fs/fuse/dev.c

   1 /*
   2   FUSE: Filesystem in Userspace
   3   Copyright (C) 2001-2008  Miklos Szeredi <miklos@szeredi.hu>
   4
   5   This program can be distributed under the terms of the GNU GPL.
   6   See the file COPYING.
   7 */
   8
   9 #include "fuse_i.h"
  10
  11 #include <linux/init.h>
  12 #include <linux/module.h>
  13 #include <linux/poll.h>
  14 #include <linux/uio.h>
  15 #include <linux/miscdevice.h>
  16 #include <linux/pagemap.h>
  17 #include <linux/file.h>
  18 #include <linux/slab.h>
  19 #include <linux/pipe_fs_i.h>
  20 #include <linux/swap.h>
  21 #include <linux/splice.h>
  22
  23 MODULE_ALIAS_MISCDEV(FUSE_MINOR);
  24 MODULE_ALIAS("devname:fuse");
  25
  26 static struct kmem_cache *fuse_req_cachep;
  27
  28 static struct fuse_conn *fuse_get_conn(struct file *file)
  29 {
  30         /*
  31          * Lockless access is OK, because file->private data is set
  32          * once during mount and is valid until the file is released.
  33          */
  34         return file->private_data;
  35 }
  36
  37 static void fuse_request_init(struct fuse_req *req, struct page **pages,
  38                               struct fuse_page_desc *page_descs,
  39                               unsigned npages)
  40 {
  41         memset(req, 0, sizeof(*req));
  42         memset(pages, 0, sizeof(*pages) * npages);
  43         memset(page_descs, 0, sizeof(*page_descs) * npages);
  44         INIT_LIST_HEAD(&req->list);
  45         INIT_LIST_HEAD(&req->intr_entry);
  46         init_waitqueue_head(&req->waitq);
  47         atomic_set(&req->count, 1);
  48         req->pages = pages;
  49         req->page_descs = page_descs;
  50         req->max_pages = npages;
  51 }
  52
  53 static struct fuse_req *__fuse_request_alloc(unsigned npages, gfp_t flags)
  54 {
  55         struct fuse_req *req = kmem_cache_alloc(fuse_req_cachep, flags);
  56         if (req) {
  57                 struct page **pages;
  58                 struct fuse_page_desc *page_descs;
  59
  60                 if (npages <= FUSE_REQ_INLINE_PAGES) {
  61                         pages = req->inline_pages;
  62                         page_descs = req->inline_page_descs;
  63                 } else {
  64                         pages = kmalloc(sizeof(struct page *) * npages, flags);
  65                         page_descs = kmalloc(sizeof(struct fuse_page_desc) *
  66                                              npages, flags);
  67                 }
  68
  69                 if (!pages || !page_descs) {
  70                         kfree(pages);
  71                         kfree(page_descs);
  72                         kmem_cache_free(fuse_req_cachep, req);
  73                         return NULL;
  74                 }
  75
  76                 fuse_request_init(req, pages, page_descs, npages);
  77         }
  78         return req;
  79 }
  80
  81 struct fuse_req *fuse_request_alloc(unsigned npages)
  82 {
  83         return __fuse_request_alloc(npages, GFP_KERNEL);
  84 }
  85 EXPORT_SYMBOL_GPL(fuse_request_alloc);
  86
  87 struct fuse_req *fuse_request_alloc_nofs(unsigned npages)
  88 {
  89         return __fuse_request_alloc(npages, GFP_NOFS);
  90 }
  91
  92 void fuse_request_free(struct fuse_req *req)
  93 {
  94         if (req->pages != req->inline_pages) {
  95                 kfree(req->pages);
  96                 kfree(req->page_descs);
  97         }
  98         kmem_cache_free(fuse_req_cachep, req);
  99 }
 100
 101 static void block_sigs(sigset_t *oldset)
 102 {
 103         sigset_t mask;
 104
 105         siginitsetinv(&mask, sigmask(SIGKILL));
 106         sigprocmask(SIG_BLOCK, &mask, oldset);
 107 }
 108
 109 static void restore_sigs(sigset_t *oldset)
 110 {
 111         sigprocmask(SIG_SETMASK, oldset, NULL);
 112 }
 113
 114 static void __fuse_get_request(struct fuse_req *req)
 115 {
 116         atomic_inc(&req->count);
 117 }
 118
 119 /* Must be called with > 1 refcount */
 120 static void __fuse_put_request(struct fuse_req *req)
 121 {
 122         BUG_ON(atomic_read(&req->count) < 2);
 123         atomic_dec(&req->count);
 124 }
 125
 126 static void fuse_req_init_context(struct fuse_req *req)
 127 {
 128         req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid());
 129         req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid());
 130         req->in.h.pid = current->pid;
 131 }
 132
 133 struct fuse_req *fuse_get_req(struct fuse_conn *fc, unsigned npages)
 134 {
 135         struct fuse_req *req;
 136         sigset_t oldset;
 137         int intr;
 138         int err;
 139
 140         atomic_inc(&fc->num_waiting);
 141         block_sigs(&oldset);
 142         intr = wait_event_interruptible(fc->blocked_waitq, !fc->blocked);
 143         restore_sigs(&oldset);
 144         err = -EINTR;
 145         if (intr)
 146                 goto out;
 147
 148         err = -ENOTCONN;
 149         if (!fc->connected)
 150                 goto out;
 151
 152         req = fuse_request_alloc(npages);
 153         err = -ENOMEM;
 154         if (!req)
 155                 goto out;
 156
 157         fuse_req_init_context(req);
 158         req->waiting = 1;
 159         return req;
 160
 161  out:
 162         atomic_dec(&fc->num_waiting);
 163         return ERR_PTR(err);
 164 }
 165 EXPORT_SYMBOL_GPL(fuse_get_req);
 166
 167 /*
 168  * Return request in fuse_file->reserved_req.  However that may
 169  * currently be in use.  If that is the case, wait for it to become
 170  * available.
 171  */
 172 static struct fuse_req *get_reserved_req(struct fuse_conn *fc,
 173                                          struct file *file)
 174 {
 175         struct fuse_req *req = NULL;
 176         struct fuse_file *ff = file->private_data;
 177
 178         do {
 179                 wait_event(fc->reserved_req_waitq, ff->reserved_req);
 180                 spin_lock(&fc->lock);
 181                 if (ff->reserved_req) {
 182                         req = ff->reserved_req;
 183                         ff->reserved_req = NULL;
 184                         req->stolen_file = get_file(file);
 185                 }
 186                 spin_unlock(&fc->lock);
 187         } while (!req);
 188
 189         return req;
 190 }
 191
 192 /*
 193  * Put stolen request back into fuse_file->reserved_req
 194  */
 195 static void put_reserved_req(struct fuse_conn *fc, struct fuse_req *req)
 196 {
 197         struct file *file = req->stolen_file;
 198         struct fuse_file *ff = file->private_data;
 199
 200         spin_lock(&fc->lock);
 201         fuse_request_init(req, req->pages, req->page_descs, req->max_pages);
 202         BUG_ON(ff->reserved_req);
 203         ff->reserved_req = req;
 204         wake_up_all(&fc->reserved_req_waitq);
 205         spin_unlock(&fc->lock);
 206         fput(file);
 207 }
 208
 209 /*
 210  * Gets a requests for a file operation, always succeeds
 211  *
 212  * This is used for sending the FLUSH request, which must get to
 213  * userspace, due to POSIX locks which may need to be unlocked.
 214  *
 215  * If allocation fails due to OOM, use the reserved request in
 216  * fuse_file.
 217  *
 218  * This is very unlikely to deadlock accidentally, since the
 219  * filesystem should not have it's own file open.  If deadlock is
 220  * intentional, it can still be broken by "aborting" the filesystem.
 221  */
 222 struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc,
 223                                              struct file *file)
 224 {
 225         struct fuse_req *req;
 226
 227         atomic_inc(&fc->num_waiting);
 228         wait_event(fc->blocked_waitq, !fc->blocked);
 229         req = fuse_request_alloc(0);
 230         if (!req)
 231                 req = get_reserved_req(fc, file);
 232
 233         fuse_req_init_context(req);
 234         req->waiting = 1;
 235         return req;
 236 }
 237
 238 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 239 {
 240         if (atomic_dec_and_test(&req->count)) {
 241                 if (req->waiting)
 242                         atomic_dec(&fc->num_waiting);
 243
 244                 if (req->stolen_file)
 245                         put_reserved_req(fc, req);
 246                 else
 247                         fuse_request_free(req);
 248         }
 249 }
 250 EXPORT_SYMBOL_GPL(fuse_put_request);
 251
 252 static unsigned len_args(unsigned numargs, struct fuse_arg *args)
 253 {
 254         unsigned nbytes = 0;
 255         unsigned i;
 256
 257         for (i = 0; i < numargs; i++)
 258                 nbytes += args[i].size;
 259
 260         return nbytes;
 261 }
 262
 263 static u64 fuse_get_unique(struct fuse_conn *fc)
 264 {
 265         fc->reqctr++;
 266         /* zero is special */
 267         if (fc->reqctr == 0)
 268                 fc->reqctr = 1;
 269
 270         return fc->reqctr;
 271 }
 272
 273 static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
 274 {
 275         req->in.h.len = sizeof(struct fuse_in_header) +
 276                 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
 277         list_add_tail(&req->list, &fc->pending);
 278         req->state = FUSE_REQ_PENDING;
 279         if (!req->waiting) {
 280                 req->waiting = 1;
 281                 atomic_inc(&fc->num_waiting);
 282         }
 283         wake_up(&fc->waitq);
 284         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 285 }
 286
 287 void fuse_queue_forget(struct fuse_conn *fc, struct fuse_forget_link *forget,
 288                        u64 nodeid, u64 nlookup)
 289 {
 290         forget->forget_one.nodeid = nodeid;
 291         forget->forget_one.nlookup = nlookup;
 292
 293         spin_lock(&fc->lock);
 294         if (fc->connected) {
 295                 fc->forget_list_tail->next = forget;
 296                 fc->forget_list_tail = forget;
 297                 wake_up(&fc->waitq);
 298                 kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 299         } else {
 300                 kfree(forget);
 301         }
 302         spin_unlock(&fc->lock);
 303 }
 304
 305 static void flush_bg_queue(struct fuse_conn *fc)
 306 {
 307         while (fc->active_background < fc->max_background &&
 308                !list_empty(&fc->bg_queue)) {
 309                 struct fuse_req *req;
 310
 311                 req = list_entry(fc->bg_queue.next, struct fuse_req, list);
 312                 list_del(&req->list);
 313                 fc->active_background++;
 314                 req->in.h.unique = fuse_get_unique(fc);
 315                 queue_request(fc, req);
 316         }
 317 }
 318
 319 /*
 320  * This function is called when a request is finished.  Either a reply
 321  * has arrived or it was aborted (and not yet sent) or some error
 322  * occurred during communication with userspace, or the device file
 323  * was closed.  The requester thread is woken up (if still waiting),
 324  * the 'end' callback is called if given, else the reference to the
 325  * request is released
 326  *
 327  * Called with fc->lock, unlocks it
 328  */
 329 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 330 __releases(fc->lock)
 331 {
 332         void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
 333         req->end = NULL;
 334         list_del(&req->list);
 335         list_del(&req->intr_entry);
 336         req->state = FUSE_REQ_FINISHED;
 337         if (req->background) {
 338                 if (fc->num_background == fc->max_background) {
 339                         fc->blocked = 0;
 340                         wake_up_all(&fc->blocked_waitq);
 341                 }
 342                 if (fc->num_background == fc->congestion_threshold &&
 343                     fc->connected && fc->bdi_initialized) {
 344                         clear_bdi_congested(&fc->bdi, BLK_RW_SYNC);
 345                         clear_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
 346                 }
 347                 fc->num_background--;
 348                 fc->active_background--;
 349                 flush_bg_queue(fc);
 350         }
 351         spin_unlock(&fc->lock);
 352         wake_up(&req->waitq);
 353         if (end)
 354                 end(fc, req);
 355         fuse_put_request(fc, req);
 356 }
 357
 358 static void wait_answer_interruptible(struct fuse_conn *fc,
 359                                       struct fuse_req *req)
 360 __releases(fc->lock)
 361 __acquires(fc->lock)
 362 {
 363         if (signal_pending(current))
 364                 return;
 365
 366         spin_unlock(&fc->lock);
 367         wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
 368         spin_lock(&fc->lock);
 369 }
 370
 371 static void queue_interrupt(struct fuse_conn *fc, struct fuse_req *req)
 372 {
 373         list_add_tail(&req->intr_entry, &fc->interrupts);
 374         wake_up(&fc->waitq);
 375         kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 376 }
 377
 378 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 379 __releases(fc->lock)
 380 __acquires(fc->lock)
 381 {
 382         if (!fc->no_interrupt) {
 383                 /* Any signal may interrupt this */
 384                 wait_answer_interruptible(fc, req);
 385
 386                 if (req->aborted)
 387                         goto aborted;
 388                 if (req->state == FUSE_REQ_FINISHED)
 389                         return;
 390
 391                 req->interrupted = 1;
 392                 if (req->state == FUSE_REQ_SENT)
 393                         queue_interrupt(fc, req);
 394         }
 395
 396         if (!req->force) {
 397                 sigset_t oldset;
 398
 399                 /* Only fatal signals may interrupt this */
 400                 block_sigs(&oldset);
 401                 wait_answer_interruptible(fc, req);
 402                 restore_sigs(&oldset);
 403
 404                 if (req->aborted)
 405                         goto aborted;
 406                 if (req->state == FUSE_REQ_FINISHED)
 407                         return;
 408
 409                 /* Request is not yet in userspace, bail out */
 410                 if (req->state == FUSE_REQ_PENDING) {
 411                         list_del(&req->list);
 412                         __fuse_put_request(req);
 413                         req->out.h.error = -EINTR;
 414                         return;
 415                 }
 416         }
 417
 418         /*
 419          * Either request is already in userspace, or it was forced.
 420          * Wait it out.
 421          */
 422         spin_unlock(&fc->lock);
 423         wait_event(req->waitq, req->state == FUSE_REQ_FINISHED);
 424         spin_lock(&fc->lock);
 425
 426         if (!req->aborted)
 427                 return;
 428
 429  aborted:
 430         BUG_ON(req->state != FUSE_REQ_FINISHED);
 431         if (req->locked) {
 432                 /* This is uninterruptible sleep, because data is
 433                    being copied to/from the buffers of req.  During
 434                    locked state, there mustn't be any filesystem
 435                    operation (e.g. page fault), since that could lead
 436                    to deadlock */
 437                 spin_unlock(&fc->lock);
 438                 wait_event(req->waitq, !req->locked);
 439                 spin_lock(&fc->lock);
 440         }
 441 }
 442
 443 void fuse_request_send(struct fuse_conn *fc, struct fuse_req *req)
 444 {
 445         req->isreply = 1;
 446         spin_lock(&fc->lock);
 447         if (!fc->connected)
 448                 req->out.h.error = -ENOTCONN;
 449         else if (fc->conn_error)
 450                 req->out.h.error = -ECONNREFUSED;
 451         else {
 452                 req->in.h.unique = fuse_get_unique(fc);
 453                 queue_request(fc, req);
 454                 /* acquire extra reference, since request is still needed
 455                    after request_end() */
 456                 __fuse_get_request(req);
 457
 458                 request_wait_answer(fc, req);
 459         }
 460         spin_unlock(&fc->lock);
 461 }
 462 EXPORT_SYMBOL_GPL(fuse_request_send);
 463
 464 static void fuse_request_send_nowait_locked(struct fuse_conn *fc,
 465                                             struct fuse_req *req)
 466 {
 467         req->background = 1;
 468         fc->num_background++;
 469         if (fc->num_background == fc->max_background)
 470                 fc->blocked = 1;
 471         if (fc->num_background == fc->congestion_threshold &&
 472             fc->bdi_initialized) {
 473                 set_bdi_congested(&fc->bdi, BLK_RW_SYNC);
 474                 set_bdi_congested(&fc->bdi, BLK_RW_ASYNC);
 475         }
 476         list_add_tail(&req->list, &fc->bg_queue);
 477         flush_bg_queue(fc);
 478 }
 479
 480 static void fuse_request_send_nowait(struct fuse_conn *fc, struct fuse_req *req)
 481 {
 482         spin_lock(&fc->lock);
 483         if (fc->connected) {
 484                 fuse_request_send_nowait_locked(fc, req);
 485                 spin_unlock(&fc->lock);
 486         } else {
 487                 req->out.h.error = -ENOTCONN;
 488                 request_end(fc, req);
 489         }
 490 }
 491
 492 void fuse_request_send_background(struct fuse_conn *fc, struct fuse_req *req)
 493 {
 494         req->isreply = 1;
 495         fuse_request_send_nowait(fc, req);
 496 }
 497 EXPORT_SYMBOL_GPL(fuse_request_send_background);
 498
 499 static int fuse_request_send_notify_reply(struct fuse_conn *fc,
 500                                           struct fuse_req *req, u64 unique)
 501 {
 502         int err = -ENODEV;
 503
 504         req->isreply = 0;
 505         req->in.h.unique = unique;
 506         spin_lock(&fc->lock);
 507         if (fc->connected) {
 508                 queue_request(fc, req);
 509                 err = 0;
 510         }
 511         spin_unlock(&fc->lock);
 512
 513         return err;
 514 }
 515
 516 /*
 517  * Called under fc->lock
 518  *
 519  * fc->connected must have been checked previously
 520  */
 521 void fuse_request_send_background_locked(struct fuse_conn *fc,
 522                                          struct fuse_req *req)
 523 {
 524         req->isreply = 1;
 525         fuse_request_send_nowait_locked(fc, req);
 526 }
 527
 528 void fuse_force_forget(struct file *file, u64 nodeid)
 529 {
 530         struct inode *inode = file->f_path.dentry->d_inode;
 531         struct fuse_conn *fc = get_fuse_conn(inode);
 532         struct fuse_req *req;
 533         struct fuse_forget_in inarg;
 534
 535         memset(&inarg, 0, sizeof(inarg));
 536         inarg.nlookup = 1;
 537         req = fuse_get_req_nofail_nopages(fc, file);
 538         req->in.h.opcode = FUSE_FORGET;
 539         req->in.h.nodeid = nodeid;
 540         req->in.numargs = 1;
 541         req->in.args[0].size = sizeof(inarg);
 542         req->in.args[0].value = &inarg;
 543         req->isreply = 0;
 544         fuse_request_send_nowait(fc, req);
 545 }
 546
 547 /*
 548  * Lock the request.  Up to the next unlock_request() there mustn't be
 549  * anything that could cause a page-fault.  If the request was already
 550  * aborted bail out.
 551  */
 552 static int lock_request(struct fuse_conn *fc, struct fuse_req *req)
 553 {
 554         int err = 0;
 555         if (req) {
 556                 spin_lock(&fc->lock);
 557                 if (req->aborted)
 558                         err = -ENOENT;
 559                 else
 560                         req->locked = 1;
 561                 spin_unlock(&fc->lock);
 562         }
 563         return err;
 564 }
 565
 566 /*
 567  * Unlock request.  If it was aborted during being locked, the
 568  * requester thread is currently waiting for it to be unlocked, so
 569  * wake it up.
 570  */
 571 static void unlock_request(struct fuse_conn *fc, struct fuse_req *req)
 572 {
 573         if (req) {
 574                 spin_lock(&fc->lock);
 575                 req->locked = 0;
 576                 if (req->aborted)
 577                         wake_up(&req->waitq);
 578                 spin_unlock(&fc->lock);
 579         }
 580 }
 581
 582 struct fuse_copy_state {
 583         struct fuse_conn *fc;
 584         int write;
 585         struct fuse_req *req;
 586         const struct iovec *iov;
 587         struct pipe_buffer *pipebufs;
 588         struct pipe_buffer *currbuf;
 589         struct pipe_inode_info *pipe;
 590         unsigned long nr_segs;
 591         unsigned long seglen;
 592         unsigned long addr;
 593         struct page *pg;
 594         void *mapaddr;
 595         void *buf;
 596         unsigned len;
 597         unsigned move_pages:1;
 598 };
 599
 600 static void fuse_copy_init(struct fuse_copy_state *cs, struct fuse_conn *fc,
 601                            int write,
 602                            const struct iovec *iov, unsigned long nr_segs)
 603 {
 604         memset(cs, 0, sizeof(*cs));
 605         cs->fc = fc;
 606         cs->write = write;
 607         cs->iov = iov;
 608         cs->nr_segs = nr_segs;
 609 }
 610
 611 /* Unmap and put previous page of userspace buffer */
 612 static void fuse_copy_finish(struct fuse_copy_state *cs)
 613 {
 614         if (cs->currbuf) {
 615                 struct pipe_buffer *buf = cs->currbuf;
 616
 617                 if (!cs->write) {
 618                         buf->ops->unmap(cs->pipe, buf, cs->mapaddr);
 619                 } else {
 620                         kunmap(buf->page);
 621                         buf->len = PAGE_SIZE - cs->len;
 622                 }
 623                 cs->currbuf = NULL;
 624                 cs->mapaddr = NULL;
 625         } else if (cs->mapaddr) {
 626                 kunmap(cs->pg);
 627                 if (cs->write) {
 628                         flush_dcache_page(cs->pg);
 629                         set_page_dirty_lock(cs->pg);
 630                 }
 631                 put_page(cs->pg);
 632                 cs->mapaddr = NULL;
 633         }
 634 }
 635
 636 /*
 637  * Get another pagefull of userspace buffer, and map it to kernel
 638  * address space, and lock request
 639  */
 640 static int fuse_copy_fill(struct fuse_copy_state *cs)
 641 {
 642         unsigned long offset;
 643         int err;
 644
 645         unlock_request(cs->fc, cs->req);
 646         fuse_copy_finish(cs);
 647         if (cs->pipebufs) {
 648                 struct pipe_buffer *buf = cs->pipebufs;
 649
 650                 if (!cs->write) {
 651                         err = buf->ops->confirm(cs->pipe, buf);
 652                         if (err)
 653                                 return err;
 654
 655                         BUG_ON(!cs->nr_segs);
 656                         cs->currbuf = buf;
 657                         cs->mapaddr = buf->ops->map(cs->pipe, buf, 0);
 658                         cs->len = buf->len;
 659                         cs->buf = cs->mapaddr + buf->offset;
 660                         cs->pipebufs++;
 661                         cs->nr_segs--;
 662                 } else {
 663                         struct page *page;
 664
 665                         if (cs->nr_segs == cs->pipe->buffers)
 666                                 return -EIO;
 667
 668                         page = alloc_page(GFP_HIGHUSER);
 669                         if (!page)
 670                                 return -ENOMEM;
 671
 672                         buf->page = page;
 673                         buf->offset = 0;
 674                         buf->len = 0;
 675
 676                         cs->currbuf = buf;
 677                         cs->mapaddr = kmap(page);
 678                         cs->buf = cs->mapaddr;
 679                         cs->len = PAGE_SIZE;
 680                         cs->pipebufs++;
 681                         cs->nr_segs++;
 682                 }
 683         } else {
 684                 if (!cs->seglen) {
 685                         BUG_ON(!cs->nr_segs);
 686                         cs->seglen = cs->iov[0].iov_len;
 687                         cs->addr = (unsigned long) cs->iov[0].iov_base;
 688                         cs->iov++;
 689                         cs->nr_segs--;
 690                 }
 691                 err = get_user_pages_fast(cs->addr, 1, cs->write, &cs->pg);
 692                 if (err < 0)
 693                         return err;
 694                 BUG_ON(err != 1);
 695                 offset = cs->addr % PAGE_SIZE;
 696                 cs->mapaddr = kmap(cs->pg);
 697                 cs->buf = cs->mapaddr + offset;
 698                 cs->len = min(PAGE_SIZE - offset, cs->seglen);
 699                 cs->seglen -= cs->len;
 700                 cs->addr += cs->len;
 701         }
 702
 703         return lock_request(cs->fc, cs->req);
 704 }
 705
 706 /* Do as much copy to/from userspace buffer as we can */
 707 static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
 708 {
 709         unsigned ncpy = min(*size, cs->len);
 710         if (val) {
 711                 if (cs->write)
 712                         memcpy(cs->buf, *val, ncpy);
 713                 else
 714                         memcpy(*val, cs->buf, ncpy);
 715                 *val += ncpy;
 716         }
 717         *size -= ncpy;
 718         cs->len -= ncpy;
 719         cs->buf += ncpy;
 720         return ncpy;
 721 }
 722
 723 static int fuse_check_page(struct page *page)
 724 {
 725         if (page_mapcount(page) ||
 726             page->mapping != NULL ||
 727             page_count(page) != 1 ||
 728             (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
 729              ~(1 << PG_locked |
 730                1 << PG_referenced |
 731                1 << PG_uptodate |
 732                1 << PG_lru |
 733                1 << PG_active |
 734                1 << PG_reclaim))) {
 735                 printk(KERN_WARNING "fuse: trying to steal weird page\n");
 736                 printk(KERN_WARNING "  page=%p index=%li flags=%08lx, count=%i, mapcount=%i, mapping=%p\n", page, page->index, page->flags, page_count(page), page_mapcount(page), page->mapping);
 737                 return 1;
 738         }
 739         return 0;
 740 }
 741
 742 static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
 743 {
 744         int err;
 745         struct page *oldpage = *pagep;
 746         struct page *newpage;
 747         struct pipe_buffer *buf = cs->pipebufs;
 748
 749         unlock_request(cs->fc, cs->req);
 750         fuse_copy_finish(cs);
 751
 752         err = buf->ops->confirm(cs->pipe, buf);
 753         if (err)
 754                 return err;
 755
 756         BUG_ON(!cs->nr_segs);
 757         cs->currbuf = buf;
 758         cs->len = buf->len;
 759         cs->pipebufs++;
 760         cs->nr_segs--;
 761
 762         if (cs->len != PAGE_SIZE)
 763                 goto out_fallback;
 764
 765         if (buf->ops->steal(cs->pipe, buf) != 0)
 766                 goto out_fallback;
 767
 768         newpage = buf->page;
 769
 770         if (WARN_ON(!PageUptodate(newpage)))
 771                 return -EIO;
 772
 773         ClearPageMappedToDisk(newpage);
 774
 775         if (fuse_check_page(newpage) != 0)
 776                 goto out_fallback_unlock;
 777
 778         /*
 779          * This is a new and locked page, it shouldn't be mapped or
 780          * have any special flags on it
 781          */
 782         if (WARN_ON(page_mapped(oldpage)))
 783                 goto out_fallback_unlock;
 784         if (WARN_ON(page_has_private(oldpage)))
 785                 goto out_fallback_unlock;
 786         if (WARN_ON(PageDirty(oldpage) || PageWriteback(oldpage)))
 787                 goto out_fallback_unlock;
 788         if (WARN_ON(PageMlocked(oldpage)))
 789                 goto out_fallback_unlock;
 790
 791         err = replace_page_cache_page(oldpage, newpage, GFP_KERNEL);
 792         if (err) {
 793                 unlock_page(newpage);
 794                 return err;
 795         }
 796
 797         page_cache_get(newpage);
 798
 799         if (!(buf->flags & PIPE_BUF_FLAG_LRU))
 800                 lru_cache_add_file(newpage);
 801
 802         err = 0;
 803         spin_lock(&cs->fc->lock);
 804         if (cs->req->aborted)
 805                 err = -ENOENT;
 806         else
 807                 *pagep = newpage;
 808         spin_unlock(&cs->fc->lock);
 809
 810         if (err) {
 811                 unlock_page(newpage);
 812                 page_cache_release(newpage);
 813                 return err;
 814         }
 815
 816         unlock_page(oldpage);
 817         page_cache_release(oldpage);
 818         cs->len = 0;
 819
 820         return 0;
 821
 822 out_fallback_unlock:
 823         unlock_page(newpage);
 824 out_fallback:
 825         cs->mapaddr = buf->ops->map(cs->pipe, buf, 1);
 826         cs->buf = cs->mapaddr + buf->offset;
 827
 828         err = lock_request(cs->fc, cs->req);
 829         if (err)
 830                 return err;
 831
 832         return 1;
 833 }
 834
 835 static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
 836                          unsigned offset, unsigned count)
 837 {
 838         struct pipe_buffer *buf;
 839
 840         if (cs->nr_segs == cs->pipe->buffers)
 841                 return -EIO;
 842
 843         unlock_request(cs->fc, cs->req);
 844         fuse_copy_finish(cs);
 845
 846         buf = cs->pipebufs;
 847         page_cache_get(page);
 848         buf->page = page;
 849         buf->offset = offset;
 850         buf->len = count;
 851
 852         cs->pipebufs++;
 853         cs->nr_segs++;
 854         cs->len = 0;
 855
 856         return 0;
 857 }
 858
 859 /*
 860  * Copy a page in the request to/from the userspace buffer.  Must be
 861  * done atomically
 862  */
 863 static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep,
 864                           unsigned offset, unsigned count, int zeroing)
 865 {
 866         int err;
 867         struct page *page = *pagep;
 868
 869         if (page && zeroing && count < PAGE_SIZE)
 870                 clear_highpage(page);
 871
 872         while (count) {
 873                 if (cs->write && cs->pipebufs && page) {
 874                         return fuse_ref_page(cs, page, offset, count);
 875                 } else if (!cs->len) {
 876                         if (cs->move_pages && page &&
 877                             offset == 0 && count == PAGE_SIZE) {
 878                                 err = fuse_try_move_page(cs, pagep);
 879                                 if (err <= 0)
 880                                         return err;
 881                         } else {
 882                                 err = fuse_copy_fill(cs);
 883                                 if (err)
 884                                         return err;
 885                         }
 886                 }
 887                 if (page) {
 888                         void *mapaddr = kmap_atomic(page);
 889                         void *buf = mapaddr + offset;
 890                         offset += fuse_copy_do(cs, &buf, &count);
 891                         kunmap_atomic(mapaddr);
 892                 } else
 893                         offset += fuse_copy_do(cs, NULL, &count);
 894         }
 895         if (page && !cs->write)
 896                 flush_dcache_page(page);
 897         return 0;
 898 }
 899
 900 /* Copy pages in the request to/from userspace buffer */
 901 static int fuse_copy_pages(struct fuse_copy_state *cs, unsigned nbytes,
 902                            int zeroing)
 903 {
 904         unsigned i;
 905         struct fuse_req *req = cs->req;
 906         unsigned offset = req->page_descs[0].offset;
 907         unsigned count = min(nbytes, (unsigned) PAGE_SIZE - offset);
 908
 909         for (i = 0; i < req->num_pages && (nbytes || zeroing); i++) {
 910                 int err;
 911
 912                 err = fuse_copy_page(cs, &req->pages[i], offset, count,
 913                                      zeroing);
 914                 if (err)
 915                         return err;
 916
 917                 nbytes -= count;
 918                 count = min(nbytes, (unsigned) PAGE_SIZE);
 919                 offset = 0;
 920         }
 921         return 0;
 922 }
 923
 924 /* Copy a single argument in the request to/from userspace buffer */
 925 static int fuse_copy_one(struct fuse_copy_state *cs, void *val, unsigned size)
 926 {
 927         while (size) {
 928                 if (!cs->len) {
 929                         int err = fuse_copy_fill(cs);
 930                         if (err)
 931                                 return err;
 932                 }
 933                 fuse_copy_do(cs, &val, &size);
 934         }
 935         return 0;
 936 }
 937
 938 /* Copy request arguments to/from userspace buffer */
 939 static int fuse_copy_args(struct fuse_copy_state *cs, unsigned numargs,
 940                           unsigned argpages, struct fuse_arg *args,
 941                           int zeroing)
 942 {
 943         int err = 0;
 944         unsigned i;
 945
 946         for (i = 0; !err && i < numargs; i++)  {
 947                 struct fuse_arg *arg = &args[i];
 948                 if (i == numargs - 1 && argpages)
 949                         err = fuse_copy_pages(cs, arg->size, zeroing);
 950                 else
 951                         err = fuse_copy_one(cs, arg->value, arg->size);
 952         }
 953         return err;
 954 }
 955
 956 static int forget_pending(struct fuse_conn *fc)
 957 {
 958         return fc->forget_list_head.next != NULL;
 959 }
 960
 961 static int request_pending(struct fuse_conn *fc)
 962 {
 963         return !list_empty(&fc->pending) || !list_empty(&fc->interrupts) ||
 964                 forget_pending(fc);
 965 }
 966
 967 /* Wait until a request is available on the pending list */
 968 static void request_wait(struct fuse_conn *fc)
 969 __releases(fc->lock)
 970 __acquires(fc->lock)
 971 {
 972         DECLARE_WAITQUEUE(wait, current);
 973
 974         add_wait_queue_exclusive(&fc->waitq, &wait);
 975         while (fc->connected && !request_pending(fc)) {
 976                 set_current_state(TASK_INTERRUPTIBLE);
 977                 if (signal_pending(current))
 978                         break;
 979
 980                 spin_unlock(&fc->lock);
 981                 schedule();
 982                 spin_lock(&fc->lock);
 983         }
 984         set_current_state(TASK_RUNNING);
 985         remove_wait_queue(&fc->waitq, &wait);
 986 }
 987
 988 /*
 989  * Transfer an interrupt request to userspace
 990  *
 991  * Unlike other requests this is assembled on demand, without a need
 992  * to allocate a separate fuse_req structure.
 993  *
 994  * Called with fc->lock held, releases it
 995  */
 996 static int fuse_read_interrupt(struct fuse_conn *fc, struct fuse_copy_state *cs,
 997                                size_t nbytes, struct fuse_req *req)
 998 __releases(fc->lock)
 999 {
1000         struct fuse_in_header ih;
1001         struct fuse_interrupt_in arg;
1002         unsigned reqsize = sizeof(ih) + sizeof(arg);
1003         int err;
1004
1005         list_del_init(&req->intr_entry);
1006         req->intr_unique = fuse_get_unique(fc);
1007         memset(&ih, 0, sizeof(ih));
1008         memset(&arg, 0, sizeof(arg));
1009         ih.len = reqsize;
1010         ih.opcode = FUSE_INTERRUPT;
1011         ih.unique = req->intr_unique;
1012         arg.unique = req->in.h.unique;
1013
1014         spin_unlock(&fc->lock);
1015         if (nbytes < reqsize)
1016                 return -EINVAL;
1017
1018         err = fuse_copy_one(cs, &ih, sizeof(ih));
1019         if (!err)
1020                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1021         fuse_copy_finish(cs);
1022
1023         return err ? err : reqsize;
1024 }
1025
1026 static struct fuse_forget_link *dequeue_forget(struct fuse_conn *fc,
1027                                                unsigned max,
1028                                                unsigned *countp)
1029 {
1030         struct fuse_forget_link *head = fc->forget_list_head.next;
1031         struct fuse_forget_link **newhead = &head;
1032         unsigned count;
1033
1034         for (count = 0; *newhead != NULL && count < max; count++)
1035                 newhead = &(*newhead)->next;
1036
1037         fc->forget_list_head.next = *newhead;
1038         *newhead = NULL;
1039         if (fc->forget_list_head.next == NULL)
1040                 fc->forget_list_tail = &fc->forget_list_head;
1041
1042         if (countp != NULL)
1043                 *countp = count;
1044
1045         return head;
1046 }
1047
1048 static int fuse_read_single_forget(struct fuse_conn *fc,
1049                                    struct fuse_copy_state *cs,
1050                                    size_t nbytes)
1051 __releases(fc->lock)
1052 {
1053         int err;
1054         struct fuse_forget_link *forget = dequeue_forget(fc, 1, NULL);
1055         struct fuse_forget_in arg = {
1056                 .nlookup = forget->forget_one.nlookup,
1057         };
1058         struct fuse_in_header ih = {
1059                 .opcode = FUSE_FORGET,
1060                 .nodeid = forget->forget_one.nodeid,
1061                 .unique = fuse_get_unique(fc),
1062                 .len = sizeof(ih) + sizeof(arg),
1063         };
1064
1065         spin_unlock(&fc->lock);
1066         kfree(forget);
1067         if (nbytes < ih.len)
1068                 return -EINVAL;
1069
1070         err = fuse_copy_one(cs, &ih, sizeof(ih));
1071         if (!err)
1072                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1073         fuse_copy_finish(cs);
1074
1075         if (err)
1076                 return err;
1077
1078         return ih.len;
1079 }
1080
1081 static int fuse_read_batch_forget(struct fuse_conn *fc,
1082                                    struct fuse_copy_state *cs, size_t nbytes)
1083 __releases(fc->lock)
1084 {
1085         int err;
1086         unsigned max_forgets;
1087         unsigned count;
1088         struct fuse_forget_link *head;
1089         struct fuse_batch_forget_in arg = { .count = 0 };
1090         struct fuse_in_header ih = {
1091                 .opcode = FUSE_BATCH_FORGET,
1092                 .unique = fuse_get_unique(fc),
1093                 .len = sizeof(ih) + sizeof(arg),
1094         };
1095
1096         if (nbytes < ih.len) {
1097                 spin_unlock(&fc->lock);
1098                 return -EINVAL;
1099         }
1100
1101         max_forgets = (nbytes - ih.len) / sizeof(struct fuse_forget_one);
1102         head = dequeue_forget(fc, max_forgets, &count);
1103         spin_unlock(&fc->lock);
1104
1105         arg.count = count;
1106         ih.len += count * sizeof(struct fuse_forget_one);
1107         err = fuse_copy_one(cs, &ih, sizeof(ih));
1108         if (!err)
1109                 err = fuse_copy_one(cs, &arg, sizeof(arg));
1110
1111         while (head) {
1112                 struct fuse_forget_link *forget = head;
1113
1114                 if (!err) {
1115                         err = fuse_copy_one(cs, &forget->forget_one,
1116                                             sizeof(forget->forget_one));
1117                 }
1118                 head = forget->next;
1119                 kfree(forget);
1120         }
1121
1122         fuse_copy_finish(cs);
1123
1124         if (err)
1125                 return err;
1126
1127         return ih.len;
1128 }
1129
1130 static int fuse_read_forget(struct fuse_conn *fc, struct fuse_copy_state *cs,
1131                             size_t nbytes)
1132 __releases(fc->lock)
1133 {
1134         if (fc->minor < 16 || fc->forget_list_head.next->next == NULL)
1135                 return fuse_read_single_forget(fc, cs, nbytes);
1136         else
1137                 return fuse_read_batch_forget(fc, cs, nbytes);
1138 }
1139
1140 /*
1141  * Read a single request into the userspace filesystem's buffer.  This
1142  * function waits until a request is available, then removes it from
1143  * the pending list and copies request data to userspace buffer.  If
1144  * no reply is needed (FORGET) or request has been aborted or there
1145  * was an error during the copying then it's finished by calling
1146  * request_end().  Otherwise add it to the processing list, and set
1147  * the 'sent' flag.
1148  */
1149 static ssize_t fuse_dev_do_read(struct fuse_conn *fc, struct file *file,
1150                                 struct fuse_copy_state *cs, size_t nbytes)
1151 {
1152         int err;
1153         struct fuse_req *req;
1154         struct fuse_in *in;
1155         unsigned reqsize;
1156
1157  restart:
1158         spin_lock(&fc->lock);
1159         err = -EAGAIN;
1160         if ((file->f_flags & O_NONBLOCK) && fc->connected &&
1161             !request_pending(fc))
1162                 goto err_unlock;
1163
1164         request_wait(fc);
1165         err = -ENODEV;
1166         if (!fc->connected)
1167                 goto err_unlock;
1168         err = -ERESTARTSYS;
1169         if (!request_pending(fc))
1170                 goto err_unlock;
1171
1172         if (!list_empty(&fc->interrupts)) {
1173                 req = list_entry(fc->interrupts.next, struct fuse_req,
1174                                  intr_entry);
1175                 return fuse_read_interrupt(fc, cs, nbytes, req);
1176         }
1177
1178         if (forget_pending(fc)) {
1179                 if (list_empty(&fc->pending) || fc->forget_batch-- > 0)
1180                         return fuse_read_forget(fc, cs, nbytes);
1181
1182                 if (fc->forget_batch <= -8)
1183                         fc->forget_batch = 16;
1184         }
1185
1186         req = list_entry(fc->pending.next, struct fuse_req, list);
1187         req->state = FUSE_REQ_READING;
1188         list_move(&req->list, &fc->io);
1189
1190         in = &req->in;
1191         reqsize = in->h.len;
1192         /* If request is too large, reply with an error and restart the read */
1193         if (nbytes < reqsize) {
1194                 req->out.h.error = -EIO;
1195                 /* SETXATTR is special, since it may contain too large data */
1196                 if (in->h.opcode == FUSE_SETXATTR)
1197                         req->out.h.error = -E2BIG;
1198                 request_end(fc, req);
1199                 goto restart;
1200         }
1201         spin_unlock(&fc->lock);
1202         cs->req = req;
1203         err = fuse_copy_one(cs, &in->h, sizeof(in->h));
1204         if (!err)
1205                 err = fuse_copy_args(cs, in->numargs, in->argpages,
1206                                      (struct fuse_arg *) in->args, 0);
1207         fuse_copy_finish(cs);
1208         spin_lock(&fc->lock);
1209         req->locked = 0;
1210         if (req->aborted) {
1211                 request_end(fc, req);
1212                 return -ENODEV;
1213         }
1214         if (err) {
1215                 req->out.h.error = -EIO;
1216                 request_end(fc, req);
1217                 return err;
1218         }
1219         if (!req->isreply)
1220                 request_end(fc, req);
1221         else {
1222                 req->state = FUSE_REQ_SENT;
1223                 list_move_tail(&req->list, &fc->processing);
1224                 if (req->interrupted)
1225                         queue_interrupt(fc, req);
1226                 spin_unlock(&fc->lock);
1227         }
1228         return reqsize;
1229
1230  err_unlock:
1231         spin_unlock(&fc->lock);
1232         return err;
1233 }
1234
1235 static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
1236                               unsigned long nr_segs, loff_t pos)
1237 {
1238         struct fuse_copy_state cs;
1239         struct file *file = iocb->ki_filp;
1240         struct fuse_conn *fc = fuse_get_conn(file);
1241         if (!fc)
1242                 return -EPERM;
1243
1244         fuse_copy_init(&cs, fc, 1, iov, nr_segs);
1245
1246         return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
1247 }
1248
1249 static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
1250                                    struct pipe_buffer *buf)
1251 {
1252         return 1;
1253 }
1254
1255 static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = {
1256         .can_merge = 0,
1257         .map = generic_pipe_buf_map,
1258         .unmap = generic_pipe_buf_unmap,
1259         .confirm = generic_pipe_buf_confirm,
1260         .release = generic_pipe_buf_release,
1261         .steal = fuse_dev_pipe_buf_steal,
1262         .get = generic_pipe_buf_get,
1263 };
1264
1265 static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
1266                                     struct pipe_inode_info *pipe,
1267                                     size_t len, unsigned int flags)
1268 {
1269         int ret;
1270         int page_nr = 0;
1271         int do_wakeup = 0;
1272         struct pipe_buffer *bufs;
1273         struct fuse_copy_state cs;
1274         struct fuse_conn *fc = fuse_get_conn(in);
1275         if (!fc)
1276                 return -EPERM;
1277
1278         bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1279         if (!bufs)
1280                 return -ENOMEM;
1281
1282         fuse_copy_init(&cs, fc, 1, NULL, 0);
1283         cs.pipebufs = bufs;
1284         cs.pipe = pipe;
1285         ret = fuse_dev_do_read(fc, in, &cs, len);
1286         if (ret < 0)
1287                 goto out;
1288
1289         ret = 0;
1290         pipe_lock(pipe);
1291
1292         if (!pipe->readers) {
1293                 send_sig(SIGPIPE, current, 0);
1294                 if (!ret)
1295                         ret = -EPIPE;
1296                 goto out_unlock;
1297         }
1298
1299         if (pipe->nrbufs + cs.nr_segs > pipe->buffers) {
1300                 ret = -EIO;
1301                 goto out_unlock;
1302         }
1303
1304         while (page_nr < cs.nr_segs) {
1305                 int newbuf = (pipe->curbuf + pipe->nrbufs) & (pipe->buffers - 1);
1306                 struct pipe_buffer *buf = pipe->bufs + newbuf;
1307
1308                 buf->page = bufs[page_nr].page;
1309                 buf->offset = bufs[page_nr].offset;
1310                 buf->len = bufs[page_nr].len;
1311                 buf->ops = &fuse_dev_pipe_buf_ops;
1312
1313                 pipe->nrbufs++;
1314                 page_nr++;
1315                 ret += buf->len;
1316
1317                 if (pipe->inode)
1318                         do_wakeup = 1;
1319         }
1320
1321 out_unlock:
1322         pipe_unlock(pipe);
1323
1324         if (do_wakeup) {
1325                 smp_mb();
1326                 if (waitqueue_active(&pipe->wait))
1327                         wake_up_interruptible(&pipe->wait);
1328                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
1329         }
1330
1331 out:
1332         for (; page_nr < cs.nr_segs; page_nr++)
1333                 page_cache_release(bufs[page_nr].page);
1334
1335         kfree(bufs);
1336         return ret;
1337 }
1338
1339 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
1340                             struct fuse_copy_state *cs)
1341 {
1342         struct fuse_notify_poll_wakeup_out outarg;
1343         int err = -EINVAL;
1344
1345         if (size != sizeof(outarg))
1346                 goto err;
1347
1348         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1349         if (err)
1350                 goto err;
1351
1352         fuse_copy_finish(cs);
1353         return fuse_notify_poll_wakeup(fc, &outarg);
1354
1355 err:
1356         fuse_copy_finish(cs);
1357         return err;
1358 }
1359
1360 static int fuse_notify_inval_inode(struct fuse_conn *fc, unsigned int size,
1361                                    struct fuse_copy_state *cs)
1362 {
1363         struct fuse_notify_inval_inode_out outarg;
1364         int err = -EINVAL;
1365
1366         if (size != sizeof(outarg))
1367                 goto err;
1368
1369         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1370         if (err)
1371                 goto err;
1372         fuse_copy_finish(cs);
1373
1374         down_read(&fc->killsb);
1375         err = -ENOENT;
1376         if (fc->sb) {
1377                 err = fuse_reverse_inval_inode(fc->sb, outarg.ino,
1378                                                outarg.off, outarg.len);
1379         }
1380         up_read(&fc->killsb);
1381         return err;
1382
1383 err:
1384         fuse_copy_finish(cs);
1385         return err;
1386 }
1387
1388 static int fuse_notify_inval_entry(struct fuse_conn *fc, unsigned int size,
1389                                    struct fuse_copy_state *cs)
1390 {
1391         struct fuse_notify_inval_entry_out outarg;
1392         int err = -ENOMEM;
1393         char *buf;
1394         struct qstr name;
1395
1396         buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1397         if (!buf)
1398                 goto err;
1399
1400         err = -EINVAL;
1401         if (size < sizeof(outarg))
1402                 goto err;
1403
1404         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1405         if (err)
1406                 goto err;
1407
1408         err = -ENAMETOOLONG;
1409         if (outarg.namelen > FUSE_NAME_MAX)
1410                 goto err;
1411
1412         err = -EINVAL;
1413         if (size != sizeof(outarg) + outarg.namelen + 1)
1414                 goto err;
1415
1416         name.name = buf;
1417         name.len = outarg.namelen;
1418         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1419         if (err)
1420                 goto err;
1421         fuse_copy_finish(cs);
1422         buf[outarg.namelen] = 0;
1423         name.hash = full_name_hash(name.name, name.len);
1424
1425         down_read(&fc->killsb);
1426         err = -ENOENT;
1427         if (fc->sb)
1428                 err = fuse_reverse_inval_entry(fc->sb, outarg.parent, 0, &name);
1429         up_read(&fc->killsb);
1430         kfree(buf);
1431         return err;
1432
1433 err:
1434         kfree(buf);
1435         fuse_copy_finish(cs);
1436         return err;
1437 }
1438
1439 static int fuse_notify_delete(struct fuse_conn *fc, unsigned int size,
1440                               struct fuse_copy_state *cs)
1441 {
1442         struct fuse_notify_delete_out outarg;
1443         int err = -ENOMEM;
1444         char *buf;
1445         struct qstr name;
1446
1447         buf = kzalloc(FUSE_NAME_MAX + 1, GFP_KERNEL);
1448         if (!buf)
1449                 goto err;
1450
1451         err = -EINVAL;
1452         if (size < sizeof(outarg))
1453                 goto err;
1454
1455         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1456         if (err)
1457                 goto err;
1458
1459         err = -ENAMETOOLONG;
1460         if (outarg.namelen > FUSE_NAME_MAX)
1461                 goto err;
1462
1463         err = -EINVAL;
1464         if (size != sizeof(outarg) + outarg.namelen + 1)
1465                 goto err;
1466
1467         name.name = buf;
1468         name.len = outarg.namelen;
1469         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
1470         if (err)
1471                 goto err;
1472         fuse_copy_finish(cs);
1473         buf[outarg.namelen] = 0;
1474         name.hash = full_name_hash(name.name, name.len);
1475
1476         down_read(&fc->killsb);
1477         err = -ENOENT;
1478         if (fc->sb)
1479                 err = fuse_reverse_inval_entry(fc->sb, outarg.parent,
1480                                                outarg.child, &name);
1481         up_read(&fc->killsb);
1482         kfree(buf);
1483         return err;
1484
1485 err:
1486         kfree(buf);
1487         fuse_copy_finish(cs);
1488         return err;
1489 }
1490
1491 static int fuse_notify_store(struct fuse_conn *fc, unsigned int size,
1492                              struct fuse_copy_state *cs)
1493 {
1494         struct fuse_notify_store_out outarg;
1495         struct inode *inode;
1496         struct address_space *mapping;
1497         u64 nodeid;
1498         int err;
1499         pgoff_t index;
1500         unsigned int offset;
1501         unsigned int num;
1502         loff_t file_size;
1503         loff_t end;
1504
1505         err = -EINVAL;
1506         if (size < sizeof(outarg))
1507                 goto out_finish;
1508
1509         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1510         if (err)
1511                 goto out_finish;
1512
1513         err = -EINVAL;
1514         if (size - sizeof(outarg) != outarg.size)
1515                 goto out_finish;
1516
1517         nodeid = outarg.nodeid;
1518
1519         down_read(&fc->killsb);
1520
1521         err = -ENOENT;
1522         if (!fc->sb)
1523                 goto out_up_killsb;
1524
1525         inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1526         if (!inode)
1527                 goto out_up_killsb;
1528
1529         mapping = inode->i_mapping;
1530         index = outarg.offset >> PAGE_CACHE_SHIFT;
1531         offset = outarg.offset & ~PAGE_CACHE_MASK;
1532         file_size = i_size_read(inode);
1533         end = outarg.offset + outarg.size;
1534         if (end > file_size) {
1535                 file_size = end;
1536                 fuse_write_update_size(inode, file_size);
1537         }
1538
1539         num = outarg.size;
1540         while (num) {
1541                 struct page *page;
1542                 unsigned int this_num;
1543
1544                 err = -ENOMEM;
1545                 page = find_or_create_page(mapping, index,
1546                                            mapping_gfp_mask(mapping));
1547                 if (!page)
1548                         goto out_iput;
1549
1550                 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1551                 err = fuse_copy_page(cs, &page, offset, this_num, 0);
1552                 if (!err && offset == 0 && (num != 0 || file_size == end))
1553                         SetPageUptodate(page);
1554                 unlock_page(page);
1555                 page_cache_release(page);
1556
1557                 if (err)
1558                         goto out_iput;
1559
1560                 num -= this_num;
1561                 offset = 0;
1562                 index++;
1563         }
1564
1565         err = 0;
1566
1567 out_iput:
1568         iput(inode);
1569 out_up_killsb:
1570         up_read(&fc->killsb);
1571 out_finish:
1572         fuse_copy_finish(cs);
1573         return err;
1574 }
1575
1576 static void fuse_retrieve_end(struct fuse_conn *fc, struct fuse_req *req)
1577 {
1578         release_pages(req->pages, req->num_pages, 0);
1579 }
1580
1581 static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
1582                          struct fuse_notify_retrieve_out *outarg)
1583 {
1584         int err;
1585         struct address_space *mapping = inode->i_mapping;
1586         struct fuse_req *req;
1587         pgoff_t index;
1588         loff_t file_size;
1589         unsigned int num;
1590         unsigned int offset;
1591         size_t total_len = 0;
1592         int num_pages;
1593
1594         offset = outarg->offset & ~PAGE_CACHE_MASK;
1595         file_size = i_size_read(inode);
1596
1597         num = outarg->size;
1598         if (outarg->offset > file_size)
1599                 num = 0;
1600         else if (outarg->offset + num > file_size)
1601                 num = file_size - outarg->offset;
1602
1603         num_pages = (num + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
1604         num_pages = min(num_pages, FUSE_MAX_PAGES_PER_REQ);
1605
1606         req = fuse_get_req(fc, num_pages);
1607         if (IS_ERR(req))
1608                 return PTR_ERR(req);
1609
1610         req->in.h.opcode = FUSE_NOTIFY_REPLY;
1611         req->in.h.nodeid = outarg->nodeid;
1612         req->in.numargs = 2;
1613         req->in.argpages = 1;
1614         req->page_descs[0].offset = offset;
1615         req->end = fuse_retrieve_end;
1616
1617         index = outarg->offset >> PAGE_CACHE_SHIFT;
1618
1619         while (num && req->num_pages < num_pages) {
1620                 struct page *page;
1621                 unsigned int this_num;
1622
1623                 page = find_get_page(mapping, index);
1624                 if (!page)
1625                         break;
1626
1627                 this_num = min_t(unsigned, num, PAGE_CACHE_SIZE - offset);
1628                 req->pages[req->num_pages] = page;
1629                 req->num_pages++;
1630
1631                 offset = 0;
1632                 num -= this_num;
1633                 total_len += this_num;
1634                 index++;
1635         }
1636         req->misc.retrieve_in.offset = outarg->offset;
1637         req->misc.retrieve_in.size = total_len;
1638         req->in.args[0].size = sizeof(req->misc.retrieve_in);
1639         req->in.args[0].value = &req->misc.retrieve_in;
1640         req->in.args[1].size = total_len;
1641
1642         err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
1643         if (err)
1644                 fuse_retrieve_end(fc, req);
1645
1646         return err;
1647 }
1648
1649 static int fuse_notify_retrieve(struct fuse_conn *fc, unsigned int size,
1650                                 struct fuse_copy_state *cs)
1651 {
1652         struct fuse_notify_retrieve_out outarg;
1653         struct inode *inode;
1654         int err;
1655
1656         err = -EINVAL;
1657         if (size != sizeof(outarg))
1658                 goto copy_finish;
1659
1660         err = fuse_copy_one(cs, &outarg, sizeof(outarg));
1661         if (err)
1662                 goto copy_finish;
1663
1664         fuse_copy_finish(cs);
1665
1666         down_read(&fc->killsb);
1667         err = -ENOENT;
1668         if (fc->sb) {
1669                 u64 nodeid = outarg.nodeid;
1670
1671                 inode = ilookup5(fc->sb, nodeid, fuse_inode_eq, &nodeid);
1672                 if (inode) {
1673                         err = fuse_retrieve(fc, inode, &outarg);
1674                         iput(inode);
1675                 }
1676         }
1677         up_read(&fc->killsb);
1678
1679         return err;
1680
1681 copy_finish:
1682         fuse_copy_finish(cs);
1683         return err;
1684 }
1685
1686 static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
1687                        unsigned int size, struct fuse_copy_state *cs)
1688 {
1689         switch (code) {
1690         case FUSE_NOTIFY_POLL:
1691                 return fuse_notify_poll(fc, size, cs);
1692
1693         case FUSE_NOTIFY_INVAL_INODE:
1694                 return fuse_notify_inval_inode(fc, size, cs);
1695
1696         case FUSE_NOTIFY_INVAL_ENTRY:
1697                 return fuse_notify_inval_entry(fc, size, cs);
1698
1699         case FUSE_NOTIFY_STORE:
1700                 return fuse_notify_store(fc, size, cs);
1701
1702         case FUSE_NOTIFY_RETRIEVE:
1703                 return fuse_notify_retrieve(fc, size, cs);
1704
1705         case FUSE_NOTIFY_DELETE:
1706                 return fuse_notify_delete(fc, size, cs);
1707
1708         default:
1709                 fuse_copy_finish(cs);
1710                 return -EINVAL;
1711         }
1712 }
1713
1714 /* Look up request on processing list by unique ID */
1715 static struct fuse_req *request_find(struct fuse_conn *fc, u64 unique)
1716 {
1717         struct list_head *entry;
1718
1719         list_for_each(entry, &fc->processing) {
1720                 struct fuse_req *req;
1721                 req = list_entry(entry, struct fuse_req, list);
1722                 if (req->in.h.unique == unique || req->intr_unique == unique)
1723                         return req;
1724         }
1725         return NULL;
1726 }
1727
1728 static int copy_out_args(struct fuse_copy_state *cs, struct fuse_out *out,
1729                          unsigned nbytes)
1730 {
1731         unsigned reqsize = sizeof(struct fuse_out_header);
1732
1733         if (out->h.error)
1734                 return nbytes != reqsize ? -EINVAL : 0;
1735
1736         reqsize += len_args(out->numargs, out->args);
1737
1738         if (reqsize < nbytes || (reqsize > nbytes && !out->argvar))
1739                 return -EINVAL;
1740         else if (reqsize > nbytes) {
1741                 struct fuse_arg *lastarg = &out->args[out->numargs-1];
1742                 unsigned diffsize = reqsize - nbytes;
1743                 if (diffsize > lastarg->size)
1744                         return -EINVAL;
1745                 lastarg->size -= diffsize;
1746         }
1747         return fuse_copy_args(cs, out->numargs, out->argpages, out->args,
1748                               out->page_zeroing);
1749 }
1750
1751 /*
1752  * Write a single reply to a request.  First the header is copied from
1753  * the write buffer.  The request is then searched on the processing
1754  * list by the unique ID found in the header.  If found, then remove
1755  * it from the list and copy the rest of the buffer to the request.
1756  * The request is finished by calling request_end()
1757  */
1758 static ssize_t fuse_dev_do_write(struct fuse_conn *fc,
1759                                  struct fuse_copy_state *cs, size_t nbytes)
1760 {
1761         int err;
1762         struct fuse_req *req;
1763         struct fuse_out_header oh;
1764
1765         if (nbytes < sizeof(struct fuse_out_header))
1766                 return -EINVAL;
1767
1768         err = fuse_copy_one(cs, &oh, sizeof(oh));
1769         if (err)
1770                 goto err_finish;
1771
1772         err = -EINVAL;
1773         if (oh.len != nbytes)
1774                 goto err_finish;
1775
1776         /*
1777          * Zero oh.unique indicates unsolicited notification message
1778          * and error contains notification code.
1779          */
1780         if (!oh.unique) {
1781                 err = fuse_notify(fc, oh.error, nbytes - sizeof(oh), cs);
1782                 return err ? err : nbytes;
1783         }
1784
1785         err = -EINVAL;
1786         if (oh.error <= -1000 || oh.error > 0)
1787                 goto err_finish;
1788
1789         spin_lock(&fc->lock);
1790         err = -ENOENT;
1791         if (!fc->connected)
1792                 goto err_unlock;
1793
1794         req = request_find(fc, oh.unique);
1795         if (!req)
1796                 goto err_unlock;
1797
1798         if (req->aborted) {
1799                 spin_unlock(&fc->lock);
1800                 fuse_copy_finish(cs);
1801                 spin_lock(&fc->lock);
1802                 request_end(fc, req);
1803                 return -ENOENT;
1804         }
1805         /* Is it an interrupt reply? */
1806         if (req->intr_unique == oh.unique) {
1807                 err = -EINVAL;
1808                 if (nbytes != sizeof(struct fuse_out_header))
1809                         goto err_unlock;
1810
1811                 if (oh.error == -ENOSYS)
1812                         fc->no_interrupt = 1;
1813                 else if (oh.error == -EAGAIN)
1814                         queue_interrupt(fc, req);
1815
1816                 spin_unlock(&fc->lock);
1817                 fuse_copy_finish(cs);
1818                 return nbytes;
1819         }
1820
1821         req->state = FUSE_REQ_WRITING;
1822         list_move(&req->list, &fc->io);
1823         req->out.h = oh;
1824         req->locked = 1;
1825         cs->req = req;
1826         if (!req->out.page_replace)
1827                 cs->move_pages = 0;
1828         spin_unlock(&fc->lock);
1829
1830         err = copy_out_args(cs, &req->out, nbytes);
1831         fuse_copy_finish(cs);
1832
1833         spin_lock(&fc->lock);
1834         req->locked = 0;
1835         if (!err) {
1836                 if (req->aborted)
1837                         err = -ENOENT;
1838         } else if (!req->aborted)
1839                 req->out.h.error = -EIO;
1840         request_end(fc, req);
1841
1842         return err ? err : nbytes;
1843
1844  err_unlock:
1845         spin_unlock(&fc->lock);
1846  err_finish:
1847         fuse_copy_finish(cs);
1848         return err;
1849 }
1850
1851 static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
1852                               unsigned long nr_segs, loff_t pos)
1853 {
1854         struct fuse_copy_state cs;
1855         struct fuse_conn *fc = fuse_get_conn(iocb->ki_filp);
1856         if (!fc)
1857                 return -EPERM;
1858
1859         fuse_copy_init(&cs, fc, 0, iov, nr_segs);
1860
1861         return fuse_dev_do_write(fc, &cs, iov_length(iov, nr_segs));
1862 }
1863
1864 static ssize_t fuse_dev_splice_write(struct pipe_inode_info *pipe,
1865                                      struct file *out, loff_t *ppos,
1866                                      size_t len, unsigned int flags)
1867 {
1868         unsigned nbuf;
1869         unsigned idx;
1870         struct pipe_buffer *bufs;
1871         struct fuse_copy_state cs;
1872         struct fuse_conn *fc;
1873         size_t rem;
1874         ssize_t ret;
1875
1876         fc = fuse_get_conn(out);
1877         if (!fc)
1878                 return -EPERM;
1879
1880         bufs = kmalloc(pipe->buffers * sizeof(struct pipe_buffer), GFP_KERNEL);
1881         if (!bufs)
1882                 return -ENOMEM;
1883
1884         pipe_lock(pipe);
1885         nbuf = 0;
1886         rem = 0;
1887         for (idx = 0; idx < pipe->nrbufs && rem < len; idx++)
1888                 rem += pipe->bufs[(pipe->curbuf + idx) & (pipe->buffers - 1)].len;
1889
1890         ret = -EINVAL;
1891         if (rem < len) {
1892                 pipe_unlock(pipe);
1893                 goto out;
1894         }
1895
1896         rem = len;
1897         while (rem) {
1898                 struct pipe_buffer *ibuf;
1899                 struct pipe_buffer *obuf;
1900
1901                 BUG_ON(nbuf >= pipe->buffers);
1902                 BUG_ON(!pipe->nrbufs);
1903                 ibuf = &pipe->bufs[pipe->curbuf];
1904                 obuf = &bufs[nbuf];
1905
1906                 if (rem >= ibuf->len) {
1907                         *obuf = *ibuf;
1908                         ibuf->ops = NULL;
1909                         pipe->curbuf = (pipe->curbuf + 1) & (pipe->buffers - 1);
1910                         pipe->nrbufs--;
1911                 } else {
1912                         ibuf->ops->get(pipe, ibuf);
1913                         *obuf = *ibuf;
1914                         obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
1915                         obuf->len = rem;
1916                         ibuf->offset += obuf->len;
1917                         ibuf->len -= obuf->len;
1918                 }
1919                 nbuf++;
1920                 rem -= obuf->len;
1921         }
1922         pipe_unlock(pipe);
1923
1924         fuse_copy_init(&cs, fc, 0, NULL, nbuf);
1925         cs.pipebufs = bufs;
1926         cs.pipe = pipe;
1927
1928         if (flags & SPLICE_F_MOVE)
1929                 cs.move_pages = 1;
1930
1931         ret = fuse_dev_do_write(fc, &cs, len);
1932
1933         for (idx = 0; idx < nbuf; idx++) {
1934                 struct pipe_buffer *buf = &bufs[idx];
1935                 buf->ops->release(pipe, buf);
1936         }
1937 out:
1938         kfree(bufs);
1939         return ret;
1940 }
1941
1942 static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
1943 {
1944         unsigned mask = POLLOUT | POLLWRNORM;
1945         struct fuse_conn *fc = fuse_get_conn(file);
1946         if (!fc)
1947                 return POLLERR;
1948
1949         poll_wait(file, &fc->waitq, wait);
1950
1951         spin_lock(&fc->lock);
1952         if (!fc->connected)
1953                 mask = POLLERR;
1954         else if (request_pending(fc))
1955                 mask |= POLLIN | POLLRDNORM;
1956         spin_unlock(&fc->lock);
1957
1958         return mask;
1959 }
1960
1961 /*
1962  * Abort all requests on the given list (pending or processing)
1963  *
1964  * This function releases and reacquires fc->lock
1965  */
1966 static void end_requests(struct fuse_conn *fc, struct list_head *head)
1967 __releases(fc->lock)
1968 __acquires(fc->lock)
1969 {
1970         while (!list_empty(head)) {
1971                 struct fuse_req *req;
1972                 req = list_entry(head->next, struct fuse_req, list);
1973                 req->out.h.error = -ECONNABORTED;
1974                 request_end(fc, req);
1975                 spin_lock(&fc->lock);
1976         }
1977 }
1978
1979 /*
1980  * Abort requests under I/O
1981  *
1982  * The requests are set to aborted and finished, and the request
1983  * waiter is woken up.  This will make request_wait_answer() wait
1984  * until the request is unlocked and then return.
1985  *
1986  * If the request is asynchronous, then the end function needs to be
1987  * called after waiting for the request to be unlocked (if it was
1988  * locked).
1989  */
1990 static void end_io_requests(struct fuse_conn *fc)
1991 __releases(fc->lock)
1992 __acquires(fc->lock)
1993 {
1994         while (!list_empty(&fc->io)) {
1995                 struct fuse_req *req =
1996                         list_entry(fc->io.next, struct fuse_req, list);
1997                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
1998
1999                 req->aborted = 1;
2000                 req->out.h.error = -ECONNABORTED;
2001                 req->state = FUSE_REQ_FINISHED;
2002                 list_del_init(&req->list);
2003                 wake_up(&req->waitq);
2004                 if (end) {
2005                         req->end = NULL;
2006                         __fuse_get_request(req);
2007                         spin_unlock(&fc->lock);
2008                         wait_event(req->waitq, !req->locked);
2009                         end(fc, req);
2010                         fuse_put_request(fc, req);
2011                         spin_lock(&fc->lock);
2012                 }
2013         }
2014 }
2015
2016 static void end_queued_requests(struct fuse_conn *fc)
2017 __releases(fc->lock)
2018 __acquires(fc->lock)
2019 {
2020         fc->max_background = UINT_MAX;
2021         flush_bg_queue(fc);
2022         end_requests(fc, &fc->pending);
2023         end_requests(fc, &fc->processing);
2024         while (forget_pending(fc))
2025                 kfree(dequeue_forget(fc, 1, NULL));
2026 }
2027
2028 static void end_polls(struct fuse_conn *fc)
2029 {
2030         struct rb_node *p;
2031
2032         p = rb_first(&fc->polled_files);
2033
2034         while (p) {
2035                 struct fuse_file *ff;
2036                 ff = rb_entry(p, struct fuse_file, polled_node);
2037                 wake_up_interruptible_all(&ff->poll_wait);
2038
2039                 p = rb_next(p);
2040         }
2041 }
2042
2043 /*
2044  * Abort all requests.
2045  *
2046  * Emergency exit in case of a malicious or accidental deadlock, or
2047  * just a hung filesystem.
2048  *
2049  * The same effect is usually achievable through killing the
2050  * filesystem daemon and all users of the filesystem.  The exception
2051  * is the combination of an asynchronous request and the tricky
2052  * deadlock (see Documentation/filesystems/fuse.txt).
2053  *
2054  * During the aborting, progression of requests from the pending and
2055  * processing lists onto the io list, and progression of new requests
2056  * onto the pending list is prevented by req->connected being false.
2057  *
2058  * Progression of requests under I/O to the processing list is
2059  * prevented by the req->aborted flag being true for these requests.
2060  * For this reason requests on the io list must be aborted first.
2061  */
2062 void fuse_abort_conn(struct fuse_conn *fc)
2063 {
2064         spin_lock(&fc->lock);
2065         if (fc->connected) {
2066                 fc->connected = 0;
2067                 fc->blocked = 0;
2068                 end_io_requests(fc);
2069                 end_queued_requests(fc);
2070                 end_polls(fc);
2071                 wake_up_all(&fc->waitq);
2072                 wake_up_all(&fc->blocked_waitq);
2073                 kill_fasync(&fc->fasync, SIGIO, POLL_IN);
2074         }
2075         spin_unlock(&fc->lock);
2076 }
2077 EXPORT_SYMBOL_GPL(fuse_abort_conn);
2078
2079 int fuse_dev_release(struct inode *inode, struct file *file)
2080 {
2081         struct fuse_conn *fc = fuse_get_conn(file);
2082         if (fc) {
2083                 spin_lock(&fc->lock);
2084                 fc->connected = 0;
2085                 fc->blocked = 0;
2086                 end_queued_requests(fc);
2087                 end_polls(fc);
2088                 wake_up_all(&fc->blocked_waitq);
2089                 spin_unlock(&fc->lock);
2090                 fuse_conn_put(fc);
2091         }
2092
2093         return 0;
2094 }
2095 EXPORT_SYMBOL_GPL(fuse_dev_release);
2096
2097 static int fuse_dev_fasync(int fd, struct file *file, int on)
2098 {
2099         struct fuse_conn *fc = fuse_get_conn(file);
2100         if (!fc)
2101                 return -EPERM;
2102
2103         /* No locking - fasync_helper does its own locking */
2104         return fasync_helper(fd, file, on, &fc->fasync);
2105 }
2106
2107 const struct file_operations fuse_dev_operations = {
2108         .owner          = THIS_MODULE,
2109         .llseek         = no_llseek,
2110         .read           = do_sync_read,
2111         .aio_read       = fuse_dev_read,
2112         .splice_read    = fuse_dev_splice_read,
2113         .write          = do_sync_write,
2114         .aio_write      = fuse_dev_write,
2115         .splice_write   = fuse_dev_splice_write,
2116         .poll           = fuse_dev_poll,
2117         .release        = fuse_dev_release,
2118         .fasync         = fuse_dev_fasync,
2119 };
2120 EXPORT_SYMBOL_GPL(fuse_dev_operations);
2121
2122 static struct miscdevice fuse_miscdevice = {
2123         .minor = FUSE_MINOR,
2124         .name  = "fuse",
2125         .fops = &fuse_dev_operations,
2126 };
2127
2128 int __init fuse_dev_init(void)
2129 {
2130         int err = -ENOMEM;
2131         fuse_req_cachep = kmem_cache_create("fuse_request",
2132                                             sizeof(struct fuse_req),
2133                                             0, 0, NULL);
2134         if (!fuse_req_cachep)
2135                 goto out;
2136
2137         err = misc_register(&fuse_miscdevice);
2138         if (err)
2139                 goto out_cache_clean;
2140
2141         return 0;
2142
2143  out_cache_clean:
2144         kmem_cache_destroy(fuse_req_cachep);
2145  out:
2146         return err;
2147 }
2148
2149 void fuse_dev_cleanup(void)
2150 {
2151         misc_deregister(&fuse_miscdevice);
2152         kmem_cache_destroy(fuse_req_cachep);
2153 }