5 files changed, 342 insertions, 27 deletions

diff --git a/Documentation/devices.txt b/Documentation/devices.txt
index 23721d3be3e6..80b72419ffd8 100644
--- a/Documentation/devices.txt
+++ b/Documentation/devices.txt
@@ -414,6 +414,7 @@ Your cooperation is appreciated.
                 200 = /dev/net/tun      TAP/TUN network device
                 201 = /dev/button/gulpb Transmeta GULP-B buttons
                 202 = /dev/emd/ctl      Enhanced Metadisk RAID (EMD) control
+                203 = /dev/cuse         Cuse (character device in user-space)
                 204 = /dev/video/em8300         EM8300 DVD decoder control
                 205 = /dev/video/em8300_mv      EM8300 DVD decoder video
                 206 = /dev/video/em8300_ma      EM8300 DVD decoder audio
diff --git a/fs/fuse/cuse.c b/fs/fuse/cuse.c
index adbfd66b380f..24da581cb52b 100644
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -589,11 +589,14 @@ static struct attribute *cuse_class_dev_attrs[] = {
 ATTRIBUTE_GROUPS(cuse_class_dev);
 
 static struct miscdevice cuse_miscdev = {
-        .minor          = MISC_DYNAMIC_MINOR,
+        .minor          = CUSE_MINOR,
         .name           = "cuse",
         .fops           = &cuse_channel_fops,
 };
 
+MODULE_ALIAS_MISCDEV(CUSE_MINOR);
+MODULE_ALIAS("devname:cuse");
+
 static int __init cuse_init(void)
 {
         int i, rc;
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 4598345ab87d..7e70506297bc 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -334,7 +334,8 @@ static bool fuse_page_is_writeback(struct inode *inode, pgoff_t index)
 
                 BUG_ON(req->inode != inode);
                 curr_index = req->misc.write.in.offset >> PAGE_CACHE_SHIFT;
-                if (curr_index == index) {
+                if (curr_index <= index &&
+                    index < curr_index + req->num_pages) {
                         found = true;
                         break;
                 }
@@ -1409,8 +1410,13 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
 
 static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
 {
-        __free_page(req->pages[0]);
-        fuse_file_put(req->ff, false);
+        int i;
+
+        for (i = 0; i < req->num_pages; i++)
+                __free_page(req->pages[i]);
+
+        if (req->ff)
+                fuse_file_put(req->ff, false);
 }
 
 static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
@@ -1418,30 +1424,34 @@ static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
         struct inode *inode = req->inode;
         struct fuse_inode *fi = get_fuse_inode(inode);
         struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
+        int i;
 
         list_del(&req->writepages_entry);
-        dec_bdi_stat(bdi, BDI_WRITEBACK);
-        dec_zone_page_state(req->pages[0], NR_WRITEBACK_TEMP);
-        bdi_writeout_inc(bdi);
+        for (i = 0; i < req->num_pages; i++) {
+                dec_bdi_stat(bdi, BDI_WRITEBACK);
+                dec_zone_page_state(req->pages[i], NR_WRITEBACK_TEMP);
+                bdi_writeout_inc(bdi);
+        }
         wake_up(&fi->page_waitq);
 }
 
 /* Called under fc->lock, may release and reacquire it */
-static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
+static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req,
+                                loff_t size)
 __releases(fc->lock)
 __acquires(fc->lock)
 {
         struct fuse_inode *fi = get_fuse_inode(req->inode);
-        loff_t size = i_size_read(req->inode);
         struct fuse_write_in *inarg = &req->misc.write.in;
+        __u64 data_size = req->num_pages * PAGE_CACHE_SIZE;
 
         if (!fc->connected)
                 goto out_free;
 
-        if (inarg->offset + PAGE_CACHE_SIZE <= size) {
-                inarg->size = PAGE_CACHE_SIZE;
+        if (inarg->offset + data_size <= size) {
+                inarg->size = data_size;
         } else if (inarg->offset < size) {
-                inarg->size = size & (PAGE_CACHE_SIZE - 1);
+                inarg->size = size - inarg->offset;
         } else {
                 /* Got truncated off completely */
                 goto out_free;
@@ -1472,12 +1482,13 @@ __acquires(fc->lock)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_inode *fi = get_fuse_inode(inode);
+        size_t crop = i_size_read(inode);
         struct fuse_req *req;
 
         while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
                 req = list_entry(fi->queued_writes.next, struct fuse_req, list);
                 list_del_init(&req->list);
-                fuse_send_writepage(fc, req);
+                fuse_send_writepage(fc, req, crop);
         }
 }
 
@@ -1488,12 +1499,62 @@ static void fuse_writepage_end(struct fuse_conn *fc, struct fuse_req *req)
 
         mapping_set_error(inode->i_mapping, req->out.h.error);
         spin_lock(&fc->lock);
+        while (req->misc.write.next) {
+                struct fuse_conn *fc = get_fuse_conn(inode);
+                struct fuse_write_in *inarg = &req->misc.write.in;
+                struct fuse_req *next = req->misc.write.next;
+                req->misc.write.next = next->misc.write.next;
+                next->misc.write.next = NULL;
+                next->ff = fuse_file_get(req->ff);
+                list_add(&next->writepages_entry, &fi->writepages);
+
+                /*
+                 * Skip fuse_flush_writepages() to make it easy to crop requests
+                 * based on primary request size.
+                 *
+                 * 1st case (trivial): there are no concurrent activities using
+                 * fuse_set/release_nowrite.  Then we're on safe side because
+                 * fuse_flush_writepages() would call fuse_send_writepage()
+                 * anyway.
+                 *
+                 * 2nd case: someone called fuse_set_nowrite and it is waiting
+                 * now for completion of all in-flight requests.  This happens
+                 * rarely and no more than once per page, so this should be
+                 * okay.
+                 *
+                 * 3rd case: someone (e.g. fuse_do_setattr()) is in the middle
+                 * of fuse_set_nowrite..fuse_release_nowrite section.  The fact
+                 * that fuse_set_nowrite returned implies that all in-flight
+                 * requests were completed along with all of their secondary
+                 * requests.  Further primary requests are blocked by negative
+                 * writectr.  Hence there cannot be any in-flight requests and
+                 * no invocations of fuse_writepage_end() while we're in
+                 * fuse_set_nowrite..fuse_release_nowrite section.
+                 */
+                fuse_send_writepage(fc, next, inarg->offset + inarg->size);
+        }
         fi->writectr--;
         fuse_writepage_finish(fc, req);
         spin_unlock(&fc->lock);
         fuse_writepage_free(fc, req);
 }
 
+static struct fuse_file *fuse_write_file_get(struct fuse_conn *fc,
+                                             struct fuse_inode *fi)
+{
+        struct fuse_file *ff = NULL;
+
+        spin_lock(&fc->lock);
+        if (!WARN_ON(list_empty(&fi->write_files))) {
+                ff = list_entry(fi->write_files.next, struct fuse_file,
+                                write_entry);
+                fuse_file_get(ff);