5 files changed, 741 insertions, 333 deletions

diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 8f873e621f41..4526da8907c6 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -21,18 +21,18 @@ MODULE_ALIAS_MISCDEV(FUSE_MINOR);
 
 static kmem_cache_t *fuse_req_cachep;
 
-static inline struct fuse_conn *fuse_get_conn(struct file *file)
+static struct fuse_conn *fuse_get_conn(struct file *file)
 {
         struct fuse_conn *fc;
         spin_lock(&fuse_lock);
         fc = file->private_data;
-        if (fc && !fc->mounted)
+        if (fc && !fc->connected)
                 fc = NULL;
         spin_unlock(&fuse_lock);
         return fc;
 }
 
-static inline void fuse_request_init(struct fuse_req *req)
+static void fuse_request_init(struct fuse_req *req)
 {
         memset(req, 0, sizeof(*req));
         INIT_LIST_HEAD(&req->list);
@@ -53,7 +53,7 @@ void fuse_request_free(struct fuse_req *req)
         kmem_cache_free(fuse_req_cachep, req);
 }
 
-static inline void block_sigs(sigset_t *oldset)
+static void block_sigs(sigset_t *oldset)
 {
         sigset_t mask;
 
@@ -61,7 +61,7 @@ static inline void block_sigs(sigset_t *oldset)
         sigprocmask(SIG_BLOCK, &mask, oldset);
 }
 
-static inline void restore_sigs(sigset_t *oldset)
+static void restore_sigs(sigset_t *oldset)
 {
         sigprocmask(SIG_SETMASK, oldset, NULL);
 }
@@ -109,18 +109,24 @@ struct fuse_req *fuse_get_request(struct fuse_conn *fc)
         int intr;
         sigset_t oldset;
 
+        atomic_inc(&fc->num_waiting);
         block_sigs(&oldset);
         intr = down_interruptible(&fc->outstanding_sem);
         restore_sigs(&oldset);
-        return intr ? NULL : do_get_request(fc);
+        if (intr) {
+                atomic_dec(&fc->num_waiting);
+                return NULL;
+        }
+        return do_get_request(fc);
 }
 
 static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         spin_lock(&fuse_lock);
-        if (req->preallocated)
+        if (req->preallocated) {
+                atomic_dec(&fc->num_waiting);
                 list_add(&req->list, &fc->unused_list);
-        else
+        } else
                 fuse_request_free(req);
 
         /* If we are in debt decrease that first */
@@ -151,19 +157,20 @@ void fuse_release_background(struct fuse_req *req)
 /*
  * This function is called when a request is finished.  Either a reply
  * has arrived or it was interrupted (and not yet sent) or some error
- * occurred during communication with userspace, or the device file was
- * closed.  It decreases the reference count for the request.  In case
- * of a background request the reference to the stored objects are
- * released.  The requester thread is woken up (if still waiting), and
- * finally the request is either freed or put on the unused_list
+ * occurred during communication with userspace, or the device file
+ * was closed.  In case of a background request the reference to the
+ * stored objects are released.  The requester thread is woken up (if
+ * still waiting), the 'end' callback is called if given, else the
+ * reference to the request is released
  *
  * Called with fuse_lock, unlocks it
  */
 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        int putback;
-        req->finished = 1;
-        putback = atomic_dec_and_test(&req->count);
+        void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+        req->end = NULL;
+        list_del(&req->list);
+        req->state = FUSE_REQ_FINISHED;
         spin_unlock(&fuse_lock);
         if (req->background) {
                 down_read(&fc->sbput_sem);
@@ -172,28 +179,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
                 up_read(&fc->sbput_sem);
         }
         wake_up(&req->waitq);
-        if (req->in.h.opcode == FUSE_INIT) {
-                int i;
-
-                if (req->misc.init_in_out.major != FUSE_KERNEL_VERSION)
-                        fc->conn_error = 1;
-
-                /* After INIT reply is received other requests can go
-                   out.  So do (FUSE_MAX_OUTSTANDING - 1) number of
-                   up()s on outstanding_sem.  The last up() is done in
-                   fuse_putback_request() */
-                for (i = 1; i < FUSE_MAX_OUTSTANDING; i++)
-                        up(&fc->outstanding_sem);
-        } else if (req->in.h.opcode == FUSE_RELEASE && req->inode == NULL) {
-                /* Special case for failed iget in CREATE */
-                u64 nodeid = req->in.h.nodeid;
-                __fuse_get_request(req);
-                fuse_reset_request(req);
-                fuse_send_forget(fc, req, nodeid, 1);
-                putback = 0;
-        }
-        if (putback)
-                fuse_putback_request(fc, req);
+        if (end)
+                end(fc, req);
+        else
+                fuse_put_request(fc, req);
 }
 
 /*
@@ -244,14 +233,16 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 
         spin_unlock(&fuse_lock);
         block_sigs(&oldset);
-        wait_event_interruptible(req->waitq, req->finished);
+        wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
         restore_sigs(&oldset);
         spin_lock(&fuse_lock);
-        if (req->finished)
+        if (req->state == FUSE_REQ_FINISHED && !req->interrupted)
                 return;
 
-        req->out.h.error = -EINTR;
-        req->interrupted = 1;
+        if (!req->interrupted) {
+                req->out.h.error = -EINTR;
+                req->interrupted = 1;
+        }
         if (req->locked) {
                 /* This is uninterruptible sleep, because data is
                    being copied to/from the buffers of req.  During
@@ -262,10 +253,10 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
                 wait_event(req->waitq, !req->locked);
                 spin_lock(&fuse_lock);
         }
-        if (!req->sent && !list_empty(&req->list)) {
+        if (req->state == FUSE_REQ_PENDING) {
                 list_del(&req->list);
                 __fuse_put_request(req);
-        } else if (!req->finished && req->sent)
+        } else if (req->state == FUSE_REQ_SENT)
                 background_request(fc, req);
 }
 
@@ -300,6 +291,7 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
                         fc->outstanding_debt++;
         }
         list_add_tail(&req->list, &fc->pending);
+        req->state = FUSE_REQ_PENDING;
         wake_up(&fc->waitq);
 }
 
@@ -352,30 +344,12 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req)
         request_send_nowait(fc, req);
 }
 
-void fuse_send_init(struct fuse_conn *fc)
-{
-        /* This is called from fuse_read_super() so there's guaranteed
-           to be a request available */
-        struct fuse_req *req = do_get_request(fc);
-        struct fuse_init_in_out *arg = &req->misc.init_in_out;
-        arg->major = FUSE_KERNEL_VERSION;
-        arg->minor = FUSE_KERNEL_MINOR_VERSION;
-        req->in.h.opcode = FUSE_INIT;
-        req->in.numargs = 1;
-        req->in.args[0].size = sizeof(*arg);
-        req->in.args[0].value = arg;
-        req->out.numargs = 1;
-        req->out.args[0].size = sizeof(*arg);
-        req->out.args[0].value = arg;
-        request_send_background(fc, req);
-}
-
 /*
  * Lock the request.  Up to the next unlock_request() there mustn't be
  * anything that could cause a page-fault.  If the request was already
  * interrupted bail out.
  */
-static inline int lock_request(struct fuse_req *req)
+static int lock_request(struct fuse_req *req)
 {
         int err = 0;
         if (req) {
@@ -394,7 +368,7 @@ static inline int lock_request(struct fuse_req *req)
  * requester thread is currently waiting for it to be unlocked, so
  * wake it up.
  */
-static inline void unlock_request(struct fuse_req *req)
+static void unlock_request(struct fuse_req *req)
 {
         if (req) {
                 spin_lock(&fuse_lock);
@@ -430,7 +404,7 @@ static void fuse_copy_init(struct fuse_copy_state *cs, int write,
 }
 
 /* Unmap and put previous page of userspace buffer */
-static inline void fuse_copy_finish(struct fuse_copy_state *cs)
+static void fuse_copy_finish(struct fuse_copy_state *cs)
 {
         if (cs->mapaddr) {
                 kunmap_atomic(cs->mapaddr, KM_USER0);
@@ -479,8 +453,7 @@ static int fuse_copy_fill(struct fuse_copy_state *cs)
 }
 
 /* Do as much copy to/from userspace buffer as we can */
-static inline int fuse_copy_do(struct fuse_copy_state *cs, void **val,
-                               unsigned *size)
+static int fuse_copy_do(struct fuse_copy_state *cs, void **val, unsigned *size)
 {
         unsigned ncpy = min(*size, cs->len);
         if (val) {
@@ -500,8 +473,8 @@ static inline int fuse_copy_do(struct fuse_copy_state *cs, void **val,
  * Copy a page in the request to/from the userspace buffer.  Must be
  * done atomically
  */
-static inline int fuse_copy_page(struct fuse_copy_state *cs, struct page *page,
-                                 unsigned offset, unsigned count, int zeroing)
+static int fuse_copy_page(struct fuse_copy_state *cs, struct page *page,
+                          unsigned offset, unsigned count, int zeroing)
 {
         if (page && zeroing && count < PAGE_SIZE) {
                 void *mapaddr = kmap_atomic(page, KM_USER1);
@@ -583,7 +556,7 @@ static void request_wait(struct fuse_conn *fc)
         DECLARE_WAITQUEUE(wait, current);
 
         add_wait_queue_exclusive(&fc->waitq, &wait);
-        while (fc->mounted && list_empty(&fc->pending)) {
+        while (fc->connected && list_empty(&fc->pending)) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (signal_pending(current))
                         break;
@@ -615,6 +588,7 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
         struct fuse_copy_state cs;
         unsigned reqsize;
 
+ restart:
         spin_lock(&fuse_lock);
         fc = file->private_data;
         err = -EPERM;
@@ -622,28 +596,34 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
                 goto err_unlock;
         request_wait(fc);
         err = -ENODEV;
-        if (!fc->mounted)
+        if (!fc->connected)
                 goto err_unlock;
         err = -ERESTARTSYS;
         if (list_empty(&fc->pending))
                 goto err_unlock;
 
         req = list_entry(fc->pending.next, struct fuse_req, list);
-        list_del_init(&req->list);
-        spin_unlock(&fuse_lock);
+        req->state = FUSE_REQ_READING;
+        list_move(&req->list, &fc->io);
 
         in = &req->in;
-        reqsize = req->in.h.len;
-        fuse_copy_init(&cs, 1, req, iov, nr_segs);
-        err = -EINVAL;
-        if (iov_length(iov, nr_segs) >= reqsize) {
-                err = fuse_copy_one(&cs, &in->h, sizeof(in->h));
-                if (!err)
-                        err = fuse_copy_args(&cs, in->numargs, in->argpages,
-                                             (struct fuse_arg *) in->args, 0);
+        reqsize = in->h.len;
+        /* If request is too large, reply with an error and restart the read */
+        if (iov_length(iov, nr_segs) < reqsize) {
+                req->out.h.error = -EIO;
+                /* SETXATTR is special, since it may contain too large data */
+                if (in->h.opcode == FUSE_SETXATTR)
+                        req->out.h.error = -E2BIG;
+                request_end(fc, req);
+                goto restart;
         }
+        spin_unlock(&fuse_lock);
+        fuse_copy_init(&cs, 1, req, iov, nr_segs);
+        err = fuse_copy_one(&cs, &in->h, sizeof(in->h));
+        if (!err)
+                err = fuse_copy_args(&cs, in->numargs, in->argpages,
+                                     (struct fuse_arg *) in->args, 0);
         fuse_copy_finish(&cs);
-
         spin_lock(&fuse_lock);
         req->locked = 0;
         if (!err && req->interrupted)
@@ -657,8 +637,8 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
         if (!req->isreply)
                 request_end(fc, req);
         else {
-                req->sent = 1;
-                list_add_tail(&req->list, &fc->processing);
+                req->state = FUSE_REQ_SENT;
+                list_move_tail(&req->list, &fc->processing);
                 spin_unlock(&fuse_lock);
         }
         return reqsize;
@@ -746,17 +726,23 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
                 goto err_finish;
 
         spin_lock(&fuse_lock);
+        err = -ENOENT;
+        if (!fc->connected)
+                goto err_unlock;
+
         req = request_find(fc, oh.unique);
         err = -EINVAL;
         if (!req)
                 goto err_unlock;
 
-        list_del_init(&req->list);
         if (req->interrupted) {
-                request_end(fc, req);
+                spin_unlock(&fuse_lock);
                 fuse_copy_finish(&cs);
+                spin_lock(&fuse_lock);
+                request_end(fc, req);
                 return -ENOENT;
         }
+        list_move(&req->list, &fc->io);
         req->out.h = oh;
         req->locked = 1;
         cs.req = req;
@@ -810,19 +796,90 @@ static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
         return mask;
 }
 
-/* Abort all requests on the given list (pending or processing) */
+/*
+ * Abort all requests on the given list (pending or processing)
+ *
+ * This function releases and reacquires fuse_lock
+ */
 static void end_requests(struct fuse_conn *fc, struct list_head *head)
 {
         while (!list_empty(head)) {
                 struct fuse_req *req;
                 req = list_entry(head->next, struct fuse_req, list);
-                list_del_init(&req->list);
                 req->out.h.error = -ECONNABORTED;
                 request_end(fc, req);
                 spin_lock(&fuse_lock);
         }
 }
 
+/*
+ * Abort requests under I/O
+ *
+ * The requests are set to interrupted and finished, and the request
+ * waiter is woken up.  This will make request_wait_answer() wait
+ * until the request is unlocked and then return.
+ *
+ * If the request is asynchronous, then the end function needs to be
+ * called after waiting for the request to be unlocked (if it was
+ * locked).
+ */
+static void end_io_requests(struct fuse_conn *fc)
+{
+        while (!list_empty(&fc->io)) {
+                struct fuse_req *req =
+                        list_entry(fc->io.next, struct fuse_req, list);
+                void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
+
+                req->interrupted = 1;
+                req->out.h.error = -ECONNABORTED;
+                req->state = FUSE_REQ_FINISHED;
+                list_del_init(&req->list);
+                wake_up(&req->waitq);
+                if (end) {
+                        req->end = NULL;
+                        /* The end function will consume this reference */
+                        __fuse_get_request(req);
+                        spin_unlock(&fuse_lock);
+                        wait_event(req->waitq, !req->locked);
+                        end(fc, req);
+                        spin_lock(&fuse_lock);
+                }
+        }
+}
+
+/*
+ * Abort all requests.
+ *
+ * Emergency exit in case of a malicious or accidental deadlock, or
+ * just a hung filesystem.
+ *
+ * The same effect is usually achievable through killing the
+ * filesystem daemon and all users of the filesystem.  The exception
+ * is the combination of an asynchronous request and the tricky
+ * deadlock (see Documentation/filesystems/fuse.txt).
+ *
+ * During the aborting, progression of requests from the pending and
+ * processing lists onto the io list, and progression of new requests
+ * onto the pending list is prevented by req->connected being false.
+ *
+ * Progression of requests under I/O to the processing list is
+ * prevented by the req->interrupted flag being true for these
+ * requests.  For this reason requests on the io list must be aborted
+ * first.
+ */
+void fuse_abort_conn(struct fuse_conn *fc)
+{
+        spin_lock(&fuse_lock);
+        if (fc->connected) {
+                fc->connected = 0;
+                end_io_requests(fc);
+                end_requests(fc, &fc->pending);
+                end_requests(fc, &fc->processing);
+                wake_up_all(&fc->waitq);
+        }
+        spin_unlock(&fuse_lock);
+}
+
 static int fuse_dev_release(struct inode *inode, struct file *file)
 {
         struct fuse_conn *fc;
@@ -833,9 +890,11 @@ static int fuse_dev_release(struct inode *inode, struct file *file)
                 fc->connected = 0;
                 end_requests(fc, &fc->pending);
                 end_requests(fc, &fc->processing);
-                fuse_release_conn(fc);
         }
         spin_unlock(&fuse_lock);
+        if (fc)
+                kobject_put(&fc->kobj);
+
         return 0;
 }
 
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index c045cc70c749..21fd59c7bc24 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -13,15 +13,66 @@
 #include <linux/gfp.h>
 #include <linux/sched.h>
 #include <linux/namei.h>
-#include <linux/mount.h>
 
-static inline unsigned long time_to_jiffies(unsigned long sec,
-                                            unsigned long nsec)
+/*
+ * FUSE caches dentries and attributes with separate timeout.  The
+ * time in jiffies until the dentry/attributes are valid is stored in
+ * dentry->d_time and fuse_inode->i_time respectively.
+ */
+
+/*
+ * Calculate the time in jiffies until a dentry/attributes are valid
+ */
+static unsigned long time_to_jiffies(unsigned long sec, unsigned long nsec)
 {
         struct timespec ts = {sec, nsec};
         return jiffies + timespec_to_jiffies(&ts);
 }
 
+/*
+ * Set dentry and possibly attribute timeouts from the lookup/mk*
+ * replies
+ */
+static void fuse_change_timeout(struct dentry *entry, struct fuse_entry_out *o)
+{
+        entry->d_time = time_to_jiffies(o->entry_valid, o->entry_valid_nsec);
+        if (entry->d_inode)
+                get_fuse_inode(entry->d_inode)->i_time =
+                        time_to_jiffies(o->attr_valid, o->attr_valid_nsec);
+}
+
+/*
+ * Mark the attributes as stale, so that at the next call to
+ * ->getattr() they will be fetched from userspace
+ */
+void fuse_invalidate_attr(struct inode *inode)
+{
+        get_fuse_inode(inode)->i_time = jiffies - 1;
+}
+
+/*
+ * Just mark the entry as stale, so that a next attempt to look it up
+ * will result in a new lookup call to userspace
+ *
+ * This is called when a dentry is about to become negative and the
+ * timeout is unknown (unlink, rmdir, rename and in some cases
+ * lookup)
+ */
+static void fuse_invalidate_entry_cache(struct dentry *entry)
+{
+        entry->d_time = jiffies - 1;
+}
+
+/*
+ * Same as fuse_invalidate_entry_cache(), but also try to remove the
+ * dentry from the hash
+ */
+static void fuse_invalidate_entry(struct dentry *entry)
+{
+        d_invalidate(entry);
+        fuse_invalidate_entry_cache(entry);
+}
+
 static void fuse_lookup_init(struct fuse_req *req, struct inode *dir,
                              struct dentry *entry,
                              struct fuse_entry_out *outarg)
@@ -37,17 +88,34 @@ static void fuse_lookup_init(struct fuse_req *req, struct inode *dir,
         req->out.args[0].value = outarg;
 }
 
+/*
+ * Check whether the dentry is still valid
+ *
+ * If the entry validity timeout has expired and the dentry is
+ * positive, try to redo the lookup.  If the lookup results in a
+ * different inode, then let the VFS invalidate the dentry and redo
+ * the lookup once more.  If the lookup results in the same inode,
+ * then refresh the attributes, timeouts and mark the dentry valid.
+ */
 static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
 {
-        if (!entry->d_inode || is_bad_inode(entry->d_inode))
+        struct inode *inode = entry->d_inode;
+
+        if (inode && is_bad_inode(inode))
                 return 0;
         else if (time_after(jiffies, entry->d_time)) {
                 int err;
                 struct fuse_entry_out outarg;
-                struct inode *inode = entry->d_inode;
-                struct fuse_inode *fi = get_fuse_inode(inode);
-                struct fuse_conn *fc = get_fuse_conn(inode);
-                struct fuse_req *req = fuse_get_request(fc);
+                struct fuse_conn *fc;
+                struct fuse_req *req;
+
+                /* Doesn't hurt to "reset" the validity timeout */
+                fuse_invalidate_entry_cache(entry);
+                if (!inode)
+                        return 0;
+
+                fc = get_fuse_conn(inode);
+                req = fuse_get_request(fc);
                 if (!req)
                         return 0;
 
@@ -55,6 +123,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 request_send(fc, req);
                 err = req->out.h.error;
                 if (!err) {
+                        struct fuse_inode *fi = get_fuse_inode(inode);
                         if (outarg.nodeid != get_node_id(inode)) {
                                 fuse_send_forget(fc, req, outarg.nodeid, 1);
                                 return 0;
@@ -66,20 +135,44 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                         return 0;
 
                 fuse_change_attributes(inode, &outarg.attr);
-                entry->d_time = time_to_jiffies(outarg.entry_valid,
-                                                outarg.entry_valid_nsec);
-                fi->i_time = time_to_jiffies(outarg.attr_valid,
-                                             outarg.attr_valid_nsec);
+                fuse_change_timeout(entry, &outarg);
         }
         return 1;
 }
 
+/*
+ * Check if there's already a hashed alias of this directory inode.
+ * If yes, then lookup and mkdir must not create a new alias.
+ */
+static int dir_alias(struct inode *inode)
+{
+        if (S_ISDIR(inode->i_mode)) {
+                struct dentry *alias = d_find_alias(inode);
+                if (alias) {
+                        dput(alias);
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+static int invalid_nodeid(u64 nodeid)
+{
+        return !nodeid || nodeid == FUSE_ROOT_ID;
+}
+
 static struct dentry_operations fuse_dentry_operations = {
         .d_revalidate   = fuse_dentry_revalidate,
 };
 
-static int fuse_lookup_iget(struct inode *dir, struct dentry *entry,
-                            struct inode **inodep)
+static int valid_mode(int m)
+{
+        return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
+                S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
+}
+
+static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
+                                  struct nameidata *nd)
 {
         int err;
         struct fuse_entry_out outarg;
@@ -88,53 +181,49 @@ static int fuse_lookup_iget(struct inode *dir, struct dentry *entry,
         struct fuse_req *req;
 
         if (entry->d_name.len > FUSE_NAME_MAX)
-                return -ENAMETOOLONG;
+                return ERR_PTR(-ENAMETOOLONG);
 
         req = fuse_get_request(fc);
         if (!req)
-                return -EINTR;
+                return ERR_PTR(-EINTR);
 
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
         err = req->out.h.error;
-        if (!err && (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID))
+        if (!err && ((outarg.nodeid && invalid_nodeid(outarg.nodeid)) ||
+                     !valid_mode(outarg.attr.mode)))
                 err = -EIO;
-        if (!err) {
+        if (!err && outarg.nodeid) {
                 inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                                   &outarg.attr);
                 if (!inode) {
                         fuse_send_forget(fc, req, outarg.nodeid, 1);
-                        return -ENOMEM;
+                        return ERR_PTR(-ENOMEM);
                 }
         }
         fuse_put_request(fc, req);
         if (err && err != -ENOENT)
-                return err;
+                return ERR_PTR(err);
 
-        if (inode) {
-                struct fuse_inode *fi = get_fuse_inode(inode);
-                entry->d_time = time_to_jiffies(outarg.entry_valid,
-                                                outarg.entry_valid_nsec);
-                fi->i_time = time_to_jiffies(outarg.attr_valid,
-                                             outarg.attr_valid_nsec);
+        if (inode && dir_alias(inode)) {
+                iput(inode);
+                return ERR_PTR(-EIO);
         }
-
+        d_add(entry, inode);
         entry->d_op = &fuse_dentry_operations;
-        *inodep = inode;
-        return 0;
-}
-
-void fuse_invalidate_attr(struct inode *inode)
-{
-        get_fuse_inode(inode)->i_time = jiffies - 1;
-}
-
-static void fuse_invalidate_entry(struct dentry *entry)
-{
-        d_invalidate(entry);
-        entry->d_time = jiffies - 1;
+        if (!err)
+                fuse_change_timeout(entry, &outarg);
+        else
+                fuse_invalidate_entry_cache(entry);
+        return NULL;
 }
 
+/*
+ * Atomic create+open operation
+ *
+ * If the filesystem doesn't support this, then fall back to separate
+ * 'mknod' + 'open' requests.
+ */
 static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
                             struct nameidata *nd)
 {
@@ -145,7 +234,6 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         struct fuse_open_in inarg;
         struct fuse_open_out outopen;
         struct fuse_entry_out outentry;
-        struct fuse_inode *fi;
         struct fuse_file *ff;
         struct file *file;
         int flags = nd->intent.open.flags - 1;
@@ -154,10 +242,6 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (fc->no_create)
                 goto out;
 
-        err = -ENAMETOOLONG;
-        if (entry->d_name.len > FUSE_NAME_MAX)
-                goto out;
-
         err = -EINTR;
         req = fuse_get_request(fc);
         if (!req)
@@ -193,7 +277,7 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         }
 
         err = -EIO;
-        if (!S_ISREG(outentry.attr.mode))
+        if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid))
                 goto out_free_ff;
 
         inode = fuse_iget(dir->i_sb, outentry.nodeid, outentry.generation,
@@ -202,17 +286,15 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         if (!inode) {
                 flags &= ~(O_CREAT | O_EXCL | O_TRUNC);
                 ff->fh = outopen.fh;
+                /* Special release, with inode = NULL, this will
+                   trigger a 'forget' request when the release is
+                   complete */
                 fuse_send_release(fc, ff, outentry.nodeid, NULL, flags, 0);
                 goto out_put_request;
         }
         fuse_put_request(fc, req);
-        entry->d_time = time_to_jiffies(outentry.entry_valid,
-                                        outentry.entry_valid_nsec);
-        fi = get_fuse_inode(inode);
-        fi->i_time = time_to_jiffies(outentry.attr_valid,
-                                     outentry.attr_valid_nsec);
-
         d_instantiate(entry, inode);
+        fuse_change_timeout(entry, &outentry);
         file = lookup_instantiate_filp(nd, entry, generic_file_open);
         if (IS_ERR(file)) {
                 ff->fh = outopen.fh;
@@ -230,13 +312,15 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         return err;
 }
 
+/*
+ * Code shared between mknod, mkdir, symlink and link
+ */
 static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
                             struct inode *dir, struct dentry *entry,
                             int mode)
 {
         struct fuse_entry_out outarg;
         struct inode *inode;
-        struct fuse_inode *fi;
         int err;
 
         req->in.h.nodeid = get_node_id(dir);
@@ -250,10 +334,13 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
                 fuse_put_request(fc, req);
                 return err;
         }
-        if (!outarg.nodeid || outarg.nodeid == FUSE_ROOT_ID) {
-                fuse_put_request(fc, req);
-                return -EIO;
-        }
+        err = -EIO;
+        if (invalid_nodeid(outarg.nodeid))
+                goto out_put_request;
+
+        if ((outarg.attr.mode ^ mode) & S_IFMT)
+                goto out_put_request;
+
         inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
                           &outarg.attr);
         if (!inode) {
@@ -262,22 +349,19 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         }
         fuse_put_request(fc, req);
 
-        /* Don't allow userspace to do really stupid things... */
-        if ((inode->i_mode ^ mode) & S_IFMT) {
+        if (dir_alias(inode)) {
                 iput(inode);
                 return -EIO;
         }
 
-        entry->d_time = time_to_jiffies(outarg.entry_valid,
-                                        outarg.entry_valid_nsec);
-
-        fi = get_fuse_inode(inode);
-        fi->i_time = time_to_jiffies(outarg.attr_valid,
-                                     outarg.attr_valid_nsec);
-
         d_instantiate(entry, inode);
+        fuse_change_timeout(entry, &outarg);
         fuse_invalidate_attr(dir);
         return 0;
+
+ out_put_request:
+        fuse_put_request(fc, req);
+        return err;
 }
 
 static int fuse_mknod(struct inode *dir, struct dentry *entry, int mode,
@@ -337,12 +421,7 @@ static int fuse_symlink(struct inode *dir, struct dentry *entry,
 {
         struct fuse_conn *fc = get_fuse_conn(dir);
         unsigned len = strlen(link) + 1;
-        struct fuse_req *req;
-
-        if (len > FUSE_SYMLINK_MAX)
-                return -ENAMETOOLONG;
-
-        req = fuse_get_request(fc);
+        struct fuse_req *req = fuse_get_request(fc);
         if (!req)
                 return -EINTR;
 
@@ -381,6 +460,7 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
                 inode->i_nlink = 0;
                 fuse_invalidate_attr(inode);
                 fuse_invalidate_attr(dir);
+                fuse_invalidate_entry_cache(entry);
         } else if (err == -EINTR)
                 fuse_invalidate_entry(entry);
         return err;
@@ -406,6 +486,7 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry)
         if (!err) {
                 entry->d_inode->i_nlink = 0;
                 fuse_invalidate_attr(dir);
+                fuse_invalidate_entry_cache(entry);
         } else if (err == -EINTR)
                 fuse_invalidate_entry(entry);
         return err;
@@ -441,6 +522,10 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
                 fuse_invalidate_attr(olddir);
                 if (olddir != newdir)
                         fuse_invalidate_attr(newdir);
+
+                /* newent will end up negative */
+                if (newent->d_inode)
+                        fuse_invalidate_entry_cache(newent);
         } else if (err == -EINTR) {
                 /* If request was interrupted, DEITY only knows if the
                    rename actually took place.  If the invalidation
@@ -548,6 +633,15 @@ static int fuse_allow_task(struct fuse_conn *fc, struct task_struct *task)
         return 0;
 }
 
+/*
+ * Check whether the inode attributes are still valid
+ *
+ * If the attribute validity timeout has expired, then fetch the fresh
+ * attributes with a 'getattr' request
+ *
+ * I'm not sure why cached attributes are never returned for the root
+ * inode, this is probably being too cautious.
+ */
 static int fuse_revalidate(struct dentry *entry)
 {
         struct inode *inode = entry->d_inode;
@@ -595,6 +689,19 @@ static int fuse_access(struct inode *inode, int mask)
         return err;
 }
 
+/*
+ * Check permission.  The two basic access models of FUSE are:
+ *
+ * 1) Local access checking ('default_permissions' mount option) based
+ * on file mode.  This is the plain old disk filesystem permission
+ * modell.
+ *
+ * 2) "Remote" access checking, where server is responsible for
+ * checking permission in each inode operation.  An exception to this
+ * is if ->permission() was invoked from sys_access() in which case an
+ * access request is sent.  Execute permission is still checked
+ * locally based on file mode.
+ */
 static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
 {
         struct fuse_conn *fc = get_fuse_conn(inode);
@@ -613,14 +720,10 @@ static int fuse_permission(struct inode *inode, int mask, struct nameidata *nd)
                                 err = generic_permission(inode, mask, NULL);
                 }
 
-                /* FIXME: Need some mechanism to revoke permissions:
-                   currently if the filesystem suddenly changes the
-                   file mode, we will not be informed about it, and
-                   continue to allow access to the file/directory.
-
-                   This is actually not so grave, since the user can
-                   simply keep access to the file/directory anyway by
-                   keeping it open... */
+                /* Note: the opposite of the above test does not
+                   exist.  So if permissions are revoked this won't be
+                   noticed immediately, only after the attribute
+                   timeout has expired */
 
                 return err;
         } else {
@@ -659,13 +762,6 @@ static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
         return 0;
 }
 
-static inline size_t fuse_send_readdir(struct fuse_req *req, struct file *file,
-                                       struct inode *inode, loff_t pos,
-                                       size_t count)
-{
-        return fuse_send_read_common(req, file, inode, pos, count, 1);
-}
-
 static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
 {
         int err;
@@ -673,7 +769,12 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         struct page *page;
         struct inode *inode = file->f_dentry->d_inode;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_req *req = fuse_get_request(fc);
+        struct fuse_req *req;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
+        req = fuse_get_request(fc);
         if (!req)
                 return -EINTR;
 
@@ -684,7 +785,9 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         }
         req->num_pages = 1;
         req->pages[0] = page;
-        nbytes = fuse_send_readdir(req, file, inode, file->f_pos, PAGE_SIZE);
+        fuse_read_fill(req, file, inode, file->f_pos, PAGE_SIZE, FUSE_READDIR);
+        request_send(fc, req);
+        nbytes = req->out.args[0].size;
         err = req->out.h.error;
         fuse_put_request(fc, req);
         if (!err)
@@ -788,6 +891,15 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg)
         }
 }
 
+/*
+ * Set attributes, and at the same time refresh them.
+ *
+ * Truncation is slightly complicated, because the 'truncate' request
+ * may fail, in which case we don't want to touch the mapping.
+ * vmtruncate() doesn't allow for this case.  So do the rlimit
+ * checking by hand and call vmtruncate() only after the file has
+ * actually been truncated.
+ */
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)
 {
         struct inode *inode = entry->d_inode;
@@ -865,28 +977,6 @@ static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
         return err;
 }
 
-static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
-                                  struct nameidata *nd)
-{
-        struct inode *inode;
-        int err;
-
-        err = fuse_lookup_iget(dir, entry, &inode);
-        if (err)
-                return ERR_PTR(err);
-        if (inode && S_ISDIR(inode->i_mode)) {
-                /* Don't allow creating an alias to a directory  */
-                struct dentry *alias = d_find_alias(inode);
-                if (alias) {
-                        dput(alias);
-                        iput(inode);
-                        return ERR_PTR(-EIO);
-                }
-        }
-        d_add(entry, inode);
-        return NULL;
-}
-
 static int fuse_setxattr(struct dentry *entry, const char *name,
                          const void *value, size_t size, int flags)
 {
@@ -896,9 +986,6 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
         struct fuse_setxattr_in inarg;
         int err;
 
-        if (size > FUSE_XATTR_SIZE_MAX)
-                return -E2BIG;
-
         if (fc->no_setxattr)
                 return -EOPNOTSUPP;
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 2ca86141d13a..a7ef5e716f3c 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -113,6 +113,14 @@ int fuse_open_common(struct inode *inode, struct file *file, int isdir)
         return err;
 }
 
+/* Special case for failed iget in CREATE */
+static void fuse_release_end(struct fuse_conn *fc, struct fuse_req *req)
+{
+        u64 nodeid = req->in.h.nodeid;
+        fuse_reset_request(req);
+        fuse_send_forget(fc, req, nodeid, 1);
+}
+
 void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
                        u64 nodeid, struct inode *inode, int flags, int isdir)
 {
@@ -128,6 +136,8 @@ void fuse_send_release(struct fuse_conn *fc, struct fuse_file *ff,
         req->in.args[0].size = sizeof(struct fuse_release_in);
         req->in.args[0].value = inarg;
         request_send_background(fc, req);
+        if (!inode)
+                req->end = fuse_release_end;
         kfree(ff);
 }
 
@@ -163,6 +173,9 @@ static int fuse_flush(struct file *file)
         struct fuse_flush_in inarg;
         int err;
 
+        if (is_bad_inode(inode))
+                return -EIO;
+
         if (fc->no_flush)
                 return 0;
 
@@ -199,6 +212,9 @@ int fuse_fsync_common(struct file *file, struct dentry *de, int datasync,
         struct fuse_fsync_in inarg;
         int err;
 
+        if (is_bad_inode(inode))
+                return -EIO;
+
         if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
                 return 0;
 
@@ -234,54 +250,57 @@ static int fuse_fsync(struct file *file, struct dentry *de, int datasync)
         return fuse_fsync_common(file, de, datasync, 0);
 }
 
-size_t fuse_send_read_common(struct fuse_req *req, struct file *file,
-                             struct inode *inode, loff_t pos, size_t count,
-                             int isdir)
+void fuse_read_fill(struct fuse_req *req, struct file *file,
+                    struct inode *inode, loff_t pos, size_t count, int opcode)
 {
-        struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_file *ff = file->private_data;
-        struct fuse_read_in inarg;
+        struct fuse_read_in *inarg = &req->misc.read_in;
 
-        memset(&inarg, 0, sizeof(struct fuse_read_in));
-        inarg.fh = ff->fh;
-        inarg.offset = pos;
-        inarg.size = count;
-        req->in.h.opcode = isdir ? FUSE_READDIR : FUSE_READ;
+        inarg->fh = ff->fh;
+        inarg->offset = pos;
+        inarg->size = count;
+        req->in.h.opcode = opcode;
         req->in.h.nodeid = get_node_id(inode);
         req->inode = inode;
         req->file = file;
         req->in.numargs = 1;
         req->in.args[0].size = sizeof(struct fuse_read_in);
-        req->in.args[0].value = &inarg;
+        req->in.args[0].value = inarg;
         req->out.argpages = 1;
         req->out.argvar = 1;
         req->out.numargs = 1;
         req->out.args[0].size = count;
-        request_send(fc, req);
-        return req->out.args[0].size;
 }
 
-static inline size_t fuse_send_read(struct fuse_req *req, struct file *file,
-                                    struct inode *inode, loff_t pos,
-                                    size_t count)
+static size_t fuse_send_read(struct fuse_req *req, struct file *file,
+                             struct inode *inode, loff_t pos, size_t count)
 {
-        return fuse_send_read_common(req, file, inode, pos, count, 0);
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
+        request_send(fc, req);
+        return req->out.args[0].size;
 }
 
 static int fuse_readpage(struct file *file, struct page *page)
 {
         struct inode *inode = page->mapping->host;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        loff_t pos = (loff_t) page->index << PAGE_CACHE_SHIFT;
-        struct fuse_req *req = fuse_get_request(fc);
-        int err = -EINTR;
+        struct fuse_req *req;
+        int err;
+
+        err = -EIO;
+        if (is_bad_inode(inode))
+                goto out;
+
+        err = -EINTR;
+        req = fuse_get_request(fc);
         if (!req)
                 goto out;
 
         req->out.page_zeroing = 1;
         req->num_pages = 1;
         req->pages[0] = page;
-        fuse_send_read(req, file, inode, pos, PAGE_CACHE_SIZE);
+        fuse_send_read(req, file, inode, page_offset(page), PAGE_CACHE_SIZE);
         err = req->out.h.error;
         fuse_put_request(fc, req);
         if (!err)
@@ -292,21 +311,33 @@ static int fuse_readpage(struct file *file, struct page *page)
         return err;
 }
 
-static int fuse_send_readpages(struct fuse_req *req, struct file *file,
-                               struct inode *inode)
+static void fuse_readpages_end(struct fuse_conn *fc, struct fuse_req *req)
 {
-        loff_t pos = (loff_t) req->pages[0]->index << PAGE_CACHE_SHIFT;
-        size_t count = req->num_pages << PAGE_CACHE_SHIFT;
-        unsigned i;
-        req->out.page_zeroing = 1;
-        fuse_send_read(req, file, inode, pos, count);
+        int i;
+
+        fuse_invalidate_attr(req->pages[0]->mapping->host); /* atime changed */
+
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
                 if (!req->out.h.error)
                         SetPageUptodate(page);
+                else
+                        SetPageError(page);
                 unlock_page(page);
         }
-        return req->out.h.error;
+        fuse_put_request(fc, req);
+}
+
+static void fuse_send_readpages(struct fuse_req *req, struct file *file,
+                                struct inode *inode)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        loff_t pos = page_offset(req->pages[0]);
+        size_t count = req->num_pages << PAGE_CACHE_SHIFT;
+        req->out.page_zeroing = 1;
+        req->end = fuse_readpages_end;
+        fuse_read_fill(req, file, inode, pos, count, FUSE_READ);
+        request_send_background(fc, req);
 }
 
 struct fuse_readpages_data {
@@ -326,12 +357,12 @@ static int fuse_readpages_fill(void *_data, struct page *page)
             (req->num_pages == FUSE_MAX_PAGES_PER_REQ ||
              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
-                int err = fuse_send_readpages(req, data->file, inode);
-                if (err) {
+                fuse_send_readpages(req, data->file, inode);
+                data->req = req = fuse_get_request(fc);
+                if (!req) {
                         unlock_page(page);
-                        return err;
+                        return -EINTR;
                 }
-                fuse_reset_request(req);
         }
         req->pages[req->num_pages] = page;
         req->num_pages ++;
@@ -345,6 +376,10 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
         struct fuse_conn *fc = get_fuse_conn(inode);
         struct fuse_readpages_data data;
         int err;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_request(fc);
@@ -352,10 +387,8 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 return -EINTR;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
-        if (!err && data.req->num_pages)
-                err = fuse_send_readpages(data.req, file, inode);
-        fuse_put_request(fc, data.req);
-        fuse_invalidate_attr(inode); /* atime changed */
+        if (!err)
+                fuse_send_readpages(data.req, file, inode);
         return err;
 }
 
@@ -402,8 +435,13 @@ static int fuse_commit_write(struct file *file, struct page *page,
         unsigned count = to - offset;
         struct inode *inode = page->mapping->host;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        loff_t pos = ((loff_t) page->index << PAGE_CACHE_SHIFT) + offset;
-        struct fuse_req *req = fuse_get_request(fc);
+        loff_t pos = page_offset(page) + offset;
+        struct fuse_req *req;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
+        req = fuse_get_request(fc);
         if (!req)
                 return -EINTR;
 
@@ -454,7 +492,7 @@ static int fuse_get_user_pages(struct fuse_req *req, const char __user *buf,
 
         nbytes = min(nbytes, (unsigned) FUSE_MAX_PAGES_PER_REQ << PAGE_SHIFT);
         npages = (nbytes + offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        npages = min(npages, FUSE_MAX_PAGES_PER_REQ);
+        npages = min(max(npages, 1), FUSE_MAX_PAGES_PER_REQ);
         down_read(&current->mm->mmap_sem);
         npages = get_user_pages(current, current->mm, user_addr, npages, write,
                                 0, req->pages, NULL);
@@ -475,12 +513,16 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
         size_t nmax = write ? fc->max_write : fc->max_read;
         loff_t pos = *ppos;
         ssize_t res = 0;
-        struct fuse_req *req = fuse_get_request(fc);
+        struct fuse_req *req;
+
+        if (is_bad_inode(inode))
+                return -EIO;
+
+        req = fuse_get_request(fc);
         if (!req)
                 return -EINTR;
 
         while (count) {
-                size_t tmp;
                 size_t nres;
                 size_t nbytes = min(count, nmax);
                 int err = fuse_get_user_pages(req, buf, nbytes, !write);
@@ -488,8 +530,8 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                         res = err;
                         break;
                 }
-                tmp = (req->num_pages << PAGE_SHIFT) - req->page_offset;
-                nbytes = min(nbytes, tmp);
+                nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
+                nbytes = min(count, nbytes);
                 if (write)
                         nres = fuse_send_write(req, file, inode, pos, nbytes);
                 else
@@ -535,9 +577,9 @@ static ssize_t fuse_direct_write(struct file *file, const char __user *buf,
         struct inode *inode = file->f_dentry->d_inode;
         ssize_t res;
         /* Don't allow parallel writes to the same file */
-        down(&inode->i_sem);
+        mutex_lock(&inode->i_mutex);
         res = fuse_direct_io(file, buf, count, ppos, 1);
-        up(&inode->i_sem);
+        mutex_unlock(&inode->i_mutex);
         return res;
 }
 
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 0ea5301f86be..46cf933aa3bf 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -21,6 +21,9 @@
 /** If more requests are outstanding, then the operation will block */
 #define FUSE_MAX_OUTSTANDING 10
 
+/** It could be as large as PATH_MAX, but would that have any uses? */
+#define FUSE_NAME_MAX 1024
+
 /** If the FUSE_DEFAULT_PERMISSIONS flag is given, the filesystem
     module will check permissions based on the file mode.  Otherwise no
     permission checking is done in the kernel */
@@ -91,6 +94,11 @@ struct fuse_out {
         /** Header returned from userspace */
         struct fuse_out_header h;
 
+        /*
+         * The following bitfields are not changed during the request
+         * processing
+         */
+
         /** Last argument is variable length (can be shorter than
             arg->size) */
         unsigned argvar:1;
@@ -108,15 +116,23 @@ struct fuse_out {
         struct fuse_arg args[3];
 };
 
-struct fuse_req;
+/** The request state */
+enum fuse_req_state {
+        FUSE_REQ_INIT = 0,
+        FUSE_REQ_PENDING,
+        FUSE_REQ_READING,
+        FUSE_REQ_SENT,
+        FUSE_REQ_FINISHED
+};
+
 struct fuse_conn;
 
 /**
  * A request to the client
  */
 struct fuse_req {
-        /** This can be on either unused_list, pending or processing
-            lists in fuse_conn */
+        /** This can be on either unused_list, pending processing or
+            io lists in fuse_conn */
         struct list_head list;
 
         /** Entry on the background list */
@@ -125,6 +141,12 @@ struct fuse_req {
         /** refcount */
         atomic_t count;
 
+        /*
+         * The following bitfields are either set once before the
+         * request is queued or setting/clearing them is protected by
+         * fuse_lock
+         */
+
         /** True if the request has reply */
         unsigned isreply:1;
 
@@ -140,11 +162,8 @@ struct fuse_req {
         /** Data is being copied to/from the request */
         unsigned locked:1;
 
-        /** Request has been sent to userspace */
-        unsigned sent:1;
-
-        /** The request is finished */
-        unsigned finished:1;
+        /** State of the request */
+        enum fuse_req_state state;
 
         /** The request input */
         struct fuse_in in;
@@ -159,7 +178,9 @@ struct fuse_req {
         union {
                 struct fuse_forget_in forget_in;
                 struct fuse_release_in release_in;
-                struct fuse_init_in_out init_in_out;
+                struct fuse_init_in init_in;
+                struct fuse_init_out init_out;
+                struct fuse_read_in read_in;
         } misc;
 
         /** page vector */
@@ -179,6 +200,9 @@ struct fuse_req {
 
         /** File used in the request (or NULL) */
         struct file *file;
+
+        /** Request completion callback */
+        void (*end)(struct fuse_conn *, struct fuse_req *);
 };
 
 /**
@@ -189,9 +213,6 @@ struct fuse_req {
  * unmounted.
  */
 struct fuse_conn {
-        /** Reference count */
-        int count;
-
         /** The user id for this mount */
         uid_t user_id;
 
@@ -216,6 +237,9 @@ struct fuse_conn {
         /** The list of requests being processed */
         struct list_head processing;
 
+        /** The list of requests under I/O */
+        struct list_head io;
+
         /** Requests put in the background (RELEASE or any other
             interrupted request) */
         struct list_head background;
@@ -237,14 +261,22 @@ struct fuse_conn {
         u64 reqctr;
 
         /** Mount is active */
-        unsigned mounted : 1;
+        unsigned mounted;
 
-        /** Connection established */
-        unsigned connected : 1;
+        /** Connection established, cleared on umount, connection
+            abort and device release */
+        unsigned connected;
 
-        /** Connection failed (version mismatch) */
+        /** Connection failed (version mismatch).  Cannot race with
+            setting other bitfields since it is only set once in INIT
+            reply, before any other request, and never cleared */
         unsigned conn_error : 1;
 
+        /*
+         * The following bitfields are only for optimization purposes
+         * and hence races in setting them will not cause malfunction
+         */
+
         /** Is fsync not implemented by fs? */
         unsigned no_fsync : 1;
 
@@ -272,18 +304,22 @@ struct fuse_conn {
         /** Is create not implemented by fs? */
         unsigned no_create : 1;
 
+        /** The number of requests waiting for completion */
+        atomic_t num_waiting;
+
+        /** Negotiated minor version */
+        unsigned minor;
+
         /** Backing dev info */
         struct backing_dev_info bdi;
-};
 
-static inline struct fuse_conn **get_fuse_conn_super_p(struct super_block *sb)
-{
-        return (struct fuse_conn **) &sb->s_fs_info;
-}
+        /** kobject */
+        struct kobject kobj;
+};
 
 static inline struct fuse_conn *get_fuse_conn_super(struct super_block *sb)
 {
-        return *get_fuse_conn_super_p(sb);
+        return sb->s_fs_info;
 }
 
 static inline struct fuse_conn *get_fuse_conn(struct inode *inode)
@@ -291,6 +327,11 @@ static inline struct fuse_conn *get_fuse_conn(struct inode *inode)
         return get_fuse_conn_super(inode->i_sb);
 }
 
+static inline struct fuse_conn *get_fuse_conn_kobj(struct kobject *obj)
+{
+        return container_of(obj, struct fuse_conn, kobj);
+}
+
 static inline struct fuse_inode *get_fuse_inode(struct inode *inode)
 {
         return container_of(inode, struct fuse_inode, inode);
@@ -332,11 +373,10 @@ void fuse_send_forget(struct fuse_conn *fc, struct fuse_req *req,
                       unsigned long nodeid, u64 nlookup);
 
 /**
- * Send READ or READDIR request
+ * Initialize READ or READDIR request
  */
-size_t fuse_send_read_common(struct fuse_req *req, struct file *file,
-                             struct inode *inode, loff_t pos, size_t count,
-                             int isdir);
+void fuse_read_fill(struct fuse_req *req, struct file *file,
+                    struct inode *inode, loff_t pos, size_t count, int opcode);
 
 /**
  * Send OPEN or OPENDIR request
@@ -391,12 +431,6 @@ void fuse_init_symlink(struct inode *inode);
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr);
 
 /**
- * Check if the connection can be released, and if yes, then free the
- * connection structure
- */
-void fuse_release_conn(struct fuse_conn *fc);
-
-/**
  * Initialize the client device
  */
 int fuse_dev_init(void);
@@ -452,6 +486,9 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
  */
 void fuse_release_background(struct fuse_req *req);
 
+/* Abort all requests */
+void fuse_abort_conn(struct fuse_conn *fc);
+
 /**
  * Get the attributes of a file
  */
@@ -461,8 +498,3 @@ int fuse_do_getattr(struct inode *inode);
  * Invalidate inode attributes
  */
 void fuse_invalidate_attr(struct inode *inode);
-
-/**
- * Send the INIT message
- */
-void fuse_send_init(struct fuse_conn *fc);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index e69a546844d0..c755a0440a66 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -24,6 +24,13 @@ MODULE_LICENSE("GPL");
 
 spinlock_t fuse_lock;
 static kmem_cache_t *fuse_inode_cachep;
+static struct subsystem connections_subsys;
+
+struct fuse_conn_attr {
+        struct attribute attr;
+        ssize_t (*show)(struct fuse_conn *, char *);
+        ssize_t (*store)(struct fuse_conn *, const char *, size_t);
+};
 
 #define FUSE_SUPER_MAGIC 0x65735546
 
@@ -135,12 +142,8 @@ static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
                 fuse_init_common(inode);
                 init_special_inode(inode, inode->i_mode,
                                    new_decode_dev(attr->rdev));
-        } else {
-                /* Don't let user create weird files */
-                inode->i_mode = S_IFREG;
-                fuse_init_common(inode);
-                fuse_init_file_inode(inode);
-        }
+        } else
+                BUG();
 }
 
 static int fuse_inode_eq(struct inode *inode, void *_nodeidp)
@@ -193,6 +196,11 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
         return inode;
 }
 
+static void fuse_umount_begin(struct super_block *sb)
+{
+        fuse_abort_conn(get_fuse_conn_super(sb));
+}
+
 static void fuse_put_super(struct super_block *sb)
 {
         struct fuse_conn *fc = get_fuse_conn_super(sb);
@@ -204,20 +212,20 @@ static void fuse_put_super(struct super_block *sb)
 
         spin_lock(&fuse_lock);
         fc->mounted = 0;
-        fc->user_id = 0;
-        fc->group_id = 0;
-        fc->flags = 0;
+        fc->connected = 0;
+        spin_unlock(&fuse_lock);
+        up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
         wake_up_all(&fc->waitq);
-        up_write(&fc->sbput_sem);
-        fuse_release_conn(fc);
-        spin_unlock(&fuse_lock);
+        kobject_del(&fc->kobj);
+        kobject_put(&fc->kobj);
 }
 
 static void convert_fuse_statfs(struct kstatfs *stbuf, struct fuse_kstatfs *attr)
 {
         stbuf->f_type    = FUSE_SUPER_MAGIC;
         stbuf->f_bsize   = attr->bsize;
+        stbuf->f_frsize  = attr->frsize;
         stbuf->f_blocks  = attr->blocks;
         stbuf->f_bfree   = attr->bfree;
         stbuf->f_bavail  = attr->bavail;
@@ -238,10 +246,12 @@ static int fuse_statfs(struct super_block *sb, struct kstatfs *buf)
         if (!req)
                 return -EINTR;
 
+        memset(&outarg, 0, sizeof(outarg));
         req->in.numargs = 0;
         req->in.h.opcode = FUSE_STATFS;
         req->out.numargs = 1;
-        req->out.args[0].size = sizeof(outarg);
+        req->out.args[0].size =
+                fc->minor < 4 ? FUSE_COMPAT_STATFS_SIZE : sizeof(outarg);
         req->out.args[0].value = &outarg;
         request_send(fc, req);
         err = req->out.h.error;
@@ -357,8 +367,10 @@ static int fuse_show_options(struct seq_file *m, struct vfsmount *mnt)
         return 0;
 }
 
-static void free_conn(struct fuse_conn *fc)
+static void fuse_conn_release(struct kobject *kobj)
 {
+        struct fuse_conn *fc = get_fuse_conn_kobj(kobj);
+
         while (!list_empty(&fc->unused_list)) {
                 struct fuse_req *req;
                 req = list_entry(fc->unused_list.next, struct fuse_req, list);
@@ -368,33 +380,28 @@ static void free_conn(struct fuse_conn *fc)
         kfree(fc);
 }
 
-/* Must be called with the fuse lock held */
-void fuse_release_conn(struct fuse_conn *fc)
-{
-        fc->count--;
-        if (!fc->count)
-                free_conn(fc);
-}
-
 static struct fuse_conn *new_conn(void)
 {
         struct fuse_conn *fc;
 
-        fc = kmalloc(sizeof(*fc), GFP_KERNEL);
-        if (fc != NULL) {
+        fc = kzalloc(sizeof(*fc), GFP_KERNEL);
+        if (fc) {
                 int i;
-                memset(fc, 0, sizeof(*fc));
                 init_waitqueue_head(&fc->waitq);
                 INIT_LIST_HEAD(&fc->pending);
                 INIT_LIST_HEAD(&fc->processing);
+                INIT_LIST_HEAD(&fc->io);
                 INIT_LIST_HEAD(&fc->unused_list);
                 INIT_LIST_HEAD(&fc->background);
-                sema_init(&fc->outstanding_sem, 0);
+                sema_init(&fc->outstanding_sem, 1); /* One for INIT */
                 init_rwsem(&fc->sbput_sem);
+                kobj_set_kset_s(fc, connections_subsys);
+                kobject_init(&fc->kobj);
+                atomic_set(&fc->num_waiting, 0);
                 for (i = 0; i < FUSE_MAX_OUTSTANDING; i++) {
                         struct fuse_req *req = fuse_request_alloc();
                         if (!req) {
-                                free_conn(fc);
+                                kobject_put(&fc->kobj);
                                 return NULL;
                         }
                         list_add(&req->list, &fc->unused_list);
@@ -409,25 +416,32 @@ static struct fuse_conn *new_conn(void)
 static struct fuse_conn *get_conn(struct file *file, struct super_block *sb)
 {
         struct fuse_conn *fc;
+        int err;
 
+        err = -EINVAL;
         if (file->f_op != &fuse_dev_operations)
-                return ERR_PTR(-EINVAL);
+                goto out_err;
+
+        err = -ENOMEM;
         fc = new_conn();
-        if (fc == NULL)
-                return ERR_PTR(-ENOMEM);
+        if (!fc)
+                goto out_err;
+
         spin_lock(&fuse_lock);
-        if (file->private_data) {
-                free_conn(fc);
-                fc = ERR_PTR(-EINVAL);
-        } else {
-                file->private_data = fc;
-                *get_fuse_conn_super_p(sb) = fc;
-                fc->mounted = 1;
-                fc->connected = 1;
-                fc->count = 2;
-        }
+        err = -EINVAL;
+        if (file->private_data)
+                goto out_unlock;
+
+        kobject_get(&fc->kobj);
+        file->private_data = fc;
         spin_unlock(&fuse_lock);
         return fc;
+
+ out_unlock:
+        spin_unlock(&fuse_lock);
+        kobject_put(&fc->kobj);
+ out_err:
+        return ERR_PTR(err);
 }
 
 static struct inode *get_root_inode(struct super_block *sb, unsigned mode)
@@ -446,16 +460,74 @@ static struct super_operations fuse_super_operations = {
         .read_inode     = fuse_read_inode,
         .clear_inode    = fuse_clear_inode,
         .put_super      = fuse_put_super,
+        .umount_begin   = fuse_umount_begin,
         .statfs         = fuse_statfs,
         .show_options   = fuse_show_options,
 };
 
+static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
+{
+        int i;
+        struct fuse_init_out *arg = &req->misc.init_out;
+
+        if (req->out.h.error || arg->major != FUSE_KERNEL_VERSION)
+                fc->conn_error = 1;
+        else {
+                fc->minor = arg->minor;
+                fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
+        }
+
+        /* After INIT reply is received other requests can go
+           out.  So do (FUSE_MAX_OUTSTANDING - 1) number of
+           up()s on outstanding_sem.  The last up() is done in
+           fuse_putback_request() */
+        for (i = 1; i < FUSE_MAX_OUTSTANDING; i++)
+                up(&fc->outstanding_sem);
+
+        fuse_put_request(fc, req);
+}
+
+static void fuse_send_init(struct fuse_conn *fc)
+{
+        /* This is called from fuse_read_super() so there's guaranteed
+           to be exactly one request available */
+        struct fuse_req *req = fuse_get_request(fc);
+        struct fuse_init_in *arg = &req->misc.init_in;
+
+        arg->major = FUSE_KERNEL_VERSION;
+        arg->minor = FUSE_KERNEL_MINOR_VERSION;
+        req->in.h.opcode = FUSE_INIT;
+        req->in.numargs = 1;
+        req->in.args[0].size = sizeof(*arg);
+        req->in.args[0].value = arg;
+        req->out.numargs = 1;
+        /* Variable length arguement used for backward compatibility
+           with interface version < 7.5.  Rest of init_out is zeroed
+           by do_get_request(), so a short reply is not a problem */
+        req->out.argvar = 1;
+        req->out.args[0].size = sizeof(struct fuse_init_out);
+        req->out.args[0].value = &req->misc.init_out;
+        req->end = process_init_reply;
+        request_send_background(fc, req);
+}
+
+static unsigned long long conn_id(void)
+{
+        static unsigned long long ctr = 1;
+        unsigned long long val;
+        spin_lock(&fuse_lock);
+        val = ctr++;
+        spin_unlock(&fuse_lock);
+        return val;
+}
+
 static int fuse_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct fuse_conn *fc;
         struct inode *root;
         struct fuse_mount_data d;
         struct file *file;
+        struct dentry *root_dentry;
         int err;
 
         if (!parse_fuse_opt((char *) data, &d))
@@ -482,25 +554,43 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         fc->max_read = d.max_read;
         if (fc->max_read / PAGE_CACHE_SIZE < fc->bdi.ra_pages)
                 fc->bdi.ra_pages = fc->max_read / PAGE_CACHE_SIZE;
-        fc->max_write = FUSE_MAX_IN / 2;
+
+        /* Used by get_root_inode() */
+        sb->s_fs_info = fc;
 
         err = -ENOMEM;
         root = get_root_inode(sb, d.rootmode);
-        if (root == NULL)
+        if (!root)
                 goto err;
 
-        sb->s_root = d_alloc_root(root);
-        if (!sb->s_root) {
+        root_dentry = d_alloc_root(root);
+        if (!root_dentry) {
                 iput(root);
                 goto err;
         }
+
+        err = kobject_set_name(&fc->kobj, "%llu", conn_id());
+        if (err)
+                goto err_put_root;
+
+        err = kobject_add(&fc->kobj);
+        if (err)
+                goto err_put_root;
+
+        sb->s_root = root_dentry;
+        spin_lock(&fuse_lock);
+        fc->mounted = 1;
+        fc->connected = 1;
+        spin_unlock(&fuse_lock);
+
         fuse_send_init(fc);
+
         return 0;
 
+ err_put_root:
+        dput(root_dentry);
  err:
-        spin_lock(&fuse_lock);
-        fuse_release_conn(fc);
-        spin_unlock(&fuse_lock);
+        kobject_put(&fc->kobj);
         return err;
 }
 
@@ -518,6 +608,69 @@ static struct file_system_type fuse_fs_type = {
         .kill_sb        = kill_anon_super,
 };
 
+static ssize_t fuse_conn_waiting_show(struct fuse_conn *fc, char *page)
+{
+        return sprintf(page, "%i\n", atomic_read(&fc->num_waiting));
+}
+
+static ssize_t fuse_conn_abort_store(struct fuse_conn *fc, const char *page,
+                                     size_t count)
+{
+        fuse_abort_conn(fc);
+        return count;
+}
+
+static struct fuse_conn_attr fuse_conn_waiting =
+        __ATTR(waiting, 0400, fuse_conn_waiting_show, NULL);
+static struct fuse_conn_attr fuse_conn_abort =
+        __ATTR(abort, 0600, NULL, fuse_conn_abort_store);
+
+static struct attribute *fuse_conn_attrs[] = {
+        &fuse_conn_waiting.attr,
+        &fuse_conn_abort.attr,
+        NULL,
+};
+
+static ssize_t fuse_conn_attr_show(struct kobject *kobj,
+                                   struct attribute *attr,
+                                   char *page)
+{
+        struct fuse_conn_attr *fca =
+                container_of(attr, struct fuse_conn_attr, attr);
+
+        if (fca->show)
+                return fca->show(get_fuse_conn_kobj(kobj), page);
+        else
+                return -EACCES;
+}
+
+static ssize_t fuse_conn_attr_store(struct kobject *kobj,
+                                    struct attribute *attr,
+                                    const char *page, size_t count)
+{
+        struct fuse_conn_attr *fca =
+                container_of(attr, struct fuse_conn_attr, attr);
+
+        if (fca->store)
+                return fca->store(get_fuse_conn_kobj(kobj), page, count);
+        else
+                return -EACCES;
+}
+
+static struct sysfs_ops fuse_conn_sysfs_ops = {
+        .show   = &fuse_conn_attr_show,
+        .store  = &fuse_conn_attr_store,
+};
+
+static struct kobj_type ktype_fuse_conn = {
+        .release        = fuse_conn_release,
+        .sysfs_ops      = &fuse_conn_sysfs_ops,
+        .default_attrs  = fuse_conn_attrs,
+};
+
+static decl_subsys(fuse, NULL, NULL);
+static decl_subsys(connections, &ktype_fuse_conn, NULL);
+
 static void fuse_inode_init_once(void *foo, kmem_cache_t *cachep,
                                  unsigned long flags)
 {
@@ -555,6 +708,34 @@ static void fuse_fs_cleanup(void)
         kmem_cache_destroy(fuse_inode_cachep);
 }
 
+static int fuse_sysfs_init(void)
+{
+        int err;
+
+        kset_set_kset_s(&fuse_subsys, fs_subsys);
+        err = subsystem_register(&fuse_subsys);
+        if (err)
+                goto out_err;
+
+        kset_set_kset_s(&connections_subsys, fuse_subsys);
+        err = subsystem_register(&connections_subsys);
+        if (err)
+                goto out_fuse_unregister;
+
+        return 0;
+
+ out_fuse_unregister:
+        subsystem_unregister(&fuse_subsys);
+ out_err:
+        return err;
+}
+
+static void fuse_sysfs_cleanup(void)
+{
+        subsystem_unregister(&connections_subsys);
+        subsystem_unregister(&fuse_subsys);
+}
+
 static int __init fuse_init(void)
 {
         int res;
@@ -571,8 +752,14 @@ static int __init fuse_init(void)
         if (res)
                 goto err_fs_cleanup;
 
+        res = fuse_sysfs_init();
+        if (res)
+                goto err_dev_cleanup;
+
         return 0;
 
+ err_dev_cleanup:
+        fuse_dev_cleanup();
  err_fs_cleanup:
         fuse_fs_cleanup();
  err:
@@ -583,6 +770,7 @@ static void __exit fuse_exit(void)
 {
         printk(KERN_DEBUG "fuse exit\n");
 
+        fuse_sysfs_cleanup();
         fuse_fs_cleanup();
         fuse_dev_cleanup();
 }