1 files changed, 378 insertions, 113 deletions

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f3ab824fa302..d1c9b85b3f58 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/compat.h>
 #include <linux/swap.h>
+#include <linux/aio.h>
 
 static const struct file_operations fuse_direct_io_file_operations;
 
@@ -25,7 +26,7 @@ static int fuse_send_open(struct fuse_conn *fc, u64 nodeid, struct file *file,
         struct fuse_req *req;
         int err;
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -57,7 +58,7 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
                 return NULL;
 
         ff->fc = fc;
-        ff->reserved_req = fuse_request_alloc();
+        ff->reserved_req = fuse_request_alloc(0);
         if (unlikely(!ff->reserved_req)) {
                 kfree(ff);
                 return NULL;
@@ -126,11 +127,13 @@ static void fuse_file_put(struct fuse_file *ff, bool sync)
                 struct fuse_req *req = ff->reserved_req;
 
                 if (sync) {
+                        req->background = 0;
                         fuse_request_send(ff->fc, req);
                         path_put(&req->misc.release.path);
                         fuse_put_request(ff->fc, req);
                 } else {
                         req->end = fuse_release_end;
+                        req->background = 1;
                         fuse_request_send_background(ff->fc, req);
                 }
                 kfree(ff);
@@ -282,6 +285,7 @@ void fuse_sync_release(struct fuse_file *ff, int flags)
         WARN_ON(atomic_read(&ff->count) > 1);
         fuse_prepare_release(ff, flags, FUSE_RELEASE);
         ff->reserved_req->force = 1;
+        ff->reserved_req->background = 0;
         fuse_request_send(ff->fc, ff->reserved_req);
         fuse_put_request(ff->fc, ff->reserved_req);
         kfree(ff);
@@ -355,7 +359,7 @@ static int fuse_wait_on_page_writeback(struct inode *inode, pgoff_t index)
 
 static int fuse_flush(struct file *file, fl_owner_t id)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_file *ff = file->private_data;
         struct fuse_req *req;
@@ -368,7 +372,7 @@ static int fuse_flush(struct file *file, fl_owner_t id)
         if (fc->no_flush)
                 return 0;
 
-        req = fuse_get_req_nofail(fc, file);
+        req = fuse_get_req_nofail_nopages(fc, file);
         memset(&inarg, 0, sizeof(inarg));
         inarg.fh = ff->fh;
         inarg.lock_owner = fuse_lock_owner_id(fc, id);
@@ -436,7 +440,7 @@ int fuse_fsync_common(struct file *file, loff_t start, loff_t end,
 
         fuse_sync_writes(inode);
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
                 goto out;
@@ -491,9 +495,115 @@ void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
         req->out.args[0].size = count;
 }
 
-static size_t fuse_send_read(struct fuse_req *req, struct file *file,
+static void fuse_release_user_pages(struct fuse_req *req, int write)
+{
+        unsigned i;
+
+        for (i = 0; i < req->num_pages; i++) {
+                struct page *page = req->pages[i];
+                if (write)
+                        set_page_dirty_lock(page);
+                put_page(page);
+        }
+}
+
+/**
+ * In case of short read, the caller sets 'pos' to the position of
+ * actual end of fuse request in IO request. Otherwise, if bytes_requested
+ * == bytes_transferred or rw == WRITE, the caller sets 'pos' to -1.
+ *
+ * An example:
+ * User requested DIO read of 64K. It was splitted into two 32K fuse requests,
+ * both submitted asynchronously. The first of them was ACKed by userspace as
+ * fully completed (req->out.args[0].size == 32K) resulting in pos == -1. The
+ * second request was ACKed as short, e.g. only 1K was read, resulting in
+ * pos == 33K.
+ *
+ * Thus, when all fuse requests are completed, the minimal non-negative 'pos'
+ * will be equal to the length of the longest contiguous fragment of
+ * transferred data starting from the beginning of IO request.
+ */
+static void fuse_aio_complete(struct fuse_io_priv *io, int err, ssize_t pos)
+{
+        int left;
+
+        spin_lock(&io->lock);
+        if (err)
+                io->err = io->err ? : err;
+        else if (pos >= 0 && (io->bytes < 0 || pos < io->bytes))
+                io->bytes = pos;
+
+        left = --io->reqs;
+        spin_unlock(&io->lock);
+
+        if (!left) {
+                long res;
+
+                if (io->err)
+                        res = io->err;
+                else if (io->bytes >= 0 && io->write)
+                        res = -EIO;
+                else {
+                        res = io->bytes < 0 ? io->size : io->bytes;
+
+                        if (!is_sync_kiocb(io->iocb)) {
+                                struct path *path = &io->iocb->ki_filp->f_path;
+                                struct inode *inode = path->dentry->d_inode;
+                                struct fuse_conn *fc = get_fuse_conn(inode);
+                                struct fuse_inode *fi = get_fuse_inode(inode);
+
+                                spin_lock(&fc->lock);
+                                fi->attr_version = ++fc->attr_version;
+                                spin_unlock(&fc->lock);
+                        }
+                }
+
+                aio_complete(io->iocb, res, 0);
+                kfree(io);
+        }
+}
+
+static void fuse_aio_complete_req(struct fuse_conn *fc, struct fuse_req *req)
+{
+        struct fuse_io_priv *io = req->io;
+        ssize_t pos = -1;
+
+        fuse_release_user_pages(req, !io->write);
+
+        if (io->write) {
+                if (req->misc.write.in.size != req->misc.write.out.size)
+                        pos = req->misc.write.in.offset - io->offset +
+                                req->misc.write.out.size;
+        } else {
+                if (req->misc.read.in.size != req->out.args[0].size)
+                        pos = req->misc.read.in.offset - io->offset +
+                                req->out.args[0].size;
+        }
+
+        fuse_aio_complete(io, req->out.h.error, pos);
+}
+
+static size_t fuse_async_req_send(struct fuse_conn *fc, struct fuse_req *req,
+                size_t num_bytes, struct fuse_io_priv *io)
+{
+        spin_lock(&io->lock);
+        io->size += num_bytes;
+        io->reqs++;
+        spin_unlock(&io->lock);
+
+        req->io = io;
+        req->end = fuse_aio_complete_req;
+
+        __fuse_get_request(req);
+        fuse_request_send_background(fc, req);
+
+        return num_bytes;
+}
+
+static size_t fuse_send_read(struct fuse_req *req, struct fuse_io_priv *io,
                              loff_t pos, size_t count, fl_owner_t owner)
 {
+        struct file *file = io->file;
         struct fuse_file *ff = file->private_data;
         struct fuse_conn *fc = ff->fc;
 
@@ -504,6 +614,10 @@ static size_t fuse_send_read(struct fuse_req *req, struct file *file,
                 inarg->read_flags |= FUSE_READ_LOCKOWNER;
                 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
         }
+
+        if (io->async)
+                return fuse_async_req_send(fc, req, count, io);
+
         fuse_request_send(fc, req);
         return req->out.args[0].size;
 }
@@ -524,6 +638,7 @@ static void fuse_read_update_size(struct inode *inode, loff_t size,
 
 static int fuse_readpage(struct file *file, struct page *page)
 {
+        struct fuse_io_priv io = { .async = 0, .file = file };
         struct inode *inode = page->mapping->host;
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_req *req;
@@ -544,7 +659,7 @@ static int fuse_readpage(struct file *file, struct page *page)
          */
         fuse_wait_on_page_writeback(inode, page->index);
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req(fc, 1);
         err = PTR_ERR(req);
         if (IS_ERR(req))
                 goto out;
@@ -555,7 +670,8 @@ static int fuse_readpage(struct file *file, struct page *page)
         req->out.argpages = 1;
         req->num_pages = 1;
         req->pages[0] = page;
-        num_read = fuse_send_read(req, file, pos, count, NULL);
+        req->page_descs[0].length = count;
+        num_read = fuse_send_read(req, &io, pos, count, NULL);
         err = req->out.h.error;
         fuse_put_request(fc, req);
 
@@ -641,6 +757,7 @@ struct fuse_fill_data {
         struct fuse_req *req;
         struct file *file;
         struct inode *inode;
+        unsigned nr_pages;
 };
 
 static int fuse_readpages_fill(void *_data, struct page *page)
@@ -656,16 +773,31 @@ static int fuse_readpages_fill(void *_data, struct page *page)
             (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
+                int nr_alloc = min_t(unsigned, data->nr_pages,
+                                     FUSE_MAX_PAGES_PER_REQ);
                 fuse_send_readpages(req, data->file);
-                data->req = req = fuse_get_req(fc);
+                if (fc->async_read)
+                        req = fuse_get_req_for_background(fc, nr_alloc);
+                else
+                        req = fuse_get_req(fc, nr_alloc);
+
+                data->req = req;
                 if (IS_ERR(req)) {
                         unlock_page(page);
                         return PTR_ERR(req);
                 }
         }
+
+        if (WARN_ON(req->num_pages >= req->max_pages)) {
+                fuse_put_request(fc, req);
+                return -EIO;
+        }
+
         page_cache_get(page);
         req->pages[req->num_pages] = page;
+        req->page_descs[req->num_pages].length = PAGE_SIZE;
         req->num_pages++;
+        data->nr_pages--;
         return 0;
 }
 
@@ -676,6 +808,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_fill_data data;
         int err;
+        int nr_alloc = min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ);
 
         err = -EIO;
         if (is_bad_inode(inode))
@@ -683,7 +816,11 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         data.file = file;
         data.inode = inode;
-        data.req = fuse_get_req(fc);
+        if (fc->async_read)
+                data.req = fuse_get_req_for_background(fc, nr_alloc);
+        else
+                data.req = fuse_get_req(fc, nr_alloc);
+        data.nr_pages = nr_pages;
         err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
                 goto out;
@@ -744,9 +881,10 @@ static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
         req->out.args[0].value = outarg;
 }
 
-static size_t fuse_send_write(struct fuse_req *req, struct file *file,
+static size_t fuse_send_write(struct fuse_req *req, struct fuse_io_priv *io,
                               loff_t pos, size_t count, fl_owner_t owner)
 {
+        struct file *file = io->file;
         struct fuse_file *ff = file->private_data;
         struct fuse_conn *fc = ff->fc;
         struct fuse_write_in *inarg = &req->misc.write.in;
@@ -757,6 +895,10 @@ static size_t fuse_send_write(struct fuse_req *req, struct file *file,
                 inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
                 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
         }
+
+        if (io->async)
+                return fuse_async_req_send(fc, req, count, io);
+
         fuse_request_send(fc, req);
         return req->misc.write.out.size;
 }
@@ -780,13 +922,14 @@ static size_t fuse_send_write_pages(struct fuse_req *req, struct file *file,
         size_t res;
         unsigned offset;
         unsigned i;
+        struct fuse_io_priv io = { .async = 0, .file = file };
 
         for (i = 0; i < req->num_pages; i++)
                 fuse_wait_on_page_writeback(inode, req->pages[i]->index);
 
-        res = fuse_send_write(req, file, pos, count, NULL);
+        res = fuse_send_write(req, &io, pos, count, NULL);
 
-        offset = req->page_offset;
+        offset = req->page_descs[0].offset;
         count = res;
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
@@ -817,7 +960,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
         int err;
 
         req->in.argpages = 1;
-        req->page_offset = offset;
+        req->page_descs[0].offset = offset;
 
         do {
                 size_t tmp;
@@ -857,6 +1000,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
 
                 err = 0;
                 req->pages[req->num_pages] = page;
+                req->page_descs[req->num_pages].length = tmp;
                 req->num_pages++;
 
                 iov_iter_advance(ii, tmp);
@@ -869,11 +1013,19 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                 if (!fc->big_writes)
                         break;
         } while (iov_iter_count(ii) && count < fc->max_write &&
-                 req->num_pages < FUSE_MAX_PAGES_PER_REQ && offset == 0);
+                 req->num_pages < req->max_pages && offset == 0);
 
         return count > 0 ? count : err;
 }
 
+static inline unsigned fuse_wr_pages(loff_t pos, size_t len)
+{
+        return min_t(unsigned,
+                     ((pos + len - 1) >> PAGE_CACHE_SHIFT) -
+                     (pos >> PAGE_CACHE_SHIFT) + 1,
+                     FUSE_MAX_PAGES_PER_REQ);
+}
+
 static ssize_t fuse_perform_write(struct file *file,
                                   struct address_space *mapping,
                                   struct iov_iter *ii, loff_t pos)
@@ -889,8 +1041,9 @@ static ssize_t fuse_perform_write(struct file *file,
         do {
                 struct fuse_req *req;
                 ssize_t count;
+                unsigned nr_pages = fuse_wr_pages(pos, iov_iter_count(ii));
 
-                req = fuse_get_req(fc);
+                req = fuse_get_req(fc, nr_pages);
                 if (IS_ERR(req)) {
                         err = PTR_ERR(req);
                         break;
@@ -947,7 +1100,6 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
                 return err;
 
         count = ocount;
-        sb_start_write(inode->i_sb);
         mutex_lock(&inode->i_mutex);
 
         /* We can write back this queue in page reclaim */
@@ -1006,73 +1158,127 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 out:
         current->backing_dev_info = NULL;
         mutex_unlock(&inode->i_mutex);
-        sb_end_write(inode->i_sb);
 
         return written ? written : err;
 }
 
-static void fuse_release_user_pages(struct fuse_req *req, int write)
+static inline void fuse_page_descs_length_init(struct fuse_req *req,
+                unsigned index, unsigned nr_pages)
 {
-        unsigned i;
+        int i;
 
-        for (i = 0; i < req->num_pages; i++) {
-                struct page *page = req->pages[i];
-                if (write)
-                        set_page_dirty_lock(page);
-                put_page(page);
-        }
+        for (i = index; i < index + nr_pages; i++)
+                req->page_descs[i].length = PAGE_SIZE -
+                        req->page_descs[i].offset;
+}
+
+static inline unsigned long fuse_get_user_addr(const struct iov_iter *ii)
+{
+        return (unsigned long)ii->iov->iov_base + ii->iov_offset;
+}
+
+static inline size_t fuse_get_frag_size(const struct iov_iter *ii,
+                                        size_t max_size)
+{
+        return min(iov_iter_single_seg_count(ii), max_size);
 }
 
-static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
+static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii,
                                size_t *nbytesp, int write)
 {
-        size_t nbytes = *nbytesp;
-        unsigned long user_addr = (unsigned long) buf;
-        unsigned offset = user_addr & ~PAGE_MASK;
-        int npages;
+        size_t nbytes = 0;  /* # bytes already packed in req */
 
         /* Special case for kernel I/O: can copy directly into the buffer */
         if (segment_eq(get_fs(), KERNEL_DS)) {
+                unsigned long user_addr = fuse_get_user_addr(ii);
+                size_t frag_size = fuse_get_frag_size(ii, *nbytesp);
+
                 if (write)
                         req->in.args[1].value = (void *) user_addr;
                 else
                         req->out.args[0].value = (void *) user_addr;
 
+                iov_iter_advance(ii, frag_size);
+                *nbytesp = frag_size;
                 return 0;
         }
 
-        nbytes = min_t(size_t, nbytes, FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
-        npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        npages = clamp(npages, 1, FUSE_MAX_PAGES_PER_REQ);
-        npages = get_user_pages_fast(user_addr, npages, !write, req->pages);
-        if (npages < 0)
-                return npages;
+        while (nbytes < *nbytesp && req->num_pages < req->max_pages) {
+                unsigned npages;
+                unsigned long user_addr = fuse_get_user_addr(ii);
+                unsigned offset = user_addr & ~PAGE_MASK;
+                size_t frag_size = fuse_get_frag_size(ii, *nbytesp - nbytes);
+                int ret;
+
+                unsigned n = req->max_pages - req->num_pages;
+                frag_size = min_t(size_t, frag_size, n << PAGE_SHIFT);
+
+                npages = (frag_size + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                npages = clamp(npages, 1U, n);
+
+                ret = get_user_pages_fast(user_addr, npages, !write,
+                                          &req->pages[req->num_pages]);
+                if (ret < 0)
+                        return ret;
 
-        req->num_pages = npages;
-        req->page_offset = offset;
+                npages = ret;
+                frag_size = min_t(size_t, frag_size,
+                                  (npages << PAGE_SHIFT) - offset);
+                iov_iter_advance(ii, frag_size);
+
+                req->page_descs[req->num_pages].offset = offset;
+                fuse_page_descs_length_init(req, req->num_pages, npages);
+
+                req->num_pages += npages;
+                req->page_descs[req->num_pages - 1].length -=
+                        (npages << PAGE_SHIFT) - offset - frag_size;
+
+                nbytes += frag_size;
+        }
 
         if (write)
                 req->in.argpages = 1;
         else
                 req->out.argpages = 1;
 
-        nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
-        *nbytesp = min(*nbytesp, nbytes);
+        *nbytesp = nbytes;
 
         return 0;
 }
 
-ssize_t fuse_direct_io(struct file *file, const char __user *buf,
-                       size_t count, loff_t *ppos, int write)
+static inline int fuse_iter_npages(const struct iov_iter *ii_p)
 {
+        struct iov_iter ii = *ii_p;
+        int npages = 0;
+
+        while (iov_iter_count(&ii) && npages < FUSE_MAX_PAGES_PER_REQ) {
+                unsigned long user_addr = fuse_get_user_addr(&ii);
+                unsigned offset = user_addr & ~PAGE_MASK;
+                size_t frag_size = iov_iter_single_seg_count(&ii);
+
+                npages += (frag_size + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
+                iov_iter_advance(&ii, frag_size);
+        }
+
+        return min(npages, FUSE_MAX_PAGES_PER_REQ);
+}
+
+ssize_t fuse_direct_io(struct fuse_io_priv *io, const struct iovec *iov,
+                       unsigned long nr_segs, size_t count, loff_t *ppos,
+                       int write)
+{
+        struct file *file = io->file;
         struct fuse_file *ff = file->private_data;
         struct fuse_conn *fc = ff->fc;
         size_t nmax = write ? fc->max_write : fc->max_read;
         loff_t pos = *ppos;
         ssize_t res = 0;
         struct fuse_req *req;
+        struct iov_iter ii;
 
-        req = fuse_get_req(fc);
+        iov_iter_init(&ii, iov, nr_segs, count, 0);
+
+        req = fuse_get_req(fc, fuse_iter_npages(&ii));
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1080,18 +1286,19 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                 size_t nres;
                 fl_owner_t owner = current->files;
                 size_t nbytes = min(count, nmax);
-                int err = fuse_get_user_pages(req, buf, &nbytes, write);
+                int err = fuse_get_user_pages(req, &ii, &nbytes, write);
                 if (err) {
                         res = err;
                         break;
                 }
 
                 if (write)
-                        nres = fuse_send_write(req, file, pos, nbytes, owner);
+                        nres = fuse_send_write(req, io, pos, nbytes, owner);
                 else
-                        nres = fuse_send_read(req, file, pos, nbytes, owner);
+                        nres = fuse_send_read(req, io, pos, nbytes, owner);
 
-                fuse_release_user_pages(req, !write);
+                if (!io->async)
+                        fuse_release_user_pages(req, !write);
                 if (req->out.h.error) {
                         if (!res)
                                 res = req->out.h.error;
@@ -1103,12 +1310,11 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                 count -= nres;
                 res += nres;
                 pos += nres;
-                buf += nres;
                 if (nres != nbytes)
                         break;
                 if (count) {
                         fuse_put_request(fc, req);
-                        req = fuse_get_req(fc);
+                        req = fuse_get_req(fc, fuse_iter_npages(&ii));
                         if (IS_ERR(req))
                                 break;
                 }
@@ -1122,34 +1328,45 @@ ssize_t fuse_direct_io(struct file *file, const char __user *buf,
 }
 EXPORT_SYMBOL_GPL(fuse_direct_io);
 
-static ssize_t fuse_direct_read(struct file *file, char __user *buf,
-                                     size_t count, loff_t *ppos)
+static ssize_t __fuse_direct_read(struct fuse_io_priv *io,
+                                  const struct iovec *iov,
+                                  unsigned long nr_segs, loff_t *ppos,
+                                  size_t count)
 {
         ssize_t res;
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct file *file = io->file;
+        struct inode *inode = file_inode(file);
 
         if (is_bad_inode(inode))
                 return -EIO;
 
-        res = fuse_direct_io(file, buf, count, ppos, 0);
+        res = fuse_direct_io(io, iov, nr_segs, count, ppos, 0);
 
         fuse_invalidate_attr(inode);
 
         return res;
 }
 
-static ssize_t __fuse_direct_write(struct file *file, const char __user *buf,
-                                   size_t count, loff_t *ppos)
+static ssize_t fuse_direct_read(struct file *file, char __user *buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct fuse_io_priv io = { .async = 0, .file = file };
+        struct iovec iov = { .iov_base = buf, .iov_len = count };
+        return __fuse_direct_read(&io, &iov, 1, ppos, count);
+}
+
+static ssize_t __fuse_direct_write(struct fuse_io_priv *io,
+                                   const struct iovec *iov,
+                                   unsigned long nr_segs, loff_t *ppos)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct file *file = io->file;
+        struct inode *inode = file_inode(file);
+        size_t count = iov_length(iov, nr_segs);
         ssize_t res;
 
         res = generic_write_checks(file, ppos, &count, 0);
-        if (!res) {
-                res = fuse_direct_io(file, buf, count, ppos, 1);
-                if (res > 0)
-                        fuse_write_update_size(inode, *ppos);
-        }
+        if (!res)
+                res = fuse_direct_io(io, iov, nr_segs, count, ppos, 1);
 
         fuse_invalidate_attr(inode);
 
@@ -1159,15 +1376,19 @@ static ssize_t __fuse_direct_write(struct file *file, const char __user *buf,
 static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
                                  size_t count, loff_t *ppos)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct iovec iov = { .iov_base = (void __user *)buf, .iov_len = count };
+        struct inode *inode = file_inode(file);
         ssize_t res;
+        struct fuse_io_priv io = { .async = 0, .file = file };
 
         if (is_bad_inode(inode))
                 return -EIO;
 
         /* Don't allow parallel writes to the same file */
         mutex_lock(&inode->i_mutex);
-        res = __fuse_direct_write(file, buf, count, ppos);
+        res = __fuse_direct_write(&io, &iov, 1, ppos);
+        if (res > 0)
+                fuse_write_update_size(inode, *ppos);
         mutex_unlock(&inode->i_mutex);
 
         return res;
@@ -1272,10 +1493,11 @@ static int fuse_writepage_locked(struct page *page)
 
         set_page_writeback(page);
 
-        req = fuse_request_alloc_nofs();
+        req = fuse_request_alloc_nofs(1);
         if (!req)
                 goto err;
 
+        req->background = 1; /* writeback always goes to bg_queue */
         tmp_page = alloc_page(GFP_NOFS | __GFP_HIGHMEM);
         if (!tmp_page)
                 goto err_free;
@@ -1293,7 +1515,8 @@ static int fuse_writepage_locked(struct page *page)
         req->in.argpages = 1;
         req->num_pages = 1;
         req->pages[0] = tmp_page;
-        req->page_offset = 0;
+        req->page_descs[0].offset = 0;
+        req->page_descs[0].length = PAGE_SIZE;
         req->end = fuse_writepage_end;
         req->inode = inode;
 
@@ -1385,7 +1608,7 @@ static const struct vm_operations_struct fuse_file_vm_ops = {
 static int fuse_file_mmap(struct file *file, struct vm_area_struct *vma)
 {
         if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) {
-                struct inode *inode = file->f_dentry->d_inode;
+                struct inode *inode = file_inode(file);
                 struct fuse_conn *fc = get_fuse_conn(inode);
                 struct fuse_inode *fi = get_fuse_inode(inode);
                 struct fuse_file *ff = file->private_data;
@@ -1443,7 +1666,7 @@ static void fuse_lk_fill(struct fuse_req *req, struct file *file,
                          const struct file_lock *fl, int opcode, pid_t pid,
                          int flock)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_file *ff = file->private_data;
         struct fuse_lk_in *arg = &req->misc.lk_in;
@@ -1465,13 +1688,13 @@ static void fuse_lk_fill(struct fuse_req *req, struct file *file,
 
 static int fuse_getlk(struct file *file, struct file_lock *fl)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_req *req;
         struct fuse_lk_out outarg;
         int err;
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1490,7 +1713,7 @@ static int fuse_getlk(struct file *file, struct file_lock *fl)
 
 static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_req *req;
         int opcode = (fl->fl_flags & FL_SLEEP) ? FUSE_SETLKW : FUSE_SETLK;
@@ -1506,7 +1729,7 @@ static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
         if (fl->fl_flags & FL_CLOSE)
                 return 0;
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return PTR_ERR(req);
 
@@ -1522,7 +1745,7 @@ static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
 
 static int fuse_file_lock(struct file *file, int cmd, struct file_lock *fl)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         int err;
 
@@ -1545,7 +1768,7 @@ static int fuse_file_lock(struct file *file, int cmd, struct file_lock *fl)
 
 static int fuse_file_flock(struct file *file, int cmd, struct file_lock *fl)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
         int err;
 
@@ -1575,7 +1798,7 @@ static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
         if (!inode->i_sb->s_bdev || fc->no_bmap)
                 return 0;
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return 0;
 
@@ -1602,7 +1825,7 @@ static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
 static loff_t fuse_file_llseek(struct file *file, loff_t offset, int whence)
 {
         loff_t retval;
-        struct inode *inode = file->f_path.dentry->d_inode;
+        struct inode *inode = file_inode(file);
 
         /* No i_mutex protection necessary for SEEK_CUR and SEEK_SET */
         if (whence == SEEK_CUR || whence == SEEK_SET)
@@ -1873,7 +2096,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
                 num_pages++;
         }
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req(fc, num_pages);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
                 req = NULL;
@@ -1881,6 +2104,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
         }
         memcpy(req->pages, pages, sizeof(req->pages[0]) * num_pages);
         req->num_pages = num_pages;
+        fuse_page_descs_length_init(req, 0, req->num_pages);
 
         /* okay, let's send it to the client */
         req->in.h.opcode = FUSE_IOCTL;
@@ -1978,10 +2202,10 @@ EXPORT_SYMBOL_GPL(fuse_do_ioctl);
 long fuse_ioctl_common(struct file *file, unsigned int cmd,
                        unsigned long arg, unsigned int flags)
 {
-        struct inode *inode = file->f_dentry->d_inode;
+        struct inode *inode = file_inode(file);
         struct fuse_conn *fc = get_fuse_conn(inode);
 
-        if (!fuse_allow_task(fc, current))
+        if (!fuse_allow_current_process(fc))
                 return -EACCES;
 
         if (is_bad_inode(inode))
@@ -2066,6 +2290,7 @@ unsigned fuse_file_poll(struct file *file, poll_table *wait)
                 return DEFAULT_POLLMASK;
 
         poll_wait(file, &ff->poll_wait, wait);
+        inarg.events = (__u32)poll_requested_events(wait);
 
         /*
          * Ask for notification iff there's someone waiting for it.
@@ -2076,7 +2301,7 @@ unsigned fuse_file_poll(struct file *file, poll_table *wait)
                 fuse_register_polled_file(fc, ff);
         }
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return POLLERR;
 
@@ -2126,53 +2351,93 @@ int fuse_notify_poll_wakeup(struct fuse_conn *fc,
         return 0;
 }
 
-static ssize_t fuse_loop_dio(struct file *filp, const struct iovec *iov,
-                             unsigned long nr_segs, loff_t *ppos, int rw)
+static void fuse_do_truncate(struct file *file)
 {
-        const struct iovec *vector = iov;
-        ssize_t ret = 0;
-
-        while (nr_segs > 0) {
-                void __user *base;
-                size_t len;
-                ssize_t nr;
-
-                base = vector->iov_base;
-                len = vector->iov_len;
-                vector++;
-                nr_segs--;
+        struct inode *inode = file->f_mapping->host;
+        struct iattr attr;
 
-                if (rw == WRITE)
-                        nr = __fuse_direct_write(filp, base, len, ppos);
-                else
-                        nr = fuse_direct_read(filp, base, len, ppos);
+        attr.ia_valid = ATTR_SIZE;
+        attr.ia_size = i_size_read(inode);
 
-                if (nr < 0) {
-                        if (!ret)
-                                ret = nr;
-                        break;
-                }
-                ret += nr;
-                if (nr != len)
-                        break;
-        }
+        attr.ia_file = file;
+        attr.ia_valid |= ATTR_FILE;
 
-        return ret;
+        fuse_do_setattr(inode, &attr, file);
 }
 
-
 static ssize_t
 fuse_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
                         loff_t offset, unsigned long nr_segs)
 {
         ssize_t ret = 0;
-        struct file *file = NULL;
+        struct file *file = iocb->ki_filp;
+        struct fuse_file *ff = file->private_data;
         loff_t pos = 0;
+        struct inode *inode;
+        loff_t i_size;
+        size_t count = iov_length(iov, nr_segs);
+        struct fuse_io_priv *io;
 
-        file = iocb->ki_filp;
         pos = offset;
+        inode = file->f_mapping->host;
+        i_size = i_size_read(inode);
+
+        /* optimization for short read */
+        if (rw != WRITE && offset + count > i_size) {
+                if (offset >= i_size)
+                        return 0;
+                count = i_size - offset;
+        }
+
+        io = kmalloc(sizeof(struct fuse_io_priv), GFP_KERNEL);
+        if (!io)
+                return -ENOMEM;
+        spin_lock_init(&io->lock);
+        io->reqs = 1;
+        io->bytes = -1;
+        io->size = 0;
+        io->offset = offset;
+        io->write = (rw == WRITE);
+        io->err = 0;
+        io->file = file;
+        /*
+         * By default, we want to optimize all I/Os with async request
+         * submission to the client filesystem if supported.
+         */
+        io->async = ff->fc->async_dio;
+        io->iocb = iocb;
+
+        /*
+         * We cannot asynchronously extend the size of a file. We have no method
+         * to wait on real async I/O requests, so we must submit this request
+         * synchronously.
+         */
+        if (!is_sync_kiocb(iocb) && (offset + count > i_size))
+                io->async = false;
 
-        ret = fuse_loop_dio(file, iov, nr_segs, &pos, rw);
+        if (rw == WRITE)
+                ret = __fuse_direct_write(io, iov, nr_segs, &pos);
+        else
+                ret = __fuse_direct_read(io, iov, nr_segs, &pos, count);
+
+        if (io->async) {
+                fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
+
+                /* we have a non-extending, async request, so return */
+                if (ret > 0 && !is_sync_kiocb(iocb))
+                        return -EIOCBQUEUED;
+
+                ret = wait_on_sync_kiocb(iocb);
+        } else {
+                kfree(io);
+        }
+
+        if (rw == WRITE) {
+                if (ret > 0)
+                        fuse_write_update_size(inode, pos);
+                else if (ret < 0 && offset + count > i_size)
+                        fuse_do_truncate(file);
+        }
 
         return ret;
 }
@@ -2194,7 +2459,7 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
         if (fc->no_fallocate)
                 return -EOPNOTSUPP;
 
-        req = fuse_get_req(fc);
+        req = fuse_get_req_nopages(fc);
         if (IS_ERR(req))
                 return PTR_ERR(req);