filemap.c 77.1 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11
/*
 *	linux/mm/filemap.c
 *
 * Copyright (C) 1994-1999  Linus Torvalds
 */

/*
 * This file handles the generic file mmap semantics used by
 * most "normal" filesystems (but you don't /have/ to use this:
 * the NFS filesystem used to do this differently, for example)
 */
12
#include <linux/export.h>
L
Linus Torvalds 已提交
13
#include <linux/compiler.h>
14
#include <linux/dax.h>
L
Linus Torvalds 已提交
15
#include <linux/fs.h>
16
#include <linux/uaccess.h>
17
#include <linux/capability.h>
L
Linus Torvalds 已提交
18
#include <linux/kernel_stat.h>
19
#include <linux/gfp.h>
L
Linus Torvalds 已提交
20 21 22 23 24 25 26 27
#include <linux/mm.h>
#include <linux/swap.h>
#include <linux/mman.h>
#include <linux/pagemap.h>
#include <linux/file.h>
#include <linux/uio.h>
#include <linux/hash.h>
#include <linux/writeback.h>
28
#include <linux/backing-dev.h>
L
Linus Torvalds 已提交
29 30 31
#include <linux/pagevec.h>
#include <linux/blkdev.h>
#include <linux/security.h>
32
#include <linux/cpuset.h>
N
Nick Piggin 已提交
33
#include <linux/hardirq.h> /* for BUG_ON(!in_atomic()) only */
34
#include <linux/hugetlb.h>
35
#include <linux/memcontrol.h>
36
#include <linux/cleancache.h>
37
#include <linux/rmap.h>
38 39
#include "internal.h"

R
Robert Jarzmik 已提交
40 41 42
#define CREATE_TRACE_POINTS
#include <trace/events/filemap.h>

L
Linus Torvalds 已提交
43 44 45
/*
 * FIXME: remove all knowledge of the buffer layer from the core VM
 */
46
#include <linux/buffer_head.h> /* for try_to_free_buffers */
L
Linus Torvalds 已提交
47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

#include <asm/mman.h>

/*
 * Shared mappings implemented 30.11.1994. It's not fully working yet,
 * though.
 *
 * Shared mappings now work. 15.8.1995  Bruno.
 *
 * finished 'unifying' the page and buffer cache and SMP-threaded the
 * page-cache, 21.05.1999, Ingo Molnar <mingo@redhat.com>
 *
 * SMP-threaded pagemap-LRU 1999, Andrea Arcangeli <andrea@suse.de>
 */

/*
 * Lock ordering:
 *
65
 *  ->i_mmap_rwsem		(truncate_pagecache)
L
Linus Torvalds 已提交
66
 *    ->private_lock		(__free_pte->__set_page_dirty_buffers)
67 68
 *      ->swap_lock		(exclusive_swap_page, others)
 *        ->mapping->tree_lock
L
Linus Torvalds 已提交
69
 *
70
 *  ->i_mutex
71
 *    ->i_mmap_rwsem		(truncate->unmap_mapping_range)
L
Linus Torvalds 已提交
72 73
 *
 *  ->mmap_sem
74
 *    ->i_mmap_rwsem
75
 *      ->page_table_lock or pte_lock	(various, mainly in memory.c)
L
Linus Torvalds 已提交
76 77 78 79 80
 *        ->mapping->tree_lock	(arch-dependent flush_dcache_mmap_lock)
 *
 *  ->mmap_sem
 *    ->lock_page		(access_process_vm)
 *
A
Al Viro 已提交
81
 *  ->i_mutex			(generic_perform_write)
82
 *    ->mmap_sem		(fault_in_pages_readable->do_page_fault)
L
Linus Torvalds 已提交
83
 *
84
 *  bdi->wb.list_lock
85
 *    sb_lock			(fs/fs-writeback.c)
L
Linus Torvalds 已提交
86 87
 *    ->mapping->tree_lock	(__sync_single_inode)
 *
88
 *  ->i_mmap_rwsem
L
Linus Torvalds 已提交
89 90 91
 *    ->anon_vma.lock		(vma_adjust)
 *
 *  ->anon_vma.lock
92
 *    ->page_table_lock or pte_lock	(anon_vma_prepare and various)
L
Linus Torvalds 已提交
93
 *
94
 *  ->page_table_lock or pte_lock
95
 *    ->swap_lock		(try_to_unmap_one)
L
Linus Torvalds 已提交
96 97
 *    ->private_lock		(try_to_unmap_one)
 *    ->tree_lock		(try_to_unmap_one)
98 99
 *    ->zone_lru_lock(zone)	(follow_page->mark_page_accessed)
 *    ->zone_lru_lock(zone)	(check_pte_range->isolate_lru_page)
L
Linus Torvalds 已提交
100 101
 *    ->private_lock		(page_remove_rmap->set_page_dirty)
 *    ->tree_lock		(page_remove_rmap->set_page_dirty)
102
 *    bdi.wb->list_lock		(page_remove_rmap->set_page_dirty)
103
 *    ->inode->i_lock		(page_remove_rmap->set_page_dirty)
104
 *    ->memcg->move_lock	(page_remove_rmap->lock_page_memcg)
105
 *    bdi.wb->list_lock		(zap_pte_range->set_page_dirty)
106
 *    ->inode->i_lock		(zap_pte_range->set_page_dirty)
L
Linus Torvalds 已提交
107 108
 *    ->private_lock		(zap_pte_range->__set_page_dirty_buffers)
 *
109
 * ->i_mmap_rwsem
110
 *   ->tasklist_lock            (memory_failure, collect_procs_ao)
L
Linus Torvalds 已提交
111 112
 */

113 114 115
static void page_cache_tree_delete(struct address_space *mapping,
				   struct page *page, void *shadow)
{
116
	struct radix_tree_node *node;
117
	int i, nr = PageHuge(page) ? 1 : hpage_nr_pages(page);
118

119 120 121
	VM_BUG_ON_PAGE(!PageLocked(page), page);
	VM_BUG_ON_PAGE(PageTail(page), page);
	VM_BUG_ON_PAGE(nr != 1 && shadow, page);
122 123

	if (shadow) {
124
		mapping->nrexceptional += nr;
125
		/*
126
		 * Make sure the nrexceptional update is committed before
127 128 129 130 131
		 * the nrpages update so that final truncate racing
		 * with reclaim does not see both counters 0 at the
		 * same time and miss a shadow entry.
		 */
		smp_wmb();
132
	}
133
	mapping->nrpages -= nr;
134

135 136 137 138 139
	for (i = 0; i < nr; i++) {
		node = radix_tree_replace_clear_tags(&mapping->page_tree,
				page->index + i, shadow);
		if (!node) {
			VM_BUG_ON_PAGE(nr != 1, page);
140
			return;
141
		}
142

143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164
		workingset_node_pages_dec(node);
		if (shadow)
			workingset_node_shadows_inc(node);
		else
			if (__radix_tree_delete_node(&mapping->page_tree, node))
				continue;

		/*
		 * Track node that only contains shadow entries. DAX mappings
		 * contain no shadow entries and may contain other exceptional
		 * entries so skip those.
		 *
		 * Avoid acquiring the list_lru lock if already tracked.
		 * The list_empty() test is safe as node->private_list is
		 * protected by mapping->tree_lock.
		 */
		if (!dax_mapping(mapping) && !workingset_node_pages(node) &&
				list_empty(&node->private_list)) {
			node->private_data = mapping;
			list_lru_add(&workingset_shadow_nodes,
					&node->private_list);
		}
165
	}
166 167
}

L
Linus Torvalds 已提交
168
/*
169
 * Delete a page from the page cache and free it. Caller has to make
L
Linus Torvalds 已提交
170
 * sure the page is locked and that nobody else uses it - or that usage
171
 * is safe.  The caller must hold the mapping's tree_lock.
L
Linus Torvalds 已提交
172
 */
J
Johannes Weiner 已提交
173
void __delete_from_page_cache(struct page *page, void *shadow)
L
Linus Torvalds 已提交
174 175
{
	struct address_space *mapping = page->mapping;
176
	int nr = hpage_nr_pages(page);
L
Linus Torvalds 已提交
177

R
Robert Jarzmik 已提交
178
	trace_mm_filemap_delete_from_page_cache(page);
179 180 181 182 183 184 185 186
	/*
	 * if we're uptodate, flush out into the cleancache, otherwise
	 * invalidate any existing cleancache entries.  We can't leave
	 * stale data around in the cleancache once our page is gone
	 */
	if (PageUptodate(page) && PageMappedToDisk(page))
		cleancache_put_page(page);
	else
187
		cleancache_invalidate_page(mapping, page);
188

189
	VM_BUG_ON_PAGE(PageTail(page), page);
190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209
	VM_BUG_ON_PAGE(page_mapped(page), page);
	if (!IS_ENABLED(CONFIG_DEBUG_VM) && unlikely(page_mapped(page))) {
		int mapcount;

		pr_alert("BUG: Bad page cache in process %s  pfn:%05lx\n",
			 current->comm, page_to_pfn(page));
		dump_page(page, "still mapped when deleted");
		dump_stack();
		add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);

		mapcount = page_mapcount(page);
		if (mapping_exiting(mapping) &&
		    page_count(page) >= mapcount + 2) {
			/*
			 * All vmas have already been torn down, so it's
			 * a good bet that actually the page is unmapped,
			 * and we'd prefer not to leak it: if we're wrong,
			 * some other bad page check should catch it later.
			 */
			page_mapcount_reset(page);
210
			page_ref_sub(page, mapcount);
211 212 213
		}
	}

214 215
	page_cache_tree_delete(mapping, page, shadow);

L
Linus Torvalds 已提交
216
	page->mapping = NULL;
217
	/* Leave page->index set: truncation lookup relies upon it */
218

219 220
	/* hugetlb pages do not participate in page cache accounting. */
	if (!PageHuge(page))
221
		__mod_node_page_state(page_pgdat(page), NR_FILE_PAGES, -nr);
222
	if (PageSwapBacked(page)) {
223
		__mod_node_page_state(page_pgdat(page), NR_SHMEM, -nr);
224
		if (PageTransHuge(page))
225
			__dec_node_page_state(page, NR_SHMEM_THPS);
226 227 228
	} else {
		VM_BUG_ON_PAGE(PageTransHuge(page) && !PageHuge(page), page);
	}
229 230

	/*
231 232
	 * At this point page must be either written or cleaned by truncate.
	 * Dirty page here signals a bug and loss of unwritten data.
233
	 *
234 235 236
	 * This fixes dirty accounting after removing the page entirely but
	 * leaves PageDirty set: it has no effect for truncated page and
	 * anyway will be cleared before returning page into buddy allocator.
237
	 */
238
	if (WARN_ON_ONCE(PageDirty(page)))
J
Johannes Weiner 已提交
239
		account_page_cleaned(page, mapping, inode_to_wb(mapping->host));
L
Linus Torvalds 已提交
240 241
}

242 243 244 245 246 247 248 249 250
/**
 * delete_from_page_cache - delete page from page cache
 * @page: the page which the kernel is trying to remove from page cache
 *
 * This must be called only on pages that have been verified to be in the page
 * cache and locked.  It will never put the page into the free list, the caller
 * has a reference on the page.
 */
void delete_from_page_cache(struct page *page)
L
Linus Torvalds 已提交
251
{
252
	struct address_space *mapping = page_mapping(page);
253
	unsigned long flags;
254
	void (*freepage)(struct page *);
L
Linus Torvalds 已提交
255

M
Matt Mackall 已提交
256
	BUG_ON(!PageLocked(page));
L
Linus Torvalds 已提交
257

258
	freepage = mapping->a_ops->freepage;
259 260

	spin_lock_irqsave(&mapping->tree_lock, flags);
J
Johannes Weiner 已提交
261
	__delete_from_page_cache(page, NULL);
262
	spin_unlock_irqrestore(&mapping->tree_lock, flags);
263 264 265

	if (freepage)
		freepage(page);
266 267 268 269 270 271 272

	if (PageTransHuge(page) && !PageHuge(page)) {
		page_ref_sub(page, HPAGE_PMD_NR);
		VM_BUG_ON_PAGE(page_count(page) <= 0, page);
	} else {
		put_page(page);
	}
273 274 275
}
EXPORT_SYMBOL(delete_from_page_cache);

276
int filemap_check_errors(struct address_space *mapping)
277 278 279
{
	int ret = 0;
	/* Check for outstanding write errors */
280 281
	if (test_bit(AS_ENOSPC, &mapping->flags) &&
	    test_and_clear_bit(AS_ENOSPC, &mapping->flags))
282
		ret = -ENOSPC;
283 284
	if (test_bit(AS_EIO, &mapping->flags) &&
	    test_and_clear_bit(AS_EIO, &mapping->flags))
285 286 287
		ret = -EIO;
	return ret;
}
288
EXPORT_SYMBOL(filemap_check_errors);
289

L
Linus Torvalds 已提交
290
/**
291
 * __filemap_fdatawrite_range - start writeback on mapping dirty pages in range
292 293
 * @mapping:	address space structure to write
 * @start:	offset in bytes where the range starts
294
 * @end:	offset in bytes where the range ends (inclusive)
295
 * @sync_mode:	enable synchronous operation
L
Linus Torvalds 已提交
296
 *
297 298 299
 * Start writeback against all of a mapping's dirty pages that lie
 * within the byte offsets <start, end> inclusive.
 *
L
Linus Torvalds 已提交
300
 * If sync_mode is WB_SYNC_ALL then this is a "data integrity" operation, as
301
 * opposed to a regular memory cleansing writeback.  The difference between
L
Linus Torvalds 已提交
302 303 304
 * these two operations is that if a dirty page/buffer is encountered, it must
 * be waited upon, and not just skipped over.
 */
305 306
int __filemap_fdatawrite_range(struct address_space *mapping, loff_t start,
				loff_t end, int sync_mode)
L
Linus Torvalds 已提交
307 308 309 310
{
	int ret;
	struct writeback_control wbc = {
		.sync_mode = sync_mode,
311
		.nr_to_write = LONG_MAX,
312 313
		.range_start = start,
		.range_end = end,
L
Linus Torvalds 已提交
314 315 316 317 318
	};

	if (!mapping_cap_writeback_dirty(mapping))
		return 0;

319
	wbc_attach_fdatawrite_inode(&wbc, mapping->host);
L
Linus Torvalds 已提交
320
	ret = do_writepages(mapping, &wbc);
321
	wbc_detach_inode(&wbc);
L
Linus Torvalds 已提交
322 323 324 325 326 327
	return ret;
}

static inline int __filemap_fdatawrite(struct address_space *mapping,
	int sync_mode)
{
328
	return __filemap_fdatawrite_range(mapping, 0, LLONG_MAX, sync_mode);
L
Linus Torvalds 已提交
329 330 331 332 333 334 335 336
}

int filemap_fdatawrite(struct address_space *mapping)
{
	return __filemap_fdatawrite(mapping, WB_SYNC_ALL);
}
EXPORT_SYMBOL(filemap_fdatawrite);

337
int filemap_fdatawrite_range(struct address_space *mapping, loff_t start,
338
				loff_t end)
L
Linus Torvalds 已提交
339 340 341
{
	return __filemap_fdatawrite_range(mapping, start, end, WB_SYNC_ALL);
}
342
EXPORT_SYMBOL(filemap_fdatawrite_range);
L
Linus Torvalds 已提交
343

344 345 346 347
/**
 * filemap_flush - mostly a non-blocking flush
 * @mapping:	target address_space
 *
L
Linus Torvalds 已提交
348 349 350 351 352 353 354 355 356
 * This is a mostly non-blocking flush.  Not suitable for data-integrity
 * purposes - I/O may not be started against all dirty pages.
 */
int filemap_flush(struct address_space *mapping)
{
	return __filemap_fdatawrite(mapping, WB_SYNC_NONE);
}
EXPORT_SYMBOL(filemap_flush);

357 358
static int __filemap_fdatawait_range(struct address_space *mapping,
				     loff_t start_byte, loff_t end_byte)
L
Linus Torvalds 已提交
359
{
360 361
	pgoff_t index = start_byte >> PAGE_SHIFT;
	pgoff_t end = end_byte >> PAGE_SHIFT;
L
Linus Torvalds 已提交
362 363
	struct pagevec pvec;
	int nr_pages;
364
	int ret = 0;
L
Linus Torvalds 已提交
365

366
	if (end_byte < start_byte)
367
		goto out;
L
Linus Torvalds 已提交
368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383

	pagevec_init(&pvec, 0);
	while ((index <= end) &&
			(nr_pages = pagevec_lookup_tag(&pvec, mapping, &index,
			PAGECACHE_TAG_WRITEBACK,
			min(end - index, (pgoff_t)PAGEVEC_SIZE-1) + 1)) != 0) {
		unsigned i;

		for (i = 0; i < nr_pages; i++) {
			struct page *page = pvec.pages[i];

			/* until radix tree lookup accepts end_index */
			if (page->index > end)
				continue;

			wait_on_page_writeback(page);
384
			if (TestClearPageError(page))
L
Linus Torvalds 已提交
385 386 387 388 389
				ret = -EIO;
		}
		pagevec_release(&pvec);
		cond_resched();
	}
390
out:
391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413
	return ret;
}

/**
 * filemap_fdatawait_range - wait for writeback to complete
 * @mapping:		address space structure to wait for
 * @start_byte:		offset in bytes where the range starts
 * @end_byte:		offset in bytes where the range ends (inclusive)
 *
 * Walk the list of under-writeback pages of the given address space
 * in the given range and wait for all of them.  Check error status of
 * the address space and return it.
 *
 * Since the error status of the address space is cleared by this function,
 * callers are responsible for checking the return value and handling and/or
 * reporting the error.
 */
int filemap_fdatawait_range(struct address_space *mapping, loff_t start_byte,
			    loff_t end_byte)
{
	int ret, ret2;

	ret = __filemap_fdatawait_range(mapping, start_byte, end_byte);
414 415 416
	ret2 = filemap_check_errors(mapping);
	if (!ret)
		ret = ret2;
L
Linus Torvalds 已提交
417 418 419

	return ret;
}
420 421
EXPORT_SYMBOL(filemap_fdatawait_range);

422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443
/**
 * filemap_fdatawait_keep_errors - wait for writeback without clearing errors
 * @mapping: address space structure to wait for
 *
 * Walk the list of under-writeback pages of the given address space
 * and wait for all of them.  Unlike filemap_fdatawait(), this function
 * does not clear error status of the address space.
 *
 * Use this function if callers don't handle errors themselves.  Expected
 * call sites are system-wide / filesystem-wide data flushers: e.g. sync(2),
 * fsfreeze(8)
 */
void filemap_fdatawait_keep_errors(struct address_space *mapping)
{
	loff_t i_size = i_size_read(mapping->host);

	if (i_size == 0)
		return;

	__filemap_fdatawait_range(mapping, 0, i_size - 1);
}

L
Linus Torvalds 已提交
444
/**
445
 * filemap_fdatawait - wait for all under-writeback pages to complete
L
Linus Torvalds 已提交
446
 * @mapping: address space structure to wait for
447 448
 *
 * Walk the list of under-writeback pages of the given address space
449 450 451 452 453 454
 * and wait for all of them.  Check error status of the address space
 * and return it.
 *
 * Since the error status of the address space is cleared by this function,
 * callers are responsible for checking the return value and handling and/or
 * reporting the error.
L
Linus Torvalds 已提交
455 456 457 458 459 460 461 462
 */
int filemap_fdatawait(struct address_space *mapping)
{
	loff_t i_size = i_size_read(mapping->host);

	if (i_size == 0)
		return 0;

463
	return filemap_fdatawait_range(mapping, 0, i_size - 1);
L
Linus Torvalds 已提交
464 465 466 467 468
}
EXPORT_SYMBOL(filemap_fdatawait);

int filemap_write_and_wait(struct address_space *mapping)
{
469
	int err = 0;
L
Linus Torvalds 已提交
470

471 472
	if ((!dax_mapping(mapping) && mapping->nrpages) ||
	    (dax_mapping(mapping) && mapping->nrexceptional)) {
473 474 475 476 477 478 479 480 481 482 483 484
		err = filemap_fdatawrite(mapping);
		/*
		 * Even if the above returned error, the pages may be
		 * written partially (e.g. -ENOSPC), so we wait for it.
		 * But the -EIO is special case, it may indicate the worst
		 * thing (e.g. bug) happened, so we avoid waiting for it.
		 */
		if (err != -EIO) {
			int err2 = filemap_fdatawait(mapping);
			if (!err)
				err = err2;
		}
485 486
	} else {
		err = filemap_check_errors(mapping);
L
Linus Torvalds 已提交
487
	}
488
	return err;
L
Linus Torvalds 已提交
489
}
490
EXPORT_SYMBOL(filemap_write_and_wait);
L
Linus Torvalds 已提交
491

492 493 494 495 496 497
/**
 * filemap_write_and_wait_range - write out & wait on a file range
 * @mapping:	the address_space for the pages
 * @lstart:	offset in bytes where the range starts
 * @lend:	offset in bytes where the range ends (inclusive)
 *
498 499 500 501 502
 * Write out and wait upon file offsets lstart->lend, inclusive.
 *
 * Note that `lend' is inclusive (describes the last byte to be written) so
 * that this function can be used to write to the very end-of-file (end = -1).
 */
L
Linus Torvalds 已提交
503 504 505
int filemap_write_and_wait_range(struct address_space *mapping,
				 loff_t lstart, loff_t lend)
{
506
	int err = 0;
L
Linus Torvalds 已提交
507

508 509
	if ((!dax_mapping(mapping) && mapping->nrpages) ||
	    (dax_mapping(mapping) && mapping->nrexceptional)) {
510 511 512 513
		err = __filemap_fdatawrite_range(mapping, lstart, lend,
						 WB_SYNC_ALL);
		/* See comment of filemap_write_and_wait() */
		if (err != -EIO) {
514 515
			int err2 = filemap_fdatawait_range(mapping,
						lstart, lend);
516 517 518
			if (!err)
				err = err2;
		}
519 520
	} else {
		err = filemap_check_errors(mapping);
L
Linus Torvalds 已提交
521
	}
522
	return err;
L
Linus Torvalds 已提交
523
}
524
EXPORT_SYMBOL(filemap_write_and_wait_range);
L
Linus Torvalds 已提交
525

526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544
/**
 * replace_page_cache_page - replace a pagecache page with a new one
 * @old:	page to be replaced
 * @new:	page to replace with
 * @gfp_mask:	allocation mode
 *
 * This function replaces a page in the pagecache with a new one.  On
 * success it acquires the pagecache reference for the new page and
 * drops it for the old page.  Both the old and new pages must be
 * locked.  This function does not add the new page to the LRU, the
 * caller must do that.
 *
 * The remove + add is atomic.  The only way this function can fail is
 * memory allocation failure.
 */
int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask)
{
	int error;

545 546 547
	VM_BUG_ON_PAGE(!PageLocked(old), old);
	VM_BUG_ON_PAGE(!PageLocked(new), new);
	VM_BUG_ON_PAGE(new->mapping, new);
548 549 550 551 552

	error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM);
	if (!error) {
		struct address_space *mapping = old->mapping;
		void (*freepage)(struct page *);
553
		unsigned long flags;
554 555 556 557

		pgoff_t offset = old->index;
		freepage = mapping->a_ops->freepage;

558
		get_page(new);
559 560 561
		new->mapping = mapping;
		new->index = offset;

562
		spin_lock_irqsave(&mapping->tree_lock, flags);
J
Johannes Weiner 已提交
563
		__delete_from_page_cache(old, NULL);
564 565 566
		error = radix_tree_insert(&mapping->page_tree, offset, new);
		BUG_ON(error);
		mapping->nrpages++;
567 568 569 570 571

		/*
		 * hugetlb pages do not participate in page cache accounting.
		 */
		if (!PageHuge(new))
572
			__inc_node_page_state(new, NR_FILE_PAGES);
573
		if (PageSwapBacked(new))
574
			__inc_node_page_state(new, NR_SHMEM);
575
		spin_unlock_irqrestore(&mapping->tree_lock, flags);
576
		mem_cgroup_migrate(old, new);
577 578 579
		radix_tree_preload_end();
		if (freepage)
			freepage(old);
580
		put_page(old);
581 582 583 584 585 586
	}

	return error;
}
EXPORT_SYMBOL_GPL(replace_page_cache_page);

587
static int page_cache_tree_insert(struct address_space *mapping,
588
				  struct page *page, void **shadowp)
589
{
590
	struct radix_tree_node *node;
591 592 593
	void **slot;
	int error;

594
	error = __radix_tree_create(&mapping->page_tree, page->index, 0,
595 596 597 598
				    &node, &slot);
	if (error)
		return error;
	if (*slot) {
599 600 601 602 603
		void *p;

		p = radix_tree_deref_slot_protected(slot, &mapping->tree_lock);
		if (!radix_tree_exceptional_entry(p))
			return -EEXIST;
604 605

		mapping->nrexceptional--;
606 607 608 609 610 611 612 613 614 615 616 617 618
		if (!dax_mapping(mapping)) {
			if (shadowp)
				*shadowp = p;
			if (node)
				workingset_node_shadows_dec(node);
		} else {
			/* DAX can replace empty locked entry with a hole */
			WARN_ON_ONCE(p !=
				(void *)(RADIX_TREE_EXCEPTIONAL_ENTRY |
					 RADIX_DAX_ENTRY_LOCK));
			/* DAX accounts exceptional entries as normal pages */
			if (node)
				workingset_node_pages_dec(node);
J
Jan Kara 已提交
619 620 621
			/* Wakeup waiters for exceptional entry lock */
			dax_wake_mapping_entry_waiter(mapping, page->index,
						      false);
622
		}
623
	}
624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640
	radix_tree_replace_slot(slot, page);
	mapping->nrpages++;
	if (node) {
		workingset_node_pages_inc(node);
		/*
		 * Don't track node that contains actual pages.
		 *
		 * Avoid acquiring the list_lru lock if already
		 * untracked.  The list_empty() test is safe as
		 * node->private_list is protected by
		 * mapping->tree_lock.
		 */
		if (!list_empty(&node->private_list))
			list_lru_del(&workingset_shadow_nodes,
				     &node->private_list);
	}
	return 0;
641 642
}

643 644 645 646
static int __add_to_page_cache_locked(struct page *page,
				      struct address_space *mapping,
				      pgoff_t offset, gfp_t gfp_mask,
				      void **shadowp)
L
Linus Torvalds 已提交
647
{
648 649
	int huge = PageHuge(page);
	struct mem_cgroup *memcg;
N
Nick Piggin 已提交
650 651
	int error;

652 653
	VM_BUG_ON_PAGE(!PageLocked(page), page);
	VM_BUG_ON_PAGE(PageSwapBacked(page), page);
N
Nick Piggin 已提交
654

655 656
	if (!huge) {
		error = mem_cgroup_try_charge(page, current->mm,
657
					      gfp_mask, &memcg, false);
658 659 660
		if (error)
			return error;
	}
L
Linus Torvalds 已提交
661

662
	error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM);
663
	if (error) {
664
		if (!huge)
665
			mem_cgroup_cancel_charge(page, memcg, false);
666 667 668
		return error;
	}

669
	get_page(page);
670 671 672 673
	page->mapping = mapping;
	page->index = offset;

	spin_lock_irq(&mapping->tree_lock);
674
	error = page_cache_tree_insert(mapping, page, shadowp);
675 676 677
	radix_tree_preload_end();
	if (unlikely(error))
		goto err_insert;
678 679 680

	/* hugetlb pages do not participate in page cache accounting. */
	if (!huge)
681
		__inc_node_page_state(page, NR_FILE_PAGES);
682
	spin_unlock_irq(&mapping->tree_lock);
683
	if (!huge)
684
		mem_cgroup_commit_charge(page, memcg, false, false);
685 686 687 688 689 690
	trace_mm_filemap_add_to_page_cache(page);
	return 0;
err_insert:
	page->mapping = NULL;
	/* Leave page->index set: truncation relies upon it */
	spin_unlock_irq(&mapping->tree_lock);
691
	if (!huge)
692
		mem_cgroup_cancel_charge(page, memcg, false);
693
	put_page(page);
L
Linus Torvalds 已提交
694 695
	return error;
}
696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712

/**
 * add_to_page_cache_locked - add a locked page to the pagecache
 * @page:	page to add
 * @mapping:	the page's address_space
 * @offset:	page index
 * @gfp_mask:	page allocation mode
 *
 * This function is used to add a page to the pagecache. It must be locked.
 * This function does not add the page to the LRU.  The caller must do that.
 */
int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
		pgoff_t offset, gfp_t gfp_mask)
{
	return __add_to_page_cache_locked(page, mapping, offset,
					  gfp_mask, NULL);
}
N
Nick Piggin 已提交
713
EXPORT_SYMBOL(add_to_page_cache_locked);
L
Linus Torvalds 已提交
714 715

int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
A
Al Viro 已提交
716
				pgoff_t offset, gfp_t gfp_mask)
L
Linus Torvalds 已提交
717
{
718
	void *shadow = NULL;
719 720
	int ret;

721
	__SetPageLocked(page);
722 723 724
	ret = __add_to_page_cache_locked(page, mapping, offset,
					 gfp_mask, &shadow);
	if (unlikely(ret))
725
		__ClearPageLocked(page);
726 727 728 729 730
	else {
		/*
		 * The page might have been evicted from cache only
		 * recently, in which case it should be activated like
		 * any other repeatedly accessed page.
731 732 733
		 * The exception is pages getting rewritten; evicting other
		 * data from the working set, only to cache data that will
		 * get overwritten with something else, is a waste of memory.
734
		 */
735 736
		if (!(gfp_mask & __GFP_WRITE) &&
		    shadow && workingset_refault(shadow)) {
737 738 739 740 741 742
			SetPageActive(page);
			workingset_activation(page);
		} else
			ClearPageActive(page);
		lru_cache_add(page);
	}
L
Linus Torvalds 已提交
743 744
	return ret;
}
745
EXPORT_SYMBOL_GPL(add_to_page_cache_lru);
L
Linus Torvalds 已提交
746

747
#ifdef CONFIG_NUMA
748
struct page *__page_cache_alloc(gfp_t gfp)
749
{
750 751 752
	int n;
	struct page *page;

753
	if (cpuset_do_page_mem_spread()) {
754 755
		unsigned int cpuset_mems_cookie;
		do {
756
			cpuset_mems_cookie = read_mems_allowed_begin();
757
			n = cpuset_mem_spread_node();
758
			page = __alloc_pages_node(n, gfp, 0);
759
		} while (!page && read_mems_allowed_retry(cpuset_mems_cookie));
760

761
		return page;
762
	}
763
	return alloc_pages(gfp, 0);
764
}
765
EXPORT_SYMBOL(__page_cache_alloc);
766 767
#endif

L
Linus Torvalds 已提交
768 769 770 771 772 773 774 775 776 777
/*
 * In order to wait for pages to become available there must be
 * waitqueues associated with pages. By using a hash table of
 * waitqueues where the bucket discipline is to maintain all
 * waiters on the same queue and wake all when any of the pages
 * become available, and for the woken contexts to check to be
 * sure the appropriate page became available, this saves space
 * at a cost of "thundering herd" phenomena during rare hash
 * collisions.
 */
N
NeilBrown 已提交
778
wait_queue_head_t *page_waitqueue(struct page *page)
L
Linus Torvalds 已提交
779 780 781 782 783
{
	const struct zone *zone = page_zone(page);

	return &zone->wait_table[hash_ptr(page, zone->wait_table_bits)];
}
N
NeilBrown 已提交
784
EXPORT_SYMBOL(page_waitqueue);
L
Linus Torvalds 已提交
785

H
Harvey Harrison 已提交
786
void wait_on_page_bit(struct page *page, int bit_nr)
L
Linus Torvalds 已提交
787 788 789 790
{
	DEFINE_WAIT_BIT(wait, &page->flags, bit_nr);

	if (test_bit(bit_nr, &page->flags))
791
		__wait_on_bit(page_waitqueue(page), &wait, bit_wait_io,
L
Linus Torvalds 已提交
792 793 794 795
							TASK_UNINTERRUPTIBLE);
}
EXPORT_SYMBOL(wait_on_page_bit);

796 797 798 799 800 801 802 803
int wait_on_page_bit_killable(struct page *page, int bit_nr)
{
	DEFINE_WAIT_BIT(wait, &page->flags, bit_nr);

	if (!test_bit(bit_nr, &page->flags))
		return 0;

	return __wait_on_bit(page_waitqueue(page), &wait,
804
			     bit_wait_io, TASK_KILLABLE);
805 806
}

807 808 809 810 811 812 813 814 815 816 817 818 819
int wait_on_page_bit_killable_timeout(struct page *page,
				       int bit_nr, unsigned long timeout)
{
	DEFINE_WAIT_BIT(wait, &page->flags, bit_nr);

	wait.key.timeout = jiffies + timeout;
	if (!test_bit(bit_nr, &page->flags))
		return 0;
	return __wait_on_bit(page_waitqueue(page), &wait,
			     bit_wait_io_timeout, TASK_KILLABLE);
}
EXPORT_SYMBOL_GPL(wait_on_page_bit_killable_timeout);

820 821
/**
 * add_page_wait_queue - Add an arbitrary waiter to a page's wait queue
R
Randy Dunlap 已提交
822 823
 * @page: Page defining the wait queue of interest
 * @waiter: Waiter to add to the queue
824 825 826 827 828 829 830 831 832 833 834 835 836 837
 *
 * Add an arbitrary @waiter to the wait queue for the nominated @page.
 */
void add_page_wait_queue(struct page *page, wait_queue_t *waiter)
{
	wait_queue_head_t *q = page_waitqueue(page);
	unsigned long flags;

	spin_lock_irqsave(&q->lock, flags);
	__add_wait_queue(q, waiter);
	spin_unlock_irqrestore(&q->lock, flags);
}
EXPORT_SYMBOL_GPL(add_page_wait_queue);

L
Linus Torvalds 已提交
838
/**
839
 * unlock_page - unlock a locked page
L
Linus Torvalds 已提交
840 841 842 843
 * @page: the page
 *
 * Unlocks the page and wakes up sleepers in ___wait_on_page_locked().
 * Also wakes sleepers in wait_on_page_writeback() because the wakeup
844
 * mechanism between PageLocked pages and PageWriteback pages is shared.
L
Linus Torvalds 已提交
845 846
 * But that's OK - sleepers in wait_on_page_writeback() just go back to sleep.
 *
N
Nick Piggin 已提交
847 848
 * The mb is necessary to enforce ordering between the clear_bit and the read
 * of the waitqueue (to avoid SMP races with a parallel wait_on_page_locked()).
L
Linus Torvalds 已提交
849
 */
H
Harvey Harrison 已提交
850
void unlock_page(struct page *page)
L
Linus Torvalds 已提交
851
{
852
	page = compound_head(page);
853
	VM_BUG_ON_PAGE(!PageLocked(page), page);
N
Nick Piggin 已提交
854
	clear_bit_unlock(PG_locked, &page->flags);
855
	smp_mb__after_atomic();
L
Linus Torvalds 已提交
856 857 858 859
	wake_up_page(page, PG_locked);
}
EXPORT_SYMBOL(unlock_page);

860 861 862
/**
 * end_page_writeback - end writeback against a page
 * @page: the page
L
Linus Torvalds 已提交
863 864 865
 */
void end_page_writeback(struct page *page)
{
866 867 868 869 870 871 872 873 874
	/*
	 * TestClearPageReclaim could be used here but it is an atomic
	 * operation and overkill in this particular case. Failing to
	 * shuffle a page marked for immediate reclaim is too mild to
	 * justify taking an atomic operation penalty at the end of
	 * ever page writeback.
	 */
	if (PageReclaim(page)) {
		ClearPageReclaim(page);
875
		rotate_reclaimable_page(page);
876
	}
877 878 879 880

	if (!test_clear_page_writeback(page))
		BUG();

881
	smp_mb__after_atomic();
L
Linus Torvalds 已提交
882 883 884 885
	wake_up_page(page, PG_writeback);
}
EXPORT_SYMBOL(end_page_writeback);

886 887 888 889
/*
 * After completing I/O on a page, call this routine to update the page
 * flags appropriately
 */
890
void page_endio(struct page *page, int op, int err)
891
{
892
	if (!op_is_write(op)) {
893 894 895 896 897 898 899
		if (!err) {
			SetPageUptodate(page);
		} else {
			ClearPageUptodate(page);
			SetPageError(page);
		}
		unlock_page(page);
900
	} else {
901 902 903 904 905 906 907 908 909 910
		if (err) {
			SetPageError(page);
			if (page->mapping)
				mapping_set_error(page->mapping, err);
		}
		end_page_writeback(page);
	}
}
EXPORT_SYMBOL_GPL(page_endio);

911 912 913
/**
 * __lock_page - get a lock on the page, assuming we need to sleep to get it
 * @page: the page to lock
L
Linus Torvalds 已提交
914
 */
H
Harvey Harrison 已提交
915
void __lock_page(struct page *page)
L
Linus Torvalds 已提交
916
{
917 918
	struct page *page_head = compound_head(page);
	DEFINE_WAIT_BIT(wait, &page_head->flags, PG_locked);
L
Linus Torvalds 已提交
919

920
	__wait_on_bit_lock(page_waitqueue(page_head), &wait, bit_wait_io,
L
Linus Torvalds 已提交
921 922 923 924
							TASK_UNINTERRUPTIBLE);
}
EXPORT_SYMBOL(__lock_page);

H
Harvey Harrison 已提交
925
int __lock_page_killable(struct page *page)
M
Matthew Wilcox 已提交
926
{
927 928
	struct page *page_head = compound_head(page);
	DEFINE_WAIT_BIT(wait, &page_head->flags, PG_locked);
M
Matthew Wilcox 已提交
929

930
	return __wait_on_bit_lock(page_waitqueue(page_head), &wait,
931
					bit_wait_io, TASK_KILLABLE);
M
Matthew Wilcox 已提交
932
}
933
EXPORT_SYMBOL_GPL(__lock_page_killable);
M
Matthew Wilcox 已提交
934

935 936 937 938 939 940 941 942 943 944 945
/*
 * Return values:
 * 1 - page is locked; mmap_sem is still held.
 * 0 - page is not locked.
 *     mmap_sem has been released (up_read()), unless flags had both
 *     FAULT_FLAG_ALLOW_RETRY and FAULT_FLAG_RETRY_NOWAIT set, in
 *     which case mmap_sem is still held.
 *
 * If neither ALLOW_RETRY nor KILLABLE are set, will always return 1
 * with the page locked and the mmap_sem unperturbed.
 */
946 947 948
int __lock_page_or_retry(struct page *page, struct mm_struct *mm,
			 unsigned int flags)
{
949 950 951 952 953 954 955 956 957 958 959 960
	if (flags & FAULT_FLAG_ALLOW_RETRY) {
		/*
		 * CAUTION! In this case, mmap_sem is not released
		 * even though return 0.
		 */
		if (flags & FAULT_FLAG_RETRY_NOWAIT)
			return 0;

		up_read(&mm->mmap_sem);
		if (flags & FAULT_FLAG_KILLABLE)
			wait_on_page_locked_killable(page);
		else
961
			wait_on_page_locked(page);
962
		return 0;
963 964 965 966 967 968 969 970 971 972 973 974
	} else {
		if (flags & FAULT_FLAG_KILLABLE) {
			int ret;

			ret = __lock_page_killable(page);
			if (ret) {
				up_read(&mm->mmap_sem);
				return 0;
			}
		} else
			__lock_page(page);
		return 1;
975 976 977
	}
}

978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004
/**
 * page_cache_next_hole - find the next hole (not-present entry)
 * @mapping: mapping
 * @index: index
 * @max_scan: maximum range to search
 *
 * Search the set [index, min(index+max_scan-1, MAX_INDEX)] for the
 * lowest indexed hole.
 *
 * Returns: the index of the hole if found, otherwise returns an index
 * outside of the set specified (in which case 'return - index >=
 * max_scan' will be true). In rare cases of index wrap-around, 0 will
 * be returned.
 *
 * page_cache_next_hole may be called under rcu_read_lock. However,
 * like radix_tree_gang_lookup, this will not atomically search a
 * snapshot of the tree at a single point in time. For example, if a
 * hole is created at index 5, then subsequently a hole is created at
 * index 10, page_cache_next_hole covering both indexes may return 10
 * if called under rcu_read_lock.
 */
pgoff_t page_cache_next_hole(struct address_space *mapping,
			     pgoff_t index, unsigned long max_scan)
{
	unsigned long i;

	for (i = 0; i < max_scan; i++) {
1005 1006 1007 1008
		struct page *page;

		page = radix_tree_lookup(&mapping->page_tree, index);
		if (!page || radix_tree_exceptional_entry(page))
1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045
			break;
		index++;
		if (index == 0)
			break;
	}

	return index;
}
EXPORT_SYMBOL(page_cache_next_hole);

/**
 * page_cache_prev_hole - find the prev hole (not-present entry)
 * @mapping: mapping
 * @index: index
 * @max_scan: maximum range to search
 *
 * Search backwards in the range [max(index-max_scan+1, 0), index] for
 * the first hole.
 *
 * Returns: the index of the hole if found, otherwise returns an index
 * outside of the set specified (in which case 'index - return >=
 * max_scan' will be true). In rare cases of wrap-around, ULONG_MAX
 * will be returned.
 *
 * page_cache_prev_hole may be called under rcu_read_lock. However,
 * like radix_tree_gang_lookup, this will not atomically search a
 * snapshot of the tree at a single point in time. For example, if a
 * hole is created at index 10, then subsequently a hole is created at
 * index 5, page_cache_prev_hole covering both indexes may return 5 if
 * called under rcu_read_lock.
 */
pgoff_t page_cache_prev_hole(struct address_space *mapping,
			     pgoff_t index, unsigned long max_scan)
{
	unsigned long i;

	for (i = 0; i < max_scan; i++) {
1046 1047 1048 1049
		struct page *page;

		page = radix_tree_lookup(&mapping->page_tree, index);
		if (!page || radix_tree_exceptional_entry(page))
1050 1051 1052 1053 1054 1055 1056 1057 1058 1059
			break;
		index--;
		if (index == ULONG_MAX)
			break;
	}

	return index;
}
EXPORT_SYMBOL(page_cache_prev_hole);

1060
/**
1061
 * find_get_entry - find and get a page cache entry
1062
 * @mapping: the address_space to search
1063 1064 1065 1066
 * @offset: the page cache index
 *
 * Looks up the page cache slot at @mapping & @offset.  If there is a
 * page cache page, it is returned with an increased refcount.
1067
 *
1068 1069
 * If the slot holds a shadow entry of a previously evicted page, or a
 * swap entry from shmem/tmpfs, it is returned.
1070 1071
 *
 * Otherwise, %NULL is returned.
L
Linus Torvalds 已提交
1072
 */
1073
struct page *find_get_entry(struct address_space *mapping, pgoff_t offset)
L
Linus Torvalds 已提交
1074
{
N
Nick Piggin 已提交
1075
	void **pagep;
1076
	struct page *head, *page;
L
Linus Torvalds 已提交
1077

N
Nick Piggin 已提交
1078 1079 1080 1081 1082 1083
	rcu_read_lock();
repeat:
	page = NULL;
	pagep = radix_tree_lookup_slot(&mapping->page_tree, offset);
	if (pagep) {
		page = radix_tree_deref_slot(pagep);
N
Nick Piggin 已提交
1084 1085
		if (unlikely(!page))
			goto out;
1086
		if (radix_tree_exception(page)) {
1087 1088 1089
			if (radix_tree_deref_retry(page))
				goto repeat;
			/*
1090 1091 1092
			 * A shadow entry of a recently evicted page,
			 * or a swap entry from shmem/tmpfs.  Return
			 * it without attempting to raise page count.
1093 1094
			 */
			goto out;
1095
		}
1096 1097 1098 1099 1100 1101 1102 1103

		head = compound_head(page);
		if (!page_cache_get_speculative(head))
			goto repeat;

		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
N
Nick Piggin 已提交
1104
			goto repeat;
1105
		}
N
Nick Piggin 已提交
1106 1107 1108 1109 1110 1111 1112

		/*
		 * Has the page moved?
		 * This is part of the lockless pagecache protocol. See
		 * include/linux/pagemap.h for details.
		 */
		if (unlikely(page != *pagep)) {
1113
			put_page(head);
N
Nick Piggin 已提交
1114 1115 1116
			goto repeat;
		}
	}
N
Nick Piggin 已提交
1117
out:
N
Nick Piggin 已提交
1118 1119
	rcu_read_unlock();

L
Linus Torvalds 已提交
1120 1121
	return page;
}
1122
EXPORT_SYMBOL(find_get_entry);
L
Linus Torvalds 已提交
1123

1124 1125 1126 1127 1128 1129 1130 1131 1132
/**
 * find_lock_entry - locate, pin and lock a page cache entry
 * @mapping: the address_space to search
 * @offset: the page cache index
 *
 * Looks up the page cache slot at @mapping & @offset.  If there is a
 * page cache page, it is returned locked and with an increased
 * refcount.
 *
1133 1134
 * If the slot holds a shadow entry of a previously evicted page, or a
 * swap entry from shmem/tmpfs, it is returned.
1135 1136 1137 1138 1139 1140
 *
 * Otherwise, %NULL is returned.
 *
 * find_lock_entry() may sleep.
 */
struct page *find_lock_entry(struct address_space *mapping, pgoff_t offset)
L
Linus Torvalds 已提交
1141 1142 1143 1144
{
	struct page *page;

repeat:
1145
	page = find_get_entry(mapping, offset);
1146
	if (page && !radix_tree_exception(page)) {
N
Nick Piggin 已提交
1147 1148
		lock_page(page);
		/* Has the page been truncated? */
1149
		if (unlikely(page_mapping(page) != mapping)) {
N
Nick Piggin 已提交
1150
			unlock_page(page);
1151
			put_page(page);
N
Nick Piggin 已提交
1152
			goto repeat;
L
Linus Torvalds 已提交
1153
		}
1154
		VM_BUG_ON_PAGE(page_to_pgoff(page) != offset, page);
L
Linus Torvalds 已提交
1155 1156 1157
	}
	return page;
}
1158 1159 1160
EXPORT_SYMBOL(find_lock_entry);

/**
1161
 * pagecache_get_page - find and get a page reference
1162 1163
 * @mapping: the address_space to search
 * @offset: the page index
1164
 * @fgp_flags: PCG flags
1165
 * @gfp_mask: gfp mask to use for the page cache data page allocation
1166
 *
1167
 * Looks up the page cache slot at @mapping & @offset.
L
Linus Torvalds 已提交
1168
 *
1169
 * PCG flags modify how the page is returned.
1170
 *
1171 1172 1173
 * FGP_ACCESSED: the page will be marked accessed
 * FGP_LOCK: Page is return locked
 * FGP_CREAT: If page is not present then a new page is allocated using
1174 1175 1176
 *		@gfp_mask and added to the page cache and the VM's LRU
 *		list. The page is returned locked and with an increased
 *		refcount. Otherwise, %NULL is returned.
L
Linus Torvalds 已提交
1177
 *
1178 1179
 * If FGP_LOCK or FGP_CREAT are specified then the function may sleep even
 * if the GFP flags specified for FGP_CREAT are atomic.
L
Linus Torvalds 已提交
1180
 *
1181
 * If there is a page cache page, it is returned with an increased refcount.
L
Linus Torvalds 已提交
1182
 */
1183
struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset,
1184
	int fgp_flags, gfp_t gfp_mask)
L
Linus Torvalds 已提交
1185
{
N
Nick Piggin 已提交
1186
	struct page *page;
1187

L
Linus Torvalds 已提交
1188
repeat:
1189 1190 1191 1192 1193 1194 1195 1196 1197
	page = find_get_entry(mapping, offset);
	if (radix_tree_exceptional_entry(page))
		page = NULL;
	if (!page)
		goto no_page;

	if (fgp_flags & FGP_LOCK) {
		if (fgp_flags & FGP_NOWAIT) {
			if (!trylock_page(page)) {
1198
				put_page(page);
1199 1200 1201 1202 1203 1204 1205 1206 1207
				return NULL;
			}
		} else {
			lock_page(page);
		}

		/* Has the page been truncated? */
		if (unlikely(page->mapping != mapping)) {
			unlock_page(page);
1208
			put_page(page);
1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220
			goto repeat;
		}
		VM_BUG_ON_PAGE(page->index != offset, page);
	}

	if (page && (fgp_flags & FGP_ACCESSED))
		mark_page_accessed(page);

no_page:
	if (!page && (fgp_flags & FGP_CREAT)) {
		int err;
		if ((fgp_flags & FGP_WRITE) && mapping_cap_account_dirty(mapping))
1221 1222 1223
			gfp_mask |= __GFP_WRITE;
		if (fgp_flags & FGP_NOFS)
			gfp_mask &= ~__GFP_FS;
1224

1225
		page = __page_cache_alloc(gfp_mask);
N
Nick Piggin 已提交
1226 1227
		if (!page)
			return NULL;
1228 1229 1230 1231

		if (WARN_ON_ONCE(!(fgp_flags & FGP_LOCK)))
			fgp_flags |= FGP_LOCK;

1232
		/* Init accessed so avoid atomic mark_page_accessed later */
1233
		if (fgp_flags & FGP_ACCESSED)
1234
			__SetPageReferenced(page);
1235

1236 1237
		err = add_to_page_cache_lru(page, mapping, offset,
				gfp_mask & GFP_RECLAIM_MASK);
N
Nick Piggin 已提交
1238
		if (unlikely(err)) {
1239
			put_page(page);
N
Nick Piggin 已提交
1240 1241 1242
			page = NULL;
			if (err == -EEXIST)
				goto repeat;
L
Linus Torvalds 已提交
1243 1244
		}
	}
1245

L
Linus Torvalds 已提交
1246 1247
	return page;
}
1248
EXPORT_SYMBOL(pagecache_get_page);
L
Linus Torvalds 已提交
1249

1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266
/**
 * find_get_entries - gang pagecache lookup
 * @mapping:	The address_space to search
 * @start:	The starting page cache index
 * @nr_entries:	The maximum number of entries
 * @entries:	Where the resulting entries are placed
 * @indices:	The cache indices corresponding to the entries in @entries
 *
 * find_get_entries() will search for and return a group of up to
 * @nr_entries entries in the mapping.  The entries are placed at
 * @entries.  find_get_entries() takes a reference against any actual
 * pages it returns.
 *
 * The search returns a group of mapping-contiguous page cache entries
 * with ascending indexes.  There may be holes in the indices due to
 * not-present pages.
 *
1267 1268
 * Any shadow entries of evicted pages, or swap entries from
 * shmem/tmpfs, are included in the returned array.
1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285
 *
 * find_get_entries() returns the number of pages and shadow entries
 * which were found.
 */
unsigned find_get_entries(struct address_space *mapping,
			  pgoff_t start, unsigned int nr_entries,
			  struct page **entries, pgoff_t *indices)
{
	void **slot;
	unsigned int ret = 0;
	struct radix_tree_iter iter;

	if (!nr_entries)
		return 0;

	rcu_read_lock();
	radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
1286
		struct page *head, *page;
1287 1288 1289 1290 1291
repeat:
		page = radix_tree_deref_slot(slot);
		if (unlikely(!page))
			continue;
		if (radix_tree_exception(page)) {
M
Matthew Wilcox 已提交
1292 1293 1294 1295
			if (radix_tree_deref_retry(page)) {
				slot = radix_tree_iter_retry(&iter);
				continue;
			}
1296
			/*
1297 1298 1299
			 * A shadow entry of a recently evicted page, a swap
			 * entry from shmem/tmpfs or a DAX entry.  Return it
			 * without attempting to raise page count.
1300 1301 1302
			 */
			goto export;
		}
1303 1304 1305 1306 1307 1308 1309 1310

		head = compound_head(page);
		if (!page_cache_get_speculative(head))
			goto repeat;

		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
1311
			goto repeat;
1312
		}
1313 1314 1315

		/* Has the page moved? */
		if (unlikely(page != *slot)) {
1316
			put_page(head);
1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328
			goto repeat;
		}
export:
		indices[ret] = iter.index;
		entries[ret] = page;
		if (++ret == nr_entries)
			break;
	}
	rcu_read_unlock();
	return ret;
}

L
Linus Torvalds 已提交
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347
/**
 * find_get_pages - gang pagecache lookup
 * @mapping:	The address_space to search
 * @start:	The starting page index
 * @nr_pages:	The maximum number of pages
 * @pages:	Where the resulting pages are placed
 *
 * find_get_pages() will search for and return a group of up to
 * @nr_pages pages in the mapping.  The pages are placed at @pages.
 * find_get_pages() takes a reference against the returned pages.
 *
 * The search returns a group of mapping-contiguous pages with ascending
 * indexes.  There may be holes in the indices due to not-present pages.
 *
 * find_get_pages() returns the number of pages which were found.
 */
unsigned find_get_pages(struct address_space *mapping, pgoff_t start,
			    unsigned int nr_pages, struct page **pages)
{
1348 1349 1350 1351 1352 1353
	struct radix_tree_iter iter;
	void **slot;
	unsigned ret = 0;

	if (unlikely(!nr_pages))
		return 0;
N
Nick Piggin 已提交
1354 1355

	rcu_read_lock();
1356
	radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
1357
		struct page *head, *page;
N
Nick Piggin 已提交
1358
repeat:
1359
		page = radix_tree_deref_slot(slot);
N
Nick Piggin 已提交
1360 1361
		if (unlikely(!page))
			continue;
1362

1363
		if (radix_tree_exception(page)) {
1364
			if (radix_tree_deref_retry(page)) {
M
Matthew Wilcox 已提交
1365 1366
				slot = radix_tree_iter_retry(&iter);
				continue;
1367
			}
1368
			/*
1369 1370 1371
			 * A shadow entry of a recently evicted page,
			 * or a swap entry from shmem/tmpfs.  Skip
			 * over it.
1372
			 */
1373
			continue;
N
Nick Piggin 已提交
1374
		}
N
Nick Piggin 已提交
1375

1376 1377 1378 1379 1380 1381 1382
		head = compound_head(page);
		if (!page_cache_get_speculative(head))
			goto repeat;

		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
N
Nick Piggin 已提交
1383
			goto repeat;
1384
		}
N
Nick Piggin 已提交
1385 1386

		/* Has the page moved? */
1387
		if (unlikely(page != *slot)) {
1388
			put_page(head);
N
Nick Piggin 已提交
1389 1390
			goto repeat;
		}
L
Linus Torvalds 已提交
1391

N
Nick Piggin 已提交
1392
		pages[ret] = page;
1393 1394
		if (++ret == nr_pages)
			break;
N
Nick Piggin 已提交
1395
	}
1396

N
Nick Piggin 已提交
1397
	rcu_read_unlock();
L
Linus Torvalds 已提交
1398 1399 1400
	return ret;
}

1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415
/**
 * find_get_pages_contig - gang contiguous pagecache lookup
 * @mapping:	The address_space to search
 * @index:	The starting page index
 * @nr_pages:	The maximum number of pages
 * @pages:	Where the resulting pages are placed
 *
 * find_get_pages_contig() works exactly like find_get_pages(), except
 * that the returned number of pages are guaranteed to be contiguous.
 *
 * find_get_pages_contig() returns the number of pages which were found.
 */
unsigned find_get_pages_contig(struct address_space *mapping, pgoff_t index,
			       unsigned int nr_pages, struct page **pages)
{
1416 1417 1418 1419 1420 1421
	struct radix_tree_iter iter;
	void **slot;
	unsigned int ret = 0;

	if (unlikely(!nr_pages))
		return 0;
N
Nick Piggin 已提交
1422 1423

	rcu_read_lock();
1424
	radix_tree_for_each_contig(slot, &mapping->page_tree, &iter, index) {
1425
		struct page *head, *page;
N
Nick Piggin 已提交
1426
repeat:
1427 1428
		page = radix_tree_deref_slot(slot);
		/* The hole, there no reason to continue */
N
Nick Piggin 已提交
1429
		if (unlikely(!page))
1430
			break;
1431

1432
		if (radix_tree_exception(page)) {
1433
			if (radix_tree_deref_retry(page)) {
M
Matthew Wilcox 已提交
1434 1435
				slot = radix_tree_iter_retry(&iter);
				continue;
1436
			}
1437
			/*
1438 1439 1440
			 * A shadow entry of a recently evicted page,
			 * or a swap entry from shmem/tmpfs.  Stop
			 * looking for contiguous pages.
1441
			 */
1442
			break;
1443
		}
1444

1445 1446 1447 1448 1449 1450 1451
		head = compound_head(page);
		if (!page_cache_get_speculative(head))
			goto repeat;

		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
N
Nick Piggin 已提交
1452
			goto repeat;
1453
		}
N
Nick Piggin 已提交
1454 1455

		/* Has the page moved? */
1456
		if (unlikely(page != *slot)) {
1457
			put_page(head);
N
Nick Piggin 已提交
1458 1459 1460
			goto repeat;
		}

N
Nick Piggin 已提交
1461 1462 1463 1464 1465
		/*
		 * must check mapping and index after taking the ref.
		 * otherwise we can get both false positives and false
		 * negatives, which is just confusing to the caller.
		 */
1466
		if (page->mapping == NULL || page_to_pgoff(page) != iter.index) {
1467
			put_page(page);
N
Nick Piggin 已提交
1468 1469 1470
			break;
		}

N
Nick Piggin 已提交
1471
		pages[ret] = page;
1472 1473
		if (++ret == nr_pages)
			break;
1474
	}
N
Nick Piggin 已提交
1475 1476
	rcu_read_unlock();
	return ret;
1477
}
1478
EXPORT_SYMBOL(find_get_pages_contig);
1479

1480 1481 1482 1483 1484 1485 1486 1487
/**
 * find_get_pages_tag - find and return pages that match @tag
 * @mapping:	the address_space to search
 * @index:	the starting page index
 * @tag:	the tag index
 * @nr_pages:	the maximum number of pages
 * @pages:	where the resulting pages are placed
 *
L
Linus Torvalds 已提交
1488
 * Like find_get_pages, except we only return pages which are tagged with
1489
 * @tag.   We update @index to index the next page for the traversal.
L
Linus Torvalds 已提交
1490 1491 1492 1493
 */
unsigned find_get_pages_tag(struct address_space *mapping, pgoff_t *index,
			int tag, unsigned int nr_pages, struct page **pages)
{
1494 1495 1496 1497 1498 1499
	struct radix_tree_iter iter;
	void **slot;
	unsigned ret = 0;

	if (unlikely(!nr_pages))
		return 0;
N
Nick Piggin 已提交
1500 1501

	rcu_read_lock();
1502 1503
	radix_tree_for_each_tagged(slot, &mapping->page_tree,
				   &iter, *index, tag) {
1504
		struct page *head, *page;
N
Nick Piggin 已提交
1505
repeat:
1506
		page = radix_tree_deref_slot(slot);
N
Nick Piggin 已提交
1507 1508
		if (unlikely(!page))
			continue;
1509

1510
		if (radix_tree_exception(page)) {
1511
			if (radix_tree_deref_retry(page)) {
M
Matthew Wilcox 已提交
1512 1513
				slot = radix_tree_iter_retry(&iter);
				continue;
1514
			}
1515
			/*
1516 1517 1518 1519 1520 1521 1522 1523 1524
			 * A shadow entry of a recently evicted page.
			 *
			 * Those entries should never be tagged, but
			 * this tree walk is lockless and the tags are
			 * looked up in bulk, one radix tree node at a
			 * time, so there is a sizable window for page
			 * reclaim to evict a page we saw tagged.
			 *
			 * Skip over it.
1525
			 */
1526
			continue;
1527
		}
N
Nick Piggin 已提交
1528

1529 1530
		head = compound_head(page);
		if (!page_cache_get_speculative(head))
N
Nick Piggin 已提交
1531 1532
			goto repeat;

1533 1534 1535 1536 1537 1538
		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
			goto repeat;
		}

N
Nick Piggin 已提交
1539
		/* Has the page moved? */
1540
		if (unlikely(page != *slot)) {
1541
			put_page(head);
N
Nick Piggin 已提交
1542 1543 1544 1545
			goto repeat;
		}

		pages[ret] = page;
1546 1547
		if (++ret == nr_pages)
			break;
N
Nick Piggin 已提交
1548
	}
1549

N
Nick Piggin 已提交
1550
	rcu_read_unlock();
L
Linus Torvalds 已提交
1551 1552 1553

	if (ret)
		*index = pages[ret - 1]->index + 1;
N
Nick Piggin 已提交
1554

L
Linus Torvalds 已提交
1555 1556
	return ret;
}
1557
EXPORT_SYMBOL(find_get_pages_tag);
L
Linus Torvalds 已提交
1558

R
Ross Zwisler 已提交
1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584
/**
 * find_get_entries_tag - find and return entries that match @tag
 * @mapping:	the address_space to search
 * @start:	the starting page cache index
 * @tag:	the tag index
 * @nr_entries:	the maximum number of entries
 * @entries:	where the resulting entries are placed
 * @indices:	the cache indices corresponding to the entries in @entries
 *
 * Like find_get_entries, except we only return entries which are tagged with
 * @tag.
 */
unsigned find_get_entries_tag(struct address_space *mapping, pgoff_t start,
			int tag, unsigned int nr_entries,
			struct page **entries, pgoff_t *indices)
{
	void **slot;
	unsigned int ret = 0;
	struct radix_tree_iter iter;

	if (!nr_entries)
		return 0;

	rcu_read_lock();
	radix_tree_for_each_tagged(slot, &mapping->page_tree,
				   &iter, start, tag) {
1585
		struct page *head, *page;
R
Ross Zwisler 已提交
1586 1587 1588 1589 1590 1591
repeat:
		page = radix_tree_deref_slot(slot);
		if (unlikely(!page))
			continue;
		if (radix_tree_exception(page)) {
			if (radix_tree_deref_retry(page)) {
M
Matthew Wilcox 已提交
1592 1593
				slot = radix_tree_iter_retry(&iter);
				continue;
R
Ross Zwisler 已提交
1594 1595 1596 1597 1598 1599 1600 1601 1602
			}

			/*
			 * A shadow entry of a recently evicted page, a swap
			 * entry from shmem/tmpfs or a DAX entry.  Return it
			 * without attempting to raise page count.
			 */
			goto export;
		}
1603 1604 1605

		head = compound_head(page);
		if (!page_cache_get_speculative(head))
R
Ross Zwisler 已提交
1606 1607
			goto repeat;

1608 1609 1610 1611 1612 1613
		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
			goto repeat;
		}

R
Ross Zwisler 已提交
1614 1615
		/* Has the page moved? */
		if (unlikely(page != *slot)) {
1616
			put_page(head);
R
Ross Zwisler 已提交
1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629
			goto repeat;
		}
export:
		indices[ret] = iter.index;
		entries[ret] = page;
		if (++ret == nr_entries)
			break;
	}
	rcu_read_unlock();
	return ret;
}
EXPORT_SYMBOL(find_get_entries_tag);

1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650
/*
 * CD/DVDs are error prone. When a medium error occurs, the driver may fail
 * a _large_ part of the i/o request. Imagine the worst scenario:
 *
 *      ---R__________________________________________B__________
 *         ^ reading here                             ^ bad block(assume 4k)
 *
 * read(R) => miss => readahead(R...B) => media error => frustrating retries
 * => failing the whole request => read(R) => read(R+1) =>
 * readahead(R+1...B+1) => bang => read(R+2) => read(R+3) =>
 * readahead(R+3...B+2) => bang => read(R+3) => read(R+4) =>
 * readahead(R+4...B+3) => bang => read(R+4) => read(R+5) => ......
 *
 * It is going insane. Fix it by quickly scaling down the readahead size.
 */
static void shrink_readahead_size_eio(struct file *filp,
					struct file_ra_state *ra)
{
	ra->ra_pages /= 4;
}

1651
/**
C
Christoph Hellwig 已提交
1652
 * do_generic_file_read - generic file read routine
1653 1654
 * @filp:	the file to read
 * @ppos:	current file position
1655 1656
 * @iter:	data destination
 * @written:	already copied
1657
 *
L
Linus Torvalds 已提交
1658
 * This is a generic file read routine, and uses the
1659
 * mapping->a_ops->readpage() function for the actual low-level stuff.
L
Linus Torvalds 已提交
1660 1661 1662 1663
 *
 * This is really ugly. But the goto's actually try to clarify some
 * of the logic when it comes to error handling etc.
 */
1664 1665
static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos,
		struct iov_iter *iter, ssize_t written)
L
Linus Torvalds 已提交
1666
{
C
Christoph Hellwig 已提交
1667
	struct address_space *mapping = filp->f_mapping;
L
Linus Torvalds 已提交
1668
	struct inode *inode = mapping->host;
C
Christoph Hellwig 已提交
1669
	struct file_ra_state *ra = &filp->f_ra;
1670 1671 1672 1673
	pgoff_t index;
	pgoff_t last_index;
	pgoff_t prev_index;
	unsigned long offset;      /* offset into pagecache page */
1674
	unsigned int prev_offset;
1675
	int error = 0;
L
Linus Torvalds 已提交
1676

1677 1678 1679 1680 1681
	index = *ppos >> PAGE_SHIFT;
	prev_index = ra->prev_pos >> PAGE_SHIFT;
	prev_offset = ra->prev_pos & (PAGE_SIZE-1);
	last_index = (*ppos + iter->count + PAGE_SIZE-1) >> PAGE_SHIFT;
	offset = *ppos & ~PAGE_MASK;
L
Linus Torvalds 已提交
1682 1683 1684

	for (;;) {
		struct page *page;
1685
		pgoff_t end_index;
N
NeilBrown 已提交
1686
		loff_t isize;
L
Linus Torvalds 已提交
1687 1688 1689 1690 1691
		unsigned long nr, ret;

		cond_resched();
find_page:
		page = find_get_page(mapping, index);
1692
		if (!page) {
1693
			page_cache_sync_readahead(mapping,
1694
					ra, filp,
1695 1696 1697 1698 1699 1700
					index, last_index - index);
			page = find_get_page(mapping, index);
			if (unlikely(page == NULL))
				goto no_cached_page;
		}
		if (PageReadahead(page)) {
1701
			page_cache_async_readahead(mapping,
1702
					ra, filp, page,
1703
					index, last_index - index);
L
Linus Torvalds 已提交
1704
		}
1705
		if (!PageUptodate(page)) {
1706 1707 1708 1709 1710 1711 1712 1713 1714
			/*
			 * See comment in do_read_cache_page on why
			 * wait_on_page_locked is used to avoid unnecessarily
			 * serialisations and why it's safe.
			 */
			wait_on_page_locked_killable(page);
			if (PageUptodate(page))
				goto page_ok;

1715
			if (inode->i_blkbits == PAGE_SHIFT ||
1716 1717
					!mapping->a_ops->is_partially_uptodate)
				goto page_not_up_to_date;
N
Nick Piggin 已提交
1718
			if (!trylock_page(page))
1719
				goto page_not_up_to_date;
1720 1721 1722
			/* Did it get truncated before we got the lock? */
			if (!page->mapping)
				goto page_not_up_to_date_locked;
1723
			if (!mapping->a_ops->is_partially_uptodate(page,
1724
							offset, iter->count))
1725 1726 1727
				goto page_not_up_to_date_locked;
			unlock_page(page);
		}
L
Linus Torvalds 已提交
1728
page_ok:
N
NeilBrown 已提交
1729 1730 1731 1732 1733 1734 1735 1736 1737 1738
		/*
		 * i_size must be checked after we know the page is Uptodate.
		 *
		 * Checking i_size after the check allows us to calculate
		 * the correct value for "nr", which means the zero-filled
		 * part of the page is not copied back to userspace (unless
		 * another truncate extends the file - this is desired though).
		 */

		isize = i_size_read(inode);
1739
		end_index = (isize - 1) >> PAGE_SHIFT;
N
NeilBrown 已提交
1740
		if (unlikely(!isize || index > end_index)) {
1741
			put_page(page);
N
NeilBrown 已提交
1742 1743 1744 1745
			goto out;
		}

		/* nr is the maximum number of bytes to copy from this page */
1746
		nr = PAGE_SIZE;
N
NeilBrown 已提交
1747
		if (index == end_index) {
1748
			nr = ((isize - 1) & ~PAGE_MASK) + 1;
N
NeilBrown 已提交
1749
			if (nr <= offset) {
1750
				put_page(page);
N
NeilBrown 已提交
1751 1752 1753 1754
				goto out;
			}
		}
		nr = nr - offset;
L
Linus Torvalds 已提交
1755 1756 1757 1758 1759 1760 1761 1762 1763

		/* If users can be writing to this page using arbitrary
		 * virtual addresses, take care about potential aliasing
		 * before reading the page on the kernel side.
		 */
		if (mapping_writably_mapped(mapping))
			flush_dcache_page(page);

		/*
1764 1765
		 * When a sequential read accesses a page several times,
		 * only mark it as accessed the first time.
L
Linus Torvalds 已提交
1766
		 */
1767
		if (prev_index != index || offset != prev_offset)
L
Linus Torvalds 已提交
1768 1769 1770 1771 1772 1773 1774
			mark_page_accessed(page);
		prev_index = index;

		/*
		 * Ok, we have the page, and it's up-to-date, so
		 * now we can copy it to user space...
		 */
1775 1776

		ret = copy_page_to_iter(page, offset, nr, iter);
L
Linus Torvalds 已提交
1777
		offset += ret;
1778 1779
		index += offset >> PAGE_SHIFT;
		offset &= ~PAGE_MASK;
J
Jan Kara 已提交
1780
		prev_offset = offset;
L
Linus Torvalds 已提交
1781

1782
		put_page(page);
1783 1784 1785 1786 1787 1788 1789 1790
		written += ret;
		if (!iov_iter_count(iter))
			goto out;
		if (ret < nr) {
			error = -EFAULT;
			goto out;
		}
		continue;
L
Linus Torvalds 已提交
1791 1792 1793

page_not_up_to_date:
		/* Get exclusive access to the page ... */
1794 1795 1796
		error = lock_page_killable(page);
		if (unlikely(error))
			goto readpage_error;
L
Linus Torvalds 已提交
1797

1798
page_not_up_to_date_locked:
N
Nick Piggin 已提交
1799
		/* Did it get truncated before we got the lock? */
L
Linus Torvalds 已提交
1800 1801
		if (!page->mapping) {
			unlock_page(page);
1802
			put_page(page);
L
Linus Torvalds 已提交
1803 1804 1805 1806 1807 1808 1809 1810 1811 1812
			continue;
		}

		/* Did somebody else fill it already? */
		if (PageUptodate(page)) {
			unlock_page(page);
			goto page_ok;
		}

readpage:
1813 1814 1815 1816 1817 1818
		/*
		 * A previous I/O error may have been due to temporary
		 * failures, eg. multipath errors.
		 * PG_error will be set again if readpage fails.
		 */
		ClearPageError(page);
L
Linus Torvalds 已提交
1819 1820 1821
		/* Start the actual read. The read will unlock the page. */
		error = mapping->a_ops->readpage(filp, page);

1822 1823
		if (unlikely(error)) {
			if (error == AOP_TRUNCATED_PAGE) {
1824
				put_page(page);
1825
				error = 0;
1826 1827
				goto find_page;
			}
L
Linus Torvalds 已提交
1828
			goto readpage_error;
1829
		}
L
Linus Torvalds 已提交
1830 1831

		if (!PageUptodate(page)) {
1832 1833 1834
			error = lock_page_killable(page);
			if (unlikely(error))
				goto readpage_error;
L
Linus Torvalds 已提交
1835 1836 1837
			if (!PageUptodate(page)) {
				if (page->mapping == NULL) {
					/*
1838
					 * invalidate_mapping_pages got it
L
Linus Torvalds 已提交
1839 1840
					 */
					unlock_page(page);
1841
					put_page(page);
L
Linus Torvalds 已提交
1842 1843 1844
					goto find_page;
				}
				unlock_page(page);
1845
				shrink_readahead_size_eio(filp, ra);
1846 1847
				error = -EIO;
				goto readpage_error;
L
Linus Torvalds 已提交
1848 1849 1850 1851 1852 1853 1854 1855
			}
			unlock_page(page);
		}

		goto page_ok;

readpage_error:
		/* UHHUH! A synchronous read error occurred. Report it */
1856
		put_page(page);
L
Linus Torvalds 已提交
1857 1858 1859 1860 1861 1862 1863
		goto out;

no_cached_page:
		/*
		 * Ok, it wasn't cached, so we need to create a new
		 * page..
		 */
N
Nick Piggin 已提交
1864 1865
		page = page_cache_alloc_cold(mapping);
		if (!page) {
1866
			error = -ENOMEM;
N
Nick Piggin 已提交
1867
			goto out;
L
Linus Torvalds 已提交
1868
		}
1869
		error = add_to_page_cache_lru(page, mapping, index,
1870
				mapping_gfp_constraint(mapping, GFP_KERNEL));
L
Linus Torvalds 已提交
1871
		if (error) {
1872
			put_page(page);
1873 1874
			if (error == -EEXIST) {
				error = 0;
L
Linus Torvalds 已提交
1875
				goto find_page;
1876
			}
L
Linus Torvalds 已提交
1877 1878 1879 1880 1881 1882
			goto out;
		}
		goto readpage;
	}

out:
1883
	ra->prev_pos = prev_index;
1884
	ra->prev_pos <<= PAGE_SHIFT;
1885
	ra->prev_pos |= prev_offset;
L
Linus Torvalds 已提交
1886

1887
	*ppos = ((loff_t)index << PAGE_SHIFT) + offset;
1888
	file_accessed(filp);
1889
	return written ? written : error;
L
Linus Torvalds 已提交
1890 1891
}

1892
/**
A
Al Viro 已提交
1893
 * generic_file_read_iter - generic filesystem read routine
1894
 * @iocb:	kernel I/O control block
A
Al Viro 已提交
1895
 * @iter:	destination for the data read
1896
 *
A
Al Viro 已提交
1897
 * This is the "read_iter()" routine for all filesystems
L
Linus Torvalds 已提交
1898 1899 1900
 * that can use the page cache directly.
 */
ssize_t
A
Al Viro 已提交
1901
generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter)
L
Linus Torvalds 已提交
1902
{
A
Al Viro 已提交
1903
	struct file *file = iocb->ki_filp;
A
Al Viro 已提交
1904
	ssize_t retval = 0;
1905 1906 1907 1908
	size_t count = iov_iter_count(iter);

	if (!count)
		goto out; /* skip atime */
L
Linus Torvalds 已提交
1909

1910
	if (iocb->ki_flags & IOCB_DIRECT) {
A
Al Viro 已提交
1911 1912
		struct address_space *mapping = file->f_mapping;
		struct inode *inode = mapping->host;
1913
		loff_t size;
L
Linus Torvalds 已提交
1914 1915

		size = i_size_read(inode);
1916 1917
		retval = filemap_write_and_wait_range(mapping, iocb->ki_pos,
					iocb->ki_pos + count - 1);
1918
		if (!retval) {
A
Al Viro 已提交
1919
			struct iov_iter data = *iter;
1920
			retval = mapping->a_ops->direct_IO(iocb, &data);
1921
		}
A
Al Viro 已提交
1922

1923
		if (retval > 0) {
1924
			iocb->ki_pos += retval;
A
Al Viro 已提交
1925
			iov_iter_advance(iter, retval);
1926
		}
1927

1928 1929 1930 1931 1932 1933
		/*
		 * Btrfs can have a short DIO read if we encounter
		 * compressed extents, so if there was an error, or if
		 * we've already read everything we wanted to, or if
		 * there was a short read because we hit EOF, go ahead
		 * and return.  Otherwise fallthrough to buffered io for
1934 1935
		 * the rest of the read.  Buffered reads will not work for
		 * DAX files, so don't bother trying.
1936
		 */
1937
		if (retval < 0 || !iov_iter_count(iter) || iocb->ki_pos >= size ||
1938
		    IS_DAX(inode)) {
A
Al Viro 已提交
1939
			file_accessed(file);
1940
			goto out;
1941
		}
L
Linus Torvalds 已提交
1942 1943
	}

1944
	retval = do_generic_file_read(file, &iocb->ki_pos, iter, retval);
L
Linus Torvalds 已提交
1945 1946 1947
out:
	return retval;
}
A
Al Viro 已提交
1948
EXPORT_SYMBOL(generic_file_read_iter);
L
Linus Torvalds 已提交
1949 1950

#ifdef CONFIG_MMU
1951 1952 1953 1954
/**
 * page_cache_read - adds requested page to the page cache if not already there
 * @file:	file to read
 * @offset:	page index
1955
 * @gfp_mask:	memory allocation flags
1956
 *
L
Linus Torvalds 已提交
1957 1958 1959
 * This adds the requested page to the page cache if it isn't already there,
 * and schedules an I/O to read in its contents from disk.
 */
1960
static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask)
L
Linus Torvalds 已提交
1961 1962
{
	struct address_space *mapping = file->f_mapping;
1963
	struct page *page;
1964
	int ret;
L
Linus Torvalds 已提交
1965

1966
	do {
1967
		page = __page_cache_alloc(gfp_mask|__GFP_COLD);
1968 1969 1970
		if (!page)
			return -ENOMEM;

1971
		ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL);
1972 1973 1974 1975
		if (ret == 0)
			ret = mapping->a_ops->readpage(file, page);
		else if (ret == -EEXIST)
			ret = 0; /* losing race to add is OK */
L
Linus Torvalds 已提交
1976

1977
		put_page(page);
L
Linus Torvalds 已提交
1978

1979
	} while (ret == AOP_TRUNCATED_PAGE);
1980

1981
	return ret;
L
Linus Torvalds 已提交
1982 1983 1984 1985
}

#define MMAP_LOTSAMISS  (100)

1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997
/*
 * Synchronous readahead happens when we don't even find
 * a page in the page cache at all.
 */
static void do_sync_mmap_readahead(struct vm_area_struct *vma,
				   struct file_ra_state *ra,
				   struct file *file,
				   pgoff_t offset)
{
	struct address_space *mapping = file->f_mapping;

	/* If we don't want any read-ahead, don't bother */
1998
	if (vma->vm_flags & VM_RAND_READ)
1999
		return;
2000 2001
	if (!ra->ra_pages)
		return;
2002

2003
	if (vma->vm_flags & VM_SEQ_READ) {
2004 2005
		page_cache_sync_readahead(mapping, ra, file, offset,
					  ra->ra_pages);
2006 2007 2008
		return;
	}

2009 2010
	/* Avoid banging the cache line if not needed */
	if (ra->mmap_miss < MMAP_LOTSAMISS * 10)
2011 2012 2013 2014 2015 2016 2017 2018 2019
		ra->mmap_miss++;

	/*
	 * Do we miss much more than hit in this file? If so,
	 * stop bothering with read-ahead. It will only hurt.
	 */
	if (ra->mmap_miss > MMAP_LOTSAMISS)
		return;

2020 2021 2022
	/*
	 * mmap read-around
	 */
2023 2024 2025
	ra->start = max_t(long, 0, offset - ra->ra_pages / 2);
	ra->size = ra->ra_pages;
	ra->async_size = ra->ra_pages / 4;
2026
	ra_submit(ra, mapping, file);
2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041
}

/*
 * Asynchronous readahead happens when we find the page and PG_readahead,
 * so we want to possibly extend the readahead further..
 */
static void do_async_mmap_readahead(struct vm_area_struct *vma,
				    struct file_ra_state *ra,
				    struct file *file,
				    struct page *page,
				    pgoff_t offset)
{
	struct address_space *mapping = file->f_mapping;

	/* If we don't want any read-ahead, don't bother */
2042
	if (vma->vm_flags & VM_RAND_READ)
2043 2044 2045 2046
		return;
	if (ra->mmap_miss > 0)
		ra->mmap_miss--;
	if (PageReadahead(page))
2047 2048
		page_cache_async_readahead(mapping, ra, file,
					   page, offset, ra->ra_pages);
2049 2050
}

2051
/**
2052
 * filemap_fault - read in file data for page fault handling
N
Nick Piggin 已提交
2053 2054
 * @vma:	vma in which the fault was taken
 * @vmf:	struct vm_fault containing details of the fault
2055
 *
2056
 * filemap_fault() is invoked via the vma operations vector for a
L
Linus Torvalds 已提交
2057 2058 2059 2060 2061
 * mapped memory region to read in file data during a page fault.
 *
 * The goto's are kind of ugly, but this streamlines the normal case of having
 * it in the page cache, and handles the special cases reasonably without
 * having a lot of duplicated code.
2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073
 *
 * vma->vm_mm->mmap_sem must be held on entry.
 *
 * If our return value has VM_FAULT_RETRY set, it's because
 * lock_page_or_retry() returned 0.
 * The mmap_sem has usually been released in this case.
 * See __lock_page_or_retry() for the exception.
 *
 * If our return value does not have VM_FAULT_RETRY set, the mmap_sem
 * has not been released.
 *
 * We never return with VM_FAULT_RETRY and a bit from VM_FAULT_ERROR set.
L
Linus Torvalds 已提交
2074
 */
N
Nick Piggin 已提交
2075
int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
L
Linus Torvalds 已提交
2076 2077
{
	int error;
2078
	struct file *file = vma->vm_file;
L
Linus Torvalds 已提交
2079 2080 2081
	struct address_space *mapping = file->f_mapping;
	struct file_ra_state *ra = &file->f_ra;
	struct inode *inode = mapping->host;
2082
	pgoff_t offset = vmf->pgoff;
L
Linus Torvalds 已提交
2083
	struct page *page;
2084
	loff_t size;
N
Nick Piggin 已提交
2085
	int ret = 0;
L
Linus Torvalds 已提交
2086

2087 2088
	size = round_up(i_size_read(inode), PAGE_SIZE);
	if (offset >= size >> PAGE_SHIFT)
2089
		return VM_FAULT_SIGBUS;
L
Linus Torvalds 已提交
2090 2091

	/*
2092
	 * Do we have something in the page cache already?
L
Linus Torvalds 已提交
2093
	 */
2094
	page = find_get_page(mapping, offset);
2095
	if (likely(page) && !(vmf->flags & FAULT_FLAG_TRIED)) {
L
Linus Torvalds 已提交
2096
		/*
2097 2098
		 * We found the page, so try async readahead before
		 * waiting for the lock.
L
Linus Torvalds 已提交
2099
		 */
2100
		do_async_mmap_readahead(vma, ra, file, page, offset);
2101
	} else if (!page) {
2102 2103 2104
		/* No page in the page cache at all */
		do_sync_mmap_readahead(vma, ra, file, offset);
		count_vm_event(PGMAJFAULT);
2105
		mem_cgroup_count_vm_event(vma->vm_mm, PGMAJFAULT);
2106 2107
		ret = VM_FAULT_MAJOR;
retry_find:
2108
		page = find_get_page(mapping, offset);
L
Linus Torvalds 已提交
2109 2110 2111 2112
		if (!page)
			goto no_cached_page;
	}

2113
	if (!lock_page_or_retry(page, vma->vm_mm, vmf->flags)) {
2114
		put_page(page);
2115
		return ret | VM_FAULT_RETRY;
2116
	}
2117 2118 2119 2120 2121 2122 2123

	/* Did it get truncated? */
	if (unlikely(page->mapping != mapping)) {
		unlock_page(page);
		put_page(page);
		goto retry_find;
	}
2124
	VM_BUG_ON_PAGE(page->index != offset, page);
2125

L
Linus Torvalds 已提交
2126
	/*
2127 2128
	 * We have a locked page in the page cache, now we need to check
	 * that it's up-to-date. If not, it is going to be due to an error.
L
Linus Torvalds 已提交
2129
	 */
2130
	if (unlikely(!PageUptodate(page)))
L
Linus Torvalds 已提交
2131 2132
		goto page_not_uptodate;

2133 2134 2135 2136
	/*
	 * Found the page and have a reference on it.
	 * We must recheck i_size under page lock.
	 */
2137 2138
	size = round_up(i_size_read(inode), PAGE_SIZE);
	if (unlikely(offset >= size >> PAGE_SHIFT)) {
2139
		unlock_page(page);
2140
		put_page(page);
2141
		return VM_FAULT_SIGBUS;
2142 2143
	}

N
Nick Piggin 已提交
2144
	vmf->page = page;
N
Nick Piggin 已提交
2145
	return ret | VM_FAULT_LOCKED;
L
Linus Torvalds 已提交
2146 2147 2148 2149 2150 2151

no_cached_page:
	/*
	 * We're only likely to ever get here if MADV_RANDOM is in
	 * effect.
	 */
2152
	error = page_cache_read(file, offset, vmf->gfp_mask);
L
Linus Torvalds 已提交
2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167

	/*
	 * The page we want has now been added to the page cache.
	 * In the unlikely event that someone removed it in the
	 * meantime, we'll just come back here and read it again.
	 */
	if (error >= 0)
		goto retry_find;

	/*
	 * An error return from page_cache_read can result if the
	 * system is low on memory, or a problem occurs while trying
	 * to schedule I/O.
	 */
	if (error == -ENOMEM)
N
Nick Piggin 已提交
2168 2169
		return VM_FAULT_OOM;
	return VM_FAULT_SIGBUS;
L
Linus Torvalds 已提交
2170 2171 2172 2173 2174 2175 2176 2177 2178

page_not_uptodate:
	/*
	 * Umm, take care of errors if the page isn't up-to-date.
	 * Try to re-read it _once_. We do this synchronously,
	 * because there really aren't any performance issues here
	 * and we need to check for errors.
	 */
	ClearPageError(page);
2179
	error = mapping->a_ops->readpage(file, page);
2180 2181 2182 2183 2184
	if (!error) {
		wait_on_page_locked(page);
		if (!PageUptodate(page))
			error = -EIO;
	}
2185
	put_page(page);
2186 2187

	if (!error || error == AOP_TRUNCATED_PAGE)
2188
		goto retry_find;
L
Linus Torvalds 已提交
2189

2190
	/* Things didn't work out. Return zero to tell the mm layer so. */
2191
	shrink_readahead_size_eio(file, ra);
N
Nick Piggin 已提交
2192
	return VM_FAULT_SIGBUS;
2193 2194 2195
}
EXPORT_SYMBOL(filemap_fault);

K
Kirill A. Shutemov 已提交
2196 2197
void filemap_map_pages(struct fault_env *fe,
		pgoff_t start_pgoff, pgoff_t end_pgoff)
2198 2199 2200
{
	struct radix_tree_iter iter;
	void **slot;
K
Kirill A. Shutemov 已提交
2201
	struct file *file = fe->vma->vm_file;
2202
	struct address_space *mapping = file->f_mapping;
K
Kirill A. Shutemov 已提交
2203
	pgoff_t last_pgoff = start_pgoff;
2204
	loff_t size;
2205
	struct page *head, *page;
2206 2207

	rcu_read_lock();
K
Kirill A. Shutemov 已提交
2208 2209 2210
	radix_tree_for_each_slot(slot, &mapping->page_tree, &iter,
			start_pgoff) {
		if (iter.index > end_pgoff)
2211 2212 2213 2214 2215 2216
			break;
repeat:
		page = radix_tree_deref_slot(slot);
		if (unlikely(!page))
			goto next;
		if (radix_tree_exception(page)) {
M
Matthew Wilcox 已提交
2217 2218 2219 2220 2221
			if (radix_tree_deref_retry(page)) {
				slot = radix_tree_iter_retry(&iter);
				continue;
			}
			goto next;
2222 2223
		}

2224 2225
		head = compound_head(page);
		if (!page_cache_get_speculative(head))
2226 2227
			goto repeat;

2228 2229 2230 2231 2232 2233
		/* The page was split under us? */
		if (compound_head(page) != head) {
			put_page(head);
			goto repeat;
		}

2234 2235
		/* Has the page moved? */
		if (unlikely(page != *slot)) {
2236
			put_page(head);
2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249
			goto repeat;
		}

		if (!PageUptodate(page) ||
				PageReadahead(page) ||
				PageHWPoison(page))
			goto skip;
		if (!trylock_page(page))
			goto skip;

		if (page->mapping != mapping || !PageUptodate(page))
			goto unlock;

2250 2251
		size = round_up(i_size_read(mapping->host), PAGE_SIZE);
		if (page->index >= size >> PAGE_SHIFT)
2252 2253 2254 2255
			goto unlock;

		if (file->f_ra.mmap_miss > 0)
			file->f_ra.mmap_miss--;
2256 2257 2258 2259 2260 2261 2262

		fe->address += (iter.index - last_pgoff) << PAGE_SHIFT;
		if (fe->pte)
			fe->pte += iter.index - last_pgoff;
		last_pgoff = iter.index;
		if (alloc_set_pte(fe, NULL, page))
			goto unlock;
2263 2264 2265 2266 2267
		unlock_page(page);
		goto next;
unlock:
		unlock_page(page);
skip:
2268
		put_page(page);
2269
next:
2270 2271 2272
		/* Huge page is mapped? No need to proceed. */
		if (pmd_trans_huge(*fe->pmd))
			break;
K
Kirill A. Shutemov 已提交
2273
		if (iter.index == end_pgoff)
2274 2275 2276 2277 2278 2279
			break;
	}
	rcu_read_unlock();
}
EXPORT_SYMBOL(filemap_map_pages);

2280 2281 2282
int filemap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
{
	struct page *page = vmf->page;
A
Al Viro 已提交
2283
	struct inode *inode = file_inode(vma->vm_file);
2284 2285
	int ret = VM_FAULT_LOCKED;

2286
	sb_start_pagefault(inode->i_sb);
2287 2288 2289 2290 2291 2292 2293
	file_update_time(vma->vm_file);
	lock_page(page);
	if (page->mapping != inode->i_mapping) {
		unlock_page(page);
		ret = VM_FAULT_NOPAGE;
		goto out;
	}
2294 2295 2296 2297 2298 2299
	/*
	 * We mark the page dirty already here so that when freeze is in
	 * progress, we are guaranteed that writeback during freezing will
	 * see the dirty page and writeprotect it again.
	 */
	set_page_dirty(page);
2300
	wait_for_stable_page(page);
2301
out:
2302
	sb_end_pagefault(inode->i_sb);
2303 2304 2305 2306
	return ret;
}
EXPORT_SYMBOL(filemap_page_mkwrite);

2307
const struct vm_operations_struct generic_file_vm_ops = {
2308
	.fault		= filemap_fault,
2309
	.map_pages	= filemap_map_pages,
2310
	.page_mkwrite	= filemap_page_mkwrite,
L
Linus Torvalds 已提交
2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348
};

/* This is used for a general mmap of a disk file */

int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
{
	struct address_space *mapping = file->f_mapping;

	if (!mapping->a_ops->readpage)
		return -ENOEXEC;
	file_accessed(file);
	vma->vm_ops = &generic_file_vm_ops;
	return 0;
}

/*
 * This is for filesystems which do not implement ->writepage.
 */
int generic_file_readonly_mmap(struct file *file, struct vm_area_struct *vma)
{
	if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_MAYWRITE))
		return -EINVAL;
	return generic_file_mmap(file, vma);
}
#else
int generic_file_mmap(struct file * file, struct vm_area_struct * vma)
{
	return -ENOSYS;
}
int generic_file_readonly_mmap(struct file * file, struct vm_area_struct * vma)
{
	return -ENOSYS;
}
#endif /* CONFIG_MMU */

EXPORT_SYMBOL(generic_file_mmap);
EXPORT_SYMBOL(generic_file_readonly_mmap);

S
Sasha Levin 已提交
2349 2350 2351 2352 2353
static struct page *wait_on_page_read(struct page *page)
{
	if (!IS_ERR(page)) {
		wait_on_page_locked(page);
		if (!PageUptodate(page)) {
2354
			put_page(page);
S
Sasha Levin 已提交
2355 2356 2357 2358 2359 2360
			page = ERR_PTR(-EIO);
		}
	}
	return page;
}

2361
static struct page *do_read_cache_page(struct address_space *mapping,
2362
				pgoff_t index,
2363
				int (*filler)(void *, struct page *),
2364 2365
				void *data,
				gfp_t gfp)
L
Linus Torvalds 已提交
2366
{
N
Nick Piggin 已提交
2367
	struct page *page;
L
Linus Torvalds 已提交
2368 2369 2370 2371
	int err;
repeat:
	page = find_get_page(mapping, index);
	if (!page) {
2372
		page = __page_cache_alloc(gfp | __GFP_COLD);
N
Nick Piggin 已提交
2373 2374
		if (!page)
			return ERR_PTR(-ENOMEM);
2375
		err = add_to_page_cache_lru(page, mapping, index, gfp);
N
Nick Piggin 已提交
2376
		if (unlikely(err)) {
2377
			put_page(page);
N
Nick Piggin 已提交
2378 2379
			if (err == -EEXIST)
				goto repeat;
L
Linus Torvalds 已提交
2380 2381 2382
			/* Presumably ENOMEM for radix tree node */
			return ERR_PTR(err);
		}
2383 2384

filler:
L
Linus Torvalds 已提交
2385 2386
		err = filler(data, page);
		if (err < 0) {
2387
			put_page(page);
2388
			return ERR_PTR(err);
L
Linus Torvalds 已提交
2389 2390
		}

2391 2392 2393 2394 2395
		page = wait_on_page_read(page);
		if (IS_ERR(page))
			return page;
		goto out;
	}
L
Linus Torvalds 已提交
2396 2397 2398
	if (PageUptodate(page))
		goto out;

2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434
	/*
	 * Page is not up to date and may be locked due one of the following
	 * case a: Page is being filled and the page lock is held
	 * case b: Read/write error clearing the page uptodate status
	 * case c: Truncation in progress (page locked)
	 * case d: Reclaim in progress
	 *
	 * Case a, the page will be up to date when the page is unlocked.
	 *    There is no need to serialise on the page lock here as the page
	 *    is pinned so the lock gives no additional protection. Even if the
	 *    the page is truncated, the data is still valid if PageUptodate as
	 *    it's a race vs truncate race.
	 * Case b, the page will not be up to date
	 * Case c, the page may be truncated but in itself, the data may still
	 *    be valid after IO completes as it's a read vs truncate race. The
	 *    operation must restart if the page is not uptodate on unlock but
	 *    otherwise serialising on page lock to stabilise the mapping gives
	 *    no additional guarantees to the caller as the page lock is
	 *    released before return.
	 * Case d, similar to truncation. If reclaim holds the page lock, it
	 *    will be a race with remove_mapping that determines if the mapping
	 *    is valid on unlock but otherwise the data is valid and there is
	 *    no need to serialise with page lock.
	 *
	 * As the page lock gives no additional guarantee, we optimistically
	 * wait on the page to be unlocked and check if it's up to date and
	 * use the page if it is. Otherwise, the page lock is required to
	 * distinguish between the different cases. The motivation is that we
	 * avoid spurious serialisations and wakeups when multiple processes
	 * wait on the same page for IO to complete.
	 */
	wait_on_page_locked(page);
	if (PageUptodate(page))
		goto out;

	/* Distinguish between all the cases under the safety of the lock */
L
Linus Torvalds 已提交
2435
	lock_page(page);
2436 2437

	/* Case c or d, restart the operation */
L
Linus Torvalds 已提交
2438 2439
	if (!page->mapping) {
		unlock_page(page);
2440
		put_page(page);
2441
		goto repeat;
L
Linus Torvalds 已提交
2442
	}
2443 2444

	/* Someone else locked and filled the page in a very small window */
L
Linus Torvalds 已提交
2445 2446 2447 2448
	if (PageUptodate(page)) {
		unlock_page(page);
		goto out;
	}
2449 2450
	goto filler;

2451
out:
2452 2453 2454
	mark_page_accessed(page);
	return page;
}
2455 2456

/**
S
Sasha Levin 已提交
2457
 * read_cache_page - read into page cache, fill it if needed
2458 2459 2460
 * @mapping:	the page's address_space
 * @index:	the page index
 * @filler:	function to perform the read
2461
 * @data:	first arg to filler(data, page) function, often left as NULL
2462 2463
 *
 * Read into the page cache. If a page already exists, and PageUptodate() is
S
Sasha Levin 已提交
2464
 * not set, try to fill the page and wait for it to become unlocked.
2465 2466 2467
 *
 * If the page does not get brought uptodate, return -EIO.
 */
S
Sasha Levin 已提交
2468
struct page *read_cache_page(struct address_space *mapping,
2469
				pgoff_t index,
2470
				int (*filler)(void *, struct page *),
2471 2472 2473 2474
				void *data)
{
	return do_read_cache_page(mapping, index, filler, data, mapping_gfp_mask(mapping));
}
S
Sasha Levin 已提交
2475
EXPORT_SYMBOL(read_cache_page);
2476 2477 2478 2479 2480 2481 2482 2483

/**
 * read_cache_page_gfp - read into page cache, using specified page allocation flags.
 * @mapping:	the page's address_space
 * @index:	the page index
 * @gfp:	the page allocator flags to use if allocating
 *
 * This is the same as "read_mapping_page(mapping, index, NULL)", but with
2484
 * any new page allocations done using the specified allocation flags.
2485 2486 2487 2488 2489 2490 2491 2492 2493
 *
 * If the page does not get brought uptodate, return -EIO.
 */
struct page *read_cache_page_gfp(struct address_space *mapping,
				pgoff_t index,
				gfp_t gfp)
{
	filler_t *filler = (filler_t *)mapping->a_ops->readpage;

S
Sasha Levin 已提交
2494
	return do_read_cache_page(mapping, index, filler, NULL, gfp);
2495 2496 2497
}
EXPORT_SYMBOL(read_cache_page_gfp);

L
Linus Torvalds 已提交
2498 2499 2500
/*
 * Performs necessary checks before doing a write
 *
2501
 * Can adjust writing position or amount of bytes to write.
L
Linus Torvalds 已提交
2502 2503 2504
 * Returns appropriate error code that caller should return or
 * zero in case that write should be allowed.
 */
2505
inline ssize_t generic_write_checks(struct kiocb *iocb, struct iov_iter *from)
L
Linus Torvalds 已提交
2506
{
2507
	struct file *file = iocb->ki_filp;
L
Linus Torvalds 已提交
2508
	struct inode *inode = file->f_mapping->host;
J
Jiri Slaby 已提交
2509
	unsigned long limit = rlimit(RLIMIT_FSIZE);
2510
	loff_t pos;
L
Linus Torvalds 已提交
2511

2512 2513
	if (!iov_iter_count(from))
		return 0;
L
Linus Torvalds 已提交
2514

2515
	/* FIXME: this is for backwards compatibility with 2.4 */
2516
	if (iocb->ki_flags & IOCB_APPEND)
2517
		iocb->ki_pos = i_size_read(inode);
L
Linus Torvalds 已提交
2518

2519
	pos = iocb->ki_pos;
L
Linus Torvalds 已提交
2520

2521
	if (limit != RLIM_INFINITY) {
2522
		if (iocb->ki_pos >= limit) {
2523 2524
			send_sig(SIGXFSZ, current, 0);
			return -EFBIG;
L
Linus Torvalds 已提交
2525
		}
2526
		iov_iter_truncate(from, limit - (unsigned long)pos);
L
Linus Torvalds 已提交
2527 2528 2529 2530 2531
	}

	/*
	 * LFS rule
	 */
2532
	if (unlikely(pos + iov_iter_count(from) > MAX_NON_LFS &&
L
Linus Torvalds 已提交
2533
				!(file->f_flags & O_LARGEFILE))) {
2534
		if (pos >= MAX_NON_LFS)
L
Linus Torvalds 已提交
2535
			return -EFBIG;
2536
		iov_iter_truncate(from, MAX_NON_LFS - (unsigned long)pos);
L
Linus Torvalds 已提交
2537 2538 2539 2540 2541 2542 2543 2544 2545
	}

	/*
	 * Are we about to exceed the fs block limit ?
	 *
	 * If we have written data it becomes a short write.  If we have
	 * exceeded without writing data we send a signal and return EFBIG.
	 * Linus frestrict idea will clean these up nicely..
	 */
2546 2547
	if (unlikely(pos >= inode->i_sb->s_maxbytes))
		return -EFBIG;
L
Linus Torvalds 已提交
2548

2549 2550
	iov_iter_truncate(from, inode->i_sb->s_maxbytes - pos);
	return iov_iter_count(from);
L
Linus Torvalds 已提交
2551 2552 2553
}
EXPORT_SYMBOL(generic_write_checks);

2554 2555 2556 2557 2558 2559
int pagecache_write_begin(struct file *file, struct address_space *mapping,
				loff_t pos, unsigned len, unsigned flags,
				struct page **pagep, void **fsdata)
{
	const struct address_space_operations *aops = mapping->a_ops;

2560
	return aops->write_begin(file, mapping, pos, len, flags,
2561 2562 2563 2564 2565 2566 2567 2568 2569 2570
							pagep, fsdata);
}
EXPORT_SYMBOL(pagecache_write_begin);

int pagecache_write_end(struct file *file, struct address_space *mapping,
				loff_t pos, unsigned len, unsigned copied,
				struct page *page, void *fsdata)
{
	const struct address_space_operations *aops = mapping->a_ops;

2571
	return aops->write_end(file, mapping, pos, len, copied, page, fsdata);
2572 2573 2574
}
EXPORT_SYMBOL(pagecache_write_end);

L
Linus Torvalds 已提交
2575
ssize_t
2576
generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from)
L
Linus Torvalds 已提交
2577 2578 2579 2580
{
	struct file	*file = iocb->ki_filp;
	struct address_space *mapping = file->f_mapping;
	struct inode	*inode = mapping->host;
2581
	loff_t		pos = iocb->ki_pos;
L
Linus Torvalds 已提交
2582
	ssize_t		written;
2583 2584
	size_t		write_len;
	pgoff_t		end;
A
Al Viro 已提交
2585
	struct iov_iter data;
L
Linus Torvalds 已提交
2586

A
Al Viro 已提交
2587
	write_len = iov_iter_count(from);
2588
	end = (pos + write_len - 1) >> PAGE_SHIFT;
2589

2590
	written = filemap_write_and_wait_range(mapping, pos, pos + write_len - 1);
2591 2592 2593 2594 2595 2596 2597
	if (written)
		goto out;

	/*
	 * After a write we want buffered reads to be sure to go to disk to get
	 * the new data.  We invalidate clean cached page from the region we're
	 * about to write.  We do this *before* the write so that we can return
2598
	 * without clobbering -EIOCBQUEUED from ->direct_IO().
2599 2600 2601
	 */
	if (mapping->nrpages) {
		written = invalidate_inode_pages2_range(mapping,
2602
					pos >> PAGE_SHIFT, end);
2603 2604 2605 2606 2607 2608 2609
		/*
		 * If a page can not be invalidated, return 0 to fall back
		 * to buffered write.
		 */
		if (written) {
			if (written == -EBUSY)
				return 0;
2610
			goto out;
2611
		}
2612 2613
	}

A
Al Viro 已提交
2614
	data = *from;
2615
	written = mapping->a_ops->direct_IO(iocb, &data);
2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626

	/*
	 * Finally, try again to invalidate clean pages which might have been
	 * cached by non-direct readahead, or faulted in by get_user_pages()
	 * if the source of the write was an mmap'ed region of the file
	 * we're writing.  Either one is a pretty crazy thing to do,
	 * so we don't support it 100%.  If this invalidation
	 * fails, tough, the write still worked...
	 */
	if (mapping->nrpages) {
		invalidate_inode_pages2_range(mapping,
2627
					      pos >> PAGE_SHIFT, end);
2628 2629
	}

L
Linus Torvalds 已提交
2630
	if (written > 0) {
2631
		pos += written;
2632
		iov_iter_advance(from, written);
2633 2634
		if (pos > i_size_read(inode) && !S_ISBLK(inode->i_mode)) {
			i_size_write(inode, pos);
L
Linus Torvalds 已提交
2635 2636
			mark_inode_dirty(inode);
		}
2637
		iocb->ki_pos = pos;
L
Linus Torvalds 已提交
2638
	}
2639
out:
L
Linus Torvalds 已提交
2640 2641 2642 2643
	return written;
}
EXPORT_SYMBOL(generic_file_direct_write);

N
Nick Piggin 已提交
2644 2645 2646 2647
/*
 * Find or create a page at the given pagecache position. Return the locked
 * page. This function is specifically for buffered writes.
 */
2648 2649
struct page *grab_cache_page_write_begin(struct address_space *mapping,
					pgoff_t index, unsigned flags)
N
Nick Piggin 已提交
2650 2651
{
	struct page *page;
2652
	int fgp_flags = FGP_LOCK|FGP_WRITE|FGP_CREAT;
2653

2654
	if (flags & AOP_FLAG_NOFS)
2655 2656 2657
		fgp_flags |= FGP_NOFS;

	page = pagecache_get_page(mapping, index, fgp_flags,
2658
			mapping_gfp_mask(mapping));
2659
	if (page)
2660
		wait_for_stable_page(page);
N
Nick Piggin 已提交
2661 2662 2663

	return page;
}
2664
EXPORT_SYMBOL(grab_cache_page_write_begin);
N
Nick Piggin 已提交
2665

2666
ssize_t generic_perform_write(struct file *file,
2667 2668 2669 2670 2671 2672
				struct iov_iter *i, loff_t pos)
{
	struct address_space *mapping = file->f_mapping;
	const struct address_space_operations *a_ops = mapping->a_ops;
	long status = 0;
	ssize_t written = 0;
N
Nick Piggin 已提交
2673 2674 2675 2676 2677
	unsigned int flags = 0;

	/*
	 * Copies from kernel address space cannot fail (NFSD is a big user).
	 */
A
Al Viro 已提交
2678
	if (!iter_is_iovec(i))
N
Nick Piggin 已提交
2679
		flags |= AOP_FLAG_UNINTERRUPTIBLE;
2680 2681 2682 2683 2684 2685 2686 2687

	do {
		struct page *page;
		unsigned long offset;	/* Offset into pagecache page */
		unsigned long bytes;	/* Bytes to write to page */
		size_t copied;		/* Bytes copied from user */
		void *fsdata;

2688 2689
		offset = (pos & (PAGE_SIZE - 1));
		bytes = min_t(unsigned long, PAGE_SIZE - offset,
2690 2691 2692
						iov_iter_count(i));

again:
2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707
		/*
		 * Bring in the user page that we will copy from _first_.
		 * Otherwise there's a nasty deadlock on copying from the
		 * same page as we're writing to, without it being marked
		 * up-to-date.
		 *
		 * Not only is this an optimisation, but it is also required
		 * to check that the address is actually valid, when atomic
		 * usercopies are used, below.
		 */
		if (unlikely(iov_iter_fault_in_readable(i, bytes))) {
			status = -EFAULT;
			break;
		}

J
Jan Kara 已提交
2708 2709 2710 2711 2712
		if (fatal_signal_pending(current)) {
			status = -EINTR;
			break;
		}

N
Nick Piggin 已提交
2713
		status = a_ops->write_begin(file, mapping, pos, bytes, flags,
2714
						&page, &fsdata);
2715
		if (unlikely(status < 0))
2716 2717
			break;

2718 2719
		if (mapping_writably_mapped(mapping))
			flush_dcache_page(page);
2720

2721 2722 2723 2724 2725 2726 2727 2728 2729 2730 2731
		copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
		flush_dcache_page(page);

		status = a_ops->write_end(file, mapping, pos, bytes, copied,
						page, fsdata);
		if (unlikely(status < 0))
			break;
		copied = status;

		cond_resched();

2732
		iov_iter_advance(i, copied);
2733 2734 2735 2736 2737 2738 2739 2740 2741
		if (unlikely(copied == 0)) {
			/*
			 * If we were unable to copy any data at all, we must
			 * fall back to a single segment length write.
			 *
			 * If we didn't fallback here, we could livelock
			 * because not all segments in the iov can be copied at
			 * once without a pagefault.
			 */
2742
			bytes = min_t(unsigned long, PAGE_SIZE - offset,
2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753
						iov_iter_single_seg_count(i));
			goto again;
		}
		pos += copied;
		written += copied;

		balance_dirty_pages_ratelimited(mapping);
	} while (iov_iter_count(i));

	return written ? written : status;
}
2754
EXPORT_SYMBOL(generic_perform_write);
L
Linus Torvalds 已提交
2755

2756
/**
2757
 * __generic_file_write_iter - write data to a file
2758
 * @iocb:	IO state structure (file, offset, etc.)
2759
 * @from:	iov_iter with data to write
2760 2761 2762 2763 2764 2765 2766 2767 2768 2769 2770 2771 2772
 *
 * This function does all the work needed for actually writing data to a
 * file. It does all basic checks, removes SUID from the file, updates
 * modification times and calls proper subroutines depending on whether we
 * do direct IO or a standard buffered write.
 *
 * It expects i_mutex to be grabbed unless we work on a block device or similar
 * object which does not need locking at all.
 *
 * This function does *not* take care of syncing data in case of O_SYNC write.
 * A caller has to handle it. This is mainly due to the fact that we want to
 * avoid syncing under i_mutex.
 */
2773
ssize_t __generic_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
L
Linus Torvalds 已提交
2774 2775
{
	struct file *file = iocb->ki_filp;
2776
	struct address_space * mapping = file->f_mapping;
L
Linus Torvalds 已提交
2777
	struct inode 	*inode = mapping->host;
2778
	ssize_t		written = 0;
L
Linus Torvalds 已提交
2779
	ssize_t		err;
2780
	ssize_t		status;
L
Linus Torvalds 已提交
2781 2782

	/* We can write back this queue in page reclaim */
2783
	current->backing_dev_info = inode_to_bdi(inode);
2784
	err = file_remove_privs(file);
L
Linus Torvalds 已提交
2785 2786 2787
	if (err)
		goto out;

2788 2789 2790
	err = file_update_time(file);
	if (err)
		goto out;
L
Linus Torvalds 已提交
2791

2792
	if (iocb->ki_flags & IOCB_DIRECT) {
2793
		loff_t pos, endbyte;
2794

2795
		written = generic_file_direct_write(iocb, from);
L
Linus Torvalds 已提交
2796
		/*
2797 2798 2799 2800 2801
		 * If the write stopped short of completing, fall back to
		 * buffered writes.  Some filesystems do this for writes to
		 * holes, for example.  For DAX files, a buffered write will
		 * not succeed (even if it did, DAX does not handle dirty
		 * page-cache pages correctly).
L
Linus Torvalds 已提交
2802
		 */
2803
		if (written < 0 || !iov_iter_count(from) || IS_DAX(inode))
2804 2805
			goto out;

2806
		status = generic_perform_write(file, from, pos = iocb->ki_pos);
2807
		/*
2808
		 * If generic_perform_write() returned a synchronous error
2809 2810 2811 2812 2813
		 * then we want to return the number of bytes which were
		 * direct-written, or the error code if that was zero.  Note
		 * that this differs from normal direct-io semantics, which
		 * will return -EFOO even if some bytes were written.
		 */
2814
		if (unlikely(status < 0)) {
2815
			err = status;
2816 2817 2818 2819 2820 2821 2822
			goto out;
		}
		/*
		 * We need to ensure that the page cache pages are written to
		 * disk and invalidated to preserve the expected O_DIRECT
		 * semantics.
		 */
2823
		endbyte = pos + status - 1;
2824
		err = filemap_write_and_wait_range(mapping, pos, endbyte);
2825
		if (err == 0) {
2826
			iocb->ki_pos = endbyte + 1;
2827
			written += status;
2828
			invalidate_mapping_pages(mapping,
2829 2830
						 pos >> PAGE_SHIFT,
						 endbyte >> PAGE_SHIFT);
2831 2832 2833 2834 2835 2836 2837
		} else {
			/*
			 * We don't know how much we wrote, so just return
			 * the number of bytes which were direct-written
			 */
		}
	} else {
2838 2839 2840
		written = generic_perform_write(file, from, iocb->ki_pos);
		if (likely(written > 0))
			iocb->ki_pos += written;
2841
	}
L
Linus Torvalds 已提交
2842 2843 2844 2845
out:
	current->backing_dev_info = NULL;
	return written ? written : err;
}
2846
EXPORT_SYMBOL(__generic_file_write_iter);
2847 2848

/**
2849
 * generic_file_write_iter - write data to a file
2850
 * @iocb:	IO state structure
2851
 * @from:	iov_iter with data to write
2852
 *
2853
 * This is a wrapper around __generic_file_write_iter() to be used by most
2854 2855 2856
 * filesystems. It takes care of syncing the file in case of O_SYNC file
 * and acquires i_mutex as needed.
 */
2857
ssize_t generic_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
L
Linus Torvalds 已提交
2858 2859
{
	struct file *file = iocb->ki_filp;
2860
	struct inode *inode = file->f_mapping->host;
L
Linus Torvalds 已提交
2861 2862
	ssize_t ret;

A
Al Viro 已提交
2863
	inode_lock(inode);
2864 2865
	ret = generic_write_checks(iocb, from);
	if (ret > 0)
2866
		ret = __generic_file_write_iter(iocb, from);
A
Al Viro 已提交
2867
	inode_unlock(inode);
L
Linus Torvalds 已提交
2868

2869 2870
	if (ret > 0)
		ret = generic_write_sync(iocb, ret);
L
Linus Torvalds 已提交
2871 2872
	return ret;
}
2873
EXPORT_SYMBOL(generic_file_write_iter);
L
Linus Torvalds 已提交
2874

2875 2876 2877 2878 2879 2880 2881 2882 2883 2884
/**
 * try_to_release_page() - release old fs-specific metadata on a page
 *
 * @page: the page which the kernel is trying to free
 * @gfp_mask: memory allocation flags (and I/O mode)
 *
 * The address_space is to try to release any data against the page
 * (presumably at page->private).  If the release was successful, return `1'.
 * Otherwise return zero.
 *
2885 2886 2887
 * This may also be called if PG_fscache is set on a page, indicating that the
 * page is known to the local caching routines.
 *
2888
 * The @gfp_mask argument specifies whether I/O may be performed to release
2889
 * this page (__GFP_IO), and whether the call may block (__GFP_RECLAIM & __GFP_FS).
2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905
 *
 */
int try_to_release_page(struct page *page, gfp_t gfp_mask)
{
	struct address_space * const mapping = page->mapping;

	BUG_ON(!PageLocked(page));
	if (PageWriteback(page))
		return 0;

	if (mapping && mapping->a_ops->releasepage)
		return mapping->a_ops->releasepage(page, gfp_mask);
	return try_to_free_buffers(page);
}

EXPORT_SYMBOL(try_to_release_page);