1 /* 2 * mm/rmap.c - physical to virtual reverse mappings 3 * 4 * Copyright 2001, Rik van Riel <riel@conectiva.com.br> 5 * Released under the General Public License (GPL). 6 * 7 * Simple, low overhead reverse mapping scheme. 8 * Please try to keep this thing as modular as possible. 9 * 10 * Provides methods for unmapping each kind of mapped page: 11 * the anon methods track anonymous pages, and 12 * the file methods track pages belonging to an inode. 13 * 14 * Original design by Rik van Riel <riel@conectiva.com.br> 2001 15 * File methods by Dave McCracken <dmccr@us.ibm.com> 2003, 2004 16 * Anonymous methods by Andrea Arcangeli <andrea@suse.de> 2004 17 * Contributions by Hugh Dickins 2003, 2004 18 */ 19 20 /* 21 * Lock ordering in mm: 22 * 23 * inode->i_mutex (while writing or truncating, not reading or faulting) 24 * mm->mmap_sem 25 * page->flags PG_locked (lock_page) 26 * mapping->i_mmap_mutex 27 * anon_vma->rwsem 28 * mm->page_table_lock or pte_lock 29 * zone->lru_lock (in mark_page_accessed, isolate_lru_page) 30 * swap_lock (in swap_duplicate, swap_info_get) 31 * mmlist_lock (in mmput, drain_mmlist and others) 32 * mapping->private_lock (in __set_page_dirty_buffers) 33 * inode->i_lock (in set_page_dirty's __mark_inode_dirty) 34 * bdi.wb->list_lock (in set_page_dirty's __mark_inode_dirty) 35 * sb_lock (within inode_lock in fs/fs-writeback.c) 36 * mapping->tree_lock (widely used, in set_page_dirty, 37 * in arch-dependent flush_dcache_mmap_lock, 38 * within bdi.wb->list_lock in __sync_single_inode) 39 * 40 * anon_vma->rwsem,mapping->i_mutex (memory_failure, collect_procs_anon) 41 * ->tasklist_lock 42 * pte map lock 43 */ 44 45 #include <linux/mm.h> 46 #include <linux/pagemap.h> 47 #include <linux/swap.h> 48 #include <linux/swapops.h> 49 #include <linux/slab.h> 50 #include <linux/init.h> 51 #include <linux/ksm.h> 52 #include <linux/rmap.h> 53 #include <linux/rcupdate.h> 54 #include <linux/export.h> 55 #include <linux/memcontrol.h> 56 #include <linux/mmu_notifier.h> 57 #include <linux/migrate.h> 58 #include <linux/hugetlb.h> 59 #include <linux/backing-dev.h> 60 61 #include <asm/tlbflush.h> 62 63 #include "internal.h" 64 65 static struct kmem_cache *anon_vma_cachep; 66 static struct kmem_cache *anon_vma_chain_cachep; 67 68 static inline struct anon_vma *anon_vma_alloc(void) 69 { 70 struct anon_vma *anon_vma; 71 72 anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); 73 if (anon_vma) { 74 atomic_set(&anon_vma->refcount, 1); 75 /* 76 * Initialise the anon_vma root to point to itself. If called 77 * from fork, the root will be reset to the parents anon_vma. 78 */ 79 anon_vma->root = anon_vma; 80 } 81 82 return anon_vma; 83 } 84 85 static inline void anon_vma_free(struct anon_vma *anon_vma) 86 { 87 VM_BUG_ON(atomic_read(&anon_vma->refcount)); 88 89 /* 90 * Synchronize against page_lock_anon_vma_read() such that 91 * we can safely hold the lock without the anon_vma getting 92 * freed. 93 * 94 * Relies on the full mb implied by the atomic_dec_and_test() from 95 * put_anon_vma() against the acquire barrier implied by 96 * down_read_trylock() from page_lock_anon_vma_read(). This orders: 97 * 98 * page_lock_anon_vma_read() VS put_anon_vma() 99 * down_read_trylock() atomic_dec_and_test() 100 * LOCK MB 101 * atomic_read() rwsem_is_locked() 102 * 103 * LOCK should suffice since the actual taking of the lock must 104 * happen _before_ what follows. 105 */ 106 if (rwsem_is_locked(&anon_vma->root->rwsem)) { 107 anon_vma_lock_write(anon_vma); 108 anon_vma_unlock(anon_vma); 109 } 110 111 kmem_cache_free(anon_vma_cachep, anon_vma); 112 } 113 114 static inline struct anon_vma_chain *anon_vma_chain_alloc(gfp_t gfp) 115 { 116 return kmem_cache_alloc(anon_vma_chain_cachep, gfp); 117 } 118 119 static void anon_vma_chain_free(struct anon_vma_chain *anon_vma_chain) 120 { 121 kmem_cache_free(anon_vma_chain_cachep, anon_vma_chain); 122 } 123 124 static void anon_vma_chain_link(struct vm_area_struct *vma, 125 struct anon_vma_chain *avc, 126 struct anon_vma *anon_vma) 127 { 128 avc->vma = vma; 129 avc->anon_vma = anon_vma; 130 list_add(&avc->same_vma, &vma->anon_vma_chain); 131 anon_vma_interval_tree_insert(avc, &anon_vma->rb_root); 132 } 133 134 /** 135 * anon_vma_prepare - attach an anon_vma to a memory region 136 * @vma: the memory region in question 137 * 138 * This makes sure the memory mapping described by 'vma' has 139 * an 'anon_vma' attached to it, so that we can associate the 140 * anonymous pages mapped into it with that anon_vma. 141 * 142 * The common case will be that we already have one, but if 143 * not we either need to find an adjacent mapping that we 144 * can re-use the anon_vma from (very common when the only 145 * reason for splitting a vma has been mprotect()), or we 146 * allocate a new one. 147 * 148 * Anon-vma allocations are very subtle, because we may have 149 * optimistically looked up an anon_vma in page_lock_anon_vma_read() 150 * and that may actually touch the spinlock even in the newly 151 * allocated vma (it depends on RCU to make sure that the 152 * anon_vma isn't actually destroyed). 153 * 154 * As a result, we need to do proper anon_vma locking even 155 * for the new allocation. At the same time, we do not want 156 * to do any locking for the common case of already having 157 * an anon_vma. 158 * 159 * This must be called with the mmap_sem held for reading. 160 */ 161 int anon_vma_prepare(struct vm_area_struct *vma) 162 { 163 struct anon_vma *anon_vma = vma->anon_vma; 164 struct anon_vma_chain *avc; 165 166 might_sleep(); 167 if (unlikely(!anon_vma)) { 168 struct mm_struct *mm = vma->vm_mm; 169 struct anon_vma *allocated; 170 171 avc = anon_vma_chain_alloc(GFP_KERNEL); 172 if (!avc) 173 goto out_enomem; 174 175 anon_vma = find_mergeable_anon_vma(vma); 176 allocated = NULL; 177 if (!anon_vma) { 178 anon_vma = anon_vma_alloc(); 179 if (unlikely(!anon_vma)) 180 goto out_enomem_free_avc; 181 allocated = anon_vma; 182 } 183 184 anon_vma_lock_write(anon_vma); 185 /* page_table_lock to protect against threads */ 186 spin_lock(&mm->page_table_lock); 187 if (likely(!vma->anon_vma)) { 188 vma->anon_vma = anon_vma; 189 anon_vma_chain_link(vma, avc, anon_vma); 190 allocated = NULL; 191 avc = NULL; 192 } 193 spin_unlock(&mm->page_table_lock); 194 anon_vma_unlock(anon_vma); 195 196 if (unlikely(allocated)) 197 put_anon_vma(allocated); 198 if (unlikely(avc)) 199 anon_vma_chain_free(avc); 200 } 201 return 0; 202 203 out_enomem_free_avc: 204 anon_vma_chain_free(avc); 205 out_enomem: 206 return -ENOMEM; 207 } 208 209 /* 210 * This is a useful helper function for locking the anon_vma root as 211 * we traverse the vma->anon_vma_chain, looping over anon_vma's that 212 * have the same vma. 213 * 214 * Such anon_vma's should have the same root, so you'd expect to see 215 * just a single mutex_lock for the whole traversal. 216 */ 217 static inline struct anon_vma *lock_anon_vma_root(struct anon_vma *root, struct anon_vma *anon_vma) 218 { 219 struct anon_vma *new_root = anon_vma->root; 220 if (new_root != root) { 221 if (WARN_ON_ONCE(root)) 222 up_write(&root->rwsem); 223 root = new_root; 224 down_write(&root->rwsem); 225 } 226 return root; 227 } 228 229 static inline void unlock_anon_vma_root(struct anon_vma *root) 230 { 231 if (root) 232 up_write(&root->rwsem); 233 } 234 235 /* 236 * Attach the anon_vmas from src to dst. 237 * Returns 0 on success, -ENOMEM on failure. 238 */ 239 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) 240 { 241 struct anon_vma_chain *avc, *pavc; 242 struct anon_vma *root = NULL; 243 244 list_for_each_entry_reverse(pavc, &src->anon_vma_chain, same_vma) { 245 struct anon_vma *anon_vma; 246 247 avc = anon_vma_chain_alloc(GFP_NOWAIT | __GFP_NOWARN); 248 if (unlikely(!avc)) { 249 unlock_anon_vma_root(root); 250 root = NULL; 251 avc = anon_vma_chain_alloc(GFP_KERNEL); 252 if (!avc) 253 goto enomem_failure; 254 } 255 anon_vma = pavc->anon_vma; 256 root = lock_anon_vma_root(root, anon_vma); 257 anon_vma_chain_link(dst, avc, anon_vma); 258 } 259 unlock_anon_vma_root(root); 260 return 0; 261 262 enomem_failure: 263 unlink_anon_vmas(dst); 264 return -ENOMEM; 265 } 266 267 /* 268 * Attach vma to its own anon_vma, as well as to the anon_vmas that 269 * the corresponding VMA in the parent process is attached to. 270 * Returns 0 on success, non-zero on failure. 271 */ 272 int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) 273 { 274 struct anon_vma_chain *avc; 275 struct anon_vma *anon_vma; 276 277 /* Don't bother if the parent process has no anon_vma here. */ 278 if (!pvma->anon_vma) 279 return 0; 280 281 /* 282 * First, attach the new VMA to the parent VMA's anon_vmas, 283 * so rmap can find non-COWed pages in child processes. 284 */ 285 if (anon_vma_clone(vma, pvma)) 286 return -ENOMEM; 287 288 /* Then add our own anon_vma. */ 289 anon_vma = anon_vma_alloc(); 290 if (!anon_vma) 291 goto out_error; 292 avc = anon_vma_chain_alloc(GFP_KERNEL); 293 if (!avc) 294 goto out_error_free_anon_vma; 295 296 /* 297 * The root anon_vma's spinlock is the lock actually used when we 298 * lock any of the anon_vmas in this anon_vma tree. 299 */ 300 anon_vma->root = pvma->anon_vma->root; 301 /* 302 * With refcounts, an anon_vma can stay around longer than the 303 * process it belongs to. The root anon_vma needs to be pinned until 304 * this anon_vma is freed, because the lock lives in the root. 305 */ 306 get_anon_vma(anon_vma->root); 307 /* Mark this anon_vma as the one where our new (COWed) pages go. */ 308 vma->anon_vma = anon_vma; 309 anon_vma_lock_write(anon_vma); 310 anon_vma_chain_link(vma, avc, anon_vma); 311 anon_vma_unlock(anon_vma); 312 313 return 0; 314 315 out_error_free_anon_vma: 316 put_anon_vma(anon_vma); 317 out_error: 318 unlink_anon_vmas(vma); 319 return -ENOMEM; 320 } 321 322 void unlink_anon_vmas(struct vm_area_struct *vma) 323 { 324 struct anon_vma_chain *avc, *next; 325 struct anon_vma *root = NULL; 326 327 /* 328 * Unlink each anon_vma chained to the VMA. This list is ordered 329 * from newest to oldest, ensuring the root anon_vma gets freed last. 330 */ 331 list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { 332 struct anon_vma *anon_vma = avc->anon_vma; 333 334 root = lock_anon_vma_root(root, anon_vma); 335 anon_vma_interval_tree_remove(avc, &anon_vma->rb_root); 336 337 /* 338 * Leave empty anon_vmas on the list - we'll need 339 * to free them outside the lock. 340 */ 341 if (RB_EMPTY_ROOT(&anon_vma->rb_root)) 342 continue; 343 344 list_del(&avc->same_vma); 345 anon_vma_chain_free(avc); 346 } 347 unlock_anon_vma_root(root); 348 349 /* 350 * Iterate the list once more, it now only contains empty and unlinked 351 * anon_vmas, destroy them. Could not do before due to __put_anon_vma() 352 * needing to write-acquire the anon_vma->root->rwsem. 353 */ 354 list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { 355 struct anon_vma *anon_vma = avc->anon_vma; 356 357 put_anon_vma(anon_vma); 358 359 list_del(&avc->same_vma); 360 anon_vma_chain_free(avc); 361 } 362 } 363 364 static void anon_vma_ctor(void *data) 365 { 366 struct anon_vma *anon_vma = data; 367 368 init_rwsem(&anon_vma->rwsem); 369 atomic_set(&anon_vma->refcount, 0); 370 anon_vma->rb_root = RB_ROOT; 371 } 372 373 void __init anon_vma_init(void) 374 { 375 anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma), 376 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC, anon_vma_ctor); 377 anon_vma_chain_cachep = KMEM_CACHE(anon_vma_chain, SLAB_PANIC); 378 } 379 380 /* 381 * Getting a lock on a stable anon_vma from a page off the LRU is tricky! 382 * 383 * Since there is no serialization what so ever against page_remove_rmap() 384 * the best this function can do is return a locked anon_vma that might 385 * have been relevant to this page. 386 * 387 * The page might have been remapped to a different anon_vma or the anon_vma 388 * returned may already be freed (and even reused). 389 * 390 * In case it was remapped to a different anon_vma, the new anon_vma will be a 391 * child of the old anon_vma, and the anon_vma lifetime rules will therefore 392 * ensure that any anon_vma obtained from the page will still be valid for as 393 * long as we observe page_mapped() [ hence all those page_mapped() tests ]. 394 * 395 * All users of this function must be very careful when walking the anon_vma 396 * chain and verify that the page in question is indeed mapped in it 397 * [ something equivalent to page_mapped_in_vma() ]. 398 * 399 * Since anon_vma's slab is DESTROY_BY_RCU and we know from page_remove_rmap() 400 * that the anon_vma pointer from page->mapping is valid if there is a 401 * mapcount, we can dereference the anon_vma after observing those. 402 */ 403 struct anon_vma *page_get_anon_vma(struct page *page) 404 { 405 struct anon_vma *anon_vma = NULL; 406 unsigned long anon_mapping; 407 408 rcu_read_lock(); 409 anon_mapping = (unsigned long) ACCESS_ONCE(page->mapping); 410 if ((anon_mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON) 411 goto out; 412 if (!page_mapped(page)) 413 goto out; 414 415 anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON); 416 if (!atomic_inc_not_zero(&anon_vma->refcount)) { 417 anon_vma = NULL; 418 goto out; 419 } 420 421 /* 422 * If this page is still mapped, then its anon_vma cannot have been 423 * freed. But if it has been unmapped, we have no security against the 424 * anon_vma structure being freed and reused (for another anon_vma: 425 * SLAB_DESTROY_BY_RCU guarantees that - so the atomic_inc_not_zero() 426 * above cannot corrupt). 427 */ 428 if (!page_mapped(page)) { 429 put_anon_vma(anon_vma); 430 anon_vma = NULL; 431 } 432 out: 433 rcu_read_unlock(); 434 435 return anon_vma; 436 } 437 438 /* 439 * Similar to page_get_anon_vma() except it locks the anon_vma. 440 * 441 * Its a little more complex as it tries to keep the fast path to a single 442 * atomic op -- the trylock. If we fail the trylock, we fall back to getting a 443 * reference like with page_get_anon_vma() and then block on the mutex. 444 */ 445 struct anon_vma *page_lock_anon_vma_read(struct page *page) 446 { 447 struct anon_vma *anon_vma = NULL; 448 struct anon_vma *root_anon_vma; 449 unsigned long anon_mapping; 450 451 rcu_read_lock(); 452 anon_mapping = (unsigned long) ACCESS_ONCE(page->mapping); 453 if ((anon_mapping & PAGE_MAPPING_FLAGS) != PAGE_MAPPING_ANON) 454 goto out; 455 if (!page_mapped(page)) 456 goto out; 457 458 anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON); 459 root_anon_vma = ACCESS_ONCE(anon_vma->root); 460 if (down_read_trylock(&root_anon_vma->rwsem)) { 461 /* 462 * If the page is still mapped, then this anon_vma is still 463 * its anon_vma, and holding the mutex ensures that it will 464 * not go away, see anon_vma_free(). 465 */ 466 if (!page_mapped(page)) { 467 up_read(&root_anon_vma->rwsem); 468 anon_vma = NULL; 469 } 470 goto out; 471 } 472 473 /* trylock failed, we got to sleep */ 474 if (!atomic_inc_not_zero(&anon_vma->refcount)) { 475 anon_vma = NULL; 476 goto out; 477 } 478 479 if (!page_mapped(page)) { 480 put_anon_vma(anon_vma); 481 anon_vma = NULL; 482 goto out; 483 } 484 485 /* we pinned the anon_vma, its safe to sleep */ 486 rcu_read_unlock(); 487 anon_vma_lock_read(anon_vma); 488 489 if (atomic_dec_and_test(&anon_vma->refcount)) { 490 /* 491 * Oops, we held the last refcount, release the lock 492 * and bail -- can't simply use put_anon_vma() because 493 * we'll deadlock on the anon_vma_lock_write() recursion. 494 */ 495 anon_vma_unlock_read(anon_vma); 496 __put_anon_vma(anon_vma); 497 anon_vma = NULL; 498 } 499 500 return anon_vma; 501 502 out: 503 rcu_read_unlock(); 504 return anon_vma; 505 } 506 507 void page_unlock_anon_vma_read(struct anon_vma *anon_vma) 508 { 509 anon_vma_unlock_read(anon_vma); 510 } 511 512 /* 513 * At what user virtual address is page expected in @vma? 514 */ 515 static inline unsigned long 516 __vma_address(struct page *page, struct vm_area_struct *vma) 517 { 518 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 519 520 if (unlikely(is_vm_hugetlb_page(vma))) 521 pgoff = page->index << huge_page_order(page_hstate(page)); 522 523 return vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT); 524 } 525 526 inline unsigned long 527 vma_address(struct page *page, struct vm_area_struct *vma) 528 { 529 unsigned long address = __vma_address(page, vma); 530 531 /* page should be within @vma mapping range */ 532 VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end); 533 534 return address; 535 } 536 537 /* 538 * At what user virtual address is page expected in vma? 539 * Caller should check the page is actually part of the vma. 540 */ 541 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma) 542 { 543 unsigned long address; 544 if (PageAnon(page)) { 545 struct anon_vma *page__anon_vma = page_anon_vma(page); 546 /* 547 * Note: swapoff's unuse_vma() is more efficient with this 548 * check, and needs it to match anon_vma when KSM is active. 549 */ 550 if (!vma->anon_vma || !page__anon_vma || 551 vma->anon_vma->root != page__anon_vma->root) 552 return -EFAULT; 553 } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) { 554 if (!vma->vm_file || 555 vma->vm_file->f_mapping != page->mapping) 556 return -EFAULT; 557 } else 558 return -EFAULT; 559 address = __vma_address(page, vma); 560 if (unlikely(address < vma->vm_start || address >= vma->vm_end)) 561 return -EFAULT; 562 return address; 563 } 564 565 pmd_t *mm_find_pmd(struct mm_struct *mm, unsigned long address) 566 { 567 pgd_t *pgd; 568 pud_t *pud; 569 pmd_t *pmd = NULL; 570 571 pgd = pgd_offset(mm, address); 572 if (!pgd_present(*pgd)) 573 goto out; 574 575 pud = pud_offset(pgd, address); 576 if (!pud_present(*pud)) 577 goto out; 578 579 pmd = pmd_offset(pud, address); 580 if (!pmd_present(*pmd)) 581 pmd = NULL; 582 out: 583 return pmd; 584 } 585 586 /* 587 * Check that @page is mapped at @address into @mm. 588 * 589 * If @sync is false, page_check_address may perform a racy check to avoid 590 * the page table lock when the pte is not present (helpful when reclaiming 591 * highly shared pages). 592 * 593 * On success returns with pte mapped and locked. 594 */ 595 pte_t *__page_check_address(struct page *page, struct mm_struct *mm, 596 unsigned long address, spinlock_t **ptlp, int sync) 597 { 598 pmd_t *pmd; 599 pte_t *pte; 600 spinlock_t *ptl; 601 602 if (unlikely(PageHuge(page))) { 603 pte = huge_pte_offset(mm, address); 604 ptl = &mm->page_table_lock; 605 goto check; 606 } 607 608 pmd = mm_find_pmd(mm, address); 609 if (!pmd) 610 return NULL; 611 612 if (pmd_trans_huge(*pmd)) 613 return NULL; 614 615 pte = pte_offset_map(pmd, address); 616 /* Make a quick check before getting the lock */ 617 if (!sync && !pte_present(*pte)) { 618 pte_unmap(pte); 619 return NULL; 620 } 621 622 ptl = pte_lockptr(mm, pmd); 623 check: 624 spin_lock(ptl); 625 if (pte_present(*pte) && page_to_pfn(page) == pte_pfn(*pte)) { 626 *ptlp = ptl; 627 return pte; 628 } 629 pte_unmap_unlock(pte, ptl); 630 return NULL; 631 } 632 633 /** 634 * page_mapped_in_vma - check whether a page is really mapped in a VMA 635 * @page: the page to test 636 * @vma: the VMA to test 637 * 638 * Returns 1 if the page is mapped into the page tables of the VMA, 0 639 * if the page is not mapped into the page tables of this VMA. Only 640 * valid for normal file or anonymous VMAs. 641 */ 642 int page_mapped_in_vma(struct page *page, struct vm_area_struct *vma) 643 { 644 unsigned long address; 645 pte_t *pte; 646 spinlock_t *ptl; 647 648 address = __vma_address(page, vma); 649 if (unlikely(address < vma->vm_start || address >= vma->vm_end)) 650 return 0; 651 pte = page_check_address(page, vma->vm_mm, address, &ptl, 1); 652 if (!pte) /* the page is not in this mm */ 653 return 0; 654 pte_unmap_unlock(pte, ptl); 655 656 return 1; 657 } 658 659 /* 660 * Subfunctions of page_referenced: page_referenced_one called 661 * repeatedly from either page_referenced_anon or page_referenced_file. 662 */ 663 int page_referenced_one(struct page *page, struct vm_area_struct *vma, 664 unsigned long address, unsigned int *mapcount, 665 unsigned long *vm_flags) 666 { 667 struct mm_struct *mm = vma->vm_mm; 668 int referenced = 0; 669 670 if (unlikely(PageTransHuge(page))) { 671 pmd_t *pmd; 672 673 spin_lock(&mm->page_table_lock); 674 /* 675 * rmap might return false positives; we must filter 676 * these out using page_check_address_pmd(). 677 */ 678 pmd = page_check_address_pmd(page, mm, address, 679 PAGE_CHECK_ADDRESS_PMD_FLAG); 680 if (!pmd) { 681 spin_unlock(&mm->page_table_lock); 682 goto out; 683 } 684 685 if (vma->vm_flags & VM_LOCKED) { 686 spin_unlock(&mm->page_table_lock); 687 *mapcount = 0; /* break early from loop */ 688 *vm_flags |= VM_LOCKED; 689 goto out; 690 } 691 692 /* go ahead even if the pmd is pmd_trans_splitting() */ 693 if (pmdp_clear_flush_young_notify(vma, address, pmd)) 694 referenced++; 695 spin_unlock(&mm->page_table_lock); 696 } else { 697 pte_t *pte; 698 spinlock_t *ptl; 699 700 /* 701 * rmap might return false positives; we must filter 702 * these out using page_check_address(). 703 */ 704 pte = page_check_address(page, mm, address, &ptl, 0); 705 if (!pte) 706 goto out; 707 708 if (vma->vm_flags & VM_LOCKED) { 709 pte_unmap_unlock(pte, ptl); 710 *mapcount = 0; /* break early from loop */ 711 *vm_flags |= VM_LOCKED; 712 goto out; 713 } 714 715 if (ptep_clear_flush_young_notify(vma, address, pte)) { 716 /* 717 * Don't treat a reference through a sequentially read 718 * mapping as such. If the page has been used in 719 * another mapping, we will catch it; if this other 720 * mapping is already gone, the unmap path will have 721 * set PG_referenced or activated the page. 722 */ 723 if (likely(!VM_SequentialReadHint(vma))) 724 referenced++; 725 } 726 pte_unmap_unlock(pte, ptl); 727 } 728 729 (*mapcount)--; 730 731 if (referenced) 732 *vm_flags |= vma->vm_flags; 733 out: 734 return referenced; 735 } 736 737 static int page_referenced_anon(struct page *page, 738 struct mem_cgroup *memcg, 739 unsigned long *vm_flags) 740 { 741 unsigned int mapcount; 742 struct anon_vma *anon_vma; 743 pgoff_t pgoff; 744 struct anon_vma_chain *avc; 745 int referenced = 0; 746 747 anon_vma = page_lock_anon_vma_read(page); 748 if (!anon_vma) 749 return referenced; 750 751 mapcount = page_mapcount(page); 752 pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 753 anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff, pgoff) { 754 struct vm_area_struct *vma = avc->vma; 755 unsigned long address = vma_address(page, vma); 756 /* 757 * If we are reclaiming on behalf of a cgroup, skip 758 * counting on behalf of references from different 759 * cgroups 760 */ 761 if (memcg && !mm_match_cgroup(vma->vm_mm, memcg)) 762 continue; 763 referenced += page_referenced_one(page, vma, address, 764 &mapcount, vm_flags); 765 if (!mapcount) 766 break; 767 } 768 769 page_unlock_anon_vma_read(anon_vma); 770 return referenced; 771 } 772 773 /** 774 * page_referenced_file - referenced check for object-based rmap 775 * @page: the page we're checking references on. 776 * @memcg: target memory control group 777 * @vm_flags: collect encountered vma->vm_flags who actually referenced the page 778 * 779 * For an object-based mapped page, find all the places it is mapped and 780 * check/clear the referenced flag. This is done by following the page->mapping 781 * pointer, then walking the chain of vmas it holds. It returns the number 782 * of references it found. 783 * 784 * This function is only called from page_referenced for object-based pages. 785 */ 786 static int page_referenced_file(struct page *page, 787 struct mem_cgroup *memcg, 788 unsigned long *vm_flags) 789 { 790 unsigned int mapcount; 791 struct address_space *mapping = page->mapping; 792 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 793 struct vm_area_struct *vma; 794 int referenced = 0; 795 796 /* 797 * The caller's checks on page->mapping and !PageAnon have made 798 * sure that this is a file page: the check for page->mapping 799 * excludes the case just before it gets set on an anon page. 800 */ 801 BUG_ON(PageAnon(page)); 802 803 /* 804 * The page lock not only makes sure that page->mapping cannot 805 * suddenly be NULLified by truncation, it makes sure that the 806 * structure at mapping cannot be freed and reused yet, 807 * so we can safely take mapping->i_mmap_mutex. 808 */ 809 BUG_ON(!PageLocked(page)); 810 811 mutex_lock(&mapping->i_mmap_mutex); 812 813 /* 814 * i_mmap_mutex does not stabilize mapcount at all, but mapcount 815 * is more likely to be accurate if we note it after spinning. 816 */ 817 mapcount = page_mapcount(page); 818 819 vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { 820 unsigned long address = vma_address(page, vma); 821 /* 822 * If we are reclaiming on behalf of a cgroup, skip 823 * counting on behalf of references from different 824 * cgroups 825 */ 826 if (memcg && !mm_match_cgroup(vma->vm_mm, memcg)) 827 continue; 828 referenced += page_referenced_one(page, vma, address, 829 &mapcount, vm_flags); 830 if (!mapcount) 831 break; 832 } 833 834 mutex_unlock(&mapping->i_mmap_mutex); 835 return referenced; 836 } 837 838 /** 839 * page_referenced - test if the page was referenced 840 * @page: the page to test 841 * @is_locked: caller holds lock on the page 842 * @memcg: target memory cgroup 843 * @vm_flags: collect encountered vma->vm_flags who actually referenced the page 844 * 845 * Quick test_and_clear_referenced for all mappings to a page, 846 * returns the number of ptes which referenced the page. 847 */ 848 int page_referenced(struct page *page, 849 int is_locked, 850 struct mem_cgroup *memcg, 851 unsigned long *vm_flags) 852 { 853 int referenced = 0; 854 int we_locked = 0; 855 856 *vm_flags = 0; 857 if (page_mapped(page) && page_rmapping(page)) { 858 if (!is_locked && (!PageAnon(page) || PageKsm(page))) { 859 we_locked = trylock_page(page); 860 if (!we_locked) { 861 referenced++; 862 goto out; 863 } 864 } 865 if (unlikely(PageKsm(page))) 866 referenced += page_referenced_ksm(page, memcg, 867 vm_flags); 868 else if (PageAnon(page)) 869 referenced += page_referenced_anon(page, memcg, 870 vm_flags); 871 else if (page->mapping) 872 referenced += page_referenced_file(page, memcg, 873 vm_flags); 874 if (we_locked) 875 unlock_page(page); 876 877 if (page_test_and_clear_young(page_to_pfn(page))) 878 referenced++; 879 } 880 out: 881 return referenced; 882 } 883 884 static int page_mkclean_one(struct page *page, struct vm_area_struct *vma, 885 unsigned long address) 886 { 887 struct mm_struct *mm = vma->vm_mm; 888 pte_t *pte; 889 spinlock_t *ptl; 890 int ret = 0; 891 892 pte = page_check_address(page, mm, address, &ptl, 1); 893 if (!pte) 894 goto out; 895 896 if (pte_dirty(*pte) || pte_write(*pte)) { 897 pte_t entry; 898 899 flush_cache_page(vma, address, pte_pfn(*pte)); 900 entry = ptep_clear_flush(vma, address, pte); 901 entry = pte_wrprotect(entry); 902 entry = pte_mkclean(entry); 903 set_pte_at(mm, address, pte, entry); 904 ret = 1; 905 } 906 907 pte_unmap_unlock(pte, ptl); 908 909 if (ret) 910 mmu_notifier_invalidate_page(mm, address); 911 out: 912 return ret; 913 } 914 915 static int page_mkclean_file(struct address_space *mapping, struct page *page) 916 { 917 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 918 struct vm_area_struct *vma; 919 int ret = 0; 920 921 BUG_ON(PageAnon(page)); 922 923 mutex_lock(&mapping->i_mmap_mutex); 924 vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { 925 if (vma->vm_flags & VM_SHARED) { 926 unsigned long address = vma_address(page, vma); 927 ret += page_mkclean_one(page, vma, address); 928 } 929 } 930 mutex_unlock(&mapping->i_mmap_mutex); 931 return ret; 932 } 933 934 int page_mkclean(struct page *page) 935 { 936 int ret = 0; 937 938 BUG_ON(!PageLocked(page)); 939 940 if (page_mapped(page)) { 941 struct address_space *mapping = page_mapping(page); 942 if (mapping) 943 ret = page_mkclean_file(mapping, page); 944 } 945 946 return ret; 947 } 948 EXPORT_SYMBOL_GPL(page_mkclean); 949 950 /** 951 * page_move_anon_rmap - move a page to our anon_vma 952 * @page: the page to move to our anon_vma 953 * @vma: the vma the page belongs to 954 * @address: the user virtual address mapped 955 * 956 * When a page belongs exclusively to one process after a COW event, 957 * that page can be moved into the anon_vma that belongs to just that 958 * process, so the rmap code will not search the parent or sibling 959 * processes. 960 */ 961 void page_move_anon_rmap(struct page *page, 962 struct vm_area_struct *vma, unsigned long address) 963 { 964 struct anon_vma *anon_vma = vma->anon_vma; 965 966 VM_BUG_ON(!PageLocked(page)); 967 VM_BUG_ON(!anon_vma); 968 VM_BUG_ON(page->index != linear_page_index(vma, address)); 969 970 anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON; 971 page->mapping = (struct address_space *) anon_vma; 972 } 973 974 /** 975 * __page_set_anon_rmap - set up new anonymous rmap 976 * @page: Page to add to rmap 977 * @vma: VM area to add page to. 978 * @address: User virtual address of the mapping 979 * @exclusive: the page is exclusively owned by the current process 980 */ 981 static void __page_set_anon_rmap(struct page *page, 982 struct vm_area_struct *vma, unsigned long address, int exclusive) 983 { 984 struct anon_vma *anon_vma = vma->anon_vma; 985 986 BUG_ON(!anon_vma); 987 988 if (PageAnon(page)) 989 return; 990 991 /* 992 * If the page isn't exclusively mapped into this vma, 993 * we must use the _oldest_ possible anon_vma for the 994 * page mapping! 995 */ 996 if (!exclusive) 997 anon_vma = anon_vma->root; 998 999 anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON; 1000 page->mapping = (struct address_space *) anon_vma; 1001 page->index = linear_page_index(vma, address); 1002 } 1003 1004 /** 1005 * __page_check_anon_rmap - sanity check anonymous rmap addition 1006 * @page: the page to add the mapping to 1007 * @vma: the vm area in which the mapping is added 1008 * @address: the user virtual address mapped 1009 */ 1010 static void __page_check_anon_rmap(struct page *page, 1011 struct vm_area_struct *vma, unsigned long address) 1012 { 1013 #ifdef CONFIG_DEBUG_VM 1014 /* 1015 * The page's anon-rmap details (mapping and index) are guaranteed to 1016 * be set up correctly at this point. 1017 * 1018 * We have exclusion against page_add_anon_rmap because the caller 1019 * always holds the page locked, except if called from page_dup_rmap, 1020 * in which case the page is already known to be setup. 1021 * 1022 * We have exclusion against page_add_new_anon_rmap because those pages 1023 * are initially only visible via the pagetables, and the pte is locked 1024 * over the call to page_add_new_anon_rmap. 1025 */ 1026 BUG_ON(page_anon_vma(page)->root != vma->anon_vma->root); 1027 BUG_ON(page->index != linear_page_index(vma, address)); 1028 #endif 1029 } 1030 1031 /** 1032 * page_add_anon_rmap - add pte mapping to an anonymous page 1033 * @page: the page to add the mapping to 1034 * @vma: the vm area in which the mapping is added 1035 * @address: the user virtual address mapped 1036 * 1037 * The caller needs to hold the pte lock, and the page must be locked in 1038 * the anon_vma case: to serialize mapping,index checking after setting, 1039 * and to ensure that PageAnon is not being upgraded racily to PageKsm 1040 * (but PageKsm is never downgraded to PageAnon). 1041 */ 1042 void page_add_anon_rmap(struct page *page, 1043 struct vm_area_struct *vma, unsigned long address) 1044 { 1045 do_page_add_anon_rmap(page, vma, address, 0); 1046 } 1047 1048 /* 1049 * Special version of the above for do_swap_page, which often runs 1050 * into pages that are exclusively owned by the current process. 1051 * Everybody else should continue to use page_add_anon_rmap above. 1052 */ 1053 void do_page_add_anon_rmap(struct page *page, 1054 struct vm_area_struct *vma, unsigned long address, int exclusive) 1055 { 1056 int first = atomic_inc_and_test(&page->_mapcount); 1057 if (first) { 1058 if (!PageTransHuge(page)) 1059 __inc_zone_page_state(page, NR_ANON_PAGES); 1060 else 1061 __inc_zone_page_state(page, 1062 NR_ANON_TRANSPARENT_HUGEPAGES); 1063 } 1064 if (unlikely(PageKsm(page))) 1065 return; 1066 1067 VM_BUG_ON(!PageLocked(page)); 1068 /* address might be in next vma when migration races vma_adjust */ 1069 if (first) 1070 __page_set_anon_rmap(page, vma, address, exclusive); 1071 else 1072 __page_check_anon_rmap(page, vma, address); 1073 } 1074 1075 /** 1076 * page_add_new_anon_rmap - add pte mapping to a new anonymous page 1077 * @page: the page to add the mapping to 1078 * @vma: the vm area in which the mapping is added 1079 * @address: the user virtual address mapped 1080 * 1081 * Same as page_add_anon_rmap but must only be called on *new* pages. 1082 * This means the inc-and-test can be bypassed. 1083 * Page does not have to be locked. 1084 */ 1085 void page_add_new_anon_rmap(struct page *page, 1086 struct vm_area_struct *vma, unsigned long address) 1087 { 1088 VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end); 1089 SetPageSwapBacked(page); 1090 atomic_set(&page->_mapcount, 0); /* increment count (starts at -1) */ 1091 if (!PageTransHuge(page)) 1092 __inc_zone_page_state(page, NR_ANON_PAGES); 1093 else 1094 __inc_zone_page_state(page, NR_ANON_TRANSPARENT_HUGEPAGES); 1095 __page_set_anon_rmap(page, vma, address, 1); 1096 if (!mlocked_vma_newpage(vma, page)) 1097 lru_cache_add_lru(page, LRU_ACTIVE_ANON); 1098 else 1099 add_page_to_unevictable_list(page); 1100 } 1101 1102 /** 1103 * page_add_file_rmap - add pte mapping to a file page 1104 * @page: the page to add the mapping to 1105 * 1106 * The caller needs to hold the pte lock. 1107 */ 1108 void page_add_file_rmap(struct page *page) 1109 { 1110 bool locked; 1111 unsigned long flags; 1112 1113 mem_cgroup_begin_update_page_stat(page, &locked, &flags); 1114 if (atomic_inc_and_test(&page->_mapcount)) { 1115 __inc_zone_page_state(page, NR_FILE_MAPPED); 1116 mem_cgroup_inc_page_stat(page, MEMCG_NR_FILE_MAPPED); 1117 } 1118 mem_cgroup_end_update_page_stat(page, &locked, &flags); 1119 } 1120 1121 /** 1122 * page_remove_rmap - take down pte mapping from a page 1123 * @page: page to remove mapping from 1124 * 1125 * The caller needs to hold the pte lock. 1126 */ 1127 void page_remove_rmap(struct page *page) 1128 { 1129 struct address_space *mapping = page_mapping(page); 1130 bool anon = PageAnon(page); 1131 bool locked; 1132 unsigned long flags; 1133 1134 /* 1135 * The anon case has no mem_cgroup page_stat to update; but may 1136 * uncharge_page() below, where the lock ordering can deadlock if 1137 * we hold the lock against page_stat move: so avoid it on anon. 1138 */ 1139 if (!anon) 1140 mem_cgroup_begin_update_page_stat(page, &locked, &flags); 1141 1142 /* page still mapped by someone else? */ 1143 if (!atomic_add_negative(-1, &page->_mapcount)) 1144 goto out; 1145 1146 /* 1147 * Now that the last pte has gone, s390 must transfer dirty 1148 * flag from storage key to struct page. We can usually skip 1149 * this if the page is anon, so about to be freed; but perhaps 1150 * not if it's in swapcache - there might be another pte slot 1151 * containing the swap entry, but page not yet written to swap. 1152 * 1153 * And we can skip it on file pages, so long as the filesystem 1154 * participates in dirty tracking (note that this is not only an 1155 * optimization but also solves problems caused by dirty flag in 1156 * storage key getting set by a write from inside kernel); but need to 1157 * catch shm and tmpfs and ramfs pages which have been modified since 1158 * creation by read fault. 1159 * 1160 * Note that mapping must be decided above, before decrementing 1161 * mapcount (which luckily provides a barrier): once page is unmapped, 1162 * it could be truncated and page->mapping reset to NULL at any moment. 1163 * Note also that we are relying on page_mapping(page) to set mapping 1164 * to &swapper_space when PageSwapCache(page). 1165 */ 1166 if (mapping && !mapping_cap_account_dirty(mapping) && 1167 page_test_and_clear_dirty(page_to_pfn(page), 1)) 1168 set_page_dirty(page); 1169 /* 1170 * Hugepages are not counted in NR_ANON_PAGES nor NR_FILE_MAPPED 1171 * and not charged by memcg for now. 1172 */ 1173 if (unlikely(PageHuge(page))) 1174 goto out; 1175 if (anon) { 1176 mem_cgroup_uncharge_page(page); 1177 if (!PageTransHuge(page)) 1178 __dec_zone_page_state(page, NR_ANON_PAGES); 1179 else 1180 __dec_zone_page_state(page, 1181 NR_ANON_TRANSPARENT_HUGEPAGES); 1182 } else { 1183 __dec_zone_page_state(page, NR_FILE_MAPPED); 1184 mem_cgroup_dec_page_stat(page, MEMCG_NR_FILE_MAPPED); 1185 mem_cgroup_end_update_page_stat(page, &locked, &flags); 1186 } 1187 if (unlikely(PageMlocked(page))) 1188 clear_page_mlock(page); 1189 /* 1190 * It would be tidy to reset the PageAnon mapping here, 1191 * but that might overwrite a racing page_add_anon_rmap 1192 * which increments mapcount after us but sets mapping 1193 * before us: so leave the reset to free_hot_cold_page, 1194 * and remember that it's only reliable while mapped. 1195 * Leaving it set also helps swapoff to reinstate ptes 1196 * faster for those pages still in swapcache. 1197 */ 1198 return; 1199 out: 1200 if (!anon) 1201 mem_cgroup_end_update_page_stat(page, &locked, &flags); 1202 } 1203 1204 /* 1205 * Subfunctions of try_to_unmap: try_to_unmap_one called 1206 * repeatedly from try_to_unmap_ksm, try_to_unmap_anon or try_to_unmap_file. 1207 */ 1208 int try_to_unmap_one(struct page *page, struct vm_area_struct *vma, 1209 unsigned long address, enum ttu_flags flags) 1210 { 1211 struct mm_struct *mm = vma->vm_mm; 1212 pte_t *pte; 1213 pte_t pteval; 1214 spinlock_t *ptl; 1215 int ret = SWAP_AGAIN; 1216 1217 pte = page_check_address(page, mm, address, &ptl, 0); 1218 if (!pte) 1219 goto out; 1220 1221 /* 1222 * If the page is mlock()d, we cannot swap it out. 1223 * If it's recently referenced (perhaps page_referenced 1224 * skipped over this mm) then we should reactivate it. 1225 */ 1226 if (!(flags & TTU_IGNORE_MLOCK)) { 1227 if (vma->vm_flags & VM_LOCKED) 1228 goto out_mlock; 1229 1230 if (TTU_ACTION(flags) == TTU_MUNLOCK) 1231 goto out_unmap; 1232 } 1233 if (!(flags & TTU_IGNORE_ACCESS)) { 1234 if (ptep_clear_flush_young_notify(vma, address, pte)) { 1235 ret = SWAP_FAIL; 1236 goto out_unmap; 1237 } 1238 } 1239 1240 /* Nuke the page table entry. */ 1241 flush_cache_page(vma, address, page_to_pfn(page)); 1242 pteval = ptep_clear_flush(vma, address, pte); 1243 1244 /* Move the dirty bit to the physical page now the pte is gone. */ 1245 if (pte_dirty(pteval)) 1246 set_page_dirty(page); 1247 1248 /* Update high watermark before we lower rss */ 1249 update_hiwater_rss(mm); 1250 1251 if (PageHWPoison(page) && !(flags & TTU_IGNORE_HWPOISON)) { 1252 if (!PageHuge(page)) { 1253 if (PageAnon(page)) 1254 dec_mm_counter(mm, MM_ANONPAGES); 1255 else 1256 dec_mm_counter(mm, MM_FILEPAGES); 1257 } 1258 set_pte_at(mm, address, pte, 1259 swp_entry_to_pte(make_hwpoison_entry(page))); 1260 } else if (PageAnon(page)) { 1261 swp_entry_t entry = { .val = page_private(page) }; 1262 1263 if (PageSwapCache(page)) { 1264 /* 1265 * Store the swap location in the pte. 1266 * See handle_pte_fault() ... 1267 */ 1268 if (swap_duplicate(entry) < 0) { 1269 set_pte_at(mm, address, pte, pteval); 1270 ret = SWAP_FAIL; 1271 goto out_unmap; 1272 } 1273 if (list_empty(&mm->mmlist)) { 1274 spin_lock(&mmlist_lock); 1275 if (list_empty(&mm->mmlist)) 1276 list_add(&mm->mmlist, &init_mm.mmlist); 1277 spin_unlock(&mmlist_lock); 1278 } 1279 dec_mm_counter(mm, MM_ANONPAGES); 1280 inc_mm_counter(mm, MM_SWAPENTS); 1281 } else if (IS_ENABLED(CONFIG_MIGRATION)) { 1282 /* 1283 * Store the pfn of the page in a special migration 1284 * pte. do_swap_page() will wait until the migration 1285 * pte is removed and then restart fault handling. 1286 */ 1287 BUG_ON(TTU_ACTION(flags) != TTU_MIGRATION); 1288 entry = make_migration_entry(page, pte_write(pteval)); 1289 } 1290 set_pte_at(mm, address, pte, swp_entry_to_pte(entry)); 1291 BUG_ON(pte_file(*pte)); 1292 } else if (IS_ENABLED(CONFIG_MIGRATION) && 1293 (TTU_ACTION(flags) == TTU_MIGRATION)) { 1294 /* Establish migration entry for a file page */ 1295 swp_entry_t entry; 1296 entry = make_migration_entry(page, pte_write(pteval)); 1297 set_pte_at(mm, address, pte, swp_entry_to_pte(entry)); 1298 } else 1299 dec_mm_counter(mm, MM_FILEPAGES); 1300 1301 page_remove_rmap(page); 1302 page_cache_release(page); 1303 1304 out_unmap: 1305 pte_unmap_unlock(pte, ptl); 1306 if (ret != SWAP_FAIL) 1307 mmu_notifier_invalidate_page(mm, address); 1308 out: 1309 return ret; 1310 1311 out_mlock: 1312 pte_unmap_unlock(pte, ptl); 1313 1314 1315 /* 1316 * We need mmap_sem locking, Otherwise VM_LOCKED check makes 1317 * unstable result and race. Plus, We can't wait here because 1318 * we now hold anon_vma->rwsem or mapping->i_mmap_mutex. 1319 * if trylock failed, the page remain in evictable lru and later 1320 * vmscan could retry to move the page to unevictable lru if the 1321 * page is actually mlocked. 1322 */ 1323 if (down_read_trylock(&vma->vm_mm->mmap_sem)) { 1324 if (vma->vm_flags & VM_LOCKED) { 1325 mlock_vma_page(page); 1326 ret = SWAP_MLOCK; 1327 } 1328 up_read(&vma->vm_mm->mmap_sem); 1329 } 1330 return ret; 1331 } 1332 1333 /* 1334 * objrmap doesn't work for nonlinear VMAs because the assumption that 1335 * offset-into-file correlates with offset-into-virtual-addresses does not hold. 1336 * Consequently, given a particular page and its ->index, we cannot locate the 1337 * ptes which are mapping that page without an exhaustive linear search. 1338 * 1339 * So what this code does is a mini "virtual scan" of each nonlinear VMA which 1340 * maps the file to which the target page belongs. The ->vm_private_data field 1341 * holds the current cursor into that scan. Successive searches will circulate 1342 * around the vma's virtual address space. 1343 * 1344 * So as more replacement pressure is applied to the pages in a nonlinear VMA, 1345 * more scanning pressure is placed against them as well. Eventually pages 1346 * will become fully unmapped and are eligible for eviction. 1347 * 1348 * For very sparsely populated VMAs this is a little inefficient - chances are 1349 * there there won't be many ptes located within the scan cluster. In this case 1350 * maybe we could scan further - to the end of the pte page, perhaps. 1351 * 1352 * Mlocked pages: check VM_LOCKED under mmap_sem held for read, if we can 1353 * acquire it without blocking. If vma locked, mlock the pages in the cluster, 1354 * rather than unmapping them. If we encounter the "check_page" that vmscan is 1355 * trying to unmap, return SWAP_MLOCK, else default SWAP_AGAIN. 1356 */ 1357 #define CLUSTER_SIZE min(32*PAGE_SIZE, PMD_SIZE) 1358 #define CLUSTER_MASK (~(CLUSTER_SIZE - 1)) 1359 1360 static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount, 1361 struct vm_area_struct *vma, struct page *check_page) 1362 { 1363 struct mm_struct *mm = vma->vm_mm; 1364 pmd_t *pmd; 1365 pte_t *pte; 1366 pte_t pteval; 1367 spinlock_t *ptl; 1368 struct page *page; 1369 unsigned long address; 1370 unsigned long mmun_start; /* For mmu_notifiers */ 1371 unsigned long mmun_end; /* For mmu_notifiers */ 1372 unsigned long end; 1373 int ret = SWAP_AGAIN; 1374 int locked_vma = 0; 1375 1376 address = (vma->vm_start + cursor) & CLUSTER_MASK; 1377 end = address + CLUSTER_SIZE; 1378 if (address < vma->vm_start) 1379 address = vma->vm_start; 1380 if (end > vma->vm_end) 1381 end = vma->vm_end; 1382 1383 pmd = mm_find_pmd(mm, address); 1384 if (!pmd) 1385 return ret; 1386 1387 mmun_start = address; 1388 mmun_end = end; 1389 mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); 1390 1391 /* 1392 * If we can acquire the mmap_sem for read, and vma is VM_LOCKED, 1393 * keep the sem while scanning the cluster for mlocking pages. 1394 */ 1395 if (down_read_trylock(&vma->vm_mm->mmap_sem)) { 1396 locked_vma = (vma->vm_flags & VM_LOCKED); 1397 if (!locked_vma) 1398 up_read(&vma->vm_mm->mmap_sem); /* don't need it */ 1399 } 1400 1401 pte = pte_offset_map_lock(mm, pmd, address, &ptl); 1402 1403 /* Update high watermark before we lower rss */ 1404 update_hiwater_rss(mm); 1405 1406 for (; address < end; pte++, address += PAGE_SIZE) { 1407 if (!pte_present(*pte)) 1408 continue; 1409 page = vm_normal_page(vma, address, *pte); 1410 BUG_ON(!page || PageAnon(page)); 1411 1412 if (locked_vma) { 1413 mlock_vma_page(page); /* no-op if already mlocked */ 1414 if (page == check_page) 1415 ret = SWAP_MLOCK; 1416 continue; /* don't unmap */ 1417 } 1418 1419 if (ptep_clear_flush_young_notify(vma, address, pte)) 1420 continue; 1421 1422 /* Nuke the page table entry. */ 1423 flush_cache_page(vma, address, pte_pfn(*pte)); 1424 pteval = ptep_clear_flush(vma, address, pte); 1425 1426 /* If nonlinear, store the file page offset in the pte. */ 1427 if (page->index != linear_page_index(vma, address)) 1428 set_pte_at(mm, address, pte, pgoff_to_pte(page->index)); 1429 1430 /* Move the dirty bit to the physical page now the pte is gone. */ 1431 if (pte_dirty(pteval)) 1432 set_page_dirty(page); 1433 1434 page_remove_rmap(page); 1435 page_cache_release(page); 1436 dec_mm_counter(mm, MM_FILEPAGES); 1437 (*mapcount)--; 1438 } 1439 pte_unmap_unlock(pte - 1, ptl); 1440 mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end); 1441 if (locked_vma) 1442 up_read(&vma->vm_mm->mmap_sem); 1443 return ret; 1444 } 1445 1446 bool is_vma_temporary_stack(struct vm_area_struct *vma) 1447 { 1448 int maybe_stack = vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP); 1449 1450 if (!maybe_stack) 1451 return false; 1452 1453 if ((vma->vm_flags & VM_STACK_INCOMPLETE_SETUP) == 1454 VM_STACK_INCOMPLETE_SETUP) 1455 return true; 1456 1457 return false; 1458 } 1459 1460 /** 1461 * try_to_unmap_anon - unmap or unlock anonymous page using the object-based 1462 * rmap method 1463 * @page: the page to unmap/unlock 1464 * @flags: action and flags 1465 * 1466 * Find all the mappings of a page using the mapping pointer and the vma chains 1467 * contained in the anon_vma struct it points to. 1468 * 1469 * This function is only called from try_to_unmap/try_to_munlock for 1470 * anonymous pages. 1471 * When called from try_to_munlock(), the mmap_sem of the mm containing the vma 1472 * where the page was found will be held for write. So, we won't recheck 1473 * vm_flags for that VMA. That should be OK, because that vma shouldn't be 1474 * 'LOCKED. 1475 */ 1476 static int try_to_unmap_anon(struct page *page, enum ttu_flags flags) 1477 { 1478 struct anon_vma *anon_vma; 1479 pgoff_t pgoff; 1480 struct anon_vma_chain *avc; 1481 int ret = SWAP_AGAIN; 1482 1483 anon_vma = page_lock_anon_vma_read(page); 1484 if (!anon_vma) 1485 return ret; 1486 1487 pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 1488 anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff, pgoff) { 1489 struct vm_area_struct *vma = avc->vma; 1490 unsigned long address; 1491 1492 /* 1493 * During exec, a temporary VMA is setup and later moved. 1494 * The VMA is moved under the anon_vma lock but not the 1495 * page tables leading to a race where migration cannot 1496 * find the migration ptes. Rather than increasing the 1497 * locking requirements of exec(), migration skips 1498 * temporary VMAs until after exec() completes. 1499 */ 1500 if (IS_ENABLED(CONFIG_MIGRATION) && (flags & TTU_MIGRATION) && 1501 is_vma_temporary_stack(vma)) 1502 continue; 1503 1504 address = vma_address(page, vma); 1505 ret = try_to_unmap_one(page, vma, address, flags); 1506 if (ret != SWAP_AGAIN || !page_mapped(page)) 1507 break; 1508 } 1509 1510 page_unlock_anon_vma_read(anon_vma); 1511 return ret; 1512 } 1513 1514 /** 1515 * try_to_unmap_file - unmap/unlock file page using the object-based rmap method 1516 * @page: the page to unmap/unlock 1517 * @flags: action and flags 1518 * 1519 * Find all the mappings of a page using the mapping pointer and the vma chains 1520 * contained in the address_space struct it points to. 1521 * 1522 * This function is only called from try_to_unmap/try_to_munlock for 1523 * object-based pages. 1524 * When called from try_to_munlock(), the mmap_sem of the mm containing the vma 1525 * where the page was found will be held for write. So, we won't recheck 1526 * vm_flags for that VMA. That should be OK, because that vma shouldn't be 1527 * 'LOCKED. 1528 */ 1529 static int try_to_unmap_file(struct page *page, enum ttu_flags flags) 1530 { 1531 struct address_space *mapping = page->mapping; 1532 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 1533 struct vm_area_struct *vma; 1534 int ret = SWAP_AGAIN; 1535 unsigned long cursor; 1536 unsigned long max_nl_cursor = 0; 1537 unsigned long max_nl_size = 0; 1538 unsigned int mapcount; 1539 1540 mutex_lock(&mapping->i_mmap_mutex); 1541 vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { 1542 unsigned long address = vma_address(page, vma); 1543 ret = try_to_unmap_one(page, vma, address, flags); 1544 if (ret != SWAP_AGAIN || !page_mapped(page)) 1545 goto out; 1546 } 1547 1548 if (list_empty(&mapping->i_mmap_nonlinear)) 1549 goto out; 1550 1551 /* 1552 * We don't bother to try to find the munlocked page in nonlinears. 1553 * It's costly. Instead, later, page reclaim logic may call 1554 * try_to_unmap(TTU_MUNLOCK) and recover PG_mlocked lazily. 1555 */ 1556 if (TTU_ACTION(flags) == TTU_MUNLOCK) 1557 goto out; 1558 1559 list_for_each_entry(vma, &mapping->i_mmap_nonlinear, 1560 shared.nonlinear) { 1561 cursor = (unsigned long) vma->vm_private_data; 1562 if (cursor > max_nl_cursor) 1563 max_nl_cursor = cursor; 1564 cursor = vma->vm_end - vma->vm_start; 1565 if (cursor > max_nl_size) 1566 max_nl_size = cursor; 1567 } 1568 1569 if (max_nl_size == 0) { /* all nonlinears locked or reserved ? */ 1570 ret = SWAP_FAIL; 1571 goto out; 1572 } 1573 1574 /* 1575 * We don't try to search for this page in the nonlinear vmas, 1576 * and page_referenced wouldn't have found it anyway. Instead 1577 * just walk the nonlinear vmas trying to age and unmap some. 1578 * The mapcount of the page we came in with is irrelevant, 1579 * but even so use it as a guide to how hard we should try? 1580 */ 1581 mapcount = page_mapcount(page); 1582 if (!mapcount) 1583 goto out; 1584 cond_resched(); 1585 1586 max_nl_size = (max_nl_size + CLUSTER_SIZE - 1) & CLUSTER_MASK; 1587 if (max_nl_cursor == 0) 1588 max_nl_cursor = CLUSTER_SIZE; 1589 1590 do { 1591 list_for_each_entry(vma, &mapping->i_mmap_nonlinear, 1592 shared.nonlinear) { 1593 cursor = (unsigned long) vma->vm_private_data; 1594 while ( cursor < max_nl_cursor && 1595 cursor < vma->vm_end - vma->vm_start) { 1596 if (try_to_unmap_cluster(cursor, &mapcount, 1597 vma, page) == SWAP_MLOCK) 1598 ret = SWAP_MLOCK; 1599 cursor += CLUSTER_SIZE; 1600 vma->vm_private_data = (void *) cursor; 1601 if ((int)mapcount <= 0) 1602 goto out; 1603 } 1604 vma->vm_private_data = (void *) max_nl_cursor; 1605 } 1606 cond_resched(); 1607 max_nl_cursor += CLUSTER_SIZE; 1608 } while (max_nl_cursor <= max_nl_size); 1609 1610 /* 1611 * Don't loop forever (perhaps all the remaining pages are 1612 * in locked vmas). Reset cursor on all unreserved nonlinear 1613 * vmas, now forgetting on which ones it had fallen behind. 1614 */ 1615 list_for_each_entry(vma, &mapping->i_mmap_nonlinear, shared.nonlinear) 1616 vma->vm_private_data = NULL; 1617 out: 1618 mutex_unlock(&mapping->i_mmap_mutex); 1619 return ret; 1620 } 1621 1622 /** 1623 * try_to_unmap - try to remove all page table mappings to a page 1624 * @page: the page to get unmapped 1625 * @flags: action and flags 1626 * 1627 * Tries to remove all the page table entries which are mapping this 1628 * page, used in the pageout path. Caller must hold the page lock. 1629 * Return values are: 1630 * 1631 * SWAP_SUCCESS - we succeeded in removing all mappings 1632 * SWAP_AGAIN - we missed a mapping, try again later 1633 * SWAP_FAIL - the page is unswappable 1634 * SWAP_MLOCK - page is mlocked. 1635 */ 1636 int try_to_unmap(struct page *page, enum ttu_flags flags) 1637 { 1638 int ret; 1639 1640 BUG_ON(!PageLocked(page)); 1641 VM_BUG_ON(!PageHuge(page) && PageTransHuge(page)); 1642 1643 if (unlikely(PageKsm(page))) 1644 ret = try_to_unmap_ksm(page, flags); 1645 else if (PageAnon(page)) 1646 ret = try_to_unmap_anon(page, flags); 1647 else 1648 ret = try_to_unmap_file(page, flags); 1649 if (ret != SWAP_MLOCK && !page_mapped(page)) 1650 ret = SWAP_SUCCESS; 1651 return ret; 1652 } 1653 1654 /** 1655 * try_to_munlock - try to munlock a page 1656 * @page: the page to be munlocked 1657 * 1658 * Called from munlock code. Checks all of the VMAs mapping the page 1659 * to make sure nobody else has this page mlocked. The page will be 1660 * returned with PG_mlocked cleared if no other vmas have it mlocked. 1661 * 1662 * Return values are: 1663 * 1664 * SWAP_AGAIN - no vma is holding page mlocked, or, 1665 * SWAP_AGAIN - page mapped in mlocked vma -- couldn't acquire mmap sem 1666 * SWAP_FAIL - page cannot be located at present 1667 * SWAP_MLOCK - page is now mlocked. 1668 */ 1669 int try_to_munlock(struct page *page) 1670 { 1671 VM_BUG_ON(!PageLocked(page) || PageLRU(page)); 1672 1673 if (unlikely(PageKsm(page))) 1674 return try_to_unmap_ksm(page, TTU_MUNLOCK); 1675 else if (PageAnon(page)) 1676 return try_to_unmap_anon(page, TTU_MUNLOCK); 1677 else 1678 return try_to_unmap_file(page, TTU_MUNLOCK); 1679 } 1680 1681 void __put_anon_vma(struct anon_vma *anon_vma) 1682 { 1683 struct anon_vma *root = anon_vma->root; 1684 1685 if (root != anon_vma && atomic_dec_and_test(&root->refcount)) 1686 anon_vma_free(root); 1687 1688 anon_vma_free(anon_vma); 1689 } 1690 1691 #ifdef CONFIG_MIGRATION 1692 /* 1693 * rmap_walk() and its helpers rmap_walk_anon() and rmap_walk_file(): 1694 * Called by migrate.c to remove migration ptes, but might be used more later. 1695 */ 1696 static int rmap_walk_anon(struct page *page, int (*rmap_one)(struct page *, 1697 struct vm_area_struct *, unsigned long, void *), void *arg) 1698 { 1699 struct anon_vma *anon_vma; 1700 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 1701 struct anon_vma_chain *avc; 1702 int ret = SWAP_AGAIN; 1703 1704 /* 1705 * Note: remove_migration_ptes() cannot use page_lock_anon_vma_read() 1706 * because that depends on page_mapped(); but not all its usages 1707 * are holding mmap_sem. Users without mmap_sem are required to 1708 * take a reference count to prevent the anon_vma disappearing 1709 */ 1710 anon_vma = page_anon_vma(page); 1711 if (!anon_vma) 1712 return ret; 1713 anon_vma_lock_read(anon_vma); 1714 anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff, pgoff) { 1715 struct vm_area_struct *vma = avc->vma; 1716 unsigned long address = vma_address(page, vma); 1717 ret = rmap_one(page, vma, address, arg); 1718 if (ret != SWAP_AGAIN) 1719 break; 1720 } 1721 anon_vma_unlock_read(anon_vma); 1722 return ret; 1723 } 1724 1725 static int rmap_walk_file(struct page *page, int (*rmap_one)(struct page *, 1726 struct vm_area_struct *, unsigned long, void *), void *arg) 1727 { 1728 struct address_space *mapping = page->mapping; 1729 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT); 1730 struct vm_area_struct *vma; 1731 int ret = SWAP_AGAIN; 1732 1733 if (!mapping) 1734 return ret; 1735 mutex_lock(&mapping->i_mmap_mutex); 1736 vma_interval_tree_foreach(vma, &mapping->i_mmap, pgoff, pgoff) { 1737 unsigned long address = vma_address(page, vma); 1738 ret = rmap_one(page, vma, address, arg); 1739 if (ret != SWAP_AGAIN) 1740 break; 1741 } 1742 /* 1743 * No nonlinear handling: being always shared, nonlinear vmas 1744 * never contain migration ptes. Decide what to do about this 1745 * limitation to linear when we need rmap_walk() on nonlinear. 1746 */ 1747 mutex_unlock(&mapping->i_mmap_mutex); 1748 return ret; 1749 } 1750 1751 int rmap_walk(struct page *page, int (*rmap_one)(struct page *, 1752 struct vm_area_struct *, unsigned long, void *), void *arg) 1753 { 1754 VM_BUG_ON(!PageLocked(page)); 1755 1756 if (unlikely(PageKsm(page))) 1757 return rmap_walk_ksm(page, rmap_one, arg); 1758 else if (PageAnon(page)) 1759 return rmap_walk_anon(page, rmap_one, arg); 1760 else 1761 return rmap_walk_file(page, rmap_one, arg); 1762 } 1763 #endif /* CONFIG_MIGRATION */ 1764 1765 #ifdef CONFIG_HUGETLB_PAGE 1766 /* 1767 * The following three functions are for anonymous (private mapped) hugepages. 1768 * Unlike common anonymous pages, anonymous hugepages have no accounting code 1769 * and no lru code, because we handle hugepages differently from common pages. 1770 */ 1771 static void __hugepage_set_anon_rmap(struct page *page, 1772 struct vm_area_struct *vma, unsigned long address, int exclusive) 1773 { 1774 struct anon_vma *anon_vma = vma->anon_vma; 1775 1776 BUG_ON(!anon_vma); 1777 1778 if (PageAnon(page)) 1779 return; 1780 if (!exclusive) 1781 anon_vma = anon_vma->root; 1782 1783 anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON; 1784 page->mapping = (struct address_space *) anon_vma; 1785 page->index = linear_page_index(vma, address); 1786 } 1787 1788 void hugepage_add_anon_rmap(struct page *page, 1789 struct vm_area_struct *vma, unsigned long address) 1790 { 1791 struct anon_vma *anon_vma = vma->anon_vma; 1792 int first; 1793 1794 BUG_ON(!PageLocked(page)); 1795 BUG_ON(!anon_vma); 1796 /* address might be in next vma when migration races vma_adjust */ 1797 first = atomic_inc_and_test(&page->_mapcount); 1798 if (first) 1799 __hugepage_set_anon_rmap(page, vma, address, 0); 1800 } 1801 1802 void hugepage_add_new_anon_rmap(struct page *page, 1803 struct vm_area_struct *vma, unsigned long address) 1804 { 1805 BUG_ON(address < vma->vm_start || address >= vma->vm_end); 1806 atomic_set(&page->_mapcount, 0); 1807 __hugepage_set_anon_rmap(page, vma, address, 1); 1808 } 1809 #endif /* CONFIG_HUGETLB_PAGE */ 1810