xref: /linux/mm/swapfile.c (revision f73a058be5d70dd81a43f16b2bbff4b1576a7af8)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  linux/mm/swapfile.c
4  *
5  *  Copyright (C) 1991, 1992, 1993, 1994  Linus Torvalds
6  *  Swap reorganised 29.12.95, Stephen Tweedie
7  */
8 
9 #include <linux/blkdev.h>
10 #include <linux/mm.h>
11 #include <linux/sched/mm.h>
12 #include <linux/sched/task.h>
13 #include <linux/hugetlb.h>
14 #include <linux/mman.h>
15 #include <linux/slab.h>
16 #include <linux/kernel_stat.h>
17 #include <linux/swap.h>
18 #include <linux/vmalloc.h>
19 #include <linux/pagemap.h>
20 #include <linux/namei.h>
21 #include <linux/shmem_fs.h>
22 #include <linux/blk-cgroup.h>
23 #include <linux/random.h>
24 #include <linux/writeback.h>
25 #include <linux/proc_fs.h>
26 #include <linux/seq_file.h>
27 #include <linux/init.h>
28 #include <linux/ksm.h>
29 #include <linux/rmap.h>
30 #include <linux/security.h>
31 #include <linux/backing-dev.h>
32 #include <linux/mutex.h>
33 #include <linux/capability.h>
34 #include <linux/syscalls.h>
35 #include <linux/memcontrol.h>
36 #include <linux/poll.h>
37 #include <linux/oom.h>
38 #include <linux/swapfile.h>
39 #include <linux/export.h>
40 #include <linux/swap_slots.h>
41 #include <linux/sort.h>
42 #include <linux/completion.h>
43 #include <linux/suspend.h>
44 #include <linux/zswap.h>
45 #include <linux/plist.h>
46 
47 #include <asm/tlbflush.h>
48 #include <linux/swapops.h>
49 #include <linux/swap_cgroup.h>
50 #include "internal.h"
51 #include "swap.h"
52 
53 static bool swap_count_continued(struct swap_info_struct *, pgoff_t,
54 				 unsigned char);
55 static void free_swap_count_continuations(struct swap_info_struct *);
56 
57 static DEFINE_SPINLOCK(swap_lock);
58 static unsigned int nr_swapfiles;
59 atomic_long_t nr_swap_pages;
60 /*
61  * Some modules use swappable objects and may try to swap them out under
62  * memory pressure (via the shrinker). Before doing so, they may wish to
63  * check to see if any swap space is available.
64  */
65 EXPORT_SYMBOL_GPL(nr_swap_pages);
66 /* protected with swap_lock. reading in vm_swap_full() doesn't need lock */
67 long total_swap_pages;
68 static int least_priority = -1;
69 unsigned long swapfile_maximum_size;
70 #ifdef CONFIG_MIGRATION
71 bool swap_migration_ad_supported;
72 #endif	/* CONFIG_MIGRATION */
73 
74 static const char Bad_file[] = "Bad swap file entry ";
75 static const char Unused_file[] = "Unused swap file entry ";
76 static const char Bad_offset[] = "Bad swap offset entry ";
77 static const char Unused_offset[] = "Unused swap offset entry ";
78 
79 /*
80  * all active swap_info_structs
81  * protected with swap_lock, and ordered by priority.
82  */
83 static PLIST_HEAD(swap_active_head);
84 
85 /*
86  * all available (active, not full) swap_info_structs
87  * protected with swap_avail_lock, ordered by priority.
88  * This is used by folio_alloc_swap() instead of swap_active_head
89  * because swap_active_head includes all swap_info_structs,
90  * but folio_alloc_swap() doesn't need to look at full ones.
91  * This uses its own lock instead of swap_lock because when a
92  * swap_info_struct changes between not-full/full, it needs to
93  * add/remove itself to/from this list, but the swap_info_struct->lock
94  * is held and the locking order requires swap_lock to be taken
95  * before any swap_info_struct->lock.
96  */
97 static struct plist_head *swap_avail_heads;
98 static DEFINE_SPINLOCK(swap_avail_lock);
99 
100 static struct swap_info_struct *swap_info[MAX_SWAPFILES];
101 
102 static DEFINE_MUTEX(swapon_mutex);
103 
104 static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
105 /* Activity counter to indicate that a swapon or swapoff has occurred */
106 static atomic_t proc_poll_event = ATOMIC_INIT(0);
107 
108 atomic_t nr_rotate_swap = ATOMIC_INIT(0);
109 
110 static struct swap_info_struct *swap_type_to_swap_info(int type)
111 {
112 	if (type >= MAX_SWAPFILES)
113 		return NULL;
114 
115 	return READ_ONCE(swap_info[type]); /* rcu_dereference() */
116 }
117 
118 static inline unsigned char swap_count(unsigned char ent)
119 {
120 	return ent & ~SWAP_HAS_CACHE;	/* may include COUNT_CONTINUED flag */
121 }
122 
123 /* Reclaim the swap entry anyway if possible */
124 #define TTRS_ANYWAY		0x1
125 /*
126  * Reclaim the swap entry if there are no more mappings of the
127  * corresponding page
128  */
129 #define TTRS_UNMAPPED		0x2
130 /* Reclaim the swap entry if swap is getting full*/
131 #define TTRS_FULL		0x4
132 
133 /*
134  * returns number of pages in the folio that backs the swap entry. If positive,
135  * the folio was reclaimed. If negative, the folio was not reclaimed. If 0, no
136  * folio was associated with the swap entry.
137  */
138 static int __try_to_reclaim_swap(struct swap_info_struct *si,
139 				 unsigned long offset, unsigned long flags)
140 {
141 	swp_entry_t entry = swp_entry(si->type, offset);
142 	struct folio *folio;
143 	int ret = 0;
144 
145 	folio = filemap_get_folio(swap_address_space(entry), offset);
146 	if (IS_ERR(folio))
147 		return 0;
148 	/*
149 	 * When this function is called from scan_swap_map_slots() and it's
150 	 * called by vmscan.c at reclaiming folios. So we hold a folio lock
151 	 * here. We have to use trylock for avoiding deadlock. This is a special
152 	 * case and you should use folio_free_swap() with explicit folio_lock()
153 	 * in usual operations.
154 	 */
155 	if (folio_trylock(folio)) {
156 		if ((flags & TTRS_ANYWAY) ||
157 		    ((flags & TTRS_UNMAPPED) && !folio_mapped(folio)) ||
158 		    ((flags & TTRS_FULL) && mem_cgroup_swap_full(folio)))
159 			ret = folio_free_swap(folio);
160 		folio_unlock(folio);
161 	}
162 	ret = ret ? folio_nr_pages(folio) : -folio_nr_pages(folio);
163 	folio_put(folio);
164 	return ret;
165 }
166 
167 static inline struct swap_extent *first_se(struct swap_info_struct *sis)
168 {
169 	struct rb_node *rb = rb_first(&sis->swap_extent_root);
170 	return rb_entry(rb, struct swap_extent, rb_node);
171 }
172 
173 static inline struct swap_extent *next_se(struct swap_extent *se)
174 {
175 	struct rb_node *rb = rb_next(&se->rb_node);
176 	return rb ? rb_entry(rb, struct swap_extent, rb_node) : NULL;
177 }
178 
179 /*
180  * swapon tell device that all the old swap contents can be discarded,
181  * to allow the swap device to optimize its wear-levelling.
182  */
183 static int discard_swap(struct swap_info_struct *si)
184 {
185 	struct swap_extent *se;
186 	sector_t start_block;
187 	sector_t nr_blocks;
188 	int err = 0;
189 
190 	/* Do not discard the swap header page! */
191 	se = first_se(si);
192 	start_block = (se->start_block + 1) << (PAGE_SHIFT - 9);
193 	nr_blocks = ((sector_t)se->nr_pages - 1) << (PAGE_SHIFT - 9);
194 	if (nr_blocks) {
195 		err = blkdev_issue_discard(si->bdev, start_block,
196 				nr_blocks, GFP_KERNEL);
197 		if (err)
198 			return err;
199 		cond_resched();
200 	}
201 
202 	for (se = next_se(se); se; se = next_se(se)) {
203 		start_block = se->start_block << (PAGE_SHIFT - 9);
204 		nr_blocks = (sector_t)se->nr_pages << (PAGE_SHIFT - 9);
205 
206 		err = blkdev_issue_discard(si->bdev, start_block,
207 				nr_blocks, GFP_KERNEL);
208 		if (err)
209 			break;
210 
211 		cond_resched();
212 	}
213 	return err;		/* That will often be -EOPNOTSUPP */
214 }
215 
216 static struct swap_extent *
217 offset_to_swap_extent(struct swap_info_struct *sis, unsigned long offset)
218 {
219 	struct swap_extent *se;
220 	struct rb_node *rb;
221 
222 	rb = sis->swap_extent_root.rb_node;
223 	while (rb) {
224 		se = rb_entry(rb, struct swap_extent, rb_node);
225 		if (offset < se->start_page)
226 			rb = rb->rb_left;
227 		else if (offset >= se->start_page + se->nr_pages)
228 			rb = rb->rb_right;
229 		else
230 			return se;
231 	}
232 	/* It *must* be present */
233 	BUG();
234 }
235 
236 sector_t swap_folio_sector(struct folio *folio)
237 {
238 	struct swap_info_struct *sis = swp_swap_info(folio->swap);
239 	struct swap_extent *se;
240 	sector_t sector;
241 	pgoff_t offset;
242 
243 	offset = swp_offset(folio->swap);
244 	se = offset_to_swap_extent(sis, offset);
245 	sector = se->start_block + (offset - se->start_page);
246 	return sector << (PAGE_SHIFT - 9);
247 }
248 
249 /*
250  * swap allocation tell device that a cluster of swap can now be discarded,
251  * to allow the swap device to optimize its wear-levelling.
252  */
253 static void discard_swap_cluster(struct swap_info_struct *si,
254 				 pgoff_t start_page, pgoff_t nr_pages)
255 {
256 	struct swap_extent *se = offset_to_swap_extent(si, start_page);
257 
258 	while (nr_pages) {
259 		pgoff_t offset = start_page - se->start_page;
260 		sector_t start_block = se->start_block + offset;
261 		sector_t nr_blocks = se->nr_pages - offset;
262 
263 		if (nr_blocks > nr_pages)
264 			nr_blocks = nr_pages;
265 		start_page += nr_blocks;
266 		nr_pages -= nr_blocks;
267 
268 		start_block <<= PAGE_SHIFT - 9;
269 		nr_blocks <<= PAGE_SHIFT - 9;
270 		if (blkdev_issue_discard(si->bdev, start_block,
271 					nr_blocks, GFP_NOIO))
272 			break;
273 
274 		se = next_se(se);
275 	}
276 }
277 
278 #ifdef CONFIG_THP_SWAP
279 #define SWAPFILE_CLUSTER	HPAGE_PMD_NR
280 
281 #define swap_entry_order(order)	(order)
282 #else
283 #define SWAPFILE_CLUSTER	256
284 
285 /*
286  * Define swap_entry_order() as constant to let compiler to optimize
287  * out some code if !CONFIG_THP_SWAP
288  */
289 #define swap_entry_order(order)	0
290 #endif
291 #define LATENCY_LIMIT		256
292 
293 static inline void cluster_set_flag(struct swap_cluster_info *info,
294 	unsigned int flag)
295 {
296 	info->flags = flag;
297 }
298 
299 static inline unsigned int cluster_count(struct swap_cluster_info *info)
300 {
301 	return info->data;
302 }
303 
304 static inline void cluster_set_count(struct swap_cluster_info *info,
305 				     unsigned int c)
306 {
307 	info->data = c;
308 }
309 
310 static inline void cluster_set_count_flag(struct swap_cluster_info *info,
311 					 unsigned int c, unsigned int f)
312 {
313 	info->flags = f;
314 	info->data = c;
315 }
316 
317 static inline unsigned int cluster_next(struct swap_cluster_info *info)
318 {
319 	return info->data;
320 }
321 
322 static inline void cluster_set_next(struct swap_cluster_info *info,
323 				    unsigned int n)
324 {
325 	info->data = n;
326 }
327 
328 static inline void cluster_set_next_flag(struct swap_cluster_info *info,
329 					 unsigned int n, unsigned int f)
330 {
331 	info->flags = f;
332 	info->data = n;
333 }
334 
335 static inline bool cluster_is_free(struct swap_cluster_info *info)
336 {
337 	return info->flags & CLUSTER_FLAG_FREE;
338 }
339 
340 static inline bool cluster_is_null(struct swap_cluster_info *info)
341 {
342 	return info->flags & CLUSTER_FLAG_NEXT_NULL;
343 }
344 
345 static inline void cluster_set_null(struct swap_cluster_info *info)
346 {
347 	info->flags = CLUSTER_FLAG_NEXT_NULL;
348 	info->data = 0;
349 }
350 
351 static inline struct swap_cluster_info *lock_cluster(struct swap_info_struct *si,
352 						     unsigned long offset)
353 {
354 	struct swap_cluster_info *ci;
355 
356 	ci = si->cluster_info;
357 	if (ci) {
358 		ci += offset / SWAPFILE_CLUSTER;
359 		spin_lock(&ci->lock);
360 	}
361 	return ci;
362 }
363 
364 static inline void unlock_cluster(struct swap_cluster_info *ci)
365 {
366 	if (ci)
367 		spin_unlock(&ci->lock);
368 }
369 
370 /*
371  * Determine the locking method in use for this device.  Return
372  * swap_cluster_info if SSD-style cluster-based locking is in place.
373  */
374 static inline struct swap_cluster_info *lock_cluster_or_swap_info(
375 		struct swap_info_struct *si, unsigned long offset)
376 {
377 	struct swap_cluster_info *ci;
378 
379 	/* Try to use fine-grained SSD-style locking if available: */
380 	ci = lock_cluster(si, offset);
381 	/* Otherwise, fall back to traditional, coarse locking: */
382 	if (!ci)
383 		spin_lock(&si->lock);
384 
385 	return ci;
386 }
387 
388 static inline void unlock_cluster_or_swap_info(struct swap_info_struct *si,
389 					       struct swap_cluster_info *ci)
390 {
391 	if (ci)
392 		unlock_cluster(ci);
393 	else
394 		spin_unlock(&si->lock);
395 }
396 
397 static inline bool cluster_list_empty(struct swap_cluster_list *list)
398 {
399 	return cluster_is_null(&list->head);
400 }
401 
402 static inline unsigned int cluster_list_first(struct swap_cluster_list *list)
403 {
404 	return cluster_next(&list->head);
405 }
406 
407 static void cluster_list_init(struct swap_cluster_list *list)
408 {
409 	cluster_set_null(&list->head);
410 	cluster_set_null(&list->tail);
411 }
412 
413 static void cluster_list_add_tail(struct swap_cluster_list *list,
414 				  struct swap_cluster_info *ci,
415 				  unsigned int idx)
416 {
417 	if (cluster_list_empty(list)) {
418 		cluster_set_next_flag(&list->head, idx, 0);
419 		cluster_set_next_flag(&list->tail, idx, 0);
420 	} else {
421 		struct swap_cluster_info *ci_tail;
422 		unsigned int tail = cluster_next(&list->tail);
423 
424 		/*
425 		 * Nested cluster lock, but both cluster locks are
426 		 * only acquired when we held swap_info_struct->lock
427 		 */
428 		ci_tail = ci + tail;
429 		spin_lock_nested(&ci_tail->lock, SINGLE_DEPTH_NESTING);
430 		cluster_set_next(ci_tail, idx);
431 		spin_unlock(&ci_tail->lock);
432 		cluster_set_next_flag(&list->tail, idx, 0);
433 	}
434 }
435 
436 static unsigned int cluster_list_del_first(struct swap_cluster_list *list,
437 					   struct swap_cluster_info *ci)
438 {
439 	unsigned int idx;
440 
441 	idx = cluster_next(&list->head);
442 	if (cluster_next(&list->tail) == idx) {
443 		cluster_set_null(&list->head);
444 		cluster_set_null(&list->tail);
445 	} else
446 		cluster_set_next_flag(&list->head,
447 				      cluster_next(&ci[idx]), 0);
448 
449 	return idx;
450 }
451 
452 /* Add a cluster to discard list and schedule it to do discard */
453 static void swap_cluster_schedule_discard(struct swap_info_struct *si,
454 		unsigned int idx)
455 {
456 	/*
457 	 * If scan_swap_map_slots() can't find a free cluster, it will check
458 	 * si->swap_map directly. To make sure the discarding cluster isn't
459 	 * taken by scan_swap_map_slots(), mark the swap entries bad (occupied).
460 	 * It will be cleared after discard
461 	 */
462 	memset(si->swap_map + idx * SWAPFILE_CLUSTER,
463 			SWAP_MAP_BAD, SWAPFILE_CLUSTER);
464 
465 	cluster_list_add_tail(&si->discard_clusters, si->cluster_info, idx);
466 
467 	schedule_work(&si->discard_work);
468 }
469 
470 static void __free_cluster(struct swap_info_struct *si, unsigned long idx)
471 {
472 	struct swap_cluster_info *ci = si->cluster_info;
473 
474 	cluster_set_flag(ci + idx, CLUSTER_FLAG_FREE);
475 	cluster_list_add_tail(&si->free_clusters, ci, idx);
476 }
477 
478 /*
479  * Doing discard actually. After a cluster discard is finished, the cluster
480  * will be added to free cluster list. caller should hold si->lock.
481 */
482 static void swap_do_scheduled_discard(struct swap_info_struct *si)
483 {
484 	struct swap_cluster_info *info, *ci;
485 	unsigned int idx;
486 
487 	info = si->cluster_info;
488 
489 	while (!cluster_list_empty(&si->discard_clusters)) {
490 		idx = cluster_list_del_first(&si->discard_clusters, info);
491 		spin_unlock(&si->lock);
492 
493 		discard_swap_cluster(si, idx * SWAPFILE_CLUSTER,
494 				SWAPFILE_CLUSTER);
495 
496 		spin_lock(&si->lock);
497 		ci = lock_cluster(si, idx * SWAPFILE_CLUSTER);
498 		__free_cluster(si, idx);
499 		memset(si->swap_map + idx * SWAPFILE_CLUSTER,
500 				0, SWAPFILE_CLUSTER);
501 		unlock_cluster(ci);
502 	}
503 }
504 
505 static void swap_discard_work(struct work_struct *work)
506 {
507 	struct swap_info_struct *si;
508 
509 	si = container_of(work, struct swap_info_struct, discard_work);
510 
511 	spin_lock(&si->lock);
512 	swap_do_scheduled_discard(si);
513 	spin_unlock(&si->lock);
514 }
515 
516 static void swap_users_ref_free(struct percpu_ref *ref)
517 {
518 	struct swap_info_struct *si;
519 
520 	si = container_of(ref, struct swap_info_struct, users);
521 	complete(&si->comp);
522 }
523 
524 static void alloc_cluster(struct swap_info_struct *si, unsigned long idx)
525 {
526 	struct swap_cluster_info *ci = si->cluster_info;
527 
528 	VM_BUG_ON(cluster_list_first(&si->free_clusters) != idx);
529 	cluster_list_del_first(&si->free_clusters, ci);
530 	cluster_set_count_flag(ci + idx, 0, 0);
531 }
532 
533 static void free_cluster(struct swap_info_struct *si, unsigned long idx)
534 {
535 	struct swap_cluster_info *ci = si->cluster_info + idx;
536 
537 	VM_BUG_ON(cluster_count(ci) != 0);
538 	/*
539 	 * If the swap is discardable, prepare discard the cluster
540 	 * instead of free it immediately. The cluster will be freed
541 	 * after discard.
542 	 */
543 	if ((si->flags & (SWP_WRITEOK | SWP_PAGE_DISCARD)) ==
544 	    (SWP_WRITEOK | SWP_PAGE_DISCARD)) {
545 		swap_cluster_schedule_discard(si, idx);
546 		return;
547 	}
548 
549 	__free_cluster(si, idx);
550 }
551 
552 /*
553  * The cluster corresponding to page_nr will be used. The cluster will be
554  * removed from free cluster list and its usage counter will be increased by
555  * count.
556  */
557 static void add_cluster_info_page(struct swap_info_struct *p,
558 	struct swap_cluster_info *cluster_info, unsigned long page_nr,
559 	unsigned long count)
560 {
561 	unsigned long idx = page_nr / SWAPFILE_CLUSTER;
562 
563 	if (!cluster_info)
564 		return;
565 	if (cluster_is_free(&cluster_info[idx]))
566 		alloc_cluster(p, idx);
567 
568 	VM_BUG_ON(cluster_count(&cluster_info[idx]) + count > SWAPFILE_CLUSTER);
569 	cluster_set_count(&cluster_info[idx],
570 		cluster_count(&cluster_info[idx]) + count);
571 }
572 
573 /*
574  * The cluster corresponding to page_nr will be used. The cluster will be
575  * removed from free cluster list and its usage counter will be increased by 1.
576  */
577 static void inc_cluster_info_page(struct swap_info_struct *p,
578 	struct swap_cluster_info *cluster_info, unsigned long page_nr)
579 {
580 	add_cluster_info_page(p, cluster_info, page_nr, 1);
581 }
582 
583 /*
584  * The cluster corresponding to page_nr decreases one usage. If the usage
585  * counter becomes 0, which means no page in the cluster is in using, we can
586  * optionally discard the cluster and add it to free cluster list.
587  */
588 static void dec_cluster_info_page(struct swap_info_struct *p,
589 	struct swap_cluster_info *cluster_info, unsigned long page_nr)
590 {
591 	unsigned long idx = page_nr / SWAPFILE_CLUSTER;
592 
593 	if (!cluster_info)
594 		return;
595 
596 	VM_BUG_ON(cluster_count(&cluster_info[idx]) == 0);
597 	cluster_set_count(&cluster_info[idx],
598 		cluster_count(&cluster_info[idx]) - 1);
599 
600 	if (cluster_count(&cluster_info[idx]) == 0)
601 		free_cluster(p, idx);
602 }
603 
604 /*
605  * It's possible scan_swap_map_slots() uses a free cluster in the middle of free
606  * cluster list. Avoiding such abuse to avoid list corruption.
607  */
608 static bool
609 scan_swap_map_ssd_cluster_conflict(struct swap_info_struct *si,
610 	unsigned long offset, int order)
611 {
612 	struct percpu_cluster *percpu_cluster;
613 	bool conflict;
614 
615 	offset /= SWAPFILE_CLUSTER;
616 	conflict = !cluster_list_empty(&si->free_clusters) &&
617 		offset != cluster_list_first(&si->free_clusters) &&
618 		cluster_is_free(&si->cluster_info[offset]);
619 
620 	if (!conflict)
621 		return false;
622 
623 	percpu_cluster = this_cpu_ptr(si->percpu_cluster);
624 	percpu_cluster->next[order] = SWAP_NEXT_INVALID;
625 	return true;
626 }
627 
628 static inline bool swap_range_empty(char *swap_map, unsigned int start,
629 				    unsigned int nr_pages)
630 {
631 	unsigned int i;
632 
633 	for (i = 0; i < nr_pages; i++) {
634 		if (swap_map[start + i])
635 			return false;
636 	}
637 
638 	return true;
639 }
640 
641 /*
642  * Try to get swap entries with specified order from current cpu's swap entry
643  * pool (a cluster). This might involve allocating a new cluster for current CPU
644  * too.
645  */
646 static bool scan_swap_map_try_ssd_cluster(struct swap_info_struct *si,
647 	unsigned long *offset, unsigned long *scan_base, int order)
648 {
649 	unsigned int nr_pages = 1 << order;
650 	struct percpu_cluster *cluster;
651 	struct swap_cluster_info *ci;
652 	unsigned int tmp, max;
653 
654 new_cluster:
655 	cluster = this_cpu_ptr(si->percpu_cluster);
656 	tmp = cluster->next[order];
657 	if (tmp == SWAP_NEXT_INVALID) {
658 		if (!cluster_list_empty(&si->free_clusters)) {
659 			tmp = cluster_next(&si->free_clusters.head) *
660 					SWAPFILE_CLUSTER;
661 		} else if (!cluster_list_empty(&si->discard_clusters)) {
662 			/*
663 			 * we don't have free cluster but have some clusters in
664 			 * discarding, do discard now and reclaim them, then
665 			 * reread cluster_next_cpu since we dropped si->lock
666 			 */
667 			swap_do_scheduled_discard(si);
668 			*scan_base = this_cpu_read(*si->cluster_next_cpu);
669 			*offset = *scan_base;
670 			goto new_cluster;
671 		} else
672 			return false;
673 	}
674 
675 	/*
676 	 * Other CPUs can use our cluster if they can't find a free cluster,
677 	 * check if there is still free entry in the cluster, maintaining
678 	 * natural alignment.
679 	 */
680 	max = min_t(unsigned long, si->max, ALIGN(tmp + 1, SWAPFILE_CLUSTER));
681 	if (tmp < max) {
682 		ci = lock_cluster(si, tmp);
683 		while (tmp < max) {
684 			if (swap_range_empty(si->swap_map, tmp, nr_pages))
685 				break;
686 			tmp += nr_pages;
687 		}
688 		unlock_cluster(ci);
689 	}
690 	if (tmp >= max) {
691 		cluster->next[order] = SWAP_NEXT_INVALID;
692 		goto new_cluster;
693 	}
694 	*offset = tmp;
695 	*scan_base = tmp;
696 	tmp += nr_pages;
697 	cluster->next[order] = tmp < max ? tmp : SWAP_NEXT_INVALID;
698 	return true;
699 }
700 
701 static void __del_from_avail_list(struct swap_info_struct *p)
702 {
703 	int nid;
704 
705 	assert_spin_locked(&p->lock);
706 	for_each_node(nid)
707 		plist_del(&p->avail_lists[nid], &swap_avail_heads[nid]);
708 }
709 
710 static void del_from_avail_list(struct swap_info_struct *p)
711 {
712 	spin_lock(&swap_avail_lock);
713 	__del_from_avail_list(p);
714 	spin_unlock(&swap_avail_lock);
715 }
716 
717 static void swap_range_alloc(struct swap_info_struct *si, unsigned long offset,
718 			     unsigned int nr_entries)
719 {
720 	unsigned int end = offset + nr_entries - 1;
721 
722 	if (offset == si->lowest_bit)
723 		si->lowest_bit += nr_entries;
724 	if (end == si->highest_bit)
725 		WRITE_ONCE(si->highest_bit, si->highest_bit - nr_entries);
726 	WRITE_ONCE(si->inuse_pages, si->inuse_pages + nr_entries);
727 	if (si->inuse_pages == si->pages) {
728 		si->lowest_bit = si->max;
729 		si->highest_bit = 0;
730 		del_from_avail_list(si);
731 	}
732 }
733 
734 static void add_to_avail_list(struct swap_info_struct *p)
735 {
736 	int nid;
737 
738 	spin_lock(&swap_avail_lock);
739 	for_each_node(nid)
740 		plist_add(&p->avail_lists[nid], &swap_avail_heads[nid]);
741 	spin_unlock(&swap_avail_lock);
742 }
743 
744 static void swap_range_free(struct swap_info_struct *si, unsigned long offset,
745 			    unsigned int nr_entries)
746 {
747 	unsigned long begin = offset;
748 	unsigned long end = offset + nr_entries - 1;
749 	void (*swap_slot_free_notify)(struct block_device *, unsigned long);
750 
751 	if (offset < si->lowest_bit)
752 		si->lowest_bit = offset;
753 	if (end > si->highest_bit) {
754 		bool was_full = !si->highest_bit;
755 
756 		WRITE_ONCE(si->highest_bit, end);
757 		if (was_full && (si->flags & SWP_WRITEOK))
758 			add_to_avail_list(si);
759 	}
760 	if (si->flags & SWP_BLKDEV)
761 		swap_slot_free_notify =
762 			si->bdev->bd_disk->fops->swap_slot_free_notify;
763 	else
764 		swap_slot_free_notify = NULL;
765 	while (offset <= end) {
766 		arch_swap_invalidate_page(si->type, offset);
767 		if (swap_slot_free_notify)
768 			swap_slot_free_notify(si->bdev, offset);
769 		offset++;
770 	}
771 	clear_shadow_from_swap_cache(si->type, begin, end);
772 
773 	/*
774 	 * Make sure that try_to_unuse() observes si->inuse_pages reaching 0
775 	 * only after the above cleanups are done.
776 	 */
777 	smp_wmb();
778 	atomic_long_add(nr_entries, &nr_swap_pages);
779 	WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries);
780 }
781 
782 static void set_cluster_next(struct swap_info_struct *si, unsigned long next)
783 {
784 	unsigned long prev;
785 
786 	if (!(si->flags & SWP_SOLIDSTATE)) {
787 		si->cluster_next = next;
788 		return;
789 	}
790 
791 	prev = this_cpu_read(*si->cluster_next_cpu);
792 	/*
793 	 * Cross the swap address space size aligned trunk, choose
794 	 * another trunk randomly to avoid lock contention on swap
795 	 * address space if possible.
796 	 */
797 	if ((prev >> SWAP_ADDRESS_SPACE_SHIFT) !=
798 	    (next >> SWAP_ADDRESS_SPACE_SHIFT)) {
799 		/* No free swap slots available */
800 		if (si->highest_bit <= si->lowest_bit)
801 			return;
802 		next = get_random_u32_inclusive(si->lowest_bit, si->highest_bit);
803 		next = ALIGN_DOWN(next, SWAP_ADDRESS_SPACE_PAGES);
804 		next = max_t(unsigned int, next, si->lowest_bit);
805 	}
806 	this_cpu_write(*si->cluster_next_cpu, next);
807 }
808 
809 static bool swap_offset_available_and_locked(struct swap_info_struct *si,
810 					     unsigned long offset)
811 {
812 	if (data_race(!si->swap_map[offset])) {
813 		spin_lock(&si->lock);
814 		return true;
815 	}
816 
817 	if (vm_swap_full() && READ_ONCE(si->swap_map[offset]) == SWAP_HAS_CACHE) {
818 		spin_lock(&si->lock);
819 		return true;
820 	}
821 
822 	return false;
823 }
824 
825 static int scan_swap_map_slots(struct swap_info_struct *si,
826 			       unsigned char usage, int nr,
827 			       swp_entry_t slots[], int order)
828 {
829 	struct swap_cluster_info *ci;
830 	unsigned long offset;
831 	unsigned long scan_base;
832 	unsigned long last_in_cluster = 0;
833 	int latency_ration = LATENCY_LIMIT;
834 	unsigned int nr_pages = 1 << order;
835 	int n_ret = 0;
836 	bool scanned_many = false;
837 
838 	/*
839 	 * We try to cluster swap pages by allocating them sequentially
840 	 * in swap.  Once we've allocated SWAPFILE_CLUSTER pages this
841 	 * way, however, we resort to first-free allocation, starting
842 	 * a new cluster.  This prevents us from scattering swap pages
843 	 * all over the entire swap partition, so that we reduce
844 	 * overall disk seek times between swap pages.  -- sct
845 	 * But we do now try to find an empty cluster.  -Andrea
846 	 * And we let swap pages go all over an SSD partition.  Hugh
847 	 */
848 
849 	if (order > 0) {
850 		/*
851 		 * Should not even be attempting large allocations when huge
852 		 * page swap is disabled.  Warn and fail the allocation.
853 		 */
854 		if (!IS_ENABLED(CONFIG_THP_SWAP) ||
855 		    nr_pages > SWAPFILE_CLUSTER) {
856 			VM_WARN_ON_ONCE(1);
857 			return 0;
858 		}
859 
860 		/*
861 		 * Swapfile is not block device or not using clusters so unable
862 		 * to allocate large entries.
863 		 */
864 		if (!(si->flags & SWP_BLKDEV) || !si->cluster_info)
865 			return 0;
866 	}
867 
868 	si->flags += SWP_SCANNING;
869 	/*
870 	 * Use percpu scan base for SSD to reduce lock contention on
871 	 * cluster and swap cache.  For HDD, sequential access is more
872 	 * important.
873 	 */
874 	if (si->flags & SWP_SOLIDSTATE)
875 		scan_base = this_cpu_read(*si->cluster_next_cpu);
876 	else
877 		scan_base = si->cluster_next;
878 	offset = scan_base;
879 
880 	/* SSD algorithm */
881 	if (si->cluster_info) {
882 		if (!scan_swap_map_try_ssd_cluster(si, &offset, &scan_base, order)) {
883 			if (order > 0)
884 				goto no_page;
885 			goto scan;
886 		}
887 	} else if (unlikely(!si->cluster_nr--)) {
888 		if (si->pages - si->inuse_pages < SWAPFILE_CLUSTER) {
889 			si->cluster_nr = SWAPFILE_CLUSTER - 1;
890 			goto checks;
891 		}
892 
893 		spin_unlock(&si->lock);
894 
895 		/*
896 		 * If seek is expensive, start searching for new cluster from
897 		 * start of partition, to minimize the span of allocated swap.
898 		 * If seek is cheap, that is the SWP_SOLIDSTATE si->cluster_info
899 		 * case, just handled by scan_swap_map_try_ssd_cluster() above.
900 		 */
901 		scan_base = offset = si->lowest_bit;
902 		last_in_cluster = offset + SWAPFILE_CLUSTER - 1;
903 
904 		/* Locate the first empty (unaligned) cluster */
905 		for (; last_in_cluster <= READ_ONCE(si->highest_bit); offset++) {
906 			if (si->swap_map[offset])
907 				last_in_cluster = offset + SWAPFILE_CLUSTER;
908 			else if (offset == last_in_cluster) {
909 				spin_lock(&si->lock);
910 				offset -= SWAPFILE_CLUSTER - 1;
911 				si->cluster_next = offset;
912 				si->cluster_nr = SWAPFILE_CLUSTER - 1;
913 				goto checks;
914 			}
915 			if (unlikely(--latency_ration < 0)) {
916 				cond_resched();
917 				latency_ration = LATENCY_LIMIT;
918 			}
919 		}
920 
921 		offset = scan_base;
922 		spin_lock(&si->lock);
923 		si->cluster_nr = SWAPFILE_CLUSTER - 1;
924 	}
925 
926 checks:
927 	if (si->cluster_info) {
928 		while (scan_swap_map_ssd_cluster_conflict(si, offset, order)) {
929 		/* take a break if we already got some slots */
930 			if (n_ret)
931 				goto done;
932 			if (!scan_swap_map_try_ssd_cluster(si, &offset,
933 							&scan_base, order)) {
934 				if (order > 0)
935 					goto no_page;
936 				goto scan;
937 			}
938 		}
939 	}
940 	if (!(si->flags & SWP_WRITEOK))
941 		goto no_page;
942 	if (!si->highest_bit)
943 		goto no_page;
944 	if (offset > si->highest_bit)
945 		scan_base = offset = si->lowest_bit;
946 
947 	ci = lock_cluster(si, offset);
948 	/* reuse swap entry of cache-only swap if not busy. */
949 	if (vm_swap_full() && si->swap_map[offset] == SWAP_HAS_CACHE) {
950 		int swap_was_freed;
951 		unlock_cluster(ci);
952 		spin_unlock(&si->lock);
953 		swap_was_freed = __try_to_reclaim_swap(si, offset, TTRS_ANYWAY);
954 		spin_lock(&si->lock);
955 		/* entry was freed successfully, try to use this again */
956 		if (swap_was_freed > 0)
957 			goto checks;
958 		goto scan; /* check next one */
959 	}
960 
961 	if (si->swap_map[offset]) {
962 		unlock_cluster(ci);
963 		if (!n_ret)
964 			goto scan;
965 		else
966 			goto done;
967 	}
968 	memset(si->swap_map + offset, usage, nr_pages);
969 	add_cluster_info_page(si, si->cluster_info, offset, nr_pages);
970 	unlock_cluster(ci);
971 
972 	swap_range_alloc(si, offset, nr_pages);
973 	slots[n_ret++] = swp_entry(si->type, offset);
974 
975 	/* got enough slots or reach max slots? */
976 	if ((n_ret == nr) || (offset >= si->highest_bit))
977 		goto done;
978 
979 	/* search for next available slot */
980 
981 	/* time to take a break? */
982 	if (unlikely(--latency_ration < 0)) {
983 		if (n_ret)
984 			goto done;
985 		spin_unlock(&si->lock);
986 		cond_resched();
987 		spin_lock(&si->lock);
988 		latency_ration = LATENCY_LIMIT;
989 	}
990 
991 	/* try to get more slots in cluster */
992 	if (si->cluster_info) {
993 		if (scan_swap_map_try_ssd_cluster(si, &offset, &scan_base, order))
994 			goto checks;
995 		if (order > 0)
996 			goto done;
997 	} else if (si->cluster_nr && !si->swap_map[++offset]) {
998 		/* non-ssd case, still more slots in cluster? */
999 		--si->cluster_nr;
1000 		goto checks;
1001 	}
1002 
1003 	/*
1004 	 * Even if there's no free clusters available (fragmented),
1005 	 * try to scan a little more quickly with lock held unless we
1006 	 * have scanned too many slots already.
1007 	 */
1008 	if (!scanned_many) {
1009 		unsigned long scan_limit;
1010 
1011 		if (offset < scan_base)
1012 			scan_limit = scan_base;
1013 		else
1014 			scan_limit = si->highest_bit;
1015 		for (; offset <= scan_limit && --latency_ration > 0;
1016 		     offset++) {
1017 			if (!si->swap_map[offset])
1018 				goto checks;
1019 		}
1020 	}
1021 
1022 done:
1023 	if (order == 0)
1024 		set_cluster_next(si, offset + 1);
1025 	si->flags -= SWP_SCANNING;
1026 	return n_ret;
1027 
1028 scan:
1029 	VM_WARN_ON(order > 0);
1030 	spin_unlock(&si->lock);
1031 	while (++offset <= READ_ONCE(si->highest_bit)) {
1032 		if (unlikely(--latency_ration < 0)) {
1033 			cond_resched();
1034 			latency_ration = LATENCY_LIMIT;
1035 			scanned_many = true;
1036 		}
1037 		if (swap_offset_available_and_locked(si, offset))
1038 			goto checks;
1039 	}
1040 	offset = si->lowest_bit;
1041 	while (offset < scan_base) {
1042 		if (unlikely(--latency_ration < 0)) {
1043 			cond_resched();
1044 			latency_ration = LATENCY_LIMIT;
1045 			scanned_many = true;
1046 		}
1047 		if (swap_offset_available_and_locked(si, offset))
1048 			goto checks;
1049 		offset++;
1050 	}
1051 	spin_lock(&si->lock);
1052 
1053 no_page:
1054 	si->flags -= SWP_SCANNING;
1055 	return n_ret;
1056 }
1057 
1058 static void swap_free_cluster(struct swap_info_struct *si, unsigned long idx)
1059 {
1060 	unsigned long offset = idx * SWAPFILE_CLUSTER;
1061 	struct swap_cluster_info *ci;
1062 
1063 	ci = lock_cluster(si, offset);
1064 	memset(si->swap_map + offset, 0, SWAPFILE_CLUSTER);
1065 	cluster_set_count_flag(ci, 0, 0);
1066 	free_cluster(si, idx);
1067 	unlock_cluster(ci);
1068 	swap_range_free(si, offset, SWAPFILE_CLUSTER);
1069 }
1070 
1071 int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_order)
1072 {
1073 	int order = swap_entry_order(entry_order);
1074 	unsigned long size = 1 << order;
1075 	struct swap_info_struct *si, *next;
1076 	long avail_pgs;
1077 	int n_ret = 0;
1078 	int node;
1079 
1080 	spin_lock(&swap_avail_lock);
1081 
1082 	avail_pgs = atomic_long_read(&nr_swap_pages) / size;
1083 	if (avail_pgs <= 0) {
1084 		spin_unlock(&swap_avail_lock);
1085 		goto noswap;
1086 	}
1087 
1088 	n_goal = min3((long)n_goal, (long)SWAP_BATCH, avail_pgs);
1089 
1090 	atomic_long_sub(n_goal * size, &nr_swap_pages);
1091 
1092 start_over:
1093 	node = numa_node_id();
1094 	plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) {
1095 		/* requeue si to after same-priority siblings */
1096 		plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]);
1097 		spin_unlock(&swap_avail_lock);
1098 		spin_lock(&si->lock);
1099 		if (!si->highest_bit || !(si->flags & SWP_WRITEOK)) {
1100 			spin_lock(&swap_avail_lock);
1101 			if (plist_node_empty(&si->avail_lists[node])) {
1102 				spin_unlock(&si->lock);
1103 				goto nextsi;
1104 			}
1105 			WARN(!si->highest_bit,
1106 			     "swap_info %d in list but !highest_bit\n",
1107 			     si->type);
1108 			WARN(!(si->flags & SWP_WRITEOK),
1109 			     "swap_info %d in list but !SWP_WRITEOK\n",
1110 			     si->type);
1111 			__del_from_avail_list(si);
1112 			spin_unlock(&si->lock);
1113 			goto nextsi;
1114 		}
1115 		n_ret = scan_swap_map_slots(si, SWAP_HAS_CACHE,
1116 					    n_goal, swp_entries, order);
1117 		spin_unlock(&si->lock);
1118 		if (n_ret || size > 1)
1119 			goto check_out;
1120 		cond_resched();
1121 
1122 		spin_lock(&swap_avail_lock);
1123 nextsi:
1124 		/*
1125 		 * if we got here, it's likely that si was almost full before,
1126 		 * and since scan_swap_map_slots() can drop the si->lock,
1127 		 * multiple callers probably all tried to get a page from the
1128 		 * same si and it filled up before we could get one; or, the si
1129 		 * filled up between us dropping swap_avail_lock and taking
1130 		 * si->lock. Since we dropped the swap_avail_lock, the
1131 		 * swap_avail_head list may have been modified; so if next is
1132 		 * still in the swap_avail_head list then try it, otherwise
1133 		 * start over if we have not gotten any slots.
1134 		 */
1135 		if (plist_node_empty(&next->avail_lists[node]))
1136 			goto start_over;
1137 	}
1138 
1139 	spin_unlock(&swap_avail_lock);
1140 
1141 check_out:
1142 	if (n_ret < n_goal)
1143 		atomic_long_add((long)(n_goal - n_ret) * size,
1144 				&nr_swap_pages);
1145 noswap:
1146 	return n_ret;
1147 }
1148 
1149 static struct swap_info_struct *_swap_info_get(swp_entry_t entry)
1150 {
1151 	struct swap_info_struct *p;
1152 	unsigned long offset;
1153 
1154 	if (!entry.val)
1155 		goto out;
1156 	p = swp_swap_info(entry);
1157 	if (!p)
1158 		goto bad_nofile;
1159 	if (data_race(!(p->flags & SWP_USED)))
1160 		goto bad_device;
1161 	offset = swp_offset(entry);
1162 	if (offset >= p->max)
1163 		goto bad_offset;
1164 	if (data_race(!p->swap_map[swp_offset(entry)]))
1165 		goto bad_free;
1166 	return p;
1167 
1168 bad_free:
1169 	pr_err("%s: %s%08lx\n", __func__, Unused_offset, entry.val);
1170 	goto out;
1171 bad_offset:
1172 	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
1173 	goto out;
1174 bad_device:
1175 	pr_err("%s: %s%08lx\n", __func__, Unused_file, entry.val);
1176 	goto out;
1177 bad_nofile:
1178 	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
1179 out:
1180 	return NULL;
1181 }
1182 
1183 static struct swap_info_struct *swap_info_get_cont(swp_entry_t entry,
1184 					struct swap_info_struct *q)
1185 {
1186 	struct swap_info_struct *p;
1187 
1188 	p = _swap_info_get(entry);
1189 
1190 	if (p != q) {
1191 		if (q != NULL)
1192 			spin_unlock(&q->lock);
1193 		if (p != NULL)
1194 			spin_lock(&p->lock);
1195 	}
1196 	return p;
1197 }
1198 
1199 static unsigned char __swap_entry_free_locked(struct swap_info_struct *p,
1200 					      unsigned long offset,
1201 					      unsigned char usage)
1202 {
1203 	unsigned char count;
1204 	unsigned char has_cache;
1205 
1206 	count = p->swap_map[offset];
1207 
1208 	has_cache = count & SWAP_HAS_CACHE;
1209 	count &= ~SWAP_HAS_CACHE;
1210 
1211 	if (usage == SWAP_HAS_CACHE) {
1212 		VM_BUG_ON(!has_cache);
1213 		has_cache = 0;
1214 	} else if (count == SWAP_MAP_SHMEM) {
1215 		/*
1216 		 * Or we could insist on shmem.c using a special
1217 		 * swap_shmem_free() and free_shmem_swap_and_cache()...
1218 		 */
1219 		count = 0;
1220 	} else if ((count & ~COUNT_CONTINUED) <= SWAP_MAP_MAX) {
1221 		if (count == COUNT_CONTINUED) {
1222 			if (swap_count_continued(p, offset, count))
1223 				count = SWAP_MAP_MAX | COUNT_CONTINUED;
1224 			else
1225 				count = SWAP_MAP_MAX;
1226 		} else
1227 			count--;
1228 	}
1229 
1230 	usage = count | has_cache;
1231 	if (usage)
1232 		WRITE_ONCE(p->swap_map[offset], usage);
1233 	else
1234 		WRITE_ONCE(p->swap_map[offset], SWAP_HAS_CACHE);
1235 
1236 	return usage;
1237 }
1238 
1239 /*
1240  * When we get a swap entry, if there aren't some other ways to
1241  * prevent swapoff, such as the folio in swap cache is locked, RCU
1242  * reader side is locked, etc., the swap entry may become invalid
1243  * because of swapoff.  Then, we need to enclose all swap related
1244  * functions with get_swap_device() and put_swap_device(), unless the
1245  * swap functions call get/put_swap_device() by themselves.
1246  *
1247  * RCU reader side lock (including any spinlock) is sufficient to
1248  * prevent swapoff, because synchronize_rcu() is called in swapoff()
1249  * before freeing data structures.
1250  *
1251  * Check whether swap entry is valid in the swap device.  If so,
1252  * return pointer to swap_info_struct, and keep the swap entry valid
1253  * via preventing the swap device from being swapoff, until
1254  * put_swap_device() is called.  Otherwise return NULL.
1255  *
1256  * Notice that swapoff or swapoff+swapon can still happen before the
1257  * percpu_ref_tryget_live() in get_swap_device() or after the
1258  * percpu_ref_put() in put_swap_device() if there isn't any other way
1259  * to prevent swapoff.  The caller must be prepared for that.  For
1260  * example, the following situation is possible.
1261  *
1262  *   CPU1				CPU2
1263  *   do_swap_page()
1264  *     ...				swapoff+swapon
1265  *     __read_swap_cache_async()
1266  *       swapcache_prepare()
1267  *         __swap_duplicate()
1268  *           // check swap_map
1269  *     // verify PTE not changed
1270  *
1271  * In __swap_duplicate(), the swap_map need to be checked before
1272  * changing partly because the specified swap entry may be for another
1273  * swap device which has been swapoff.  And in do_swap_page(), after
1274  * the page is read from the swap device, the PTE is verified not
1275  * changed with the page table locked to check whether the swap device
1276  * has been swapoff or swapoff+swapon.
1277  */
1278 struct swap_info_struct *get_swap_device(swp_entry_t entry)
1279 {
1280 	struct swap_info_struct *si;
1281 	unsigned long offset;
1282 
1283 	if (!entry.val)
1284 		goto out;
1285 	si = swp_swap_info(entry);
1286 	if (!si)
1287 		goto bad_nofile;
1288 	if (!percpu_ref_tryget_live(&si->users))
1289 		goto out;
1290 	/*
1291 	 * Guarantee the si->users are checked before accessing other
1292 	 * fields of swap_info_struct.
1293 	 *
1294 	 * Paired with the spin_unlock() after setup_swap_info() in
1295 	 * enable_swap_info().
1296 	 */
1297 	smp_rmb();
1298 	offset = swp_offset(entry);
1299 	if (offset >= si->max)
1300 		goto put_out;
1301 
1302 	return si;
1303 bad_nofile:
1304 	pr_err("%s: %s%08lx\n", __func__, Bad_file, entry.val);
1305 out:
1306 	return NULL;
1307 put_out:
1308 	pr_err("%s: %s%08lx\n", __func__, Bad_offset, entry.val);
1309 	percpu_ref_put(&si->users);
1310 	return NULL;
1311 }
1312 
1313 static unsigned char __swap_entry_free(struct swap_info_struct *p,
1314 				       swp_entry_t entry)
1315 {
1316 	struct swap_cluster_info *ci;
1317 	unsigned long offset = swp_offset(entry);
1318 	unsigned char usage;
1319 
1320 	ci = lock_cluster_or_swap_info(p, offset);
1321 	usage = __swap_entry_free_locked(p, offset, 1);
1322 	unlock_cluster_or_swap_info(p, ci);
1323 	if (!usage)
1324 		free_swap_slot(entry);
1325 
1326 	return usage;
1327 }
1328 
1329 static void swap_entry_free(struct swap_info_struct *p, swp_entry_t entry)
1330 {
1331 	struct swap_cluster_info *ci;
1332 	unsigned long offset = swp_offset(entry);
1333 	unsigned char count;
1334 
1335 	ci = lock_cluster(p, offset);
1336 	count = p->swap_map[offset];
1337 	VM_BUG_ON(count != SWAP_HAS_CACHE);
1338 	p->swap_map[offset] = 0;
1339 	dec_cluster_info_page(p, p->cluster_info, offset);
1340 	unlock_cluster(ci);
1341 
1342 	mem_cgroup_uncharge_swap(entry, 1);
1343 	swap_range_free(p, offset, 1);
1344 }
1345 
1346 /*
1347  * Caller has made sure that the swap device corresponding to entry
1348  * is still around or has not been recycled.
1349  */
1350 void swap_free(swp_entry_t entry)
1351 {
1352 	struct swap_info_struct *p;
1353 
1354 	p = _swap_info_get(entry);
1355 	if (p)
1356 		__swap_entry_free(p, entry);
1357 }
1358 
1359 /*
1360  * Called after dropping swapcache to decrease refcnt to swap entries.
1361  */
1362 void put_swap_folio(struct folio *folio, swp_entry_t entry)
1363 {
1364 	unsigned long offset = swp_offset(entry);
1365 	unsigned long idx = offset / SWAPFILE_CLUSTER;
1366 	struct swap_cluster_info *ci;
1367 	struct swap_info_struct *si;
1368 	unsigned char *map;
1369 	unsigned int i, free_entries = 0;
1370 	unsigned char val;
1371 	int size = 1 << swap_entry_order(folio_order(folio));
1372 
1373 	si = _swap_info_get(entry);
1374 	if (!si)
1375 		return;
1376 
1377 	ci = lock_cluster_or_swap_info(si, offset);
1378 	if (size == SWAPFILE_CLUSTER) {
1379 		map = si->swap_map + offset;
1380 		for (i = 0; i < SWAPFILE_CLUSTER; i++) {
1381 			val = map[i];
1382 			VM_BUG_ON(!(val & SWAP_HAS_CACHE));
1383 			if (val == SWAP_HAS_CACHE)
1384 				free_entries++;
1385 		}
1386 		if (free_entries == SWAPFILE_CLUSTER) {
1387 			unlock_cluster_or_swap_info(si, ci);
1388 			spin_lock(&si->lock);
1389 			mem_cgroup_uncharge_swap(entry, SWAPFILE_CLUSTER);
1390 			swap_free_cluster(si, idx);
1391 			spin_unlock(&si->lock);
1392 			return;
1393 		}
1394 	}
1395 	for (i = 0; i < size; i++, entry.val++) {
1396 		if (!__swap_entry_free_locked(si, offset + i, SWAP_HAS_CACHE)) {
1397 			unlock_cluster_or_swap_info(si, ci);
1398 			free_swap_slot(entry);
1399 			if (i == size - 1)
1400 				return;
1401 			lock_cluster_or_swap_info(si, offset);
1402 		}
1403 	}
1404 	unlock_cluster_or_swap_info(si, ci);
1405 }
1406 
1407 static int swp_entry_cmp(const void *ent1, const void *ent2)
1408 {
1409 	const swp_entry_t *e1 = ent1, *e2 = ent2;
1410 
1411 	return (int)swp_type(*e1) - (int)swp_type(*e2);
1412 }
1413 
1414 void swapcache_free_entries(swp_entry_t *entries, int n)
1415 {
1416 	struct swap_info_struct *p, *prev;
1417 	int i;
1418 
1419 	if (n <= 0)
1420 		return;
1421 
1422 	prev = NULL;
1423 	p = NULL;
1424 
1425 	/*
1426 	 * Sort swap entries by swap device, so each lock is only taken once.
1427 	 * nr_swapfiles isn't absolutely correct, but the overhead of sort() is
1428 	 * so low that it isn't necessary to optimize further.
1429 	 */
1430 	if (nr_swapfiles > 1)
1431 		sort(entries, n, sizeof(entries[0]), swp_entry_cmp, NULL);
1432 	for (i = 0; i < n; ++i) {
1433 		p = swap_info_get_cont(entries[i], prev);
1434 		if (p)
1435 			swap_entry_free(p, entries[i]);
1436 		prev = p;
1437 	}
1438 	if (p)
1439 		spin_unlock(&p->lock);
1440 }
1441 
1442 int __swap_count(swp_entry_t entry)
1443 {
1444 	struct swap_info_struct *si = swp_swap_info(entry);
1445 	pgoff_t offset = swp_offset(entry);
1446 
1447 	return swap_count(si->swap_map[offset]);
1448 }
1449 
1450 /*
1451  * How many references to @entry are currently swapped out?
1452  * This does not give an exact answer when swap count is continued,
1453  * but does include the high COUNT_CONTINUED flag to allow for that.
1454  */
1455 int swap_swapcount(struct swap_info_struct *si, swp_entry_t entry)
1456 {
1457 	pgoff_t offset = swp_offset(entry);
1458 	struct swap_cluster_info *ci;
1459 	int count;
1460 
1461 	ci = lock_cluster_or_swap_info(si, offset);
1462 	count = swap_count(si->swap_map[offset]);
1463 	unlock_cluster_or_swap_info(si, ci);
1464 	return count;
1465 }
1466 
1467 /*
1468  * How many references to @entry are currently swapped out?
1469  * This considers COUNT_CONTINUED so it returns exact answer.
1470  */
1471 int swp_swapcount(swp_entry_t entry)
1472 {
1473 	int count, tmp_count, n;
1474 	struct swap_info_struct *p;
1475 	struct swap_cluster_info *ci;
1476 	struct page *page;
1477 	pgoff_t offset;
1478 	unsigned char *map;
1479 
1480 	p = _swap_info_get(entry);
1481 	if (!p)
1482 		return 0;
1483 
1484 	offset = swp_offset(entry);
1485 
1486 	ci = lock_cluster_or_swap_info(p, offset);
1487 
1488 	count = swap_count(p->swap_map[offset]);
1489 	if (!(count & COUNT_CONTINUED))
1490 		goto out;
1491 
1492 	count &= ~COUNT_CONTINUED;
1493 	n = SWAP_MAP_MAX + 1;
1494 
1495 	page = vmalloc_to_page(p->swap_map + offset);
1496 	offset &= ~PAGE_MASK;
1497 	VM_BUG_ON(page_private(page) != SWP_CONTINUED);
1498 
1499 	do {
1500 		page = list_next_entry(page, lru);
1501 		map = kmap_local_page(page);
1502 		tmp_count = map[offset];
1503 		kunmap_local(map);
1504 
1505 		count += (tmp_count & ~COUNT_CONTINUED) * n;
1506 		n *= (SWAP_CONT_MAX + 1);
1507 	} while (tmp_count & COUNT_CONTINUED);
1508 out:
1509 	unlock_cluster_or_swap_info(p, ci);
1510 	return count;
1511 }
1512 
1513 static bool swap_page_trans_huge_swapped(struct swap_info_struct *si,
1514 					 swp_entry_t entry, int order)
1515 {
1516 	struct swap_cluster_info *ci;
1517 	unsigned char *map = si->swap_map;
1518 	unsigned int nr_pages = 1 << order;
1519 	unsigned long roffset = swp_offset(entry);
1520 	unsigned long offset = round_down(roffset, nr_pages);
1521 	int i;
1522 	bool ret = false;
1523 
1524 	ci = lock_cluster_or_swap_info(si, offset);
1525 	if (!ci || nr_pages == 1) {
1526 		if (swap_count(map[roffset]))
1527 			ret = true;
1528 		goto unlock_out;
1529 	}
1530 	for (i = 0; i < nr_pages; i++) {
1531 		if (swap_count(map[offset + i])) {
1532 			ret = true;
1533 			break;
1534 		}
1535 	}
1536 unlock_out:
1537 	unlock_cluster_or_swap_info(si, ci);
1538 	return ret;
1539 }
1540 
1541 static bool folio_swapped(struct folio *folio)
1542 {
1543 	swp_entry_t entry = folio->swap;
1544 	struct swap_info_struct *si = _swap_info_get(entry);
1545 
1546 	if (!si)
1547 		return false;
1548 
1549 	if (!IS_ENABLED(CONFIG_THP_SWAP) || likely(!folio_test_large(folio)))
1550 		return swap_swapcount(si, entry) != 0;
1551 
1552 	return swap_page_trans_huge_swapped(si, entry, folio_order(folio));
1553 }
1554 
1555 /**
1556  * folio_free_swap() - Free the swap space used for this folio.
1557  * @folio: The folio to remove.
1558  *
1559  * If swap is getting full, or if there are no more mappings of this folio,
1560  * then call folio_free_swap to free its swap space.
1561  *
1562  * Return: true if we were able to release the swap space.
1563  */
1564 bool folio_free_swap(struct folio *folio)
1565 {
1566 	VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio);
1567 
1568 	if (!folio_test_swapcache(folio))
1569 		return false;
1570 	if (folio_test_writeback(folio))
1571 		return false;
1572 	if (folio_swapped(folio))
1573 		return false;
1574 
1575 	/*
1576 	 * Once hibernation has begun to create its image of memory,
1577 	 * there's a danger that one of the calls to folio_free_swap()
1578 	 * - most probably a call from __try_to_reclaim_swap() while
1579 	 * hibernation is allocating its own swap pages for the image,
1580 	 * but conceivably even a call from memory reclaim - will free
1581 	 * the swap from a folio which has already been recorded in the
1582 	 * image as a clean swapcache folio, and then reuse its swap for
1583 	 * another page of the image.  On waking from hibernation, the
1584 	 * original folio might be freed under memory pressure, then
1585 	 * later read back in from swap, now with the wrong data.
1586 	 *
1587 	 * Hibernation suspends storage while it is writing the image
1588 	 * to disk so check that here.
1589 	 */
1590 	if (pm_suspended_storage())
1591 		return false;
1592 
1593 	delete_from_swap_cache(folio);
1594 	folio_set_dirty(folio);
1595 	return true;
1596 }
1597 
1598 /**
1599  * free_swap_and_cache_nr() - Release reference on range of swap entries and
1600  *                            reclaim their cache if no more references remain.
1601  * @entry: First entry of range.
1602  * @nr: Number of entries in range.
1603  *
1604  * For each swap entry in the contiguous range, release a reference. If any swap
1605  * entries become free, try to reclaim their underlying folios, if present. The
1606  * offset range is defined by [entry.offset, entry.offset + nr).
1607  */
1608 void free_swap_and_cache_nr(swp_entry_t entry, int nr)
1609 {
1610 	const unsigned long start_offset = swp_offset(entry);
1611 	const unsigned long end_offset = start_offset + nr;
1612 	unsigned int type = swp_type(entry);
1613 	struct swap_info_struct *si;
1614 	bool any_only_cache = false;
1615 	unsigned long offset;
1616 	unsigned char count;
1617 
1618 	if (non_swap_entry(entry))
1619 		return;
1620 
1621 	si = get_swap_device(entry);
1622 	if (!si)
1623 		return;
1624 
1625 	if (WARN_ON(end_offset > si->max))
1626 		goto out;
1627 
1628 	/*
1629 	 * First free all entries in the range.
1630 	 */
1631 	for (offset = start_offset; offset < end_offset; offset++) {
1632 		if (data_race(si->swap_map[offset])) {
1633 			count = __swap_entry_free(si, swp_entry(type, offset));
1634 			if (count == SWAP_HAS_CACHE)
1635 				any_only_cache = true;
1636 		} else {
1637 			WARN_ON_ONCE(1);
1638 		}
1639 	}
1640 
1641 	/*
1642 	 * Short-circuit the below loop if none of the entries had their
1643 	 * reference drop to zero.
1644 	 */
1645 	if (!any_only_cache)
1646 		goto out;
1647 
1648 	/*
1649 	 * Now go back over the range trying to reclaim the swap cache. This is
1650 	 * more efficient for large folios because we will only try to reclaim
1651 	 * the swap once per folio in the common case. If we do
1652 	 * __swap_entry_free() and __try_to_reclaim_swap() in the same loop, the
1653 	 * latter will get a reference and lock the folio for every individual
1654 	 * page but will only succeed once the swap slot for every subpage is
1655 	 * zero.
1656 	 */
1657 	for (offset = start_offset; offset < end_offset; offset += nr) {
1658 		nr = 1;
1659 		if (READ_ONCE(si->swap_map[offset]) == SWAP_HAS_CACHE) {
1660 			/*
1661 			 * Folios are always naturally aligned in swap so
1662 			 * advance forward to the next boundary. Zero means no
1663 			 * folio was found for the swap entry, so advance by 1
1664 			 * in this case. Negative value means folio was found
1665 			 * but could not be reclaimed. Here we can still advance
1666 			 * to the next boundary.
1667 			 */
1668 			nr = __try_to_reclaim_swap(si, offset,
1669 					      TTRS_UNMAPPED | TTRS_FULL);
1670 			if (nr == 0)
1671 				nr = 1;
1672 			else if (nr < 0)
1673 				nr = -nr;
1674 			nr = ALIGN(offset + 1, nr) - offset;
1675 		}
1676 	}
1677 
1678 out:
1679 	put_swap_device(si);
1680 }
1681 
1682 #ifdef CONFIG_HIBERNATION
1683 
1684 swp_entry_t get_swap_page_of_type(int type)
1685 {
1686 	struct swap_info_struct *si = swap_type_to_swap_info(type);
1687 	swp_entry_t entry = {0};
1688 
1689 	if (!si)
1690 		goto fail;
1691 
1692 	/* This is called for allocating swap entry, not cache */
1693 	spin_lock(&si->lock);
1694 	if ((si->flags & SWP_WRITEOK) && scan_swap_map_slots(si, 1, 1, &entry, 0))
1695 		atomic_long_dec(&nr_swap_pages);
1696 	spin_unlock(&si->lock);
1697 fail:
1698 	return entry;
1699 }
1700 
1701 /*
1702  * Find the swap type that corresponds to given device (if any).
1703  *
1704  * @offset - number of the PAGE_SIZE-sized block of the device, starting
1705  * from 0, in which the swap header is expected to be located.
1706  *
1707  * This is needed for the suspend to disk (aka swsusp).
1708  */
1709 int swap_type_of(dev_t device, sector_t offset)
1710 {
1711 	int type;
1712 
1713 	if (!device)
1714 		return -1;
1715 
1716 	spin_lock(&swap_lock);
1717 	for (type = 0; type < nr_swapfiles; type++) {
1718 		struct swap_info_struct *sis = swap_info[type];
1719 
1720 		if (!(sis->flags & SWP_WRITEOK))
1721 			continue;
1722 
1723 		if (device == sis->bdev->bd_dev) {
1724 			struct swap_extent *se = first_se(sis);
1725 
1726 			if (se->start_block == offset) {
1727 				spin_unlock(&swap_lock);
1728 				return type;
1729 			}
1730 		}
1731 	}
1732 	spin_unlock(&swap_lock);
1733 	return -ENODEV;
1734 }
1735 
1736 int find_first_swap(dev_t *device)
1737 {
1738 	int type;
1739 
1740 	spin_lock(&swap_lock);
1741 	for (type = 0; type < nr_swapfiles; type++) {
1742 		struct swap_info_struct *sis = swap_info[type];
1743 
1744 		if (!(sis->flags & SWP_WRITEOK))
1745 			continue;
1746 		*device = sis->bdev->bd_dev;
1747 		spin_unlock(&swap_lock);
1748 		return type;
1749 	}
1750 	spin_unlock(&swap_lock);
1751 	return -ENODEV;
1752 }
1753 
1754 /*
1755  * Get the (PAGE_SIZE) block corresponding to given offset on the swapdev
1756  * corresponding to given index in swap_info (swap type).
1757  */
1758 sector_t swapdev_block(int type, pgoff_t offset)
1759 {
1760 	struct swap_info_struct *si = swap_type_to_swap_info(type);
1761 	struct swap_extent *se;
1762 
1763 	if (!si || !(si->flags & SWP_WRITEOK))
1764 		return 0;
1765 	se = offset_to_swap_extent(si, offset);
1766 	return se->start_block + (offset - se->start_page);
1767 }
1768 
1769 /*
1770  * Return either the total number of swap pages of given type, or the number
1771  * of free pages of that type (depending on @free)
1772  *
1773  * This is needed for software suspend
1774  */
1775 unsigned int count_swap_pages(int type, int free)
1776 {
1777 	unsigned int n = 0;
1778 
1779 	spin_lock(&swap_lock);
1780 	if ((unsigned int)type < nr_swapfiles) {
1781 		struct swap_info_struct *sis = swap_info[type];
1782 
1783 		spin_lock(&sis->lock);
1784 		if (sis->flags & SWP_WRITEOK) {
1785 			n = sis->pages;
1786 			if (free)
1787 				n -= sis->inuse_pages;
1788 		}
1789 		spin_unlock(&sis->lock);
1790 	}
1791 	spin_unlock(&swap_lock);
1792 	return n;
1793 }
1794 #endif /* CONFIG_HIBERNATION */
1795 
1796 static inline int pte_same_as_swp(pte_t pte, pte_t swp_pte)
1797 {
1798 	return pte_same(pte_swp_clear_flags(pte), swp_pte);
1799 }
1800 
1801 /*
1802  * No need to decide whether this PTE shares the swap entry with others,
1803  * just let do_wp_page work it out if a write is requested later - to
1804  * force COW, vm_page_prot omits write permission from any private vma.
1805  */
1806 static int unuse_pte(struct vm_area_struct *vma, pmd_t *pmd,
1807 		unsigned long addr, swp_entry_t entry, struct folio *folio)
1808 {
1809 	struct page *page;
1810 	struct folio *swapcache;
1811 	spinlock_t *ptl;
1812 	pte_t *pte, new_pte, old_pte;
1813 	bool hwpoisoned = false;
1814 	int ret = 1;
1815 
1816 	swapcache = folio;
1817 	folio = ksm_might_need_to_copy(folio, vma, addr);
1818 	if (unlikely(!folio))
1819 		return -ENOMEM;
1820 	else if (unlikely(folio == ERR_PTR(-EHWPOISON))) {
1821 		hwpoisoned = true;
1822 		folio = swapcache;
1823 	}
1824 
1825 	page = folio_file_page(folio, swp_offset(entry));
1826 	if (PageHWPoison(page))
1827 		hwpoisoned = true;
1828 
1829 	pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
1830 	if (unlikely(!pte || !pte_same_as_swp(ptep_get(pte),
1831 						swp_entry_to_pte(entry)))) {
1832 		ret = 0;
1833 		goto out;
1834 	}
1835 
1836 	old_pte = ptep_get(pte);
1837 
1838 	if (unlikely(hwpoisoned || !folio_test_uptodate(folio))) {
1839 		swp_entry_t swp_entry;
1840 
1841 		dec_mm_counter(vma->vm_mm, MM_SWAPENTS);
1842 		if (hwpoisoned) {
1843 			swp_entry = make_hwpoison_entry(page);
1844 		} else {
1845 			swp_entry = make_poisoned_swp_entry();
1846 		}
1847 		new_pte = swp_entry_to_pte(swp_entry);
1848 		ret = 0;
1849 		goto setpte;
1850 	}
1851 
1852 	/*
1853 	 * Some architectures may have to restore extra metadata to the page
1854 	 * when reading from swap. This metadata may be indexed by swap entry
1855 	 * so this must be called before swap_free().
1856 	 */
1857 	arch_swap_restore(folio_swap(entry, folio), folio);
1858 
1859 	dec_mm_counter(vma->vm_mm, MM_SWAPENTS);
1860 	inc_mm_counter(vma->vm_mm, MM_ANONPAGES);
1861 	folio_get(folio);
1862 	if (folio == swapcache) {
1863 		rmap_t rmap_flags = RMAP_NONE;
1864 
1865 		/*
1866 		 * See do_swap_page(): writeback would be problematic.
1867 		 * However, we do a folio_wait_writeback() just before this
1868 		 * call and have the folio locked.
1869 		 */
1870 		VM_BUG_ON_FOLIO(folio_test_writeback(folio), folio);
1871 		if (pte_swp_exclusive(old_pte))
1872 			rmap_flags |= RMAP_EXCLUSIVE;
1873 
1874 		folio_add_anon_rmap_pte(folio, page, vma, addr, rmap_flags);
1875 	} else { /* ksm created a completely new copy */
1876 		folio_add_new_anon_rmap(folio, vma, addr);
1877 		folio_add_lru_vma(folio, vma);
1878 	}
1879 	new_pte = pte_mkold(mk_pte(page, vma->vm_page_prot));
1880 	if (pte_swp_soft_dirty(old_pte))
1881 		new_pte = pte_mksoft_dirty(new_pte);
1882 	if (pte_swp_uffd_wp(old_pte))
1883 		new_pte = pte_mkuffd_wp(new_pte);
1884 setpte:
1885 	set_pte_at(vma->vm_mm, addr, pte, new_pte);
1886 	swap_free(entry);
1887 out:
1888 	if (pte)
1889 		pte_unmap_unlock(pte, ptl);
1890 	if (folio != swapcache) {
1891 		folio_unlock(folio);
1892 		folio_put(folio);
1893 	}
1894 	return ret;
1895 }
1896 
1897 static int unuse_pte_range(struct vm_area_struct *vma, pmd_t *pmd,
1898 			unsigned long addr, unsigned long end,
1899 			unsigned int type)
1900 {
1901 	pte_t *pte = NULL;
1902 	struct swap_info_struct *si;
1903 
1904 	si = swap_info[type];
1905 	do {
1906 		struct folio *folio;
1907 		unsigned long offset;
1908 		unsigned char swp_count;
1909 		swp_entry_t entry;
1910 		int ret;
1911 		pte_t ptent;
1912 
1913 		if (!pte++) {
1914 			pte = pte_offset_map(pmd, addr);
1915 			if (!pte)
1916 				break;
1917 		}
1918 
1919 		ptent = ptep_get_lockless(pte);
1920 
1921 		if (!is_swap_pte(ptent))
1922 			continue;
1923 
1924 		entry = pte_to_swp_entry(ptent);
1925 		if (swp_type(entry) != type)
1926 			continue;
1927 
1928 		offset = swp_offset(entry);
1929 		pte_unmap(pte);
1930 		pte = NULL;
1931 
1932 		folio = swap_cache_get_folio(entry, vma, addr);
1933 		if (!folio) {
1934 			struct page *page;
1935 			struct vm_fault vmf = {
1936 				.vma = vma,
1937 				.address = addr,
1938 				.real_address = addr,
1939 				.pmd = pmd,
1940 			};
1941 
1942 			page = swapin_readahead(entry, GFP_HIGHUSER_MOVABLE,
1943 						&vmf);
1944 			if (page)
1945 				folio = page_folio(page);
1946 		}
1947 		if (!folio) {
1948 			swp_count = READ_ONCE(si->swap_map[offset]);
1949 			if (swp_count == 0 || swp_count == SWAP_MAP_BAD)
1950 				continue;
1951 			return -ENOMEM;
1952 		}
1953 
1954 		folio_lock(folio);
1955 		folio_wait_writeback(folio);
1956 		ret = unuse_pte(vma, pmd, addr, entry, folio);
1957 		if (ret < 0) {
1958 			folio_unlock(folio);
1959 			folio_put(folio);
1960 			return ret;
1961 		}
1962 
1963 		folio_free_swap(folio);
1964 		folio_unlock(folio);
1965 		folio_put(folio);
1966 	} while (addr += PAGE_SIZE, addr != end);
1967 
1968 	if (pte)
1969 		pte_unmap(pte);
1970 	return 0;
1971 }
1972 
1973 static inline int unuse_pmd_range(struct vm_area_struct *vma, pud_t *pud,
1974 				unsigned long addr, unsigned long end,
1975 				unsigned int type)
1976 {
1977 	pmd_t *pmd;
1978 	unsigned long next;
1979 	int ret;
1980 
1981 	pmd = pmd_offset(pud, addr);
1982 	do {
1983 		cond_resched();
1984 		next = pmd_addr_end(addr, end);
1985 		ret = unuse_pte_range(vma, pmd, addr, next, type);
1986 		if (ret)
1987 			return ret;
1988 	} while (pmd++, addr = next, addr != end);
1989 	return 0;
1990 }
1991 
1992 static inline int unuse_pud_range(struct vm_area_struct *vma, p4d_t *p4d,
1993 				unsigned long addr, unsigned long end,
1994 				unsigned int type)
1995 {
1996 	pud_t *pud;
1997 	unsigned long next;
1998 	int ret;
1999 
2000 	pud = pud_offset(p4d, addr);
2001 	do {
2002 		next = pud_addr_end(addr, end);
2003 		if (pud_none_or_clear_bad(pud))
2004 			continue;
2005 		ret = unuse_pmd_range(vma, pud, addr, next, type);
2006 		if (ret)
2007 			return ret;
2008 	} while (pud++, addr = next, addr != end);
2009 	return 0;
2010 }
2011 
2012 static inline int unuse_p4d_range(struct vm_area_struct *vma, pgd_t *pgd,
2013 				unsigned long addr, unsigned long end,
2014 				unsigned int type)
2015 {
2016 	p4d_t *p4d;
2017 	unsigned long next;
2018 	int ret;
2019 
2020 	p4d = p4d_offset(pgd, addr);
2021 	do {
2022 		next = p4d_addr_end(addr, end);
2023 		if (p4d_none_or_clear_bad(p4d))
2024 			continue;
2025 		ret = unuse_pud_range(vma, p4d, addr, next, type);
2026 		if (ret)
2027 			return ret;
2028 	} while (p4d++, addr = next, addr != end);
2029 	return 0;
2030 }
2031 
2032 static int unuse_vma(struct vm_area_struct *vma, unsigned int type)
2033 {
2034 	pgd_t *pgd;
2035 	unsigned long addr, end, next;
2036 	int ret;
2037 
2038 	addr = vma->vm_start;
2039 	end = vma->vm_end;
2040 
2041 	pgd = pgd_offset(vma->vm_mm, addr);
2042 	do {
2043 		next = pgd_addr_end(addr, end);
2044 		if (pgd_none_or_clear_bad(pgd))
2045 			continue;
2046 		ret = unuse_p4d_range(vma, pgd, addr, next, type);
2047 		if (ret)
2048 			return ret;
2049 	} while (pgd++, addr = next, addr != end);
2050 	return 0;
2051 }
2052 
2053 static int unuse_mm(struct mm_struct *mm, unsigned int type)
2054 {
2055 	struct vm_area_struct *vma;
2056 	int ret = 0;
2057 	VMA_ITERATOR(vmi, mm, 0);
2058 
2059 	mmap_read_lock(mm);
2060 	for_each_vma(vmi, vma) {
2061 		if (vma->anon_vma) {
2062 			ret = unuse_vma(vma, type);
2063 			if (ret)
2064 				break;
2065 		}
2066 
2067 		cond_resched();
2068 	}
2069 	mmap_read_unlock(mm);
2070 	return ret;
2071 }
2072 
2073 /*
2074  * Scan swap_map from current position to next entry still in use.
2075  * Return 0 if there are no inuse entries after prev till end of
2076  * the map.
2077  */
2078 static unsigned int find_next_to_unuse(struct swap_info_struct *si,
2079 					unsigned int prev)
2080 {
2081 	unsigned int i;
2082 	unsigned char count;
2083 
2084 	/*
2085 	 * No need for swap_lock here: we're just looking
2086 	 * for whether an entry is in use, not modifying it; false
2087 	 * hits are okay, and sys_swapoff() has already prevented new
2088 	 * allocations from this area (while holding swap_lock).
2089 	 */
2090 	for (i = prev + 1; i < si->max; i++) {
2091 		count = READ_ONCE(si->swap_map[i]);
2092 		if (count && swap_count(count) != SWAP_MAP_BAD)
2093 			break;
2094 		if ((i % LATENCY_LIMIT) == 0)
2095 			cond_resched();
2096 	}
2097 
2098 	if (i == si->max)
2099 		i = 0;
2100 
2101 	return i;
2102 }
2103 
2104 static int try_to_unuse(unsigned int type)
2105 {
2106 	struct mm_struct *prev_mm;
2107 	struct mm_struct *mm;
2108 	struct list_head *p;
2109 	int retval = 0;
2110 	struct swap_info_struct *si = swap_info[type];
2111 	struct folio *folio;
2112 	swp_entry_t entry;
2113 	unsigned int i;
2114 
2115 	if (!READ_ONCE(si->inuse_pages))
2116 		goto success;
2117 
2118 retry:
2119 	retval = shmem_unuse(type);
2120 	if (retval)
2121 		return retval;
2122 
2123 	prev_mm = &init_mm;
2124 	mmget(prev_mm);
2125 
2126 	spin_lock(&mmlist_lock);
2127 	p = &init_mm.mmlist;
2128 	while (READ_ONCE(si->inuse_pages) &&
2129 	       !signal_pending(current) &&
2130 	       (p = p->next) != &init_mm.mmlist) {
2131 
2132 		mm = list_entry(p, struct mm_struct, mmlist);
2133 		if (!mmget_not_zero(mm))
2134 			continue;
2135 		spin_unlock(&mmlist_lock);
2136 		mmput(prev_mm);
2137 		prev_mm = mm;
2138 		retval = unuse_mm(mm, type);
2139 		if (retval) {
2140 			mmput(prev_mm);
2141 			return retval;
2142 		}
2143 
2144 		/*
2145 		 * Make sure that we aren't completely killing
2146 		 * interactive performance.
2147 		 */
2148 		cond_resched();
2149 		spin_lock(&mmlist_lock);
2150 	}
2151 	spin_unlock(&mmlist_lock);
2152 
2153 	mmput(prev_mm);
2154 
2155 	i = 0;
2156 	while (READ_ONCE(si->inuse_pages) &&
2157 	       !signal_pending(current) &&
2158 	       (i = find_next_to_unuse(si, i)) != 0) {
2159 
2160 		entry = swp_entry(type, i);
2161 		folio = filemap_get_folio(swap_address_space(entry), i);
2162 		if (IS_ERR(folio))
2163 			continue;
2164 
2165 		/*
2166 		 * It is conceivable that a racing task removed this folio from
2167 		 * swap cache just before we acquired the page lock. The folio
2168 		 * might even be back in swap cache on another swap area. But
2169 		 * that is okay, folio_free_swap() only removes stale folios.
2170 		 */
2171 		folio_lock(folio);
2172 		folio_wait_writeback(folio);
2173 		folio_free_swap(folio);
2174 		folio_unlock(folio);
2175 		folio_put(folio);
2176 	}
2177 
2178 	/*
2179 	 * Lets check again to see if there are still swap entries in the map.
2180 	 * If yes, we would need to do retry the unuse logic again.
2181 	 * Under global memory pressure, swap entries can be reinserted back
2182 	 * into process space after the mmlist loop above passes over them.
2183 	 *
2184 	 * Limit the number of retries? No: when mmget_not_zero()
2185 	 * above fails, that mm is likely to be freeing swap from
2186 	 * exit_mmap(), which proceeds at its own independent pace;
2187 	 * and even shmem_writepage() could have been preempted after
2188 	 * folio_alloc_swap(), temporarily hiding that swap.  It's easy
2189 	 * and robust (though cpu-intensive) just to keep retrying.
2190 	 */
2191 	if (READ_ONCE(si->inuse_pages)) {
2192 		if (!signal_pending(current))
2193 			goto retry;
2194 		return -EINTR;
2195 	}
2196 
2197 success:
2198 	/*
2199 	 * Make sure that further cleanups after try_to_unuse() returns happen
2200 	 * after swap_range_free() reduces si->inuse_pages to 0.
2201 	 */
2202 	smp_mb();
2203 	return 0;
2204 }
2205 
2206 /*
2207  * After a successful try_to_unuse, if no swap is now in use, we know
2208  * we can empty the mmlist.  swap_lock must be held on entry and exit.
2209  * Note that mmlist_lock nests inside swap_lock, and an mm must be
2210  * added to the mmlist just after page_duplicate - before would be racy.
2211  */
2212 static void drain_mmlist(void)
2213 {
2214 	struct list_head *p, *next;
2215 	unsigned int type;
2216 
2217 	for (type = 0; type < nr_swapfiles; type++)
2218 		if (swap_info[type]->inuse_pages)
2219 			return;
2220 	spin_lock(&mmlist_lock);
2221 	list_for_each_safe(p, next, &init_mm.mmlist)
2222 		list_del_init(p);
2223 	spin_unlock(&mmlist_lock);
2224 }
2225 
2226 /*
2227  * Free all of a swapdev's extent information
2228  */
2229 static void destroy_swap_extents(struct swap_info_struct *sis)
2230 {
2231 	while (!RB_EMPTY_ROOT(&sis->swap_extent_root)) {
2232 		struct rb_node *rb = sis->swap_extent_root.rb_node;
2233 		struct swap_extent *se = rb_entry(rb, struct swap_extent, rb_node);
2234 
2235 		rb_erase(rb, &sis->swap_extent_root);
2236 		kfree(se);
2237 	}
2238 
2239 	if (sis->flags & SWP_ACTIVATED) {
2240 		struct file *swap_file = sis->swap_file;
2241 		struct address_space *mapping = swap_file->f_mapping;
2242 
2243 		sis->flags &= ~SWP_ACTIVATED;
2244 		if (mapping->a_ops->swap_deactivate)
2245 			mapping->a_ops->swap_deactivate(swap_file);
2246 	}
2247 }
2248 
2249 /*
2250  * Add a block range (and the corresponding page range) into this swapdev's
2251  * extent tree.
2252  *
2253  * This function rather assumes that it is called in ascending page order.
2254  */
2255 int
2256 add_swap_extent(struct swap_info_struct *sis, unsigned long start_page,
2257 		unsigned long nr_pages, sector_t start_block)
2258 {
2259 	struct rb_node **link = &sis->swap_extent_root.rb_node, *parent = NULL;
2260 	struct swap_extent *se;
2261 	struct swap_extent *new_se;
2262 
2263 	/*
2264 	 * place the new node at the right most since the
2265 	 * function is called in ascending page order.
2266 	 */
2267 	while (*link) {
2268 		parent = *link;
2269 		link = &parent->rb_right;
2270 	}
2271 
2272 	if (parent) {
2273 		se = rb_entry(parent, struct swap_extent, rb_node);
2274 		BUG_ON(se->start_page + se->nr_pages != start_page);
2275 		if (se->start_block + se->nr_pages == start_block) {
2276 			/* Merge it */
2277 			se->nr_pages += nr_pages;
2278 			return 0;
2279 		}
2280 	}
2281 
2282 	/* No merge, insert a new extent. */
2283 	new_se = kmalloc(sizeof(*se), GFP_KERNEL);
2284 	if (new_se == NULL)
2285 		return -ENOMEM;
2286 	new_se->start_page = start_page;
2287 	new_se->nr_pages = nr_pages;
2288 	new_se->start_block = start_block;
2289 
2290 	rb_link_node(&new_se->rb_node, parent, link);
2291 	rb_insert_color(&new_se->rb_node, &sis->swap_extent_root);
2292 	return 1;
2293 }
2294 EXPORT_SYMBOL_GPL(add_swap_extent);
2295 
2296 /*
2297  * A `swap extent' is a simple thing which maps a contiguous range of pages
2298  * onto a contiguous range of disk blocks.  A rbtree of swap extents is
2299  * built at swapon time and is then used at swap_writepage/swap_read_folio
2300  * time for locating where on disk a page belongs.
2301  *
2302  * If the swapfile is an S_ISBLK block device, a single extent is installed.
2303  * This is done so that the main operating code can treat S_ISBLK and S_ISREG
2304  * swap files identically.
2305  *
2306  * Whether the swapdev is an S_ISREG file or an S_ISBLK blockdev, the swap
2307  * extent rbtree operates in PAGE_SIZE disk blocks.  Both S_ISREG and S_ISBLK
2308  * swapfiles are handled *identically* after swapon time.
2309  *
2310  * For S_ISREG swapfiles, setup_swap_extents() will walk all the file's blocks
2311  * and will parse them into a rbtree, in PAGE_SIZE chunks.  If some stray
2312  * blocks are found which do not fall within the PAGE_SIZE alignment
2313  * requirements, they are simply tossed out - we will never use those blocks
2314  * for swapping.
2315  *
2316  * For all swap devices we set S_SWAPFILE across the life of the swapon.  This
2317  * prevents users from writing to the swap device, which will corrupt memory.
2318  *
2319  * The amount of disk space which a single swap extent represents varies.
2320  * Typically it is in the 1-4 megabyte range.  So we can have hundreds of
2321  * extents in the rbtree. - akpm.
2322  */
2323 static int setup_swap_extents(struct swap_info_struct *sis, sector_t *span)
2324 {
2325 	struct file *swap_file = sis->swap_file;
2326 	struct address_space *mapping = swap_file->f_mapping;
2327 	struct inode *inode = mapping->host;
2328 	int ret;
2329 
2330 	if (S_ISBLK(inode->i_mode)) {
2331 		ret = add_swap_extent(sis, 0, sis->max, 0);
2332 		*span = sis->pages;
2333 		return ret;
2334 	}
2335 
2336 	if (mapping->a_ops->swap_activate) {
2337 		ret = mapping->a_ops->swap_activate(sis, swap_file, span);
2338 		if (ret < 0)
2339 			return ret;
2340 		sis->flags |= SWP_ACTIVATED;
2341 		if ((sis->flags & SWP_FS_OPS) &&
2342 		    sio_pool_init() != 0) {
2343 			destroy_swap_extents(sis);
2344 			return -ENOMEM;
2345 		}
2346 		return ret;
2347 	}
2348 
2349 	return generic_swapfile_activate(sis, swap_file, span);
2350 }
2351 
2352 static int swap_node(struct swap_info_struct *p)
2353 {
2354 	struct block_device *bdev;
2355 
2356 	if (p->bdev)
2357 		bdev = p->bdev;
2358 	else
2359 		bdev = p->swap_file->f_inode->i_sb->s_bdev;
2360 
2361 	return bdev ? bdev->bd_disk->node_id : NUMA_NO_NODE;
2362 }
2363 
2364 static void setup_swap_info(struct swap_info_struct *p, int prio,
2365 			    unsigned char *swap_map,
2366 			    struct swap_cluster_info *cluster_info)
2367 {
2368 	int i;
2369 
2370 	if (prio >= 0)
2371 		p->prio = prio;
2372 	else
2373 		p->prio = --least_priority;
2374 	/*
2375 	 * the plist prio is negated because plist ordering is
2376 	 * low-to-high, while swap ordering is high-to-low
2377 	 */
2378 	p->list.prio = -p->prio;
2379 	for_each_node(i) {
2380 		if (p->prio >= 0)
2381 			p->avail_lists[i].prio = -p->prio;
2382 		else {
2383 			if (swap_node(p) == i)
2384 				p->avail_lists[i].prio = 1;
2385 			else
2386 				p->avail_lists[i].prio = -p->prio;
2387 		}
2388 	}
2389 	p->swap_map = swap_map;
2390 	p->cluster_info = cluster_info;
2391 }
2392 
2393 static void _enable_swap_info(struct swap_info_struct *p)
2394 {
2395 	p->flags |= SWP_WRITEOK;
2396 	atomic_long_add(p->pages, &nr_swap_pages);
2397 	total_swap_pages += p->pages;
2398 
2399 	assert_spin_locked(&swap_lock);
2400 	/*
2401 	 * both lists are plists, and thus priority ordered.
2402 	 * swap_active_head needs to be priority ordered for swapoff(),
2403 	 * which on removal of any swap_info_struct with an auto-assigned
2404 	 * (i.e. negative) priority increments the auto-assigned priority
2405 	 * of any lower-priority swap_info_structs.
2406 	 * swap_avail_head needs to be priority ordered for folio_alloc_swap(),
2407 	 * which allocates swap pages from the highest available priority
2408 	 * swap_info_struct.
2409 	 */
2410 	plist_add(&p->list, &swap_active_head);
2411 
2412 	/* add to available list iff swap device is not full */
2413 	if (p->highest_bit)
2414 		add_to_avail_list(p);
2415 }
2416 
2417 static void enable_swap_info(struct swap_info_struct *p, int prio,
2418 				unsigned char *swap_map,
2419 				struct swap_cluster_info *cluster_info)
2420 {
2421 	spin_lock(&swap_lock);
2422 	spin_lock(&p->lock);
2423 	setup_swap_info(p, prio, swap_map, cluster_info);
2424 	spin_unlock(&p->lock);
2425 	spin_unlock(&swap_lock);
2426 	/*
2427 	 * Finished initializing swap device, now it's safe to reference it.
2428 	 */
2429 	percpu_ref_resurrect(&p->users);
2430 	spin_lock(&swap_lock);
2431 	spin_lock(&p->lock);
2432 	_enable_swap_info(p);
2433 	spin_unlock(&p->lock);
2434 	spin_unlock(&swap_lock);
2435 }
2436 
2437 static void reinsert_swap_info(struct swap_info_struct *p)
2438 {
2439 	spin_lock(&swap_lock);
2440 	spin_lock(&p->lock);
2441 	setup_swap_info(p, p->prio, p->swap_map, p->cluster_info);
2442 	_enable_swap_info(p);
2443 	spin_unlock(&p->lock);
2444 	spin_unlock(&swap_lock);
2445 }
2446 
2447 static bool __has_usable_swap(void)
2448 {
2449 	return !plist_head_empty(&swap_active_head);
2450 }
2451 
2452 bool has_usable_swap(void)
2453 {
2454 	bool ret;
2455 
2456 	spin_lock(&swap_lock);
2457 	ret = __has_usable_swap();
2458 	spin_unlock(&swap_lock);
2459 	return ret;
2460 }
2461 
2462 SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
2463 {
2464 	struct swap_info_struct *p = NULL;
2465 	unsigned char *swap_map;
2466 	struct swap_cluster_info *cluster_info;
2467 	struct file *swap_file, *victim;
2468 	struct address_space *mapping;
2469 	struct inode *inode;
2470 	struct filename *pathname;
2471 	int err, found = 0;
2472 
2473 	if (!capable(CAP_SYS_ADMIN))
2474 		return -EPERM;
2475 
2476 	BUG_ON(!current->mm);
2477 
2478 	pathname = getname(specialfile);
2479 	if (IS_ERR(pathname))
2480 		return PTR_ERR(pathname);
2481 
2482 	victim = file_open_name(pathname, O_RDWR|O_LARGEFILE, 0);
2483 	err = PTR_ERR(victim);
2484 	if (IS_ERR(victim))
2485 		goto out;
2486 
2487 	mapping = victim->f_mapping;
2488 	spin_lock(&swap_lock);
2489 	plist_for_each_entry(p, &swap_active_head, list) {
2490 		if (p->flags & SWP_WRITEOK) {
2491 			if (p->swap_file->f_mapping == mapping) {
2492 				found = 1;
2493 				break;
2494 			}
2495 		}
2496 	}
2497 	if (!found) {
2498 		err = -EINVAL;
2499 		spin_unlock(&swap_lock);
2500 		goto out_dput;
2501 	}
2502 	if (!security_vm_enough_memory_mm(current->mm, p->pages))
2503 		vm_unacct_memory(p->pages);
2504 	else {
2505 		err = -ENOMEM;
2506 		spin_unlock(&swap_lock);
2507 		goto out_dput;
2508 	}
2509 	spin_lock(&p->lock);
2510 	del_from_avail_list(p);
2511 	if (p->prio < 0) {
2512 		struct swap_info_struct *si = p;
2513 		int nid;
2514 
2515 		plist_for_each_entry_continue(si, &swap_active_head, list) {
2516 			si->prio++;
2517 			si->list.prio--;
2518 			for_each_node(nid) {
2519 				if (si->avail_lists[nid].prio != 1)
2520 					si->avail_lists[nid].prio--;
2521 			}
2522 		}
2523 		least_priority++;
2524 	}
2525 	plist_del(&p->list, &swap_active_head);
2526 	atomic_long_sub(p->pages, &nr_swap_pages);
2527 	total_swap_pages -= p->pages;
2528 	p->flags &= ~SWP_WRITEOK;
2529 	spin_unlock(&p->lock);
2530 	spin_unlock(&swap_lock);
2531 
2532 	disable_swap_slots_cache_lock();
2533 
2534 	set_current_oom_origin();
2535 	err = try_to_unuse(p->type);
2536 	clear_current_oom_origin();
2537 
2538 	if (err) {
2539 		/* re-insert swap space back into swap_list */
2540 		reinsert_swap_info(p);
2541 		reenable_swap_slots_cache_unlock();
2542 		goto out_dput;
2543 	}
2544 
2545 	reenable_swap_slots_cache_unlock();
2546 
2547 	/*
2548 	 * Wait for swap operations protected by get/put_swap_device()
2549 	 * to complete.  Because of synchronize_rcu() here, all swap
2550 	 * operations protected by RCU reader side lock (including any
2551 	 * spinlock) will be waited too.  This makes it easy to
2552 	 * prevent folio_test_swapcache() and the following swap cache
2553 	 * operations from racing with swapoff.
2554 	 */
2555 	percpu_ref_kill(&p->users);
2556 	synchronize_rcu();
2557 	wait_for_completion(&p->comp);
2558 
2559 	flush_work(&p->discard_work);
2560 
2561 	destroy_swap_extents(p);
2562 	if (p->flags & SWP_CONTINUED)
2563 		free_swap_count_continuations(p);
2564 
2565 	if (!p->bdev || !bdev_nonrot(p->bdev))
2566 		atomic_dec(&nr_rotate_swap);
2567 
2568 	mutex_lock(&swapon_mutex);
2569 	spin_lock(&swap_lock);
2570 	spin_lock(&p->lock);
2571 	drain_mmlist();
2572 
2573 	/* wait for anyone still in scan_swap_map_slots */
2574 	p->highest_bit = 0;		/* cuts scans short */
2575 	while (p->flags >= SWP_SCANNING) {
2576 		spin_unlock(&p->lock);
2577 		spin_unlock(&swap_lock);
2578 		schedule_timeout_uninterruptible(1);
2579 		spin_lock(&swap_lock);
2580 		spin_lock(&p->lock);
2581 	}
2582 
2583 	swap_file = p->swap_file;
2584 	p->swap_file = NULL;
2585 	p->max = 0;
2586 	swap_map = p->swap_map;
2587 	p->swap_map = NULL;
2588 	cluster_info = p->cluster_info;
2589 	p->cluster_info = NULL;
2590 	spin_unlock(&p->lock);
2591 	spin_unlock(&swap_lock);
2592 	arch_swap_invalidate_area(p->type);
2593 	zswap_swapoff(p->type);
2594 	mutex_unlock(&swapon_mutex);
2595 	free_percpu(p->percpu_cluster);
2596 	p->percpu_cluster = NULL;
2597 	free_percpu(p->cluster_next_cpu);
2598 	p->cluster_next_cpu = NULL;
2599 	vfree(swap_map);
2600 	kvfree(cluster_info);
2601 	/* Destroy swap account information */
2602 	swap_cgroup_swapoff(p->type);
2603 	exit_swap_address_space(p->type);
2604 
2605 	inode = mapping->host;
2606 
2607 	inode_lock(inode);
2608 	inode->i_flags &= ~S_SWAPFILE;
2609 	inode_unlock(inode);
2610 	filp_close(swap_file, NULL);
2611 
2612 	/*
2613 	 * Clear the SWP_USED flag after all resources are freed so that swapon
2614 	 * can reuse this swap_info in alloc_swap_info() safely.  It is ok to
2615 	 * not hold p->lock after we cleared its SWP_WRITEOK.
2616 	 */
2617 	spin_lock(&swap_lock);
2618 	p->flags = 0;
2619 	spin_unlock(&swap_lock);
2620 
2621 	err = 0;
2622 	atomic_inc(&proc_poll_event);
2623 	wake_up_interruptible(&proc_poll_wait);
2624 
2625 out_dput:
2626 	filp_close(victim, NULL);
2627 out:
2628 	putname(pathname);
2629 	return err;
2630 }
2631 
2632 #ifdef CONFIG_PROC_FS
2633 static __poll_t swaps_poll(struct file *file, poll_table *wait)
2634 {
2635 	struct seq_file *seq = file->private_data;
2636 
2637 	poll_wait(file, &proc_poll_wait, wait);
2638 
2639 	if (seq->poll_event != atomic_read(&proc_poll_event)) {
2640 		seq->poll_event = atomic_read(&proc_poll_event);
2641 		return EPOLLIN | EPOLLRDNORM | EPOLLERR | EPOLLPRI;
2642 	}
2643 
2644 	return EPOLLIN | EPOLLRDNORM;
2645 }
2646 
2647 /* iterator */
2648 static void *swap_start(struct seq_file *swap, loff_t *pos)
2649 {
2650 	struct swap_info_struct *si;
2651 	int type;
2652 	loff_t l = *pos;
2653 
2654 	mutex_lock(&swapon_mutex);
2655 
2656 	if (!l)
2657 		return SEQ_START_TOKEN;
2658 
2659 	for (type = 0; (si = swap_type_to_swap_info(type)); type++) {
2660 		if (!(si->flags & SWP_USED) || !si->swap_map)
2661 			continue;
2662 		if (!--l)
2663 			return si;
2664 	}
2665 
2666 	return NULL;
2667 }
2668 
2669 static void *swap_next(struct seq_file *swap, void *v, loff_t *pos)
2670 {
2671 	struct swap_info_struct *si = v;
2672 	int type;
2673 
2674 	if (v == SEQ_START_TOKEN)
2675 		type = 0;
2676 	else
2677 		type = si->type + 1;
2678 
2679 	++(*pos);
2680 	for (; (si = swap_type_to_swap_info(type)); type++) {
2681 		if (!(si->flags & SWP_USED) || !si->swap_map)
2682 			continue;
2683 		return si;
2684 	}
2685 
2686 	return NULL;
2687 }
2688 
2689 static void swap_stop(struct seq_file *swap, void *v)
2690 {
2691 	mutex_unlock(&swapon_mutex);
2692 }
2693 
2694 static int swap_show(struct seq_file *swap, void *v)
2695 {
2696 	struct swap_info_struct *si = v;
2697 	struct file *file;
2698 	int len;
2699 	unsigned long bytes, inuse;
2700 
2701 	if (si == SEQ_START_TOKEN) {
2702 		seq_puts(swap, "Filename\t\t\t\tType\t\tSize\t\tUsed\t\tPriority\n");
2703 		return 0;
2704 	}
2705 
2706 	bytes = K(si->pages);
2707 	inuse = K(READ_ONCE(si->inuse_pages));
2708 
2709 	file = si->swap_file;
2710 	len = seq_file_path(swap, file, " \t\n\\");
2711 	seq_printf(swap, "%*s%s\t%lu\t%s%lu\t%s%d\n",
2712 			len < 40 ? 40 - len : 1, " ",
2713 			S_ISBLK(file_inode(file)->i_mode) ?
2714 				"partition" : "file\t",
2715 			bytes, bytes < 10000000 ? "\t" : "",
2716 			inuse, inuse < 10000000 ? "\t" : "",
2717 			si->prio);
2718 	return 0;
2719 }
2720 
2721 static const struct seq_operations swaps_op = {
2722 	.start =	swap_start,
2723 	.next =		swap_next,
2724 	.stop =		swap_stop,
2725 	.show =		swap_show
2726 };
2727 
2728 static int swaps_open(struct inode *inode, struct file *file)
2729 {
2730 	struct seq_file *seq;
2731 	int ret;
2732 
2733 	ret = seq_open(file, &swaps_op);
2734 	if (ret)
2735 		return ret;
2736 
2737 	seq = file->private_data;
2738 	seq->poll_event = atomic_read(&proc_poll_event);
2739 	return 0;
2740 }
2741 
2742 static const struct proc_ops swaps_proc_ops = {
2743 	.proc_flags	= PROC_ENTRY_PERMANENT,
2744 	.proc_open	= swaps_open,
2745 	.proc_read	= seq_read,
2746 	.proc_lseek	= seq_lseek,
2747 	.proc_release	= seq_release,
2748 	.proc_poll	= swaps_poll,
2749 };
2750 
2751 static int __init procswaps_init(void)
2752 {
2753 	proc_create("swaps", 0, NULL, &swaps_proc_ops);
2754 	return 0;
2755 }
2756 __initcall(procswaps_init);
2757 #endif /* CONFIG_PROC_FS */
2758 
2759 #ifdef MAX_SWAPFILES_CHECK
2760 static int __init max_swapfiles_check(void)
2761 {
2762 	MAX_SWAPFILES_CHECK();
2763 	return 0;
2764 }
2765 late_initcall(max_swapfiles_check);
2766 #endif
2767 
2768 static struct swap_info_struct *alloc_swap_info(void)
2769 {
2770 	struct swap_info_struct *p;
2771 	struct swap_info_struct *defer = NULL;
2772 	unsigned int type;
2773 	int i;
2774 
2775 	p = kvzalloc(struct_size(p, avail_lists, nr_node_ids), GFP_KERNEL);
2776 	if (!p)
2777 		return ERR_PTR(-ENOMEM);
2778 
2779 	if (percpu_ref_init(&p->users, swap_users_ref_free,
2780 			    PERCPU_REF_INIT_DEAD, GFP_KERNEL)) {
2781 		kvfree(p);
2782 		return ERR_PTR(-ENOMEM);
2783 	}
2784 
2785 	spin_lock(&swap_lock);
2786 	for (type = 0; type < nr_swapfiles; type++) {
2787 		if (!(swap_info[type]->flags & SWP_USED))
2788 			break;
2789 	}
2790 	if (type >= MAX_SWAPFILES) {
2791 		spin_unlock(&swap_lock);
2792 		percpu_ref_exit(&p->users);
2793 		kvfree(p);
2794 		return ERR_PTR(-EPERM);
2795 	}
2796 	if (type >= nr_swapfiles) {
2797 		p->type = type;
2798 		/*
2799 		 * Publish the swap_info_struct after initializing it.
2800 		 * Note that kvzalloc() above zeroes all its fields.
2801 		 */
2802 		smp_store_release(&swap_info[type], p); /* rcu_assign_pointer() */
2803 		nr_swapfiles++;
2804 	} else {
2805 		defer = p;
2806 		p = swap_info[type];
2807 		/*
2808 		 * Do not memset this entry: a racing procfs swap_next()
2809 		 * would be relying on p->type to remain valid.
2810 		 */
2811 	}
2812 	p->swap_extent_root = RB_ROOT;
2813 	plist_node_init(&p->list, 0);
2814 	for_each_node(i)
2815 		plist_node_init(&p->avail_lists[i], 0);
2816 	p->flags = SWP_USED;
2817 	spin_unlock(&swap_lock);
2818 	if (defer) {
2819 		percpu_ref_exit(&defer->users);
2820 		kvfree(defer);
2821 	}
2822 	spin_lock_init(&p->lock);
2823 	spin_lock_init(&p->cont_lock);
2824 	init_completion(&p->comp);
2825 
2826 	return p;
2827 }
2828 
2829 static int claim_swapfile(struct swap_info_struct *p, struct inode *inode)
2830 {
2831 	if (S_ISBLK(inode->i_mode)) {
2832 		p->bdev = I_BDEV(inode);
2833 		/*
2834 		 * Zoned block devices contain zones that have a sequential
2835 		 * write only restriction.  Hence zoned block devices are not
2836 		 * suitable for swapping.  Disallow them here.
2837 		 */
2838 		if (bdev_is_zoned(p->bdev))
2839 			return -EINVAL;
2840 		p->flags |= SWP_BLKDEV;
2841 	} else if (S_ISREG(inode->i_mode)) {
2842 		p->bdev = inode->i_sb->s_bdev;
2843 	}
2844 
2845 	return 0;
2846 }
2847 
2848 
2849 /*
2850  * Find out how many pages are allowed for a single swap device. There
2851  * are two limiting factors:
2852  * 1) the number of bits for the swap offset in the swp_entry_t type, and
2853  * 2) the number of bits in the swap pte, as defined by the different
2854  * architectures.
2855  *
2856  * In order to find the largest possible bit mask, a swap entry with
2857  * swap type 0 and swap offset ~0UL is created, encoded to a swap pte,
2858  * decoded to a swp_entry_t again, and finally the swap offset is
2859  * extracted.
2860  *
2861  * This will mask all the bits from the initial ~0UL mask that can't
2862  * be encoded in either the swp_entry_t or the architecture definition
2863  * of a swap pte.
2864  */
2865 unsigned long generic_max_swapfile_size(void)
2866 {
2867 	return swp_offset(pte_to_swp_entry(
2868 			swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
2869 }
2870 
2871 /* Can be overridden by an architecture for additional checks. */
2872 __weak unsigned long arch_max_swapfile_size(void)
2873 {
2874 	return generic_max_swapfile_size();
2875 }
2876 
2877 static unsigned long read_swap_header(struct swap_info_struct *p,
2878 					union swap_header *swap_header,
2879 					struct inode *inode)
2880 {
2881 	int i;
2882 	unsigned long maxpages;
2883 	unsigned long swapfilepages;
2884 	unsigned long last_page;
2885 
2886 	if (memcmp("SWAPSPACE2", swap_header->magic.magic, 10)) {
2887 		pr_err("Unable to find swap-space signature\n");
2888 		return 0;
2889 	}
2890 
2891 	/* swap partition endianness hack... */
2892 	if (swab32(swap_header->info.version) == 1) {
2893 		swab32s(&swap_header->info.version);
2894 		swab32s(&swap_header->info.last_page);
2895 		swab32s(&swap_header->info.nr_badpages);
2896 		if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
2897 			return 0;
2898 		for (i = 0; i < swap_header->info.nr_badpages; i++)
2899 			swab32s(&swap_header->info.badpages[i]);
2900 	}
2901 	/* Check the swap header's sub-version */
2902 	if (swap_header->info.version != 1) {
2903 		pr_warn("Unable to handle swap header version %d\n",
2904 			swap_header->info.version);
2905 		return 0;
2906 	}
2907 
2908 	p->lowest_bit  = 1;
2909 	p->cluster_next = 1;
2910 	p->cluster_nr = 0;
2911 
2912 	maxpages = swapfile_maximum_size;
2913 	last_page = swap_header->info.last_page;
2914 	if (!last_page) {
2915 		pr_warn("Empty swap-file\n");
2916 		return 0;
2917 	}
2918 	if (last_page > maxpages) {
2919 		pr_warn("Truncating oversized swap area, only using %luk out of %luk\n",
2920 			K(maxpages), K(last_page));
2921 	}
2922 	if (maxpages > last_page) {
2923 		maxpages = last_page + 1;
2924 		/* p->max is an unsigned int: don't overflow it */
2925 		if ((unsigned int)maxpages == 0)
2926 			maxpages = UINT_MAX;
2927 	}
2928 	p->highest_bit = maxpages - 1;
2929 
2930 	if (!maxpages)
2931 		return 0;
2932 	swapfilepages = i_size_read(inode) >> PAGE_SHIFT;
2933 	if (swapfilepages && maxpages > swapfilepages) {
2934 		pr_warn("Swap area shorter than signature indicates\n");
2935 		return 0;
2936 	}
2937 	if (swap_header->info.nr_badpages && S_ISREG(inode->i_mode))
2938 		return 0;
2939 	if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
2940 		return 0;
2941 
2942 	return maxpages;
2943 }
2944 
2945 #define SWAP_CLUSTER_INFO_COLS						\
2946 	DIV_ROUND_UP(L1_CACHE_BYTES, sizeof(struct swap_cluster_info))
2947 #define SWAP_CLUSTER_SPACE_COLS						\
2948 	DIV_ROUND_UP(SWAP_ADDRESS_SPACE_PAGES, SWAPFILE_CLUSTER)
2949 #define SWAP_CLUSTER_COLS						\
2950 	max_t(unsigned int, SWAP_CLUSTER_INFO_COLS, SWAP_CLUSTER_SPACE_COLS)
2951 
2952 static int setup_swap_map_and_extents(struct swap_info_struct *p,
2953 					union swap_header *swap_header,
2954 					unsigned char *swap_map,
2955 					struct swap_cluster_info *cluster_info,
2956 					unsigned long maxpages,
2957 					sector_t *span)
2958 {
2959 	unsigned int j, k;
2960 	unsigned int nr_good_pages;
2961 	int nr_extents;
2962 	unsigned long nr_clusters = DIV_ROUND_UP(maxpages, SWAPFILE_CLUSTER);
2963 	unsigned long col = p->cluster_next / SWAPFILE_CLUSTER % SWAP_CLUSTER_COLS;
2964 	unsigned long i, idx;
2965 
2966 	nr_good_pages = maxpages - 1;	/* omit header page */
2967 
2968 	cluster_list_init(&p->free_clusters);
2969 	cluster_list_init(&p->discard_clusters);
2970 
2971 	for (i = 0; i < swap_header->info.nr_badpages; i++) {
2972 		unsigned int page_nr = swap_header->info.badpages[i];
2973 		if (page_nr == 0 || page_nr > swap_header->info.last_page)
2974 			return -EINVAL;
2975 		if (page_nr < maxpages) {
2976 			swap_map[page_nr] = SWAP_MAP_BAD;
2977 			nr_good_pages--;
2978 			/*
2979 			 * Haven't marked the cluster free yet, no list
2980 			 * operation involved
2981 			 */
2982 			inc_cluster_info_page(p, cluster_info, page_nr);
2983 		}
2984 	}
2985 
2986 	/* Haven't marked the cluster free yet, no list operation involved */
2987 	for (i = maxpages; i < round_up(maxpages, SWAPFILE_CLUSTER); i++)
2988 		inc_cluster_info_page(p, cluster_info, i);
2989 
2990 	if (nr_good_pages) {
2991 		swap_map[0] = SWAP_MAP_BAD;
2992 		/*
2993 		 * Not mark the cluster free yet, no list
2994 		 * operation involved
2995 		 */
2996 		inc_cluster_info_page(p, cluster_info, 0);
2997 		p->max = maxpages;
2998 		p->pages = nr_good_pages;
2999 		nr_extents = setup_swap_extents(p, span);
3000 		if (nr_extents < 0)
3001 			return nr_extents;
3002 		nr_good_pages = p->pages;
3003 	}
3004 	if (!nr_good_pages) {
3005 		pr_warn("Empty swap-file\n");
3006 		return -EINVAL;
3007 	}
3008 
3009 	if (!cluster_info)
3010 		return nr_extents;
3011 
3012 
3013 	/*
3014 	 * Reduce false cache line sharing between cluster_info and
3015 	 * sharing same address space.
3016 	 */
3017 	for (k = 0; k < SWAP_CLUSTER_COLS; k++) {
3018 		j = (k + col) % SWAP_CLUSTER_COLS;
3019 		for (i = 0; i < DIV_ROUND_UP(nr_clusters, SWAP_CLUSTER_COLS); i++) {
3020 			idx = i * SWAP_CLUSTER_COLS + j;
3021 			if (idx >= nr_clusters)
3022 				continue;
3023 			if (cluster_count(&cluster_info[idx]))
3024 				continue;
3025 			cluster_set_flag(&cluster_info[idx], CLUSTER_FLAG_FREE);
3026 			cluster_list_add_tail(&p->free_clusters, cluster_info,
3027 					      idx);
3028 		}
3029 	}
3030 	return nr_extents;
3031 }
3032 
3033 SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags)
3034 {
3035 	struct swap_info_struct *p;
3036 	struct filename *name;
3037 	struct file *swap_file = NULL;
3038 	struct address_space *mapping;
3039 	struct dentry *dentry;
3040 	int prio;
3041 	int error;
3042 	union swap_header *swap_header;
3043 	int nr_extents;
3044 	sector_t span;
3045 	unsigned long maxpages;
3046 	unsigned char *swap_map = NULL;
3047 	struct swap_cluster_info *cluster_info = NULL;
3048 	struct page *page = NULL;
3049 	struct inode *inode = NULL;
3050 	bool inced_nr_rotate_swap = false;
3051 
3052 	if (swap_flags & ~SWAP_FLAGS_VALID)
3053 		return -EINVAL;
3054 
3055 	if (!capable(CAP_SYS_ADMIN))
3056 		return -EPERM;
3057 
3058 	if (!swap_avail_heads)
3059 		return -ENOMEM;
3060 
3061 	p = alloc_swap_info();
3062 	if (IS_ERR(p))
3063 		return PTR_ERR(p);
3064 
3065 	INIT_WORK(&p->discard_work, swap_discard_work);
3066 
3067 	name = getname(specialfile);
3068 	if (IS_ERR(name)) {
3069 		error = PTR_ERR(name);
3070 		name = NULL;
3071 		goto bad_swap;
3072 	}
3073 	swap_file = file_open_name(name, O_RDWR | O_LARGEFILE | O_EXCL, 0);
3074 	if (IS_ERR(swap_file)) {
3075 		error = PTR_ERR(swap_file);
3076 		swap_file = NULL;
3077 		goto bad_swap;
3078 	}
3079 
3080 	p->swap_file = swap_file;
3081 	mapping = swap_file->f_mapping;
3082 	dentry = swap_file->f_path.dentry;
3083 	inode = mapping->host;
3084 
3085 	error = claim_swapfile(p, inode);
3086 	if (unlikely(error))
3087 		goto bad_swap;
3088 
3089 	inode_lock(inode);
3090 	if (d_unlinked(dentry) || cant_mount(dentry)) {
3091 		error = -ENOENT;
3092 		goto bad_swap_unlock_inode;
3093 	}
3094 	if (IS_SWAPFILE(inode)) {
3095 		error = -EBUSY;
3096 		goto bad_swap_unlock_inode;
3097 	}
3098 
3099 	/*
3100 	 * Read the swap header.
3101 	 */
3102 	if (!mapping->a_ops->read_folio) {
3103 		error = -EINVAL;
3104 		goto bad_swap_unlock_inode;
3105 	}
3106 	page = read_mapping_page(mapping, 0, swap_file);
3107 	if (IS_ERR(page)) {
3108 		error = PTR_ERR(page);
3109 		goto bad_swap_unlock_inode;
3110 	}
3111 	swap_header = kmap(page);
3112 
3113 	maxpages = read_swap_header(p, swap_header, inode);
3114 	if (unlikely(!maxpages)) {
3115 		error = -EINVAL;
3116 		goto bad_swap_unlock_inode;
3117 	}
3118 
3119 	/* OK, set up the swap map and apply the bad block list */
3120 	swap_map = vzalloc(maxpages);
3121 	if (!swap_map) {
3122 		error = -ENOMEM;
3123 		goto bad_swap_unlock_inode;
3124 	}
3125 
3126 	if (p->bdev && bdev_stable_writes(p->bdev))
3127 		p->flags |= SWP_STABLE_WRITES;
3128 
3129 	if (p->bdev && bdev_synchronous(p->bdev))
3130 		p->flags |= SWP_SYNCHRONOUS_IO;
3131 
3132 	if (p->bdev && bdev_nonrot(p->bdev)) {
3133 		int cpu, i;
3134 		unsigned long ci, nr_cluster;
3135 
3136 		p->flags |= SWP_SOLIDSTATE;
3137 		p->cluster_next_cpu = alloc_percpu(unsigned int);
3138 		if (!p->cluster_next_cpu) {
3139 			error = -ENOMEM;
3140 			goto bad_swap_unlock_inode;
3141 		}
3142 		/*
3143 		 * select a random position to start with to help wear leveling
3144 		 * SSD
3145 		 */
3146 		for_each_possible_cpu(cpu) {
3147 			per_cpu(*p->cluster_next_cpu, cpu) =
3148 				get_random_u32_inclusive(1, p->highest_bit);
3149 		}
3150 		nr_cluster = DIV_ROUND_UP(maxpages, SWAPFILE_CLUSTER);
3151 
3152 		cluster_info = kvcalloc(nr_cluster, sizeof(*cluster_info),
3153 					GFP_KERNEL);
3154 		if (!cluster_info) {
3155 			error = -ENOMEM;
3156 			goto bad_swap_unlock_inode;
3157 		}
3158 
3159 		for (ci = 0; ci < nr_cluster; ci++)
3160 			spin_lock_init(&((cluster_info + ci)->lock));
3161 
3162 		p->percpu_cluster = alloc_percpu(struct percpu_cluster);
3163 		if (!p->percpu_cluster) {
3164 			error = -ENOMEM;
3165 			goto bad_swap_unlock_inode;
3166 		}
3167 		for_each_possible_cpu(cpu) {
3168 			struct percpu_cluster *cluster;
3169 
3170 			cluster = per_cpu_ptr(p->percpu_cluster, cpu);
3171 			for (i = 0; i < SWAP_NR_ORDERS; i++)
3172 				cluster->next[i] = SWAP_NEXT_INVALID;
3173 		}
3174 	} else {
3175 		atomic_inc(&nr_rotate_swap);
3176 		inced_nr_rotate_swap = true;
3177 	}
3178 
3179 	error = swap_cgroup_swapon(p->type, maxpages);
3180 	if (error)
3181 		goto bad_swap_unlock_inode;
3182 
3183 	nr_extents = setup_swap_map_and_extents(p, swap_header, swap_map,
3184 		cluster_info, maxpages, &span);
3185 	if (unlikely(nr_extents < 0)) {
3186 		error = nr_extents;
3187 		goto bad_swap_unlock_inode;
3188 	}
3189 
3190 	if ((swap_flags & SWAP_FLAG_DISCARD) &&
3191 	    p->bdev && bdev_max_discard_sectors(p->bdev)) {
3192 		/*
3193 		 * When discard is enabled for swap with no particular
3194 		 * policy flagged, we set all swap discard flags here in
3195 		 * order to sustain backward compatibility with older
3196 		 * swapon(8) releases.
3197 		 */
3198 		p->flags |= (SWP_DISCARDABLE | SWP_AREA_DISCARD |
3199 			     SWP_PAGE_DISCARD);
3200 
3201 		/*
3202 		 * By flagging sys_swapon, a sysadmin can tell us to
3203 		 * either do single-time area discards only, or to just
3204 		 * perform discards for released swap page-clusters.
3205 		 * Now it's time to adjust the p->flags accordingly.
3206 		 */
3207 		if (swap_flags & SWAP_FLAG_DISCARD_ONCE)
3208 			p->flags &= ~SWP_PAGE_DISCARD;
3209 		else if (swap_flags & SWAP_FLAG_DISCARD_PAGES)
3210 			p->flags &= ~SWP_AREA_DISCARD;
3211 
3212 		/* issue a swapon-time discard if it's still required */
3213 		if (p->flags & SWP_AREA_DISCARD) {
3214 			int err = discard_swap(p);
3215 			if (unlikely(err))
3216 				pr_err("swapon: discard_swap(%p): %d\n",
3217 					p, err);
3218 		}
3219 	}
3220 
3221 	error = init_swap_address_space(p->type, maxpages);
3222 	if (error)
3223 		goto bad_swap_unlock_inode;
3224 
3225 	error = zswap_swapon(p->type, maxpages);
3226 	if (error)
3227 		goto free_swap_address_space;
3228 
3229 	/*
3230 	 * Flush any pending IO and dirty mappings before we start using this
3231 	 * swap device.
3232 	 */
3233 	inode->i_flags |= S_SWAPFILE;
3234 	error = inode_drain_writes(inode);
3235 	if (error) {
3236 		inode->i_flags &= ~S_SWAPFILE;
3237 		goto free_swap_zswap;
3238 	}
3239 
3240 	mutex_lock(&swapon_mutex);
3241 	prio = -1;
3242 	if (swap_flags & SWAP_FLAG_PREFER)
3243 		prio =
3244 		  (swap_flags & SWAP_FLAG_PRIO_MASK) >> SWAP_FLAG_PRIO_SHIFT;
3245 	enable_swap_info(p, prio, swap_map, cluster_info);
3246 
3247 	pr_info("Adding %uk swap on %s.  Priority:%d extents:%d across:%lluk %s%s%s%s\n",
3248 		K(p->pages), name->name, p->prio, nr_extents,
3249 		K((unsigned long long)span),
3250 		(p->flags & SWP_SOLIDSTATE) ? "SS" : "",
3251 		(p->flags & SWP_DISCARDABLE) ? "D" : "",
3252 		(p->flags & SWP_AREA_DISCARD) ? "s" : "",
3253 		(p->flags & SWP_PAGE_DISCARD) ? "c" : "");
3254 
3255 	mutex_unlock(&swapon_mutex);
3256 	atomic_inc(&proc_poll_event);
3257 	wake_up_interruptible(&proc_poll_wait);
3258 
3259 	error = 0;
3260 	goto out;
3261 free_swap_zswap:
3262 	zswap_swapoff(p->type);
3263 free_swap_address_space:
3264 	exit_swap_address_space(p->type);
3265 bad_swap_unlock_inode:
3266 	inode_unlock(inode);
3267 bad_swap:
3268 	free_percpu(p->percpu_cluster);
3269 	p->percpu_cluster = NULL;
3270 	free_percpu(p->cluster_next_cpu);
3271 	p->cluster_next_cpu = NULL;
3272 	inode = NULL;
3273 	destroy_swap_extents(p);
3274 	swap_cgroup_swapoff(p->type);
3275 	spin_lock(&swap_lock);
3276 	p->swap_file = NULL;
3277 	p->flags = 0;
3278 	spin_unlock(&swap_lock);
3279 	vfree(swap_map);
3280 	kvfree(cluster_info);
3281 	if (inced_nr_rotate_swap)
3282 		atomic_dec(&nr_rotate_swap);
3283 	if (swap_file)
3284 		filp_close(swap_file, NULL);
3285 out:
3286 	if (page && !IS_ERR(page)) {
3287 		kunmap(page);
3288 		put_page(page);
3289 	}
3290 	if (name)
3291 		putname(name);
3292 	if (inode)
3293 		inode_unlock(inode);
3294 	if (!error)
3295 		enable_swap_slots_cache();
3296 	return error;
3297 }
3298 
3299 void si_swapinfo(struct sysinfo *val)
3300 {
3301 	unsigned int type;
3302 	unsigned long nr_to_be_unused = 0;
3303 
3304 	spin_lock(&swap_lock);
3305 	for (type = 0; type < nr_swapfiles; type++) {
3306 		struct swap_info_struct *si = swap_info[type];
3307 
3308 		if ((si->flags & SWP_USED) && !(si->flags & SWP_WRITEOK))
3309 			nr_to_be_unused += READ_ONCE(si->inuse_pages);
3310 	}
3311 	val->freeswap = atomic_long_read(&nr_swap_pages) + nr_to_be_unused;
3312 	val->totalswap = total_swap_pages + nr_to_be_unused;
3313 	spin_unlock(&swap_lock);
3314 }
3315 
3316 /*
3317  * Verify that a swap entry is valid and increment its swap map count.
3318  *
3319  * Returns error code in following case.
3320  * - success -> 0
3321  * - swp_entry is invalid -> EINVAL
3322  * - swp_entry is migration entry -> EINVAL
3323  * - swap-cache reference is requested but there is already one. -> EEXIST
3324  * - swap-cache reference is requested but the entry is not used. -> ENOENT
3325  * - swap-mapped reference requested but needs continued swap count. -> ENOMEM
3326  */
3327 static int __swap_duplicate(swp_entry_t entry, unsigned char usage)
3328 {
3329 	struct swap_info_struct *p;
3330 	struct swap_cluster_info *ci;
3331 	unsigned long offset;
3332 	unsigned char count;
3333 	unsigned char has_cache;
3334 	int err;
3335 
3336 	p = swp_swap_info(entry);
3337 
3338 	offset = swp_offset(entry);
3339 	ci = lock_cluster_or_swap_info(p, offset);
3340 
3341 	count = p->swap_map[offset];
3342 
3343 	/*
3344 	 * swapin_readahead() doesn't check if a swap entry is valid, so the
3345 	 * swap entry could be SWAP_MAP_BAD. Check here with lock held.
3346 	 */
3347 	if (unlikely(swap_count(count) == SWAP_MAP_BAD)) {
3348 		err = -ENOENT;
3349 		goto unlock_out;
3350 	}
3351 
3352 	has_cache = count & SWAP_HAS_CACHE;
3353 	count &= ~SWAP_HAS_CACHE;
3354 	err = 0;
3355 
3356 	if (usage == SWAP_HAS_CACHE) {
3357 
3358 		/* set SWAP_HAS_CACHE if there is no cache and entry is used */
3359 		if (!has_cache && count)
3360 			has_cache = SWAP_HAS_CACHE;
3361 		else if (has_cache)		/* someone else added cache */
3362 			err = -EEXIST;
3363 		else				/* no users remaining */
3364 			err = -ENOENT;
3365 
3366 	} else if (count || has_cache) {
3367 
3368 		if ((count & ~COUNT_CONTINUED) < SWAP_MAP_MAX)
3369 			count += usage;
3370 		else if ((count & ~COUNT_CONTINUED) > SWAP_MAP_MAX)
3371 			err = -EINVAL;
3372 		else if (swap_count_continued(p, offset, count))
3373 			count = COUNT_CONTINUED;
3374 		else
3375 			err = -ENOMEM;
3376 	} else
3377 		err = -ENOENT;			/* unused swap entry */
3378 
3379 	if (!err)
3380 		WRITE_ONCE(p->swap_map[offset], count | has_cache);
3381 
3382 unlock_out:
3383 	unlock_cluster_or_swap_info(p, ci);
3384 	return err;
3385 }
3386 
3387 /*
3388  * Help swapoff by noting that swap entry belongs to shmem/tmpfs
3389  * (in which case its reference count is never incremented).
3390  */
3391 void swap_shmem_alloc(swp_entry_t entry)
3392 {
3393 	__swap_duplicate(entry, SWAP_MAP_SHMEM);
3394 }
3395 
3396 /*
3397  * Increase reference count of swap entry by 1.
3398  * Returns 0 for success, or -ENOMEM if a swap_count_continuation is required
3399  * but could not be atomically allocated.  Returns 0, just as if it succeeded,
3400  * if __swap_duplicate() fails for another reason (-EINVAL or -ENOENT), which
3401  * might occur if a page table entry has got corrupted.
3402  */
3403 int swap_duplicate(swp_entry_t entry)
3404 {
3405 	int err = 0;
3406 
3407 	while (!err && __swap_duplicate(entry, 1) == -ENOMEM)
3408 		err = add_swap_count_continuation(entry, GFP_ATOMIC);
3409 	return err;
3410 }
3411 
3412 /*
3413  * @entry: swap entry for which we allocate swap cache.
3414  *
3415  * Called when allocating swap cache for existing swap entry,
3416  * This can return error codes. Returns 0 at success.
3417  * -EEXIST means there is a swap cache.
3418  * Note: return code is different from swap_duplicate().
3419  */
3420 int swapcache_prepare(swp_entry_t entry)
3421 {
3422 	return __swap_duplicate(entry, SWAP_HAS_CACHE);
3423 }
3424 
3425 void swapcache_clear(struct swap_info_struct *si, swp_entry_t entry)
3426 {
3427 	struct swap_cluster_info *ci;
3428 	unsigned long offset = swp_offset(entry);
3429 	unsigned char usage;
3430 
3431 	ci = lock_cluster_or_swap_info(si, offset);
3432 	usage = __swap_entry_free_locked(si, offset, SWAP_HAS_CACHE);
3433 	unlock_cluster_or_swap_info(si, ci);
3434 	if (!usage)
3435 		free_swap_slot(entry);
3436 }
3437 
3438 struct swap_info_struct *swp_swap_info(swp_entry_t entry)
3439 {
3440 	return swap_type_to_swap_info(swp_type(entry));
3441 }
3442 
3443 /*
3444  * out-of-line methods to avoid include hell.
3445  */
3446 struct address_space *swapcache_mapping(struct folio *folio)
3447 {
3448 	return swp_swap_info(folio->swap)->swap_file->f_mapping;
3449 }
3450 EXPORT_SYMBOL_GPL(swapcache_mapping);
3451 
3452 pgoff_t __page_file_index(struct page *page)
3453 {
3454 	swp_entry_t swap = page_swap_entry(page);
3455 	return swp_offset(swap);
3456 }
3457 EXPORT_SYMBOL_GPL(__page_file_index);
3458 
3459 /*
3460  * add_swap_count_continuation - called when a swap count is duplicated
3461  * beyond SWAP_MAP_MAX, it allocates a new page and links that to the entry's
3462  * page of the original vmalloc'ed swap_map, to hold the continuation count
3463  * (for that entry and for its neighbouring PAGE_SIZE swap entries).  Called
3464  * again when count is duplicated beyond SWAP_MAP_MAX * SWAP_CONT_MAX, etc.
3465  *
3466  * These continuation pages are seldom referenced: the common paths all work
3467  * on the original swap_map, only referring to a continuation page when the
3468  * low "digit" of a count is incremented or decremented through SWAP_MAP_MAX.
3469  *
3470  * add_swap_count_continuation(, GFP_ATOMIC) can be called while holding
3471  * page table locks; if it fails, add_swap_count_continuation(, GFP_KERNEL)
3472  * can be called after dropping locks.
3473  */
3474 int add_swap_count_continuation(swp_entry_t entry, gfp_t gfp_mask)
3475 {
3476 	struct swap_info_struct *si;
3477 	struct swap_cluster_info *ci;
3478 	struct page *head;
3479 	struct page *page;
3480 	struct page *list_page;
3481 	pgoff_t offset;
3482 	unsigned char count;
3483 	int ret = 0;
3484 
3485 	/*
3486 	 * When debugging, it's easier to use __GFP_ZERO here; but it's better
3487 	 * for latency not to zero a page while GFP_ATOMIC and holding locks.
3488 	 */
3489 	page = alloc_page(gfp_mask | __GFP_HIGHMEM);
3490 
3491 	si = get_swap_device(entry);
3492 	if (!si) {
3493 		/*
3494 		 * An acceptable race has occurred since the failing
3495 		 * __swap_duplicate(): the swap device may be swapoff
3496 		 */
3497 		goto outer;
3498 	}
3499 	spin_lock(&si->lock);
3500 
3501 	offset = swp_offset(entry);
3502 
3503 	ci = lock_cluster(si, offset);
3504 
3505 	count = swap_count(si->swap_map[offset]);
3506 
3507 	if ((count & ~COUNT_CONTINUED) != SWAP_MAP_MAX) {
3508 		/*
3509 		 * The higher the swap count, the more likely it is that tasks
3510 		 * will race to add swap count continuation: we need to avoid
3511 		 * over-provisioning.
3512 		 */
3513 		goto out;
3514 	}
3515 
3516 	if (!page) {
3517 		ret = -ENOMEM;
3518 		goto out;
3519 	}
3520 
3521 	head = vmalloc_to_page(si->swap_map + offset);
3522 	offset &= ~PAGE_MASK;
3523 
3524 	spin_lock(&si->cont_lock);
3525 	/*
3526 	 * Page allocation does not initialize the page's lru field,
3527 	 * but it does always reset its private field.
3528 	 */
3529 	if (!page_private(head)) {
3530 		BUG_ON(count & COUNT_CONTINUED);
3531 		INIT_LIST_HEAD(&head->lru);
3532 		set_page_private(head, SWP_CONTINUED);
3533 		si->flags |= SWP_CONTINUED;
3534 	}
3535 
3536 	list_for_each_entry(list_page, &head->lru, lru) {
3537 		unsigned char *map;
3538 
3539 		/*
3540 		 * If the previous map said no continuation, but we've found
3541 		 * a continuation page, free our allocation and use this one.
3542 		 */
3543 		if (!(count & COUNT_CONTINUED))
3544 			goto out_unlock_cont;
3545 
3546 		map = kmap_local_page(list_page) + offset;
3547 		count = *map;
3548 		kunmap_local(map);
3549 
3550 		/*
3551 		 * If this continuation count now has some space in it,
3552 		 * free our allocation and use this one.
3553 		 */
3554 		if ((count & ~COUNT_CONTINUED) != SWAP_CONT_MAX)
3555 			goto out_unlock_cont;
3556 	}
3557 
3558 	list_add_tail(&page->lru, &head->lru);
3559 	page = NULL;			/* now it's attached, don't free it */
3560 out_unlock_cont:
3561 	spin_unlock(&si->cont_lock);
3562 out:
3563 	unlock_cluster(ci);
3564 	spin_unlock(&si->lock);
3565 	put_swap_device(si);
3566 outer:
3567 	if (page)
3568 		__free_page(page);
3569 	return ret;
3570 }
3571 
3572 /*
3573  * swap_count_continued - when the original swap_map count is incremented
3574  * from SWAP_MAP_MAX, check if there is already a continuation page to carry
3575  * into, carry if so, or else fail until a new continuation page is allocated;
3576  * when the original swap_map count is decremented from 0 with continuation,
3577  * borrow from the continuation and report whether it still holds more.
3578  * Called while __swap_duplicate() or swap_entry_free() holds swap or cluster
3579  * lock.
3580  */
3581 static bool swap_count_continued(struct swap_info_struct *si,
3582 				 pgoff_t offset, unsigned char count)
3583 {
3584 	struct page *head;
3585 	struct page *page;
3586 	unsigned char *map;
3587 	bool ret;
3588 
3589 	head = vmalloc_to_page(si->swap_map + offset);
3590 	if (page_private(head) != SWP_CONTINUED) {
3591 		BUG_ON(count & COUNT_CONTINUED);
3592 		return false;		/* need to add count continuation */
3593 	}
3594 
3595 	spin_lock(&si->cont_lock);
3596 	offset &= ~PAGE_MASK;
3597 	page = list_next_entry(head, lru);
3598 	map = kmap_local_page(page) + offset;
3599 
3600 	if (count == SWAP_MAP_MAX)	/* initial increment from swap_map */
3601 		goto init_map;		/* jump over SWAP_CONT_MAX checks */
3602 
3603 	if (count == (SWAP_MAP_MAX | COUNT_CONTINUED)) { /* incrementing */
3604 		/*
3605 		 * Think of how you add 1 to 999
3606 		 */
3607 		while (*map == (SWAP_CONT_MAX | COUNT_CONTINUED)) {
3608 			kunmap_local(map);
3609 			page = list_next_entry(page, lru);
3610 			BUG_ON(page == head);
3611 			map = kmap_local_page(page) + offset;
3612 		}
3613 		if (*map == SWAP_CONT_MAX) {
3614 			kunmap_local(map);
3615 			page = list_next_entry(page, lru);
3616 			if (page == head) {
3617 				ret = false;	/* add count continuation */
3618 				goto out;
3619 			}
3620 			map = kmap_local_page(page) + offset;
3621 init_map:		*map = 0;		/* we didn't zero the page */
3622 		}
3623 		*map += 1;
3624 		kunmap_local(map);
3625 		while ((page = list_prev_entry(page, lru)) != head) {
3626 			map = kmap_local_page(page) + offset;
3627 			*map = COUNT_CONTINUED;
3628 			kunmap_local(map);
3629 		}
3630 		ret = true;			/* incremented */
3631 
3632 	} else {				/* decrementing */
3633 		/*
3634 		 * Think of how you subtract 1 from 1000
3635 		 */
3636 		BUG_ON(count != COUNT_CONTINUED);
3637 		while (*map == COUNT_CONTINUED) {
3638 			kunmap_local(map);
3639 			page = list_next_entry(page, lru);
3640 			BUG_ON(page == head);
3641 			map = kmap_local_page(page) + offset;
3642 		}
3643 		BUG_ON(*map == 0);
3644 		*map -= 1;
3645 		if (*map == 0)
3646 			count = 0;
3647 		kunmap_local(map);
3648 		while ((page = list_prev_entry(page, lru)) != head) {
3649 			map = kmap_local_page(page) + offset;
3650 			*map = SWAP_CONT_MAX | count;
3651 			count = COUNT_CONTINUED;
3652 			kunmap_local(map);
3653 		}
3654 		ret = count == COUNT_CONTINUED;
3655 	}
3656 out:
3657 	spin_unlock(&si->cont_lock);
3658 	return ret;
3659 }
3660 
3661 /*
3662  * free_swap_count_continuations - swapoff free all the continuation pages
3663  * appended to the swap_map, after swap_map is quiesced, before vfree'ing it.
3664  */
3665 static void free_swap_count_continuations(struct swap_info_struct *si)
3666 {
3667 	pgoff_t offset;
3668 
3669 	for (offset = 0; offset < si->max; offset += PAGE_SIZE) {
3670 		struct page *head;
3671 		head = vmalloc_to_page(si->swap_map + offset);
3672 		if (page_private(head)) {
3673 			struct page *page, *next;
3674 
3675 			list_for_each_entry_safe(page, next, &head->lru, lru) {
3676 				list_del(&page->lru);
3677 				__free_page(page);
3678 			}
3679 		}
3680 	}
3681 }
3682 
3683 #if defined(CONFIG_MEMCG) && defined(CONFIG_BLK_CGROUP)
3684 void __folio_throttle_swaprate(struct folio *folio, gfp_t gfp)
3685 {
3686 	struct swap_info_struct *si, *next;
3687 	int nid = folio_nid(folio);
3688 
3689 	if (!(gfp & __GFP_IO))
3690 		return;
3691 
3692 	if (!__has_usable_swap())
3693 		return;
3694 
3695 	if (!blk_cgroup_congested())
3696 		return;
3697 
3698 	/*
3699 	 * We've already scheduled a throttle, avoid taking the global swap
3700 	 * lock.
3701 	 */
3702 	if (current->throttle_disk)
3703 		return;
3704 
3705 	spin_lock(&swap_avail_lock);
3706 	plist_for_each_entry_safe(si, next, &swap_avail_heads[nid],
3707 				  avail_lists[nid]) {
3708 		if (si->bdev) {
3709 			blkcg_schedule_throttle(si->bdev->bd_disk, true);
3710 			break;
3711 		}
3712 	}
3713 	spin_unlock(&swap_avail_lock);
3714 }
3715 #endif
3716 
3717 static int __init swapfile_init(void)
3718 {
3719 	int nid;
3720 
3721 	swap_avail_heads = kmalloc_array(nr_node_ids, sizeof(struct plist_head),
3722 					 GFP_KERNEL);
3723 	if (!swap_avail_heads) {
3724 		pr_emerg("Not enough memory for swap heads, swap is disabled\n");
3725 		return -ENOMEM;
3726 	}
3727 
3728 	for_each_node(nid)
3729 		plist_head_init(&swap_avail_heads[nid]);
3730 
3731 	swapfile_maximum_size = arch_max_swapfile_size();
3732 
3733 #ifdef CONFIG_MIGRATION
3734 	if (swapfile_maximum_size >= (1UL << SWP_MIG_TOTAL_BITS))
3735 		swap_migration_ad_supported = true;
3736 #endif	/* CONFIG_MIGRATION */
3737 
3738 	return 0;
3739 }
3740 subsys_initcall(swapfile_init);
3741