filemap.c revision 18f2ee705d98034b0f229a3202d827468d4bffd9
1/*
2 *	linux/mm/filemap.c
3 *
4 * Copyright (C) 1994-1999  Linus Torvalds
5 */
6
7/*
8 * This file handles the generic file mmap semantics used by
9 * most "normal" filesystems (but you don't /have/ to use this:
10 * the NFS filesystem used to do this differently, for example)
11 */
12#include <linux/module.h>
13#include <linux/slab.h>
14#include <linux/compiler.h>
15#include <linux/fs.h>
16#include <linux/uaccess.h>
17#include <linux/aio.h>
18#include <linux/capability.h>
19#include <linux/kernel_stat.h>
20#include <linux/mm.h>
21#include <linux/swap.h>
22#include <linux/mman.h>
23#include <linux/pagemap.h>
24#include <linux/file.h>
25#include <linux/uio.h>
26#include <linux/hash.h>
27#include <linux/writeback.h>
28#include <linux/backing-dev.h>
29#include <linux/pagevec.h>
30#include <linux/blkdev.h>
31#include <linux/security.h>
32#include <linux/syscalls.h>
33#include <linux/cpuset.h>
34#include <linux/hardirq.h> /* for BUG_ON(!in_atomic()) only */
35#include <linux/memcontrol.h>
36#include <linux/mm_inline.h> /* for page_is_file_cache() */
37#include "internal.h"
38
39/*
40 * FIXME: remove all knowledge of the buffer layer from the core VM
41 */
42#include <linux/buffer_head.h> /* for try_to_free_buffers */
43
44#include <asm/mman.h>
45
46/*
47 * Shared mappings implemented 30.11.1994. It's not fully working yet,
48 * though.
49 *
50 * Shared mappings now work. 15.8.1995  Bruno.
51 *
52 * finished 'unifying' the page and buffer cache and SMP-threaded the
53 * page-cache, 21.05.1999, Ingo Molnar <mingo@redhat.com>
54 *
55 * SMP-threaded pagemap-LRU 1999, Andrea Arcangeli <andrea@suse.de>
56 */
57
58/*
59 * Lock ordering:
60 *
61 *  ->i_mmap_lock		(vmtruncate)
62 *    ->private_lock		(__free_pte->__set_page_dirty_buffers)
63 *      ->swap_lock		(exclusive_swap_page, others)
64 *        ->mapping->tree_lock
65 *
66 *  ->i_mutex
67 *    ->i_mmap_lock		(truncate->unmap_mapping_range)
68 *
69 *  ->mmap_sem
70 *    ->i_mmap_lock
71 *      ->page_table_lock or pte_lock	(various, mainly in memory.c)
72 *        ->mapping->tree_lock	(arch-dependent flush_dcache_mmap_lock)
73 *
74 *  ->mmap_sem
75 *    ->lock_page		(access_process_vm)
76 *
77 *  ->i_mutex			(generic_file_buffered_write)
78 *    ->mmap_sem		(fault_in_pages_readable->do_page_fault)
79 *
80 *  ->i_mutex
81 *    ->i_alloc_sem             (various)
82 *
83 *  ->inode_lock
84 *    ->sb_lock			(fs/fs-writeback.c)
85 *    ->mapping->tree_lock	(__sync_single_inode)
86 *
87 *  ->i_mmap_lock
88 *    ->anon_vma.lock		(vma_adjust)
89 *
90 *  ->anon_vma.lock
91 *    ->page_table_lock or pte_lock	(anon_vma_prepare and various)
92 *
93 *  ->page_table_lock or pte_lock
94 *    ->swap_lock		(try_to_unmap_one)
95 *    ->private_lock		(try_to_unmap_one)
96 *    ->tree_lock		(try_to_unmap_one)
97 *    ->zone.lru_lock		(follow_page->mark_page_accessed)
98 *    ->zone.lru_lock		(check_pte_range->isolate_lru_page)
99 *    ->private_lock		(page_remove_rmap->set_page_dirty)
100 *    ->tree_lock		(page_remove_rmap->set_page_dirty)
101 *    ->inode_lock		(page_remove_rmap->set_page_dirty)
102 *    ->inode_lock		(zap_pte_range->set_page_dirty)
103 *    ->private_lock		(zap_pte_range->__set_page_dirty_buffers)
104 *
105 *  ->task->proc_lock
106 *    ->dcache_lock		(proc_pid_lookup)
107 */
108
109/*
110 * Remove a page from the page cache and free it. Caller has to make
111 * sure the page is locked and that nobody else uses it - or that usage
112 * is safe.  The caller must hold the mapping's tree_lock.
113 */
114void __remove_from_page_cache(struct page *page)
115{
116	struct address_space *mapping = page->mapping;
117
118	radix_tree_delete(&mapping->page_tree, page->index);
119	page->mapping = NULL;
120	mapping->nrpages--;
121	__dec_zone_page_state(page, NR_FILE_PAGES);
122	BUG_ON(page_mapped(page));
123
124	/*
125	 * Some filesystems seem to re-dirty the page even after
126	 * the VM has canceled the dirty bit (eg ext3 journaling).
127	 *
128	 * Fix it up by doing a final dirty accounting check after
129	 * having removed the page entirely.
130	 */
131	if (PageDirty(page) && mapping_cap_account_dirty(mapping)) {
132		dec_zone_page_state(page, NR_FILE_DIRTY);
133		dec_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE);
134	}
135}
136
137void remove_from_page_cache(struct page *page)
138{
139	struct address_space *mapping = page->mapping;
140
141	BUG_ON(!PageLocked(page));
142
143	spin_lock_irq(&mapping->tree_lock);
144	__remove_from_page_cache(page);
145	spin_unlock_irq(&mapping->tree_lock);
146	mem_cgroup_uncharge_cache_page(page);
147}
148
149static int sync_page(void *word)
150{
151	struct address_space *mapping;
152	struct page *page;
153
154	page = container_of((unsigned long *)word, struct page, flags);
155
156	/*
157	 * page_mapping() is being called without PG_locked held.
158	 * Some knowledge of the state and use of the page is used to
159	 * reduce the requirements down to a memory barrier.
160	 * The danger here is of a stale page_mapping() return value
161	 * indicating a struct address_space different from the one it's
162	 * associated with when it is associated with one.
163	 * After smp_mb(), it's either the correct page_mapping() for
164	 * the page, or an old page_mapping() and the page's own
165	 * page_mapping() has gone NULL.
166	 * The ->sync_page() address_space operation must tolerate
167	 * page_mapping() going NULL. By an amazing coincidence,
168	 * this comes about because none of the users of the page
169	 * in the ->sync_page() methods make essential use of the
170	 * page_mapping(), merely passing the page down to the backing
171	 * device's unplug functions when it's non-NULL, which in turn
172	 * ignore it for all cases but swap, where only page_private(page) is
173	 * of interest. When page_mapping() does go NULL, the entire
174	 * call stack gracefully ignores the page and returns.
175	 * -- wli
176	 */
177	smp_mb();
178	mapping = page_mapping(page);
179	if (mapping && mapping->a_ops && mapping->a_ops->sync_page)
180		mapping->a_ops->sync_page(page);
181	io_schedule();
182	return 0;
183}
184
185static int sync_page_killable(void *word)
186{
187	sync_page(word);
188	return fatal_signal_pending(current) ? -EINTR : 0;
189}
190
191/**
192 * __filemap_fdatawrite_range - start writeback on mapping dirty pages in range
193 * @mapping:	address space structure to write
194 * @start:	offset in bytes where the range starts
195 * @end:	offset in bytes where the range ends (inclusive)
196 * @sync_mode:	enable synchronous operation
197 *
198 * Start writeback against all of a mapping's dirty pages that lie
199 * within the byte offsets <start, end> inclusive.
200 *
201 * If sync_mode is WB_SYNC_ALL then this is a "data integrity" operation, as
202 * opposed to a regular memory cleansing writeback.  The difference between
203 * these two operations is that if a dirty page/buffer is encountered, it must
204 * be waited upon, and not just skipped over.
205 */
206int __filemap_fdatawrite_range(struct address_space *mapping, loff_t start,
207				loff_t end, int sync_mode)
208{
209	int ret;
210	struct writeback_control wbc = {
211		.sync_mode = sync_mode,
212		.nr_to_write = LONG_MAX,
213		.range_start = start,
214		.range_end = end,
215	};
216
217	if (!mapping_cap_writeback_dirty(mapping))
218		return 0;
219
220	ret = do_writepages(mapping, &wbc);
221	return ret;
222}
223
224static inline int __filemap_fdatawrite(struct address_space *mapping,
225	int sync_mode)
226{
227	return __filemap_fdatawrite_range(mapping, 0, LLONG_MAX, sync_mode);
228}
229
230int filemap_fdatawrite(struct address_space *mapping)
231{
232	return __filemap_fdatawrite(mapping, WB_SYNC_ALL);
233}
234EXPORT_SYMBOL(filemap_fdatawrite);
235
236int filemap_fdatawrite_range(struct address_space *mapping, loff_t start,
237				loff_t end)
238{
239	return __filemap_fdatawrite_range(mapping, start, end, WB_SYNC_ALL);
240}
241EXPORT_SYMBOL(filemap_fdatawrite_range);
242
243/**
244 * filemap_flush - mostly a non-blocking flush
245 * @mapping:	target address_space
246 *
247 * This is a mostly non-blocking flush.  Not suitable for data-integrity
248 * purposes - I/O may not be started against all dirty pages.
249 */
250int filemap_flush(struct address_space *mapping)
251{
252	return __filemap_fdatawrite(mapping, WB_SYNC_NONE);
253}
254EXPORT_SYMBOL(filemap_flush);
255
256/**
257 * wait_on_page_writeback_range - wait for writeback to complete
258 * @mapping:	target address_space
259 * @start:	beginning page index
260 * @end:	ending page index
261 *
262 * Wait for writeback to complete against pages indexed by start->end
263 * inclusive
264 */
265int wait_on_page_writeback_range(struct address_space *mapping,
266				pgoff_t start, pgoff_t end)
267{
268	struct pagevec pvec;
269	int nr_pages;
270	int ret = 0;
271	pgoff_t index;
272
273	if (end < start)
274		return 0;
275
276	pagevec_init(&pvec, 0);
277	index = start;
278	while ((index <= end) &&
279			(nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
280			PAGECACHE_TAG_WRITEBACK,
281			min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1)) != 0) {
282		unsigned i;
283
284		for (i = 0; i < nr_pages; i++) {
285			struct page *page = pvec.pages[i];
286
287			/* until radix tree lookup accepts end_index */
288			if (page->index > end)
289				continue;
290
291			wait_on_page_writeback(page);
292			if (PageError(page))
293				ret = -EIO;
294		}
295		pagevec_release(&pvec);
296		cond_resched();
297	}
298
299	/* Check for outstanding write errors */
300	if (test_and_clear_bit(AS_ENOSPC, &mapping->flags))
301		ret = -ENOSPC;
302	if (test_and_clear_bit(AS_EIO, &mapping->flags))
303		ret = -EIO;
304
305	return ret;
306}
307
308/**
309 * filemap_fdatawait_range - wait for all under-writeback pages to complete in a given range
310 * @mapping: address space structure to wait for
311 * @start:	offset in bytes where the range starts
312 * @end:	offset in bytes where the range ends (inclusive)
313 *
314 * Walk the list of under-writeback pages of the given address space
315 * in the given range and wait for all of them.
316 *
317 * This is just a simple wrapper so that callers don't have to convert offsets
318 * to page indexes themselves
319 */
320int filemap_fdatawait_range(struct address_space *mapping, loff_t start,
321			    loff_t end)
322{
323	return wait_on_page_writeback_range(mapping, start >> PAGE_CACHE_SHIFT,
324					    end >> PAGE_CACHE_SHIFT);
325}
326EXPORT_SYMBOL(filemap_fdatawait_range);
327
328/**
329 * filemap_fdatawait - wait for all under-writeback pages to complete
330 * @mapping: address space structure to wait for
331 *
332 * Walk the list of under-writeback pages of the given address space
333 * and wait for all of them.
334 */
335int filemap_fdatawait(struct address_space *mapping)
336{
337	loff_t i_size = i_size_read(mapping->host);
338
339	if (i_size == 0)
340		return 0;
341
342	return wait_on_page_writeback_range(mapping, 0,
343				(i_size - 1) >> PAGE_CACHE_SHIFT);
344}
345EXPORT_SYMBOL(filemap_fdatawait);
346
347int filemap_write_and_wait(struct address_space *mapping)
348{
349	int err = 0;
350
351	if (mapping->nrpages) {
352		err = filemap_fdatawrite(mapping);
353		/*
354		 * Even if the above returned error, the pages may be
355		 * written partially (e.g. -ENOSPC), so we wait for it.
356		 * But the -EIO is special case, it may indicate the worst
357		 * thing (e.g. bug) happened, so we avoid waiting for it.
358		 */
359		if (err != -EIO) {
360			int err2 = filemap_fdatawait(mapping);
361			if (!err)
362				err = err2;
363		}
364	}
365	return err;
366}
367EXPORT_SYMBOL(filemap_write_and_wait);
368
369/**
370 * filemap_write_and_wait_range - write out & wait on a file range
371 * @mapping:	the address_space for the pages
372 * @lstart:	offset in bytes where the range starts
373 * @lend:	offset in bytes where the range ends (inclusive)
374 *
375 * Write out and wait upon file offsets lstart->lend, inclusive.
376 *
377 * Note that `lend' is inclusive (describes the last byte to be written) so
378 * that this function can be used to write to the very end-of-file (end = -1).
379 */
380int filemap_write_and_wait_range(struct address_space *mapping,
381				 loff_t lstart, loff_t lend)
382{
383	int err = 0;
384
385	if (mapping->nrpages) {
386		err = __filemap_fdatawrite_range(mapping, lstart, lend,
387						 WB_SYNC_ALL);
388		/* See comment of filemap_write_and_wait() */
389		if (err != -EIO) {
390			int err2 = wait_on_page_writeback_range(mapping,
391						lstart >> PAGE_CACHE_SHIFT,
392						lend >> PAGE_CACHE_SHIFT);
393			if (!err)
394				err = err2;
395		}
396	}
397	return err;
398}
399EXPORT_SYMBOL(filemap_write_and_wait_range);
400
401/**
402 * add_to_page_cache_locked - add a locked page to the pagecache
403 * @page:	page to add
404 * @mapping:	the page's address_space
405 * @offset:	page index
406 * @gfp_mask:	page allocation mode
407 *
408 * This function is used to add a page to the pagecache. It must be locked.
409 * This function does not add the page to the LRU.  The caller must do that.
410 */
411int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
412		pgoff_t offset, gfp_t gfp_mask)
413{
414	int error;
415
416	VM_BUG_ON(!PageLocked(page));
417
418	error = mem_cgroup_cache_charge(page, current->mm,
419					gfp_mask & GFP_RECLAIM_MASK);
420	if (error)
421		goto out;
422
423	error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
424	if (error == 0) {
425		page_cache_get(page);
426		page->mapping = mapping;
427		page->index = offset;
428
429		spin_lock_irq(&mapping->tree_lock);
430		error = radix_tree_insert(&mapping->page_tree, offset, page);
431		if (likely(!error)) {
432			mapping->nrpages++;
433			__inc_zone_page_state(page, NR_FILE_PAGES);
434			spin_unlock_irq(&mapping->tree_lock);
435		} else {
436			page->mapping = NULL;
437			spin_unlock_irq(&mapping->tree_lock);
438			mem_cgroup_uncharge_cache_page(page);
439			page_cache_release(page);
440		}
441		radix_tree_preload_end();
442	} else
443		mem_cgroup_uncharge_cache_page(page);
444out:
445	return error;
446}
447EXPORT_SYMBOL(add_to_page_cache_locked);
448
449int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
450				pgoff_t offset, gfp_t gfp_mask)
451{
452	int ret;
453
454	/*
455	 * Splice_read and readahead add shmem/tmpfs pages into the page cache
456	 * before shmem_readpage has a chance to mark them as SwapBacked: they
457	 * need to go on the active_anon lru below, and mem_cgroup_cache_charge
458	 * (called in add_to_page_cache) needs to know where they're going too.
459	 */
460	if (mapping_cap_swap_backed(mapping))
461		SetPageSwapBacked(page);
462
463	ret = add_to_page_cache(page, mapping, offset, gfp_mask);
464	if (ret == 0) {
465		if (page_is_file_cache(page))
466			lru_cache_add_file(page);
467		else
468			lru_cache_add_active_anon(page);
469	}
470	return ret;
471}
472EXPORT_SYMBOL_GPL(add_to_page_cache_lru);
473
474#ifdef CONFIG_NUMA
475struct page *__page_cache_alloc(gfp_t gfp)
476{
477	if (cpuset_do_page_mem_spread()) {
478		int n = cpuset_mem_spread_node();
479		return alloc_pages_exact_node(n, gfp, 0);
480	}
481	return alloc_pages(gfp, 0);
482}
483EXPORT_SYMBOL(__page_cache_alloc);
484#endif
485
486static int __sleep_on_page_lock(void *word)
487{
488	io_schedule();
489	return 0;
490}
491
492/*
493 * In order to wait for pages to become available there must be
494 * waitqueues associated with pages. By using a hash table of
495 * waitqueues where the bucket discipline is to maintain all
496 * waiters on the same queue and wake all when any of the pages
497 * become available, and for the woken contexts to check to be
498 * sure the appropriate page became available, this saves space
499 * at a cost of "thundering herd" phenomena during rare hash
500 * collisions.
501 */
502static wait_queue_head_t *page_waitqueue(struct page *page)
503{
504	const struct zone *zone = page_zone(page);
505
506	return &zone->wait_table[hash_ptr(page, zone->wait_table_bits)];
507}
508
509static inline void wake_up_page(struct page *page, int bit)
510{
511	__wake_up_bit(page_waitqueue(page), &page->flags, bit);
512}
513
514void wait_on_page_bit(struct page *page, int bit_nr)
515{
516	DEFINE_WAIT_BIT(wait, &page->flags, bit_nr);
517
518	if (test_bit(bit_nr, &page->flags))
519		__wait_on_bit(page_waitqueue(page), &wait, sync_page,
520							TASK_UNINTERRUPTIBLE);
521}
522EXPORT_SYMBOL(wait_on_page_bit);
523
524/**
525 * add_page_wait_queue - Add an arbitrary waiter to a page's wait queue
526 * @page: Page defining the wait queue of interest
527 * @waiter: Waiter to add to the queue
528 *
529 * Add an arbitrary @waiter to the wait queue for the nominated @page.
530 */
531void add_page_wait_queue(struct page *page, wait_queue_t *waiter)
532{
533	wait_queue_head_t *q = page_waitqueue(page);
534	unsigned long flags;
535
536	spin_lock_irqsave(&q->lock, flags);
537	__add_wait_queue(q, waiter);
538	spin_unlock_irqrestore(&q->lock, flags);
539}
540EXPORT_SYMBOL_GPL(add_page_wait_queue);
541
542/**
543 * unlock_page - unlock a locked page
544 * @page: the page
545 *
546 * Unlocks the page and wakes up sleepers in ___wait_on_page_locked().
547 * Also wakes sleepers in wait_on_page_writeback() because the wakeup
548 * mechananism between PageLocked pages and PageWriteback pages is shared.
549 * But that's OK - sleepers in wait_on_page_writeback() just go back to sleep.
550 *
551 * The mb is necessary to enforce ordering between the clear_bit and the read
552 * of the waitqueue (to avoid SMP races with a parallel wait_on_page_locked()).
553 */
554void unlock_page(struct page *page)
555{
556	VM_BUG_ON(!PageLocked(page));
557	clear_bit_unlock(PG_locked, &page->flags);
558	smp_mb__after_clear_bit();
559	wake_up_page(page, PG_locked);
560}
561EXPORT_SYMBOL(unlock_page);
562
563/**
564 * end_page_writeback - end writeback against a page
565 * @page: the page
566 */
567void end_page_writeback(struct page *page)
568{
569	if (TestClearPageReclaim(page))
570		rotate_reclaimable_page(page);
571
572	if (!test_clear_page_writeback(page))
573		BUG();
574
575	smp_mb__after_clear_bit();
576	wake_up_page(page, PG_writeback);
577}
578EXPORT_SYMBOL(end_page_writeback);
579
580/**
581 * __lock_page - get a lock on the page, assuming we need to sleep to get it
582 * @page: the page to lock
583 *
584 * Ugly. Running sync_page() in state TASK_UNINTERRUPTIBLE is scary.  If some
585 * random driver's requestfn sets TASK_RUNNING, we could busywait.  However
586 * chances are that on the second loop, the block layer's plug list is empty,
587 * so sync_page() will then return in state TASK_UNINTERRUPTIBLE.
588 */
589void __lock_page(struct page *page)
590{
591	DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
592
593	__wait_on_bit_lock(page_waitqueue(page), &wait, sync_page,
594							TASK_UNINTERRUPTIBLE);
595}
596EXPORT_SYMBOL(__lock_page);
597
598int __lock_page_killable(struct page *page)
599{
600	DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
601
602	return __wait_on_bit_lock(page_waitqueue(page), &wait,
603					sync_page_killable, TASK_KILLABLE);
604}
605EXPORT_SYMBOL_GPL(__lock_page_killable);
606
607/**
608 * __lock_page_nosync - get a lock on the page, without calling sync_page()
609 * @page: the page to lock
610 *
611 * Variant of lock_page that does not require the caller to hold a reference
612 * on the page's mapping.
613 */
614void __lock_page_nosync(struct page *page)
615{
616	DEFINE_WAIT_BIT(wait, &page->flags, PG_locked);
617	__wait_on_bit_lock(page_waitqueue(page), &wait, __sleep_on_page_lock,
618							TASK_UNINTERRUPTIBLE);
619}
620
621/**
622 * find_get_page - find and get a page reference
623 * @mapping: the address_space to search
624 * @offset: the page index
625 *
626 * Is there a pagecache struct page at the given (mapping, offset) tuple?
627 * If yes, increment its refcount and return it; if no, return NULL.
628 */
629struct page *find_get_page(struct address_space *mapping, pgoff_t offset)
630{
631	void **pagep;
632	struct page *page;
633
634	rcu_read_lock();
635repeat:
636	page = NULL;
637	pagep = radix_tree_lookup_slot(&mapping->page_tree, offset);
638	if (pagep) {
639		page = radix_tree_deref_slot(pagep);
640		if (unlikely(!page || page == RADIX_TREE_RETRY))
641			goto repeat;
642
643		if (!page_cache_get_speculative(page))
644			goto repeat;
645
646		/*
647		 * Has the page moved?
648		 * This is part of the lockless pagecache protocol. See
649		 * include/linux/pagemap.h for details.
650		 */
651		if (unlikely(page != *pagep)) {
652			page_cache_release(page);
653			goto repeat;
654		}
655	}
656	rcu_read_unlock();
657
658	return page;
659}
660EXPORT_SYMBOL(find_get_page);
661
662/**
663 * find_lock_page - locate, pin and lock a pagecache page
664 * @mapping: the address_space to search
665 * @offset: the page index
666 *
667 * Locates the desired pagecache page, locks it, increments its reference
668 * count and returns its address.
669 *
670 * Returns zero if the page was not present. find_lock_page() may sleep.
671 */
672struct page *find_lock_page(struct address_space *mapping, pgoff_t offset)
673{
674	struct page *page;
675
676repeat:
677	page = find_get_page(mapping, offset);
678	if (page) {
679		lock_page(page);
680		/* Has the page been truncated? */
681		if (unlikely(page->mapping != mapping)) {
682			unlock_page(page);
683			page_cache_release(page);
684			goto repeat;
685		}
686		VM_BUG_ON(page->index != offset);
687	}
688	return page;
689}
690EXPORT_SYMBOL(find_lock_page);
691
692/**
693 * find_or_create_page - locate or add a pagecache page
694 * @mapping: the page's address_space
695 * @index: the page's index into the mapping
696 * @gfp_mask: page allocation mode
697 *
698 * Locates a page in the pagecache.  If the page is not present, a new page
699 * is allocated using @gfp_mask and is added to the pagecache and to the VM's
700 * LRU list.  The returned page is locked and has its reference count
701 * incremented.
702 *
703 * find_or_create_page() may sleep, even if @gfp_flags specifies an atomic
704 * allocation!
705 *
706 * find_or_create_page() returns the desired page's address, or zero on
707 * memory exhaustion.
708 */
709struct page *find_or_create_page(struct address_space *mapping,
710		pgoff_t index, gfp_t gfp_mask)
711{
712	struct page *page;
713	int err;
714repeat:
715	page = find_lock_page(mapping, index);
716	if (!page) {
717		page = __page_cache_alloc(gfp_mask);
718		if (!page)
719			return NULL;
720		/*
721		 * We want a regular kernel memory (not highmem or DMA etc)
722		 * allocation for the radix tree nodes, but we need to honour
723		 * the context-specific requirements the caller has asked for.
724		 * GFP_RECLAIM_MASK collects those requirements.
725		 */
726		err = add_to_page_cache_lru(page, mapping, index,
727			(gfp_mask & GFP_RECLAIM_MASK));
728		if (unlikely(err)) {
729			page_cache_release(page);
730			page = NULL;
731			if (err == -EEXIST)
732				goto repeat;
733		}
734	}
735	return page;
736}
737EXPORT_SYMBOL(find_or_create_page);
738
739/**
740 * find_get_pages - gang pagecache lookup
741 * @mapping:	The address_space to search
742 * @start:	The starting page index
743 * @nr_pages:	The maximum number of pages
744 * @pages:	Where the resulting pages are placed
745 *
746 * find_get_pages() will search for and return a group of up to
747 * @nr_pages pages in the mapping.  The pages are placed at @pages.
748 * find_get_pages() takes a reference against the returned pages.
749 *
750 * The search returns a group of mapping-contiguous pages with ascending
751 * indexes.  There may be holes in the indices due to not-present pages.
752 *
753 * find_get_pages() returns the number of pages which were found.
754 */
755unsigned find_get_pages(struct address_space *mapping, pgoff_t start,
756			    unsigned int nr_pages, struct page **pages)
757{
758	unsigned int i;
759	unsigned int ret;
760	unsigned int nr_found;
761
762	rcu_read_lock();
763restart:
764	nr_found = radix_tree_gang_lookup_slot(&mapping->page_tree,
765				(void ***)pages, start, nr_pages);
766	ret = 0;
767	for (i = 0; i < nr_found; i++) {
768		struct page *page;
769repeat:
770		page = radix_tree_deref_slot((void **)pages[i]);
771		if (unlikely(!page))
772			continue;
773		/*
774		 * this can only trigger if nr_found == 1, making livelock
775		 * a non issue.
776		 */
777		if (unlikely(page == RADIX_TREE_RETRY))
778			goto restart;
779
780		if (!page_cache_get_speculative(page))
781			goto repeat;
782
783		/* Has the page moved? */
784		if (unlikely(page != *((void **)pages[i]))) {
785			page_cache_release(page);
786			goto repeat;
787		}
788
789		pages[ret] = page;
790		ret++;
791	}
792	rcu_read_unlock();
793	return ret;
794}
795
796/**
797 * find_get_pages_contig - gang contiguous pagecache lookup
798 * @mapping:	The address_space to search
799 * @index:	The starting page index
800 * @nr_pages:	The maximum number of pages
801 * @pages:	Where the resulting pages are placed
802 *
803 * find_get_pages_contig() works exactly like find_get_pages(), except
804 * that the returned number of pages are guaranteed to be contiguous.
805 *
806 * find_get_pages_contig() returns the number of pages which were found.
807 */
808unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index,
809			       unsigned int nr_pages, struct page **pages)
810{
811	unsigned int i;
812	unsigned int ret;
813	unsigned int nr_found;
814
815	rcu_read_lock();
816restart:
817	nr_found = radix_tree_gang_lookup_slot(&mapping->page_tree,
818				(void ***)pages, index, nr_pages);
819	ret = 0;
820	for (i = 0; i < nr_found; i++) {
821		struct page *page;
822repeat:
823		page = radix_tree_deref_slot((void **)pages[i]);
824		if (unlikely(!page))
825			continue;
826		/*
827		 * this can only trigger if nr_found == 1, making livelock
828		 * a non issue.
829		 */
830		if (unlikely(page == RADIX_TREE_RETRY))
831			goto restart;
832
833		if (page->mapping == NULL || page->index != index)
834			break;
835
836		if (!page_cache_get_speculative(page))
837			goto repeat;
838
839		/* Has the page moved? */
840		if (unlikely(page != *((void **)pages[i]))) {
841			page_cache_release(page);
842			goto repeat;
843		}
844
845		pages[ret] = page;
846		ret++;
847		index++;
848	}
849	rcu_read_unlock();
850	return ret;
851}
852EXPORT_SYMBOL(find_get_pages_contig);
853
854/**
855 * find_get_pages_tag - find and return pages that match @tag
856 * @mapping:	the address_space to search
857 * @index:	the starting page index
858 * @tag:	the tag index
859 * @nr_pages:	the maximum number of pages
860 * @pages:	where the resulting pages are placed
861 *
862 * Like find_get_pages, except we only return pages which are tagged with
863 * @tag.   We update @index to index the next page for the traversal.
864 */
865unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
866			int tag, unsigned int nr_pages, struct page **pages)
867{
868	unsigned int i;
869	unsigned int ret;
870	unsigned int nr_found;
871
872	rcu_read_lock();
873restart:
874	nr_found = radix_tree_gang_lookup_tag_slot(&mapping->page_tree,
875				(void ***)pages, *index, nr_pages, tag);
876	ret = 0;
877	for (i = 0; i < nr_found; i++) {
878		struct page *page;
879repeat:
880		page = radix_tree_deref_slot((void **)pages[i]);
881		if (unlikely(!page))
882			continue;
883		/*
884		 * this can only trigger if nr_found == 1, making livelock
885		 * a non issue.
886		 */
887		if (unlikely(page == RADIX_TREE_RETRY))
888			goto restart;
889
890		if (!page_cache_get_speculative(page))
891			goto repeat;
892
893		/* Has the page moved? */
894		if (unlikely(page != *((void **)pages[i]))) {
895			page_cache_release(page);
896			goto repeat;
897		}
898
899		pages[ret] = page;
900		ret++;
901	}
902	rcu_read_unlock();
903
904	if (ret)
905		*index = pages[ret - 1]->index + 1;
906
907	return ret;
908}
909EXPORT_SYMBOL(find_get_pages_tag);
910
911/**
912 * grab_cache_page_nowait - returns locked page at given index in given cache
913 * @mapping: target address_space
914 * @index: the page index
915 *
916 * Same as grab_cache_page(), but do not wait if the page is unavailable.
917 * This is intended for speculative data generators, where the data can
918 * be regenerated if the page couldn't be grabbed.  This routine should
919 * be safe to call while holding the lock for another page.
920 *
921 * Clear __GFP_FS when allocating the page to avoid recursion into the fs
922 * and deadlock against the caller's locked page.
923 */
924struct page *
925grab_cache_page_nowait(struct address_space *mapping, pgoff_t index)
926{
927	struct page *page = find_get_page(mapping, index);
928
929	if (page) {
930		if (trylock_page(page))
931			return page;
932		page_cache_release(page);
933		return NULL;
934	}
935	page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~__GFP_FS);
936	if (page && add_to_page_cache_lru(page, mapping, index, GFP_NOFS)) {
937		page_cache_release(page);
938		page = NULL;
939	}
940	return page;
941}
942EXPORT_SYMBOL(grab_cache_page_nowait);
943
944/*
945 * CD/DVDs are error prone. When a medium error occurs, the driver may fail
946 * a _large_ part of the i/o request. Imagine the worst scenario:
947 *
948 *      ---R__________________________________________B__________
949 *         ^ reading here                             ^ bad block(assume 4k)
950 *
951 * read(R) => miss => readahead(R...B) => media error => frustrating retries
952 * => failing the whole request => read(R) => read(R+1) =>
953 * readahead(R+1...B+1) => bang => read(R+2) => read(R+3) =>
954 * readahead(R+3...B+2) => bang => read(R+3) => read(R+4) =>
955 * readahead(R+4...B+3) => bang => read(R+4) => read(R+5) => ......
956 *
957 * It is going insane. Fix it by quickly scaling down the readahead size.
958 */
959static void shrink_readahead_size_eio(struct file *filp,
960					struct file_ra_state *ra)
961{
962	ra->ra_pages /= 4;
963}
964
965/**
966 * do_generic_file_read - generic file read routine
967 * @filp:	the file to read
968 * @ppos:	current file position
969 * @desc:	read_descriptor
970 * @actor:	read method
971 *
972 * This is a generic file read routine, and uses the
973 * mapping->a_ops->readpage() function for the actual low-level stuff.
974 *
975 * This is really ugly. But the goto's actually try to clarify some
976 * of the logic when it comes to error handling etc.
977 */
978static void do_generic_file_read(struct file *filp, loff_t *ppos,
979		read_descriptor_t *desc, read_actor_t actor)
980{
981	struct address_space *mapping = filp->f_mapping;
982	struct inode *inode = mapping->host;
983	struct file_ra_state *ra = &filp->f_ra;
984	pgoff_t index;
985	pgoff_t last_index;
986	pgoff_t prev_index;
987	unsigned long offset;      /* offset into pagecache page */
988	unsigned int prev_offset;
989	int error;
990
991	index = *ppos >> PAGE_CACHE_SHIFT;
992	prev_index = ra->prev_pos >> PAGE_CACHE_SHIFT;
993	prev_offset = ra->prev_pos & (PAGE_CACHE_SIZE-1);
994	last_index = (*ppos + desc->count + PAGE_CACHE_SIZE-1) >> PAGE_CACHE_SHIFT;
995	offset = *ppos & ~PAGE_CACHE_MASK;
996
997	for (;;) {
998		struct page *page;
999		pgoff_t end_index;
1000		loff_t isize;
1001		unsigned long nr, ret;
1002
1003		cond_resched();
1004find_page:
1005		page = find_get_page(mapping, index);
1006		if (!page) {
1007			page_cache_sync_readahead(mapping,
1008					ra, filp,
1009					index, last_index - index);
1010			page = find_get_page(mapping, index);
1011			if (unlikely(page == NULL))
1012				goto no_cached_page;
1013		}
1014		if (PageReadahead(page)) {
1015			page_cache_async_readahead(mapping,
1016					ra, filp, page,
1017					index, last_index - index);
1018		}
1019		if (!PageUptodate(page)) {
1020			if (inode->i_blkbits == PAGE_CACHE_SHIFT ||
1021					!mapping->a_ops->is_partially_uptodate)
1022				goto page_not_up_to_date;
1023			if (!trylock_page(page))
1024				goto page_not_up_to_date;
1025			if (!mapping->a_ops->is_partially_uptodate(page,
1026								desc, offset))
1027				goto page_not_up_to_date_locked;
1028			unlock_page(page);
1029		}
1030page_ok:
1031		/*
1032		 * i_size must be checked after we know the page is Uptodate.
1033		 *
1034		 * Checking i_size after the check allows us to calculate
1035		 * the correct value for "nr", which means the zero-filled
1036		 * part of the page is not copied back to userspace (unless
1037		 * another truncate extends the file - this is desired though).
1038		 */
1039
1040		isize = i_size_read(inode);
1041		end_index = (isize - 1) >> PAGE_CACHE_SHIFT;
1042		if (unlikely(!isize || index > end_index)) {
1043			page_cache_release(page);
1044			goto out;
1045		}
1046
1047		/* nr is the maximum number of bytes to copy from this page */
1048		nr = PAGE_CACHE_SIZE;
1049		if (index == end_index) {
1050			nr = ((isize - 1) & ~PAGE_CACHE_MASK) + 1;
1051			if (nr <= offset) {
1052				page_cache_release(page);
1053				goto out;
1054			}
1055		}
1056		nr = nr - offset;
1057
1058		/* If users can be writing to this page using arbitrary
1059		 * virtual addresses, take care about potential aliasing
1060		 * before reading the page on the kernel side.
1061		 */
1062		if (mapping_writably_mapped(mapping))
1063			flush_dcache_page(page);
1064
1065		/*
1066		 * When a sequential read accesses a page several times,
1067		 * only mark it as accessed the first time.
1068		 */
1069		if (prev_index != index || offset != prev_offset)
1070			mark_page_accessed(page);
1071		prev_index = index;
1072
1073		/*
1074		 * Ok, we have the page, and it's up-to-date, so
1075		 * now we can copy it to user space...
1076		 *
1077		 * The actor routine returns how many bytes were actually used..
1078		 * NOTE! This may not be the same as how much of a user buffer
1079		 * we filled up (we may be padding etc), so we can only update
1080		 * "pos" here (the actor routine has to update the user buffer
1081		 * pointers and the remaining count).
1082		 */
1083		ret = actor(desc, page, offset, nr);
1084		offset += ret;
1085		index += offset >> PAGE_CACHE_SHIFT;
1086		offset &= ~PAGE_CACHE_MASK;
1087		prev_offset = offset;
1088
1089		page_cache_release(page);
1090		if (ret == nr && desc->count)
1091			continue;
1092		goto out;
1093
1094page_not_up_to_date:
1095		/* Get exclusive access to the page ... */
1096		error = lock_page_killable(page);
1097		if (unlikely(error))
1098			goto readpage_error;
1099
1100page_not_up_to_date_locked:
1101		/* Did it get truncated before we got the lock? */
1102		if (!page->mapping) {
1103			unlock_page(page);
1104			page_cache_release(page);
1105			continue;
1106		}
1107
1108		/* Did somebody else fill it already? */
1109		if (PageUptodate(page)) {
1110			unlock_page(page);
1111			goto page_ok;
1112		}
1113
1114readpage:
1115		/* Start the actual read. The read will unlock the page. */
1116		error = mapping->a_ops->readpage(filp, page);
1117
1118		if (unlikely(error)) {
1119			if (error == AOP_TRUNCATED_PAGE) {
1120				page_cache_release(page);
1121				goto find_page;
1122			}
1123			goto readpage_error;
1124		}
1125
1126		if (!PageUptodate(page)) {
1127			error = lock_page_killable(page);
1128			if (unlikely(error))
1129				goto readpage_error;
1130			if (!PageUptodate(page)) {
1131				if (page->mapping == NULL) {
1132					/*
1133					 * invalidate_inode_pages got it
1134					 */
1135					unlock_page(page);
1136					page_cache_release(page);
1137					goto find_page;
1138				}
1139				unlock_page(page);
1140				shrink_readahead_size_eio(filp, ra);
1141				error = -EIO;
1142				goto readpage_error;
1143			}
1144			unlock_page(page);
1145		}
1146
1147		goto page_ok;
1148
1149readpage_error:
1150		/* UHHUH! A synchronous read error occurred. Report it */
1151		desc->error = error;
1152		page_cache_release(page);
1153		goto out;
1154
1155no_cached_page:
1156		/*
1157		 * Ok, it wasn't cached, so we need to create a new
1158		 * page..
1159		 */
1160		page = page_cache_alloc_cold(mapping);
1161		if (!page) {
1162			desc->error = -ENOMEM;
1163			goto out;
1164		}
1165		error = add_to_page_cache_lru(page, mapping,
1166						index, GFP_KERNEL);
1167		if (error) {
1168			page_cache_release(page);
1169			if (error == -EEXIST)
1170				goto find_page;
1171			desc->error = error;
1172			goto out;
1173		}
1174		goto readpage;
1175	}
1176
1177out:
1178	ra->prev_pos = prev_index;
1179	ra->prev_pos <<= PAGE_CACHE_SHIFT;
1180	ra->prev_pos |= prev_offset;
1181
1182	*ppos = ((loff_t)index << PAGE_CACHE_SHIFT) + offset;
1183	file_accessed(filp);
1184}
1185
1186int file_read_actor(read_descriptor_t *desc, struct page *page,
1187			unsigned long offset, unsigned long size)
1188{
1189	char *kaddr;
1190	unsigned long left, count = desc->count;
1191
1192	if (size > count)
1193		size = count;
1194
1195	/*
1196	 * Faults on the destination of a read are common, so do it before
1197	 * taking the kmap.
1198	 */
1199	if (!fault_in_pages_writeable(desc->arg.buf, size)) {
1200		kaddr = kmap_atomic(page, KM_USER0);
1201		left = __copy_to_user_inatomic(desc->arg.buf,
1202						kaddr + offset, size);
1203		kunmap_atomic(kaddr, KM_USER0);
1204		if (left == 0)
1205			goto success;
1206	}
1207
1208	/* Do it the slow way */
1209	kaddr = kmap(page);
1210	left = __copy_to_user(desc->arg.buf, kaddr + offset, size);
1211	kunmap(page);
1212
1213	if (left) {
1214		size -= left;
1215		desc->error = -EFAULT;
1216	}
1217success:
1218	desc->count = count - size;
1219	desc->written += size;
1220	desc->arg.buf += size;
1221	return size;
1222}
1223
1224/*
1225 * Performs necessary checks before doing a write
1226 * @iov:	io vector request
1227 * @nr_segs:	number of segments in the iovec
1228 * @count:	number of bytes to write
1229 * @access_flags: type of access: %VERIFY_READ or %VERIFY_WRITE
1230 *
1231 * Adjust number of segments and amount of bytes to write (nr_segs should be
1232 * properly initialized first). Returns appropriate error code that caller
1233 * should return or zero in case that write should be allowed.
1234 */
1235int generic_segment_checks(const struct iovec *iov,
1236			unsigned long *nr_segs, size_t *count, int access_flags)
1237{
1238	unsigned long   seg;
1239	size_t cnt = 0;
1240	for (seg = 0; seg < *nr_segs; seg++) {
1241		const struct iovec *iv = &iov[seg];
1242
1243		/*
1244		 * If any segment has a negative length, or the cumulative
1245		 * length ever wraps negative then return -EINVAL.
1246		 */
1247		cnt += iv->iov_len;
1248		if (unlikely((ssize_t)(cnt|iv->iov_len) < 0))
1249			return -EINVAL;
1250		if (access_ok(access_flags, iv->iov_base, iv->iov_len))
1251			continue;
1252		if (seg == 0)
1253			return -EFAULT;
1254		*nr_segs = seg;
1255		cnt -= iv->iov_len;	/* This segment is no good */
1256		break;
1257	}
1258	*count = cnt;
1259	return 0;
1260}
1261EXPORT_SYMBOL(generic_segment_checks);
1262
1263/**
1264 * generic_file_aio_read - generic filesystem read routine
1265 * @iocb:	kernel I/O control block
1266 * @iov:	io vector request
1267 * @nr_segs:	number of segments in the iovec
1268 * @pos:	current file position
1269 *
1270 * This is the "read()" routine for all filesystems
1271 * that can use the page cache directly.
1272 */
1273ssize_t
1274generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov,
1275		unsigned long nr_segs, loff_t pos)
1276{
1277	struct file *filp = iocb->ki_filp;
1278	ssize_t retval;
1279	unsigned long seg;
1280	size_t count;
1281	loff_t *ppos = &iocb->ki_pos;
1282
1283	count = 0;
1284	retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE);
1285	if (retval)
1286		return retval;
1287
1288	/* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
1289	if (filp->f_flags & O_DIRECT) {
1290		loff_t size;
1291		struct address_space *mapping;
1292		struct inode *inode;
1293
1294		mapping = filp->f_mapping;
1295		inode = mapping->host;
1296		if (!count)
1297			goto out; /* skip atime */
1298		size = i_size_read(inode);
1299		if (pos < size) {
1300			retval = filemap_write_and_wait_range(mapping, pos,
1301					pos + iov_length(iov, nr_segs) - 1);
1302			if (!retval) {
1303				retval = mapping->a_ops->direct_IO(READ, iocb,
1304							iov, pos, nr_segs);
1305			}
1306			if (retval > 0)
1307				*ppos = pos + retval;
1308			if (retval) {
1309				file_accessed(filp);
1310				goto out;
1311			}
1312		}
1313	}
1314
1315	for (seg = 0; seg < nr_segs; seg++) {
1316		read_descriptor_t desc;
1317
1318		desc.written = 0;
1319		desc.arg.buf = iov[seg].iov_base;
1320		desc.count = iov[seg].iov_len;
1321		if (desc.count == 0)
1322			continue;
1323		desc.error = 0;
1324		do_generic_file_read(filp, ppos, &desc, file_read_actor);
1325		retval += desc.written;
1326		if (desc.error) {
1327			retval = retval ?: desc.error;
1328			break;
1329		}
1330		if (desc.count > 0)
1331			break;
1332	}
1333out:
1334	return retval;
1335}
1336EXPORT_SYMBOL(generic_file_aio_read);
1337
1338static ssize_t
1339do_readahead(struct address_space *mapping, struct file *filp,
1340	     pgoff_t index, unsigned long nr)
1341{
1342	if (!mapping || !mapping->a_ops || !mapping->a_ops->readpage)
1343		return -EINVAL;
1344
1345	force_page_cache_readahead(mapping, filp, index, nr);
1346	return 0;
1347}
1348
1349SYSCALL_DEFINE(readahead)(int fd, loff_t offset, size_t count)
1350{
1351	ssize_t ret;
1352	struct file *file;
1353
1354	ret = -EBADF;
1355	file = fget(fd);
1356	if (file) {
1357		if (file->f_mode & FMODE_READ) {
1358			struct address_space *mapping = file->f_mapping;
1359			pgoff_t start = offset >> PAGE_CACHE_SHIFT;
1360			pgoff_t end = (offset + count - 1) >> PAGE_CACHE_SHIFT;
1361			unsigned long len = end - start + 1;
1362			ret = do_readahead(mapping, file, start, len);
1363		}
1364		fput(file);
1365	}
1366	return ret;
1367}
1368#ifdef CONFIG_HAVE_SYSCALL_WRAPPERS
1369asmlinkage long SyS_readahead(long fd, loff_t offset, long count)
1370{
1371	return SYSC_readahead((int) fd, offset, (size_t) count);
1372}
1373SYSCALL_ALIAS(sys_readahead, SyS_readahead);
1374#endif
1375
1376#ifdef CONFIG_MMU
1377/**
1378 * page_cache_read - adds requested page to the page cache if not already there
1379 * @file:	file to read
1380 * @offset:	page index
1381 *
1382 * This adds the requested page to the page cache if it isn't already there,
1383 * and schedules an I/O to read in its contents from disk.
1384 */
1385static int page_cache_read(struct file *file, pgoff_t offset)
1386{
1387	struct address_space *mapping = file->f_mapping;
1388	struct page *page;
1389	int ret;
1390
1391	do {
1392		page = page_cache_alloc_cold(mapping);
1393		if (!page)
1394			return -ENOMEM;
1395
1396		ret = add_to_page_cache_lru(page, mapping, offset, GFP_KERNEL);
1397		if (ret == 0)
1398			ret = mapping->a_ops->readpage(file, page);
1399		else if (ret == -EEXIST)
1400			ret = 0; /* losing race to add is OK */
1401
1402		page_cache_release(page);
1403
1404	} while (ret == AOP_TRUNCATED_PAGE);
1405
1406	return ret;
1407}
1408
1409#define MMAP_LOTSAMISS  (100)
1410
1411/*
1412 * Synchronous readahead happens when we don't even find
1413 * a page in the page cache at all.
1414 */
1415static void do_sync_mmap_readahead(struct vm_area_struct *vma,
1416				   struct file_ra_state *ra,
1417				   struct file *file,
1418				   pgoff_t offset)
1419{
1420	unsigned long ra_pages;
1421	struct address_space *mapping = file->f_mapping;
1422
1423	/* If we don't want any read-ahead, don't bother */
1424	if (VM_RandomReadHint(vma))
1425		return;
1426
1427	if (VM_SequentialReadHint(vma) ||
1428			offset - 1 == (ra->prev_pos >> PAGE_CACHE_SHIFT)) {
1429		page_cache_sync_readahead(mapping, ra, file, offset,
1430					  ra->ra_pages);
1431		return;
1432	}
1433
1434	if (ra->mmap_miss < INT_MAX)
1435		ra->mmap_miss++;
1436
1437	/*
1438	 * Do we miss much more than hit in this file? If so,
1439	 * stop bothering with read-ahead. It will only hurt.
1440	 */
1441	if (ra->mmap_miss > MMAP_LOTSAMISS)
1442		return;
1443
1444	/*
1445	 * mmap read-around
1446	 */
1447	ra_pages = max_sane_readahead(ra->ra_pages);
1448	if (ra_pages) {
1449		ra->start = max_t(long, 0, offset - ra_pages/2);
1450		ra->size = ra_pages;
1451		ra->async_size = 0;
1452		ra_submit(ra, mapping, file);
1453	}
1454}
1455
1456/*
1457 * Asynchronous readahead happens when we find the page and PG_readahead,
1458 * so we want to possibly extend the readahead further..
1459 */
1460static void do_async_mmap_readahead(struct vm_area_struct *vma,
1461				    struct file_ra_state *ra,
1462				    struct file *file,
1463				    struct page *page,
1464				    pgoff_t offset)
1465{
1466	struct address_space *mapping = file->f_mapping;
1467
1468	/* If we don't want any read-ahead, don't bother */
1469	if (VM_RandomReadHint(vma))
1470		return;
1471	if (ra->mmap_miss > 0)
1472		ra->mmap_miss--;
1473	if (PageReadahead(page))
1474		page_cache_async_readahead(mapping, ra, file,
1475					   page, offset, ra->ra_pages);
1476}
1477
1478/**
1479 * filemap_fault - read in file data for page fault handling
1480 * @vma:	vma in which the fault was taken
1481 * @vmf:	struct vm_fault containing details of the fault
1482 *
1483 * filemap_fault() is invoked via the vma operations vector for a
1484 * mapped memory region to read in file data during a page fault.
1485 *
1486 * The goto's are kind of ugly, but this streamlines the normal case of having
1487 * it in the page cache, and handles the special cases reasonably without
1488 * having a lot of duplicated code.
1489 */
1490int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
1491{
1492	int error;
1493	struct file *file = vma->vm_file;
1494	struct address_space *mapping = file->f_mapping;
1495	struct file_ra_state *ra = &file->f_ra;
1496	struct inode *inode = mapping->host;
1497	pgoff_t offset = vmf->pgoff;
1498	struct page *page;
1499	pgoff_t size;
1500	int ret = 0;
1501
1502	size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
1503	if (offset >= size)
1504		return VM_FAULT_SIGBUS;
1505
1506	/*
1507	 * Do we have something in the page cache already?
1508	 */
1509	page = find_get_page(mapping, offset);
1510	if (likely(page)) {
1511		/*
1512		 * We found the page, so try async readahead before
1513		 * waiting for the lock.
1514		 */
1515		do_async_mmap_readahead(vma, ra, file, page, offset);
1516		lock_page(page);
1517
1518		/* Did it get truncated? */
1519		if (unlikely(page->mapping != mapping)) {
1520			unlock_page(page);
1521			put_page(page);
1522			goto no_cached_page;
1523		}
1524	} else {
1525		/* No page in the page cache at all */
1526		do_sync_mmap_readahead(vma, ra, file, offset);
1527		count_vm_event(PGMAJFAULT);
1528		ret = VM_FAULT_MAJOR;
1529retry_find:
1530		page = find_lock_page(mapping, offset);
1531		if (!page)
1532			goto no_cached_page;
1533	}
1534
1535	/*
1536	 * We have a locked page in the page cache, now we need to check
1537	 * that it's up-to-date. If not, it is going to be due to an error.
1538	 */
1539	if (unlikely(!PageUptodate(page)))
1540		goto page_not_uptodate;
1541
1542	/*
1543	 * Found the page and have a reference on it.
1544	 * We must recheck i_size under page lock.
1545	 */
1546	size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
1547	if (unlikely(offset >= size)) {
1548		unlock_page(page);
1549		page_cache_release(page);
1550		return VM_FAULT_SIGBUS;
1551	}
1552
1553	ra->prev_pos = (loff_t)offset << PAGE_CACHE_SHIFT;
1554	vmf->page = page;
1555	return ret | VM_FAULT_LOCKED;
1556
1557no_cached_page:
1558	/*
1559	 * We're only likely to ever get here if MADV_RANDOM is in
1560	 * effect.
1561	 */
1562	error = page_cache_read(file, offset);
1563
1564	/*
1565	 * The page we want has now been added to the page cache.
1566	 * In the unlikely event that someone removed it in the
1567	 * meantime, we'll just come back here and read it again.
1568	 */
1569	if (error >= 0)
1570		goto retry_find;
1571
1572	/*
1573	 * An error return from page_cache_read can result if the
1574	 * system is low on memory, or a problem occurs while trying
1575	 * to schedule I/O.
1576	 */
1577	if (error == -ENOMEM)
1578		return VM_FAULT_OOM;
1579	return VM_FAULT_SIGBUS;
1580
1581page_not_uptodate:
1582	/*
1583	 * Umm, take care of errors if the page isn't up-to-date.
1584	 * Try to re-read it _once_. We do this synchronously,
1585	 * because there really aren't any performance issues here
1586	 * and we need to check for errors.
1587	 */
1588	ClearPageError(page);
1589	error = mapping->a_ops->readpage(file, page);
1590	if (!error) {
1591		wait_on_page_locked(page);
1592		if (!PageUptodate(page))
1593			error = -EIO;
1594	}
1595	page_cache_release(page);
1596
1597	if (!error || error == AOP_TRUNCATED_PAGE)
1598		goto retry_find;
1599
1600	/* Things didn't work out. Return zero to tell the mm layer so. */
1601	shrink_readahead_size_eio(file, ra);
1602	return VM_FAULT_SIGBUS;
1603}
1604EXPORT_SYMBOL(filemap_fault);
1605
1606struct vm_operations_struct generic_file_vm_ops = {
1607	.fault		= filemap_fault,
1608};
1609
1610/* This is used for a general mmap of a disk file */
1611
1612int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
1613{
1614	struct address_space *mapping = file->f_mapping;
1615
1616	if (!mapping->a_ops->readpage)
1617		return -ENOEXEC;
1618	file_accessed(file);
1619	vma->vm_ops = &generic_file_vm_ops;
1620	vma->vm_flags |= VM_CAN_NONLINEAR;
1621	return 0;
1622}
1623
1624/*
1625 * This is for filesystems which do not implement ->writepage.
1626 */
1627int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma)
1628{
1629	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE))
1630		return -EINVAL;
1631	return generic_file_mmap(file, vma);
1632}
1633#else
1634int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
1635{
1636	return -ENOSYS;
1637}
1638int generic_file_readonly_mmap(struct file * file, struct vm_area_struct * vma)
1639{
1640	return -ENOSYS;
1641}
1642#endif /* CONFIG_MMU */
1643
1644EXPORT_SYMBOL(generic_file_mmap);
1645EXPORT_SYMBOL(generic_file_readonly_mmap);
1646
1647static struct page *__read_cache_page(struct address_space *mapping,
1648				pgoff_t index,
1649				int (*filler)(void *,struct page*),
1650				void *data)
1651{
1652	struct page *page;
1653	int err;
1654repeat:
1655	page = find_get_page(mapping, index);
1656	if (!page) {
1657		page = page_cache_alloc_cold(mapping);
1658		if (!page)
1659			return ERR_PTR(-ENOMEM);
1660		err = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL);
1661		if (unlikely(err)) {
1662			page_cache_release(page);
1663			if (err == -EEXIST)
1664				goto repeat;
1665			/* Presumably ENOMEM for radix tree node */
1666			return ERR_PTR(err);
1667		}
1668		err = filler(data, page);
1669		if (err < 0) {
1670			page_cache_release(page);
1671			page = ERR_PTR(err);
1672		}
1673	}
1674	return page;
1675}
1676
1677/**
1678 * read_cache_page_async - read into page cache, fill it if needed
1679 * @mapping:	the page's address_space
1680 * @index:	the page index
1681 * @filler:	function to perform the read
1682 * @data:	destination for read data
1683 *
1684 * Same as read_cache_page, but don't wait for page to become unlocked
1685 * after submitting it to the filler.
1686 *
1687 * Read into the page cache. If a page already exists, and PageUptodate() is
1688 * not set, try to fill the page but don't wait for it to become unlocked.
1689 *
1690 * If the page does not get brought uptodate, return -EIO.
1691 */
1692struct page *read_cache_page_async(struct address_space *mapping,
1693				pgoff_t index,
1694				int (*filler)(void *,struct page*),
1695				void *data)
1696{
1697	struct page *page;
1698	int err;
1699
1700retry:
1701	page = __read_cache_page(mapping, index, filler, data);
1702	if (IS_ERR(page))
1703		return page;
1704	if (PageUptodate(page))
1705		goto out;
1706
1707	lock_page(page);
1708	if (!page->mapping) {
1709		unlock_page(page);
1710		page_cache_release(page);
1711		goto retry;
1712	}
1713	if (PageUptodate(page)) {
1714		unlock_page(page);
1715		goto out;
1716	}
1717	err = filler(data, page);
1718	if (err < 0) {
1719		page_cache_release(page);
1720		return ERR_PTR(err);
1721	}
1722out:
1723	mark_page_accessed(page);
1724	return page;
1725}
1726EXPORT_SYMBOL(read_cache_page_async);
1727
1728/**
1729 * read_cache_page - read into page cache, fill it if needed
1730 * @mapping:	the page's address_space
1731 * @index:	the page index
1732 * @filler:	function to perform the read
1733 * @data:	destination for read data
1734 *
1735 * Read into the page cache. If a page already exists, and PageUptodate() is
1736 * not set, try to fill the page then wait for it to become unlocked.
1737 *
1738 * If the page does not get brought uptodate, return -EIO.
1739 */
1740struct page *read_cache_page(struct address_space *mapping,
1741				pgoff_t index,
1742				int (*filler)(void *,struct page*),
1743				void *data)
1744{
1745	struct page *page;
1746
1747	page = read_cache_page_async(mapping, index, filler, data);
1748	if (IS_ERR(page))
1749		goto out;
1750	wait_on_page_locked(page);
1751	if (!PageUptodate(page)) {
1752		page_cache_release(page);
1753		page = ERR_PTR(-EIO);
1754	}
1755 out:
1756	return page;
1757}
1758EXPORT_SYMBOL(read_cache_page);
1759
1760/*
1761 * The logic we want is
1762 *
1763 *	if suid or (sgid and xgrp)
1764 *		remove privs
1765 */
1766int should_remove_suid(struct dentry *dentry)
1767{
1768	mode_t mode = dentry->d_inode->i_mode;
1769	int kill = 0;
1770
1771	/* suid always must be killed */
1772	if (unlikely(mode & S_ISUID))
1773		kill = ATTR_KILL_SUID;
1774
1775	/*
1776	 * sgid without any exec bits is just a mandatory locking mark; leave
1777	 * it alone.  If some exec bits are set, it's a real sgid; kill it.
1778	 */
1779	if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
1780		kill |= ATTR_KILL_SGID;
1781
1782	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
1783		return kill;
1784
1785	return 0;
1786}
1787EXPORT_SYMBOL(should_remove_suid);
1788
1789static int __remove_suid(struct dentry *dentry, int kill)
1790{
1791	struct iattr newattrs;
1792
1793	newattrs.ia_valid = ATTR_FORCE | kill;
1794	return notify_change(dentry, &newattrs);
1795}
1796
1797int file_remove_suid(struct file *file)
1798{
1799	struct dentry *dentry = file->f_path.dentry;
1800	int killsuid = should_remove_suid(dentry);
1801	int killpriv = security_inode_need_killpriv(dentry);
1802	int error = 0;
1803
1804	if (killpriv < 0)
1805		return killpriv;
1806	if (killpriv)
1807		error = security_inode_killpriv(dentry);
1808	if (!error && killsuid)
1809		error = __remove_suid(dentry, killsuid);
1810
1811	return error;
1812}
1813EXPORT_SYMBOL(file_remove_suid);
1814
1815static size_t __iovec_copy_from_user_inatomic(char *vaddr,
1816			const struct iovec *iov, size_t base, size_t bytes)
1817{
1818	size_t copied = 0, left = 0;
1819
1820	while (bytes) {
1821		char __user *buf = iov->iov_base + base;
1822		int copy = min(bytes, iov->iov_len - base);
1823
1824		base = 0;
1825		left = __copy_from_user_inatomic(vaddr, buf, copy);
1826		copied += copy;
1827		bytes -= copy;
1828		vaddr += copy;
1829		iov++;
1830
1831		if (unlikely(left))
1832			break;
1833	}
1834	return copied - left;
1835}
1836
1837/*
1838 * Copy as much as we can into the page and return the number of bytes which
1839 * were sucessfully copied.  If a fault is encountered then return the number of
1840 * bytes which were copied.
1841 */
1842size_t iov_iter_copy_from_user_atomic(struct page *page,
1843		struct iov_iter *i, unsigned long offset, size_t bytes)
1844{
1845	char *kaddr;
1846	size_t copied;
1847
1848	BUG_ON(!in_atomic());
1849	kaddr = kmap_atomic(page, KM_USER0);
1850	if (likely(i->nr_segs == 1)) {
1851		int left;
1852		char __user *buf = i->iov->iov_base + i->iov_offset;
1853		left = __copy_from_user_inatomic(kaddr + offset, buf, bytes);
1854		copied = bytes - left;
1855	} else {
1856		copied = __iovec_copy_from_user_inatomic(kaddr + offset,
1857						i->iov, i->iov_offset, bytes);
1858	}
1859	kunmap_atomic(kaddr, KM_USER0);
1860
1861	return copied;
1862}
1863EXPORT_SYMBOL(iov_iter_copy_from_user_atomic);
1864
1865/*
1866 * This has the same sideeffects and return value as
1867 * iov_iter_copy_from_user_atomic().
1868 * The difference is that it attempts to resolve faults.
1869 * Page must not be locked.
1870 */
1871size_t iov_iter_copy_from_user(struct page *page,
1872		struct iov_iter *i, unsigned long offset, size_t bytes)
1873{
1874	char *kaddr;
1875	size_t copied;
1876
1877	kaddr = kmap(page);
1878	if (likely(i->nr_segs == 1)) {
1879		int left;
1880		char __user *buf = i->iov->iov_base + i->iov_offset;
1881		left = __copy_from_user(kaddr + offset, buf, bytes);
1882		copied = bytes - left;
1883	} else {
1884		copied = __iovec_copy_from_user_inatomic(kaddr + offset,
1885						i->iov, i->iov_offset, bytes);
1886	}
1887	kunmap(page);
1888	return copied;
1889}
1890EXPORT_SYMBOL(iov_iter_copy_from_user);
1891
1892void iov_iter_advance(struct iov_iter *i, size_t bytes)
1893{
1894	BUG_ON(i->count < bytes);
1895
1896	if (likely(i->nr_segs == 1)) {
1897		i->iov_offset += bytes;
1898		i->count -= bytes;
1899	} else {
1900		const struct iovec *iov = i->iov;
1901		size_t base = i->iov_offset;
1902
1903		/*
1904		 * The !iov->iov_len check ensures we skip over unlikely
1905		 * zero-length segments (without overruning the iovec).
1906		 */
1907		while (bytes || unlikely(i->count && !iov->iov_len)) {
1908			int copy;
1909
1910			copy = min(bytes, iov->iov_len - base);
1911			BUG_ON(!i->count || i->count < copy);
1912			i->count -= copy;
1913			bytes -= copy;
1914			base += copy;
1915			if (iov->iov_len == base) {
1916				iov++;
1917				base = 0;
1918			}
1919		}
1920		i->iov = iov;
1921		i->iov_offset = base;
1922	}
1923}
1924EXPORT_SYMBOL(iov_iter_advance);
1925
1926/*
1927 * Fault in the first iovec of the given iov_iter, to a maximum length
1928 * of bytes. Returns 0 on success, or non-zero if the memory could not be
1929 * accessed (ie. because it is an invalid address).
1930 *
1931 * writev-intensive code may want this to prefault several iovecs -- that
1932 * would be possible (callers must not rely on the fact that _only_ the
1933 * first iovec will be faulted with the current implementation).
1934 */
1935int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
1936{
1937	char __user *buf = i->iov->iov_base + i->iov_offset;
1938	bytes = min(bytes, i->iov->iov_len - i->iov_offset);
1939	return fault_in_pages_readable(buf, bytes);
1940}
1941EXPORT_SYMBOL(iov_iter_fault_in_readable);
1942
1943/*
1944 * Return the count of just the current iov_iter segment.
1945 */
1946size_t iov_iter_single_seg_count(struct iov_iter *i)
1947{
1948	const struct iovec *iov = i->iov;
1949	if (i->nr_segs == 1)
1950		return i->count;
1951	else
1952		return min(i->count, iov->iov_len - i->iov_offset);
1953}
1954EXPORT_SYMBOL(iov_iter_single_seg_count);
1955
1956/*
1957 * Performs necessary checks before doing a write
1958 *
1959 * Can adjust writing position or amount of bytes to write.
1960 * Returns appropriate error code that caller should return or
1961 * zero in case that write should be allowed.
1962 */
1963inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, int isblk)
1964{
1965	struct inode *inode = file->f_mapping->host;
1966	unsigned long limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
1967
1968        if (unlikely(*pos < 0))
1969                return -EINVAL;
1970
1971	if (!isblk) {
1972		/* FIXME: this is for backwards compatibility with 2.4 */
1973		if (file->f_flags & O_APPEND)
1974                        *pos = i_size_read(inode);
1975
1976		if (limit != RLIM_INFINITY) {
1977			if (*pos >= limit) {
1978				send_sig(SIGXFSZ, current, 0);
1979				return -EFBIG;
1980			}
1981			if (*count > limit - (typeof(limit))*pos) {
1982				*count = limit - (typeof(limit))*pos;
1983			}
1984		}
1985	}
1986
1987	/*
1988	 * LFS rule
1989	 */
1990	if (unlikely(*pos + *count > MAX_NON_LFS &&
1991				!(file->f_flags & O_LARGEFILE))) {
1992		if (*pos >= MAX_NON_LFS) {
1993			return -EFBIG;
1994		}
1995		if (*count > MAX_NON_LFS - (unsigned long)*pos) {
1996			*count = MAX_NON_LFS - (unsigned long)*pos;
1997		}
1998	}
1999
2000	/*
2001	 * Are we about to exceed the fs block limit ?
2002	 *
2003	 * If we have written data it becomes a short write.  If we have
2004	 * exceeded without writing data we send a signal and return EFBIG.
2005	 * Linus frestrict idea will clean these up nicely..
2006	 */
2007	if (likely(!isblk)) {
2008		if (unlikely(*pos >= inode->i_sb->s_maxbytes)) {
2009			if (*count || *pos > inode->i_sb->s_maxbytes) {
2010				return -EFBIG;
2011			}
2012			/* zero-length writes at ->s_maxbytes are OK */
2013		}
2014
2015		if (unlikely(*pos + *count > inode->i_sb->s_maxbytes))
2016			*count = inode->i_sb->s_maxbytes - *pos;
2017	} else {
2018#ifdef CONFIG_BLOCK
2019		loff_t isize;
2020		if (bdev_read_only(I_BDEV(inode)))
2021			return -EPERM;
2022		isize = i_size_read(inode);
2023		if (*pos >= isize) {
2024			if (*count || *pos > isize)
2025				return -ENOSPC;
2026		}
2027
2028		if (*pos + *count > isize)
2029			*count = isize - *pos;
2030#else
2031		return -EPERM;
2032#endif
2033	}
2034	return 0;
2035}
2036EXPORT_SYMBOL(generic_write_checks);
2037
2038int pagecache_write_begin(struct file *file, struct address_space *mapping,
2039				loff_t pos, unsigned len, unsigned flags,
2040				struct page **pagep, void **fsdata)
2041{
2042	const struct address_space_operations *aops = mapping->a_ops;
2043
2044	return aops->write_begin(file, mapping, pos, len, flags,
2045							pagep, fsdata);
2046}
2047EXPORT_SYMBOL(pagecache_write_begin);
2048
2049int pagecache_write_end(struct file *file, struct address_space *mapping,
2050				loff_t pos, unsigned len, unsigned copied,
2051				struct page *page, void *fsdata)
2052{
2053	const struct address_space_operations *aops = mapping->a_ops;
2054
2055	mark_page_accessed(page);
2056	return aops->write_end(file, mapping, pos, len, copied, page, fsdata);
2057}
2058EXPORT_SYMBOL(pagecache_write_end);
2059
2060ssize_t
2061generic_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
2062		unsigned long *nr_segs, loff_t pos, loff_t *ppos,
2063		size_t count, size_t ocount)
2064{
2065	struct file	*file = iocb->ki_filp;
2066	struct address_space *mapping = file->f_mapping;
2067	struct inode	*inode = mapping->host;
2068	ssize_t		written;
2069	size_t		write_len;
2070	pgoff_t		end;
2071
2072	if (count != ocount)
2073		*nr_segs = iov_shorten((struct iovec *)iov, *nr_segs, count);
2074
2075	write_len = iov_length(iov, *nr_segs);
2076	end = (pos + write_len - 1) >> PAGE_CACHE_SHIFT;
2077
2078	written = filemap_write_and_wait_range(mapping, pos, pos + write_len - 1);
2079	if (written)
2080		goto out;
2081
2082	/*
2083	 * After a write we want buffered reads to be sure to go to disk to get
2084	 * the new data.  We invalidate clean cached page from the region we're
2085	 * about to write.  We do this *before* the write so that we can return
2086	 * without clobbering -EIOCBQUEUED from ->direct_IO().
2087	 */
2088	if (mapping->nrpages) {
2089		written = invalidate_inode_pages2_range(mapping,
2090					pos >> PAGE_CACHE_SHIFT, end);
2091		/*
2092		 * If a page can not be invalidated, return 0 to fall back
2093		 * to buffered write.
2094		 */
2095		if (written) {
2096			if (written == -EBUSY)
2097				return 0;
2098			goto out;
2099		}
2100	}
2101
2102	written = mapping->a_ops->direct_IO(WRITE, iocb, iov, pos, *nr_segs);
2103
2104	/*
2105	 * Finally, try again to invalidate clean pages which might have been
2106	 * cached by non-direct readahead, or faulted in by get_user_pages()
2107	 * if the source of the write was an mmap'ed region of the file
2108	 * we're writing.  Either one is a pretty crazy thing to do,
2109	 * so we don't support it 100%.  If this invalidation
2110	 * fails, tough, the write still worked...
2111	 */
2112	if (mapping->nrpages) {
2113		invalidate_inode_pages2_range(mapping,
2114					      pos >> PAGE_CACHE_SHIFT, end);
2115	}
2116
2117	if (written > 0) {
2118		loff_t end = pos + written;
2119		if (end > i_size_read(inode) && !S_ISBLK(inode->i_mode)) {
2120			i_size_write(inode,  end);
2121			mark_inode_dirty(inode);
2122		}
2123		*ppos = end;
2124	}
2125out:
2126	return written;
2127}
2128EXPORT_SYMBOL(generic_file_direct_write);
2129
2130/*
2131 * Find or create a page at the given pagecache position. Return the locked
2132 * page. This function is specifically for buffered writes.
2133 */
2134struct page *grab_cache_page_write_begin(struct address_space *mapping,
2135					pgoff_t index, unsigned flags)
2136{
2137	int status;
2138	struct page *page;
2139	gfp_t gfp_notmask = 0;
2140	if (flags & AOP_FLAG_NOFS)
2141		gfp_notmask = __GFP_FS;
2142repeat:
2143	page = find_lock_page(mapping, index);
2144	if (likely(page))
2145		return page;
2146
2147	page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~gfp_notmask);
2148	if (!page)
2149		return NULL;
2150	status = add_to_page_cache_lru(page, mapping, index,
2151						GFP_KERNEL & ~gfp_notmask);
2152	if (unlikely(status)) {
2153		page_cache_release(page);
2154		if (status == -EEXIST)
2155			goto repeat;
2156		return NULL;
2157	}
2158	return page;
2159}
2160EXPORT_SYMBOL(grab_cache_page_write_begin);
2161
2162static ssize_t generic_perform_write(struct file *file,
2163				struct iov_iter *i, loff_t pos)
2164{
2165	struct address_space *mapping = file->f_mapping;
2166	const struct address_space_operations *a_ops = mapping->a_ops;
2167	long status = 0;
2168	ssize_t written = 0;
2169	unsigned int flags = 0;
2170
2171	/*
2172	 * Copies from kernel address space cannot fail (NFSD is a big user).
2173	 */
2174	if (segment_eq(get_fs(), KERNEL_DS))
2175		flags |= AOP_FLAG_UNINTERRUPTIBLE;
2176
2177	do {
2178		struct page *page;
2179		pgoff_t index;		/* Pagecache index for current page */
2180		unsigned long offset;	/* Offset into pagecache page */
2181		unsigned long bytes;	/* Bytes to write to page */
2182		size_t copied;		/* Bytes copied from user */
2183		void *fsdata;
2184
2185		offset = (pos & (PAGE_CACHE_SIZE - 1));
2186		index = pos >> PAGE_CACHE_SHIFT;
2187		bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset,
2188						iov_iter_count(i));
2189
2190again:
2191
2192		/*
2193		 * Bring in the user page that we will copy from _first_.
2194		 * Otherwise there's a nasty deadlock on copying from the
2195		 * same page as we're writing to, without it being marked
2196		 * up-to-date.
2197		 *
2198		 * Not only is this an optimisation, but it is also required
2199		 * to check that the address is actually valid, when atomic
2200		 * usercopies are used, below.
2201		 */
2202		if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
2203			status = -EFAULT;
2204			break;
2205		}
2206
2207		status = a_ops->write_begin(file, mapping, pos, bytes, flags,
2208						&page, &fsdata);
2209		if (unlikely(status))
2210			break;
2211
2212		pagefault_disable();
2213		copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
2214		pagefault_enable();
2215		flush_dcache_page(page);
2216
2217		mark_page_accessed(page);
2218		status = a_ops->write_end(file, mapping, pos, bytes, copied,
2219						page, fsdata);
2220		if (unlikely(status < 0))
2221			break;
2222		copied = status;
2223
2224		cond_resched();
2225
2226		iov_iter_advance(i, copied);
2227		if (unlikely(copied == 0)) {
2228			/*
2229			 * If we were unable to copy any data at all, we must
2230			 * fall back to a single segment length write.
2231			 *
2232			 * If we didn't fallback here, we could livelock
2233			 * because not all segments in the iov can be copied at
2234			 * once without a pagefault.
2235			 */
2236			bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset,
2237						iov_iter_single_seg_count(i));
2238			goto again;
2239		}
2240		pos += copied;
2241		written += copied;
2242
2243		balance_dirty_pages_ratelimited(mapping);
2244
2245	} while (iov_iter_count(i));
2246
2247	return written ? written : status;
2248}
2249
2250ssize_t
2251generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov,
2252		unsigned long nr_segs, loff_t pos, loff_t *ppos,
2253		size_t count, ssize_t written)
2254{
2255	struct file *file = iocb->ki_filp;
2256	struct address_space *mapping = file->f_mapping;
2257	ssize_t status;
2258	struct iov_iter i;
2259
2260	iov_iter_init(&i, iov, nr_segs, count, written);
2261	status = generic_perform_write(file, &i, pos);
2262
2263	if (likely(status >= 0)) {
2264		written += status;
2265		*ppos = pos + status;
2266  	}
2267
2268	/*
2269	 * If we get here for O_DIRECT writes then we must have fallen through
2270	 * to buffered writes (block instantiation inside i_size).  So we sync
2271	 * the file data here, to try to honour O_DIRECT expectations.
2272	 */
2273	if (unlikely(file->f_flags & O_DIRECT) && written)
2274		status = filemap_write_and_wait_range(mapping,
2275					pos, pos + written - 1);
2276
2277	return written ? written : status;
2278}
2279EXPORT_SYMBOL(generic_file_buffered_write);
2280
2281/**
2282 * __generic_file_aio_write - write data to a file
2283 * @iocb:	IO state structure (file, offset, etc.)
2284 * @iov:	vector with data to write
2285 * @nr_segs:	number of segments in the vector
2286 * @ppos:	position where to write
2287 *
2288 * This function does all the work needed for actually writing data to a
2289 * file. It does all basic checks, removes SUID from the file, updates
2290 * modification times and calls proper subroutines depending on whether we
2291 * do direct IO or a standard buffered write.
2292 *
2293 * It expects i_mutex to be grabbed unless we work on a block device or similar
2294 * object which does not need locking at all.
2295 *
2296 * This function does *not* take care of syncing data in case of O_SYNC write.
2297 * A caller has to handle it. This is mainly due to the fact that we want to
2298 * avoid syncing under i_mutex.
2299 */
2300ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
2301				 unsigned long nr_segs, loff_t *ppos)
2302{
2303	struct file *file = iocb->ki_filp;
2304	struct address_space * mapping = file->f_mapping;
2305	size_t ocount;		/* original count */
2306	size_t count;		/* after file limit checks */
2307	struct inode 	*inode = mapping->host;
2308	loff_t		pos;
2309	ssize_t		written;
2310	ssize_t		err;
2311
2312	ocount = 0;
2313	err = generic_segment_checks(iov, &nr_segs, &ocount, VERIFY_READ);
2314	if (err)
2315		return err;
2316
2317	count = ocount;
2318	pos = *ppos;
2319
2320	vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
2321
2322	/* We can write back this queue in page reclaim */
2323	current->backing_dev_info = mapping->backing_dev_info;
2324	written = 0;
2325
2326	err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode));
2327	if (err)
2328		goto out;
2329
2330	if (count == 0)
2331		goto out;
2332
2333	err = file_remove_suid(file);
2334	if (err)
2335		goto out;
2336
2337	file_update_time(file);
2338
2339	/* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
2340	if (unlikely(file->f_flags & O_DIRECT)) {
2341		loff_t endbyte;
2342		ssize_t written_buffered;
2343
2344		written = generic_file_direct_write(iocb, iov, &nr_segs, pos,
2345							ppos, count, ocount);
2346		if (written < 0 || written == count)
2347			goto out;
2348		/*
2349		 * direct-io write to a hole: fall through to buffered I/O
2350		 * for completing the rest of the request.
2351		 */
2352		pos += written;
2353		count -= written;
2354		written_buffered = generic_file_buffered_write(iocb, iov,
2355						nr_segs, pos, ppos, count,
2356						written);
2357		/*
2358		 * If generic_file_buffered_write() retuned a synchronous error
2359		 * then we want to return the number of bytes which were
2360		 * direct-written, or the error code if that was zero.  Note
2361		 * that this differs from normal direct-io semantics, which
2362		 * will return -EFOO even if some bytes were written.
2363		 */
2364		if (written_buffered < 0) {
2365			err = written_buffered;
2366			goto out;
2367		}
2368
2369		/*
2370		 * We need to ensure that the page cache pages are written to
2371		 * disk and invalidated to preserve the expected O_DIRECT
2372		 * semantics.
2373		 */
2374		endbyte = pos + written_buffered - written - 1;
2375		err = do_sync_mapping_range(file->f_mapping, pos, endbyte,
2376					    SYNC_FILE_RANGE_WAIT_BEFORE|
2377					    SYNC_FILE_RANGE_WRITE|
2378					    SYNC_FILE_RANGE_WAIT_AFTER);
2379		if (err == 0) {
2380			written = written_buffered;
2381			invalidate_mapping_pages(mapping,
2382						 pos >> PAGE_CACHE_SHIFT,
2383						 endbyte >> PAGE_CACHE_SHIFT);
2384		} else {
2385			/*
2386			 * We don't know how much we wrote, so just return
2387			 * the number of bytes which were direct-written
2388			 */
2389		}
2390	} else {
2391		written = generic_file_buffered_write(iocb, iov, nr_segs,
2392				pos, ppos, count, written);
2393	}
2394out:
2395	current->backing_dev_info = NULL;
2396	return written ? written : err;
2397}
2398EXPORT_SYMBOL(__generic_file_aio_write);
2399
2400/**
2401 * generic_file_aio_write - write data to a file
2402 * @iocb:	IO state structure
2403 * @iov:	vector with data to write
2404 * @nr_segs:	number of segments in the vector
2405 * @pos:	position in file where to write
2406 *
2407 * This is a wrapper around __generic_file_aio_write() to be used by most
2408 * filesystems. It takes care of syncing the file in case of O_SYNC file
2409 * and acquires i_mutex as needed.
2410 */
2411ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
2412		unsigned long nr_segs, loff_t pos)
2413{
2414	struct file *file = iocb->ki_filp;
2415	struct inode *inode = file->f_mapping->host;
2416	ssize_t ret;
2417
2418	BUG_ON(iocb->ki_pos != pos);
2419
2420	mutex_lock(&inode->i_mutex);
2421	ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
2422	mutex_unlock(&inode->i_mutex);
2423
2424	if (ret > 0 || ret == -EIOCBQUEUED) {
2425		ssize_t err;
2426
2427		err = generic_write_sync(file, pos, ret);
2428		if (err < 0 && ret > 0)
2429			ret = err;
2430	}
2431	return ret;
2432}
2433EXPORT_SYMBOL(generic_file_aio_write);
2434
2435/**
2436 * try_to_release_page() - release old fs-specific metadata on a page
2437 *
2438 * @page: the page which the kernel is trying to free
2439 * @gfp_mask: memory allocation flags (and I/O mode)
2440 *
2441 * The address_space is to try to release any data against the page
2442 * (presumably at page->private).  If the release was successful, return `1'.
2443 * Otherwise return zero.
2444 *
2445 * This may also be called if PG_fscache is set on a page, indicating that the
2446 * page is known to the local caching routines.
2447 *
2448 * The @gfp_mask argument specifies whether I/O may be performed to release
2449 * this page (__GFP_IO), and whether the call may block (__GFP_WAIT & __GFP_FS).
2450 *
2451 */
2452int try_to_release_page(struct page *page, gfp_t gfp_mask)
2453{
2454	struct address_space * const mapping = page->mapping;
2455
2456	BUG_ON(!PageLocked(page));
2457	if (PageWriteback(page))
2458		return 0;
2459
2460	if (mapping && mapping->a_ops->releasepage)
2461		return mapping->a_ops->releasepage(page, gfp_mask);
2462	return try_to_free_buffers(page);
2463}
2464
2465EXPORT_SYMBOL(try_to_release_page);
2466