filemap.c revision 36e789144267105e0b3f2b9bca7db3184fce50dc
1/* 2 * linux/mm/filemap.c 3 * 4 * Copyright (C) 1994-1999 Linus Torvalds 5 */ 6 7/* 8 * This file handles the generic file mmap semantics used by 9 * most "normal" filesystems (but you don't /have/ to use this: 10 * the NFS filesystem used to do this differently, for example) 11 */ 12#include <linux/module.h> 13#include <linux/slab.h> 14#include <linux/compiler.h> 15#include <linux/fs.h> 16#include <linux/uaccess.h> 17#include <linux/aio.h> 18#include <linux/capability.h> 19#include <linux/kernel_stat.h> 20#include <linux/mm.h> 21#include <linux/swap.h> 22#include <linux/mman.h> 23#include <linux/pagemap.h> 24#include <linux/file.h> 25#include <linux/uio.h> 26#include <linux/hash.h> 27#include <linux/writeback.h> 28#include <linux/backing-dev.h> 29#include <linux/pagevec.h> 30#include <linux/blkdev.h> 31#include <linux/backing-dev.h> 32#include <linux/security.h> 33#include <linux/syscalls.h> 34#include <linux/cpuset.h> 35#include <linux/hardirq.h> /* for BUG_ON(!in_atomic()) only */ 36#include <linux/memcontrol.h> 37#include "internal.h" 38 39/* 40 * FIXME: remove all knowledge of the buffer layer from the core VM 41 */ 42#include <linux/buffer_head.h> /* for generic_osync_inode */ 43 44#include <asm/mman.h> 45 46static ssize_t 47generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov, 48 loff_t offset, unsigned long nr_segs); 49 50/* 51 * Shared mappings implemented 30.11.1994. It's not fully working yet, 52 * though. 53 * 54 * Shared mappings now work. 15.8.1995 Bruno. 55 * 56 * finished 'unifying' the page and buffer cache and SMP-threaded the 57 * page-cache, 21.05.1999, Ingo Molnar <mingo@redhat.com> 58 * 59 * SMP-threaded pagemap-LRU 1999, Andrea Arcangeli <andrea@suse.de> 60 */ 61 62/* 63 * Lock ordering: 64 * 65 * ->i_mmap_lock (vmtruncate) 66 * ->private_lock (__free_pte->__set_page_dirty_buffers) 67 * ->swap_lock (exclusive_swap_page, others) 68 * ->mapping->tree_lock 69 * 70 * ->i_mutex 71 * ->i_mmap_lock (truncate->unmap_mapping_range) 72 * 73 * ->mmap_sem 74 * ->i_mmap_lock 75 * ->page_table_lock or pte_lock (various, mainly in memory.c) 76 * ->mapping->tree_lock (arch-dependent flush_dcache_mmap_lock) 77 * 78 * ->mmap_sem 79 * ->lock_page (access_process_vm) 80 * 81 * ->i_mutex (generic_file_buffered_write) 82 * ->mmap_sem (fault_in_pages_readable->do_page_fault) 83 * 84 * ->i_mutex 85 * ->i_alloc_sem (various) 86 * 87 * ->inode_lock 88 * ->sb_lock (fs/fs-writeback.c) 89 * ->mapping->tree_lock (__sync_single_inode) 90 * 91 * ->i_mmap_lock 92 * ->anon_vma.lock (vma_adjust) 93 * 94 * ->anon_vma.lock 95 * ->page_table_lock or pte_lock (anon_vma_prepare and various) 96 * 97 * ->page_table_lock or pte_lock 98 * ->swap_lock (try_to_unmap_one) 99 * ->private_lock (try_to_unmap_one) 100 * ->tree_lock (try_to_unmap_one) 101 * ->zone.lru_lock (follow_page->mark_page_accessed) 102 * ->zone.lru_lock (check_pte_range->isolate_lru_page) 103 * ->private_lock (page_remove_rmap->set_page_dirty) 104 * ->tree_lock (page_remove_rmap->set_page_dirty) 105 * ->inode_lock (page_remove_rmap->set_page_dirty) 106 * ->inode_lock (zap_pte_range->set_page_dirty) 107 * ->private_lock (zap_pte_range->__set_page_dirty_buffers) 108 * 109 * ->task->proc_lock 110 * ->dcache_lock (proc_pid_lookup) 111 */ 112 113/* 114 * Remove a page from the page cache and free it. Caller has to make 115 * sure the page is locked and that nobody else uses it - or that usage 116 * is safe. The caller must hold a write_lock on the mapping's tree_lock. 117 */ 118void __remove_from_page_cache(struct page *page) 119{ 120 struct address_space *mapping = page->mapping; 121 122 mem_cgroup_uncharge_page(page); 123 radix_tree_delete(&mapping->page_tree, page->index); 124 page->mapping = NULL; 125 mapping->nrpages--; 126 __dec_zone_page_state(page, NR_FILE_PAGES); 127 BUG_ON(page_mapped(page)); 128 129 /* 130 * Some filesystems seem to re-dirty the page even after 131 * the VM has canceled the dirty bit (eg ext3 journaling). 132 * 133 * Fix it up by doing a final dirty accounting check after 134 * having removed the page entirely. 135 */ 136 if (PageDirty(page) && mapping_cap_account_dirty(mapping)) { 137 dec_zone_page_state(page, NR_FILE_DIRTY); 138 dec_bdi_stat(mapping->backing_dev_info, BDI_RECLAIMABLE); 139 } 140} 141 142void remove_from_page_cache(struct page *page) 143{ 144 struct address_space *mapping = page->mapping; 145 146 BUG_ON(!PageLocked(page)); 147 148 write_lock_irq(&mapping->tree_lock); 149 __remove_from_page_cache(page); 150 write_unlock_irq(&mapping->tree_lock); 151} 152 153static int sync_page(void *word) 154{ 155 struct address_space *mapping; 156 struct page *page; 157 158 page = container_of((unsigned long *)word, struct page, flags); 159 160 /* 161 * page_mapping() is being called without PG_locked held. 162 * Some knowledge of the state and use of the page is used to 163 * reduce the requirements down to a memory barrier. 164 * The danger here is of a stale page_mapping() return value 165 * indicating a struct address_space different from the one it's 166 * associated with when it is associated with one. 167 * After smp_mb(), it's either the correct page_mapping() for 168 * the page, or an old page_mapping() and the page's own 169 * page_mapping() has gone NULL. 170 * The ->sync_page() address_space operation must tolerate 171 * page_mapping() going NULL. By an amazing coincidence, 172 * this comes about because none of the users of the page 173 * in the ->sync_page() methods make essential use of the 174 * page_mapping(), merely passing the page down to the backing 175 * device's unplug functions when it's non-NULL, which in turn 176 * ignore it for all cases but swap, where only page_private(page) is 177 * of interest. When page_mapping() does go NULL, the entire 178 * call stack gracefully ignores the page and returns. 179 * -- wli 180 */ 181 smp_mb(); 182 mapping = page_mapping(page); 183 if (mapping && mapping->a_ops && mapping->a_ops->sync_page) 184 mapping->a_ops->sync_page(page); 185 io_schedule(); 186 return 0; 187} 188 189static int sync_page_killable(void *word) 190{ 191 sync_page(word); 192 return fatal_signal_pending(current) ? -EINTR : 0; 193} 194 195/** 196 * __filemap_fdatawrite_range - start writeback on mapping dirty pages in range 197 * @mapping: address space structure to write 198 * @start: offset in bytes where the range starts 199 * @end: offset in bytes where the range ends (inclusive) 200 * @sync_mode: enable synchronous operation 201 * 202 * Start writeback against all of a mapping's dirty pages that lie 203 * within the byte offsets <start, end> inclusive. 204 * 205 * If sync_mode is WB_SYNC_ALL then this is a "data integrity" operation, as 206 * opposed to a regular memory cleansing writeback. The difference between 207 * these two operations is that if a dirty page/buffer is encountered, it must 208 * be waited upon, and not just skipped over. 209 */ 210int __filemap_fdatawrite_range(struct address_space *mapping, loff_t start, 211 loff_t end, int sync_mode) 212{ 213 int ret; 214 struct writeback_control wbc = { 215 .sync_mode = sync_mode, 216 .nr_to_write = mapping->nrpages * 2, 217 .range_start = start, 218 .range_end = end, 219 }; 220 221 if (!mapping_cap_writeback_dirty(mapping)) 222 return 0; 223 224 ret = do_writepages(mapping, &wbc); 225 return ret; 226} 227 228static inline int __filemap_fdatawrite(struct address_space *mapping, 229 int sync_mode) 230{ 231 return __filemap_fdatawrite_range(mapping, 0, LLONG_MAX, sync_mode); 232} 233 234int filemap_fdatawrite(struct address_space *mapping) 235{ 236 return __filemap_fdatawrite(mapping, WB_SYNC_ALL); 237} 238EXPORT_SYMBOL(filemap_fdatawrite); 239 240static int filemap_fdatawrite_range(struct address_space *mapping, loff_t start, 241 loff_t end) 242{ 243 return __filemap_fdatawrite_range(mapping, start, end, WB_SYNC_ALL); 244} 245 246/** 247 * filemap_flush - mostly a non-blocking flush 248 * @mapping: target address_space 249 * 250 * This is a mostly non-blocking flush. Not suitable for data-integrity 251 * purposes - I/O may not be started against all dirty pages. 252 */ 253int filemap_flush(struct address_space *mapping) 254{ 255 return __filemap_fdatawrite(mapping, WB_SYNC_NONE); 256} 257EXPORT_SYMBOL(filemap_flush); 258 259/** 260 * wait_on_page_writeback_range - wait for writeback to complete 261 * @mapping: target address_space 262 * @start: beginning page index 263 * @end: ending page index 264 * 265 * Wait for writeback to complete against pages indexed by start->end 266 * inclusive 267 */ 268int wait_on_page_writeback_range(struct address_space *mapping, 269 pgoff_t start, pgoff_t end) 270{ 271 struct pagevec pvec; 272 int nr_pages; 273 int ret = 0; 274 pgoff_t index; 275 276 if (end < start) 277 return 0; 278 279 pagevec_init(&pvec, 0); 280 index = start; 281 while ((index <= end) && 282 (nr_pages = pagevec_lookup_tag(&pvec, mapping, &index, 283 PAGECACHE_TAG_WRITEBACK, 284 min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1)) != 0) { 285 unsigned i; 286 287 for (i = 0; i < nr_pages; i++) { 288 struct page *page = pvec.pages[i]; 289 290 /* until radix tree lookup accepts end_index */ 291 if (page->index > end) 292 continue; 293 294 wait_on_page_writeback(page); 295 if (PageError(page)) 296 ret = -EIO; 297 } 298 pagevec_release(&pvec); 299 cond_resched(); 300 } 301 302 /* Check for outstanding write errors */ 303 if (test_and_clear_bit(AS_ENOSPC, &mapping->flags)) 304 ret = -ENOSPC; 305 if (test_and_clear_bit(AS_EIO, &mapping->flags)) 306 ret = -EIO; 307 308 return ret; 309} 310 311/** 312 * sync_page_range - write and wait on all pages in the passed range 313 * @inode: target inode 314 * @mapping: target address_space 315 * @pos: beginning offset in pages to write 316 * @count: number of bytes to write 317 * 318 * Write and wait upon all the pages in the passed range. This is a "data 319 * integrity" operation. It waits upon in-flight writeout before starting and 320 * waiting upon new writeout. If there was an IO error, return it. 321 * 322 * We need to re-take i_mutex during the generic_osync_inode list walk because 323 * it is otherwise livelockable. 324 */ 325int sync_page_range(struct inode *inode, struct address_space *mapping, 326 loff_t pos, loff_t count) 327{ 328 pgoff_t start = pos >> PAGE_CACHE_SHIFT; 329 pgoff_t end = (pos + count - 1) >> PAGE_CACHE_SHIFT; 330 int ret; 331 332 if (!mapping_cap_writeback_dirty(mapping) || !count) 333 return 0; 334 ret = filemap_fdatawrite_range(mapping, pos, pos + count - 1); 335 if (ret == 0) { 336 mutex_lock(&inode->i_mutex); 337 ret = generic_osync_inode(inode, mapping, OSYNC_METADATA); 338 mutex_unlock(&inode->i_mutex); 339 } 340 if (ret == 0) 341 ret = wait_on_page_writeback_range(mapping, start, end); 342 return ret; 343} 344EXPORT_SYMBOL(sync_page_range); 345 346/** 347 * sync_page_range_nolock 348 * @inode: target inode 349 * @mapping: target address_space 350 * @pos: beginning offset in pages to write 351 * @count: number of bytes to write 352 * 353 * Note: Holding i_mutex across sync_page_range_nolock() is not a good idea 354 * as it forces O_SYNC writers to different parts of the same file 355 * to be serialised right until io completion. 356 */ 357int sync_page_range_nolock(struct inode *inode, struct address_space *mapping, 358 loff_t pos, loff_t count) 359{ 360 pgoff_t start = pos >> PAGE_CACHE_SHIFT; 361 pgoff_t end = (pos + count - 1) >> PAGE_CACHE_SHIFT; 362 int ret; 363 364 if (!mapping_cap_writeback_dirty(mapping) || !count) 365 return 0; 366 ret = filemap_fdatawrite_range(mapping, pos, pos + count - 1); 367 if (ret == 0) 368 ret = generic_osync_inode(inode, mapping, OSYNC_METADATA); 369 if (ret == 0) 370 ret = wait_on_page_writeback_range(mapping, start, end); 371 return ret; 372} 373EXPORT_SYMBOL(sync_page_range_nolock); 374 375/** 376 * filemap_fdatawait - wait for all under-writeback pages to complete 377 * @mapping: address space structure to wait for 378 * 379 * Walk the list of under-writeback pages of the given address space 380 * and wait for all of them. 381 */ 382int filemap_fdatawait(struct address_space *mapping) 383{ 384 loff_t i_size = i_size_read(mapping->host); 385 386 if (i_size == 0) 387 return 0; 388 389 return wait_on_page_writeback_range(mapping, 0, 390 (i_size - 1) >> PAGE_CACHE_SHIFT); 391} 392EXPORT_SYMBOL(filemap_fdatawait); 393 394int filemap_write_and_wait(struct address_space *mapping) 395{ 396 int err = 0; 397 398 if (mapping->nrpages) { 399 err = filemap_fdatawrite(mapping); 400 /* 401 * Even if the above returned error, the pages may be 402 * written partially (e.g. -ENOSPC), so we wait for it. 403 * But the -EIO is special case, it may indicate the worst 404 * thing (e.g. bug) happened, so we avoid waiting for it. 405 */ 406 if (err != -EIO) { 407 int err2 = filemap_fdatawait(mapping); 408 if (!err) 409 err = err2; 410 } 411 } 412 return err; 413} 414EXPORT_SYMBOL(filemap_write_and_wait); 415 416/** 417 * filemap_write_and_wait_range - write out & wait on a file range 418 * @mapping: the address_space for the pages 419 * @lstart: offset in bytes where the range starts 420 * @lend: offset in bytes where the range ends (inclusive) 421 * 422 * Write out and wait upon file offsets lstart->lend, inclusive. 423 * 424 * Note that `lend' is inclusive (describes the last byte to be written) so 425 * that this function can be used to write to the very end-of-file (end = -1). 426 */ 427int filemap_write_and_wait_range(struct address_space *mapping, 428 loff_t lstart, loff_t lend) 429{ 430 int err = 0; 431 432 if (mapping->nrpages) { 433 err = __filemap_fdatawrite_range(mapping, lstart, lend, 434 WB_SYNC_ALL); 435 /* See comment of filemap_write_and_wait() */ 436 if (err != -EIO) { 437 int err2 = wait_on_page_writeback_range(mapping, 438 lstart >> PAGE_CACHE_SHIFT, 439 lend >> PAGE_CACHE_SHIFT); 440 if (!err) 441 err = err2; 442 } 443 } 444 return err; 445} 446 447/** 448 * add_to_page_cache - add newly allocated pagecache pages 449 * @page: page to add 450 * @mapping: the page's address_space 451 * @offset: page index 452 * @gfp_mask: page allocation mode 453 * 454 * This function is used to add newly allocated pagecache pages; 455 * the page is new, so we can just run SetPageLocked() against it. 456 * The other page state flags were set by rmqueue(). 457 * 458 * This function does not add the page to the LRU. The caller must do that. 459 */ 460int add_to_page_cache(struct page *page, struct address_space *mapping, 461 pgoff_t offset, gfp_t gfp_mask) 462{ 463 int error = mem_cgroup_cache_charge(page, current->mm, 464 gfp_mask & ~__GFP_HIGHMEM); 465 if (error) 466 goto out; 467 468 error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM); 469 if (error == 0) { 470 write_lock_irq(&mapping->tree_lock); 471 error = radix_tree_insert(&mapping->page_tree, offset, page); 472 if (!error) { 473 page_cache_get(page); 474 SetPageLocked(page); 475 page->mapping = mapping; 476 page->index = offset; 477 mapping->nrpages++; 478 __inc_zone_page_state(page, NR_FILE_PAGES); 479 } else 480 mem_cgroup_uncharge_page(page); 481 482 write_unlock_irq(&mapping->tree_lock); 483 radix_tree_preload_end(); 484 } else 485 mem_cgroup_uncharge_page(page); 486out: 487 return error; 488} 489EXPORT_SYMBOL(add_to_page_cache); 490 491int add_to_page_cache_lru(struct page *page, struct address_space *mapping, 492 pgoff_t offset, gfp_t gfp_mask) 493{ 494 int ret = add_to_page_cache(page, mapping, offset, gfp_mask); 495 if (ret == 0) 496 lru_cache_add(page); 497 return ret; 498} 499 500#ifdef CONFIG_NUMA 501struct page *__page_cache_alloc(gfp_t gfp) 502{ 503 if (cpuset_do_page_mem_spread()) { 504 int n = cpuset_mem_spread_node(); 505 return alloc_pages_node(n, gfp, 0); 506 } 507 return alloc_pages(gfp, 0); 508} 509EXPORT_SYMBOL(__page_cache_alloc); 510#endif 511 512static int __sleep_on_page_lock(void *word) 513{ 514 io_schedule(); 515 return 0; 516} 517 518/* 519 * In order to wait for pages to become available there must be 520 * waitqueues associated with pages. By using a hash table of 521 * waitqueues where the bucket discipline is to maintain all 522 * waiters on the same queue and wake all when any of the pages 523 * become available, and for the woken contexts to check to be 524 * sure the appropriate page became available, this saves space 525 * at a cost of "thundering herd" phenomena during rare hash 526 * collisions. 527 */ 528static wait_queue_head_t *page_waitqueue(struct page *page) 529{ 530 const struct zone *zone = page_zone(page); 531 532 return &zone->wait_table[hash_ptr(page, zone->wait_table_bits)]; 533} 534 535static inline void wake_up_page(struct page *page, int bit) 536{ 537 __wake_up_bit(page_waitqueue(page), &page->flags, bit); 538} 539 540void wait_on_page_bit(struct page *page, int bit_nr) 541{ 542 DEFINE_WAIT_BIT(wait, &page->flags, bit_nr); 543 544 if (test_bit(bit_nr, &page->flags)) 545 __wait_on_bit(page_waitqueue(page), &wait, sync_page, 546 TASK_UNINTERRUPTIBLE); 547} 548EXPORT_SYMBOL(wait_on_page_bit); 549 550/** 551 * unlock_page - unlock a locked page 552 * @page: the page 553 * 554 * Unlocks the page and wakes up sleepers in ___wait_on_page_locked(). 555 * Also wakes sleepers in wait_on_page_writeback() because the wakeup 556 * mechananism between PageLocked pages and PageWriteback pages is shared. 557 * But that's OK - sleepers in wait_on_page_writeback() just go back to sleep. 558 * 559 * The first mb is necessary to safely close the critical section opened by the 560 * TestSetPageLocked(), the second mb is necessary to enforce ordering between 561 * the clear_bit and the read of the waitqueue (to avoid SMP races with a 562 * parallel wait_on_page_locked()). 563 */ 564void unlock_page(struct page *page) 565{ 566 smp_mb__before_clear_bit(); 567 if (!TestClearPageLocked(page)) 568 BUG(); 569 smp_mb__after_clear_bit(); 570 wake_up_page(page, PG_locked); 571} 572EXPORT_SYMBOL(unlock_page); 573 574/** 575 * end_page_writeback - end writeback against a page 576 * @page: the page 577 */ 578void end_page_writeback(struct page *page) 579{ 580 if (!TestClearPageReclaim(page) || rotate_reclaimable_page(page)) { 581 if (!test_clear_page_writeback(page)) 582 BUG(); 583 } 584 smp_mb__after_clear_bit(); 585 wake_up_page(page, PG_writeback); 586} 587EXPORT_SYMBOL(end_page_writeback); 588 589/** 590 * __lock_page - get a lock on the page, assuming we need to sleep to get it 591 * @page: the page to lock 592 * 593 * Ugly. Running sync_page() in state TASK_UNINTERRUPTIBLE is scary. If some 594 * random driver's requestfn sets TASK_RUNNING, we could busywait. However 595 * chances are that on the second loop, the block layer's plug list is empty, 596 * so sync_page() will then return in state TASK_UNINTERRUPTIBLE. 597 */ 598void __lock_page(struct page *page) 599{ 600 DEFINE_WAIT_BIT(wait, &page->flags, PG_locked); 601 602 __wait_on_bit_lock(page_waitqueue(page), &wait, sync_page, 603 TASK_UNINTERRUPTIBLE); 604} 605EXPORT_SYMBOL(__lock_page); 606 607int fastcall __lock_page_killable(struct page *page) 608{ 609 DEFINE_WAIT_BIT(wait, &page->flags, PG_locked); 610 611 return __wait_on_bit_lock(page_waitqueue(page), &wait, 612 sync_page_killable, TASK_KILLABLE); 613} 614 615/* 616 * Variant of lock_page that does not require the caller to hold a reference 617 * on the page's mapping. 618 */ 619void __lock_page_nosync(struct page *page) 620{ 621 DEFINE_WAIT_BIT(wait, &page->flags, PG_locked); 622 __wait_on_bit_lock(page_waitqueue(page), &wait, __sleep_on_page_lock, 623 TASK_UNINTERRUPTIBLE); 624} 625 626/** 627 * find_get_page - find and get a page reference 628 * @mapping: the address_space to search 629 * @offset: the page index 630 * 631 * Is there a pagecache struct page at the given (mapping, offset) tuple? 632 * If yes, increment its refcount and return it; if no, return NULL. 633 */ 634struct page * find_get_page(struct address_space *mapping, pgoff_t offset) 635{ 636 struct page *page; 637 638 read_lock_irq(&mapping->tree_lock); 639 page = radix_tree_lookup(&mapping->page_tree, offset); 640 if (page) 641 page_cache_get(page); 642 read_unlock_irq(&mapping->tree_lock); 643 return page; 644} 645EXPORT_SYMBOL(find_get_page); 646 647/** 648 * find_lock_page - locate, pin and lock a pagecache page 649 * @mapping: the address_space to search 650 * @offset: the page index 651 * 652 * Locates the desired pagecache page, locks it, increments its reference 653 * count and returns its address. 654 * 655 * Returns zero if the page was not present. find_lock_page() may sleep. 656 */ 657struct page *find_lock_page(struct address_space *mapping, 658 pgoff_t offset) 659{ 660 struct page *page; 661 662repeat: 663 read_lock_irq(&mapping->tree_lock); 664 page = radix_tree_lookup(&mapping->page_tree, offset); 665 if (page) { 666 page_cache_get(page); 667 if (TestSetPageLocked(page)) { 668 read_unlock_irq(&mapping->tree_lock); 669 __lock_page(page); 670 671 /* Has the page been truncated while we slept? */ 672 if (unlikely(page->mapping != mapping)) { 673 unlock_page(page); 674 page_cache_release(page); 675 goto repeat; 676 } 677 VM_BUG_ON(page->index != offset); 678 goto out; 679 } 680 } 681 read_unlock_irq(&mapping->tree_lock); 682out: 683 return page; 684} 685EXPORT_SYMBOL(find_lock_page); 686 687/** 688 * find_or_create_page - locate or add a pagecache page 689 * @mapping: the page's address_space 690 * @index: the page's index into the mapping 691 * @gfp_mask: page allocation mode 692 * 693 * Locates a page in the pagecache. If the page is not present, a new page 694 * is allocated using @gfp_mask and is added to the pagecache and to the VM's 695 * LRU list. The returned page is locked and has its reference count 696 * incremented. 697 * 698 * find_or_create_page() may sleep, even if @gfp_flags specifies an atomic 699 * allocation! 700 * 701 * find_or_create_page() returns the desired page's address, or zero on 702 * memory exhaustion. 703 */ 704struct page *find_or_create_page(struct address_space *mapping, 705 pgoff_t index, gfp_t gfp_mask) 706{ 707 struct page *page; 708 int err; 709repeat: 710 page = find_lock_page(mapping, index); 711 if (!page) { 712 page = __page_cache_alloc(gfp_mask); 713 if (!page) 714 return NULL; 715 err = add_to_page_cache_lru(page, mapping, index, gfp_mask); 716 if (unlikely(err)) { 717 page_cache_release(page); 718 page = NULL; 719 if (err == -EEXIST) 720 goto repeat; 721 } 722 } 723 return page; 724} 725EXPORT_SYMBOL(find_or_create_page); 726 727/** 728 * find_get_pages - gang pagecache lookup 729 * @mapping: The address_space to search 730 * @start: The starting page index 731 * @nr_pages: The maximum number of pages 732 * @pages: Where the resulting pages are placed 733 * 734 * find_get_pages() will search for and return a group of up to 735 * @nr_pages pages in the mapping. The pages are placed at @pages. 736 * find_get_pages() takes a reference against the returned pages. 737 * 738 * The search returns a group of mapping-contiguous pages with ascending 739 * indexes. There may be holes in the indices due to not-present pages. 740 * 741 * find_get_pages() returns the number of pages which were found. 742 */ 743unsigned find_get_pages(struct address_space *mapping, pgoff_t start, 744 unsigned int nr_pages, struct page **pages) 745{ 746 unsigned int i; 747 unsigned int ret; 748 749 read_lock_irq(&mapping->tree_lock); 750 ret = radix_tree_gang_lookup(&mapping->page_tree, 751 (void **)pages, start, nr_pages); 752 for (i = 0; i < ret; i++) 753 page_cache_get(pages[i]); 754 read_unlock_irq(&mapping->tree_lock); 755 return ret; 756} 757 758/** 759 * find_get_pages_contig - gang contiguous pagecache lookup 760 * @mapping: The address_space to search 761 * @index: The starting page index 762 * @nr_pages: The maximum number of pages 763 * @pages: Where the resulting pages are placed 764 * 765 * find_get_pages_contig() works exactly like find_get_pages(), except 766 * that the returned number of pages are guaranteed to be contiguous. 767 * 768 * find_get_pages_contig() returns the number of pages which were found. 769 */ 770unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index, 771 unsigned int nr_pages, struct page **pages) 772{ 773 unsigned int i; 774 unsigned int ret; 775 776 read_lock_irq(&mapping->tree_lock); 777 ret = radix_tree_gang_lookup(&mapping->page_tree, 778 (void **)pages, index, nr_pages); 779 for (i = 0; i < ret; i++) { 780 if (pages[i]->mapping == NULL || pages[i]->index != index) 781 break; 782 783 page_cache_get(pages[i]); 784 index++; 785 } 786 read_unlock_irq(&mapping->tree_lock); 787 return i; 788} 789EXPORT_SYMBOL(find_get_pages_contig); 790 791/** 792 * find_get_pages_tag - find and return pages that match @tag 793 * @mapping: the address_space to search 794 * @index: the starting page index 795 * @tag: the tag index 796 * @nr_pages: the maximum number of pages 797 * @pages: where the resulting pages are placed 798 * 799 * Like find_get_pages, except we only return pages which are tagged with 800 * @tag. We update @index to index the next page for the traversal. 801 */ 802unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index, 803 int tag, unsigned int nr_pages, struct page **pages) 804{ 805 unsigned int i; 806 unsigned int ret; 807 808 read_lock_irq(&mapping->tree_lock); 809 ret = radix_tree_gang_lookup_tag(&mapping->page_tree, 810 (void **)pages, *index, nr_pages, tag); 811 for (i = 0; i < ret; i++) 812 page_cache_get(pages[i]); 813 if (ret) 814 *index = pages[ret - 1]->index + 1; 815 read_unlock_irq(&mapping->tree_lock); 816 return ret; 817} 818EXPORT_SYMBOL(find_get_pages_tag); 819 820/** 821 * grab_cache_page_nowait - returns locked page at given index in given cache 822 * @mapping: target address_space 823 * @index: the page index 824 * 825 * Same as grab_cache_page(), but do not wait if the page is unavailable. 826 * This is intended for speculative data generators, where the data can 827 * be regenerated if the page couldn't be grabbed. This routine should 828 * be safe to call while holding the lock for another page. 829 * 830 * Clear __GFP_FS when allocating the page to avoid recursion into the fs 831 * and deadlock against the caller's locked page. 832 */ 833struct page * 834grab_cache_page_nowait(struct address_space *mapping, pgoff_t index) 835{ 836 struct page *page = find_get_page(mapping, index); 837 838 if (page) { 839 if (!TestSetPageLocked(page)) 840 return page; 841 page_cache_release(page); 842 return NULL; 843 } 844 page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~__GFP_FS); 845 if (page && add_to_page_cache_lru(page, mapping, index, GFP_KERNEL)) { 846 page_cache_release(page); 847 page = NULL; 848 } 849 return page; 850} 851EXPORT_SYMBOL(grab_cache_page_nowait); 852 853/* 854 * CD/DVDs are error prone. When a medium error occurs, the driver may fail 855 * a _large_ part of the i/o request. Imagine the worst scenario: 856 * 857 * ---R__________________________________________B__________ 858 * ^ reading here ^ bad block(assume 4k) 859 * 860 * read(R) => miss => readahead(R...B) => media error => frustrating retries 861 * => failing the whole request => read(R) => read(R+1) => 862 * readahead(R+1...B+1) => bang => read(R+2) => read(R+3) => 863 * readahead(R+3...B+2) => bang => read(R+3) => read(R+4) => 864 * readahead(R+4...B+3) => bang => read(R+4) => read(R+5) => ...... 865 * 866 * It is going insane. Fix it by quickly scaling down the readahead size. 867 */ 868static void shrink_readahead_size_eio(struct file *filp, 869 struct file_ra_state *ra) 870{ 871 if (!ra->ra_pages) 872 return; 873 874 ra->ra_pages /= 4; 875} 876 877/** 878 * do_generic_file_read - generic file read routine 879 * @filp: the file to read 880 * @ppos: current file position 881 * @desc: read_descriptor 882 * @actor: read method 883 * 884 * This is a generic file read routine, and uses the 885 * mapping->a_ops->readpage() function for the actual low-level stuff. 886 * 887 * This is really ugly. But the goto's actually try to clarify some 888 * of the logic when it comes to error handling etc. 889 */ 890static void do_generic_file_read(struct file *filp, loff_t *ppos, 891 read_descriptor_t *desc, read_actor_t actor) 892{ 893 struct address_space *mapping = filp->f_mapping; 894 struct inode *inode = mapping->host; 895 struct file_ra_state *ra = &filp->f_ra; 896 pgoff_t index; 897 pgoff_t last_index; 898 pgoff_t prev_index; 899 unsigned long offset; /* offset into pagecache page */ 900 unsigned int prev_offset; 901 int error; 902 903 index = *ppos >> PAGE_CACHE_SHIFT; 904 prev_index = ra->prev_pos >> PAGE_CACHE_SHIFT; 905 prev_offset = ra->prev_pos & (PAGE_CACHE_SIZE-1); 906 last_index = (*ppos + desc->count + PAGE_CACHE_SIZE-1) >> PAGE_CACHE_SHIFT; 907 offset = *ppos & ~PAGE_CACHE_MASK; 908 909 for (;;) { 910 struct page *page; 911 pgoff_t end_index; 912 loff_t isize; 913 unsigned long nr, ret; 914 915 cond_resched(); 916find_page: 917 page = find_get_page(mapping, index); 918 if (!page) { 919 page_cache_sync_readahead(mapping, 920 ra, filp, 921 index, last_index - index); 922 page = find_get_page(mapping, index); 923 if (unlikely(page == NULL)) 924 goto no_cached_page; 925 } 926 if (PageReadahead(page)) { 927 page_cache_async_readahead(mapping, 928 ra, filp, page, 929 index, last_index - index); 930 } 931 if (!PageUptodate(page)) 932 goto page_not_up_to_date; 933page_ok: 934 /* 935 * i_size must be checked after we know the page is Uptodate. 936 * 937 * Checking i_size after the check allows us to calculate 938 * the correct value for "nr", which means the zero-filled 939 * part of the page is not copied back to userspace (unless 940 * another truncate extends the file - this is desired though). 941 */ 942 943 isize = i_size_read(inode); 944 end_index = (isize - 1) >> PAGE_CACHE_SHIFT; 945 if (unlikely(!isize || index > end_index)) { 946 page_cache_release(page); 947 goto out; 948 } 949 950 /* nr is the maximum number of bytes to copy from this page */ 951 nr = PAGE_CACHE_SIZE; 952 if (index == end_index) { 953 nr = ((isize - 1) & ~PAGE_CACHE_MASK) + 1; 954 if (nr <= offset) { 955 page_cache_release(page); 956 goto out; 957 } 958 } 959 nr = nr - offset; 960 961 /* If users can be writing to this page using arbitrary 962 * virtual addresses, take care about potential aliasing 963 * before reading the page on the kernel side. 964 */ 965 if (mapping_writably_mapped(mapping)) 966 flush_dcache_page(page); 967 968 /* 969 * When a sequential read accesses a page several times, 970 * only mark it as accessed the first time. 971 */ 972 if (prev_index != index || offset != prev_offset) 973 mark_page_accessed(page); 974 prev_index = index; 975 976 /* 977 * Ok, we have the page, and it's up-to-date, so 978 * now we can copy it to user space... 979 * 980 * The actor routine returns how many bytes were actually used.. 981 * NOTE! This may not be the same as how much of a user buffer 982 * we filled up (we may be padding etc), so we can only update 983 * "pos" here (the actor routine has to update the user buffer 984 * pointers and the remaining count). 985 */ 986 ret = actor(desc, page, offset, nr); 987 offset += ret; 988 index += offset >> PAGE_CACHE_SHIFT; 989 offset &= ~PAGE_CACHE_MASK; 990 prev_offset = offset; 991 992 page_cache_release(page); 993 if (ret == nr && desc->count) 994 continue; 995 goto out; 996 997page_not_up_to_date: 998 /* Get exclusive access to the page ... */ 999 if (lock_page_killable(page)) 1000 goto readpage_eio; 1001 1002 /* Did it get truncated before we got the lock? */ 1003 if (!page->mapping) { 1004 unlock_page(page); 1005 page_cache_release(page); 1006 continue; 1007 } 1008 1009 /* Did somebody else fill it already? */ 1010 if (PageUptodate(page)) { 1011 unlock_page(page); 1012 goto page_ok; 1013 } 1014 1015readpage: 1016 /* Start the actual read. The read will unlock the page. */ 1017 error = mapping->a_ops->readpage(filp, page); 1018 1019 if (unlikely(error)) { 1020 if (error == AOP_TRUNCATED_PAGE) { 1021 page_cache_release(page); 1022 goto find_page; 1023 } 1024 goto readpage_error; 1025 } 1026 1027 if (!PageUptodate(page)) { 1028 if (lock_page_killable(page)) 1029 goto readpage_eio; 1030 if (!PageUptodate(page)) { 1031 if (page->mapping == NULL) { 1032 /* 1033 * invalidate_inode_pages got it 1034 */ 1035 unlock_page(page); 1036 page_cache_release(page); 1037 goto find_page; 1038 } 1039 unlock_page(page); 1040 shrink_readahead_size_eio(filp, ra); 1041 goto readpage_eio; 1042 } 1043 unlock_page(page); 1044 } 1045 1046 goto page_ok; 1047 1048readpage_eio: 1049 error = -EIO; 1050readpage_error: 1051 /* UHHUH! A synchronous read error occurred. Report it */ 1052 desc->error = error; 1053 page_cache_release(page); 1054 goto out; 1055 1056no_cached_page: 1057 /* 1058 * Ok, it wasn't cached, so we need to create a new 1059 * page.. 1060 */ 1061 page = page_cache_alloc_cold(mapping); 1062 if (!page) { 1063 desc->error = -ENOMEM; 1064 goto out; 1065 } 1066 error = add_to_page_cache_lru(page, mapping, 1067 index, GFP_KERNEL); 1068 if (error) { 1069 page_cache_release(page); 1070 if (error == -EEXIST) 1071 goto find_page; 1072 desc->error = error; 1073 goto out; 1074 } 1075 goto readpage; 1076 } 1077 1078out: 1079 ra->prev_pos = prev_index; 1080 ra->prev_pos <<= PAGE_CACHE_SHIFT; 1081 ra->prev_pos |= prev_offset; 1082 1083 *ppos = ((loff_t)index << PAGE_CACHE_SHIFT) + offset; 1084 if (filp) 1085 file_accessed(filp); 1086} 1087 1088int file_read_actor(read_descriptor_t *desc, struct page *page, 1089 unsigned long offset, unsigned long size) 1090{ 1091 char *kaddr; 1092 unsigned long left, count = desc->count; 1093 1094 if (size > count) 1095 size = count; 1096 1097 /* 1098 * Faults on the destination of a read are common, so do it before 1099 * taking the kmap. 1100 */ 1101 if (!fault_in_pages_writeable(desc->arg.buf, size)) { 1102 kaddr = kmap_atomic(page, KM_USER0); 1103 left = __copy_to_user_inatomic(desc->arg.buf, 1104 kaddr + offset, size); 1105 kunmap_atomic(kaddr, KM_USER0); 1106 if (left == 0) 1107 goto success; 1108 } 1109 1110 /* Do it the slow way */ 1111 kaddr = kmap(page); 1112 left = __copy_to_user(desc->arg.buf, kaddr + offset, size); 1113 kunmap(page); 1114 1115 if (left) { 1116 size -= left; 1117 desc->error = -EFAULT; 1118 } 1119success: 1120 desc->count = count - size; 1121 desc->written += size; 1122 desc->arg.buf += size; 1123 return size; 1124} 1125 1126/* 1127 * Performs necessary checks before doing a write 1128 * @iov: io vector request 1129 * @nr_segs: number of segments in the iovec 1130 * @count: number of bytes to write 1131 * @access_flags: type of access: %VERIFY_READ or %VERIFY_WRITE 1132 * 1133 * Adjust number of segments and amount of bytes to write (nr_segs should be 1134 * properly initialized first). Returns appropriate error code that caller 1135 * should return or zero in case that write should be allowed. 1136 */ 1137int generic_segment_checks(const struct iovec *iov, 1138 unsigned long *nr_segs, size_t *count, int access_flags) 1139{ 1140 unsigned long seg; 1141 size_t cnt = 0; 1142 for (seg = 0; seg < *nr_segs; seg++) { 1143 const struct iovec *iv = &iov[seg]; 1144 1145 /* 1146 * If any segment has a negative length, or the cumulative 1147 * length ever wraps negative then return -EINVAL. 1148 */ 1149 cnt += iv->iov_len; 1150 if (unlikely((ssize_t)(cnt|iv->iov_len) < 0)) 1151 return -EINVAL; 1152 if (access_ok(access_flags, iv->iov_base, iv->iov_len)) 1153 continue; 1154 if (seg == 0) 1155 return -EFAULT; 1156 *nr_segs = seg; 1157 cnt -= iv->iov_len; /* This segment is no good */ 1158 break; 1159 } 1160 *count = cnt; 1161 return 0; 1162} 1163EXPORT_SYMBOL(generic_segment_checks); 1164 1165/** 1166 * generic_file_aio_read - generic filesystem read routine 1167 * @iocb: kernel I/O control block 1168 * @iov: io vector request 1169 * @nr_segs: number of segments in the iovec 1170 * @pos: current file position 1171 * 1172 * This is the "read()" routine for all filesystems 1173 * that can use the page cache directly. 1174 */ 1175ssize_t 1176generic_file_aio_read(struct kiocb *iocb, const struct iovec *iov, 1177 unsigned long nr_segs, loff_t pos) 1178{ 1179 struct file *filp = iocb->ki_filp; 1180 ssize_t retval; 1181 unsigned long seg; 1182 size_t count; 1183 loff_t *ppos = &iocb->ki_pos; 1184 1185 count = 0; 1186 retval = generic_segment_checks(iov, &nr_segs, &count, VERIFY_WRITE); 1187 if (retval) 1188 return retval; 1189 1190 /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */ 1191 if (filp->f_flags & O_DIRECT) { 1192 loff_t size; 1193 struct address_space *mapping; 1194 struct inode *inode; 1195 1196 mapping = filp->f_mapping; 1197 inode = mapping->host; 1198 retval = 0; 1199 if (!count) 1200 goto out; /* skip atime */ 1201 size = i_size_read(inode); 1202 if (pos < size) { 1203 retval = generic_file_direct_IO(READ, iocb, 1204 iov, pos, nr_segs); 1205 if (retval > 0) 1206 *ppos = pos + retval; 1207 } 1208 if (likely(retval != 0)) { 1209 file_accessed(filp); 1210 goto out; 1211 } 1212 } 1213 1214 retval = 0; 1215 if (count) { 1216 for (seg = 0; seg < nr_segs; seg++) { 1217 read_descriptor_t desc; 1218 1219 desc.written = 0; 1220 desc.arg.buf = iov[seg].iov_base; 1221 desc.count = iov[seg].iov_len; 1222 if (desc.count == 0) 1223 continue; 1224 desc.error = 0; 1225 do_generic_file_read(filp,ppos,&desc,file_read_actor); 1226 retval += desc.written; 1227 if (desc.error) { 1228 retval = retval ?: desc.error; 1229 break; 1230 } 1231 if (desc.count > 0) 1232 break; 1233 } 1234 } 1235out: 1236 return retval; 1237} 1238EXPORT_SYMBOL(generic_file_aio_read); 1239 1240static ssize_t 1241do_readahead(struct address_space *mapping, struct file *filp, 1242 pgoff_t index, unsigned long nr) 1243{ 1244 if (!mapping || !mapping->a_ops || !mapping->a_ops->readpage) 1245 return -EINVAL; 1246 1247 force_page_cache_readahead(mapping, filp, index, 1248 max_sane_readahead(nr)); 1249 return 0; 1250} 1251 1252asmlinkage ssize_t sys_readahead(int fd, loff_t offset, size_t count) 1253{ 1254 ssize_t ret; 1255 struct file *file; 1256 1257 ret = -EBADF; 1258 file = fget(fd); 1259 if (file) { 1260 if (file->f_mode & FMODE_READ) { 1261 struct address_space *mapping = file->f_mapping; 1262 pgoff_t start = offset >> PAGE_CACHE_SHIFT; 1263 pgoff_t end = (offset + count - 1) >> PAGE_CACHE_SHIFT; 1264 unsigned long len = end - start + 1; 1265 ret = do_readahead(mapping, file, start, len); 1266 } 1267 fput(file); 1268 } 1269 return ret; 1270} 1271 1272#ifdef CONFIG_MMU 1273/** 1274 * page_cache_read - adds requested page to the page cache if not already there 1275 * @file: file to read 1276 * @offset: page index 1277 * 1278 * This adds the requested page to the page cache if it isn't already there, 1279 * and schedules an I/O to read in its contents from disk. 1280 */ 1281static int page_cache_read(struct file *file, pgoff_t offset) 1282{ 1283 struct address_space *mapping = file->f_mapping; 1284 struct page *page; 1285 int ret; 1286 1287 do { 1288 page = page_cache_alloc_cold(mapping); 1289 if (!page) 1290 return -ENOMEM; 1291 1292 ret = add_to_page_cache_lru(page, mapping, offset, GFP_KERNEL); 1293 if (ret == 0) 1294 ret = mapping->a_ops->readpage(file, page); 1295 else if (ret == -EEXIST) 1296 ret = 0; /* losing race to add is OK */ 1297 1298 page_cache_release(page); 1299 1300 } while (ret == AOP_TRUNCATED_PAGE); 1301 1302 return ret; 1303} 1304 1305#define MMAP_LOTSAMISS (100) 1306 1307/** 1308 * filemap_fault - read in file data for page fault handling 1309 * @vma: vma in which the fault was taken 1310 * @vmf: struct vm_fault containing details of the fault 1311 * 1312 * filemap_fault() is invoked via the vma operations vector for a 1313 * mapped memory region to read in file data during a page fault. 1314 * 1315 * The goto's are kind of ugly, but this streamlines the normal case of having 1316 * it in the page cache, and handles the special cases reasonably without 1317 * having a lot of duplicated code. 1318 */ 1319int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 1320{ 1321 int error; 1322 struct file *file = vma->vm_file; 1323 struct address_space *mapping = file->f_mapping; 1324 struct file_ra_state *ra = &file->f_ra; 1325 struct inode *inode = mapping->host; 1326 struct page *page; 1327 pgoff_t size; 1328 int did_readaround = 0; 1329 int ret = 0; 1330 1331 size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT; 1332 if (vmf->pgoff >= size) 1333 return VM_FAULT_SIGBUS; 1334 1335 /* If we don't want any read-ahead, don't bother */ 1336 if (VM_RandomReadHint(vma)) 1337 goto no_cached_page; 1338 1339 /* 1340 * Do we have something in the page cache already? 1341 */ 1342retry_find: 1343 page = find_lock_page(mapping, vmf->pgoff); 1344 /* 1345 * For sequential accesses, we use the generic readahead logic. 1346 */ 1347 if (VM_SequentialReadHint(vma)) { 1348 if (!page) { 1349 page_cache_sync_readahead(mapping, ra, file, 1350 vmf->pgoff, 1); 1351 page = find_lock_page(mapping, vmf->pgoff); 1352 if (!page) 1353 goto no_cached_page; 1354 } 1355 if (PageReadahead(page)) { 1356 page_cache_async_readahead(mapping, ra, file, page, 1357 vmf->pgoff, 1); 1358 } 1359 } 1360 1361 if (!page) { 1362 unsigned long ra_pages; 1363 1364 ra->mmap_miss++; 1365 1366 /* 1367 * Do we miss much more than hit in this file? If so, 1368 * stop bothering with read-ahead. It will only hurt. 1369 */ 1370 if (ra->mmap_miss > MMAP_LOTSAMISS) 1371 goto no_cached_page; 1372 1373 /* 1374 * To keep the pgmajfault counter straight, we need to 1375 * check did_readaround, as this is an inner loop. 1376 */ 1377 if (!did_readaround) { 1378 ret = VM_FAULT_MAJOR; 1379 count_vm_event(PGMAJFAULT); 1380 } 1381 did_readaround = 1; 1382 ra_pages = max_sane_readahead(file->f_ra.ra_pages); 1383 if (ra_pages) { 1384 pgoff_t start = 0; 1385 1386 if (vmf->pgoff > ra_pages / 2) 1387 start = vmf->pgoff - ra_pages / 2; 1388 do_page_cache_readahead(mapping, file, start, ra_pages); 1389 } 1390 page = find_lock_page(mapping, vmf->pgoff); 1391 if (!page) 1392 goto no_cached_page; 1393 } 1394 1395 if (!did_readaround) 1396 ra->mmap_miss--; 1397 1398 /* 1399 * We have a locked page in the page cache, now we need to check 1400 * that it's up-to-date. If not, it is going to be due to an error. 1401 */ 1402 if (unlikely(!PageUptodate(page))) 1403 goto page_not_uptodate; 1404 1405 /* Must recheck i_size under page lock */ 1406 size = (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT; 1407 if (unlikely(vmf->pgoff >= size)) { 1408 unlock_page(page); 1409 page_cache_release(page); 1410 return VM_FAULT_SIGBUS; 1411 } 1412 1413 /* 1414 * Found the page and have a reference on it. 1415 */ 1416 mark_page_accessed(page); 1417 ra->prev_pos = (loff_t)page->index << PAGE_CACHE_SHIFT; 1418 vmf->page = page; 1419 return ret | VM_FAULT_LOCKED; 1420 1421no_cached_page: 1422 /* 1423 * We're only likely to ever get here if MADV_RANDOM is in 1424 * effect. 1425 */ 1426 error = page_cache_read(file, vmf->pgoff); 1427 1428 /* 1429 * The page we want has now been added to the page cache. 1430 * In the unlikely event that someone removed it in the 1431 * meantime, we'll just come back here and read it again. 1432 */ 1433 if (error >= 0) 1434 goto retry_find; 1435 1436 /* 1437 * An error return from page_cache_read can result if the 1438 * system is low on memory, or a problem occurs while trying 1439 * to schedule I/O. 1440 */ 1441 if (error == -ENOMEM) 1442 return VM_FAULT_OOM; 1443 return VM_FAULT_SIGBUS; 1444 1445page_not_uptodate: 1446 /* IO error path */ 1447 if (!did_readaround) { 1448 ret = VM_FAULT_MAJOR; 1449 count_vm_event(PGMAJFAULT); 1450 } 1451 1452 /* 1453 * Umm, take care of errors if the page isn't up-to-date. 1454 * Try to re-read it _once_. We do this synchronously, 1455 * because there really aren't any performance issues here 1456 * and we need to check for errors. 1457 */ 1458 ClearPageError(page); 1459 error = mapping->a_ops->readpage(file, page); 1460 page_cache_release(page); 1461 1462 if (!error || error == AOP_TRUNCATED_PAGE) 1463 goto retry_find; 1464 1465 /* Things didn't work out. Return zero to tell the mm layer so. */ 1466 shrink_readahead_size_eio(file, ra); 1467 return VM_FAULT_SIGBUS; 1468} 1469EXPORT_SYMBOL(filemap_fault); 1470 1471struct vm_operations_struct generic_file_vm_ops = { 1472 .fault = filemap_fault, 1473}; 1474 1475/* This is used for a general mmap of a disk file */ 1476 1477int generic_file_mmap(struct file * file, struct vm_area_struct * vma) 1478{ 1479 struct address_space *mapping = file->f_mapping; 1480 1481 if (!mapping->a_ops->readpage) 1482 return -ENOEXEC; 1483 file_accessed(file); 1484 vma->vm_ops = &generic_file_vm_ops; 1485 vma->vm_flags |= VM_CAN_NONLINEAR; 1486 return 0; 1487} 1488 1489/* 1490 * This is for filesystems which do not implement ->writepage. 1491 */ 1492int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma) 1493{ 1494 if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE)) 1495 return -EINVAL; 1496 return generic_file_mmap(file, vma); 1497} 1498#else 1499int generic_file_mmap(struct file * file, struct vm_area_struct * vma) 1500{ 1501 return -ENOSYS; 1502} 1503int generic_file_readonly_mmap(struct file * file, struct vm_area_struct * vma) 1504{ 1505 return -ENOSYS; 1506} 1507#endif /* CONFIG_MMU */ 1508 1509EXPORT_SYMBOL(generic_file_mmap); 1510EXPORT_SYMBOL(generic_file_readonly_mmap); 1511 1512static struct page *__read_cache_page(struct address_space *mapping, 1513 pgoff_t index, 1514 int (*filler)(void *,struct page*), 1515 void *data) 1516{ 1517 struct page *page; 1518 int err; 1519repeat: 1520 page = find_get_page(mapping, index); 1521 if (!page) { 1522 page = page_cache_alloc_cold(mapping); 1523 if (!page) 1524 return ERR_PTR(-ENOMEM); 1525 err = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL); 1526 if (unlikely(err)) { 1527 page_cache_release(page); 1528 if (err == -EEXIST) 1529 goto repeat; 1530 /* Presumably ENOMEM for radix tree node */ 1531 return ERR_PTR(err); 1532 } 1533 err = filler(data, page); 1534 if (err < 0) { 1535 page_cache_release(page); 1536 page = ERR_PTR(err); 1537 } 1538 } 1539 return page; 1540} 1541 1542/* 1543 * Same as read_cache_page, but don't wait for page to become unlocked 1544 * after submitting it to the filler. 1545 */ 1546struct page *read_cache_page_async(struct address_space *mapping, 1547 pgoff_t index, 1548 int (*filler)(void *,struct page*), 1549 void *data) 1550{ 1551 struct page *page; 1552 int err; 1553 1554retry: 1555 page = __read_cache_page(mapping, index, filler, data); 1556 if (IS_ERR(page)) 1557 return page; 1558 if (PageUptodate(page)) 1559 goto out; 1560 1561 lock_page(page); 1562 if (!page->mapping) { 1563 unlock_page(page); 1564 page_cache_release(page); 1565 goto retry; 1566 } 1567 if (PageUptodate(page)) { 1568 unlock_page(page); 1569 goto out; 1570 } 1571 err = filler(data, page); 1572 if (err < 0) { 1573 page_cache_release(page); 1574 return ERR_PTR(err); 1575 } 1576out: 1577 mark_page_accessed(page); 1578 return page; 1579} 1580EXPORT_SYMBOL(read_cache_page_async); 1581 1582/** 1583 * read_cache_page - read into page cache, fill it if needed 1584 * @mapping: the page's address_space 1585 * @index: the page index 1586 * @filler: function to perform the read 1587 * @data: destination for read data 1588 * 1589 * Read into the page cache. If a page already exists, and PageUptodate() is 1590 * not set, try to fill the page then wait for it to become unlocked. 1591 * 1592 * If the page does not get brought uptodate, return -EIO. 1593 */ 1594struct page *read_cache_page(struct address_space *mapping, 1595 pgoff_t index, 1596 int (*filler)(void *,struct page*), 1597 void *data) 1598{ 1599 struct page *page; 1600 1601 page = read_cache_page_async(mapping, index, filler, data); 1602 if (IS_ERR(page)) 1603 goto out; 1604 wait_on_page_locked(page); 1605 if (!PageUptodate(page)) { 1606 page_cache_release(page); 1607 page = ERR_PTR(-EIO); 1608 } 1609 out: 1610 return page; 1611} 1612EXPORT_SYMBOL(read_cache_page); 1613 1614/* 1615 * The logic we want is 1616 * 1617 * if suid or (sgid and xgrp) 1618 * remove privs 1619 */ 1620int should_remove_suid(struct dentry *dentry) 1621{ 1622 mode_t mode = dentry->d_inode->i_mode; 1623 int kill = 0; 1624 1625 /* suid always must be killed */ 1626 if (unlikely(mode & S_ISUID)) 1627 kill = ATTR_KILL_SUID; 1628 1629 /* 1630 * sgid without any exec bits is just a mandatory locking mark; leave 1631 * it alone. If some exec bits are set, it's a real sgid; kill it. 1632 */ 1633 if (unlikely((mode & S_ISGID) && (mode & S_IXGRP))) 1634 kill |= ATTR_KILL_SGID; 1635 1636 if (unlikely(kill && !capable(CAP_FSETID))) 1637 return kill; 1638 1639 return 0; 1640} 1641EXPORT_SYMBOL(should_remove_suid); 1642 1643int __remove_suid(struct dentry *dentry, int kill) 1644{ 1645 struct iattr newattrs; 1646 1647 newattrs.ia_valid = ATTR_FORCE | kill; 1648 return notify_change(dentry, &newattrs); 1649} 1650 1651int remove_suid(struct dentry *dentry) 1652{ 1653 int killsuid = should_remove_suid(dentry); 1654 int killpriv = security_inode_need_killpriv(dentry); 1655 int error = 0; 1656 1657 if (killpriv < 0) 1658 return killpriv; 1659 if (killpriv) 1660 error = security_inode_killpriv(dentry); 1661 if (!error && killsuid) 1662 error = __remove_suid(dentry, killsuid); 1663 1664 return error; 1665} 1666EXPORT_SYMBOL(remove_suid); 1667 1668static size_t __iovec_copy_from_user_inatomic(char *vaddr, 1669 const struct iovec *iov, size_t base, size_t bytes) 1670{ 1671 size_t copied = 0, left = 0; 1672 1673 while (bytes) { 1674 char __user *buf = iov->iov_base + base; 1675 int copy = min(bytes, iov->iov_len - base); 1676 1677 base = 0; 1678 left = __copy_from_user_inatomic_nocache(vaddr, buf, copy); 1679 copied += copy; 1680 bytes -= copy; 1681 vaddr += copy; 1682 iov++; 1683 1684 if (unlikely(left)) 1685 break; 1686 } 1687 return copied - left; 1688} 1689 1690/* 1691 * Copy as much as we can into the page and return the number of bytes which 1692 * were sucessfully copied. If a fault is encountered then return the number of 1693 * bytes which were copied. 1694 */ 1695size_t iov_iter_copy_from_user_atomic(struct page *page, 1696 struct iov_iter *i, unsigned long offset, size_t bytes) 1697{ 1698 char *kaddr; 1699 size_t copied; 1700 1701 BUG_ON(!in_atomic()); 1702 kaddr = kmap_atomic(page, KM_USER0); 1703 if (likely(i->nr_segs == 1)) { 1704 int left; 1705 char __user *buf = i->iov->iov_base + i->iov_offset; 1706 left = __copy_from_user_inatomic_nocache(kaddr + offset, 1707 buf, bytes); 1708 copied = bytes - left; 1709 } else { 1710 copied = __iovec_copy_from_user_inatomic(kaddr + offset, 1711 i->iov, i->iov_offset, bytes); 1712 } 1713 kunmap_atomic(kaddr, KM_USER0); 1714 1715 return copied; 1716} 1717EXPORT_SYMBOL(iov_iter_copy_from_user_atomic); 1718 1719/* 1720 * This has the same sideeffects and return value as 1721 * iov_iter_copy_from_user_atomic(). 1722 * The difference is that it attempts to resolve faults. 1723 * Page must not be locked. 1724 */ 1725size_t iov_iter_copy_from_user(struct page *page, 1726 struct iov_iter *i, unsigned long offset, size_t bytes) 1727{ 1728 char *kaddr; 1729 size_t copied; 1730 1731 kaddr = kmap(page); 1732 if (likely(i->nr_segs == 1)) { 1733 int left; 1734 char __user *buf = i->iov->iov_base + i->iov_offset; 1735 left = __copy_from_user_nocache(kaddr + offset, buf, bytes); 1736 copied = bytes - left; 1737 } else { 1738 copied = __iovec_copy_from_user_inatomic(kaddr + offset, 1739 i->iov, i->iov_offset, bytes); 1740 } 1741 kunmap(page); 1742 return copied; 1743} 1744EXPORT_SYMBOL(iov_iter_copy_from_user); 1745 1746static void __iov_iter_advance_iov(struct iov_iter *i, size_t bytes) 1747{ 1748 if (likely(i->nr_segs == 1)) { 1749 i->iov_offset += bytes; 1750 } else { 1751 const struct iovec *iov = i->iov; 1752 size_t base = i->iov_offset; 1753 1754 /* 1755 * The !iov->iov_len check ensures we skip over unlikely 1756 * zero-length segments. 1757 */ 1758 while (bytes || !iov->iov_len) { 1759 int copy = min(bytes, iov->iov_len - base); 1760 1761 bytes -= copy; 1762 base += copy; 1763 if (iov->iov_len == base) { 1764 iov++; 1765 base = 0; 1766 } 1767 } 1768 i->iov = iov; 1769 i->iov_offset = base; 1770 } 1771} 1772 1773void iov_iter_advance(struct iov_iter *i, size_t bytes) 1774{ 1775 BUG_ON(i->count < bytes); 1776 1777 __iov_iter_advance_iov(i, bytes); 1778 i->count -= bytes; 1779} 1780EXPORT_SYMBOL(iov_iter_advance); 1781 1782/* 1783 * Fault in the first iovec of the given iov_iter, to a maximum length 1784 * of bytes. Returns 0 on success, or non-zero if the memory could not be 1785 * accessed (ie. because it is an invalid address). 1786 * 1787 * writev-intensive code may want this to prefault several iovecs -- that 1788 * would be possible (callers must not rely on the fact that _only_ the 1789 * first iovec will be faulted with the current implementation). 1790 */ 1791int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes) 1792{ 1793 char __user *buf = i->iov->iov_base + i->iov_offset; 1794 bytes = min(bytes, i->iov->iov_len - i->iov_offset); 1795 return fault_in_pages_readable(buf, bytes); 1796} 1797EXPORT_SYMBOL(iov_iter_fault_in_readable); 1798 1799/* 1800 * Return the count of just the current iov_iter segment. 1801 */ 1802size_t iov_iter_single_seg_count(struct iov_iter *i) 1803{ 1804 const struct iovec *iov = i->iov; 1805 if (i->nr_segs == 1) 1806 return i->count; 1807 else 1808 return min(i->count, iov->iov_len - i->iov_offset); 1809} 1810EXPORT_SYMBOL(iov_iter_single_seg_count); 1811 1812/* 1813 * Performs necessary checks before doing a write 1814 * 1815 * Can adjust writing position or amount of bytes to write. 1816 * Returns appropriate error code that caller should return or 1817 * zero in case that write should be allowed. 1818 */ 1819inline int generic_write_checks(struct file *file, loff_t *pos, size_t *count, int isblk) 1820{ 1821 struct inode *inode = file->f_mapping->host; 1822 unsigned long limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur; 1823 1824 if (unlikely(*pos < 0)) 1825 return -EINVAL; 1826 1827 if (!isblk) { 1828 /* FIXME: this is for backwards compatibility with 2.4 */ 1829 if (file->f_flags & O_APPEND) 1830 *pos = i_size_read(inode); 1831 1832 if (limit != RLIM_INFINITY) { 1833 if (*pos >= limit) { 1834 send_sig(SIGXFSZ, current, 0); 1835 return -EFBIG; 1836 } 1837 if (*count > limit - (typeof(limit))*pos) { 1838 *count = limit - (typeof(limit))*pos; 1839 } 1840 } 1841 } 1842 1843 /* 1844 * LFS rule 1845 */ 1846 if (unlikely(*pos + *count > MAX_NON_LFS && 1847 !(file->f_flags & O_LARGEFILE))) { 1848 if (*pos >= MAX_NON_LFS) { 1849 return -EFBIG; 1850 } 1851 if (*count > MAX_NON_LFS - (unsigned long)*pos) { 1852 *count = MAX_NON_LFS - (unsigned long)*pos; 1853 } 1854 } 1855 1856 /* 1857 * Are we about to exceed the fs block limit ? 1858 * 1859 * If we have written data it becomes a short write. If we have 1860 * exceeded without writing data we send a signal and return EFBIG. 1861 * Linus frestrict idea will clean these up nicely.. 1862 */ 1863 if (likely(!isblk)) { 1864 if (unlikely(*pos >= inode->i_sb->s_maxbytes)) { 1865 if (*count || *pos > inode->i_sb->s_maxbytes) { 1866 return -EFBIG; 1867 } 1868 /* zero-length writes at ->s_maxbytes are OK */ 1869 } 1870 1871 if (unlikely(*pos + *count > inode->i_sb->s_maxbytes)) 1872 *count = inode->i_sb->s_maxbytes - *pos; 1873 } else { 1874#ifdef CONFIG_BLOCK 1875 loff_t isize; 1876 if (bdev_read_only(I_BDEV(inode))) 1877 return -EPERM; 1878 isize = i_size_read(inode); 1879 if (*pos >= isize) { 1880 if (*count || *pos > isize) 1881 return -ENOSPC; 1882 } 1883 1884 if (*pos + *count > isize) 1885 *count = isize - *pos; 1886#else 1887 return -EPERM; 1888#endif 1889 } 1890 return 0; 1891} 1892EXPORT_SYMBOL(generic_write_checks); 1893 1894int pagecache_write_begin(struct file *file, struct address_space *mapping, 1895 loff_t pos, unsigned len, unsigned flags, 1896 struct page **pagep, void **fsdata) 1897{ 1898 const struct address_space_operations *aops = mapping->a_ops; 1899 1900 if (aops->write_begin) { 1901 return aops->write_begin(file, mapping, pos, len, flags, 1902 pagep, fsdata); 1903 } else { 1904 int ret; 1905 pgoff_t index = pos >> PAGE_CACHE_SHIFT; 1906 unsigned offset = pos & (PAGE_CACHE_SIZE - 1); 1907 struct inode *inode = mapping->host; 1908 struct page *page; 1909again: 1910 page = __grab_cache_page(mapping, index); 1911 *pagep = page; 1912 if (!page) 1913 return -ENOMEM; 1914 1915 if (flags & AOP_FLAG_UNINTERRUPTIBLE && !PageUptodate(page)) { 1916 /* 1917 * There is no way to resolve a short write situation 1918 * for a !Uptodate page (except by double copying in 1919 * the caller done by generic_perform_write_2copy). 1920 * 1921 * Instead, we have to bring it uptodate here. 1922 */ 1923 ret = aops->readpage(file, page); 1924 page_cache_release(page); 1925 if (ret) { 1926 if (ret == AOP_TRUNCATED_PAGE) 1927 goto again; 1928 return ret; 1929 } 1930 goto again; 1931 } 1932 1933 ret = aops->prepare_write(file, page, offset, offset+len); 1934 if (ret) { 1935 unlock_page(page); 1936 page_cache_release(page); 1937 if (pos + len > inode->i_size) 1938 vmtruncate(inode, inode->i_size); 1939 } 1940 return ret; 1941 } 1942} 1943EXPORT_SYMBOL(pagecache_write_begin); 1944 1945int pagecache_write_end(struct file *file, struct address_space *mapping, 1946 loff_t pos, unsigned len, unsigned copied, 1947 struct page *page, void *fsdata) 1948{ 1949 const struct address_space_operations *aops = mapping->a_ops; 1950 int ret; 1951 1952 if (aops->write_end) { 1953 mark_page_accessed(page); 1954 ret = aops->write_end(file, mapping, pos, len, copied, 1955 page, fsdata); 1956 } else { 1957 unsigned offset = pos & (PAGE_CACHE_SIZE - 1); 1958 struct inode *inode = mapping->host; 1959 1960 flush_dcache_page(page); 1961 ret = aops->commit_write(file, page, offset, offset+len); 1962 unlock_page(page); 1963 mark_page_accessed(page); 1964 page_cache_release(page); 1965 1966 if (ret < 0) { 1967 if (pos + len > inode->i_size) 1968 vmtruncate(inode, inode->i_size); 1969 } else if (ret > 0) 1970 ret = min_t(size_t, copied, ret); 1971 else 1972 ret = copied; 1973 } 1974 1975 return ret; 1976} 1977EXPORT_SYMBOL(pagecache_write_end); 1978 1979ssize_t 1980generic_file_direct_write(struct kiocb *iocb, const struct iovec *iov, 1981 unsigned long *nr_segs, loff_t pos, loff_t *ppos, 1982 size_t count, size_t ocount) 1983{ 1984 struct file *file = iocb->ki_filp; 1985 struct address_space *mapping = file->f_mapping; 1986 struct inode *inode = mapping->host; 1987 ssize_t written; 1988 1989 if (count != ocount) 1990 *nr_segs = iov_shorten((struct iovec *)iov, *nr_segs, count); 1991 1992 written = generic_file_direct_IO(WRITE, iocb, iov, pos, *nr_segs); 1993 if (written > 0) { 1994 loff_t end = pos + written; 1995 if (end > i_size_read(inode) && !S_ISBLK(inode->i_mode)) { 1996 i_size_write(inode, end); 1997 mark_inode_dirty(inode); 1998 } 1999 *ppos = end; 2000 } 2001 2002 /* 2003 * Sync the fs metadata but not the minor inode changes and 2004 * of course not the data as we did direct DMA for the IO. 2005 * i_mutex is held, which protects generic_osync_inode() from 2006 * livelocking. AIO O_DIRECT ops attempt to sync metadata here. 2007 */ 2008 if ((written >= 0 || written == -EIOCBQUEUED) && 2009 ((file->f_flags & O_SYNC) || IS_SYNC(inode))) { 2010 int err = generic_osync_inode(inode, mapping, OSYNC_METADATA); 2011 if (err < 0) 2012 written = err; 2013 } 2014 return written; 2015} 2016EXPORT_SYMBOL(generic_file_direct_write); 2017 2018/* 2019 * Find or create a page at the given pagecache position. Return the locked 2020 * page. This function is specifically for buffered writes. 2021 */ 2022struct page *__grab_cache_page(struct address_space *mapping, pgoff_t index) 2023{ 2024 int status; 2025 struct page *page; 2026repeat: 2027 page = find_lock_page(mapping, index); 2028 if (likely(page)) 2029 return page; 2030 2031 page = page_cache_alloc(mapping); 2032 if (!page) 2033 return NULL; 2034 status = add_to_page_cache_lru(page, mapping, index, GFP_KERNEL); 2035 if (unlikely(status)) { 2036 page_cache_release(page); 2037 if (status == -EEXIST) 2038 goto repeat; 2039 return NULL; 2040 } 2041 return page; 2042} 2043EXPORT_SYMBOL(__grab_cache_page); 2044 2045static ssize_t generic_perform_write_2copy(struct file *file, 2046 struct iov_iter *i, loff_t pos) 2047{ 2048 struct address_space *mapping = file->f_mapping; 2049 const struct address_space_operations *a_ops = mapping->a_ops; 2050 struct inode *inode = mapping->host; 2051 long status = 0; 2052 ssize_t written = 0; 2053 2054 do { 2055 struct page *src_page; 2056 struct page *page; 2057 pgoff_t index; /* Pagecache index for current page */ 2058 unsigned long offset; /* Offset into pagecache page */ 2059 unsigned long bytes; /* Bytes to write to page */ 2060 size_t copied; /* Bytes copied from user */ 2061 2062 offset = (pos & (PAGE_CACHE_SIZE - 1)); 2063 index = pos >> PAGE_CACHE_SHIFT; 2064 bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset, 2065 iov_iter_count(i)); 2066 2067 /* 2068 * a non-NULL src_page indicates that we're doing the 2069 * copy via get_user_pages and kmap. 2070 */ 2071 src_page = NULL; 2072 2073 /* 2074 * Bring in the user page that we will copy from _first_. 2075 * Otherwise there's a nasty deadlock on copying from the 2076 * same page as we're writing to, without it being marked 2077 * up-to-date. 2078 * 2079 * Not only is this an optimisation, but it is also required 2080 * to check that the address is actually valid, when atomic 2081 * usercopies are used, below. 2082 */ 2083 if (unlikely(iov_iter_fault_in_readable(i, bytes))) { 2084 status = -EFAULT; 2085 break; 2086 } 2087 2088 page = __grab_cache_page(mapping, index); 2089 if (!page) { 2090 status = -ENOMEM; 2091 break; 2092 } 2093 2094 /* 2095 * non-uptodate pages cannot cope with short copies, and we 2096 * cannot take a pagefault with the destination page locked. 2097 * So pin the source page to copy it. 2098 */ 2099 if (!PageUptodate(page) && !segment_eq(get_fs(), KERNEL_DS)) { 2100 unlock_page(page); 2101 2102 src_page = alloc_page(GFP_KERNEL); 2103 if (!src_page) { 2104 page_cache_release(page); 2105 status = -ENOMEM; 2106 break; 2107 } 2108 2109 /* 2110 * Cannot get_user_pages with a page locked for the 2111 * same reason as we can't take a page fault with a 2112 * page locked (as explained below). 2113 */ 2114 copied = iov_iter_copy_from_user(src_page, i, 2115 offset, bytes); 2116 if (unlikely(copied == 0)) { 2117 status = -EFAULT; 2118 page_cache_release(page); 2119 page_cache_release(src_page); 2120 break; 2121 } 2122 bytes = copied; 2123 2124 lock_page(page); 2125 /* 2126 * Can't handle the page going uptodate here, because 2127 * that means we would use non-atomic usercopies, which 2128 * zero out the tail of the page, which can cause 2129 * zeroes to become transiently visible. We could just 2130 * use a non-zeroing copy, but the APIs aren't too 2131 * consistent. 2132 */ 2133 if (unlikely(!page->mapping || PageUptodate(page))) { 2134 unlock_page(page); 2135 page_cache_release(page); 2136 page_cache_release(src_page); 2137 continue; 2138 } 2139 } 2140 2141 status = a_ops->prepare_write(file, page, offset, offset+bytes); 2142 if (unlikely(status)) 2143 goto fs_write_aop_error; 2144 2145 if (!src_page) { 2146 /* 2147 * Must not enter the pagefault handler here, because 2148 * we hold the page lock, so we might recursively 2149 * deadlock on the same lock, or get an ABBA deadlock 2150 * against a different lock, or against the mmap_sem 2151 * (which nests outside the page lock). So increment 2152 * preempt count, and use _atomic usercopies. 2153 * 2154 * The page is uptodate so we are OK to encounter a 2155 * short copy: if unmodified parts of the page are 2156 * marked dirty and written out to disk, it doesn't 2157 * really matter. 2158 */ 2159 pagefault_disable(); 2160 copied = iov_iter_copy_from_user_atomic(page, i, 2161 offset, bytes); 2162 pagefault_enable(); 2163 } else { 2164 void *src, *dst; 2165 src = kmap_atomic(src_page, KM_USER0); 2166 dst = kmap_atomic(page, KM_USER1); 2167 memcpy(dst + offset, src + offset, bytes); 2168 kunmap_atomic(dst, KM_USER1); 2169 kunmap_atomic(src, KM_USER0); 2170 copied = bytes; 2171 } 2172 flush_dcache_page(page); 2173 2174 status = a_ops->commit_write(file, page, offset, offset+bytes); 2175 if (unlikely(status < 0)) 2176 goto fs_write_aop_error; 2177 if (unlikely(status > 0)) /* filesystem did partial write */ 2178 copied = min_t(size_t, copied, status); 2179 2180 unlock_page(page); 2181 mark_page_accessed(page); 2182 page_cache_release(page); 2183 if (src_page) 2184 page_cache_release(src_page); 2185 2186 iov_iter_advance(i, copied); 2187 pos += copied; 2188 written += copied; 2189 2190 balance_dirty_pages_ratelimited(mapping); 2191 cond_resched(); 2192 continue; 2193 2194fs_write_aop_error: 2195 unlock_page(page); 2196 page_cache_release(page); 2197 if (src_page) 2198 page_cache_release(src_page); 2199 2200 /* 2201 * prepare_write() may have instantiated a few blocks 2202 * outside i_size. Trim these off again. Don't need 2203 * i_size_read because we hold i_mutex. 2204 */ 2205 if (pos + bytes > inode->i_size) 2206 vmtruncate(inode, inode->i_size); 2207 break; 2208 } while (iov_iter_count(i)); 2209 2210 return written ? written : status; 2211} 2212 2213static ssize_t generic_perform_write(struct file *file, 2214 struct iov_iter *i, loff_t pos) 2215{ 2216 struct address_space *mapping = file->f_mapping; 2217 const struct address_space_operations *a_ops = mapping->a_ops; 2218 long status = 0; 2219 ssize_t written = 0; 2220 unsigned int flags = 0; 2221 2222 /* 2223 * Copies from kernel address space cannot fail (NFSD is a big user). 2224 */ 2225 if (segment_eq(get_fs(), KERNEL_DS)) 2226 flags |= AOP_FLAG_UNINTERRUPTIBLE; 2227 2228 do { 2229 struct page *page; 2230 pgoff_t index; /* Pagecache index for current page */ 2231 unsigned long offset; /* Offset into pagecache page */ 2232 unsigned long bytes; /* Bytes to write to page */ 2233 size_t copied; /* Bytes copied from user */ 2234 void *fsdata; 2235 2236 offset = (pos & (PAGE_CACHE_SIZE - 1)); 2237 index = pos >> PAGE_CACHE_SHIFT; 2238 bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset, 2239 iov_iter_count(i)); 2240 2241again: 2242 2243 /* 2244 * Bring in the user page that we will copy from _first_. 2245 * Otherwise there's a nasty deadlock on copying from the 2246 * same page as we're writing to, without it being marked 2247 * up-to-date. 2248 * 2249 * Not only is this an optimisation, but it is also required 2250 * to check that the address is actually valid, when atomic 2251 * usercopies are used, below. 2252 */ 2253 if (unlikely(iov_iter_fault_in_readable(i, bytes))) { 2254 status = -EFAULT; 2255 break; 2256 } 2257 2258 status = a_ops->write_begin(file, mapping, pos, bytes, flags, 2259 &page, &fsdata); 2260 if (unlikely(status)) 2261 break; 2262 2263 pagefault_disable(); 2264 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes); 2265 pagefault_enable(); 2266 flush_dcache_page(page); 2267 2268 status = a_ops->write_end(file, mapping, pos, bytes, copied, 2269 page, fsdata); 2270 if (unlikely(status < 0)) 2271 break; 2272 copied = status; 2273 2274 cond_resched(); 2275 2276 iov_iter_advance(i, copied); 2277 if (unlikely(copied == 0)) { 2278 /* 2279 * If we were unable to copy any data at all, we must 2280 * fall back to a single segment length write. 2281 * 2282 * If we didn't fallback here, we could livelock 2283 * because not all segments in the iov can be copied at 2284 * once without a pagefault. 2285 */ 2286 bytes = min_t(unsigned long, PAGE_CACHE_SIZE - offset, 2287 iov_iter_single_seg_count(i)); 2288 goto again; 2289 } 2290 pos += copied; 2291 written += copied; 2292 2293 balance_dirty_pages_ratelimited(mapping); 2294 2295 } while (iov_iter_count(i)); 2296 2297 return written ? written : status; 2298} 2299 2300ssize_t 2301generic_file_buffered_write(struct kiocb *iocb, const struct iovec *iov, 2302 unsigned long nr_segs, loff_t pos, loff_t *ppos, 2303 size_t count, ssize_t written) 2304{ 2305 struct file *file = iocb->ki_filp; 2306 struct address_space *mapping = file->f_mapping; 2307 const struct address_space_operations *a_ops = mapping->a_ops; 2308 struct inode *inode = mapping->host; 2309 ssize_t status; 2310 struct iov_iter i; 2311 2312 iov_iter_init(&i, iov, nr_segs, count, written); 2313 if (a_ops->write_begin) 2314 status = generic_perform_write(file, &i, pos); 2315 else 2316 status = generic_perform_write_2copy(file, &i, pos); 2317 2318 if (likely(status >= 0)) { 2319 written += status; 2320 *ppos = pos + status; 2321 2322 /* 2323 * For now, when the user asks for O_SYNC, we'll actually give 2324 * O_DSYNC 2325 */ 2326 if (unlikely((file->f_flags & O_SYNC) || IS_SYNC(inode))) { 2327 if (!a_ops->writepage || !is_sync_kiocb(iocb)) 2328 status = generic_osync_inode(inode, mapping, 2329 OSYNC_METADATA|OSYNC_DATA); 2330 } 2331 } 2332 2333 /* 2334 * If we get here for O_DIRECT writes then we must have fallen through 2335 * to buffered writes (block instantiation inside i_size). So we sync 2336 * the file data here, to try to honour O_DIRECT expectations. 2337 */ 2338 if (unlikely(file->f_flags & O_DIRECT) && written) 2339 status = filemap_write_and_wait(mapping); 2340 2341 return written ? written : status; 2342} 2343EXPORT_SYMBOL(generic_file_buffered_write); 2344 2345static ssize_t 2346__generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov, 2347 unsigned long nr_segs, loff_t *ppos) 2348{ 2349 struct file *file = iocb->ki_filp; 2350 struct address_space * mapping = file->f_mapping; 2351 size_t ocount; /* original count */ 2352 size_t count; /* after file limit checks */ 2353 struct inode *inode = mapping->host; 2354 loff_t pos; 2355 ssize_t written; 2356 ssize_t err; 2357 2358 ocount = 0; 2359 err = generic_segment_checks(iov, &nr_segs, &ocount, VERIFY_READ); 2360 if (err) 2361 return err; 2362 2363 count = ocount; 2364 pos = *ppos; 2365 2366 vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE); 2367 2368 /* We can write back this queue in page reclaim */ 2369 current->backing_dev_info = mapping->backing_dev_info; 2370 written = 0; 2371 2372 err = generic_write_checks(file, &pos, &count, S_ISBLK(inode->i_mode)); 2373 if (err) 2374 goto out; 2375 2376 if (count == 0) 2377 goto out; 2378 2379 err = remove_suid(file->f_path.dentry); 2380 if (err) 2381 goto out; 2382 2383 file_update_time(file); 2384 2385 /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */ 2386 if (unlikely(file->f_flags & O_DIRECT)) { 2387 loff_t endbyte; 2388 ssize_t written_buffered; 2389 2390 written = generic_file_direct_write(iocb, iov, &nr_segs, pos, 2391 ppos, count, ocount); 2392 if (written < 0 || written == count) 2393 goto out; 2394 /* 2395 * direct-io write to a hole: fall through to buffered I/O 2396 * for completing the rest of the request. 2397 */ 2398 pos += written; 2399 count -= written; 2400 written_buffered = generic_file_buffered_write(iocb, iov, 2401 nr_segs, pos, ppos, count, 2402 written); 2403 /* 2404 * If generic_file_buffered_write() retuned a synchronous error 2405 * then we want to return the number of bytes which were 2406 * direct-written, or the error code if that was zero. Note 2407 * that this differs from normal direct-io semantics, which 2408 * will return -EFOO even if some bytes were written. 2409 */ 2410 if (written_buffered < 0) { 2411 err = written_buffered; 2412 goto out; 2413 } 2414 2415 /* 2416 * We need to ensure that the page cache pages are written to 2417 * disk and invalidated to preserve the expected O_DIRECT 2418 * semantics. 2419 */ 2420 endbyte = pos + written_buffered - written - 1; 2421 err = do_sync_mapping_range(file->f_mapping, pos, endbyte, 2422 SYNC_FILE_RANGE_WAIT_BEFORE| 2423 SYNC_FILE_RANGE_WRITE| 2424 SYNC_FILE_RANGE_WAIT_AFTER); 2425 if (err == 0) { 2426 written = written_buffered; 2427 invalidate_mapping_pages(mapping, 2428 pos >> PAGE_CACHE_SHIFT, 2429 endbyte >> PAGE_CACHE_SHIFT); 2430 } else { 2431 /* 2432 * We don't know how much we wrote, so just return 2433 * the number of bytes which were direct-written 2434 */ 2435 } 2436 } else { 2437 written = generic_file_buffered_write(iocb, iov, nr_segs, 2438 pos, ppos, count, written); 2439 } 2440out: 2441 current->backing_dev_info = NULL; 2442 return written ? written : err; 2443} 2444 2445ssize_t generic_file_aio_write_nolock(struct kiocb *iocb, 2446 const struct iovec *iov, unsigned long nr_segs, loff_t pos) 2447{ 2448 struct file *file = iocb->ki_filp; 2449 struct address_space *mapping = file->f_mapping; 2450 struct inode *inode = mapping->host; 2451 ssize_t ret; 2452 2453 BUG_ON(iocb->ki_pos != pos); 2454 2455 ret = __generic_file_aio_write_nolock(iocb, iov, nr_segs, 2456 &iocb->ki_pos); 2457 2458 if (ret > 0 && ((file->f_flags & O_SYNC) || IS_SYNC(inode))) { 2459 ssize_t err; 2460 2461 err = sync_page_range_nolock(inode, mapping, pos, ret); 2462 if (err < 0) 2463 ret = err; 2464 } 2465 return ret; 2466} 2467EXPORT_SYMBOL(generic_file_aio_write_nolock); 2468 2469ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov, 2470 unsigned long nr_segs, loff_t pos) 2471{ 2472 struct file *file = iocb->ki_filp; 2473 struct address_space *mapping = file->f_mapping; 2474 struct inode *inode = mapping->host; 2475 ssize_t ret; 2476 2477 BUG_ON(iocb->ki_pos != pos); 2478 2479 mutex_lock(&inode->i_mutex); 2480 ret = __generic_file_aio_write_nolock(iocb, iov, nr_segs, 2481 &iocb->ki_pos); 2482 mutex_unlock(&inode->i_mutex); 2483 2484 if (ret > 0 && ((file->f_flags & O_SYNC) || IS_SYNC(inode))) { 2485 ssize_t err; 2486 2487 err = sync_page_range(inode, mapping, pos, ret); 2488 if (err < 0) 2489 ret = err; 2490 } 2491 return ret; 2492} 2493EXPORT_SYMBOL(generic_file_aio_write); 2494 2495/* 2496 * Called under i_mutex for writes to S_ISREG files. Returns -EIO if something 2497 * went wrong during pagecache shootdown. 2498 */ 2499static ssize_t 2500generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov, 2501 loff_t offset, unsigned long nr_segs) 2502{ 2503 struct file *file = iocb->ki_filp; 2504 struct address_space *mapping = file->f_mapping; 2505 ssize_t retval; 2506 size_t write_len; 2507 pgoff_t end = 0; /* silence gcc */ 2508 2509 /* 2510 * If it's a write, unmap all mmappings of the file up-front. This 2511 * will cause any pte dirty bits to be propagated into the pageframes 2512 * for the subsequent filemap_write_and_wait(). 2513 */ 2514 if (rw == WRITE) { 2515 write_len = iov_length(iov, nr_segs); 2516 end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT; 2517 if (mapping_mapped(mapping)) 2518 unmap_mapping_range(mapping, offset, write_len, 0); 2519 } 2520 2521 retval = filemap_write_and_wait(mapping); 2522 if (retval) 2523 goto out; 2524 2525 /* 2526 * After a write we want buffered reads to be sure to go to disk to get 2527 * the new data. We invalidate clean cached page from the region we're 2528 * about to write. We do this *before* the write so that we can return 2529 * -EIO without clobbering -EIOCBQUEUED from ->direct_IO(). 2530 */ 2531 if (rw == WRITE && mapping->nrpages) { 2532 retval = invalidate_inode_pages2_range(mapping, 2533 offset >> PAGE_CACHE_SHIFT, end); 2534 if (retval) 2535 goto out; 2536 } 2537 2538 retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs); 2539 2540 /* 2541 * Finally, try again to invalidate clean pages which might have been 2542 * cached by non-direct readahead, or faulted in by get_user_pages() 2543 * if the source of the write was an mmap'ed region of the file 2544 * we're writing. Either one is a pretty crazy thing to do, 2545 * so we don't support it 100%. If this invalidation 2546 * fails, tough, the write still worked... 2547 */ 2548 if (rw == WRITE && mapping->nrpages) { 2549 invalidate_inode_pages2_range(mapping, offset >> PAGE_CACHE_SHIFT, end); 2550 } 2551out: 2552 return retval; 2553} 2554 2555/** 2556 * try_to_release_page() - release old fs-specific metadata on a page 2557 * 2558 * @page: the page which the kernel is trying to free 2559 * @gfp_mask: memory allocation flags (and I/O mode) 2560 * 2561 * The address_space is to try to release any data against the page 2562 * (presumably at page->private). If the release was successful, return `1'. 2563 * Otherwise return zero. 2564 * 2565 * The @gfp_mask argument specifies whether I/O may be performed to release 2566 * this page (__GFP_IO), and whether the call may block (__GFP_WAIT). 2567 * 2568 * NOTE: @gfp_mask may go away, and this function may become non-blocking. 2569 */ 2570int try_to_release_page(struct page *page, gfp_t gfp_mask) 2571{ 2572 struct address_space * const mapping = page->mapping; 2573 2574 BUG_ON(!PageLocked(page)); 2575 if (PageWriteback(page)) 2576 return 0; 2577 2578 if (mapping && mapping->a_ops->releasepage) 2579 return mapping->a_ops->releasepage(page, gfp_mask); 2580 return try_to_free_buffers(page); 2581} 2582 2583EXPORT_SYMBOL(try_to_release_page); 2584