuse_req *req, u64 unique)
{
	int err = -ENODEV;

	req->isreply = 0;
	req->in.h.unique = unique;
	spin_lock(&fc->lock);
	if (fc->connected) {
		queue_request(fc, req);
		err = 0;
	}
	spin_unlock(&fc->lock);

	return err;
}

M
Miklos Szeredi 已提交
516 517 518 519 520
/*
 * Called under fc->lock
 *
 * fc->connected must have been checked previously
 */
521 522
void fuse_request_send_background_locked(struct fuse_conn *fc,
					 struct fuse_req *req)
M
Miklos Szeredi 已提交
523 524
{
	req->isreply = 1;
525
	fuse_request_send_nowait_locked(fc, req);
M
Miklos Szeredi 已提交
526 527
}

528 529 530 531 532 533 534 535 536
void fuse_force_forget(struct file *file, u64 nodeid)
{
	struct inode *inode = file->f_path.dentry->d_inode;
	struct fuse_conn *fc = get_fuse_conn(inode);
	struct fuse_req *req;
	struct fuse_forget_in inarg;

	memset(&inarg, 0, sizeof(inarg));
	inarg.nlookup = 1;
M
Maxim Patlasov 已提交
537
	req = fuse_get_req_nofail_nopages(fc, file);
538 539 540 541 542 543 544 545 546
	req->in.h.opcode = FUSE_FORGET;
	req->in.h.nodeid = nodeid;
	req->in.numargs = 1;
	req->in.args[0].size = sizeof(inarg);
	req->in.args[0].value = &inarg;
	req->isreply = 0;
	fuse_request_send_nowait(fc, req);
}

M
Miklos Szeredi 已提交
547 548 549
/*
 * Lock the request.  Up to the next unlock_request() there mustn't be
 * anything that could cause a page-fault.  If the request was already
550
 * aborted bail out.
M
Miklos Szeredi 已提交
551
 */
552
static int lock_request(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
553 554 555
{
	int err = 0;
	if (req) {
556
		spin_lock(&fc->lock);
557
		if (req->aborted)
M
Miklos Szeredi 已提交
558 559 560
			err = -ENOENT;
		else
			req->locked = 1;
561
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
562 563 564 565 566
	}
	return err;
}

/*
567
 * Unlock request.  If it was aborted during being locked, the
M
Miklos Szeredi 已提交
568 569 570
 * requester thread is currently waiting for it to be unlocked, so
 * wake it up.
 */
571
static void unlock_request(struct fuse_conn *fc, struct fuse_req *req)
M
Miklos Szeredi 已提交
572 573
{
	if (req) {
574
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
575
		req->locked = 0;
576
		if (req->aborted)
M
Miklos Szeredi 已提交
577
			wake_up(&req->waitq);
578
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
579 580 581 582
	}
}

struct fuse_copy_state {
583
	struct fuse_conn *fc;
M
Miklos Szeredi 已提交
584 585 586
	int write;
	struct fuse_req *req;
	const struct iovec *iov;
587 588 589
	struct pipe_buffer *pipebufs;
	struct pipe_buffer *currbuf;
	struct pipe_inode_info *pipe;
M
Miklos Szeredi 已提交
590 591 592 593 594 595 596
	unsigned long nr_segs;
	unsigned long seglen;
	unsigned long addr;
	struct page *pg;
	void *mapaddr;
	void *buf;
	unsigned len;
597
	unsigned move_pages:1;
M
Miklos Szeredi 已提交
598 599
};

600
static void fuse_copy_init(struct fuse_copy_state *cs, struct fuse_conn *fc,
601
			   int write,
602
			   const struct iovec *iov, unsigned long nr_segs)
M
Miklos Szeredi 已提交
603 604
{
	memset(cs, 0, sizeof(*cs));
605
	cs->fc = fc;
M
Miklos Szeredi 已提交
606 607 608 609 610 611
	cs->write = write;
	cs->iov = iov;
	cs->nr_segs = nr_segs;
}

/* Unmap and put previous page of userspace buffer */
612
static void fuse_copy_finish(struct fuse_copy_state *cs)
M
Miklos Szeredi 已提交
613
{
614 615 616
	if (cs->currbuf) {
		struct pipe_buffer *buf = cs->currbuf;

617 618 619
		if (!cs->write) {
			buf->ops->unmap(cs->pipe, buf, cs->mapaddr);
		} else {
M
Miklos Szeredi 已提交
620
			kunmap(buf->page);
621 622
			buf->len = PAGE_SIZE - cs->len;
		}
623 624 625
		cs->currbuf = NULL;
		cs->mapaddr = NULL;
	} else if (cs->mapaddr) {
M
Miklos Szeredi 已提交
626
		kunmap(cs->pg);
M
Miklos Szeredi 已提交
627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644
		if (cs->write) {
			flush_dcache_page(cs->pg);
			set_page_dirty_lock(cs->pg);
		}
		put_page(cs->pg);
		cs->mapaddr = NULL;
	}
}

/*
 * Get another pagefull of userspace buffer, and map it to kernel
 * address space, and lock request
 */
static int fuse_copy_fill(struct fuse_copy_state *cs)
{
	unsigned long offset;
	int err;

645
	unlock_request(cs->fc, cs->req);
M
Miklos Szeredi 已提交
646
	fuse_copy_finish(cs);
647 648 649
	if (cs->pipebufs) {
		struct pipe_buffer *buf = cs->pipebufs;

650 651 652 653 654 655 656
		if (!cs->write) {
			err = buf->ops->confirm(cs->pipe, buf);
			if (err)
				return err;

			BUG_ON(!cs->nr_segs);
			cs->currbuf = buf;
M
Miklos Szeredi 已提交
657
			cs->mapaddr = buf->ops->map(cs->pipe, buf, 0);
658 659 660 661 662 663
			cs->len = buf->len;
			cs->buf = cs->mapaddr + buf->offset;
			cs->pipebufs++;
			cs->nr_segs--;
		} else {
			struct page *page;
664

665 666 667 668 669 670 671 672 673 674 675 676
			if (cs->nr_segs == cs->pipe->buffers)
				return -EIO;

			page = alloc_page(GFP_HIGHUSER);
			if (!page)
				return -ENOMEM;

			buf->page = page;
			buf->offset = 0;
			buf->len = 0;

			cs->currbuf = buf;
M
Miklos Szeredi 已提交
677
			cs->mapaddr = kmap(page);
678 679 680 681 682
			cs->buf = cs->mapaddr;
			cs->len = PAGE_SIZE;
			cs->pipebufs++;
			cs->nr_segs++;
		}
683 684 685 686 687 688 689 690 691 692 693 694 695
	} else {
		if (!cs->seglen) {
			BUG_ON(!cs->nr_segs);
			cs->seglen = cs->iov[0].iov_len;
			cs->addr = (unsigned long) cs->iov[0].iov_base;
			cs->iov++;
			cs->nr_segs--;
		}
		err = get_user_pages_fast(cs->addr, 1, cs->write, &cs->pg);
		if (err < 0)
			return err;
		BUG_ON(err != 1);
		offset = cs->addr % PAGE_SIZE;
M
Miklos Szeredi 已提交
696
		cs->mapaddr = kmap(cs->pg);
697 698 699 700
		cs->buf = cs->mapaddr + offset;
		cs->len = min(PAGE_SIZE - offset, cs->seglen);
		cs->seglen -= cs->len;
		cs->addr += cs->len;
M
Miklos Szeredi 已提交
701 702
	}

703
	return lock_request(cs->fc, cs->req);
M
Miklos Szeredi 已提交
704 705 706
}

/* Do as much copy to/from userspace buffer as we can */
707
static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
M
Miklos Szeredi 已提交
708 709 710 711 712 713 714 715 716 717 718 719 720 721 722
{
	unsigned ncpy = min(*size, cs->len);
	if (val) {
		if (cs->write)
			memcpy(cs->buf, *val, ncpy);
		else
			memcpy(*val, cs->buf, ncpy);
		*val += ncpy;
	}
	*size -= ncpy;
	cs->len -= ncpy;
	cs->buf += ncpy;
	return ncpy;
}

723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790
static int fuse_check_page(struct page *page)
{
	if (page_mapcount(page) ||
	    page->mapping != NULL ||
	    page_count(page) != 1 ||
	    (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
	     ~(1 << PG_locked |
	       1 << PG_referenced |
	       1 << PG_uptodate |
	       1 << PG_lru |
	       1 << PG_active |
	       1 << PG_reclaim))) {
		printk(KERN_WARNING "fuse: trying to steal weird page\n");
		printk(KERN_WARNING "  page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
		return 1;
	}
	return 0;
}

static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
{
	int err;
	struct page *oldpage = *pagep;
	struct page *newpage;
	struct pipe_buffer *buf = cs->pipebufs;

	unlock_request(cs->fc, cs->req);
	fuse_copy_finish(cs);

	err = buf->ops->confirm(cs->pipe, buf);
	if (err)
		return err;

	BUG_ON(!cs->nr_segs);
	cs->currbuf = buf;
	cs->len = buf->len;
	cs->pipebufs++;
	cs->nr_segs--;

	if (cs->len != PAGE_SIZE)
		goto out_fallback;

	if (buf->ops->steal(cs->pipe, buf) != 0)
		goto out_fallback;

	newpage = buf->page;

	if (WARN_ON(!PageUptodate(newpage)))
		return -EIO;

	ClearPageMappedToDisk(newpage);

	if (fuse_check_page(newpage) != 0)
		goto out_fallback_unlock;

	/*
	 * This is a new and locked page, it shouldn't be mapped or
	 * have any special flags on it
	 */
	if (WARN_ON(page_mapped(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(page_has_private(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
		goto out_fallback_unlock;
	if (WARN_ON(PageMlocked(oldpage)))
		goto out_fallback_unlock;

791
	err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
792
	if (err) {
793 794
		unlock_page(newpage);
		return err;
795
	}
796

797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834
	page_cache_get(newpage);

	if (!(buf->flags & PIPE_BUF_FLAG_LRU))
		lru_cache_add_file(newpage);

	err = 0;
	spin_lock(&cs->fc->lock);
	if (cs->req->aborted)
		err = -ENOENT;
	else
		*pagep = newpage;
	spin_unlock(&cs->fc->lock);

	if (err) {
		unlock_page(newpage);
		page_cache_release(newpage);
		return err;
	}

	unlock_page(oldpage);
	page_cache_release(oldpage);
	cs->len = 0;

	return 0;

out_fallback_unlock:
	unlock_page(newpage);
out_fallback:
	cs->mapaddr = buf->ops->map(cs->pipe, buf, 1);
	cs->buf = cs->mapaddr + buf->offset;

	err = lock_request(cs->fc, cs->req);
	if (err)
		return err;

	return 1;
}

835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858
static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
			 unsigned offset, unsigned count)
{
	struct pipe_buffer *buf;

	if (cs->nr_segs == cs->pipe->buffers)
		return -EIO;

	unlock_request(cs->fc, cs->req);
	fuse_copy_finish(cs);

	buf = cs->pipebufs;
	page_cache_get(page);
	buf->page = page;
	buf->offset = offset;
	buf->len = count;

	cs->pipebufs++;
	cs->nr_segs++;
	cs->len = 0;

	return 0;
}

M
Miklos Szeredi 已提交
859 860 861 862
/*
 * Copy a page in the request to/from the userspace buffer.  Must be
 * done atomically
 */
863
static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
864
			  unsigned offset, unsigned count, int zeroing)
M
Miklos Szeredi 已提交
865
{
866 867 868
	int err;
	struct page *page = *pagep;

869 870 871
	if (page && zeroing && count < PAGE_SIZE)
		clear_highpage(page);

M
Miklos Szeredi 已提交
872
	while (count) {
873 874 875
		if (cs->write && cs->pipebufs && page) {
			return fuse_ref_page(cs, page, offset, count);
		} else if (!cs->len) {
876 877 878 879 880 881 882 883 884 885
			if (cs->move_pages && page &&
			    offset == 0 && count == PAGE_SIZE) {
				err = fuse_try_move_page(cs, pagep);
				if (err <= 0)
					return err;
			} else {
				err = fuse_copy_fill(cs);
				if (err)
					return err;
			}
M
Miklos Szeredi 已提交
886
		}
M
Miklos Szeredi 已提交
887
		if (page) {
888
			void *mapaddr = kmap_atomic(page);
M
Miklos Szeredi 已提交
889 890
			void *buf = mapaddr + offset;
			offset += fuse_copy_do(cs, &buf, &count);
891
			kunmap_atomic(mapaddr);
M
Miklos Szeredi 已提交
892 893 894 895 896 897 898 899 900 901 902 903 904 905
		} else
			offset += fuse_copy_do(cs, NULL, &count);
	}
	if (page && !cs->write)
		flush_dcache_page(page);
	return 0;
}

/* Copy pages in the request to/from userspace buffer */
static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
			   int zeroing)
{
	unsigned i;
	struct fuse_req *req = cs->req;
906
	unsigned offset = req->page_descs[0].offset;
M
Miklos Szeredi 已提交
907 908 909
	unsigned count = min(nbytes, (unsigned) PAGE_SIZE - offset);

	for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
910 911 912 913
		int err;

		err = fuse_copy_page(cs, &req->pages[i], offset, count,
				     zeroing);
M
Miklos Szeredi 已提交
914 915 916 917 918 919 920 921 922 923 924 925 926 927
		if (err)
			return err;

		nbytes -= count;
		count = min(nbytes, (unsigned) PAGE_SIZE);
		offset = 0;
	}
	return 0;
}

/* Copy a single argument in the request to/from userspace buffer */
static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
{
	while (size) {
M
Miklos Szeredi 已提交
928 929 930 931 932
		if (!cs->len) {
			int err = fuse_copy_fill(cs);
			if (err)
				return err;
		}
M
Miklos Szeredi 已提交
933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955
		fuse_copy_do(cs, &val, &size);
	}
	return 0;
}

/* Copy request arguments to/from userspace buffer */
static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
			  unsigned argpages, struct fuse_arg *args,
			  int zeroing)
{
	int err = 0;
	unsigned i;

	for (i = 0; !err && i < numargs; i++)  {
		struct fuse_arg *arg = &args[i];
		if (i == numargs - 1 && argpages)
			err = fuse_copy_pages(cs, arg->size, zeroing);
		else
			err = fuse_copy_one(cs, arg->value, arg->size);
	}
	return err;
}

956 957 958 959 960
static int forget_pending(struct fuse_conn *fc)
{
	return fc->forget_list_head.next != NULL;
}

961 962
static int request_pending(struct fuse_conn *fc)
{
963 964
	return !list_empty(&fc->pending) || !list_empty(&fc->interrupts) ||
		forget_pending(fc);
965 966
}

M
Miklos Szeredi 已提交
967 968
/* Wait until a request is available on the pending list */
static void request_wait(struct fuse_conn *fc)
M
Miklos Szeredi 已提交
969 970
__releases(fc->lock)
__acquires(fc->lock)
M
Miklos Szeredi 已提交
971 972 973 974
{
	DECLARE_WAITQUEUE(wait, current);

	add_wait_queue_exclusive(&fc->waitq, &wait);
975
	while (fc->connected && !request_pending(fc)) {
M
Miklos Szeredi 已提交
976 977 978 979
		set_current_state(TASK_INTERRUPTIBLE);
		if (signal_pending(current))
			break;

980
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
981
		schedule();
982
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
983 984 985 986 987
	}
	set_current_state(TASK_RUNNING);
	remove_wait_queue(&fc->waitq, &wait);
}

988 989 990 991 992 993 994 995
/*
 * Transfer an interrupt request to userspace
 *
 * Unlike other requests this is assembled on demand, without a need
 * to allocate a separate fuse_req structure.
 *
 * Called with fc->lock held, releases it
 */
996 997
static int fuse_read_interrupt(struct fuse_conn *fc, struct fuse_copy_state *cs,
			       size_t nbytes, struct fuse_req *req)
M
Miklos Szeredi 已提交
998
__releases(fc->lock)
999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014
{
	struct fuse_in_header ih;
	struct fuse_interrupt_in arg;
	unsigned reqsize = sizeof(ih) + sizeof(arg);
	int err;

	list_del_init(&req->intr_entry);
	req->intr_unique = fuse_get_unique(fc);
	memset(&ih, 0, sizeof(ih));
	memset(&arg, 0, sizeof(arg));
	ih.len = reqsize;
	ih.opcode = FUSE_INTERRUPT;
	ih.unique = req->intr_unique;
	arg.unique = req->in.h.unique;

	spin_unlock(&fc->lock);
1015
	if (nbytes < reqsize)
1016 1017
		return -EINVAL;

1018
	err = fuse_copy_one(cs, &ih, sizeof(ih));
1019
	if (!err)
1020 1021
		err = fuse_copy_one(cs, &arg, sizeof(arg));
	fuse_copy_finish(cs);
1022 1023 1024 1025

	return err ? err : reqsize;
}

1026 1027 1028
static struct fuse_forget_link *dequeue_forget(struct fuse_conn *fc,
					       unsigned max,
					       unsigned *countp)
1029
{
1030 1031 1032
	struct fuse_forget_link *head = fc->forget_list_head.next;
	struct fuse_forget_link **newhead = &head;
	unsigned count;
1033

1034 1035 1036 1037 1038
	for (count = 0; *newhead != NULL && count < max; count++)
		newhead = &(*newhead)->next;

	fc->forget_list_head.next = *newhead;
	*newhead = NULL;
1039 1040 1041
	if (fc->forget_list_head.next == NULL)
		fc->forget_list_tail = &fc->forget_list_head;

1042 1043 1044 1045
	if (countp != NULL)
		*countp = count;

	return head;
1046 1047 1048 1049 1050 1051 1052 1053
}

static int fuse_read_single_forget(struct fuse_conn *fc,
				   struct fuse_copy_state *cs,
				   size_t nbytes)
__releases(fc->lock)
{
	int err;
1054
	struct fuse_forget_link *forget = dequeue_forget(fc, 1, NULL);
1055
	struct fuse_forget_in arg = {
1056
		.nlookup = forget->forget_one.nlookup,
1057 1058 1059
	};
	struct fuse_in_header ih = {
		.opcode = FUSE_FORGET,
1060
		.nodeid = forget->forget_one.nodeid,
1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080
		.unique = fuse_get_unique(fc),
		.len = sizeof(ih) + sizeof(arg),
	};

	spin_unlock(&fc->lock);
	kfree(forget);
	if (nbytes < ih.len)
		return -EINVAL;

	err = fuse_copy_one(cs, &ih, sizeof(ih));
	if (!err)
		err = fuse_copy_one(cs, &arg, sizeof(arg));
	fuse_copy_finish(cs);

	if (err)
		return err;

	return ih.len;
}

1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139
static int fuse_read_batch_forget(struct fuse_conn *fc,
				   struct fuse_copy_state *cs, size_t nbytes)
__releases(fc->lock)
{
	int err;
	unsigned max_forgets;
	unsigned count;
	struct fuse_forget_link *head;
	struct fuse_batch_forget_in arg = { .count = 0 };
	struct fuse_in_header ih = {
		.opcode = FUSE_BATCH_FORGET,
		.unique = fuse_get_unique(fc),
		.len = sizeof(ih) + sizeof(arg),
	};

	if (nbytes < ih.len) {
		spin_unlock(&fc->lock);
		return -EINVAL;
	}

	max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
	head = dequeue_forget(fc, max_forgets, &count);
	spin_unlock(&fc->lock);

	arg.count = count;
	ih.len += count * sizeof(struct fuse_forget_one);
	err = fuse_copy_one(cs, &ih, sizeof(ih));
	if (!err)
		err = fuse_copy_one(cs, &arg, sizeof(arg));

	while (head) {
		struct fuse_forget_link *forget = head;

		if (!err) {
			err = fuse_copy_one(cs, &forget->forget_one,
					    sizeof(forget->forget_one));
		}
		head = forget->next;
		kfree(forget);
	}

	fuse_copy_finish(cs);

	if (err)
		return err;

	return ih.len;
}

static int fuse_read_forget(struct fuse_conn *fc, struct fuse_copy_state *cs,
			    size_t nbytes)
__releases(fc->lock)
{
	if (fc->minor < 16 || fc->forget_list_head.next->next == NULL)
		return fuse_read_single_forget(fc, cs, nbytes);
	else
		return fuse_read_batch_forget(fc, cs, nbytes);
}

M
Miklos Szeredi 已提交
1140 1141 1142 1143
/*
 * Read a single request into the userspace filesystem's buffer.  This
 * function waits until a request is available, then removes it from
 * the pending list and copies request data to userspace buffer.  If
1144 1145
 * no reply is needed (FORGET) or request has been aborted or there
 * was an error during the copying then it's finished by calling
M
Miklos Szeredi 已提交
1146 1147 1148
 * request_end().  Otherwise add it to the processing list, and set
 * the 'sent' flag.
 */
1149 1150
static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
				struct fuse_copy_state *cs, size_t nbytes)
M
Miklos Szeredi 已提交
1151 1152 1153 1154 1155 1156
{
	int err;
	struct fuse_req *req;
	struct fuse_in *in;
	unsigned reqsize;

1157
 restart:
1158
	spin_lock(&fc->lock);
1159 1160
	err = -EAGAIN;
	if ((file->f_flags & O_NONBLOCK) && fc->connected &&
1161
	    !request_pending(fc))
1162 1163
		goto err_unlock;

M
Miklos Szeredi 已提交
1164 1165
	request_wait(fc);
	err = -ENODEV;
1166
	if (!fc->connected)
M
Miklos Szeredi 已提交
1167 1168
		goto err_unlock;
	err = -ERESTARTSYS;
1169
	if (!request_pending(fc))
M
Miklos Szeredi 已提交
1170 1171
		goto err_unlock;

1172 1173 1174
	if (!list_empty(&fc->interrupts)) {
		req = list_entry(fc->interrupts.next, struct fuse_req,
				 intr_entry);
1175
		return fuse_read_interrupt(fc, cs, nbytes, req);
1176 1177
	}

1178 1179
	if (forget_pending(fc)) {
		if (list_empty(&fc->pending) || fc->forget_batch-- > 0)
1180
			return fuse_read_forget(fc, cs, nbytes);
1181 1182 1183 1184 1185

		if (fc->forget_batch <= -8)
			fc->forget_batch = 16;
	}

M
Miklos Szeredi 已提交
1186
	req = list_entry(fc->pending.next, struct fuse_req, list);
1187
	req->state = FUSE_REQ_READING;
1188
	list_move(&req->list, &fc->io);
M
Miklos Szeredi 已提交
1189 1190

	in = &req->in;
1191 1192
	reqsize = in->h.len;
	/* If request is too large, reply with an error and restart the read */
1193
	if (nbytes < reqsize) {
1194 1195 1196 1197 1198 1199
		req->out.h.error = -EIO;
		/* SETXATTR is special, since it may contain too large data */
		if (in->h.opcode == FUSE_SETXATTR)
			req->out.h.error = -E2BIG;
		request_end(fc, req);
		goto restart;
M
Miklos Szeredi 已提交
1200
	}
1201
	spin_unlock(&fc->lock);
1202 1203
	cs->req = req;
	err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1204
	if (!err)
1205
		err = fuse_copy_args(cs, in->numargs, in->argpages,
1206
				     (struct fuse_arg *) in->args, 0);
1207
	fuse_copy_finish(cs);
1208
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
1209
	req->locked = 0;
1210 1211 1212 1213
	if (req->aborted) {
		request_end(fc, req);
		return -ENODEV;
	}
M
Miklos Szeredi 已提交
1214
	if (err) {
1215
		req->out.h.error = -EIO;
M
Miklos Szeredi 已提交
1216 1217 1218 1219 1220 1221
		request_end(fc, req);
		return err;
	}
	if (!req->isreply)
		request_end(fc, req);
	else {
1222
		req->state = FUSE_REQ_SENT;
1223
		list_move_tail(&req->list, &fc->processing);
1224 1225
		if (req->interrupted)
			queue_interrupt(fc, req);
1226
		spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
1227 1228 1229 1230
	}
	return reqsize;

 err_unlock:
1231
	spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
1232 1233 1234
	return err;
}

1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277
static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
			      unsigned long nr_segs, loff_t pos)
{
	struct fuse_copy_state cs;
	struct file *file = iocb->ki_filp;
	struct fuse_conn *fc = fuse_get_conn(file);
	if (!fc)
		return -EPERM;

	fuse_copy_init(&cs, fc, 1, iov, nr_segs);

	return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
}

static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
				   struct pipe_buffer *buf)
{
	return 1;
}

static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = {
	.can_merge = 0,
	.map = generic_pipe_buf_map,
	.unmap = generic_pipe_buf_unmap,
	.confirm = generic_pipe_buf_confirm,
	.release = generic_pipe_buf_release,
	.steal = fuse_dev_pipe_buf_steal,
	.get = generic_pipe_buf_get,
};

static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
				    struct pipe_inode_info *pipe,
				    size_t len, unsigned int flags)
{
	int ret;
	int page_nr = 0;
	int do_wakeup = 0;
	struct pipe_buffer *bufs;
	struct fuse_copy_state cs;
	struct fuse_conn *fc = fuse_get_conn(in);
	if (!fc)
		return -EPERM;

1278
	bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338
	if (!bufs)
		return -ENOMEM;

	fuse_copy_init(&cs, fc, 1, NULL, 0);
	cs.pipebufs = bufs;
	cs.pipe = pipe;
	ret = fuse_dev_do_read(fc, in, &cs, len);
	if (ret < 0)
		goto out;

	ret = 0;
	pipe_lock(pipe);

	if (!pipe->readers) {
		send_sig(SIGPIPE, current, 0);
		if (!ret)
			ret = -EPIPE;
		goto out_unlock;
	}

	if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
		ret = -EIO;
		goto out_unlock;
	}

	while (page_nr < cs.nr_segs) {
		int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
		struct pipe_buffer *buf = pipe->bufs + newbuf;

		buf->page = bufs[page_nr].page;
		buf->offset = bufs[page_nr].offset;
		buf->len = bufs[page_nr].len;
		buf->ops = &fuse_dev_pipe_buf_ops;

		pipe->nrbufs++;
		page_nr++;
		ret += buf->len;

		if (pipe->inode)
			do_wakeup = 1;
	}

out_unlock:
	pipe_unlock(pipe);

	if (do_wakeup) {
		smp_mb();
		if (waitqueue_active(&pipe->wait))
			wake_up_interruptible(&pipe->wait);
		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
	}

out:
	for (; page_nr < cs.nr_segs; page_nr++)
		page_cache_release(bufs[page_nr].page);

	kfree(bufs);
	return ret;
}

T
Tejun Heo 已提交
1339 1340 1341 1342
static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
			    struct fuse_copy_state *cs)
{
	struct fuse_notify_poll_wakeup_out outarg;
M
Miklos Szeredi 已提交
1343
	int err = -EINVAL;
T
Tejun Heo 已提交
1344 1345

	if (size != sizeof(outarg))
M
Miklos Szeredi 已提交
1346
		goto err;
T
Tejun Heo 已提交
1347 1348 1349

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
M
Miklos Szeredi 已提交
1350
		goto err;
T
Tejun Heo 已提交
1351

M
Miklos Szeredi 已提交
1352
	fuse_copy_finish(cs);
T
Tejun Heo 已提交
1353
	return fuse_notify_poll_wakeup(fc, &outarg);
M
Miklos Szeredi 已提交
1354 1355 1356 1357

err:
	fuse_copy_finish(cs);
	return err;
T
Tejun Heo 已提交
1358 1359
}

J
John Muir 已提交
1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375
static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
				   struct fuse_copy_state *cs)
{
	struct fuse_notify_inval_inode_out outarg;
	int err = -EINVAL;

	if (size != sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;
	fuse_copy_finish(cs);

	down_read(&fc->killsb);
	err = -ENOENT;
1376 1377 1378 1379
	if (fc->sb) {
		err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
					       outarg.off, outarg.len);
	}
J
John Muir 已提交
1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391
	up_read(&fc->killsb);
	return err;

err:
	fuse_copy_finish(cs);
	return err;
}

static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
				   struct fuse_copy_state *cs)
{
	struct fuse_notify_inval_entry_out outarg;
F
Fang Wenqi 已提交
1392 1393
	int err = -ENOMEM;
	char *buf;
J
John Muir 已提交
1394 1395
	struct qstr name;

F
Fang Wenqi 已提交
1396 1397 1398 1399 1400
	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
	if (!buf)
		goto err;

	err = -EINVAL;
J
John Muir 已提交
1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411
	if (size < sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;

	err = -ENAMETOOLONG;
	if (outarg.namelen > FUSE_NAME_MAX)
		goto err;

1412 1413 1414 1415
	err = -EINVAL;
	if (size != sizeof(outarg) + outarg.namelen + 1)
		goto err;

J
John Muir 已提交
1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426
	name.name = buf;
	name.len = outarg.namelen;
	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
	if (err)
		goto err;
	fuse_copy_finish(cs);
	buf[outarg.namelen] = 0;
	name.hash = full_name_hash(name.name, name.len);

	down_read(&fc->killsb);
	err = -ENOENT;
1427
	if (fc->sb)
1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480
		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
	up_read(&fc->killsb);
	kfree(buf);
	return err;

err:
	kfree(buf);
	fuse_copy_finish(cs);
	return err;
}

static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
			      struct fuse_copy_state *cs)
{
	struct fuse_notify_delete_out outarg;
	int err = -ENOMEM;
	char *buf;
	struct qstr name;

	buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
	if (!buf)
		goto err;

	err = -EINVAL;
	if (size < sizeof(outarg))
		goto err;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto err;

	err = -ENAMETOOLONG;
	if (outarg.namelen > FUSE_NAME_MAX)
		goto err;

	err = -EINVAL;
	if (size != sizeof(outarg) + outarg.namelen + 1)
		goto err;

	name.name = buf;
	name.len = outarg.namelen;
	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
	if (err)
		goto err;
	fuse_copy_finish(cs);
	buf[outarg.namelen] = 0;
	name.hash = full_name_hash(name.name, name.len);

	down_read(&fc->killsb);
	err = -ENOENT;
	if (fc->sb)
		err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
					       outarg.child, &name);
J
John Muir 已提交
1481
	up_read(&fc->killsb);
F
Fang Wenqi 已提交
1482
	kfree(buf);
J
John Muir 已提交
1483 1484 1485
	return err;

err:
F
Fang Wenqi 已提交
1486
	kfree(buf);
J
John Muir 已提交
1487 1488 1489 1490
	fuse_copy_finish(cs);
	return err;
}

M
Miklos Szeredi 已提交
1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575
static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
			     struct fuse_copy_state *cs)
{
	struct fuse_notify_store_out outarg;
	struct inode *inode;
	struct address_space *mapping;
	u64 nodeid;
	int err;
	pgoff_t index;
	unsigned int offset;
	unsigned int num;
	loff_t file_size;
	loff_t end;

	err = -EINVAL;
	if (size < sizeof(outarg))
		goto out_finish;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto out_finish;

	err = -EINVAL;
	if (size - sizeof(outarg) != outarg.size)
		goto out_finish;

	nodeid = outarg.nodeid;

	down_read(&fc->killsb);

	err = -ENOENT;
	if (!fc->sb)
		goto out_up_killsb;

	inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
	if (!inode)
		goto out_up_killsb;

	mapping = inode->i_mapping;
	index = outarg.offset >> PAGE_CACHE_SHIFT;
	offset = outarg.offset & ~PAGE_CACHE_MASK;
	file_size = i_size_read(inode);
	end = outarg.offset + outarg.size;
	if (end > file_size) {
		file_size = end;
		fuse_write_update_size(inode, file_size);
	}

	num = outarg.size;
	while (num) {
		struct page *page;
		unsigned int this_num;

		err = -ENOMEM;
		page = find_or_create_page(mapping, index,
					   mapping_gfp_mask(mapping));
		if (!page)
			goto out_iput;

		this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
		err = fuse_copy_page(cs, &page, offset, this_num, 0);
		if (!err && offset == 0 && (num != 0 || file_size == end))
			SetPageUptodate(page);
		unlock_page(page);
		page_cache_release(page);

		if (err)
			goto out_iput;

		num -= this_num;
		offset = 0;
		index++;
	}

	err = 0;

out_iput:
	iput(inode);
out_up_killsb:
	up_read(&fc->killsb);
out_finish:
	fuse_copy_finish(cs);
	return err;
}

M
Miklos Szeredi 已提交
1576 1577
static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
{
M
Miklos Szeredi 已提交
1578
	release_pages(req->pages, req->num_pages, 0);
M
Miklos Szeredi 已提交
1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590
}

static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
			 struct fuse_notify_retrieve_out *outarg)
{
	int err;
	struct address_space *mapping = inode->i_mapping;
	struct fuse_req *req;
	pgoff_t index;
	loff_t file_size;
	unsigned int num;
	unsigned int offset;
1591
	size_t total_len = 0;
M
Maxim Patlasov 已提交
1592
	int num_pages;
M
Miklos Szeredi 已提交
1593

M
Maxim Patlasov 已提交
1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606
	offset = outarg->offset & ~PAGE_CACHE_MASK;
	file_size = i_size_read(inode);

	num = outarg->size;
	if (outarg->offset > file_size)
		num = 0;
	else if (outarg->offset + num > file_size)
		num = file_size - outarg->offset;

	num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
	num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);

	req = fuse_get_req(fc, num_pages);
M
Miklos Szeredi 已提交
1607 1608 1609 1610 1611 1612 1613
	if (IS_ERR(req))
		return PTR_ERR(req);

	req->in.h.opcode = FUSE_NOTIFY_REPLY;
	req->in.h.nodeid = outarg->nodeid;
	req->in.numargs = 2;
	req->in.argpages = 1;
1614
	req->page_descs[0].offset = offset;
M
Miklos Szeredi 已提交
1615 1616 1617 1618
	req->end = fuse_retrieve_end;

	index = outarg->offset >> PAGE_CACHE_SHIFT;

M
Maxim Patlasov 已提交
1619
	while (num && req->num_pages < num_pages) {
M
Miklos Szeredi 已提交
1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630
		struct page *page;
		unsigned int this_num;

		page = find_get_page(mapping, index);
		if (!page)
			break;

		this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
		req->pages[req->num_pages] = page;
		req->num_pages++;

M
Miklos Szeredi 已提交
1631
		offset = 0;
M
Miklos Szeredi 已提交
1632 1633
		num -= this_num;
		total_len += this_num;
M
Miklos Szeredi 已提交
1634
		index++;
M
Miklos Szeredi 已提交
1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685
	}
	req->misc.retrieve_in.offset = outarg->offset;
	req->misc.retrieve_in.size = total_len;
	req->in.args[0].size = sizeof(req->misc.retrieve_in);
	req->in.args[0].value = &req->misc.retrieve_in;
	req->in.args[1].size = total_len;

	err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
	if (err)
		fuse_retrieve_end(fc, req);

	return err;
}

static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
				struct fuse_copy_state *cs)
{
	struct fuse_notify_retrieve_out outarg;
	struct inode *inode;
	int err;

	err = -EINVAL;
	if (size != sizeof(outarg))
		goto copy_finish;

	err = fuse_copy_one(cs, &outarg, sizeof(outarg));
	if (err)
		goto copy_finish;

	fuse_copy_finish(cs);

	down_read(&fc->killsb);
	err = -ENOENT;
	if (fc->sb) {
		u64 nodeid = outarg.nodeid;

		inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
		if (inode) {
			err = fuse_retrieve(fc, inode, &outarg);
			iput(inode);
		}
	}
	up_read(&fc->killsb);

	return err;

copy_finish:
	fuse_copy_finish(cs);
	return err;
}

1686 1687 1688 1689
static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
		       unsigned int size, struct fuse_copy_state *cs)
{
	switch (code) {
T
Tejun Heo 已提交
1690 1691 1692
	case FUSE_NOTIFY_POLL:
		return fuse_notify_poll(fc, size, cs);

J
John Muir 已提交
1693 1694 1695 1696 1697 1698
	case FUSE_NOTIFY_INVAL_INODE:
		return fuse_notify_inval_inode(fc, size, cs);

	case FUSE_NOTIFY_INVAL_ENTRY:
		return fuse_notify_inval_entry(fc, size, cs);

M
Miklos Szeredi 已提交
1699 1700 1701
	case FUSE_NOTIFY_STORE:
		return fuse_notify_store(fc, size, cs);

M
Miklos Szeredi 已提交
1702 1703 1704
	case FUSE_NOTIFY_RETRIEVE:
		return fuse_notify_retrieve(fc, size, cs);

1705 1706 1707
	case FUSE_NOTIFY_DELETE:
		return fuse_notify_delete(fc, size, cs);

1708
	default:
M
Miklos Szeredi 已提交
1709
		fuse_copy_finish(cs);
1710 1711 1712 1713
		return -EINVAL;
	}
}

M
Miklos Szeredi 已提交
1714 1715 1716 1717 1718 1719 1720 1721
/* Look up request on processing list by unique ID */
static struct fuse_req *request_find(struct fuse_conn *fc, u64 unique)
{
	struct list_head *entry;

	list_for_each(entry, &fc->processing) {
		struct fuse_req *req;
		req = list_entry(entry, struct fuse_req, list);
1722
		if (req->in.h.unique == unique || req->intr_unique == unique)
M
Miklos Szeredi 已提交
1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757
			return req;
	}
	return NULL;
}

static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
			 unsigned nbytes)
{
	unsigned reqsize = sizeof(struct fuse_out_header);

	if (out->h.error)
		return nbytes != reqsize ? -EINVAL : 0;

	reqsize += len_args(out->numargs, out->args);

	if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
		return -EINVAL;
	else if (reqsize > nbytes) {
		struct fuse_arg *lastarg = &out->args[out->numargs-1];
		unsigned diffsize = reqsize - nbytes;
		if (diffsize > lastarg->size)
			return -EINVAL;
		lastarg->size -= diffsize;
	}
	return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
			      out->page_zeroing);
}

/*
 * Write a single reply to a request.  First the header is copied from
 * the write buffer.  The request is then searched on the processing
 * list by the unique ID found in the header.  If found, then remove
 * it from the list and copy the rest of the buffer to the request.
 * The request is finished by calling request_end()
 */
1758 1759
static ssize_t fuse_dev_do_write(struct fuse_conn *fc,
				 struct fuse_copy_state *cs, size_t nbytes)
M
Miklos Szeredi 已提交
1760 1761 1762 1763 1764 1765 1766 1767
{
	int err;
	struct fuse_req *req;
	struct fuse_out_header oh;

	if (nbytes < sizeof(struct fuse_out_header))
		return -EINVAL;

1768
	err = fuse_copy_one(cs, &oh, sizeof(oh));
M
Miklos Szeredi 已提交
1769 1770
	if (err)
		goto err_finish;
1771 1772 1773 1774 1775 1776 1777 1778 1779 1780

	err = -EINVAL;
	if (oh.len != nbytes)
		goto err_finish;

	/*
	 * Zero oh.unique indicates unsolicited notification message
	 * and error contains notification code.
	 */
	if (!oh.unique) {
1781
		err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1782 1783 1784
		return err ? err : nbytes;
	}

M
Miklos Szeredi 已提交
1785
	err = -EINVAL;
1786
	if (oh.error <= -1000 || oh.error > 0)
M
Miklos Szeredi 已提交
1787 1788
		goto err_finish;

1789
	spin_lock(&fc->lock);
1790 1791 1792 1793
	err = -ENOENT;
	if (!fc->connected)
		goto err_unlock;

M
Miklos Szeredi 已提交
1794 1795 1796 1797
	req = request_find(fc, oh.unique);
	if (!req)
		goto err_unlock;

1798
	if (req->aborted) {
1799
		spin_unlock(&fc->lock);
1800
		fuse_copy_finish(cs);
1801
		spin_lock(&fc->lock);
1802
		request_end(fc, req);
M
Miklos Szeredi 已提交
1803 1804
		return -ENOENT;
	}
1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816
	/* Is it an interrupt reply? */
	if (req->intr_unique == oh.unique) {
		err = -EINVAL;
		if (nbytes != sizeof(struct fuse_out_header))
			goto err_unlock;

		if (oh.error == -ENOSYS)
			fc->no_interrupt = 1;
		else if (oh.error == -EAGAIN)
			queue_interrupt(fc, req);

		spin_unlock(&fc->lock);
1817
		fuse_copy_finish(cs);
1818 1819 1820 1821
		return nbytes;
	}

	req->state = FUSE_REQ_WRITING;
1822
	list_move(&req->list, &fc->io);
M
Miklos Szeredi 已提交
1823 1824
	req->out.h = oh;
	req->locked = 1;
1825
	cs->req = req;
1826 1827
	if (!req->out.page_replace)
		cs->move_pages = 0;
1828
	spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
1829

1830 1831
	err = copy_out_args(cs, &req->out, nbytes);
	fuse_copy_finish(cs);
M
Miklos Szeredi 已提交
1832

1833
	spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
1834 1835
	req->locked = 0;
	if (!err) {
1836
		if (req->aborted)
M
Miklos Szeredi 已提交
1837
			err = -ENOENT;
1838
	} else if (!req->aborted)
M
Miklos Szeredi 已提交
1839 1840 1841 1842 1843 1844
		req->out.h.error = -EIO;
	request_end(fc, req);

	return err ? err : nbytes;

 err_unlock:
1845
	spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
1846
 err_finish:
1847
	fuse_copy_finish(cs);
M
Miklos Szeredi 已提交
1848 1849 1850
	return err;
}

1851 1852 1853 1854 1855 1856 1857 1858
static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
			      unsigned long nr_segs, loff_t pos)
{
	struct fuse_copy_state cs;
	struct fuse_conn *fc = fuse_get_conn(iocb->ki_filp);
	if (!fc)
		return -EPERM;

1859
	fuse_copy_init(&cs, fc, 0, iov, nr_segs);
1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879

	return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
}

static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
				     struct file *out, loff_t *ppos,
				     size_t len, unsigned int flags)
{
	unsigned nbuf;
	unsigned idx;
	struct pipe_buffer *bufs;
	struct fuse_copy_state cs;
	struct fuse_conn *fc;
	size_t rem;
	ssize_t ret;

	fc = fuse_get_conn(out);
	if (!fc)
		return -EPERM;

1880
	bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923
	if (!bufs)
		return -ENOMEM;

	pipe_lock(pipe);
	nbuf = 0;
	rem = 0;
	for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
		rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;

	ret = -EINVAL;
	if (rem < len) {
		pipe_unlock(pipe);
		goto out;
	}

	rem = len;
	while (rem) {
		struct pipe_buffer *ibuf;
		struct pipe_buffer *obuf;

		BUG_ON(nbuf >= pipe->buffers);
		BUG_ON(!pipe->nrbufs);
		ibuf = &pipe->bufs[pipe->curbuf];
		obuf = &bufs[nbuf];

		if (rem >= ibuf->len) {
			*obuf = *ibuf;
			ibuf->ops = NULL;
			pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
			pipe->nrbufs--;
		} else {
			ibuf->ops->get(pipe, ibuf);
			*obuf = *ibuf;
			obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
			obuf->len = rem;
			ibuf->offset += obuf->len;
			ibuf->len -= obuf->len;
		}
		nbuf++;
		rem -= obuf->len;
	}
	pipe_unlock(pipe);

1924
	fuse_copy_init(&cs, fc, 0, NULL, nbuf);
1925 1926 1927
	cs.pipebufs = bufs;
	cs.pipe = pipe;

1928 1929 1930
	if (flags & SPLICE_F_MOVE)
		cs.move_pages = 1;

1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941
	ret = fuse_dev_do_write(fc, &cs, len);

	for (idx = 0; idx < nbuf; idx++) {
		struct pipe_buffer *buf = &bufs[idx];
		buf->ops->release(pipe, buf);
	}
out:
	kfree(bufs);
	return ret;
}

M
Miklos Szeredi 已提交
1942 1943 1944
static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
{
	unsigned mask = POLLOUT | POLLWRNORM;
1945
	struct fuse_conn *fc = fuse_get_conn(file);
M
Miklos Szeredi 已提交
1946
	if (!fc)
1947
		return POLLERR;
M
Miklos Szeredi 已提交
1948 1949 1950

	poll_wait(file, &fc->waitq, wait);

1951
	spin_lock(&fc->lock);
1952 1953
	if (!fc->connected)
		mask = POLLERR;
1954
	else if (request_pending(fc))
1955
		mask |= POLLIN | POLLRDNORM;
1956
	spin_unlock(&fc->lock);
M
Miklos Szeredi 已提交
1957 1958 1959 1960

	return mask;
}

1961 1962 1963
/*
 * Abort all requests on the given list (pending or processing)
 *
1964
 * This function releases and reacquires fc->lock
1965
 */
M
Miklos Szeredi 已提交
1966
static void end_requests(struct fuse_conn *fc, struct list_head *head)
M
Miklos Szeredi 已提交
1967 1968
__releases(fc->lock)
__acquires(fc->lock)
M
Miklos Szeredi 已提交
1969 1970 1971 1972 1973 1974
{
	while (!list_empty(head)) {
		struct fuse_req *req;
		req = list_entry(head->next, struct fuse_req, list);
		req->out.h.error = -ECONNABORTED;
		request_end(fc, req);
1975
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
1976 1977 1978
	}
}

1979 1980 1981
/*
 * Abort requests under I/O
 *
1982
 * The requests are set to aborted and finished, and the request
1983 1984
 * waiter is woken up.  This will make request_wait_answer() wait
 * until the request is unlocked and then return.
1985 1986 1987 1988
 *
 * If the request is asynchronous, then the end function needs to be
 * called after waiting for the request to be unlocked (if it was
 * locked).
1989 1990
 */
static void end_io_requests(struct fuse_conn *fc)
M
Miklos Szeredi 已提交
1991 1992
__releases(fc->lock)
__acquires(fc->lock)
1993 1994
{
	while (!list_empty(&fc->io)) {
1995 1996 1997 1998
		struct fuse_req *req =
			list_entry(fc->io.next, struct fuse_req, list);
		void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;

1999
		req->aborted = 1;
2000 2001 2002 2003
		req->out.h.error = -ECONNABORTED;
		req->state = FUSE_REQ_FINISHED;
		list_del_init(&req->list);
		wake_up(&req->waitq);
2004 2005 2006
		if (end) {
			req->end = NULL;
			__fuse_get_request(req);
2007
			spin_unlock(&fc->lock);
2008 2009
			wait_event(req->waitq, !req->locked);
			end(fc, req);
2010
			fuse_put_request(fc, req);
2011
			spin_lock(&fc->lock);
2012
		}
2013 2014 2015
	}
}

2016
static void end_queued_requests(struct fuse_conn *fc)
M
Miklos Szeredi 已提交
2017 2018
__releases(fc->lock)
__acquires(fc->lock)
2019 2020 2021 2022 2023
{
	fc->max_background = UINT_MAX;
	flush_bg_queue(fc);
	end_requests(fc, &fc->pending);
	end_requests(fc, &fc->processing);
2024
	while (forget_pending(fc))
2025
		kfree(dequeue_forget(fc, 1, NULL));
2026 2027
}

2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042
static void end_polls(struct fuse_conn *fc)
{
	struct rb_node *p;

	p = rb_first(&fc->polled_files);

	while (p) {
		struct fuse_file *ff;
		ff = rb_entry(p, struct fuse_file, polled_node);
		wake_up_interruptible_all(&ff->poll_wait);

		p = rb_next(p);
	}
}

2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058
/*
 * Abort all requests.
 *
 * Emergency exit in case of a malicious or accidental deadlock, or
 * just a hung filesystem.
 *
 * The same effect is usually achievable through killing the
 * filesystem daemon and all users of the filesystem.  The exception
 * is the combination of an asynchronous request and the tricky
 * deadlock (see Documentation/filesystems/fuse.txt).
 *
 * During the aborting, progression of requests from the pending and
 * processing lists onto the io list, and progression of new requests
 * onto the pending list is prevented by req->connected being false.
 *
 * Progression of requests under I/O to the processing list is
2059 2060
 * prevented by the req->aborted flag being true for these requests.
 * For this reason requests on the io list must be aborted first.
2061 2062 2063
 */
void fuse_abort_conn(struct fuse_conn *fc)
{
2064
	spin_lock(&fc->lock);
2065 2066
	if (fc->connected) {
		fc->connected = 0;
2067
		fc->blocked = 0;
2068
		end_io_requests(fc);
2069
		end_queued_requests(fc);
2070
		end_polls(fc);
2071
		wake_up_all(&fc->waitq);
2072
		wake_up_all(&fc->blocked_waitq);
2073
		kill_fasync(&fc->fasync, SIGIO, POLL_IN);
2074
	}
2075
	spin_unlock(&fc->lock);
2076
}
2077
EXPORT_SYMBOL_GPL(fuse_abort_conn);
2078

2079
int fuse_dev_release(struct inode *inode, struct file *file)
M
Miklos Szeredi 已提交
2080
{
M
Miklos Szeredi 已提交
2081
	struct fuse_conn *fc = fuse_get_conn(file);
M
Miklos Szeredi 已提交
2082
	if (fc) {
2083
		spin_lock(&fc->lock);
M
Miklos Szeredi 已提交
2084
		fc->connected = 0;
2085 2086
		fc->blocked = 0;
		end_queued_requests(fc);
2087
		end_polls(fc);
2088
		wake_up_all(&fc->blocked_waitq);
2089
		spin_unlock(&fc->lock);
2090
		fuse_conn_put(fc);
2091
	}
2092

M
Miklos Szeredi 已提交
2093 2094
	return 0;
}
2095
EXPORT_SYMBOL_GPL(fuse_dev_release);
M
Miklos Szeredi 已提交
2096

2097 2098 2099 2100
static int fuse_dev_fasync(int fd, struct file *file, int on)
{
	struct fuse_conn *fc = fuse_get_conn(file);
	if (!fc)
2101
		return -EPERM;
2102 2103 2104 2105 2106

	/* No locking - fasync_helper does its own locking */
	return fasync_helper(fd, file, on, &fc->fasync);
}

2107
const struct file_operations fuse_dev_operations = {
M
Miklos Szeredi 已提交
2108 2109
	.owner		= THIS_MODULE,
	.llseek		= no_llseek,
2110 2111
	.read		= do_sync_read,
	.aio_read	= fuse_dev_read,
2112
	.splice_read	= fuse_dev_splice_read,
2113 2114
	.write		= do_sync_write,
	.aio_write	= fuse_dev_write,
2115
	.splice_write	= fuse_dev_splice_write,
M
Miklos Szeredi 已提交
2116 2117
	.poll		= fuse_dev_poll,
	.release	= fuse_dev_release,
2118
	.fasync		= fuse_dev_fasync,
M
Miklos Szeredi 已提交
2119
};
2120
EXPORT_SYMBOL_GPL(fuse_dev_operations);
M
Miklos Szeredi 已提交
2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132

static struct miscdevice fuse_miscdevice = {
	.minor = FUSE_MINOR,
	.name  = "fuse",
	.fops = &fuse_dev_operations,
};

int __init fuse_dev_init(void)
{
	int err = -ENOMEM;
	fuse_req_cachep = kmem_cache_create("fuse_request",
					    sizeof(struct fuse_req),
2133
					    0, 0, NULL);
M
Miklos Szeredi 已提交
2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153
	if (!fuse_req_cachep)
		goto out;

	err = misc_register(&fuse_miscdevice);
	if (err)
		goto out_cache_clean;

	return 0;

 out_cache_clean:
	kmem_cache_destroy(fuse_req_cachep);
 out:
	return err;
}

void fuse_dev_cleanup(void)
{
	misc_deregister(&fuse_miscdevice);
	kmem_cache_destroy(fuse_req_cachep);
}