aboutsummaryrefslogtreecommitdiffstats
path: root/fs/fuse/file.c
diff options
context:
space:
mode:
Diffstat (limited to 'fs/fuse/file.c')
-rw-r--r--fs/fuse/file.c463
1 files changed, 441 insertions, 22 deletions
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 34930a964b82..d9fdb7cec538 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1,6 +1,6 @@
1/* 1/*
2 FUSE: Filesystem in Userspace 2 FUSE: Filesystem in Userspace
3 Copyright (C) 2001-2006 Miklos Szeredi <miklos@szeredi.hu> 3 Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
4 4
5 This program can be distributed under the terms of the GNU GPL. 5 This program can be distributed under the terms of the GNU GPL.
6 See the file COPYING. 6 See the file COPYING.
@@ -39,14 +39,14 @@ static int fuse_send_open(struct inode *inode, struct file *file, int isdir,
39 req->out.numargs = 1; 39 req->out.numargs = 1;
40 req->out.args[0].size = sizeof(*outargp); 40 req->out.args[0].size = sizeof(*outargp);
41 req->out.args[0].value = outargp; 41 req->out.args[0].value = outargp;
42 request_send(fc, req); 42 fuse_request_send(fc, req);
43 err = req->out.h.error; 43 err = req->out.h.error;
44 fuse_put_request(fc, req); 44 fuse_put_request(fc, req);
45 45
46 return err; 46 return err;
47} 47}
48 48
49struct fuse_file *fuse_file_alloc(void) 49struct fuse_file *fuse_file_alloc(struct fuse_conn *fc)
50{ 50{
51 struct fuse_file *ff; 51 struct fuse_file *ff;
52 ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL); 52 ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
@@ -54,11 +54,16 @@ struct fuse_file *fuse_file_alloc(void)
54 ff->reserved_req = fuse_request_alloc(); 54 ff->reserved_req = fuse_request_alloc();
55 if (!ff->reserved_req) { 55 if (!ff->reserved_req) {
56 kfree(ff); 56 kfree(ff);
57 ff = NULL; 57 return NULL;
58 } else { 58 } else {
59 INIT_LIST_HEAD(&ff->write_entry); 59 INIT_LIST_HEAD(&ff->write_entry);
60 atomic_set(&ff->count, 0); 60 atomic_set(&ff->count, 0);
61 spin_lock(&fc->lock);
62 ff->kh = ++fc->khctr;
63 spin_unlock(&fc->lock);
61 } 64 }
65 RB_CLEAR_NODE(&ff->polled_node);
66 init_waitqueue_head(&ff->poll_wait);
62 } 67 }
63 return ff; 68 return ff;
64} 69}
@@ -79,7 +84,6 @@ static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
79{ 84{
80 dput(req->misc.release.dentry); 85 dput(req->misc.release.dentry);
81 mntput(req->misc.release.vfsmount); 86 mntput(req->misc.release.vfsmount);
82 fuse_put_request(fc, req);
83} 87}
84 88
85static void fuse_file_put(struct fuse_file *ff) 89static void fuse_file_put(struct fuse_file *ff)
@@ -89,7 +93,7 @@ static void fuse_file_put(struct fuse_file *ff)
89 struct inode *inode = req->misc.release.dentry->d_inode; 93 struct inode *inode = req->misc.release.dentry->d_inode;
90 struct fuse_conn *fc = get_fuse_conn(inode); 94 struct fuse_conn *fc = get_fuse_conn(inode);
91 req->end = fuse_release_end; 95 req->end = fuse_release_end;
92 request_send_background(fc, req); 96 fuse_request_send_background(fc, req);
93 kfree(ff); 97 kfree(ff);
94 } 98 }
95} 99}
@@ -109,6 +113,7 @@ void fuse_finish_open(struct inode *inode, struct file *file,
109 113
110int fuse_open_common(struct inode *inode, struct file *file, int isdir) 114int fuse_open_common(struct inode *inode, struct file *file, int isdir)
111{ 115{
116 struct fuse_conn *fc = get_fuse_conn(inode);
112 struct fuse_open_out outarg; 117 struct fuse_open_out outarg;
113 struct fuse_file *ff; 118 struct fuse_file *ff;
114 int err; 119 int err;
@@ -121,7 +126,7 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
121 if (err) 126 if (err)
122 return err; 127 return err;
123 128
124 ff = fuse_file_alloc(); 129 ff = fuse_file_alloc(fc);
125 if (!ff) 130 if (!ff)
126 return -ENOMEM; 131 return -ENOMEM;
127 132
@@ -167,7 +172,11 @@ int fuse_release_common(struct inode *inode, struct file *file, int isdir)
167 172
168 spin_lock(&fc->lock); 173 spin_lock(&fc->lock);
169 list_del(&ff->write_entry); 174 list_del(&ff->write_entry);
175 if (!RB_EMPTY_NODE(&ff->polled_node))
176 rb_erase(&ff->polled_node, &fc->polled_files);
170 spin_unlock(&fc->lock); 177 spin_unlock(&fc->lock);
178
179 wake_up_interruptible_sync(&ff->poll_wait);
171 /* 180 /*
172 * Normally this will send the RELEASE request, 181 * Normally this will send the RELEASE request,
173 * however if some asynchronous READ or WRITE requests 182 * however if some asynchronous READ or WRITE requests
@@ -280,7 +289,7 @@ static int fuse_flush(struct file *file, fl_owner_t id)
280 req->in.args[0].size = sizeof(inarg); 289 req->in.args[0].size = sizeof(inarg);
281 req->in.args[0].value = &inarg; 290 req->in.args[0].value = &inarg;
282 req->force = 1; 291 req->force = 1;
283 request_send(fc, req); 292 fuse_request_send(fc, req);
284 err = req->out.h.error; 293 err = req->out.h.error;
285 fuse_put_request(fc, req); 294 fuse_put_request(fc, req);
286 if (err == -ENOSYS) { 295 if (err == -ENOSYS) {
@@ -344,7 +353,7 @@ int fuse_fsync_common(struct file *file, struct dentry *de, int datasync,
344 req->in.numargs = 1; 353 req->in.numargs = 1;
345 req->in.args[0].size = sizeof(inarg); 354 req->in.args[0].size = sizeof(inarg);
346 req->in.args[0].value = &inarg; 355 req->in.args[0].value = &inarg;
347 request_send(fc, req); 356 fuse_request_send(fc, req);
348 err = req->out.h.error; 357 err = req->out.h.error;
349 fuse_put_request(fc, req); 358 fuse_put_request(fc, req);
350 if (err == -ENOSYS) { 359 if (err == -ENOSYS) {
@@ -396,7 +405,7 @@ static size_t fuse_send_read(struct fuse_req *req, struct file *file,
396 inarg->read_flags |= FUSE_READ_LOCKOWNER; 405 inarg->read_flags |= FUSE_READ_LOCKOWNER;
397 inarg->lock_owner = fuse_lock_owner_id(fc, owner); 406 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
398 } 407 }
399 request_send(fc, req); 408 fuse_request_send(fc, req);
400 return req->out.args[0].size; 409 return req->out.args[0].size;
401} 410}
402 411
@@ -493,7 +502,6 @@ static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
493 } 502 }
494 if (req->ff) 503 if (req->ff)
495 fuse_file_put(req->ff); 504 fuse_file_put(req->ff);
496 fuse_put_request(fc, req);
497} 505}
498 506
499static void fuse_send_readpages(struct fuse_req *req, struct file *file, 507static void fuse_send_readpages(struct fuse_req *req, struct file *file,
@@ -509,10 +517,11 @@ static void fuse_send_readpages(struct fuse_req *req, struct file *file,
509 struct fuse_file *ff = file->private_data; 517 struct fuse_file *ff = file->private_data;
510 req->ff = fuse_file_get(ff); 518 req->ff = fuse_file_get(ff);
511 req->end = fuse_readpages_end; 519 req->end = fuse_readpages_end;
512 request_send_background(fc, req); 520 fuse_request_send_background(fc, req);
513 } else { 521 } else {
514 request_send(fc, req); 522 fuse_request_send(fc, req);
515 fuse_readpages_end(fc, req); 523 fuse_readpages_end(fc, req);
524 fuse_put_request(fc, req);
516 } 525 }
517} 526}
518 527
@@ -543,7 +552,7 @@ static int fuse_readpages_fill(void *_data, struct page *page)
543 } 552 }
544 } 553 }
545 req->pages[req->num_pages] = page; 554 req->pages[req->num_pages] = page;
546 req->num_pages ++; 555 req->num_pages++;
547 return 0; 556 return 0;
548} 557}
549 558
@@ -636,7 +645,7 @@ static size_t fuse_send_write(struct fuse_req *req, struct file *file,
636 inarg->write_flags |= FUSE_WRITE_LOCKOWNER; 645 inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
637 inarg->lock_owner = fuse_lock_owner_id(fc, owner); 646 inarg->lock_owner = fuse_lock_owner_id(fc, owner);
638 } 647 }
639 request_send(fc, req); 648 fuse_request_send(fc, req);
640 return req->misc.write.out.size; 649 return req->misc.write.out.size;
641} 650}
642 651
@@ -646,7 +655,7 @@ static int fuse_write_begin(struct file *file, struct address_space *mapping,
646{ 655{
647 pgoff_t index = pos >> PAGE_CACHE_SHIFT; 656 pgoff_t index = pos >> PAGE_CACHE_SHIFT;
648 657
649 *pagep = __grab_cache_page(mapping, index); 658 *pagep = grab_cache_page_write_begin(mapping, index, flags);
650 if (!*pagep) 659 if (!*pagep)
651 return -ENOMEM; 660 return -ENOMEM;
652 return 0; 661 return 0;
@@ -779,7 +788,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
779 break; 788 break;
780 789
781 err = -ENOMEM; 790 err = -ENOMEM;
782 page = __grab_cache_page(mapping, index); 791 page = grab_cache_page_write_begin(mapping, index, 0);
783 if (!page) 792 if (!page)
784 break; 793 break;
785 794
@@ -1042,7 +1051,6 @@ static void fuse_writepage_free(struct fuse_conn *fc, struct fuse_req *req)
1042{ 1051{
1043 __free_page(req->pages[0]); 1052 __free_page(req->pages[0]);
1044 fuse_file_put(req->ff); 1053 fuse_file_put(req->ff);
1045 fuse_put_request(fc, req);
1046} 1054}
1047 1055
1048static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req) 1056static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
@@ -1060,6 +1068,8 @@ static void fuse_writepage_finish(struct fuse_conn *fc, struct fuse_req *req)
1060 1068
1061/* Called under fc->lock, may release and reacquire it */ 1069/* Called under fc->lock, may release and reacquire it */
1062static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req) 1070static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
1071__releases(&fc->lock)
1072__acquires(&fc->lock)
1063{ 1073{
1064 struct fuse_inode *fi = get_fuse_inode(req->inode); 1074 struct fuse_inode *fi = get_fuse_inode(req->inode);
1065 loff_t size = i_size_read(req->inode); 1075 loff_t size = i_size_read(req->inode);
@@ -1079,13 +1089,14 @@ static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
1079 1089
1080 req->in.args[1].size = inarg->size; 1090 req->in.args[1].size = inarg->size;
1081 fi->writectr++; 1091 fi->writectr++;
1082 request_send_background_locked(fc, req); 1092 fuse_request_send_background_locked(fc, req);
1083 return; 1093 return;
1084 1094
1085 out_free: 1095 out_free:
1086 fuse_writepage_finish(fc, req); 1096 fuse_writepage_finish(fc, req);
1087 spin_unlock(&fc->lock); 1097 spin_unlock(&fc->lock);
1088 fuse_writepage_free(fc, req); 1098 fuse_writepage_free(fc, req);
1099 fuse_put_request(fc, req);
1089 spin_lock(&fc->lock); 1100 spin_lock(&fc->lock);
1090} 1101}
1091 1102
@@ -1096,6 +1107,8 @@ static void fuse_send_writepage(struct fuse_conn *fc, struct fuse_req *req)
1096 * Called with fc->lock 1107 * Called with fc->lock
1097 */ 1108 */
1098void fuse_flush_writepages(struct inode *inode) 1109void fuse_flush_writepages(struct inode *inode)
1110__releases(&fc->lock)
1111__acquires(&fc->lock)
1099{ 1112{
1100 struct fuse_conn *fc = get_fuse_conn(inode); 1113 struct fuse_conn *fc = get_fuse_conn(inode);
1101 struct fuse_inode *fi = get_fuse_inode(inode); 1114 struct fuse_inode *fi = get_fuse_inode(inode);
@@ -1325,7 +1338,7 @@ static int fuse_getlk(struct file *file, struct file_lock *fl)
1325 req->out.numargs = 1; 1338 req->out.numargs = 1;
1326 req->out.args[0].size = sizeof(outarg); 1339 req->out.args[0].size = sizeof(outarg);
1327 req->out.args[0].value = &outarg; 1340 req->out.args[0].value = &outarg;
1328 request_send(fc, req); 1341 fuse_request_send(fc, req);
1329 err = req->out.h.error; 1342 err = req->out.h.error;
1330 fuse_put_request(fc, req); 1343 fuse_put_request(fc, req);
1331 if (!err) 1344 if (!err)
@@ -1357,7 +1370,7 @@ static int fuse_setlk(struct file *file, struct file_lock *fl, int flock)
1357 return PTR_ERR(req); 1370 return PTR_ERR(req);
1358 1371
1359 fuse_lk_fill(req, file, fl, opcode, pid, flock); 1372 fuse_lk_fill(req, file, fl, opcode, pid, flock);
1360 request_send(fc, req); 1373 fuse_request_send(fc, req);
1361 err = req->out.h.error; 1374 err = req->out.h.error;
1362 /* locking is restartable */ 1375 /* locking is restartable */
1363 if (err == -EINTR) 1376 if (err == -EINTR)
@@ -1433,7 +1446,7 @@ static sector_t fuse_bmap(struct address_space *mapping, sector_t block)
1433 req->out.numargs = 1; 1446 req->out.numargs = 1;
1434 req->out.args[0].size = sizeof(outarg); 1447 req->out.args[0].size = sizeof(outarg);
1435 req->out.args[0].value = &outarg; 1448 req->out.args[0].value = &outarg;
1436 request_send(fc, req); 1449 fuse_request_send(fc, req);
1437 err = req->out.h.error; 1450 err = req->out.h.error;
1438 fuse_put_request(fc, req); 1451 fuse_put_request(fc, req);
1439 if (err == -ENOSYS) 1452 if (err == -ENOSYS)
@@ -1470,6 +1483,406 @@ static loff_t fuse_file_llseek(struct file *file, loff_t offset, int origin)
1470 return retval; 1483 return retval;
1471} 1484}
1472 1485
1486static int fuse_ioctl_copy_user(struct page **pages, struct iovec *iov,
1487 unsigned int nr_segs, size_t bytes, bool to_user)
1488{
1489 struct iov_iter ii;
1490 int page_idx = 0;
1491
1492 if (!bytes)
1493 return 0;
1494
1495 iov_iter_init(&ii, iov, nr_segs, bytes, 0);
1496
1497 while (iov_iter_count(&ii)) {
1498 struct page *page = pages[page_idx++];
1499 size_t todo = min_t(size_t, PAGE_SIZE, iov_iter_count(&ii));
1500 void *kaddr, *map;
1501
1502 kaddr = map = kmap(page);
1503
1504 while (todo) {
1505 char __user *uaddr = ii.iov->iov_base + ii.iov_offset;
1506 size_t iov_len = ii.iov->iov_len - ii.iov_offset;
1507 size_t copy = min(todo, iov_len);
1508 size_t left;
1509
1510 if (!to_user)
1511 left = copy_from_user(kaddr, uaddr, copy);
1512 else
1513 left = copy_to_user(uaddr, kaddr, copy);
1514
1515 if (unlikely(left))
1516 return -EFAULT;
1517
1518 iov_iter_advance(&ii, copy);
1519 todo -= copy;
1520 kaddr += copy;
1521 }
1522
1523 kunmap(map);
1524 }
1525
1526 return 0;
1527}
1528
1529/*
1530 * For ioctls, there is no generic way to determine how much memory
1531 * needs to be read and/or written. Furthermore, ioctls are allowed
1532 * to dereference the passed pointer, so the parameter requires deep
1533 * copying but FUSE has no idea whatsoever about what to copy in or
1534 * out.
1535 *
1536 * This is solved by allowing FUSE server to retry ioctl with
1537 * necessary in/out iovecs. Let's assume the ioctl implementation
1538 * needs to read in the following structure.
1539 *
1540 * struct a {
1541 * char *buf;
1542 * size_t buflen;
1543 * }
1544 *
1545 * On the first callout to FUSE server, inarg->in_size and
1546 * inarg->out_size will be NULL; then, the server completes the ioctl
1547 * with FUSE_IOCTL_RETRY set in out->flags, out->in_iovs set to 1 and
1548 * the actual iov array to
1549 *
1550 * { { .iov_base = inarg.arg, .iov_len = sizeof(struct a) } }
1551 *
1552 * which tells FUSE to copy in the requested area and retry the ioctl.
1553 * On the second round, the server has access to the structure and
1554 * from that it can tell what to look for next, so on the invocation,
1555 * it sets FUSE_IOCTL_RETRY, out->in_iovs to 2 and iov array to
1556 *
1557 * { { .iov_base = inarg.arg, .iov_len = sizeof(struct a) },
1558 * { .iov_base = a.buf, .iov_len = a.buflen } }
1559 *
1560 * FUSE will copy both struct a and the pointed buffer from the
1561 * process doing the ioctl and retry ioctl with both struct a and the
1562 * buffer.
1563 *
1564 * This time, FUSE server has everything it needs and completes ioctl
1565 * without FUSE_IOCTL_RETRY which finishes the ioctl call.
1566 *
1567 * Copying data out works the same way.
1568 *
1569 * Note that if FUSE_IOCTL_UNRESTRICTED is clear, the kernel
1570 * automatically initializes in and out iovs by decoding @cmd with
1571 * _IOC_* macros and the server is not allowed to request RETRY. This
1572 * limits ioctl data transfers to well-formed ioctls and is the forced
1573 * behavior for all FUSE servers.
1574 */
1575static long fuse_file_do_ioctl(struct file *file, unsigned int cmd,
1576 unsigned long arg, unsigned int flags)
1577{
1578 struct inode *inode = file->f_dentry->d_inode;
1579 struct fuse_file *ff = file->private_data;
1580 struct fuse_conn *fc = get_fuse_conn(inode);
1581 struct fuse_ioctl_in inarg = {
1582 .fh = ff->fh,
1583 .cmd = cmd,
1584 .arg = arg,
1585 .flags = flags
1586 };
1587 struct fuse_ioctl_out outarg;
1588 struct fuse_req *req = NULL;
1589 struct page **pages = NULL;
1590 struct page *iov_page = NULL;
1591 struct iovec *in_iov = NULL, *out_iov = NULL;
1592 unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages;
1593 size_t in_size, out_size, transferred;
1594 int err;
1595
1596 /* assume all the iovs returned by client always fits in a page */
1597 BUILD_BUG_ON(sizeof(struct iovec) * FUSE_IOCTL_MAX_IOV > PAGE_SIZE);
1598
1599 if (!fuse_allow_task(fc, current))
1600 return -EACCES;
1601
1602 err = -EIO;
1603 if (is_bad_inode(inode))
1604 goto out;
1605
1606 err = -ENOMEM;
1607 pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL);
1608 iov_page = alloc_page(GFP_KERNEL);
1609 if (!pages || !iov_page)
1610 goto out;
1611
1612 /*
1613 * If restricted, initialize IO parameters as encoded in @cmd.
1614 * RETRY from server is not allowed.
1615 */
1616 if (!(flags & FUSE_IOCTL_UNRESTRICTED)) {
1617 struct iovec *iov = page_address(iov_page);
1618
1619 iov->iov_base = (void __user *)arg;
1620 iov->iov_len = _IOC_SIZE(cmd);
1621
1622 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1623 in_iov = iov;
1624 in_iovs = 1;
1625 }
1626
1627 if (_IOC_DIR(cmd) & _IOC_READ) {
1628 out_iov = iov;
1629 out_iovs = 1;
1630 }
1631 }
1632
1633 retry:
1634 inarg.in_size = in_size = iov_length(in_iov, in_iovs);
1635 inarg.out_size = out_size = iov_length(out_iov, out_iovs);
1636
1637 /*
1638 * Out data can be used either for actual out data or iovs,
1639 * make sure there always is at least one page.
1640 */
1641 out_size = max_t(size_t, out_size, PAGE_SIZE);
1642 max_pages = DIV_ROUND_UP(max(in_size, out_size), PAGE_SIZE);
1643
1644 /* make sure there are enough buffer pages and init request with them */
1645 err = -ENOMEM;
1646 if (max_pages > FUSE_MAX_PAGES_PER_REQ)
1647 goto out;
1648 while (num_pages < max_pages) {
1649 pages[num_pages] = alloc_page(GFP_KERNEL | __GFP_HIGHMEM);
1650 if (!pages[num_pages])
1651 goto out;
1652 num_pages++;
1653 }
1654
1655 req = fuse_get_req(fc);
1656 if (IS_ERR(req)) {
1657 err = PTR_ERR(req);
1658 req = NULL;
1659 goto out;
1660 }
1661 memcpy(req->pages, pages, sizeof(req->pages[0]) * num_pages);
1662 req->num_pages = num_pages;
1663
1664 /* okay, let's send it to the client */
1665 req->in.h.opcode = FUSE_IOCTL;
1666 req->in.h.nodeid = get_node_id(inode);
1667 req->in.numargs = 1;
1668 req->in.args[0].size = sizeof(inarg);
1669 req->in.args[0].value = &inarg;
1670 if (in_size) {
1671 req->in.numargs++;
1672 req->in.args[1].size = in_size;
1673 req->in.argpages = 1;
1674
1675 err = fuse_ioctl_copy_user(pages, in_iov, in_iovs, in_size,
1676 false);
1677 if (err)
1678 goto out;
1679 }
1680
1681 req->out.numargs = 2;
1682 req->out.args[0].size = sizeof(outarg);
1683 req->out.args[0].value = &outarg;
1684 req->out.args[1].size = out_size;
1685 req->out.argpages = 1;
1686 req->out.argvar = 1;
1687
1688 fuse_request_send(fc, req);
1689 err = req->out.h.error;
1690 transferred = req->out.args[1].size;
1691 fuse_put_request(fc, req);
1692 req = NULL;
1693 if (err)
1694 goto out;
1695
1696 /* did it ask for retry? */
1697 if (outarg.flags & FUSE_IOCTL_RETRY) {
1698 char *vaddr;
1699
1700 /* no retry if in restricted mode */
1701 err = -EIO;
1702 if (!(flags & FUSE_IOCTL_UNRESTRICTED))
1703 goto out;
1704
1705 in_iovs = outarg.in_iovs;
1706 out_iovs = outarg.out_iovs;
1707
1708 /*
1709 * Make sure things are in boundary, separate checks
1710 * are to protect against overflow.
1711 */
1712 err = -ENOMEM;
1713 if (in_iovs > FUSE_IOCTL_MAX_IOV ||
1714 out_iovs > FUSE_IOCTL_MAX_IOV ||
1715 in_iovs + out_iovs > FUSE_IOCTL_MAX_IOV)
1716 goto out;
1717
1718 err = -EIO;
1719 if ((in_iovs + out_iovs) * sizeof(struct iovec) != transferred)
1720 goto out;
1721
1722 /* okay, copy in iovs and retry */
1723 vaddr = kmap_atomic(pages[0], KM_USER0);
1724 memcpy(page_address(iov_page), vaddr, transferred);
1725 kunmap_atomic(vaddr, KM_USER0);
1726
1727 in_iov = page_address(iov_page);
1728 out_iov = in_iov + in_iovs;
1729
1730 goto retry;
1731 }
1732
1733 err = -EIO;
1734 if (transferred > inarg.out_size)
1735 goto out;
1736
1737 err = fuse_ioctl_copy_user(pages, out_iov, out_iovs, transferred, true);
1738 out:
1739 if (req)
1740 fuse_put_request(fc, req);
1741 if (iov_page)
1742 __free_page(iov_page);
1743 while (num_pages)
1744 __free_page(pages[--num_pages]);
1745 kfree(pages);
1746
1747 return err ? err : outarg.result;
1748}
1749
1750static long fuse_file_ioctl(struct file *file, unsigned int cmd,
1751 unsigned long arg)
1752{
1753 return fuse_file_do_ioctl(file, cmd, arg, 0);
1754}
1755
1756static long fuse_file_compat_ioctl(struct file *file, unsigned int cmd,
1757 unsigned long arg)
1758{
1759 return fuse_file_do_ioctl(file, cmd, arg, FUSE_IOCTL_COMPAT);
1760}
1761
1762/*
1763 * All files which have been polled are linked to RB tree
1764 * fuse_conn->polled_files which is indexed by kh. Walk the tree and
1765 * find the matching one.
1766 */
1767static struct rb_node **fuse_find_polled_node(struct fuse_conn *fc, u64 kh,
1768 struct rb_node **parent_out)
1769{
1770 struct rb_node **link = &fc->polled_files.rb_node;
1771 struct rb_node *last = NULL;
1772
1773 while (*link) {
1774 struct fuse_file *ff;
1775
1776 last = *link;
1777 ff = rb_entry(last, struct fuse_file, polled_node);
1778
1779 if (kh < ff->kh)
1780 link = &last->rb_left;
1781 else if (kh > ff->kh)
1782 link = &last->rb_right;
1783 else
1784 return link;
1785 }
1786
1787 if (parent_out)
1788 *parent_out = last;
1789 return link;
1790}
1791
1792/*
1793 * The file is about to be polled. Make sure it's on the polled_files
1794 * RB tree. Note that files once added to the polled_files tree are
1795 * not removed before the file is released. This is because a file
1796 * polled once is likely to be polled again.
1797 */
1798static void fuse_register_polled_file(struct fuse_conn *fc,
1799 struct fuse_file *ff)
1800{
1801 spin_lock(&fc->lock);
1802 if (RB_EMPTY_NODE(&ff->polled_node)) {
1803 struct rb_node **link, *parent;
1804
1805 link = fuse_find_polled_node(fc, ff->kh, &parent);
1806 BUG_ON(*link);
1807 rb_link_node(&ff->polled_node, parent, link);
1808 rb_insert_color(&ff->polled_node, &fc->polled_files);
1809 }
1810 spin_unlock(&fc->lock);
1811}
1812
1813static unsigned fuse_file_poll(struct file *file, poll_table *wait)
1814{
1815 struct inode *inode = file->f_dentry->d_inode;
1816 struct fuse_file *ff = file->private_data;
1817 struct fuse_conn *fc = get_fuse_conn(inode);
1818 struct fuse_poll_in inarg = { .fh = ff->fh, .kh = ff->kh };
1819 struct fuse_poll_out outarg;
1820 struct fuse_req *req;
1821 int err;
1822
1823 if (fc->no_poll)
1824 return DEFAULT_POLLMASK;
1825
1826 poll_wait(file, &ff->poll_wait, wait);
1827
1828 /*
1829 * Ask for notification iff there's someone waiting for it.
1830 * The client may ignore the flag and always notify.
1831 */
1832 if (waitqueue_active(&ff->poll_wait)) {
1833 inarg.flags |= FUSE_POLL_SCHEDULE_NOTIFY;
1834 fuse_register_polled_file(fc, ff);
1835 }
1836
1837 req = fuse_get_req(fc);
1838 if (IS_ERR(req))
1839 return PTR_ERR(req);
1840
1841 req->in.h.opcode = FUSE_POLL;
1842 req->in.h.nodeid = get_node_id(inode);
1843 req->in.numargs = 1;
1844 req->in.args[0].size = sizeof(inarg);
1845 req->in.args[0].value = &inarg;
1846 req->out.numargs = 1;
1847 req->out.args[0].size = sizeof(outarg);
1848 req->out.args[0].value = &outarg;
1849 fuse_request_send(fc, req);
1850 err = req->out.h.error;
1851 fuse_put_request(fc, req);
1852
1853 if (!err)
1854 return outarg.revents;
1855 if (err == -ENOSYS) {
1856 fc->no_poll = 1;
1857 return DEFAULT_POLLMASK;
1858 }
1859 return POLLERR;
1860}
1861
1862/*
1863 * This is called from fuse_handle_notify() on FUSE_NOTIFY_POLL and
1864 * wakes up the poll waiters.
1865 */
1866int fuse_notify_poll_wakeup(struct fuse_conn *fc,
1867 struct fuse_notify_poll_wakeup_out *outarg)
1868{
1869 u64 kh = outarg->kh;
1870 struct rb_node **link;
1871
1872 spin_lock(&fc->lock);
1873
1874 link = fuse_find_polled_node(fc, kh, NULL);
1875 if (*link) {
1876 struct fuse_file *ff;
1877
1878 ff = rb_entry(*link, struct fuse_file, polled_node);
1879 wake_up_interruptible_sync(&ff->poll_wait);
1880 }
1881
1882 spin_unlock(&fc->lock);
1883 return 0;
1884}
1885
1473static const struct file_operations fuse_file_operations = { 1886static const struct file_operations fuse_file_operations = {
1474 .llseek = fuse_file_llseek, 1887 .llseek = fuse_file_llseek,
1475 .read = do_sync_read, 1888 .read = do_sync_read,
@@ -1484,6 +1897,9 @@ static const struct file_operations fuse_file_operations = {
1484 .lock = fuse_file_lock, 1897 .lock = fuse_file_lock,
1485 .flock = fuse_file_flock, 1898 .flock = fuse_file_flock,
1486 .splice_read = generic_file_splice_read, 1899 .splice_read = generic_file_splice_read,
1900 .unlocked_ioctl = fuse_file_ioctl,
1901 .compat_ioctl = fuse_file_compat_ioctl,
1902 .poll = fuse_file_poll,
1487}; 1903};
1488 1904
1489static const struct file_operations fuse_direct_io_file_operations = { 1905static const struct file_operations fuse_direct_io_file_operations = {
@@ -1496,6 +1912,9 @@ static const struct file_operations fuse_direct_io_file_operations = {
1496 .fsync = fuse_fsync, 1912 .fsync = fuse_fsync,
1497 .lock = fuse_file_lock, 1913 .lock = fuse_file_lock,
1498 .flock = fuse_file_flock, 1914 .flock = fuse_file_flock,
1915 .unlocked_ioctl = fuse_file_ioctl,
1916 .compat_ioctl = fuse_file_compat_ioctl,
1917 .poll = fuse_file_poll,
1499 /* no mmap and splice_read */ 1918 /* no mmap and splice_read */
1500}; 1919};
1501 1920