12 files changed, 277 insertions, 60 deletions

diff --git a/mm/Makefile b/mm/Makefile
index 12b3a4eee88d..f3c077eb0b8e 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -10,7 +10,8 @@ mmu-$(CONFIG_MMU)	:= fremap.o highmem.o madvise.o memory.o mincore.o \
 obj-y                   := bootmem.o filemap.o mempool.o oom_kill.o fadvise.o \
                            page_alloc.o page-writeback.o pdflush.o \
                            readahead.o swap.o truncate.o vmscan.o \
-                           prio_tree.o util.o mmzone.o vmstat.o $(mmu-y)
+                           prio_tree.o util.o mmzone.o vmstat.o backing-dev.o \
+                           $(mmu-y)
 
 ifeq ($(CONFIG_MMU)$(CONFIG_BLOCK),yy)
 obj-y                   += bounce.o
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
new file mode 100644
index 000000000000..f50a2811f9dc
--- /dev/null
+++ b/mm/backing-dev.c
@@ -0,0 +1,69 @@
+
+#include <linux/wait.h>
+#include <linux/backing-dev.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+
+static wait_queue_head_t congestion_wqh[2] = {
+                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[0]),
+                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[1])
+        };
+
+
+void clear_bdi_congested(struct backing_dev_info *bdi, int rw)
+{
+        enum bdi_state bit;
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
+        clear_bit(bit, &bdi->state);
+        smp_mb__after_clear_bit();
+        if (waitqueue_active(wqh))
+                wake_up(wqh);
+}
+EXPORT_SYMBOL(clear_bdi_congested);
+
+void set_bdi_congested(struct backing_dev_info *bdi, int rw)
+{
+        enum bdi_state bit;
+
+        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
+        set_bit(bit, &bdi->state);
+}
+EXPORT_SYMBOL(set_bdi_congested);
+
+/**
+ * congestion_wait - wait for a backing_dev to become uncongested
+ * @rw: READ or WRITE
+ * @timeout: timeout in jiffies
+ *
+ * Waits for up to @timeout jiffies for a backing_dev (any backing_dev) to exit
+ * write congestion.  If no backing_devs are congested then just wait for the
+ * next write to be completed.
+ */
+long congestion_wait(int rw, long timeout)
+{
+        long ret;
+        DEFINE_WAIT(wait);
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        prepare_to_wait(wqh, &wait, TASK_UNINTERRUPTIBLE);
+        ret = io_schedule_timeout(timeout);
+        finish_wait(wqh, &wait);
+        return ret;
+}
+EXPORT_SYMBOL(congestion_wait);
+
+/**
+ * congestion_end - wake up sleepers on a congested backing_dev_info
+ * @rw: READ or WRITE
+ */
+void congestion_end(int rw)
+{
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        if (waitqueue_active(wqh))
+                wake_up(wqh);
+}
+EXPORT_SYMBOL(congestion_end);
diff --git a/mm/filemap.c b/mm/filemap.c
index 3464b681f844..cb26e33fd0ff 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -75,8 +75,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
  *  ->mmap_sem
  *    ->lock_page               (access_process_vm)
  *
- *  ->mmap_sem
- *    ->i_mutex                 (msync)
+ *  ->i_mutex                   (generic_file_buffered_write)
+ *    ->mmap_sem                (fault_in_pages_readable->do_page_fault)
  *
  *  ->i_mutex
  *    ->i_alloc_sem             (various)
@@ -1884,11 +1884,10 @@ repeat:
  *      if suid or (sgid and xgrp)
  *              remove privs
  */
-int remove_suid(struct dentry *dentry)
+int should_remove_suid(struct dentry *dentry)
 {
         mode_t mode = dentry->d_inode->i_mode;
         int kill = 0;
-        int result = 0;
 
         /* suid always must be killed */
         if (unlikely(mode & S_ISUID))
@@ -1901,13 +1900,28 @@ int remove_suid(struct dentry *dentry)
         if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
                 kill |= ATTR_KILL_SGID;
 
-        if (unlikely(kill && !capable(CAP_FSETID))) {
-                struct iattr newattrs;
+        if (unlikely(kill && !capable(CAP_FSETID)))
+                return kill;
 
-                newattrs.ia_valid = ATTR_FORCE | kill;
-                result = notify_change(dentry, &newattrs);
-        }
-        return result;
+        return 0;
+}
+
+int __remove_suid(struct dentry *dentry, int kill)
+{
+        struct iattr newattrs;
+
+        newattrs.ia_valid = ATTR_FORCE | kill;
+        return notify_change(dentry, &newattrs);
+}
+
+int remove_suid(struct dentry *dentry)
+{
+        int kill = should_remove_suid(dentry);
+
+        if (unlikely(kill))
+                return __remove_suid(dentry, kill);
+
+        return 0;
 }
 EXPORT_SYMBOL(remove_suid);
 
@@ -2222,7 +2236,7 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
                                 unsigned long nr_segs, loff_t *ppos)
 {
         struct file *file = iocb->ki_filp;
-        const struct address_space * mapping = file->f_mapping;
+        struct address_space * mapping = file->f_mapping;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
         struct inode    *inode = mapping->host;
@@ -2275,8 +2289,11 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
 
         /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
         if (unlikely(file->f_flags & O_DIRECT)) {
-                written = generic_file_direct_write(iocb, iov,
-                                &nr_segs, pos, ppos, count, ocount);
+                loff_t endbyte;
+                ssize_t written_buffered;
+
+                written = generic_file_direct_write(iocb, iov, &nr_segs, pos,
+                                                        ppos, count, ocount);
                 if (written < 0 || written == count)
                         goto out;
                 /*
@@ -2285,10 +2302,46 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
                  */
                 pos += written;
                 count -= written;
-        }
+                written_buffered = generic_file_buffered_write(iocb, iov,
+                                                nr_segs, pos, ppos, count,
+                                                written);
+                /*
+                 * If generic_file_buffered_write() retuned a synchronous error
+                 * then we want to return the number of bytes which were
+                 * direct-written, or the error code if that was zero.  Note
+                 * that this differs from normal direct-io semantics, which
+                 * will return -EFOO even if some bytes were written.
+                 */
+                if (written_buffered < 0) {
+                        err = written_buffered;
+                        goto out;
+                }
 
-        written = generic_file_buffered_write(iocb, iov, nr_segs,
-                        pos, ppos, count, written);
+                /*
+                 * We need to ensure that the page cache pages are written to
+                 * disk and invalidated to preserve the expected O_DIRECT
+                 * semantics.
+                 */
+                endbyte = pos + written_buffered - written - 1;
+                err = do_sync_file_range(file, pos, endbyte,
+                                         SYNC_FILE_RANGE_WAIT_BEFORE|
+                                         SYNC_FILE_RANGE_WRITE|
+                                         SYNC_FILE_RANGE_WAIT_AFTER);
+                if (err == 0) {
+                        written = written_buffered;
+                        invalidate_mapping_pages(mapping,
+                                                 pos >> PAGE_CACHE_SHIFT,
+                                                 endbyte >> PAGE_CACHE_SHIFT);
+                } else {
+                        /*
+                         * We don't know how much we wrote, so just return
+                         * the number of bytes which were direct-written
+                         */
+                }
+        } else {
+                written = generic_file_buffered_write(iocb, iov, nr_segs,
+                                pos, ppos, count, written);
+        }
 out:
         current->backing_dev_info = NULL;
         return written ? written : err;
diff --git a/mm/memory.c b/mm/memory.c
index b5a4aadd961a..156861fcac43 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1452,6 +1452,7 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
                 if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
                         memset(kaddr, 0, PAGE_SIZE);
                 kunmap_atomic(kaddr, KM_USER0);
+                flush_dcache_page(dst);
                 return;
                 
         }
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 20f41b082e16..2e3ce3a928b9 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -15,6 +15,7 @@
  *  kernel subsystems and hints as to where to find out what things do.
  */
 
+#include <linux/oom.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/swap.h>
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index a0f339057449..8d9b19f239c3 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -222,7 +222,7 @@ static void balance_dirty_pages(struct address_space *mapping)
                         if (pages_written >= write_chunk)
                                 break;          /* We've done our duty */
                 }
-                blk_congestion_wait(WRITE, HZ/10);
+                congestion_wait(WRITE, HZ/10);
         }
 
         if (nr_reclaimable + global_page_state(NR_WRITEBACK)
@@ -314,7 +314,7 @@ void throttle_vm_writeout(void)
                 if (global_page_state(NR_UNSTABLE_NFS) +
                         global_page_state(NR_WRITEBACK) <= dirty_thresh)
                                 break;
-                blk_congestion_wait(WRITE, HZ/10);
+                congestion_wait(WRITE, HZ/10);
         }
 }
 
@@ -351,7 +351,7 @@ static void background_writeout(unsigned long _min_pages)
                 min_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
                 if (wbc.nr_to_write > 0 || wbc.pages_skipped > 0) {
                         /* Wrote less than expected */
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
                         if (!wbc.encountered_congestion)
                                 break;
                 }
@@ -422,7 +422,7 @@ static void wb_kupdate(unsigned long arg)
                 writeback_inodes(&wbc);
                 if (wbc.nr_to_write > 0) {
                         if (wbc.encountered_congestion)
-                                blk_congestion_wait(WRITE, HZ/10);
+                                congestion_wait(WRITE, HZ/10);
                         else
                                 break;  /* All the old data is written */
                 }
@@ -956,15 +956,6 @@ int test_set_page_writeback(struct page *page)
 EXPORT_SYMBOL(test_set_page_writeback);
 
 /*
- * Wakes up tasks that are being throttled due to writeback congestion
- */
-void writeback_congestion_end(void)
-{
-        blk_congestion_end(WRITE);
-}
-EXPORT_SYMBOL(writeback_congestion_end);
-
-/*
  * Return true if any of the pages in the mapping are marged with the
  * passed tag.
  */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 40db96a655d0..ebd425c2e2a7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -39,6 +39,7 @@
 #include <linux/stop_machine.h>
 #include <linux/sort.h>
 #include <linux/pfn.h>
+#include <linux/backing-dev.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -1050,7 +1051,7 @@ nofail_alloc:
                         if (page)
                                 goto got_pg;
                         if (gfp_mask & __GFP_NOFAIL) {
-                                blk_congestion_wait(WRITE, HZ/50);
+                                congestion_wait(WRITE, HZ/50);
                                 goto nofail_alloc;
                         }
                 }
@@ -1113,7 +1114,7 @@ rebalance:
                         do_retry = 1;
         }
         if (do_retry) {
-                blk_congestion_wait(WRITE, HZ/50);
+                congestion_wait(WRITE, HZ/50);
                 goto rebalance;
         }
 
@@ -3119,3 +3120,19 @@ unsigned long page_to_pfn(struct page *page)
 EXPORT_SYMBOL(pfn_to_page);
 EXPORT_SYMBOL(page_to_pfn);
 #endif /* CONFIG_OUT_OF_LINE_PFN_TO_PAGE */
+
+#if MAX_NUMNODES > 1
+/*
+ * Find the highest possible node id.
+ */
+int highest_possible_node_id(void)
+{
+        unsigned int node;
+        unsigned int highest = 0;
+
+        for_each_node_mask(node, node_possible_map)
+                highest = node;
+        return highest;
+}
+EXPORT_SYMBOL(highest_possible_node_id);
+#endif
diff --git a/mm/rmap.c b/mm/rmap.c
index a9136d8b7577..d8a842a586db 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -21,27 +21,21 @@
  * Lock ordering in mm:
  *
  * inode->i_mutex       (while writing or truncating, not reading or faulting)
- *   inode->i_alloc_sem
- *
- * When a page fault occurs in writing from user to file, down_read
- * of mmap_sem nests within i_mutex; in sys_msync, i_mutex nests within
- * down_read of mmap_sem; i_mutex and down_write of mmap_sem are never
- * taken together; in truncation, i_mutex is taken outermost.
- *
- * mm->mmap_sem
- *   page->flags PG_locked (lock_page)
- *     mapping->i_mmap_lock
- *       anon_vma->lock
- *         mm->page_table_lock or pte_lock
- *           zone->lru_lock (in mark_page_accessed, isolate_lru_page)
- *           swap_lock (in swap_duplicate, swap_info_get)
- *             mmlist_lock (in mmput, drain_mmlist and others)
- *             mapping->private_lock (in __set_page_dirty_buffers)
- *             inode_lock (in set_page_dirty's __mark_inode_dirty)
- *               sb_lock (within inode_lock in fs/fs-writeback.c)
- *               mapping->tree_lock (widely used, in set_page_dirty,
- *                         in arch-dependent flush_dcache_mmap_lock,
- *                         within inode_lock in __sync_single_inode)
+ *   inode->i_alloc_sem (vmtruncate_range)
+ *   mm->mmap_sem
+ *     page->flags PG_locked (lock_page)
+ *       mapping->i_mmap_lock
+ *         anon_vma->lock
+ *           mm->page_table_lock or pte_lock
+ *             zone->lru_lock (in mark_page_accessed, isolate_lru_page)
+ *             swap_lock (in swap_duplicate, swap_info_get)
+ *               mmlist_lock (in mmput, drain_mmlist and others)
+ *               mapping->private_lock (in __set_page_dirty_buffers)
+ *               inode_lock (in set_page_dirty's __mark_inode_dirty)
+ *                 sb_lock (within inode_lock in fs/fs-writeback.c)
+ *                 mapping->tree_lock (widely used, in set_page_dirty,
+ *                           in arch-dependent flush_dcache_mmap_lock,
+ *                           within inode_lock in __sync_single_inode)
  */
 
 #include <linux/mm.h>
diff --git a/mm/shmem.c b/mm/shmem.c
index bb8ca7ef7094..4959535fc14c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -48,6 +48,7 @@
 #include <linux/ctype.h>
 #include <linux/migrate.h>
 #include <linux/highmem.h>
+#include <linux/backing-dev.h>
 
 #include <asm/uaccess.h>
 #include <asm/div64.h>
@@ -1131,7 +1132,7 @@ repeat:
                         page_cache_release(swappage);
                         if (error == -ENOMEM) {
                                 /* let kswapd refresh zone for GFP_ATOMICs */
-                                blk_congestion_wait(WRITE, HZ/50);
+                                congestion_wait(WRITE, HZ/50);
                         }
                         goto repeat;
                 }
@@ -1362,6 +1363,7 @@ shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
                 inode->i_mapping->a_ops = &shmem_aops;
                 inode->i_mapping->backing_dev_info = &shmem_backing_dev_info;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                inode->i_generation = get_seconds();
                 info = SHMEM_I(inode);
                 memset(info, 0, (char *)inode - (char *)info);
                 spin_lock_init(&info->lock);
@@ -1956,6 +1958,85 @@ static struct xattr_handler *shmem_xattr_handlers[] = {
 };
 #endif
 
+static struct dentry *shmem_get_parent(struct dentry *child)
+{
+        return ERR_PTR(-ESTALE);
+}
+
+static int shmem_match(struct inode *ino, void *vfh)
+{
+        __u32 *fh = vfh;
+        __u64 inum = fh[2];
+        inum = (inum << 32) | fh[1];
+        return ino->i_ino == inum && fh[0] == ino->i_generation;
+}
+
+static struct dentry *shmem_get_dentry(struct super_block *sb, void *vfh)
+{
+        struct dentry *de = NULL;
+        struct inode *inode;
+        __u32 *fh = vfh;
+        __u64 inum = fh[2];
+        inum = (inum << 32) | fh[1];
+
+        inode = ilookup5(sb, (unsigned long)(inum+fh[0]), shmem_match, vfh);
+        if (inode) {
+                de = d_find_alias(inode);
+                iput(inode);
+        }
+
+        return de? de: ERR_PTR(-ESTALE);
+}
+
+static struct dentry *shmem_decode_fh(struct super_block *sb, __u32 *fh,
+                int len, int type,
+                int (*acceptable)(void *context, struct dentry *de),
+                void *context)
+{
+        if (len < 3)
+                return ERR_PTR(-ESTALE);
+
+        return sb->s_export_op->find_exported_dentry(sb, fh, NULL, acceptable,
+                                                        context);
+}
+
+static int shmem_encode_fh(struct dentry *dentry, __u32 *fh, int *len,
+                                int connectable)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (*len < 3)
+                return 255;
+
+        if (hlist_unhashed(&inode->i_hash)) {
+                /* Unfortunately insert_inode_hash is not idempotent,
+                 * so as we hash inodes here rather than at creation
+                 * time, we need a lock to ensure we only try
+                 * to do it once
+                 */
+                static DEFINE_SPINLOCK(lock);
+                spin_lock(&lock);
+                if (hlist_unhashed(&inode->i_hash))
+                        __insert_inode_hash(inode,
+                                            inode->i_ino + inode->i_generation);
+                spin_unlock(&lock);
+        }
+
+        fh[0] = inode->i_generation;
+        fh[1] = inode->i_ino;
+        fh[2] = ((__u64)inode->i_ino) >> 32;
+
+        *len = 3;
+        return 1;
+}
+
+static struct export_operations shmem_export_ops = {
+        .get_parent     = shmem_get_parent,
+        .get_dentry     = shmem_get_dentry,
+        .encode_fh      = shmem_encode_fh,
+        .decode_fh      = shmem_decode_fh,
+};
+
 static int shmem_parse_options(char *options, int *mode, uid_t *uid,
         gid_t *gid, unsigned long *blocks, unsigned long *inodes,
         int *policy, nodemask_t *policy_nodes)
@@ -2128,6 +2209,7 @@ static int shmem_fill_super(struct super_block *sb,
                                         &inodes, &policy, &policy_nodes))
                         return -EINVAL;
         }
+        sb->s_export_op = &shmem_export_ops;
 #else
         sb->s_flags |= MS_NOUSER;
 #endif
diff --git a/mm/truncate.c b/mm/truncate.c
index 11ca480701dd..e07b1e682c38 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -96,7 +96,6 @@ invalidate_complete_page(struct address_space *mapping, struct page *page)
                 return 0;
 
         ret = remove_mapping(mapping, page);
-        ClearPageUptodate(page);
 
         return ret;
 }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 750ab6ed13fc..1133dd3aafcf 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -428,8 +428,11 @@ void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         if (array_size > PAGE_SIZE) {
                 pages = __vmalloc_node(array_size, gfp_mask, PAGE_KERNEL, node);
                 area->flags |= VM_VPAGES;
-        } else
-                pages = kmalloc_node(array_size, (gfp_mask & ~__GFP_HIGHMEM), node);
+        } else {
+                pages = kmalloc_node(array_size,
+                                (gfp_mask & ~(__GFP_HIGHMEM | __GFP_ZERO)),
+                                node);
+        }
         area->pages = pages;
         if (!area->pages) {
                 remove_vm_area(area->addr);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index eca70310adb2..f05527bf792b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -378,6 +378,12 @@ static pageout_t pageout(struct page *page, struct address_space *mapping)
         return PAGE_CLEAN;
 }
 
+/*
+ * Attempt to detach a locked page from its ->mapping.  If it is dirty or if
+ * someone else has a ref on the page, abort and return 0.  If it was
+ * successfully detached, return 1.  Assumes the caller has a single ref on
+ * this page.
+ */
 int remove_mapping(struct address_space *mapping, struct page *page)
 {
         BUG_ON(!PageLocked(page));
@@ -1053,7 +1059,7 @@ unsigned long try_to_free_pages(struct zone **zones, gfp_t gfp_mask)
 
                 /* Take a nap, wait for some writeback to complete */
                 if (sc.nr_scanned && priority < DEF_PRIORITY - 2)
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
         }
         /* top priority shrink_caches still had more to do? don't OOM, then */
         if (!sc.all_unreclaimable)
@@ -1208,7 +1214,7 @@ scan:
                  * another pass across the zones.
                  */
                 if (total_scanned && priority < DEF_PRIORITY - 2)
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
 
                 /*
                  * We do this so kswapd doesn't build up large priorities for
@@ -1452,7 +1458,7 @@ unsigned long shrink_all_memory(unsigned long nr_pages)
                                 goto out;
 
                         if (sc.nr_scanned && prio < DEF_PRIORITY - 2)
-                                blk_congestion_wait(WRITE, HZ / 10);
+                                congestion_wait(WRITE, HZ / 10);
                 }
 
                 lru_pages = 0;