| blob | 89aade6f45f62d9fd6300ef84c118c6b919cddc9 |
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/ext4/inode.c
4 *
5 * Copyright (C) 1992, 1993, 1994, 1995
6 * Remy Card (card@masi.ibp.fr)
7 * Laboratoire MASI - Institut Blaise Pascal
8 * Universite Pierre et Marie Curie (Paris VI)
9 *
10 * from
11 *
12 * linux/fs/minix/inode.c
13 *
14 * Copyright (C) 1991, 1992 Linus Torvalds
15 *
16 * 64-bit file support on 64-bit platforms by Jakub Jelinek
17 * (jj@sunsite.ms.mff.cuni.cz)
18 *
19 * Assorted race fixes, rewrite of ext4_get_block() by Al Viro, 2000
20 */
22 #include <linux/fs.h>
23 #include <linux/mount.h>
24 #include <linux/time.h>
25 #include <linux/highuid.h>
26 #include <linux/pagemap.h>
27 #include <linux/dax.h>
28 #include <linux/quotaops.h>
29 #include <linux/string.h>
30 #include <linux/buffer_head.h>
31 #include <linux/writeback.h>
32 #include <linux/pagevec.h>
33 #include <linux/mpage.h>
34 #include <linux/namei.h>
35 #include <linux/uio.h>
36 #include <linux/bio.h>
37 #include <linux/workqueue.h>
38 #include <linux/kernel.h>
39 #include <linux/printk.h>
40 #include <linux/slab.h>
41 #include <linux/bitops.h>
42 #include <linux/iomap.h>
43 #include <linux/iversion.h>
50 #include <trace/events/ext4.h>
59 {
61 __u32 csum;
75 EXT4_GOOD_OLD_INODE_SIZE,
79 csum_size);
81 }
84 }
87 }
91 {
104 else
108 }
112 {
113 __u32 csum;
125 }
128 loff_t new_size)
129 {
131 /*
132 * If jinode is zero, then we never opened the file for
133 * writing, so there's no need to call
134 * jbd2_journal_begin_ordered_truncate() since there's no
135 * outstanding writes we need to flush.
136 */
141 new_size);
142 }
147 /*
148 * Test whether an inode is a fast symlink.
149 * A fast symlink has its symlink data stored in ext4_inode_info->i_data.
150 */
152 {
161 }
164 }
166 /*
167 * Called at the last iput() if i_nlink is zero.
168 */
170 {
173 /*
174 * Credits for final inode cleanup and freeing:
175 * sb + inode (ext4_orphan_del()), block bitmap, group descriptor
176 * (xattr block freeing), bitmap, group descriptor (inode freeing)
177 */
190 }
200 /*
201 * For inodes with journalled data, transaction commit could have
202 * dirtied the inode. And for inodes with dioread_nolock, unwritten
203 * extents converting worker could merge extents and also have dirtied
204 * the inode. Flush worker is ignoring it because of I_FREEING flag but
205 * we still need to remove the inode from the writeback lists.
206 */
210 /*
211 * Protect us against freezing - iput() caller didn't have to have any
212 * protection against it. When we are in a running transaction though,
213 * we are already protected against freezing and we cannot grab further
214 * protection due to lock ordering constraints.
215 */
219 }
224 /*
225 * Block bitmap, group descriptor, and inode are accounted in both
226 * ext4_blocks_for_truncate() and extra_credits. So subtract 3.
227 */
232 /*
233 * If we're going to skip the normal cleanup, we still need to
234 * make sure that the in-core orphan linked list is properly
235 * cleaned up.
236 */
241 }
246 /*
247 * Set inode->i_size to 0 before calling ext4_truncate(). We need
248 * special handling of symlinks here because i_size is used to
249 * determine whether ext4_inode_info->i_data contains symlink data or
250 * block mappings. Setting i_size to 0 will remove its fast symlink
251 * status. Erase i_data so that it becomes a valid empty block map.
252 */
261 }
269 }
270 }
272 /* Remove xattr references. */
274 extra_credits);
277 stop_handle:
284 }
286 /*
287 * Kill off the orphan record which ext4_truncate created.
288 * AKPM: I think this can be inside the above `if'.
289 * Note that ext4_orphan_del() has to be able to cope with the
290 * deletion of a non-existent orphan - this is because we don't
291 * know if ext4_truncate() actually created an orphan record.
292 * (Well, we could do this if we need to, but heck - it works)
293 */
297 /*
298 * One subtle ordering requirement: if anything has gone wrong
299 * (transaction abort, IO errors, whatever), then we can still
300 * do these next steps (the fs will already have been marked as
301 * having errors), but we can't free the inode if the mark_dirty
302 * fails.
303 */
305 /* If that failed, just do the required in-core inode clear. */
307 else
314 no_delete:
315 /*
316 * Check out some where else accidentally dirty the evicting inode,
317 * which may probably cause inode use-after-free issues later.
318 */
324 }
326 #ifdef CONFIG_QUOTA
328 {
330 }
331 #endif
333 /*
334 * Called with i_data_sem down, which is important since we can call
335 * ext4_discard_preallocations() from here.
336 */
339 {
352 }
354 /* Update per-inode reservations */
360 /* Update quota subsystem for data blocks */
364 /*
365 * We did fallocate with an offset that is already delayed
366 * allocated. So on delayed allocated writeback we should
367 * not re-claim the quota for fallocated blocks.
368 */
370 }
372 /*
373 * If we have done all the pending block allocations and if
374 * there aren't any writers on the inode, we can discard the
375 * inode's preallocations.
376 */
380 }
385 {
392 "lblock %lu mapped to illegal pblock %llu "
396 }
398 }
401 ext4_lblk_t len)
402 {
413 }
415 #define check_block_validity(inode, map) \
416 __check_block_validity((inode), __func__, __LINE__, (map))
418 #ifdef ES_AGGRESSIVE_TEST
424 {
428 /*
429 * There is a race window that the result is not the same.
430 * e.g. xfstests #223 when dioread_nolock enables. The reason
431 * is that we lookup a block mapping in extent status tree with
432 * out taking i_data_sem. So at the time the unwritten extent
433 * could be converted.
434 */
440 }
443 /*
444 * We don't check m_len because extent will be collpased in status
445 * tree. So the m_len might not equal.
446 */
451 "es_cached ex [%d/%d/%llu/%x] != "
457 }
458 }
463 {
469 else
477 "ES len assertion failed for inode "
481 }
488 }
492 {
497 /*
498 * We pass in the magic EXT4_GET_BLOCKS_DELALLOC_RESERVE
499 * indicates that the blocks and quotas has already been
500 * checked when the data was copied into the page cache.
501 */
505 /*
506 * Here we clear m_flags because after allocating an new extent,
507 * it will be set again.
508 */
511 /*
512 * We need to check for EXT4 here because migrate could have
513 * changed the inode type in between.
514 */
520 /*
521 * We allocated new blocks which will result in i_data's
522 * format changing. Force the migrate to fail by clearing
523 * migrate flags.
524 */
527 }
533 "ES len assertion failed for inode %lu: "
537 }
539 /*
540 * We have to zeroout blocks before inserting them into extent
541 * status tree. Otherwise someone could look them up there and
542 * use them before they are really zeroed. We also have to
543 * unmap metadata before zeroing as otherwise writeback can
544 * overwrite zeros with stale data from block device.
545 */
552 }
554 /*
555 * If the extent has been zeroed out, we don't need to update
556 * extent status tree.
557 */
562 }
570 }
572 /*
573 * The ext4_map_blocks() function tries to look up the requested blocks,
574 * and returns if the blocks are already mapped.
575 *
576 * Otherwise it takes the write lock of the i_data_sem and allocate blocks
577 * and store the allocated blocks in the result buffer head and mark it
578 * mapped.
579 *
580 * If file type is extents based, it will call ext4_ext_map_blocks(),
581 * Otherwise, call with ext4_ind_map_blocks() to handle indirect mapping
582 * based files
583 *
584 * On success, it returns the number of blocks being mapped or allocated.
585 * If flags doesn't contain EXT4_GET_BLOCKS_CREATE the blocks are
586 * pre-allocated and unwritten, the resulting @map is marked as unwritten.
587 * If the flags contain EXT4_GET_BLOCKS_CREATE, it will mark @map as mapped.
588 *
589 * It returns 0 if plain look up failed (blocks have not been allocated), in
590 * that case, @map is returned as unmapped but we still do fill map->m_len to
591 * indicate the length of a hole starting at map->m_lblk.
592 *
593 * It returns the error in case of allocation failure.
594 */
597 {
601 #ifdef ES_AGGRESSIVE_TEST
605 #endif
611 /*
612 * ext4_map_blocks returns an int, and m_len is an unsigned int
613 */
617 /* We can handle the block number less than EXT_MAX_BLOCKS */
621 /* Lookup extent status tree firstly */
644 }
648 #ifdef ES_AGGRESSIVE_TEST
651 #endif
653 }
654 /*
655 * In the query cache no-wait mode, nothing we can do more if we
656 * cannot find extent in the cache.
657 */
661 /*
662 * Try to see if we can get the block without requesting a new
663 * file system block.
664 */
669 found:
674 }
676 /* If it is only a block(s) look up */
680 /*
681 * Returns if the blocks have already allocated
682 *
683 * Note that if blocks have been preallocated
684 * ext4_ext_map_blocks() returns with buffer head unmapped
685 */
687 /*
688 * If we need to convert extent to unwritten
689 * we continue and do the actual work in
690 * ext4_ext_map_blocks()
691 */
695 /*
696 * New blocks allocate and/or writing to unwritten extent
697 * will possibly result in updating i_data, so we take
698 * the write lock of i_data_sem, and call get_block()
699 * with create == 1 flag.
700 */
709 /*
710 * Inodes with freshly allocated blocks where contents will be
711 * visible after transaction commit must be on transaction's
712 * ordered data list.
713 */
719 loff_t start_byte =
726 else
731 }
732 }
740 }
742 /*
743 * Update EXT4_MAP_FLAGS in bh->b_state. For buffer heads attached to pages
744 * we have to be careful as someone else may be manipulating b_state as well.
745 */
747 {
753 /* Dummy buffer_head? Set non-atomically. */
757 }
758 /*
759 * Someone else may be modifying b_state. Be careful! This is ugly but
760 * once we get rid of using bh as a container for mapping information
761 * to pass to / from get_block functions, this can go away.
762 */
767 }
771 {
782 flags);
789 /* hole case, need to fill in bh->b_size */
791 }
793 }
797 {
800 }
802 /*
803 * Get block function used when preparing for buffered write if we require
804 * creating an unwritten extent if blocks haven't been allocated. The extent
805 * will be converted to written after the IO is complete.
806 */
809 {
815 EXT4_GET_BLOCKS_CREATE_UNWRIT_EXT);
817 /*
818 * If the buffer is marked unwritten, mark it as new to make sure it is
819 * zeroed out correctly in case of partial writes. Otherwise, there is
820 * a chance of stale data getting exposed.
821 */
826 }
828 /* Maximum number of blocks we map for direct IO at once. */
829 #define DIO_MAX_BLOCKS 4096
831 /*
832 * `handle' can be NULL if create is zero
833 */
836 {
859 /*
860 * Since bh could introduce extra ref count such as referred by
861 * journal_head etc. Try to avoid using __GFP_MOVABLE here
862 * as it may fail the migration when journal_head remains.
863 */
874 /*
875 * Now that we do not always journal data, we should
876 * keep in mind whether this should always journal the
877 * new buffer as metadata. For now, regular file
878 * writes use ext4_get_block instead, so it's not a
879 * problem.
880 */
884 EXT4_JTR_NONE);
888 }
892 }
901 errout:
904 }
908 {
922 }
924 }
926 /* Read a contiguous batch of blocks. */
929 {
938 }
939 }
942 /* Note that NULL bhs[i] is valid because of holes. */
957 }
958 }
961 out_brelse:
965 }
967 }
976 {
992 }
996 }
998 }
1000 /*
1001 * Helper for handling dirtying of journalled data. We also mark the folio as
1002 * dirty so that writeback code knows about this page (and inode) contains
1003 * dirty data. ext4_writepages() then commits appropriate transaction to
1004 * make data stable.
1005 */
1007 {
1010 }
1014 {
1019 EXT4_JTR_NONE);
1020 }
1025 {
1030 sector_t block;
1056 }
1058 }
1067 /*
1068 * We may be zeroing partial buffers or all new
1069 * buffers in case of failure. Prepare JBD2 for
1070 * that.
1071 */
1076 /*
1077 * Unlike __block_write_begin() we leave
1078 * dirtying of new uptodate buffers to
1079 * ->write_end() time or
1080 * folio_zero_new_buffers().
1081 */
1084 }
1087 block_end,
1090 }
1091 }
1095 }
1101 }
1102 }
1103 /*
1104 * If we issued read requests, let them complete.
1105 */
1110 }
1115 else
1126 }
1127 }
1128 }
1131 }
1133 /*
1134 * To preserve ordering, it is essential that the hole instantiation and
1135 * the data write be encapsulated in a single transaction. We cannot
1136 * close off a transaction and start a new one between the ext4_get_block()
1137 * and the ext4_write_end(). So doing the jbd2_journal_start at the start of
1138 * ext4_write_begin() is the right place.
1139 */
1143 {
1149 pgoff_t index;
1156 /*
1157 * Reserve one block more for addition to orphan list in case
1158 * we allocate blocks but write fails for some reason
1159 */
1167 foliop);
1172 }
1174 /*
1175 * __filemap_get_folio() can take a long time if the
1176 * system is thrashing due to memory pressure, or if the folio
1177 * is being written back. So grab it first before we start
1178 * the transaction handle. This also allows us to allocate
1179 * the folio (if needed) without using GFP_NOFS.
1180 */
1181 retry_grab:
1186 /*
1187 * The same as page allocation, we prealloc buffer heads before
1188 * starting the handle.
1189 */
1195 retry_journal:
1200 }
1204 /* The folio got truncated from under us */
1209 }
1210 /* In case writeback began while the folio was unlocked */
1215 ext4_get_block_unwritten);
1216 else
1218 ext4_get_block);
1223 }
1230 /*
1231 * ext4_block_write_begin may have instantiated a few blocks
1232 * outside i_size. Trim these off again. Don't need
1233 * i_size_read because we hold i_rwsem.
1234 *
1235 * Add inode to orphan list in case we crash before
1236 * truncate finishes
1237 */
1244 /*
1245 * If truncate failed early the inode might
1246 * still be on the orphan list; we need to
1247 * make sure the inode is removed from the
1248 * orphan list in that case.
1249 */
1252 }
1259 }
1262 }
1264 /* For write_end() in data=journal mode */
1267 {
1276 }
1278 /*
1279 * We need to pick up the new inode size which generic_commit_write gave us
1280 * `file' can be NULL - eg, when called from page_symlink().
1281 *
1282 * ext4 never places buffers on inode->i_mapping->i_private_list. metadata
1283 * buffers are managed internally.
1284 */
1289 {
1302 folio);
1305 /*
1306 * it's important to update i_size while still holding folio lock:
1307 * page writeout could otherwise come in and zero beyond i_size.
1308 *
1309 * If FS_IOC_ENABLE_VERITY is running on this inode, then Merkle tree
1310 * blocks are being written past EOF, so skip the i_size update.
1311 */
1320 }
1321 /*
1322 * Don't mark the inode dirty under folio lock. First, it unnecessarily
1323 * makes the holding time of folio lock longer. Second, it forces lock
1324 * ordering of folio lock and transaction start for journaling
1325 * filesystems.
1326 */
1331 /* if we have allocated more blocks and copied
1332 * less. We will have blocks allocated outside
1333 * inode->i_size. So truncate them
1334 */
1343 /*
1344 * If truncate failed early the inode might still be
1345 * on the orphan list; we need to make sure the inode
1346 * is removed from the orphan list in that case.
1347 */
1350 }
1353 }
1355 /*
1356 * This is a private version of folio_zero_new_buffers() which doesn't
1357 * set the buffer to be dirty, since in data=journalled mode we need
1358 * to call ext4_dirty_journalled_data() instead.
1359 */
1364 {
1380 }
1383 }
1384 }
1388 }
1394 {
1412 folio);
1425 write_end_fn);
1428 }
1438 }
1444 }
1447 /* if we have allocated more blocks and copied
1448 * less. We will have blocks allocated outside
1449 * inode->i_size. So truncate them
1450 */
1458 /*
1459 * If truncate failed early the inode might still be
1460 * on the orphan list; we need to make sure the inode
1461 * is removed from the orphan list in that case.
1462 */
1465 }
1468 }
1470 /*
1471 * Reserve space for 'nr_resv' clusters
1472 */
1474 {
1479 /*
1480 * We will charge metadata quota at writeout time; this saves
1481 * us from metadata over-estimation, though we may go over by
1482 * a small amount in the end. Here we just reserve for data.
1483 */
1493 }
1499 }
1502 {
1513 /*
1514 * if there aren't enough reserved blocks, then the
1515 * counter is messed up somewhere. Since this
1516 * function is called from invalidate page, it's
1517 * harmless to return without any action.
1518 */
1520 "ino %lu, to_free %d with only %d reserved "
1525 }
1528 /* update fs dirty data blocks counter */
1534 }
1536 /*
1537 * Delayed allocation stuff
1538 */
1541 /* These are input fields for ext4_do_writepages() */
1546 /* These are internal state of ext4_do_writepages() */
1550 /*
1551 * Extent to map - this can be after first_page because that can be
1552 * fully mapped. We somewhat abuse m_flags to store whether the extent
1553 * is delalloc or unwritten.
1554 */
1560 };
1564 {
1571 /* This is necessary when next_page == 0. */
1583 /*
1584 * avoid racing with extent status tree scans made by
1585 * ext4_insert_delayed_block()
1586 */
1590 }
1612 }
1614 }
1616 }
1617 }
1620 {
1639 }
1641 /*
1642 * Check whether the cluster containing lblk has been allocated or has
1643 * delalloc reservation.
1644 *
1645 * Returns 0 if the cluster doesn't have either, 1 if it has delalloc
1646 * reservation, 2 if it's already been allocated, negative error code on
1647 * failure.
1648 */
1650 {
1654 /* Has delalloc reservation? */
1658 /* Already been allocated? */
1668 }
1670 /*
1671 * ext4_insert_delayed_blocks - adds a multiple delayed blocks to the extents
1672 * status tree, incrementing the reserved
1673 * cluster/block count or making pending
1674 * reservations where needed
1675 *
1676 * @inode - file containing the newly added block
1677 * @lblk - start logical block to be added
1678 * @len - length of blocks to be added
1679 *
1680 * Returns 0 on success, negative error code on failure.
1681 */
1683 ext4_lblk_t len)
1684 {
1689 ext4_lblk_t resv_clu;
1692 /*
1693 * If the cluster containing lblk or end is shared with a delayed,
1694 * written, or unwritten extent in a bigalloc file system, it's
1695 * already been accounted for and does not need to be reserved.
1696 * A pending reservation must be made for the cluster if it's
1697 * shared with a written or unwritten extent and doesn't already
1698 * have one. Written and unwritten extents can be purged from the
1699 * extents status tree if the system is under memory pressure, so
1700 * it's necessary to examine the extent tree if a search of the
1701 * extents status tree doesn't get a match.
1702 */
1714 resv_clu--;
1716 }
1723 resv_clu--;
1725 }
1726 }
1732 }
1733 }
1736 end_allocated);
1738 }
1740 /*
1741 * Looks up the requested blocks and sets the delalloc extent map.
1742 * First try to look up for the extent entry that contains the requested
1743 * blocks in the extent status tree without i_data_sem, then try to look
1744 * up for the ondisk extent mapping with i_data_sem in read mode,
1745 * finally hold i_data_sem in write mode, looks up again and add a
1746 * delalloc extent entry if it still couldn't find any extent. Pass out
1747 * the mapped extent through @map and return 0 on success.
1748 */
1750 {
1753 #ifdef ES_AGGRESSIVE_TEST
1757 #endif
1763 /* Lookup extent status tree firstly */
1771 found:
1772 /*
1773 * Delayed extent could be allocated by fallocate.
1774 * So we need to check it.
1775 */
1779 }
1786 else
1789 #ifdef ES_AGGRESSIVE_TEST
1791 #endif
1793 }
1795 /*
1796 * Try to see if we can get the block without requesting a new
1797 * file system block.
1798 */
1802 else
1808 add_delayed:
1810 /*
1811 * Page fault path (ext4_page_mkwrite does not take i_rwsem)
1812 * and fallocate path (no folio lock) can race. Make sure we
1813 * lookup the extent status tree here again while i_data_sem
1814 * is held in write mode, before inserting a new da entry in
1815 * the extent status tree.
1816 */
1824 }
1830 }
1831 }
1838 }
1840 /*
1841 * This is a special get_block_t callback which is used by
1842 * ext4_da_write_begin(). It will either return mapped block or
1843 * reserve space for a single block.
1844 *
1845 * For delayed buffer_head we have BH_Mapped, BH_New, BH_Delay set.
1846 * We also have b_blocknr = -1 and b_bdev initialized properly
1847 *
1848 * For unwritten buffer_head we have BH_Mapped, BH_New, BH_Unwritten set.
1849 * We also have b_blocknr = physicalblock mapping unwritten extent and b_bdev
1850 * initialized properly.
1851 */
1854 {
1868 /*
1869 * first, we need to know whether the block is allocated already
1870 * preallocated blocks are unmapped but should treated
1871 * the same as allocated blocks.
1872 */
1882 }
1888 /* A delayed write to unwritten bh should be marked
1889 * new and mapped. Mapped ensures that we don't do
1890 * get_block multiple times when we write to the same
1891 * offset and new ensures that we do proper zero out
1892 * for partial write.
1893 */
1896 }
1898 }
1901 {
1904 }
1907 {
1909 loff_t size;
1914 /*
1915 * We have to be very careful here! Nothing protects writeback path
1916 * against i_size changes and the page can be writeably mapped into
1917 * page tables. So an application can be growing i_size and writing
1918 * data through mmap while writeback runs. folio_clear_dirty_for_io()
1919 * write-protects our page in page tables and the page cannot get
1920 * written to again until we release folio lock. So only after
1921 * folio_clear_dirty_for_io() we are safe to sample i_size for
1922 * ext4_bio_write_folio() to zero-out tail of the written page. We rely
1923 * on the barrier provided by folio_test_clear_dirty() in
1924 * folio_clear_dirty_for_io() to make sure i_size is really sampled only
1925 * after page tables are updated.
1926 */
1937 }
1939 #define BH_FLAGS (BIT(BH_Unwritten) | BIT(BH_Delay))
1941 /*
1942 * mballoc gives us at most this number of blocks...
1943 * XXX: That seems to be only a limitation of ext4_mb_normalize_request().
1944 * The rest of mballoc seems to handle chunks up to full group size.
1945 */
1946 #define MAX_WRITEPAGES_EXTENT_LEN 2048
1948 /*
1949 * mpage_add_bh_to_extent - try to add bh to extent of blocks to map
1950 *
1951 * @mpd - extent of blocks
1952 * @lblk - logical number of the block in the file
1953 * @bh - buffer head we want to add to the extent
1954 *
1955 * The function is used to collect contig. blocks in the same state. If the
1956 * buffer doesn't require mapping for writeback and we haven't started the
1957 * extent of buffers to map yet, the function returns 'true' immediately - the
1958 * caller can write the buffer right away. Otherwise the function returns true
1959 * if the block has been added to the extent, false if the block couldn't be
1960 * added.
1961 */
1964 {
1967 /* Buffer that doesn't need mapping for writeback? */
1970 /* So far no extent to map => we write the buffer right away */
1974 }
1976 /* First block in the extent? */
1978 /* We cannot map unless handle is started... */
1985 }
1987 /* Don't go larger than mballoc is willing to allocate */
1991 /* Can we merge the block to our big extent? */
1996 }
1998 }
2000 /*
2001 * mpage_process_page_bufs - submit page buffers for IO or add them to extent
2002 *
2003 * @mpd - extent of blocks for mapping
2004 * @head - the first buffer in the page
2005 * @bh - buffer we should start processing from
2006 * @lblk - logical number of the block in the file corresponding to @bh
2007 *
2008 * Walk through page buffers from @bh upto @head (exclusive) and either submit
2009 * the page for IO if all buffers in this page were mapped and there's no
2010 * accumulated extent of buffers to map or add buffers in the page to the
2011 * extent of buffers to map. The function returns 1 if the caller can continue
2012 * by processing the next page, 0 if it should stop adding buffers to the
2013 * extent to map because we cannot extend it anymore. It can also return value
2014 * < 0 in case of error during IO submission.
2015 */
2019 ext4_lblk_t lblk)
2020 {
2033 /* Found extent to map? */
2036 /* Buffer needs mapping and handle is not started? */
2039 /* Everything mapped so far and we hit EOF */
2041 }
2043 /* So far everything mapped? Submit the page for IO. */
2049 }
2053 }
2055 }
2057 /*
2058 * mpage_process_folio - update folio buffers corresponding to changed extent
2059 * and may submit fully mapped page for IO
2060 * @mpd: description of extent to map, on return next extent to map
2061 * @folio: Contains these buffers.
2062 * @m_lblk: logical block mapping.
2063 * @m_pblk: corresponding physical mapping.
2064 * @map_bh: determines on return whether this page requires any further
2065 * mapping or not.
2066 *
2067 * Scan given folio buffers corresponding to changed extent and update buffer
2068 * state according to new extent state.
2069 * We map delalloc buffers to their physical location, clear unwritten bits.
2070 * If the given folio is not fully mapped, we update @mpd to the next extent in
2071 * the given folio that needs mapping & return @map_bh as true.
2072 */
2076 {
2091 /*
2092 * Buffer after end of mapped extent.
2093 * Find next buffer in the folio to map.
2094 */
2107 }
2109 }
2112 }
2116 }
2123 out:
2127 }
2129 /*
2130 * mpage_map_buffers - update buffers corresponding to changed extent and
2131 * submit fully mapped pages for IO
2132 *
2133 * @mpd - description of extent to map, on return next extent to map
2134 *
2135 * Scan buffers corresponding to changed extent (we expect corresponding pages
2136 * to be already locked) and update buffer state according to new extent state.
2137 * We map delalloc buffers to their physical location, clear unwritten bits,
2138 * and mark buffers as uninit when we perform writes to unwritten extents
2139 * and do extent conversion after IO is finished. If the last page is not fully
2140 * mapped, we update @map to the next extent in the last page that needs
2141 * mapping. Otherwise we submit the page for IO.
2142 */
2144 {
2150 ext4_lblk_t lblk;
2151 ext4_fsblk_t pblock;
2170 /*
2171 * If map_bh is true, means page may require further bh
2172 * mapping, or maybe the page was submitted for IO.
2173 * So we return to call further extent mapping.
2174 */
2177 /* Page fully mapped - let IO run! */
2182 }
2184 }
2185 /* Extent fully mapped and matches with page boundary. We are done. */
2189 out:
2192 }
2195 {
2202 /*
2203 * Call ext4_map_blocks() to allocate any delayed allocation blocks, or
2204 * to convert an unwritten extent to be initialized (in the case
2205 * where we have written into one or more preallocated blocks). It is
2206 * possible that we're going to need more metadata blocks than
2207 * previously reserved. However we must not fail because we're in
2208 * writeback and there is nothing we can do about it so it might result
2209 * in data loss. So use reserved blocks to allocate metadata if
2210 * possible.
2211 */
2213 EXT4_GET_BLOCKS_METADATA_NOFAIL |
2214 EXT4_GET_BLOCKS_IO_SUBMIT;
2227 }
2229 }
2233 }
2235 /*
2236 * mpage_map_and_submit_extent - map extent starting at mpd->lblk of length
2237 * mpd->len and submit pages underlying it for IO
2238 *
2239 * @handle - handle for journal operations
2240 * @mpd - extent to map
2241 * @give_up_on_write - we set this to true iff there is a fatal error and there
2242 * is no hope of writing the data. The caller should discard
2243 * dirty pages to avoid infinite loops.
2244 *
2245 * The function maps extent starting at mpd->lblk of length mpd->len. If it is
2246 * delayed, blocks are allocated, if it is unwritten, we may need to convert
2247 * them to initialized or split the described range from larger unwritten
2248 * extent. Note that we need not map all the described range since allocation
2249 * can return less blocks or the range is covered by more unwritten extents. We
2250 * cannot map more because we are limited by reserved transaction credits. On
2251 * the other hand we always make sure that the last touched page is fully
2252 * mapped so that it can be written out (and thus forward progress is
2253 * guaranteed). After mapping we submit all mapped pages for IO.
2254 */
2258 {
2262 loff_t disksize;
2278 /*
2279 * Let the uper layers retry transient errors.
2280 * In the case of ENOSPC, if ext4_count_free_blocks()
2281 * is non-zero, a commit should free up blocks.
2282 */
2288 }
2290 "Delayed block allocation failed for "
2291 "inode %lu at logical offset %llu with"
2297 "This should not happen!! Data will "
2301 invalidate_dirty_pages:
2304 }
2306 /*
2307 * Update buffer state, submit mapped pages, and get us new
2308 * extent to map
2309 */
2315 update_disksize:
2316 /*
2317 * Update on-disk size after IO is submitted. Races with
2318 * truncate are avoided by checking i_size under i_data_sem.
2319 */
2323 loff_t i_size;
2337 }
2340 }
2342 }
2344 /*
2345 * Calculate the total number of credits to reserve for one writepages
2346 * iteration. This is called from ext4_writepages(). We map an extent of
2347 * up to MAX_WRITEPAGES_EXTENT_LEN blocks and then we go on and finish mapping
2348 * the last partial page. So in total we can map MAX_WRITEPAGES_EXTENT_LEN +
2349 * bpp - 1 blocks in bpp different extents.
2350 */
2352 {
2357 }
2361 {
2378 }
2383 {
2396 }
2398 /*
2399 * mpage_prepare_extent_to_map - find & lock contiguous range of dirty pages
2400 * needing mapping, submit mapped pages
2401 *
2402 * @mpd - where to look for pages
2403 *
2404 * Walk dirty pages in the mapping. If they are fully mapped, submit them for
2405 * IO immediately. If we cannot map blocks, we submit just already mapped
2406 * buffers in the page for IO and keep page dirty. When we can map blocks and
2407 * we find a page which isn't mapped we start accumulating extent of buffers
2408 * underlying these pages that needs mapping (formed by either delayed or
2409 * unwritten buffers). We also lock the pages containing these buffers. The
2410 * extent found is returned in @mpd structure (starting at mpd->lblk with
2411 * length mpd->len blocks).
2412 *
2413 * Note that this function can attach bios to one io_end structure which are
2414 * neither logically nor physically contiguous. Although it may seem as an
2415 * unnecessary complication, it is actually inevitable in blocksize < pagesize
2416 * case as we need to track IO to all buffers underlying a page in one io_end.
2417 */
2419 {
2425 xa_mark_t tag;
2428 ext4_lblk_t lblk;
2435 else
2442 bpp);
2445 }
2456 /*
2457 * Accumulated enough dirty pages? This doesn't apply
2458 * to WB_SYNC_ALL mode. For integrity sync we have to
2459 * keep going because someone may be concurrently
2460 * dirtying pages, and we might have synced a lot of
2461 * newly appeared dirty pages, but have not synced all
2462 * of the old dirty pages.
2463 */
2469 /* If we can't merge this page, we are done. */
2478 }
2481 /*
2482 * If the page is no longer dirty, or its mapping no
2483 * longer corresponds to inode we are writing (which
2484 * means it has been truncated or invalidated), or the
2485 * page is already under writeback and we are not doing
2486 * a data integrity writeback, skip the page
2487 */
2494 }
2499 /*
2500 * Should never happen but for buggy code in
2501 * other subsystems that call
2502 * set_page_dirty() without properly warning
2503 * the file system first. See [1] for more
2504 * information.
2505 *
2506 * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz
2507 */
2513 }
2518 /*
2519 * Writeout when we cannot modify metadata is simple.
2520 * Just submit the page. For data=journal mode we
2521 * first handle writeout of the page for checkpoint and
2522 * only after that handle delayed page dirtying. This
2523 * makes sure current data is checkpointed to the final
2524 * location before possibly journalling it again which
2525 * is desirable when the page is frequently dirtied
2526 * through a pin.
2527 */
2532 /* Pending dirtying of journalled data? */
2539 }
2542 /* Add all dirty buffers to mpd */
2547 lblk);
2551 }
2552 }
2555 }
2560 out:
2565 }
2568 {
2584 /*
2585 * No pages to write? This is mainly a kludge to avoid starting
2586 * a transaction for special inodes like journal inode on last iput()
2587 * because that could violate lock ordering on umount
2588 */
2592 /*
2593 * If the filesystem has aborted, it is read-only, so return
2594 * right away instead of dumping stack traces later on that
2595 * will obscure the real source of the problem. We test
2596 * fs shutdown state instead of sb->s_flag's SB_RDONLY because
2597 * the latter could be true if the filesystem is mounted
2598 * read-only, and in that case, ext4_writepages should
2599 * *never* be called, so if that ever happens, we would want
2600 * the stack trace.
2601 */
2605 }
2607 /*
2608 * If we have inline data and arrive here, it means that
2609 * we will soon create the block for the 1st page, so
2610 * we'd better clear the inline data here.
2611 */
2613 /* Just inode will be modified... */
2618 }
2620 EXT4_STATE_MAY_INLINE_DATA));
2623 }
2625 /*
2626 * data=journal mode does not do delalloc so we just need to writeout /
2627 * journal already mapped buffers. On the other hand we need to commit
2628 * transaction to make data stable. We expect all the data to be
2629 * already in the journal (the only exception are DMA pinned pages
2630 * dirtied behind our back) so we commit transaction here and run the
2631 * writeback loop to checkpoint them. The checkpointing is not actually
2632 * necessary to make data persistent *but* quite a few places (extent
2633 * shifting operations, fsverity, ...) depend on being able to drop
2634 * pagecache pages after calling filemap_write_and_wait() and for that
2635 * checkpointing needs to happen.
2636 */
2642 }
2646 /*
2647 * We may need to convert up to one extent per block in
2648 * the page and we may dirty the inode.
2649 */
2652 }
2666 }
2669 retry:
2675 /*
2676 * First writeback pages that don't need mapping - we can avoid
2677 * starting a transaction unnecessarily and also avoid being blocked
2678 * in the block layer on device congestion while having transaction
2679 * started.
2680 */
2687 }
2689 /* Unlock pages we didn't use */
2691 /* Submit prepared bio */
2699 /* For each extent of pages we use new io_end */
2704 }
2707 /*
2708 * We have two constraints: We find one extent to map and we
2709 * must always write out whole page (makes a difference when
2710 * blocksize < pagesize) so that we don't block on IO when we
2711 * try to write out the rest of the page. Journalled mode is
2712 * not supported by delalloc.
2713 */
2717 /* start a new transaction */
2725 /* Release allocated io_end */
2729 }
2737 /*
2738 * Caution: If the handle is synchronous,
2739 * ext4_journal_stop() can wait for transaction commit
2740 * to finish which may depend on writeback of pages to
2741 * complete or on page lock to be released. In that
2742 * case, we have to wait until after we have
2743 * submitted all the IO, released page locks we hold,
2744 * and dropped io_end reference (for extent conversion
2745 * to be able to complete) before stopping the handle.
2746 */
2751 }
2752 /* Unlock pages we didn't use */
2754 /* Submit prepared bio */
2757 /*
2758 * Drop our io_end reference we got from init. We have
2759 * to be careful and use deferred io_end finishing if
2760 * we are still holding the transaction as we can
2761 * release the last reference to io_end which may end
2762 * up doing unwritten extent conversion.
2763 */
2772 /*
2773 * Commit the transaction which would
2774 * free blocks released in the transaction
2775 * and try again
2776 */
2780 }
2781 /* Fatal error - ENOMEM, EIO... */
2784 }
2785 unplug:
2792 }
2794 /* Update index */
2796 /*
2797 * Set the writeback_index so that range_cyclic
2798 * mode will write it back later
2799 */
2802 out_writepages:
2806 }
2810 {
2816 };
2825 /*
2826 * For data=journal writeback we could have come across pages marked
2827 * for delayed dirtying (PageChecked) which were just added to the
2828 * running transaction. Try once more to get them to stable storage.
2829 */
2835 }
2838 {
2844 };
2849 };
2851 }
2855 {
2873 }
2876 {
2880 /*
2881 * switch to non delalloc mode if we are running low
2882 * on free block. The free block accounting via percpu
2883 * counters can get slightly wrong with percpu_counter_batch getting
2884 * accumulated on each CPU without updating global counters
2885 * Delalloc need an accurate free block accounting. So switch
2886 * to non delalloc when we are near to error range.
2887 */
2888 free_clusters =
2890 dirty_clusters =
2892 /*
2893 * Start pushing delalloc when 1/2 of free blocks are dirty.
2894 */
2900 /*
2901 * free block count is less than 150% of dirty blocks
2902 * or free blocks is less than watermark
2903 */
2905 }
2907 }
2912 {
2915 pgoff_t index;
2927 }
2938 }
2940 retry:
2947 ext4_da_get_block_prep);
2951 /*
2952 * block_write_begin may have instantiated a few blocks
2953 * outside i_size. Trim these off again. Don't need
2954 * i_size_read because we hold inode lock.
2955 */
2963 }
2967 }
2969 /*
2970 * Check if we should update i_disksize
2971 * when write to the end of file but not require block allocation
2972 */
2975 {
2990 }
2995 {
3006 }
3007 /*
3008 * block_write_end() will mark the inode as dirty with I_DIRTY_PAGES
3009 * flag, which all that's needed to trigger page writeback.
3010 */
3015 /*
3016 * It's important to update i_size while still holding folio lock,
3017 * because folio writeout could otherwise come in and zero beyond
3018 * i_size.
3019 *
3020 * Since we are holding inode lock, we are sure i_disksize <=
3021 * i_size. We also know that if i_disksize < i_size, there are
3022 * delalloc writes pending in the range up to i_size. If the end of
3023 * the current write is <= i_size, there's no need to touch
3024 * i_disksize since writeback will push i_disksize up to i_size
3025 * eventually. If the end of the current write is > i_size and
3026 * inside an allocated block which ext4_da_should_update_i_disksize()
3027 * checked, we need to update i_disksize here as certain
3028 * ext4_writepages() paths not allocating blocks and update i_disksize.
3029 */
3038 }
3039 }
3047 }
3061 }
3067 {
3081 folio);
3087 }
3089 /*
3090 * Force all delayed allocation blocks to be allocated for a given inode.
3091 */
3093 {
3099 /*
3100 * We do something simple for now. The filemap_flush() will
3101 * also start triggering a write of the data blocks, which is
3102 * not strictly speaking necessary (and for users of
3103 * laptop_mode, not even desirable). However, to do otherwise
3104 * would require replicating code paths in:
3105 *
3106 * ext4_writepages() ->
3107 * write_cache_pages() ---> (via passed in callback function)
3108 * __mpage_da_writepage() -->
3109 * mpage_add_bh_to_extent()
3110 * mpage_da_map_blocks()
3111 *
3112 * The problem is that write_cache_pages(), located in
3113 * mm/page-writeback.c, marks pages clean in preparation for
3114 * doing I/O, which is not desirable if we're not planning on
3115 * doing I/O at all.
3116 *
3117 * We could call write_cache_pages(), and then redirty all of
3118 * the pages by calling redirty_page_for_writepage() but that
3119 * would be ugly in the extreme. So instead we would need to
3120 * replicate parts of the code in the above functions,
3121 * simplifying them because we wouldn't actually intend to
3122 * write out the pages, but rather only collect contiguous
3123 * logical block extents, call the multi-block allocator, and
3124 * then update the buffer heads with the block allocations.
3125 *
3126 * For now, though, we'll cheat by calling filemap_flush(),
3127 * which will map the blocks, and start the I/O, but not
3128 * actually wait for the I/O to complete.
3129 */
3131 }
3133 /*
3134 * bmap() is special. It gets used by applications such as lilo and by
3135 * the swapper to find the on-disk block of a specific piece of data.
3136 *
3137 * Naturally, this is dangerous if the block concerned is still in the
3138 * journal. If somebody makes a swapfile on an ext4 data-journaling
3139 * filesystem and enables swap, then they may get a nasty shock when the
3140 * data getting swapped to that swapfile suddenly gets overwritten by
3141 * the original zero's written out previously to the journal and
3142 * awaiting writeback in the kernel's buffer cache.
3143 *
3144 * So, if we see any bmap calls here on a modified, data-journaled file,
3145 * take extra steps to flush any blocks which might be in the cache.
3146 */
3148 {
3153 /*
3154 * We can get here for an inline file via the FIBMAP ioctl
3155 */
3162 /*
3163 * With delalloc or journalled data we want to sync the file so
3164 * that we can make sure we allocate blocks for file and data
3165 * is in place for the user to see it
3166 */
3168 }
3172 out:
3175 }
3178 {
3191 }
3194 {
3197 /* If the file has inline data, no need to do readahead. */
3202 }
3206 {
3209 /* No journalling happens on data buffers when this function is used */
3213 }
3217 {
3222 /*
3223 * If it's a full truncate we just forget about the pending dirtying
3224 */
3229 }
3231 /* Wrapper for aops... */
3235 {
3237 }
3240 {
3246 /* Page has dirty journalled data -> cannot release */
3251 else
3253 }
3256 {
3266 }
3268 /* Any metadata buffers to write? */
3272 }
3277 {
3280 /*
3281 * Writes that span EOF might trigger an I/O size update on completion,
3282 * so consider them to be dirty for the purpose of O_DSYNC, even if
3283 * there is no other metadata changes being made or are pending.
3284 */
3295 else
3304 /*
3305 * Flags passed to ext4_map_blocks() for direct I/O writes can result
3306 * in m_flags having both EXT4_MAP_MAPPED and EXT4_MAP_UNWRITTEN bits
3307 * set. In order for any allocated unwritten extents to be converted
3308 * into written extents correctly within the ->end_io() handler, we
3309 * need to ensure that the iomap->type is set appropriately. Hence, the
3310 * reason why we need to check whether the EXT4_MAP_UNWRITTEN bit has
3311 * been set first.
3312 */
3329 }
3330 }
3334 {
3339 /*
3340 * Trim the mapping request to the maximum value that we can map at
3341 * once for direct I/O.
3342 */
3347 retry:
3348 /*
3349 * Either we allocate blocks and then don't get an unwritten extent, so
3350 * in that case we have reserved enough credits. Or, the blocks are
3351 * already allocated and unwritten. In that case, the extent conversion
3352 * fits into the credits as well.
3353 */
3358 /*
3359 * DAX and direct I/O are the only two operations that are currently
3360 * supported with IOMAP_WRITE.
3361 */
3365 /*
3366 * We use i_size instead of i_disksize here because delalloc writeback
3367 * can complete at any point during the I/O and subsequently push the
3368 * i_disksize out to i_size. This could be beyond where direct I/O is
3369 * happening and thus expose allocated blocks to direct I/O reads.
3370 */
3378 /*
3379 * We cannot fill holes in indirect tree based inodes as that could
3380 * expose stale data in the case of a crash. Use the magic error code
3381 * to fallback to buffered I/O.
3382 */
3391 }
3396 {
3407 /*
3408 * Calculate the first and last logical blocks respectively.
3409 */
3415 /*
3416 * We check here if the blocks are already allocated, then we
3417 * don't need to start a journal txn and we can directly return
3418 * the mapping information. This could boost performance
3419 * especially in multi-threaded overwrite requests.
3420 */
3425 }
3429 }
3433 out:
3434 /*
3435 * When inline encryption is enabled, sometimes I/O to an encrypted file
3436 * has to be broken up to guarantee DUN contiguity. Handle this by
3437 * limiting the length of the mapping returned.
3438 */
3444 }
3449 {
3452 /*
3453 * Even for writes we don't need to allocate blocks, so just pretend
3454 * we are reading to save overhead of starting a transaction.
3455 */
3460 }
3463 {
3464 /* must be a directio to fall back to buffered */
3469 /* atomic writes are all-or-nothing */
3473 /* can only try again if we wrote nothing */
3475 }
3479 {
3480 /*
3481 * Check to see whether an error occurred while writing out the data to
3482 * the allocated blocks. If so, return the magic error code for
3483 * non-atomic write so that we fallback to buffered I/O and attempt to
3484 * complete the remainder of the I/O.
3485 * For non-atomic writes, any blocks that may have been
3486 * allocated in preparation for the direct I/O will be reused during
3487 * buffered I/O. For atomic write, we never fallback to buffered-io.
3488 */
3493 }
3498 };
3503 };
3508 {
3522 }
3523 }
3525 /*
3526 * Calculate the first and last logical block respectively.
3527 */
3532 /*
3533 * Fiemap callers may call for offset beyond s_bitmap_maxbytes.
3534 * So handle it here itself instead of querying ext4_map_blocks().
3535 * Since ext4_map_blocks() will warn about it and will return
3536 * -EIO error.
3537 */
3544 }
3545 }
3550 set_iomap:
3554 }
3558 };
3560 /*
3561 * For data=journal mode, folio should be marked dirty only when it was
3562 * writeably mapped. When that happens, it was already attached to the
3563 * transaction and marked as jbddirty (we take care of this in
3564 * ext4_page_mkwrite()). On transaction commit, we writeprotect page mappings
3565 * so we should have nothing to do here, except for the case when someone
3566 * had the page pinned and dirtied the page through this pin (e.g. by doing
3567 * direct IO to it). In that case we'd need to attach buffers here to the
3568 * transaction but we cannot due to lock ordering. We cannot just dirty the
3569 * folio and leave attached buffers clean, because the buffers' dirty state is
3570 * "definitive". We cannot just set the buffers dirty or jbddirty because all
3571 * the journalling code will explode. So what we do is to mark the folio
3572 * "pending dirty" and next time ext4_writepages() is called, attach buffers
3573 * to the transaction appropriately.
3574 */
3577 {
3582 }
3585 {
3589 }
3593 {
3596 }
3612 };
3628 };
3644 };
3651 };
3654 {
3664 }
3669 else
3671 }
3673 /*
3674 * Here we can't skip an unwritten buffer even though it usually reads zero
3675 * because it might have data in pagecache (eg, if called from ext4_zero_range,
3676 * ext4_punch_hole, etc) which needs to be properly zeroed out. Otherwise a
3677 * racing writeback can come later and flush the stale pagecache to disk.
3678 */
3681 {
3685 ext4_lblk_t iblock;
3705 /* Find the buffer that contains "offset" */
3709 iblock++;
3711 }
3715 }
3719 /* unmapped? It's a hole - nothing to do */
3723 }
3724 }
3726 /* Ok, it's mapped. Make sure it's up-to-date */
3735 /* We expect the key to be set. */
3738 blocksize,
3743 }
3744 }
3745 }
3749 EXT4_JTR_NONE);
3752 }
3763 length);
3764 }
3766 unlock:
3770 }
3772 /*
3773 * ext4_block_zero_page_range() zeros out a mapping of length 'length'
3774 * starting from file offset 'from'. The range to be zero'd must
3775 * be contained with in one block. If the specified range exceeds
3776 * the end of the block it will be shortened to end of the block
3777 * that corresponds to 'from'
3778 */
3781 {
3787 /*
3788 * correct length if it does not fall between
3789 * 'from' and the end of the block
3790 */
3797 }
3799 }
3801 /*
3802 * ext4_block_truncate_page() zeroes out a mapping from file offset `from'
3803 * up to the end of the block which corresponds to `from'.
3804 * This required during truncate. We need to physically zero the tail end
3805 * of that block so it doesn't yield old data if the file is later grown.
3806 */
3809 {
3815 /* If we are processing an encrypted inode during orphan list handling */
3823 }
3827 {
3841 /* Handle partial zero within the single block */
3847 }
3848 /* Handle partial zero out on the start of the range */
3854 }
3855 /* Handle partial zero out on the end of the range */
3861 }
3864 {
3872 }
3874 /*
3875 * We have to make sure i_disksize gets properly updated before we truncate
3876 * page cache due to hole punching or zero range. Otherwise i_disksize update
3877 * can get lost as it may have been postponed to submission of writeback but
3878 * that will never happen after we truncate page cache.
3879 */
3881 loff_t len)
3882 {
3903 }
3906 {
3910 }
3913 {
3932 }
3934 /*
3935 * ext4_punch_hole: punches a hole in a file by releasing the blocks
3936 * associated with the given offset and length
3937 *
3938 * @inode: File inode
3939 * @offset: The offset where the hole will begin
3940 * @len: The length of the hole
3941 *
3942 * Returns: 0 on success or negative on failure
3943 */
3946 {
3959 /*
3960 * Write out all dirty pages to avoid race conditions
3961 * Then release them.
3962 */
3968 }
3972 /* No need to punch hole beyond i_size */
3976 /*
3977 * If the hole extends beyond i_size, set the hole
3978 * to end after the page that contains i_size
3979 */
3983 offset;
3984 }
3986 /*
3987 * For punch hole the length + offset needs to be within one block
3988 * before last range. Adjust the length if it goes beyond that limit.
3989 */
3996 /*
3997 * Attach jinode to inode for jbd2 if we do any zeroing of
3998 * partial block
3999 */
4004 }
4006 /* Wait all existing dio workers, newcomers will block on i_rwsem */
4013 /*
4014 * Prevent page faults from reinstantiating pages we have released from
4015 * page cache.
4016 */
4026 /* Now release the pages and zero block aligned part of pages*/
4032 last_block_offset);
4033 }
4037 else
4044 }
4047 length);
4055 /* If there are blocks to remove, do it */
4067 else
4069 stop_block);
4074 }
4085 out_stop:
4087 out_dio:
4089 out_mutex:
4092 }
4095 {
4108 }
4112 }
4117 }
4119 /*
4120 * ext4_truncate()
4121 *
4122 * We block out ext4_get_block() block instantiations across the entire
4123 * transaction, and VFS/VM ensures that ext4_truncate() cannot run
4124 * simultaneously on behalf of the same inode.
4125 *
4126 * As we work through the truncate and commit bits of it to the journal there
4127 * is one core, guiding principle: the file's tree must always be consistent on
4128 * disk. We must be able to restart the truncate after a crash.
4129 *
4130 * The file's tree may be transiently inconsistent in memory (although it
4131 * probably isn't), but whenever we close off and commit a journal transaction,
4132 * the contents of (the filesystem + the journal) must be consistent and
4133 * restartable. It's pretty simple, really: bottom up, right to left (although
4134 * left-to-right works OK too).
4135 *
4136 * Note that at recovery time, journal replay occurs *before* the restart of
4137 * truncate against the orphan inode list.
4138 *
4139 * The committed inode has the new, desired i_size (which is the same as
4140 * i_disksize in this case). After a crash, ext4_orphan_cleanup() will see
4141 * that this inode's truncate did not complete and it will again call
4142 * ext4_truncate() to have another go. So there will be instantiated blocks
4143 * to the right of the truncation point in a crashed ext4 filesystem. But
4144 * that's fine - as long as they are linked from the inode, the post-crash
4145 * ext4_truncate() run will find them and release them.
4146 */
4148 {
4155 /*
4156 * There is a possibility that we're either freeing the inode
4157 * or it's a completely new inode. In those cases we might not
4158 * have i_rwsem locked because it's not necessary.
4159 */
4176 }
4178 /* If we zero-out tail of the page, we have to create jinode for jbd2 */
4183 }
4187 else
4194 }
4199 /*
4200 * We add the inode to the orphan list, so that if this
4201 * truncate spans multiple transactions, and we crash, we will
4202 * resume the truncate when the filesystem recovers. It also
4203 * marks the inode dirty, to catch the new size.
4204 *
4205 * Implication: the file must always be in a sane, consistent
4206 * truncatable state while each transaction commits.
4207 */
4218 else
4228 out_stop:
4229 /*
4230 * If this was a simple ftruncate() and the file will remain alive,
4231 * then we need to clear up the orphan record which we created above.
4232 * However, if this was a real unlink then we were called by
4233 * ext4_evict_inode(), and we allow that function to clean up the
4234 * orphan info for us.
4235 */
4245 out_trace:
4248 }
4251 {
4254 else
4256 }
4260 {
4266 /*
4267 * i_blocks can be represented in a 32 bit variable
4268 * as multiple of 512 bytes
4269 */
4274 }
4276 /*
4277 * This should never happen since sb->s_maxbytes should not have
4278 * allowed this, sb->s_maxbytes was set according to the huge_file
4279 * feature in ext4_fill_super().
4280 */
4285 /*
4286 * i_blocks can be represented in a 48 bit variable
4287 * as multiple of 512 bytes
4288 */
4294 /* i_block is stored in file system block size */
4298 }
4300 }
4303 {
4305 uid_t i_uid;
4306 gid_t i_gid;
4307 projid_t i_projid;
4320 /*
4321 * Fix up interoperability with old kernels. Otherwise,
4322 * old inodes get re-used with the upper 16 bits of the
4323 * uid/gid intact.
4324 */
4333 }
4339 }
4366 }
4370 }
4382 }
4383 }
4395 }
4397 /*
4398 * ext4_get_inode_loc returns with an extra refcount against the inode's
4399 * underlying buffer_head on success. If we pass 'inode' and it does not
4400 * have in-inode xattr, we have all inode data in memory that is needed
4401 * to recreate the on-disk version of this inode.
4402 */
4406 {
4409 ext4_fsblk_t block;
4423 /*
4424 * Figure out the offset within the block group inode table
4425 */
4437 }
4448 /* Someone brought it uptodate while we waited */
4451 }
4453 /*
4454 * If we have all information of the inode in memory and this
4455 * is the only valid inode in the block, we need not read the
4456 * block.
4457 */
4464 /* Is the inode bitmap in cache? */
4469 /*
4470 * If the inode bitmap isn't in cache then the
4471 * optimisation may end up performing two reads instead
4472 * of one, so skip it.
4473 */
4477 }
4483 }
4489 /* all other inodes are free, so skip I/O */
4496 }
4497 }
4499 make_io:
4500 /*
4501 * If we need to do any I/O, try to pre-readahead extra
4502 * blocks from the inode table.
4503 */
4511 /* s_inode_readahead_blks is always a power of 2 */
4524 }
4526 /*
4527 * There are other valid inodes in the buffer, this inode
4528 * has in-inode xattrs, or we don't have this inode in memory.
4529 * Read the block from disk.
4530 */
4541 }
4542 has_buffer:
4545 }
4549 {
4561 }
4564 {
4576 }
4581 {
4583 }
4586 {
4607 }
4610 {
4627 /* Because of the way inode_set_flags() works we must preserve S_DAX
4628 * here if already set. */
4642 }
4646 {
4647 blkcnt_t i_blocks ;
4652 /* we are using combined 48 bit field */
4656 /* i_blocks represent file system block size */
4660 }
4663 }
4664 }
4669 {
4685 }
4688 {
4693 }
4695 /*
4696 * ext4 has self-managed i_version for ea inodes, it stores the lower 32bit of
4697 * refcount in i_version, so use raw values if inode has EXT4_EA_INODE_FL flag
4698 * set.
4699 */
4701 {
4704 else
4706 }
4710 {
4720 }
4724 }
4729 {
4738 loff_t size;
4740 uid_t i_uid;
4741 gid_t i_gid;
4742 projid_t i_projid;
4758 }
4768 }
4770 }
4784 }
4792 "iget: bad extra_isize %u "
4798 }
4802 /* Precompute checksum seed for inode metadata */
4805 __u32 csum;
4812 }
4821 }
4830 else
4836 }
4846 /* We now have enough fields to check if the inode was active or not.
4847 * This is needed because nfsd might try to access dead inodes
4848 * the test is that same one that e2fsck uses
4849 * NeilBrown 1999oct15
4850 */
4855 /* this inode is deleted or unallocated */
4863 }
4864 /* The only unlinked inodes we let through here have
4865 * valid i_mode and are being read by the orphan
4866 * recovery code: that's fine, we're about to complete
4867 * the process of deleting those.
4868 * OR it is the EXT4_BOOT_LOADER_INO which is
4869 * not initialized on a new filesystem. */
4870 }
4884 }
4885 /*
4886 * If dir_index is not enabled but there's dir with INDEX flag set,
4887 * we'd normally treat htree data as empty space. But with metadata
4888 * checksumming that corrupts checksums so forbid that.
4889 */
4896 }
4898 #ifdef CONFIG_QUOTA
4900 #endif
4904 /*
4905 * NOTE! The in-memory inode i_data array is in little-endian order
4906 * even on big-endian machines: we do NOT byteswap the block numbers!
4907 */
4913 /*
4914 * Set transaction id's of transactions that have to be committed
4915 * to finish f[data]sync. We set them to currently running transaction
4916 * as we cannot be sure that the inode or some of its metadata isn't
4917 * part of the transaction - the inode could have been reclaimed and
4918 * now it is reread from disk.
4919 */
4922 tid_t tid;
4927 else
4931 else
4936 }
4940 /* The extra space is currently unused. Use it. */
4943 EXT4_GOOD_OLD_INODE_SIZE;
4948 }
4949 }
4961 ivers |=
4963 }
4965 }
4976 /* validate the block references in the inode */
4983 else
4985 }
4986 }
4998 /* VFS does not allow setting these so must be corruption */
5001 "iget: immutable or append flags "
5005 }
5015 }
5022 else
5032 }
5038 }
5043 }
5049 bad_inode:
5053 }
5059 {
5084 }
5086 }
5088 /*
5089 * Opportunistically update the other time fields for other inodes in
5090 * the same inode table block.
5091 */
5094 {
5099 /*
5100 * Calculate the first inode in the inode table block. Inode
5101 * numbers are one-based. That is, the first inode in a block
5102 * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1).
5103 */
5111 }
5113 }
5115 /*
5116 * Post the struct inode info into an on-disk inode location in the
5117 * buffer-cache. This gobbles the caller's reference to the
5118 * buffer_head in the inode location struct.
5119 *
5120 * The caller must have write access to iloc->bh.
5121 */
5125 {
5135 /*
5136 * For fields not tracked in the in-memory inode, initialise them
5137 * to zero for new inodes.
5138 */
5148 }
5155 }
5170 EXT4_JTR_NONE);
5180 }
5182 out_error:
5184 out_brelse:
5187 }
5189 /*
5190 * ext4_write_inode()
5191 *
5192 * We are called from a few places:
5193 *
5194 * - Within generic_file_aio_write() -> generic_write_sync() for O_SYNC files.
5195 * Here, there will be no transaction running. We wait for any running
5196 * transaction to commit.
5197 *
5198 * - Within flush work (sys_sync(), kupdate and such).
5199 * We wait on commit, if told to.
5200 *
5201 * - Within iput_final() -> write_inode_now()
5202 * We wait on commit, if told to.
5203 *
5204 * In all cases it is actually safe for us to return without doing anything,
5205 * because the inode has been copied into a raw inode buffer in
5206 * ext4_mark_inode_dirty(). This is a correctness thing for WB_SYNC_ALL
5207 * writeback.
5208 *
5209 * Note that we are absolutely dependent upon all inode dirtiers doing the
5210 * right thing: they *must* call mark_inode_dirty() after dirtying info in
5211 * which we are interested.
5212 *
5213 * It would be a bug for them to not do this. The code:
5214 *
5215 * mark_inode_dirty(inode)
5216 * stuff();
5217 * inode->i_size = expr;
5218 *
5219 * is in error because write_inode() could occur while `stuff()' is running,
5220 * and the new i_size will be lost. Plus the inode will no longer be on the
5221 * superblock's dirty inode list.
5222 */
5224 {
5238 }
5240 /*
5241 * No need to force transaction in WB_SYNC_NONE mode. Also
5242 * ext4_sync_fs() will force the commit after everything is
5243 * written.
5244 */
5256 /*
5257 * sync(2) will flush the whole buffer cache. No need to do
5258 * it here separately for each inode.
5259 */
5266 }
5268 }
5270 }
5272 /*
5273 * In data=journal mode ext4_journalled_invalidate_folio() may fail to invalidate
5274 * buffers that are attached to a folio straddling i_size and are undergoing
5275 * commit. In that case we have to wait for commit to finish and try again.
5276 */
5278 {
5281 tid_t commit_tid;
5286 /*
5287 * If the folio is fully truncated, we don't need to wait for any commit
5288 * (and we even should not as __ext4_journalled_invalidate_folio() may
5289 * strip all buffers from the folio but keep the folio dirty which can then
5290 * confuse e.g. concurrent ext4_writepages() seeing dirty folio without
5291 * buffers). Also we don't need to wait for any commit if all buffers in
5292 * the folio remain valid. This is most beneficial for the common case of
5293 * blocksize == PAGESIZE.
5294 */
5313 }
5317 }
5318 }
5320 /*
5321 * ext4_setattr()
5322 *
5323 * Called from notify_change.
5324 *
5325 * We want to trap VFS attempts to truncate the file as soon as
5326 * possible. In particular, we want to make sure that when the VFS
5327 * shrinks i_size, we put the inode on the orphan list and modify
5328 * i_disksize immediately, so that during the subsequent flushing of
5329 * dirty pages and freeing of disk blocks, we can guarantee that any
5330 * commit will leave the blocks being flushed in an unused state on
5331 * disk. (On recovery, the inode will get truncated and the blocks will
5332 * be freed, so we have a strong guarantee that no future commit will
5333 * leave these blocks visible to the user.)
5334 *
5335 * Another thing we have to assure is that if we are in ordered mode
5336 * and inode is still attached to the committing transaction, we must
5337 * we start writeout of all the dirty pages which are being truncated.
5338 * This way we are sure that all the data written in the previous
5339 * transaction are already on disk (truncate waits for pages under
5340 * writeback).
5341 *
5342 * Called with inode->i_rwsem down.
5343 */
5346 {
5380 }
5386 /* (user+group)*(old+new) structure, inode write (sb,
5387 * inode block, ? - but truncate inode update has it) */
5394 }
5396 /* dquot_transfer() calls back ext4_get_inode_usage() which
5397 * counts xattr inode references.
5398 */
5406 }
5407 /* Update corresponding info in inode so that everything is in
5408 * one transaction */
5415 }
5416 }
5421 loff_t old_disksize;
5429 }
5430 }
5433 }
5444 }
5445 /*
5446 * Blocks are going to be removed from the inode. Wait
5447 * for dio in flight.
5448 */
5450 }
5458 }
5461 /* attach jbd2 jinode for EOF folio tail zeroing */
5467 }
5473 }
5477 }
5478 /*
5479 * Update c/mtime and tail zero the EOF folio on
5480 * truncate up. ext4_truncate() handles the shrink case
5481 * below.
5482 */
5489 }
5496 else
5510 /*
5511 * We have to update i_size under i_data_sem together
5512 * with i_disksize to avoid races with writeback code
5513 * running ext4_wb_update_i_disksize().
5514 */
5517 else
5528 }
5529 }
5531 /*
5532 * Truncate pagecache after we've waited for commit
5533 * in data=journal mode to make pages freeable.
5534 */
5536 /*
5537 * Call ext4_truncate() even if i_size didn't change to
5538 * truncate possible preallocated blocks.
5539 */
5544 }
5545 out_mmap_sem:
5547 }
5554 }
5556 /*
5557 * If the call to ext4_truncate failed to get a transaction handle at
5558 * all, we need to clean up the in-core orphan list manually.
5559 */
5566 err_out:
5572 }
5575 {
5586 }
5588 }
5592 {
5603 }
5605 /*
5606 * Return the DIO alignment restrictions if requested. We only return
5607 * this information when requested, since on encrypted files it might
5608 * take a fair bit of work to get if the file wasn't opened recently.
5609 */
5617 /* iomap defaults */
5623 }
5624 }
5633 }
5636 }
5653 STATX_ATTR_COMPRESSED |
5654 STATX_ATTR_ENCRYPTED |
5655 STATX_ATTR_IMMUTABLE |
5656 STATX_ATTR_NODUMP |
5657 STATX_ATTR_VERITY);
5661 }
5666 {
5668 u64 delalloc_blocks;
5672 /*
5673 * If there is inline data in the inode, the inode will normally not
5674 * have data blocks allocated (it may have an external xattr block).
5675 * Report at least one sector for such files, so tools like tar, rsync,
5676 * others don't incorrectly think the file is completely sparse.
5677 */
5681 /*
5682 * We can't update i_blocks if the block allocation is delayed
5683 * otherwise in the case of system crash before the real block
5684 * allocation is done, we will have i_blocks inconsistent with
5685 * on-disk file blocks.
5686 * We always keep i_blocks updated together with real
5687 * allocation. But to not confuse with user, stat
5688 * will return the blocks that include the delayed allocation
5689 * blocks for this file.
5690 */
5695 }
5699 {
5703 }
5705 /*
5706 * Account for index blocks, block groups bitmaps and block group
5707 * descriptor blocks if modify datablocks and index blocks
5708 * worse case, the indexs blocks spread over different block groups
5709 *
5710 * If datablocks are discontiguous, they are possible to spread over
5711 * different block groups too. If they are contiguous, with flexbg,
5712 * they could still across block group boundary.
5713 *
5714 * Also account for superblock, inode, quota and xattr blocks
5715 */
5718 {
5724 /*
5725 * How many index blocks need to touch to map @lblocks logical blocks
5726 * to @pextents physical extents?
5727 */
5732 /*
5733 * Now let's see how many group bitmaps and group descriptors need
5734 * to account
5735 */
5743 /* bitmaps and block group descriptor blocks */
5746 /* Blocks for super block, inode, quota and xattr blocks */
5750 }
5752 /*
5753 * Calculate the total number of credits to reserve to fit
5754 * the modification of a single pages into a single transaction,
5755 * which may include multiple chunks of block allocations.
5756 *
5757 * This could be called via ext4_write_begin()
5758 *
5759 * We need to consider the worse case, when
5760 * one new block per extent.
5761 */
5763 {
5769 /* Account for data blocks for journalled mode */
5773 }
5775 /*
5776 * Calculate the journal credits for a chunk of data modification.
5777 *
5778 * This is called from DIO, fallocate or whoever calling
5779 * ext4_map_blocks() to map/allocate a chunk of contiguous disk blocks.
5780 *
5781 * journal buffers for data blocks are not included here, as DIO
5782 * and fallocate do no need to journal data buffers.
5783 */
5785 {
5787 }
5789 /*
5790 * The caller must have previously called ext4_reserve_inode_write().
5791 * Give this, we know that the caller already has write access to iloc->bh.
5792 */
5795 {
5801 }
5804 /* the do_update_inode consumes one bh->b_count */
5807 /* ext4_do_update_inode() does jbd2_journal_dirty_metadata */
5811 }
5813 /*
5814 * On success, We end up with an outstanding reference count against
5815 * iloc->bh. This _must_ be cleaned up later.
5816 */
5818 int
5821 {
5835 }
5836 }
5839 }
5845 {
5852 /* this was checked at iget time, but double check for good measure */
5859 }
5869 /* No extended attributes present */
5877 }
5879 /*
5880 * We may need to allocate external xattr block so we need quotas
5881 * initialized. Here we can be called with various locks held so we
5882 * cannot affort to initialize quotas ourselves. So just bail.
5883 */
5887 /* try to expand with EAs present */
5891 /*
5892 * Inode size expansion failed; don't try again
5893 */
5895 }
5898 }
5900 /*
5901 * Expand an inode by new_extra_isize bytes.
5902 * Returns 0 on success or negative error number on failure.
5903 */
5908 {
5915 /*
5916 * In nojournal mode, we can immediately attempt to expand
5917 * the inode. When journaled, we first need to obtain extra
5918 * buffer credits since we may write into the EA block
5919 * with this same handle. If journal_extend fails, then it will
5920 * only result in a minor loss of functionality for that inode.
5921 * If this is felt to be critical, then e2fsck should be run to
5922 * force a large enough s_min_extra_isize.
5923 */
5936 }
5941 {
5949 }
5957 }
5963 EXT4_JTR_NONE);
5967 }
5976 out_unlock:
5980 }
5982 /*
5983 * What we do here is to mark the in-core inode as clean with respect to inode
5984 * dirtiness (it may still be data-dirty).
5985 * This means that the in-core inode may be reaped by prune_icache
5986 * without having to perform any I/O. This is a very good thing,
5987 * because *any* task may call prune_icache - even ones which
5988 * have a transaction open against a different journal.
5989 *
5990 * Is this cheating? Not really. Sure, we haven't written the
5991 * inode out, but prune_icache isn't a user-visible syncing function.
5992 * Whenever the user wants stuff synced (sys_sync, sys_msync, sys_fsync)
5993 * we start and wait on commits.
5994 */
5997 {
6013 out:
6018 }
6020 /*
6021 * ext4_dirty_inode() is called from __mark_inode_dirty()
6022 *
6023 * We're really interested in the case where a file is being extended.
6024 * i_size has been changed by generic_commit_write() and we thus need
6025 * to include the updated inode in the current transaction.
6026 *
6027 * Also, dquot_alloc_block() will always dirty the inode when blocks
6028 * are allocated to the file.
6029 *
6030 * If the inode is marked synchronous, we don't honour that here - doing
6031 * so would cause a commit on atime updates, which we don't bother doing.
6032 * We handle synchronous inodes at the highest possible level.
6033 */
6035 {
6043 }
6046 {
6052 /*
6053 * We have to be very careful here: changing a data block's
6054 * journaling status dynamically is dangerous. If we write a
6055 * data block to the journal, change the status and then delete
6056 * that block, we risk forgetting to revoke the old log record
6057 * from the journal and so a subsequent replay can corrupt data.
6058 * So, first we make sure that the journal is empty and that
6059 * nobody is changing anything.
6060 */
6068 /* Wait for all existing dio workers */
6071 /*
6072 * Before flushing the journal and switching inode's aops, we have
6073 * to flush all dirty data the inode has. There can be outstanding
6074 * delayed allocations, there can be unwritten extents created by
6075 * fallocate or buffered writes in dioread_nolock mode covered by
6076 * dirty data which can be converted only after flushing the dirty
6077 * data (and journalled aops don't know how to handle these cases).
6078 */
6085 }
6086 }
6091 /*
6092 * OK, there are no updates running now, and all cached data is
6093 * synced to disk. We are now in a completely consistent state
6094 * which doesn't have anything in the journal, and we know that
6095 * no filesystem updates are running, so it is safe to modify
6096 * the inode's in-core data-journaling state flag now.
6097 */
6107 }
6109 }
6118 /* Finally we can mark the inode as dirty. */
6132 }
6136 {
6138 }
6141 {
6144 loff_t size;
6147 vm_fault_t ret;
6167 /*
6168 * On data journalling we skip straight to the transaction handle:
6169 * there's no delalloc; page truncated will be checked later; the
6170 * early return w/ all buffers mapped (calculates size/len) can't
6171 * be used; and there's no dioread_nolock, so only ext4_get_block.
6172 */
6176 /* Delalloc case is easy... */
6181 ext4_da_get_block_prep);
6185 }
6189 /* Page got truncated from under us? */
6194 }
6199 /*
6200 * Return if we have all the buffers mapped. This avoids the need to do
6201 * journal_start/journal_stop which can block and take a long time
6202 *
6203 * This cannot be done for data journalling, as we have to add the
6204 * inode to the transaction's list to writeprotect pages on commit.
6205 */
6209 ext4_bh_unmapped)) {
6210 /* Wait so that we don't change page under IO */
6214 }
6215 }
6217 /* OK, we need to fill the hole... */
6220 else
6222 retry_alloc:
6228 }
6229 /*
6230 * Data journalling can't use block_page_mkwrite() because it
6231 * will set_buffer_dirty() before do_journal_get_write_access()
6232 * thus might hit warning messages for dirty metadata buffers.
6233 */
6239 /* Page got truncated from under us? */
6243 }
6250 ext4_get_block);
6257 }
6258 }
6262 out_ret:
6264 out:
6268 out_error:
6272 }