bdi: Fix use after free bug in debugfs_remove()
[sfrench/cifs-2.6.git] / mm / backing-dev.c
1
2 #include <linux/wait.h>
3 #include <linux/backing-dev.h>
4 #include <linux/kthread.h>
5 #include <linux/freezer.h>
6 #include <linux/fs.h>
7 #include <linux/pagemap.h>
8 #include <linux/mm.h>
9 #include <linux/sched.h>
10 #include <linux/module.h>
11 #include <linux/writeback.h>
12 #include <linux/device.h>
13 #include <trace/events/writeback.h>
14
15 struct backing_dev_info noop_backing_dev_info = {
16         .name           = "noop",
17         .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
18 };
19 EXPORT_SYMBOL_GPL(noop_backing_dev_info);
20
21 static struct class *bdi_class;
22
23 /*
24  * bdi_lock protects updates to bdi_list. bdi_list has RCU reader side
25  * locking.
26  */
27 DEFINE_SPINLOCK(bdi_lock);
28 LIST_HEAD(bdi_list);
29
30 /* bdi_wq serves all asynchronous writeback tasks */
31 struct workqueue_struct *bdi_wq;
32
33 #ifdef CONFIG_DEBUG_FS
34 #include <linux/debugfs.h>
35 #include <linux/seq_file.h>
36
37 static struct dentry *bdi_debug_root;
38
39 static void bdi_debug_init(void)
40 {
41         bdi_debug_root = debugfs_create_dir("bdi", NULL);
42 }
43
44 static int bdi_debug_stats_show(struct seq_file *m, void *v)
45 {
46         struct backing_dev_info *bdi = m->private;
47         struct bdi_writeback *wb = &bdi->wb;
48         unsigned long background_thresh;
49         unsigned long dirty_thresh;
50         unsigned long wb_thresh;
51         unsigned long nr_dirty, nr_io, nr_more_io, nr_dirty_time;
52         struct inode *inode;
53
54         nr_dirty = nr_io = nr_more_io = nr_dirty_time = 0;
55         spin_lock(&wb->list_lock);
56         list_for_each_entry(inode, &wb->b_dirty, i_io_list)
57                 nr_dirty++;
58         list_for_each_entry(inode, &wb->b_io, i_io_list)
59                 nr_io++;
60         list_for_each_entry(inode, &wb->b_more_io, i_io_list)
61                 nr_more_io++;
62         list_for_each_entry(inode, &wb->b_dirty_time, i_io_list)
63                 if (inode->i_state & I_DIRTY_TIME)
64                         nr_dirty_time++;
65         spin_unlock(&wb->list_lock);
66
67         global_dirty_limits(&background_thresh, &dirty_thresh);
68         wb_thresh = wb_calc_thresh(wb, dirty_thresh);
69
70 #define K(x) ((x) << (PAGE_SHIFT - 10))
71         seq_printf(m,
72                    "BdiWriteback:       %10lu kB\n"
73                    "BdiReclaimable:     %10lu kB\n"
74                    "BdiDirtyThresh:     %10lu kB\n"
75                    "DirtyThresh:        %10lu kB\n"
76                    "BackgroundThresh:   %10lu kB\n"
77                    "BdiDirtied:         %10lu kB\n"
78                    "BdiWritten:         %10lu kB\n"
79                    "BdiWriteBandwidth:  %10lu kBps\n"
80                    "b_dirty:            %10lu\n"
81                    "b_io:               %10lu\n"
82                    "b_more_io:          %10lu\n"
83                    "b_dirty_time:       %10lu\n"
84                    "bdi_list:           %10u\n"
85                    "state:              %10lx\n",
86                    (unsigned long) K(wb_stat(wb, WB_WRITEBACK)),
87                    (unsigned long) K(wb_stat(wb, WB_RECLAIMABLE)),
88                    K(wb_thresh),
89                    K(dirty_thresh),
90                    K(background_thresh),
91                    (unsigned long) K(wb_stat(wb, WB_DIRTIED)),
92                    (unsigned long) K(wb_stat(wb, WB_WRITTEN)),
93                    (unsigned long) K(wb->write_bandwidth),
94                    nr_dirty,
95                    nr_io,
96                    nr_more_io,
97                    nr_dirty_time,
98                    !list_empty(&bdi->bdi_list), bdi->wb.state);
99 #undef K
100
101         return 0;
102 }
103 DEFINE_SHOW_ATTRIBUTE(bdi_debug_stats);
104
105 static int bdi_debug_register(struct backing_dev_info *bdi, const char *name)
106 {
107         if (!bdi_debug_root)
108                 return -ENOMEM;
109
110         bdi->debug_dir = debugfs_create_dir(name, bdi_debug_root);
111         if (!bdi->debug_dir)
112                 return -ENOMEM;
113
114         bdi->debug_stats = debugfs_create_file("stats", 0444, bdi->debug_dir,
115                                                bdi, &bdi_debug_stats_fops);
116         if (!bdi->debug_stats) {
117                 debugfs_remove(bdi->debug_dir);
118                 bdi->debug_dir = NULL;
119                 return -ENOMEM;
120         }
121
122         return 0;
123 }
124
125 static void bdi_debug_unregister(struct backing_dev_info *bdi)
126 {
127         debugfs_remove(bdi->debug_stats);
128         debugfs_remove(bdi->debug_dir);
129 }
130 #else
131 static inline void bdi_debug_init(void)
132 {
133 }
134 static inline int bdi_debug_register(struct backing_dev_info *bdi,
135                                       const char *name)
136 {
137         return 0;
138 }
139 static inline void bdi_debug_unregister(struct backing_dev_info *bdi)
140 {
141 }
142 #endif
143
144 static ssize_t read_ahead_kb_store(struct device *dev,
145                                   struct device_attribute *attr,
146                                   const char *buf, size_t count)
147 {
148         struct backing_dev_info *bdi = dev_get_drvdata(dev);
149         unsigned long read_ahead_kb;
150         ssize_t ret;
151
152         ret = kstrtoul(buf, 10, &read_ahead_kb);
153         if (ret < 0)
154                 return ret;
155
156         bdi->ra_pages = read_ahead_kb >> (PAGE_SHIFT - 10);
157
158         return count;
159 }
160
161 #define K(pages) ((pages) << (PAGE_SHIFT - 10))
162
163 #define BDI_SHOW(name, expr)                                            \
164 static ssize_t name##_show(struct device *dev,                          \
165                            struct device_attribute *attr, char *page)   \
166 {                                                                       \
167         struct backing_dev_info *bdi = dev_get_drvdata(dev);            \
168                                                                         \
169         return snprintf(page, PAGE_SIZE-1, "%lld\n", (long long)expr);  \
170 }                                                                       \
171 static DEVICE_ATTR_RW(name);
172
173 BDI_SHOW(read_ahead_kb, K(bdi->ra_pages))
174
175 static ssize_t min_ratio_store(struct device *dev,
176                 struct device_attribute *attr, const char *buf, size_t count)
177 {
178         struct backing_dev_info *bdi = dev_get_drvdata(dev);
179         unsigned int ratio;
180         ssize_t ret;
181
182         ret = kstrtouint(buf, 10, &ratio);
183         if (ret < 0)
184                 return ret;
185
186         ret = bdi_set_min_ratio(bdi, ratio);
187         if (!ret)
188                 ret = count;
189
190         return ret;
191 }
192 BDI_SHOW(min_ratio, bdi->min_ratio)
193
194 static ssize_t max_ratio_store(struct device *dev,
195                 struct device_attribute *attr, const char *buf, size_t count)
196 {
197         struct backing_dev_info *bdi = dev_get_drvdata(dev);
198         unsigned int ratio;
199         ssize_t ret;
200
201         ret = kstrtouint(buf, 10, &ratio);
202         if (ret < 0)
203                 return ret;
204
205         ret = bdi_set_max_ratio(bdi, ratio);
206         if (!ret)
207                 ret = count;
208
209         return ret;
210 }
211 BDI_SHOW(max_ratio, bdi->max_ratio)
212
213 static ssize_t stable_pages_required_show(struct device *dev,
214                                           struct device_attribute *attr,
215                                           char *page)
216 {
217         struct backing_dev_info *bdi = dev_get_drvdata(dev);
218
219         return snprintf(page, PAGE_SIZE-1, "%d\n",
220                         bdi_cap_stable_pages_required(bdi) ? 1 : 0);
221 }
222 static DEVICE_ATTR_RO(stable_pages_required);
223
224 static struct attribute *bdi_dev_attrs[] = {
225         &dev_attr_read_ahead_kb.attr,
226         &dev_attr_min_ratio.attr,
227         &dev_attr_max_ratio.attr,
228         &dev_attr_stable_pages_required.attr,
229         NULL,
230 };
231 ATTRIBUTE_GROUPS(bdi_dev);
232
233 static __init int bdi_class_init(void)
234 {
235         bdi_class = class_create(THIS_MODULE, "bdi");
236         if (IS_ERR(bdi_class))
237                 return PTR_ERR(bdi_class);
238
239         bdi_class->dev_groups = bdi_dev_groups;
240         bdi_debug_init();
241
242         return 0;
243 }
244 postcore_initcall(bdi_class_init);
245
246 static int bdi_init(struct backing_dev_info *bdi);
247
248 static int __init default_bdi_init(void)
249 {
250         int err;
251
252         bdi_wq = alloc_workqueue("writeback", WQ_MEM_RECLAIM | WQ_FREEZABLE |
253                                               WQ_UNBOUND | WQ_SYSFS, 0);
254         if (!bdi_wq)
255                 return -ENOMEM;
256
257         err = bdi_init(&noop_backing_dev_info);
258
259         return err;
260 }
261 subsys_initcall(default_bdi_init);
262
263 /*
264  * This function is used when the first inode for this wb is marked dirty. It
265  * wakes-up the corresponding bdi thread which should then take care of the
266  * periodic background write-out of dirty inodes. Since the write-out would
267  * starts only 'dirty_writeback_interval' centisecs from now anyway, we just
268  * set up a timer which wakes the bdi thread up later.
269  *
270  * Note, we wouldn't bother setting up the timer, but this function is on the
271  * fast-path (used by '__mark_inode_dirty()'), so we save few context switches
272  * by delaying the wake-up.
273  *
274  * We have to be careful not to postpone flush work if it is scheduled for
275  * earlier. Thus we use queue_delayed_work().
276  */
277 void wb_wakeup_delayed(struct bdi_writeback *wb)
278 {
279         unsigned long timeout;
280
281         timeout = msecs_to_jiffies(dirty_writeback_interval * 10);
282         spin_lock_bh(&wb->work_lock);
283         if (test_bit(WB_registered, &wb->state))
284                 queue_delayed_work(bdi_wq, &wb->dwork, timeout);
285         spin_unlock_bh(&wb->work_lock);
286 }
287
288 /*
289  * Initial write bandwidth: 100 MB/s
290  */
291 #define INIT_BW         (100 << (20 - PAGE_SHIFT))
292
293 static int wb_init(struct bdi_writeback *wb, struct backing_dev_info *bdi,
294                    int blkcg_id, gfp_t gfp)
295 {
296         int i, err;
297
298         memset(wb, 0, sizeof(*wb));
299
300         if (wb != &bdi->wb)
301                 bdi_get(bdi);
302         wb->bdi = bdi;
303         wb->last_old_flush = jiffies;
304         INIT_LIST_HEAD(&wb->b_dirty);
305         INIT_LIST_HEAD(&wb->b_io);
306         INIT_LIST_HEAD(&wb->b_more_io);
307         INIT_LIST_HEAD(&wb->b_dirty_time);
308         spin_lock_init(&wb->list_lock);
309
310         wb->bw_time_stamp = jiffies;
311         wb->balanced_dirty_ratelimit = INIT_BW;
312         wb->dirty_ratelimit = INIT_BW;
313         wb->write_bandwidth = INIT_BW;
314         wb->avg_write_bandwidth = INIT_BW;
315
316         spin_lock_init(&wb->work_lock);
317         INIT_LIST_HEAD(&wb->work_list);
318         INIT_DELAYED_WORK(&wb->dwork, wb_workfn);
319         wb->dirty_sleep = jiffies;
320
321         wb->congested = wb_congested_get_create(bdi, blkcg_id, gfp);
322         if (!wb->congested) {
323                 err = -ENOMEM;
324                 goto out_put_bdi;
325         }
326
327         err = fprop_local_init_percpu(&wb->completions, gfp);
328         if (err)
329                 goto out_put_cong;
330
331         for (i = 0; i < NR_WB_STAT_ITEMS; i++) {
332                 err = percpu_counter_init(&wb->stat[i], 0, gfp);
333                 if (err)
334                         goto out_destroy_stat;
335         }
336
337         return 0;
338
339 out_destroy_stat:
340         while (i--)
341                 percpu_counter_destroy(&wb->stat[i]);
342         fprop_local_destroy_percpu(&wb->completions);
343 out_put_cong:
344         wb_congested_put(wb->congested);
345 out_put_bdi:
346         if (wb != &bdi->wb)
347                 bdi_put(bdi);
348         return err;
349 }
350
351 static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb);
352
353 /*
354  * Remove bdi from the global list and shutdown any threads we have running
355  */
356 static void wb_shutdown(struct bdi_writeback *wb)
357 {
358         /* Make sure nobody queues further work */
359         spin_lock_bh(&wb->work_lock);
360         if (!test_and_clear_bit(WB_registered, &wb->state)) {
361                 spin_unlock_bh(&wb->work_lock);
362                 /*
363                  * Wait for wb shutdown to finish if someone else is just
364                  * running wb_shutdown(). Otherwise we could proceed to wb /
365                  * bdi destruction before wb_shutdown() is finished.
366                  */
367                 wait_on_bit(&wb->state, WB_shutting_down, TASK_UNINTERRUPTIBLE);
368                 return;
369         }
370         set_bit(WB_shutting_down, &wb->state);
371         spin_unlock_bh(&wb->work_lock);
372
373         cgwb_remove_from_bdi_list(wb);
374         /*
375          * Drain work list and shutdown the delayed_work.  !WB_registered
376          * tells wb_workfn() that @wb is dying and its work_list needs to
377          * be drained no matter what.
378          */
379         mod_delayed_work(bdi_wq, &wb->dwork, 0);
380         flush_delayed_work(&wb->dwork);
381         WARN_ON(!list_empty(&wb->work_list));
382         /*
383          * Make sure bit gets cleared after shutdown is finished. Matches with
384          * the barrier provided by test_and_clear_bit() above.
385          */
386         smp_wmb();
387         clear_and_wake_up_bit(WB_shutting_down, &wb->state);
388 }
389
390 static void wb_exit(struct bdi_writeback *wb)
391 {
392         int i;
393
394         WARN_ON(delayed_work_pending(&wb->dwork));
395
396         for (i = 0; i < NR_WB_STAT_ITEMS; i++)
397                 percpu_counter_destroy(&wb->stat[i]);
398
399         fprop_local_destroy_percpu(&wb->completions);
400         wb_congested_put(wb->congested);
401         if (wb != &wb->bdi->wb)
402                 bdi_put(wb->bdi);
403 }
404
405 #ifdef CONFIG_CGROUP_WRITEBACK
406
407 #include <linux/memcontrol.h>
408
409 /*
410  * cgwb_lock protects bdi->cgwb_tree, bdi->cgwb_congested_tree,
411  * blkcg->cgwb_list, and memcg->cgwb_list.  bdi->cgwb_tree is also RCU
412  * protected.
413  */
414 static DEFINE_SPINLOCK(cgwb_lock);
415
416 /**
417  * wb_congested_get_create - get or create a wb_congested
418  * @bdi: associated bdi
419  * @blkcg_id: ID of the associated blkcg
420  * @gfp: allocation mask
421  *
422  * Look up the wb_congested for @blkcg_id on @bdi.  If missing, create one.
423  * The returned wb_congested has its reference count incremented.  Returns
424  * NULL on failure.
425  */
426 struct bdi_writeback_congested *
427 wb_congested_get_create(struct backing_dev_info *bdi, int blkcg_id, gfp_t gfp)
428 {
429         struct bdi_writeback_congested *new_congested = NULL, *congested;
430         struct rb_node **node, *parent;
431         unsigned long flags;
432 retry:
433         spin_lock_irqsave(&cgwb_lock, flags);
434
435         node = &bdi->cgwb_congested_tree.rb_node;
436         parent = NULL;
437
438         while (*node != NULL) {
439                 parent = *node;
440                 congested = rb_entry(parent, struct bdi_writeback_congested,
441                                      rb_node);
442                 if (congested->blkcg_id < blkcg_id)
443                         node = &parent->rb_left;
444                 else if (congested->blkcg_id > blkcg_id)
445                         node = &parent->rb_right;
446                 else
447                         goto found;
448         }
449
450         if (new_congested) {
451                 /* !found and storage for new one already allocated, insert */
452                 congested = new_congested;
453                 new_congested = NULL;
454                 rb_link_node(&congested->rb_node, parent, node);
455                 rb_insert_color(&congested->rb_node, &bdi->cgwb_congested_tree);
456                 goto found;
457         }
458
459         spin_unlock_irqrestore(&cgwb_lock, flags);
460
461         /* allocate storage for new one and retry */
462         new_congested = kzalloc(sizeof(*new_congested), gfp);
463         if (!new_congested)
464                 return NULL;
465
466         atomic_set(&new_congested->refcnt, 0);
467         new_congested->__bdi = bdi;
468         new_congested->blkcg_id = blkcg_id;
469         goto retry;
470
471 found:
472         atomic_inc(&congested->refcnt);
473         spin_unlock_irqrestore(&cgwb_lock, flags);
474         kfree(new_congested);
475         return congested;
476 }
477
478 /**
479  * wb_congested_put - put a wb_congested
480  * @congested: wb_congested to put
481  *
482  * Put @congested and destroy it if the refcnt reaches zero.
483  */
484 void wb_congested_put(struct bdi_writeback_congested *congested)
485 {
486         unsigned long flags;
487
488         local_irq_save(flags);
489         if (!atomic_dec_and_lock(&congested->refcnt, &cgwb_lock)) {
490                 local_irq_restore(flags);
491                 return;
492         }
493
494         /* bdi might already have been destroyed leaving @congested unlinked */
495         if (congested->__bdi) {
496                 rb_erase(&congested->rb_node,
497                          &congested->__bdi->cgwb_congested_tree);
498                 congested->__bdi = NULL;
499         }
500
501         spin_unlock_irqrestore(&cgwb_lock, flags);
502         kfree(congested);
503 }
504
505 static void cgwb_release_workfn(struct work_struct *work)
506 {
507         struct bdi_writeback *wb = container_of(work, struct bdi_writeback,
508                                                 release_work);
509
510         wb_shutdown(wb);
511
512         css_put(wb->memcg_css);
513         css_put(wb->blkcg_css);
514
515         fprop_local_destroy_percpu(&wb->memcg_completions);
516         percpu_ref_exit(&wb->refcnt);
517         wb_exit(wb);
518         kfree_rcu(wb, rcu);
519 }
520
521 static void cgwb_release(struct percpu_ref *refcnt)
522 {
523         struct bdi_writeback *wb = container_of(refcnt, struct bdi_writeback,
524                                                 refcnt);
525         schedule_work(&wb->release_work);
526 }
527
528 static void cgwb_kill(struct bdi_writeback *wb)
529 {
530         lockdep_assert_held(&cgwb_lock);
531
532         WARN_ON(!radix_tree_delete(&wb->bdi->cgwb_tree, wb->memcg_css->id));
533         list_del(&wb->memcg_node);
534         list_del(&wb->blkcg_node);
535         percpu_ref_kill(&wb->refcnt);
536 }
537
538 static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb)
539 {
540         spin_lock_irq(&cgwb_lock);
541         list_del_rcu(&wb->bdi_node);
542         spin_unlock_irq(&cgwb_lock);
543 }
544
545 static int cgwb_create(struct backing_dev_info *bdi,
546                        struct cgroup_subsys_state *memcg_css, gfp_t gfp)
547 {
548         struct mem_cgroup *memcg;
549         struct cgroup_subsys_state *blkcg_css;
550         struct blkcg *blkcg;
551         struct list_head *memcg_cgwb_list, *blkcg_cgwb_list;
552         struct bdi_writeback *wb;
553         unsigned long flags;
554         int ret = 0;
555
556         memcg = mem_cgroup_from_css(memcg_css);
557         blkcg_css = cgroup_get_e_css(memcg_css->cgroup, &io_cgrp_subsys);
558         blkcg = css_to_blkcg(blkcg_css);
559         memcg_cgwb_list = mem_cgroup_cgwb_list(memcg);
560         blkcg_cgwb_list = &blkcg->cgwb_list;
561
562         /* look up again under lock and discard on blkcg mismatch */
563         spin_lock_irqsave(&cgwb_lock, flags);
564         wb = radix_tree_lookup(&bdi->cgwb_tree, memcg_css->id);
565         if (wb && wb->blkcg_css != blkcg_css) {
566                 cgwb_kill(wb);
567                 wb = NULL;
568         }
569         spin_unlock_irqrestore(&cgwb_lock, flags);
570         if (wb)
571                 goto out_put;
572
573         /* need to create a new one */
574         wb = kmalloc(sizeof(*wb), gfp);
575         if (!wb) {
576                 ret = -ENOMEM;
577                 goto out_put;
578         }
579
580         ret = wb_init(wb, bdi, blkcg_css->id, gfp);
581         if (ret)
582                 goto err_free;
583
584         ret = percpu_ref_init(&wb->refcnt, cgwb_release, 0, gfp);
585         if (ret)
586                 goto err_wb_exit;
587
588         ret = fprop_local_init_percpu(&wb->memcg_completions, gfp);
589         if (ret)
590                 goto err_ref_exit;
591
592         wb->memcg_css = memcg_css;
593         wb->blkcg_css = blkcg_css;
594         INIT_WORK(&wb->release_work, cgwb_release_workfn);
595         set_bit(WB_registered, &wb->state);
596
597         /*
598          * The root wb determines the registered state of the whole bdi and
599          * memcg_cgwb_list and blkcg_cgwb_list's next pointers indicate
600          * whether they're still online.  Don't link @wb if any is dead.
601          * See wb_memcg_offline() and wb_blkcg_offline().
602          */
603         ret = -ENODEV;
604         spin_lock_irqsave(&cgwb_lock, flags);
605         if (test_bit(WB_registered, &bdi->wb.state) &&
606             blkcg_cgwb_list->next && memcg_cgwb_list->next) {
607                 /* we might have raced another instance of this function */
608                 ret = radix_tree_insert(&bdi->cgwb_tree, memcg_css->id, wb);
609                 if (!ret) {
610                         list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list);
611                         list_add(&wb->memcg_node, memcg_cgwb_list);
612                         list_add(&wb->blkcg_node, blkcg_cgwb_list);
613                         css_get(memcg_css);
614                         css_get(blkcg_css);
615                 }
616         }
617         spin_unlock_irqrestore(&cgwb_lock, flags);
618         if (ret) {
619                 if (ret == -EEXIST)
620                         ret = 0;
621                 goto err_fprop_exit;
622         }
623         goto out_put;
624
625 err_fprop_exit:
626         fprop_local_destroy_percpu(&wb->memcg_completions);
627 err_ref_exit:
628         percpu_ref_exit(&wb->refcnt);
629 err_wb_exit:
630         wb_exit(wb);
631 err_free:
632         kfree(wb);
633 out_put:
634         css_put(blkcg_css);
635         return ret;
636 }
637
638 /**
639  * wb_get_create - get wb for a given memcg, create if necessary
640  * @bdi: target bdi
641  * @memcg_css: cgroup_subsys_state of the target memcg (must have positive ref)
642  * @gfp: allocation mask to use
643  *
644  * Try to get the wb for @memcg_css on @bdi.  If it doesn't exist, try to
645  * create one.  The returned wb has its refcount incremented.
646  *
647  * This function uses css_get() on @memcg_css and thus expects its refcnt
648  * to be positive on invocation.  IOW, rcu_read_lock() protection on
649  * @memcg_css isn't enough.  try_get it before calling this function.
650  *
651  * A wb is keyed by its associated memcg.  As blkcg implicitly enables
652  * memcg on the default hierarchy, memcg association is guaranteed to be
653  * more specific (equal or descendant to the associated blkcg) and thus can
654  * identify both the memcg and blkcg associations.
655  *
656  * Because the blkcg associated with a memcg may change as blkcg is enabled
657  * and disabled closer to root in the hierarchy, each wb keeps track of
658  * both the memcg and blkcg associated with it and verifies the blkcg on
659  * each lookup.  On mismatch, the existing wb is discarded and a new one is
660  * created.
661  */
662 struct bdi_writeback *wb_get_create(struct backing_dev_info *bdi,
663                                     struct cgroup_subsys_state *memcg_css,
664                                     gfp_t gfp)
665 {
666         struct bdi_writeback *wb;
667
668         might_sleep_if(gfpflags_allow_blocking(gfp));
669
670         if (!memcg_css->parent)
671                 return &bdi->wb;
672
673         do {
674                 rcu_read_lock();
675                 wb = radix_tree_lookup(&bdi->cgwb_tree, memcg_css->id);
676                 if (wb) {
677                         struct cgroup_subsys_state *blkcg_css;
678
679                         /* see whether the blkcg association has changed */
680                         blkcg_css = cgroup_get_e_css(memcg_css->cgroup,
681                                                      &io_cgrp_subsys);
682                         if (unlikely(wb->blkcg_css != blkcg_css ||
683                                      !wb_tryget(wb)))
684                                 wb = NULL;
685                         css_put(blkcg_css);
686                 }
687                 rcu_read_unlock();
688         } while (!wb && !cgwb_create(bdi, memcg_css, gfp));
689
690         return wb;
691 }
692
693 static int cgwb_bdi_init(struct backing_dev_info *bdi)
694 {
695         int ret;
696
697         INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC);
698         bdi->cgwb_congested_tree = RB_ROOT;
699
700         ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
701         if (!ret) {
702                 bdi->wb.memcg_css = &root_mem_cgroup->css;
703                 bdi->wb.blkcg_css = blkcg_root_css;
704         }
705         return ret;
706 }
707
708 static void cgwb_bdi_unregister(struct backing_dev_info *bdi)
709 {
710         struct radix_tree_iter iter;
711         void **slot;
712         struct bdi_writeback *wb;
713
714         WARN_ON(test_bit(WB_registered, &bdi->wb.state));
715
716         spin_lock_irq(&cgwb_lock);
717         radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0)
718                 cgwb_kill(*slot);
719
720         while (!list_empty(&bdi->wb_list)) {
721                 wb = list_first_entry(&bdi->wb_list, struct bdi_writeback,
722                                       bdi_node);
723                 spin_unlock_irq(&cgwb_lock);
724                 wb_shutdown(wb);
725                 spin_lock_irq(&cgwb_lock);
726         }
727         spin_unlock_irq(&cgwb_lock);
728 }
729
730 /**
731  * wb_memcg_offline - kill all wb's associated with a memcg being offlined
732  * @memcg: memcg being offlined
733  *
734  * Also prevents creation of any new wb's associated with @memcg.
735  */
736 void wb_memcg_offline(struct mem_cgroup *memcg)
737 {
738         struct list_head *memcg_cgwb_list = mem_cgroup_cgwb_list(memcg);
739         struct bdi_writeback *wb, *next;
740
741         spin_lock_irq(&cgwb_lock);
742         list_for_each_entry_safe(wb, next, memcg_cgwb_list, memcg_node)
743                 cgwb_kill(wb);
744         memcg_cgwb_list->next = NULL;   /* prevent new wb's */
745         spin_unlock_irq(&cgwb_lock);
746 }
747
748 /**
749  * wb_blkcg_offline - kill all wb's associated with a blkcg being offlined
750  * @blkcg: blkcg being offlined
751  *
752  * Also prevents creation of any new wb's associated with @blkcg.
753  */
754 void wb_blkcg_offline(struct blkcg *blkcg)
755 {
756         struct bdi_writeback *wb, *next;
757
758         spin_lock_irq(&cgwb_lock);
759         list_for_each_entry_safe(wb, next, &blkcg->cgwb_list, blkcg_node)
760                 cgwb_kill(wb);
761         blkcg->cgwb_list.next = NULL;   /* prevent new wb's */
762         spin_unlock_irq(&cgwb_lock);
763 }
764
765 static void cgwb_bdi_exit(struct backing_dev_info *bdi)
766 {
767         struct rb_node *rbn;
768
769         spin_lock_irq(&cgwb_lock);
770         while ((rbn = rb_first(&bdi->cgwb_congested_tree))) {
771                 struct bdi_writeback_congested *congested =
772                         rb_entry(rbn, struct bdi_writeback_congested, rb_node);
773
774                 rb_erase(rbn, &bdi->cgwb_congested_tree);
775                 congested->__bdi = NULL;        /* mark @congested unlinked */
776         }
777         spin_unlock_irq(&cgwb_lock);
778 }
779
780 static void cgwb_bdi_register(struct backing_dev_info *bdi)
781 {
782         spin_lock_irq(&cgwb_lock);
783         list_add_tail_rcu(&bdi->wb.bdi_node, &bdi->wb_list);
784         spin_unlock_irq(&cgwb_lock);
785 }
786
787 #else   /* CONFIG_CGROUP_WRITEBACK */
788
789 static int cgwb_bdi_init(struct backing_dev_info *bdi)
790 {
791         int err;
792
793         bdi->wb_congested = kzalloc(sizeof(*bdi->wb_congested), GFP_KERNEL);
794         if (!bdi->wb_congested)
795                 return -ENOMEM;
796
797         atomic_set(&bdi->wb_congested->refcnt, 1);
798
799         err = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL);
800         if (err) {
801                 wb_congested_put(bdi->wb_congested);
802                 return err;
803         }
804         return 0;
805 }
806
807 static void cgwb_bdi_unregister(struct backing_dev_info *bdi) { }
808
809 static void cgwb_bdi_exit(struct backing_dev_info *bdi)
810 {
811         wb_congested_put(bdi->wb_congested);
812 }
813
814 static void cgwb_bdi_register(struct backing_dev_info *bdi)
815 {
816         list_add_tail_rcu(&bdi->wb.bdi_node, &bdi->wb_list);
817 }
818
819 static void cgwb_remove_from_bdi_list(struct bdi_writeback *wb)
820 {
821         list_del_rcu(&wb->bdi_node);
822 }
823
824 #endif  /* CONFIG_CGROUP_WRITEBACK */
825
826 static int bdi_init(struct backing_dev_info *bdi)
827 {
828         int ret;
829
830         bdi->dev = NULL;
831
832         kref_init(&bdi->refcnt);
833         bdi->min_ratio = 0;
834         bdi->max_ratio = 100;
835         bdi->max_prop_frac = FPROP_FRAC_BASE;
836         INIT_LIST_HEAD(&bdi->bdi_list);
837         INIT_LIST_HEAD(&bdi->wb_list);
838         init_waitqueue_head(&bdi->wb_waitq);
839
840         ret = cgwb_bdi_init(bdi);
841
842         return ret;
843 }
844
845 struct backing_dev_info *bdi_alloc_node(gfp_t gfp_mask, int node_id)
846 {
847         struct backing_dev_info *bdi;
848
849         bdi = kmalloc_node(sizeof(struct backing_dev_info),
850                            gfp_mask | __GFP_ZERO, node_id);
851         if (!bdi)
852                 return NULL;
853
854         if (bdi_init(bdi)) {
855                 kfree(bdi);
856                 return NULL;
857         }
858         return bdi;
859 }
860 EXPORT_SYMBOL(bdi_alloc_node);
861
862 int bdi_register_va(struct backing_dev_info *bdi, const char *fmt, va_list args)
863 {
864         struct device *dev;
865
866         if (bdi->dev)   /* The driver needs to use separate queues per device */
867                 return 0;
868
869         dev = device_create_vargs(bdi_class, NULL, MKDEV(0, 0), bdi, fmt, args);
870         if (IS_ERR(dev))
871                 return PTR_ERR(dev);
872
873         cgwb_bdi_register(bdi);
874         bdi->dev = dev;
875
876         bdi_debug_register(bdi, dev_name(dev));
877         set_bit(WB_registered, &bdi->wb.state);
878
879         spin_lock_bh(&bdi_lock);
880         list_add_tail_rcu(&bdi->bdi_list, &bdi_list);
881         spin_unlock_bh(&bdi_lock);
882
883         trace_writeback_bdi_register(bdi);
884         return 0;
885 }
886 EXPORT_SYMBOL(bdi_register_va);
887
888 int bdi_register(struct backing_dev_info *bdi, const char *fmt, ...)
889 {
890         va_list args;
891         int ret;
892
893         va_start(args, fmt);
894         ret = bdi_register_va(bdi, fmt, args);
895         va_end(args);
896         return ret;
897 }
898 EXPORT_SYMBOL(bdi_register);
899
900 int bdi_register_owner(struct backing_dev_info *bdi, struct device *owner)
901 {
902         int rc;
903
904         rc = bdi_register(bdi, "%u:%u", MAJOR(owner->devt), MINOR(owner->devt));
905         if (rc)
906                 return rc;
907         /* Leaking owner reference... */
908         WARN_ON(bdi->owner);
909         bdi->owner = owner;
910         get_device(owner);
911         return 0;
912 }
913 EXPORT_SYMBOL(bdi_register_owner);
914
915 /*
916  * Remove bdi from bdi_list, and ensure that it is no longer visible
917  */
918 static void bdi_remove_from_list(struct backing_dev_info *bdi)
919 {
920         spin_lock_bh(&bdi_lock);
921         list_del_rcu(&bdi->bdi_list);
922         spin_unlock_bh(&bdi_lock);
923
924         synchronize_rcu_expedited();
925 }
926
927 void bdi_unregister(struct backing_dev_info *bdi)
928 {
929         /* make sure nobody finds us on the bdi_list anymore */
930         bdi_remove_from_list(bdi);
931         wb_shutdown(&bdi->wb);
932         cgwb_bdi_unregister(bdi);
933
934         if (bdi->dev) {
935                 bdi_debug_unregister(bdi);
936                 device_unregister(bdi->dev);
937                 bdi->dev = NULL;
938         }
939
940         if (bdi->owner) {
941                 put_device(bdi->owner);
942                 bdi->owner = NULL;
943         }
944 }
945
946 static void release_bdi(struct kref *ref)
947 {
948         struct backing_dev_info *bdi =
949                         container_of(ref, struct backing_dev_info, refcnt);
950
951         if (test_bit(WB_registered, &bdi->wb.state))
952                 bdi_unregister(bdi);
953         WARN_ON_ONCE(bdi->dev);
954         wb_exit(&bdi->wb);
955         cgwb_bdi_exit(bdi);
956         kfree(bdi);
957 }
958
959 void bdi_put(struct backing_dev_info *bdi)
960 {
961         kref_put(&bdi->refcnt, release_bdi);
962 }
963 EXPORT_SYMBOL(bdi_put);
964
965 static wait_queue_head_t congestion_wqh[2] = {
966                 __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[0]),
967                 __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[1])
968         };
969 static atomic_t nr_wb_congested[2];
970
971 void clear_wb_congested(struct bdi_writeback_congested *congested, int sync)
972 {
973         wait_queue_head_t *wqh = &congestion_wqh[sync];
974         enum wb_congested_state bit;
975
976         bit = sync ? WB_sync_congested : WB_async_congested;
977         if (test_and_clear_bit(bit, &congested->state))
978                 atomic_dec(&nr_wb_congested[sync]);
979         smp_mb__after_atomic();
980         if (waitqueue_active(wqh))
981                 wake_up(wqh);
982 }
983 EXPORT_SYMBOL(clear_wb_congested);
984
985 void set_wb_congested(struct bdi_writeback_congested *congested, int sync)
986 {
987         enum wb_congested_state bit;
988
989         bit = sync ? WB_sync_congested : WB_async_congested;
990         if (!test_and_set_bit(bit, &congested->state))
991                 atomic_inc(&nr_wb_congested[sync]);
992 }
993 EXPORT_SYMBOL(set_wb_congested);
994
995 /**
996  * congestion_wait - wait for a backing_dev to become uncongested
997  * @sync: SYNC or ASYNC IO
998  * @timeout: timeout in jiffies
999  *
1000  * Waits for up to @timeout jiffies for a backing_dev (any backing_dev) to exit
1001  * write congestion.  If no backing_devs are congested then just wait for the
1002  * next write to be completed.
1003  */
1004 long congestion_wait(int sync, long timeout)
1005 {
1006         long ret;
1007         unsigned long start = jiffies;
1008         DEFINE_WAIT(wait);
1009         wait_queue_head_t *wqh = &congestion_wqh[sync];
1010
1011         prepare_to_wait(wqh, &wait, TASK_UNINTERRUPTIBLE);
1012         ret = io_schedule_timeout(timeout);
1013         finish_wait(wqh, &wait);
1014
1015         trace_writeback_congestion_wait(jiffies_to_usecs(timeout),
1016                                         jiffies_to_usecs(jiffies - start));
1017
1018         return ret;
1019 }
1020 EXPORT_SYMBOL(congestion_wait);
1021
1022 /**
1023  * wait_iff_congested - Conditionally wait for a backing_dev to become uncongested or a pgdat to complete writes
1024  * @sync: SYNC or ASYNC IO
1025  * @timeout: timeout in jiffies
1026  *
1027  * In the event of a congested backing_dev (any backing_dev) this waits
1028  * for up to @timeout jiffies for either a BDI to exit congestion of the
1029  * given @sync queue or a write to complete.
1030  *
1031  * The return value is 0 if the sleep is for the full timeout. Otherwise,
1032  * it is the number of jiffies that were still remaining when the function
1033  * returned. return_value == timeout implies the function did not sleep.
1034  */
1035 long wait_iff_congested(int sync, long timeout)
1036 {
1037         long ret;
1038         unsigned long start = jiffies;
1039         DEFINE_WAIT(wait);
1040         wait_queue_head_t *wqh = &congestion_wqh[sync];
1041
1042         /*
1043          * If there is no congestion, yield if necessary instead
1044          * of sleeping on the congestion queue
1045          */
1046         if (atomic_read(&nr_wb_congested[sync]) == 0) {
1047                 cond_resched();
1048
1049                 /* In case we scheduled, work out time remaining */
1050                 ret = timeout - (jiffies - start);
1051                 if (ret < 0)
1052                         ret = 0;
1053
1054                 goto out;
1055         }
1056
1057         /* Sleep until uncongested or a write happens */
1058         prepare_to_wait(wqh, &wait, TASK_UNINTERRUPTIBLE);
1059         ret = io_schedule_timeout(timeout);
1060         finish_wait(wqh, &wait);
1061
1062 out:
1063         trace_writeback_wait_iff_congested(jiffies_to_usecs(timeout),
1064                                         jiffies_to_usecs(jiffies - start));
1065
1066         return ret;
1067 }
1068 EXPORT_SYMBOL(wait_iff_congested);