migrate.c 47.7 KB
Newer Older
C
Christoph Lameter 已提交
1
/*
2
 * Memory Migration functionality - linux/mm/migrate.c
C
Christoph Lameter 已提交
3 4 5 6 7 8 9 10 11
 *
 * Copyright (C) 2006 Silicon Graphics, Inc., Christoph Lameter
 *
 * Page migration was first developed in the context of the memory hotplug
 * project. The main authors of the migration code are:
 *
 * IWAMOTO Toshihiro <iwamoto@valinux.co.jp>
 * Hirokazu Takahashi <taka@valinux.co.jp>
 * Dave Hansen <haveblue@us.ibm.com>
C
Christoph Lameter 已提交
12
 * Christoph Lameter
C
Christoph Lameter 已提交
13 14 15
 */

#include <linux/migrate.h>
16
#include <linux/export.h>
C
Christoph Lameter 已提交
17
#include <linux/swap.h>
18
#include <linux/swapops.h>
C
Christoph Lameter 已提交
19
#include <linux/pagemap.h>
20
#include <linux/buffer_head.h>
C
Christoph Lameter 已提交
21
#include <linux/mm_inline.h>
22
#include <linux/nsproxy.h>
C
Christoph Lameter 已提交
23
#include <linux/pagevec.h>
24
#include <linux/ksm.h>
C
Christoph Lameter 已提交
25 26 27 28
#include <linux/rmap.h>
#include <linux/topology.h>
#include <linux/cpu.h>
#include <linux/cpuset.h>
29
#include <linux/writeback.h>
30 31
#include <linux/mempolicy.h>
#include <linux/vmalloc.h>
32
#include <linux/security.h>
33
#include <linux/backing-dev.h>
34
#include <linux/syscalls.h>
N
Naoya Horiguchi 已提交
35
#include <linux/hugetlb.h>
36
#include <linux/hugetlb_cgroup.h>
37
#include <linux/gfp.h>
38
#include <linux/balloon_compaction.h>
39
#include <linux/mmu_notifier.h>
40
#include <linux/page_idle.h>
C
Christoph Lameter 已提交
41

42 43
#include <asm/tlbflush.h>

44 45 46
#define CREATE_TRACE_POINTS
#include <trace/events/migrate.h>

C
Christoph Lameter 已提交
47 48 49
#include "internal.h"

/*
50
 * migrate_prep() needs to be called before we start compiling a list of pages
51 52
 * to be migrated using isolate_lru_page(). If scheduling work on other CPUs is
 * undesirable, use migrate_prep_local()
C
Christoph Lameter 已提交
53 54 55 56 57 58 59 60 61 62 63 64 65 66
 */
int migrate_prep(void)
{
	/*
	 * Clear the LRU lists so pages can be isolated.
	 * Note that pages may be moved off the LRU after we have
	 * drained them. Those pages will fail to migrate like other
	 * pages that may be busy.
	 */
	lru_add_drain_all();

	return 0;
}

67 68 69 70 71 72 73 74
/* Do the necessary work of migrate_prep but not if it involves other CPUs */
int migrate_prep_local(void)
{
	lru_add_drain();

	return 0;
}

75 76 77 78
/*
 * Put previously isolated pages back onto the appropriate lists
 * from where they were once taken off for compaction/migration.
 *
79 80 81
 * This function shall be used whenever the isolated pageset has been
 * built from lru, balloon, hugetlbfs page. See isolate_migratepages_range()
 * and isolate_huge_page().
82 83 84 85 86 87
 */
void putback_movable_pages(struct list_head *l)
{
	struct page *page;
	struct page *page2;

C
Christoph Lameter 已提交
88
	list_for_each_entry_safe(page, page2, l, lru) {
89 90 91 92
		if (unlikely(PageHuge(page))) {
			putback_active_hugepage(page);
			continue;
		}
93
		list_del(&page->lru);
K
KOSAKI Motohiro 已提交
94
		dec_zone_page_state(page, NR_ISOLATED_ANON +
95
				page_is_file_cache(page));
96
		if (unlikely(isolated_balloon_page(page)))
97 98 99
			balloon_page_putback(page);
		else
			putback_lru_page(page);
C
Christoph Lameter 已提交
100 101 102
	}
}

103 104 105
/*
 * Restore a potential migration pte to a working pte entry
 */
106 107
static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
				 unsigned long addr, void *old)
108 109 110 111 112 113 114
{
	struct mm_struct *mm = vma->vm_mm;
	swp_entry_t entry;
 	pmd_t *pmd;
	pte_t *ptep, pte;
 	spinlock_t *ptl;

N
Naoya Horiguchi 已提交
115 116 117 118
	if (unlikely(PageHuge(new))) {
		ptep = huge_pte_offset(mm, addr);
		if (!ptep)
			goto out;
119
		ptl = huge_pte_lockptr(hstate_vma(vma), mm, ptep);
N
Naoya Horiguchi 已提交
120
	} else {
B
Bob Liu 已提交
121 122
		pmd = mm_find_pmd(mm, addr);
		if (!pmd)
N
Naoya Horiguchi 已提交
123
			goto out;
124

N
Naoya Horiguchi 已提交
125
		ptep = pte_offset_map(pmd, addr);
126

127 128 129 130
		/*
		 * Peek to check is_swap_pte() before taking ptlock?  No, we
		 * can race mremap's move_ptes(), which skips anon_vma lock.
		 */
N
Naoya Horiguchi 已提交
131 132 133

		ptl = pte_lockptr(mm, pmd);
	}
134 135 136 137

 	spin_lock(ptl);
	pte = *ptep;
	if (!is_swap_pte(pte))
138
		goto unlock;
139 140 141

	entry = pte_to_swp_entry(pte);

142 143 144
	if (!is_migration_entry(entry) ||
	    migration_entry_to_page(entry) != old)
		goto unlock;
145 146 147

	get_page(new);
	pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
148 149
	if (pte_swp_soft_dirty(*ptep))
		pte = pte_mksoft_dirty(pte);
150 151

	/* Recheck VMA as permissions can change since migration started  */
152
	if (is_write_migration_entry(entry))
153 154
		pte = maybe_mkwrite(pte, vma);

A
Andi Kleen 已提交
155
#ifdef CONFIG_HUGETLB_PAGE
156
	if (PageHuge(new)) {
N
Naoya Horiguchi 已提交
157
		pte = pte_mkhuge(pte);
158 159
		pte = arch_make_huge_pte(pte, vma, new, 0);
	}
A
Andi Kleen 已提交
160
#endif
161
	flush_dcache_page(new);
162
	set_pte_at(mm, addr, ptep, pte);
163

N
Naoya Horiguchi 已提交
164 165 166 167
	if (PageHuge(new)) {
		if (PageAnon(new))
			hugepage_add_anon_rmap(new, vma, addr);
		else
168
			page_dup_rmap(new, true);
N
Naoya Horiguchi 已提交
169
	} else if (PageAnon(new))
170
		page_add_anon_rmap(new, vma, addr, false);
171 172 173
	else
		page_add_file_rmap(new);

174 175 176
	if (vma->vm_flags & VM_LOCKED)
		mlock_vma_page(new);

177
	/* No need to invalidate - it was non-present before */
178
	update_mmu_cache(vma, addr, ptep);
179
unlock:
180
	pte_unmap_unlock(ptep, ptl);
181 182
out:
	return SWAP_AGAIN;
183 184
}

185 186 187 188 189 190
/*
 * Get rid of all migration entries and replace them by
 * references to the indicated page.
 */
static void remove_migration_ptes(struct page *old, struct page *new)
{
191 192 193 194 195 196
	struct rmap_walk_control rwc = {
		.rmap_one = remove_migration_pte,
		.arg = old,
	};

	rmap_walk(new, &rwc);
197 198
}

199 200 201 202 203
/*
 * Something used the pte of a page under migration. We need to
 * get to the page and wait until migration is finished.
 * When we return from this function the fault will be retried.
 */
204
void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
205
				spinlock_t *ptl)
206
{
207
	pte_t pte;
208 209 210
	swp_entry_t entry;
	struct page *page;

211
	spin_lock(ptl);
212 213 214 215 216 217 218 219 220 221
	pte = *ptep;
	if (!is_swap_pte(pte))
		goto out;

	entry = pte_to_swp_entry(pte);
	if (!is_migration_entry(entry))
		goto out;

	page = migration_entry_to_page(entry);

N
Nick Piggin 已提交
222 223 224 225 226 227 228 229 230
	/*
	 * Once radix-tree replacement of page migration started, page_count
	 * *must* be zero. And, we don't want to call wait_on_page_locked()
	 * against a page without get_page().
	 * So, we use get_page_unless_zero(), here. Even failed, page fault
	 * will occur again.
	 */
	if (!get_page_unless_zero(page))
		goto out;
231 232 233 234 235 236 237 238
	pte_unmap_unlock(ptep, ptl);
	wait_on_page_locked(page);
	put_page(page);
	return;
out:
	pte_unmap_unlock(ptep, ptl);
}

239 240 241 242 243 244 245 246
void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
				unsigned long address)
{
	spinlock_t *ptl = pte_lockptr(mm, pmd);
	pte_t *ptep = pte_offset_map(pmd, address);
	__migration_entry_wait(mm, ptep, ptl);
}

247 248
void migration_entry_wait_huge(struct vm_area_struct *vma,
		struct mm_struct *mm, pte_t *pte)
249
{
250
	spinlock_t *ptl = huge_pte_lockptr(hstate_vma(vma), mm, pte);
251 252 253
	__migration_entry_wait(mm, pte, ptl);
}

254 255
#ifdef CONFIG_BLOCK
/* Returns true if all buffers are successfully locked */
256 257
static bool buffer_migrate_lock_buffers(struct buffer_head *head,
							enum migrate_mode mode)
258 259 260 261
{
	struct buffer_head *bh = head;

	/* Simple case, sync compaction */
262
	if (mode != MIGRATE_ASYNC) {
263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297
		do {
			get_bh(bh);
			lock_buffer(bh);
			bh = bh->b_this_page;

		} while (bh != head);

		return true;
	}

	/* async case, we cannot block on lock_buffer so use trylock_buffer */
	do {
		get_bh(bh);
		if (!trylock_buffer(bh)) {
			/*
			 * We failed to lock the buffer and cannot stall in
			 * async migration. Release the taken locks
			 */
			struct buffer_head *failed_bh = bh;
			put_bh(failed_bh);
			bh = head;
			while (bh != failed_bh) {
				unlock_buffer(bh);
				put_bh(bh);
				bh = bh->b_this_page;
			}
			return false;
		}

		bh = bh->b_this_page;
	} while (bh != head);
	return true;
}
#else
static inline bool buffer_migrate_lock_buffers(struct buffer_head *head,
298
							enum migrate_mode mode)
299 300 301 302 303
{
	return true;
}
#endif /* CONFIG_BLOCK */

C
Christoph Lameter 已提交
304
/*
305
 * Replace the page in the mapping.
306 307 308 309
 *
 * The number of remaining references must be:
 * 1 for anonymous pages without a mapping
 * 2 for pages with a mapping
310
 * 3 for pages with a mapping and PagePrivate/PagePrivate2 set.
C
Christoph Lameter 已提交
311
 */
312
int migrate_page_move_mapping(struct address_space *mapping,
313
		struct page *newpage, struct page *page,
314 315
		struct buffer_head *head, enum migrate_mode mode,
		int extra_count)
C
Christoph Lameter 已提交
316
{
317 318
	struct zone *oldzone, *newzone;
	int dirty;
319
	int expected_count = 1 + extra_count;
320
	void **pslot;
C
Christoph Lameter 已提交
321

322
	if (!mapping) {
323
		/* Anonymous page without mapping */
324
		if (page_count(page) != expected_count)
325
			return -EAGAIN;
326 327 328 329 330 331 332 333

		/* No turning back from here */
		set_page_memcg(newpage, page_memcg(page));
		newpage->index = page->index;
		newpage->mapping = page->mapping;
		if (PageSwapBacked(page))
			SetPageSwapBacked(newpage);

334
		return MIGRATEPAGE_SUCCESS;
335 336
	}

337 338 339
	oldzone = page_zone(page);
	newzone = page_zone(newpage);

N
Nick Piggin 已提交
340
	spin_lock_irq(&mapping->tree_lock);
C
Christoph Lameter 已提交
341

342 343
	pslot = radix_tree_lookup_slot(&mapping->page_tree,
 					page_index(page));
C
Christoph Lameter 已提交
344

345
	expected_count += 1 + page_has_private(page);
N
Nick Piggin 已提交
346
	if (page_count(page) != expected_count ||
347
		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
N
Nick Piggin 已提交
348
		spin_unlock_irq(&mapping->tree_lock);
349
		return -EAGAIN;
C
Christoph Lameter 已提交
350 351
	}

N
Nick Piggin 已提交
352
	if (!page_freeze_refs(page, expected_count)) {
N
Nick Piggin 已提交
353
		spin_unlock_irq(&mapping->tree_lock);
N
Nick Piggin 已提交
354 355 356
		return -EAGAIN;
	}

357 358 359 360 361 362 363
	/*
	 * In the async migration case of moving a page with buffers, lock the
	 * buffers using trylock before the mapping is moved. If the mapping
	 * was moved, we later failed to lock the buffers and could not move
	 * the mapping back due to an elevated page count, we would have to
	 * block waiting on other references to be dropped.
	 */
364 365
	if (mode == MIGRATE_ASYNC && head &&
			!buffer_migrate_lock_buffers(head, mode)) {
366 367 368 369 370
		page_unfreeze_refs(page, expected_count);
		spin_unlock_irq(&mapping->tree_lock);
		return -EAGAIN;
	}

C
Christoph Lameter 已提交
371
	/*
372 373
	 * Now we know that no one else is looking at the page:
	 * no turning back from here.
C
Christoph Lameter 已提交
374
	 */
375 376 377 378 379 380
	set_page_memcg(newpage, page_memcg(page));
	newpage->index = page->index;
	newpage->mapping = page->mapping;
	if (PageSwapBacked(page))
		SetPageSwapBacked(newpage);

381
	get_page(newpage);	/* add cache reference */
C
Christoph Lameter 已提交
382 383 384 385 386
	if (PageSwapCache(page)) {
		SetPageSwapCache(newpage);
		set_page_private(newpage, page_private(page));
	}

387 388 389 390 391 392 393
	/* Move dirty while page refs frozen and newpage not yet exposed */
	dirty = PageDirty(page);
	if (dirty) {
		ClearPageDirty(page);
		SetPageDirty(newpage);
	}

394 395 396
	radix_tree_replace_slot(pslot, newpage);

	/*
397 398
	 * Drop cache reference from old page by unfreezing
	 * to one less reference.
399 400
	 * We know this isn't the last reference.
	 */
401
	page_unfreeze_refs(page, expected_count - 1);
402

403 404 405
	spin_unlock(&mapping->tree_lock);
	/* Leave irq disabled to prevent preemption while updating stats */

406 407 408 409 410 411 412 413 414 415
	/*
	 * If moved to a different zone then also account
	 * the page for that zone. Other VM counters will be
	 * taken care of when we establish references to the
	 * new page and drop references to the old page.
	 *
	 * Note that anonymous pages are accounted for
	 * via NR_FILE_PAGES and NR_ANON_PAGES if they
	 * are mapped to swap space.
	 */
416 417 418 419 420 421 422 423 424 425 426
	if (newzone != oldzone) {
		__dec_zone_state(oldzone, NR_FILE_PAGES);
		__inc_zone_state(newzone, NR_FILE_PAGES);
		if (PageSwapBacked(page) && !PageSwapCache(page)) {
			__dec_zone_state(oldzone, NR_SHMEM);
			__inc_zone_state(newzone, NR_SHMEM);
		}
		if (dirty && mapping_cap_account_dirty(mapping)) {
			__dec_zone_state(oldzone, NR_FILE_DIRTY);
			__inc_zone_state(newzone, NR_FILE_DIRTY);
		}
427
	}
428
	local_irq_enable();
C
Christoph Lameter 已提交
429

430
	return MIGRATEPAGE_SUCCESS;
C
Christoph Lameter 已提交
431 432
}

N
Naoya Horiguchi 已提交
433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449
/*
 * The expected number of remaining references is the same as that
 * of migrate_page_move_mapping().
 */
int migrate_huge_page_move_mapping(struct address_space *mapping,
				   struct page *newpage, struct page *page)
{
	int expected_count;
	void **pslot;

	spin_lock_irq(&mapping->tree_lock);

	pslot = radix_tree_lookup_slot(&mapping->page_tree,
					page_index(page));

	expected_count = 2 + page_has_private(page);
	if (page_count(page) != expected_count ||
450
		radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
N
Naoya Horiguchi 已提交
451 452 453 454 455 456 457 458 459
		spin_unlock_irq(&mapping->tree_lock);
		return -EAGAIN;
	}

	if (!page_freeze_refs(page, expected_count)) {
		spin_unlock_irq(&mapping->tree_lock);
		return -EAGAIN;
	}

460 461 462
	set_page_memcg(newpage, page_memcg(page));
	newpage->index = page->index;
	newpage->mapping = page->mapping;
N
Naoya Horiguchi 已提交
463 464 465 466
	get_page(newpage);

	radix_tree_replace_slot(pslot, newpage);

467
	page_unfreeze_refs(page, expected_count - 1);
N
Naoya Horiguchi 已提交
468 469

	spin_unlock_irq(&mapping->tree_lock);
470
	return MIGRATEPAGE_SUCCESS;
N
Naoya Horiguchi 已提交
471 472
}

473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520
/*
 * Gigantic pages are so large that we do not guarantee that page++ pointer
 * arithmetic will work across the entire page.  We need something more
 * specialized.
 */
static void __copy_gigantic_page(struct page *dst, struct page *src,
				int nr_pages)
{
	int i;
	struct page *dst_base = dst;
	struct page *src_base = src;

	for (i = 0; i < nr_pages; ) {
		cond_resched();
		copy_highpage(dst, src);

		i++;
		dst = mem_map_next(dst, dst_base, i);
		src = mem_map_next(src, src_base, i);
	}
}

static void copy_huge_page(struct page *dst, struct page *src)
{
	int i;
	int nr_pages;

	if (PageHuge(src)) {
		/* hugetlbfs page */
		struct hstate *h = page_hstate(src);
		nr_pages = pages_per_huge_page(h);

		if (unlikely(nr_pages > MAX_ORDER_NR_PAGES)) {
			__copy_gigantic_page(dst, src, nr_pages);
			return;
		}
	} else {
		/* thp page */
		BUG_ON(!PageTransHuge(src));
		nr_pages = hpage_nr_pages(src);
	}

	for (i = 0; i < nr_pages; i++) {
		cond_resched();
		copy_highpage(dst + i, src + i);
	}
}

C
Christoph Lameter 已提交
521 522 523
/*
 * Copy the page to its new location
 */
N
Naoya Horiguchi 已提交
524
void migrate_page_copy(struct page *newpage, struct page *page)
C
Christoph Lameter 已提交
525
{
526 527
	int cpupid;

528
	if (PageHuge(page) || PageTransHuge(page))
N
Naoya Horiguchi 已提交
529 530 531
		copy_huge_page(newpage, page);
	else
		copy_highpage(newpage, page);
C
Christoph Lameter 已提交
532 533 534 535 536 537 538

	if (PageError(page))
		SetPageError(newpage);
	if (PageReferenced(page))
		SetPageReferenced(newpage);
	if (PageUptodate(page))
		SetPageUptodate(newpage);
L
Lee Schermerhorn 已提交
539
	if (TestClearPageActive(page)) {
540
		VM_BUG_ON_PAGE(PageUnevictable(page), page);
C
Christoph Lameter 已提交
541
		SetPageActive(newpage);
542 543
	} else if (TestClearPageUnevictable(page))
		SetPageUnevictable(newpage);
C
Christoph Lameter 已提交
544 545 546 547 548
	if (PageChecked(page))
		SetPageChecked(newpage);
	if (PageMappedToDisk(page))
		SetPageMappedToDisk(newpage);

549 550 551
	/* Move dirty on pages not done by migrate_page_move_mapping() */
	if (PageDirty(page))
		SetPageDirty(newpage);
C
Christoph Lameter 已提交
552

553 554 555 556 557
	if (page_is_young(page))
		set_page_young(newpage);
	if (page_is_idle(page))
		set_page_idle(newpage);

558 559 560 561 562 563 564
	/*
	 * Copy NUMA information to the new page, to prevent over-eager
	 * future migrations of this same page.
	 */
	cpupid = page_cpupid_xchg_last(page, -1);
	page_cpupid_xchg_last(newpage, cpupid);

565
	ksm_migrate_page(newpage, page);
566 567 568 569
	/*
	 * Please do not reorder this without considering how mm/ksm.c's
	 * get_ksm_page() depends upon ksm_migrate_page() and PageSwapCache().
	 */
570 571
	if (PageSwapCache(page))
		ClearPageSwapCache(page);
C
Christoph Lameter 已提交
572 573 574 575 576 577 578 579 580 581 582
	ClearPagePrivate(page);
	set_page_private(page, 0);

	/*
	 * If any waiters have accumulated on the new page then
	 * wake them up.
	 */
	if (PageWriteback(newpage))
		end_page_writeback(newpage);
}

583 584 585 586
/************************************************************
 *                    Migration functions
 ***********************************************************/

C
Christoph Lameter 已提交
587 588
/*
 * Common logic to directly migrate a single page suitable for
589
 * pages that do not use PagePrivate/PagePrivate2.
C
Christoph Lameter 已提交
590 591 592
 *
 * Pages are locked upon entry and exit.
 */
593
int migrate_page(struct address_space *mapping,
594 595
		struct page *newpage, struct page *page,
		enum migrate_mode mode)
C
Christoph Lameter 已提交
596 597 598 599 600
{
	int rc;

	BUG_ON(PageWriteback(page));	/* Writeback must be complete */

601
	rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
C
Christoph Lameter 已提交
602

603
	if (rc != MIGRATEPAGE_SUCCESS)
C
Christoph Lameter 已提交
604 605 606
		return rc;

	migrate_page_copy(newpage, page);
607
	return MIGRATEPAGE_SUCCESS;
C
Christoph Lameter 已提交
608 609 610
}
EXPORT_SYMBOL(migrate_page);

611
#ifdef CONFIG_BLOCK
612 613 614 615 616
/*
 * Migration function for pages with buffers. This function can only be used
 * if the underlying filesystem guarantees that no other references to "page"
 * exist.
 */
617
int buffer_migrate_page(struct address_space *mapping,
618
		struct page *newpage, struct page *page, enum migrate_mode mode)
619 620 621 622 623
{
	struct buffer_head *bh, *head;
	int rc;

	if (!page_has_buffers(page))
624
		return migrate_page(mapping, newpage, page, mode);
625 626 627

	head = page_buffers(page);

628
	rc = migrate_page_move_mapping(mapping, newpage, page, head, mode, 0);
629

630
	if (rc != MIGRATEPAGE_SUCCESS)
631 632
		return rc;

633 634 635 636 637
	/*
	 * In the async case, migrate_page_move_mapping locked the buffers
	 * with an IRQ-safe spinlock held. In the sync case, the buffers
	 * need to be locked now
	 */
638 639
	if (mode != MIGRATE_ASYNC)
		BUG_ON(!buffer_migrate_lock_buffers(head, mode));
640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665

	ClearPagePrivate(page);
	set_page_private(newpage, page_private(page));
	set_page_private(page, 0);
	put_page(page);
	get_page(newpage);

	bh = head;
	do {
		set_bh_page(bh, newpage, bh_offset(bh));
		bh = bh->b_this_page;

	} while (bh != head);

	SetPagePrivate(newpage);

	migrate_page_copy(newpage, page);

	bh = head;
	do {
		unlock_buffer(bh);
 		put_bh(bh);
		bh = bh->b_this_page;

	} while (bh != head);

666
	return MIGRATEPAGE_SUCCESS;
667 668
}
EXPORT_SYMBOL(buffer_migrate_page);
669
#endif
670

671 672 673 674
/*
 * Writeback a page to clean the dirty state
 */
static int writeout(struct address_space *mapping, struct page *page)
675
{
676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692
	struct writeback_control wbc = {
		.sync_mode = WB_SYNC_NONE,
		.nr_to_write = 1,
		.range_start = 0,
		.range_end = LLONG_MAX,
		.for_reclaim = 1
	};
	int rc;

	if (!mapping->a_ops->writepage)
		/* No write method for the address space */
		return -EINVAL;

	if (!clear_page_dirty_for_io(page))
		/* Someone else already triggered a write */
		return -EAGAIN;

693
	/*
694 695 696 697 698 699
	 * A dirty page may imply that the underlying filesystem has
	 * the page on some queue. So the page must be clean for
	 * migration. Writeout may mean we loose the lock and the
	 * page state is no longer what we checked for earlier.
	 * At this point we know that the migration attempt cannot
	 * be successful.
700
	 */
701
	remove_migration_ptes(page, page);
702

703
	rc = mapping->a_ops->writepage(page, &wbc);
704

705 706 707 708
	if (rc != AOP_WRITEPAGE_ACTIVATE)
		/* unlocked. Relock */
		lock_page(page);

H
Hugh Dickins 已提交
709
	return (rc < 0) ? -EIO : -EAGAIN;
710 711 712 713 714 715
}

/*
 * Default handling if a filesystem does not provide a migration function.
 */
static int fallback_migrate_page(struct address_space *mapping,
716
	struct page *newpage, struct page *page, enum migrate_mode mode)
717
{
718
	if (PageDirty(page)) {
719 720
		/* Only writeback pages in full synchronous migration */
		if (mode != MIGRATE_SYNC)
721
			return -EBUSY;
722
		return writeout(mapping, page);
723
	}
724 725 726 727 728

	/*
	 * Buffers may be managed in a filesystem specific way.
	 * We must have no buffers or drop them.
	 */
729
	if (page_has_private(page) &&
730 731 732
	    !try_to_release_page(page, GFP_KERNEL))
		return -EAGAIN;

733
	return migrate_page(mapping, newpage, page, mode);
734 735
}

736 737 738 739 740 741
/*
 * Move a page to a newly allocated page
 * The page is locked and all ptes have been successfully removed.
 *
 * The new page will have replaced the old page if this function
 * is successful.
L
Lee Schermerhorn 已提交
742 743 744
 *
 * Return value:
 *   < 0 - error code
745
 *  MIGRATEPAGE_SUCCESS - success
746
 */
747
static int move_to_new_page(struct page *newpage, struct page *page,
748
				enum migrate_mode mode)
749 750 751 752
{
	struct address_space *mapping;
	int rc;

753 754
	VM_BUG_ON_PAGE(!PageLocked(page), page);
	VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
755 756 757

	mapping = page_mapping(page);
	if (!mapping)
758
		rc = migrate_page(mapping, newpage, page, mode);
759
	else if (mapping->a_ops->migratepage)
760
		/*
761 762 763 764
		 * Most pages have a mapping and most filesystems provide a
		 * migratepage callback. Anonymous pages are part of swap
		 * space which also has its own migratepage callback. This
		 * is the most common path for page migration.
765
		 */
766
		rc = mapping->a_ops->migratepage(mapping, newpage, page, mode);
767
	else
768
		rc = fallback_migrate_page(mapping, newpage, page, mode);
769

770 771 772 773 774 775 776 777
	/*
	 * When successful, old pagecache page->mapping must be cleared before
	 * page is freed; but stats require that PageAnon be left as PageAnon.
	 */
	if (rc == MIGRATEPAGE_SUCCESS) {
		set_page_memcg(page, NULL);
		if (!PageAnon(page))
			page->mapping = NULL;
778
	}
779 780 781
	return rc;
}

782
static int __unmap_and_move(struct page *page, struct page *newpage,
783
				int force, enum migrate_mode mode)
784
{
785
	int rc = -EAGAIN;
786
	int page_was_mapped = 0;
787
	struct anon_vma *anon_vma = NULL;
788

N
Nick Piggin 已提交
789
	if (!trylock_page(page)) {
790
		if (!force || mode == MIGRATE_ASYNC)
791
			goto out;
792 793 794 795 796 797 798 799 800 801 802 803 804 805 806

		/*
		 * It's not safe for direct compaction to call lock_page.
		 * For example, during page readahead pages are added locked
		 * to the LRU. Later, when the IO completes the pages are
		 * marked uptodate and unlocked. However, the queueing
		 * could be merging multiple pages for one bio (e.g.
		 * mpage_readpages). If an allocation happens for the
		 * second or third page, the process can end up locking
		 * the same page twice and deadlocking. Rather than
		 * trying to be clever about what pages can be locked,
		 * avoid the use of lock_page for direct compaction
		 * altogether.
		 */
		if (current->flags & PF_MEMALLOC)
807
			goto out;
808

809 810 811 812
		lock_page(page);
	}

	if (PageWriteback(page)) {
813
		/*
814
		 * Only in the case of a full synchronous migration is it
815 816 817
		 * necessary to wait for PageWriteback. In the async case,
		 * the retry loop is too short and in the sync-light case,
		 * the overhead of stalling is too much
818
		 */
819
		if (mode != MIGRATE_SYNC) {
820
			rc = -EBUSY;
821
			goto out_unlock;
822 823
		}
		if (!force)
824
			goto out_unlock;
825 826
		wait_on_page_writeback(page);
	}
827

828
	/*
829 830
	 * By try_to_unmap(), page->mapcount goes down to 0 here. In this case,
	 * we cannot notice that anon_vma is freed while we migrates a page.
831
	 * This get_anon_vma() delays freeing anon_vma pointer until the end
832
	 * of migration. File cache pages are no problem because of page_lock()
833 834
	 * File Caches may use write_page() or lock_page() in migration, then,
	 * just care Anon page here.
835 836 837 838 839 840
	 *
	 * Only page_get_anon_vma() understands the subtleties of
	 * getting a hold on an anon_vma from outside one of its mms.
	 * But if we cannot get anon_vma, then we won't need it anyway,
	 * because that implies that the anon page is no longer mapped
	 * (and cannot be remapped so long as we hold the page lock).
841
	 */
842
	if (PageAnon(page) && !PageKsm(page))
843
		anon_vma = page_get_anon_vma(page);
844

845 846 847 848 849 850 851 852 853 854 855
	/*
	 * Block others from accessing the new page when we get around to
	 * establishing additional references. We are usually the only one
	 * holding a reference to newpage at this point. We used to have a BUG
	 * here if trylock_page(newpage) fails, but would like to allow for
	 * cases where there might be a race with the previous use of newpage.
	 * This is much like races on refcount of oldpage: just don't BUG().
	 */
	if (unlikely(!trylock_page(newpage)))
		goto out_unlock;

856
	if (unlikely(isolated_balloon_page(page))) {
857 858 859 860 861 862 863 864
		/*
		 * A ballooned page does not need any special attention from
		 * physical to virtual reverse mapping procedures.
		 * Skip any attempt to unmap PTEs or to remap swap cache,
		 * in order to avoid burning cycles at rmap level, and perform
		 * the page migration right away (proteced by page lock).
		 */
		rc = balloon_page_migrate(newpage, page, mode);
865
		goto out_unlock_both;
866 867
	}

868
	/*
869 870 871 872 873 874 875 876 877 878
	 * Corner case handling:
	 * 1. When a new swap-cache page is read into, it is added to the LRU
	 * and treated as swapcache but it has no rmap yet.
	 * Calling try_to_unmap() against a page->mapping==NULL page will
	 * trigger a BUG.  So handle it here.
	 * 2. An orphaned page (see truncate_complete_page) might have
	 * fs-private metadata. The page can be picked up due to memory
	 * offlining.  Everywhere else except page reclaim, the page is
	 * invisible to the vm, so the page can not be migrated.  So try to
	 * free the metadata, so the page can be freed.
879
	 */
880
	if (!page->mapping) {
881
		VM_BUG_ON_PAGE(PageAnon(page), page);
882
		if (page_has_private(page)) {
883
			try_to_free_buffers(page);
884
			goto out_unlock_both;
885
		}
886 887
	} else if (page_mapped(page)) {
		/* Establish migration ptes */
888 889
		VM_BUG_ON_PAGE(PageAnon(page) && !PageKsm(page) && !anon_vma,
				page);
890
		try_to_unmap(page,
891
			TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
892 893
		page_was_mapped = 1;
	}
894

895
	if (!page_mapped(page))
896
		rc = move_to_new_page(newpage, page, mode);
897

898 899 900
	if (page_was_mapped)
		remove_migration_ptes(page,
			rc == MIGRATEPAGE_SUCCESS ? newpage : page);
901

902 903 904
out_unlock_both:
	unlock_page(newpage);
out_unlock:
905
	/* Drop an anon_vma reference if we took one */
906
	if (anon_vma)
907
		put_anon_vma(anon_vma);
908
	unlock_page(page);
909 910 911
out:
	return rc;
}
912

913 914 915 916 917 918 919 920 921 922
/*
 * gcc 4.7 and 4.8 on arm get an ICEs when inlining unmap_and_move().  Work
 * around it.
 */
#if (GCC_VERSION >= 40700 && GCC_VERSION < 40900) && defined(CONFIG_ARM)
#define ICE_noinline noinline
#else
#define ICE_noinline
#endif

923 924 925 926
/*
 * Obtain the lock on page, remove all ptes and migrate the page
 * to the newly allocated page in newpage.
 */
927 928 929
static ICE_noinline int unmap_and_move(new_page_t get_new_page,
				   free_page_t put_new_page,
				   unsigned long private, struct page *page,
930 931
				   int force, enum migrate_mode mode,
				   enum migrate_reason reason)
932
{
933
	int rc = MIGRATEPAGE_SUCCESS;
934
	int *result = NULL;
935
	struct page *newpage;
936

937
	newpage = get_new_page(page, private, &result);
938 939 940 941 942 943 944 945 946 947 948 949
	if (!newpage)
		return -ENOMEM;

	if (page_count(page) == 1) {
		/* page was freed from under us. So we are done. */
		goto out;
	}

	if (unlikely(PageTransHuge(page)))
		if (unlikely(split_huge_page(page)))
			goto out;

950
	rc = __unmap_and_move(page, newpage, force, mode);
951 952
	if (rc == MIGRATEPAGE_SUCCESS)
		put_new_page = NULL;
953

954
out:
955
	if (rc != -EAGAIN) {
956 957 958 959 960 961 962
		/*
		 * A page that has been migrated has all references
		 * removed and will be freed. A page that has not been
		 * migrated will have kepts its references and be
		 * restored.
		 */
		list_del(&page->lru);
K
KOSAKI Motohiro 已提交
963
		dec_zone_page_state(page, NR_ISOLATED_ANON +
964
				page_is_file_cache(page));
965
		/* Soft-offlined page shouldn't go through lru cache list */
966
		if (reason == MR_MEMORY_FAILURE) {
967
			put_page(page);
968 969 970
			if (!test_set_page_hwpoison(page))
				num_poisoned_pages_inc();
		} else
971
			putback_lru_page(page);
972
	}
973

974
	/*
975 976 977
	 * If migration was not successful and there's a freeing callback, use
	 * it.  Otherwise, putback_lru_page() will drop the reference grabbed
	 * during isolation.
978
	 */
979
	if (put_new_page)
980
		put_new_page(newpage, private);
981
	else if (unlikely(__is_movable_balloon_page(newpage))) {
982 983
		/* drop our reference, page already in the balloon */
		put_page(newpage);
984
	} else
985 986
		putback_lru_page(newpage);

987 988 989 990 991 992
	if (result) {
		if (rc)
			*result = rc;
		else
			*result = page_to_nid(newpage);
	}
993 994 995
	return rc;
}

N
Naoya Horiguchi 已提交
996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014
/*
 * Counterpart of unmap_and_move_page() for hugepage migration.
 *
 * This function doesn't wait the completion of hugepage I/O
 * because there is no race between I/O and migration for hugepage.
 * Note that currently hugepage I/O occurs only in direct I/O
 * where no lock is held and PG_writeback is irrelevant,
 * and writeback status of all subpages are counted in the reference
 * count of the head page (i.e. if all subpages of a 2MB hugepage are
 * under direct I/O, the reference of the head page is 512 and a bit more.)
 * This means that when we try to migrate hugepage whose subpages are
 * doing direct I/O, some references remain after try_to_unmap() and
 * hugepage migration fails without data corruption.
 *
 * There is also no race when direct I/O is issued on the page under migration,
 * because then pte is replaced with migration swap entry and direct I/O code
 * will wait in the page fault for migration to complete.
 */
static int unmap_and_move_huge_page(new_page_t get_new_page,
1015 1016 1017
				free_page_t put_new_page, unsigned long private,
				struct page *hpage, int force,
				enum migrate_mode mode)
N
Naoya Horiguchi 已提交
1018
{
1019
	int rc = -EAGAIN;
N
Naoya Horiguchi 已提交
1020
	int *result = NULL;
1021
	int page_was_mapped = 0;
1022
	struct page *new_hpage;
N
Naoya Horiguchi 已提交
1023 1024
	struct anon_vma *anon_vma = NULL;

1025 1026 1027 1028 1029 1030 1031
	/*
	 * Movability of hugepages depends on architectures and hugepage size.
	 * This check is necessary because some callers of hugepage migration
	 * like soft offline and memory hotremove don't walk through page
	 * tables or check whether the hugepage is pmd-based or not before
	 * kicking migration.
	 */
1032
	if (!hugepage_migration_supported(page_hstate(hpage))) {
1033
		putback_active_hugepage(hpage);
1034
		return -ENOSYS;
1035
	}
1036

1037
	new_hpage = get_new_page(hpage, private, &result);
N
Naoya Horiguchi 已提交
1038 1039 1040 1041
	if (!new_hpage)
		return -ENOMEM;

	if (!trylock_page(hpage)) {
1042
		if (!force || mode != MIGRATE_SYNC)
N
Naoya Horiguchi 已提交
1043 1044 1045 1046
			goto out;
		lock_page(hpage);
	}

1047 1048
	if (PageAnon(hpage))
		anon_vma = page_get_anon_vma(hpage);
N
Naoya Horiguchi 已提交
1049

1050 1051 1052
	if (unlikely(!trylock_page(new_hpage)))
		goto put_anon;

1053 1054 1055 1056 1057
	if (page_mapped(hpage)) {
		try_to_unmap(hpage,
			TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
		page_was_mapped = 1;
	}
N
Naoya Horiguchi 已提交
1058 1059

	if (!page_mapped(hpage))
1060
		rc = move_to_new_page(new_hpage, hpage, mode);
N
Naoya Horiguchi 已提交
1061

1062 1063 1064
	if (page_was_mapped)
		remove_migration_ptes(hpage,
			rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage);
N
Naoya Horiguchi 已提交
1065

1066 1067 1068
	unlock_page(new_hpage);

put_anon:
H
Hugh Dickins 已提交
1069
	if (anon_vma)
1070
		put_anon_vma(anon_vma);
1071

1072
	if (rc == MIGRATEPAGE_SUCCESS) {
1073
		hugetlb_cgroup_migrate(hpage, new_hpage);
1074 1075
		put_new_page = NULL;
	}
1076

N
Naoya Horiguchi 已提交
1077
	unlock_page(hpage);
1078
out:
1079 1080
	if (rc != -EAGAIN)
		putback_active_hugepage(hpage);
1081 1082 1083 1084 1085 1086

	/*
	 * If migration was not successful and there's a freeing callback, use
	 * it.  Otherwise, put_page() will drop the reference grabbed during
	 * isolation.
	 */
1087
	if (put_new_page)
1088 1089
		put_new_page(new_hpage, private);
	else
1090
		putback_active_hugepage(new_hpage);
1091

N
Naoya Horiguchi 已提交
1092 1093 1094 1095 1096 1097 1098 1099 1100
	if (result) {
		if (rc)
			*result = rc;
		else
			*result = page_to_nid(new_hpage);
	}
	return rc;
}

C
Christoph Lameter 已提交
1101
/*
1102 1103
 * migrate_pages - migrate the pages specified in a list, to the free pages
 *		   supplied as the target for the page migration
C
Christoph Lameter 已提交
1104
 *
1105 1106 1107
 * @from:		The list of pages to be migrated.
 * @get_new_page:	The function used to allocate free pages to be used
 *			as the target of the page migration.
1108 1109
 * @put_new_page:	The function used to free target pages if migration
 *			fails, or NULL if no special handling is necessary.
1110 1111 1112 1113
 * @private:		Private data to be passed on to get_new_page()
 * @mode:		The migration mode that specifies the constraints for
 *			page migration, if any.
 * @reason:		The reason for page migration.
C
Christoph Lameter 已提交
1114
 *
1115 1116
 * The function returns after 10 attempts or if no pages are movable any more
 * because the list has become empty or no retryable pages exist any more.
1117
 * The caller should call putback_movable_pages() to return pages to the LRU
1118
 * or free list only if ret != 0.
C
Christoph Lameter 已提交
1119
 *
1120
 * Returns the number of pages that were not migrated, or an error code.
C
Christoph Lameter 已提交
1121
 */
1122
int migrate_pages(struct list_head *from, new_page_t get_new_page,
1123 1124
		free_page_t put_new_page, unsigned long private,
		enum migrate_mode mode, int reason)
C
Christoph Lameter 已提交
1125
{
1126
	int retry = 1;
C
Christoph Lameter 已提交
1127
	int nr_failed = 0;
1128
	int nr_succeeded = 0;
C
Christoph Lameter 已提交
1129 1130 1131 1132 1133 1134 1135 1136 1137
	int pass = 0;
	struct page *page;
	struct page *page2;
	int swapwrite = current->flags & PF_SWAPWRITE;
	int rc;

	if (!swapwrite)
		current->flags |= PF_SWAPWRITE;

1138 1139
	for(pass = 0; pass < 10 && retry; pass++) {
		retry = 0;
C
Christoph Lameter 已提交
1140

1141 1142
		list_for_each_entry_safe(page, page2, from, lru) {
			cond_resched();
1143

1144 1145
			if (PageHuge(page))
				rc = unmap_and_move_huge_page(get_new_page,
1146 1147
						put_new_page, private, page,
						pass > 2, mode);
1148
			else
1149
				rc = unmap_and_move(get_new_page, put_new_page,
1150 1151
						private, page, pass > 2, mode,
						reason);
1152

1153
			switch(rc) {
1154 1155
			case -ENOMEM:
				goto out;
1156
			case -EAGAIN:
1157
				retry++;
1158
				break;
1159
			case MIGRATEPAGE_SUCCESS:
1160
				nr_succeeded++;
1161 1162
				break;
			default:
1163 1164 1165 1166 1167 1168
				/*
				 * Permanent failure (-EBUSY, -ENOSYS, etc.):
				 * unlike -EAGAIN case, the failed page is
				 * removed from migration page list and not
				 * retried in the next outer loop.
				 */
1169
				nr_failed++;
1170
				break;
1171
			}
C
Christoph Lameter 已提交
1172 1173
		}
	}
1174 1175
	nr_failed += retry;
	rc = nr_failed;
1176
out:
1177 1178 1179 1180
	if (nr_succeeded)
		count_vm_events(PGMIGRATE_SUCCESS, nr_succeeded);
	if (nr_failed)
		count_vm_events(PGMIGRATE_FAIL, nr_failed);
1181 1182
	trace_mm_migrate_pages(nr_succeeded, nr_failed, mode, reason);

C
Christoph Lameter 已提交
1183 1184 1185
	if (!swapwrite)
		current->flags &= ~PF_SWAPWRITE;

1186
	return rc;
C
Christoph Lameter 已提交
1187
}
1188

1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212
#ifdef CONFIG_NUMA
/*
 * Move a list of individual pages
 */
struct page_to_node {
	unsigned long addr;
	struct page *page;
	int node;
	int status;
};

static struct page *new_page_node(struct page *p, unsigned long private,
		int **result)
{
	struct page_to_node *pm = (struct page_to_node *)private;

	while (pm->node != MAX_NUMNODES && pm->page != p)
		pm++;

	if (pm->node == MAX_NUMNODES)
		return NULL;

	*result = &pm->status;

1213 1214 1215 1216
	if (PageHuge(p))
		return alloc_huge_page_node(page_hstate(compound_head(p)),
					pm->node);
	else
1217
		return __alloc_pages_node(pm->node,
1218
				GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
1219 1220 1221 1222 1223 1224
}

/*
 * Move a set of pages as indicated in the pm array. The addr
 * field must be set to the virtual address of the page to be moved
 * and the node number must contain a valid target node.
1225
 * The pm array ends with node = MAX_NUMNODES.
1226
 */
1227 1228 1229
static int do_move_page_to_node_array(struct mm_struct *mm,
				      struct page_to_node *pm,
				      int migrate_all)
1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245
{
	int err;
	struct page_to_node *pp;
	LIST_HEAD(pagelist);

	down_read(&mm->mmap_sem);

	/*
	 * Build a list of pages to migrate
	 */
	for (pp = pm; pp->node != MAX_NUMNODES; pp++) {
		struct vm_area_struct *vma;
		struct page *page;

		err = -EFAULT;
		vma = find_vma(mm, pp->addr);
1246
		if (!vma || pp->addr < vma->vm_start || !vma_migratable(vma))
1247 1248
			goto set_status;

1249 1250 1251
		/* FOLL_DUMP to ignore special (like zero) pages */
		page = follow_page(vma, pp->addr,
				FOLL_GET | FOLL_SPLIT | FOLL_DUMP);
1252 1253 1254 1255 1256

		err = PTR_ERR(page);
		if (IS_ERR(page))
			goto set_status;

1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274
		err = -ENOENT;
		if (!page)
			goto set_status;

		pp->page = page;
		err = page_to_nid(page);

		if (err == pp->node)
			/*
			 * Node already in the right place
			 */
			goto put_and_set;

		err = -EACCES;
		if (page_mapcount(page) > 1 &&
				!migrate_all)
			goto put_and_set;

1275
		if (PageHuge(page)) {
1276 1277
			if (PageHead(page))
				isolate_huge_page(page, &pagelist);
1278 1279 1280
			goto put_and_set;
		}

1281
		err = isolate_lru_page(page);
1282
		if (!err) {
1283
			list_add_tail(&page->lru, &pagelist);
1284 1285 1286
			inc_zone_page_state(page, NR_ISOLATED_ANON +
					    page_is_file_cache(page));
		}
1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297
put_and_set:
		/*
		 * Either remove the duplicate refcount from
		 * isolate_lru_page() or drop the page ref if it was
		 * not isolated.
		 */
		put_page(page);
set_status:
		pp->status = err;
	}

1298
	err = 0;
1299
	if (!list_empty(&pagelist)) {
1300
		err = migrate_pages(&pagelist, new_page_node, NULL,
1301
				(unsigned long)pm, MIGRATE_SYNC, MR_SYSCALL);
1302
		if (err)
1303
			putback_movable_pages(&pagelist);
1304
	}
1305 1306 1307 1308 1309

	up_read(&mm->mmap_sem);
	return err;
}

1310 1311 1312 1313
/*
 * Migrate an array of page address onto an array of nodes and fill
 * the corresponding array of status.
 */
1314
static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
1315 1316 1317 1318 1319
			 unsigned long nr_pages,
			 const void __user * __user *pages,
			 const int __user *nodes,
			 int __user *status, int flags)
{
1320 1321 1322 1323
	struct page_to_node *pm;
	unsigned long chunk_nr_pages;
	unsigned long chunk_start;
	int err;
1324

1325 1326 1327
	err = -ENOMEM;
	pm = (struct page_to_node *)__get_free_page(GFP_KERNEL);
	if (!pm)
1328
		goto out;
1329 1330 1331

	migrate_prep();

1332
	/*
1333 1334
	 * Store a chunk of page_to_node array in a page,
	 * but keep the last one as a marker
1335
	 */
1336
	chunk_nr_pages = (PAGE_SIZE / sizeof(struct page_to_node)) - 1;
1337

1338 1339 1340 1341
	for (chunk_start = 0;
	     chunk_start < nr_pages;
	     chunk_start += chunk_nr_pages) {
		int j;
1342

1343 1344 1345 1346 1347 1348
		if (chunk_start + chunk_nr_pages > nr_pages)
			chunk_nr_pages = nr_pages - chunk_start;

		/* fill the chunk pm with addrs and nodes from user-space */
		for (j = 0; j < chunk_nr_pages; j++) {
			const void __user *p;
1349 1350
			int node;

1351 1352 1353 1354 1355 1356
			err = -EFAULT;
			if (get_user(p, pages + j + chunk_start))
				goto out_pm;
			pm[j].addr = (unsigned long) p;

			if (get_user(node, nodes + j + chunk_start))
1357 1358 1359
				goto out_pm;

			err = -ENODEV;
1360 1361 1362
			if (node < 0 || node >= MAX_NUMNODES)
				goto out_pm;

1363
			if (!node_state(node, N_MEMORY))
1364 1365 1366 1367 1368 1369
				goto out_pm;

			err = -EACCES;
			if (!node_isset(node, task_nodes))
				goto out_pm;

1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380
			pm[j].node = node;
		}

		/* End marker for this chunk */
		pm[chunk_nr_pages].node = MAX_NUMNODES;

		/* Migrate this chunk */
		err = do_move_page_to_node_array(mm, pm,
						 flags & MPOL_MF_MOVE_ALL);
		if (err < 0)
			goto out_pm;
1381 1382

		/* Return status information */
1383 1384
		for (j = 0; j < chunk_nr_pages; j++)
			if (put_user(pm[j].status, status + j + chunk_start)) {
1385
				err = -EFAULT;
1386 1387 1388 1389
				goto out_pm;
			}
	}
	err = 0;
1390 1391

out_pm:
1392
	free_page((unsigned long)pm);
1393 1394 1395 1396
out:
	return err;
}

1397
/*
1398
 * Determine the nodes of an array of pages and store it in an array of status.
1399
 */
1400 1401
static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
				const void __user **pages, int *status)
1402
{
1403 1404
	unsigned long i;

1405 1406
	down_read(&mm->mmap_sem);

1407
	for (i = 0; i < nr_pages; i++) {
1408
		unsigned long addr = (unsigned long)(*pages);
1409 1410
		struct vm_area_struct *vma;
		struct page *page;
1411
		int err = -EFAULT;
1412 1413

		vma = find_vma(mm, addr);
1414
		if (!vma || addr < vma->vm_start)
1415 1416
			goto set_status;

1417 1418
		/* FOLL_DUMP to ignore special (like zero) pages */
		page = follow_page(vma, addr, FOLL_DUMP);
1419 1420 1421 1422 1423

		err = PTR_ERR(page);
		if (IS_ERR(page))
			goto set_status;

1424
		err = page ? page_to_nid(page) : -ENOENT;
1425
set_status:
1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446
		*status = err;

		pages++;
		status++;
	}

	up_read(&mm->mmap_sem);
}

/*
 * Determine the nodes of a user array of pages and store it in
 * a user array of status.
 */
static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
			 const void __user * __user *pages,
			 int __user *status)
{
#define DO_PAGES_STAT_CHUNK_NR 16
	const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
	int chunk_status[DO_PAGES_STAT_CHUNK_NR];

1447 1448
	while (nr_pages) {
		unsigned long chunk_nr;
1449

1450 1451 1452 1453 1454 1455
		chunk_nr = nr_pages;
		if (chunk_nr > DO_PAGES_STAT_CHUNK_NR)
			chunk_nr = DO_PAGES_STAT_CHUNK_NR;

		if (copy_from_user(chunk_pages, pages, chunk_nr * sizeof(*chunk_pages)))
			break;
1456 1457 1458

		do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);

1459 1460
		if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status)))
			break;
1461

1462 1463 1464 1465 1466
		pages += chunk_nr;
		status += chunk_nr;
		nr_pages -= chunk_nr;
	}
	return nr_pages ? -EFAULT : 0;
1467 1468 1469 1470 1471 1472
}

/*
 * Move a list of pages in the address space of the currently executing
 * process.
 */
1473 1474 1475 1476
SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
		const void __user * __user *, pages,
		const int __user *, nodes,
		int __user *, status, int, flags)
1477
{
1478
	const struct cred *cred = current_cred(), *tcred;
1479 1480
	struct task_struct *task;
	struct mm_struct *mm;
1481
	int err;
1482
	nodemask_t task_nodes;
1483 1484 1485 1486 1487 1488 1489 1490 1491

	/* Check flags */
	if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
		return -EINVAL;

	if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_NICE))
		return -EPERM;

	/* Find the mm_struct */
1492
	rcu_read_lock();
1493
	task = pid ? find_task_by_vpid(pid) : current;
1494
	if (!task) {
1495
		rcu_read_unlock();
1496 1497
		return -ESRCH;
	}
1498
	get_task_struct(task);
1499 1500 1501 1502 1503 1504 1505

	/*
	 * Check if this process has the right to modify the specified
	 * process. The right exists if the process has administrative
	 * capabilities, superuser privileges or the same
	 * userid as the target process.
	 */
1506
	tcred = __task_cred(task);
1507 1508
	if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
	    !uid_eq(cred->uid,  tcred->suid) && !uid_eq(cred->uid,  tcred->uid) &&
1509
	    !capable(CAP_SYS_NICE)) {
1510
		rcu_read_unlock();
1511
		err = -EPERM;
1512
		goto out;
1513
	}
1514
	rcu_read_unlock();
1515

1516 1517
 	err = security_task_movememory(task);
 	if (err)
1518
		goto out;
1519

1520 1521 1522 1523
	task_nodes = cpuset_mems_allowed(task);
	mm = get_task_mm(task);
	put_task_struct(task);

1524 1525 1526 1527 1528 1529 1530 1531
	if (!mm)
		return -EINVAL;

	if (nodes)
		err = do_pages_move(mm, task_nodes, nr_pages, pages,
				    nodes, status, flags);
	else
		err = do_pages_stat(mm, nr_pages, pages, status);
1532 1533 1534

	mmput(mm);
	return err;
1535 1536 1537 1538

out:
	put_task_struct(task);
	return err;
1539 1540
}

1541 1542 1543 1544 1545 1546
#ifdef CONFIG_NUMA_BALANCING
/*
 * Returns true if this is a safe migration target node for misplaced NUMA
 * pages. Currently it only checks the watermarks which crude
 */
static bool migrate_balanced_pgdat(struct pglist_data *pgdat,
1547
				   unsigned long nr_migrate_pages)
1548 1549 1550 1551 1552 1553 1554 1555
{
	int z;
	for (z = pgdat->nr_zones - 1; z >= 0; z--) {
		struct zone *zone = pgdat->node_zones + z;

		if (!populated_zone(zone))
			continue;

1556
		if (!zone_reclaimable(zone))
1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576
			continue;

		/* Avoid waking kswapd by allocating pages_to_migrate pages. */
		if (!zone_watermark_ok(zone, 0,
				       high_wmark_pages(zone) +
				       nr_migrate_pages,
				       0, 0))
			continue;
		return true;
	}
	return false;
}

static struct page *alloc_misplaced_dst_page(struct page *page,
					   unsigned long data,
					   int **result)
{
	int nid = (int) data;
	struct page *newpage;

1577
	newpage = __alloc_pages_node(nid,
1578 1579 1580
					 (GFP_HIGHUSER_MOVABLE |
					  __GFP_THISNODE | __GFP_NOMEMALLOC |
					  __GFP_NORETRY | __GFP_NOWARN) &
1581
					 ~(__GFP_IO | __GFP_FS), 0);
1582

1583 1584 1585
	return newpage;
}

1586 1587 1588 1589 1590 1591 1592 1593
/*
 * page migration rate limiting control.
 * Do not migrate more than @pages_to_migrate in a @migrate_interval_millisecs
 * window of time. Default here says do not migrate more than 1280M per second.
 */
static unsigned int migrate_interval_millisecs __read_mostly = 100;
static unsigned int ratelimit_pages __read_mostly = 128 << (20 - PAGE_SHIFT);

1594
/* Returns true if the node is migrate rate-limited after the update */
1595 1596
static bool numamigrate_update_ratelimit(pg_data_t *pgdat,
					unsigned long nr_pages)
1597
{
1598 1599 1600 1601 1602 1603
	/*
	 * Rate-limit the amount of data that is being migrated to a node.
	 * Optimal placement is no good if the memory bus is saturated and
	 * all the time is being spent migrating!
	 */
	if (time_after(jiffies, pgdat->numabalancing_migrate_next_window)) {
1604
		spin_lock(&pgdat->numabalancing_migrate_lock);
1605 1606 1607
		pgdat->numabalancing_migrate_nr_pages = 0;
		pgdat->numabalancing_migrate_next_window = jiffies +
			msecs_to_jiffies(migrate_interval_millisecs);
1608
		spin_unlock(&pgdat->numabalancing_migrate_lock);
1609
	}
1610 1611 1612
	if (pgdat->numabalancing_migrate_nr_pages > ratelimit_pages) {
		trace_mm_numa_migrate_ratelimit(current, pgdat->node_id,
								nr_pages);
1613
		return true;
1614
	}
1615 1616 1617 1618 1619 1620 1621 1622 1623

	/*
	 * This is an unlocked non-atomic update so errors are possible.
	 * The consequences are failing to migrate when we potentiall should
	 * have which is not severe enough to warrant locking. If it is ever
	 * a problem, it can be converted to a per-cpu counter.
	 */
	pgdat->numabalancing_migrate_nr_pages += nr_pages;
	return false;
1624 1625
}

1626
static int numamigrate_isolate_page(pg_data_t *pgdat, struct page *page)
1627
{
1628
	int page_lru;
1629

1630
	VM_BUG_ON_PAGE(compound_order(page) && !PageTransHuge(page), page);
1631

1632
	/* Avoid migrating to a node that is nearly full */
1633 1634
	if (!migrate_balanced_pgdat(pgdat, 1UL << compound_order(page)))
		return 0;
1635

1636 1637
	if (isolate_lru_page(page))
		return 0;
1638

1639 1640 1641 1642 1643 1644 1645 1646 1647 1648
	/*
	 * migrate_misplaced_transhuge_page() skips page migration's usual
	 * check on page_count(), so we must do it here, now that the page
	 * has been isolated: a GUP pin, or any other pin, prevents migration.
	 * The expected page count is 3: 1 for page's mapcount and 1 for the
	 * caller's pin and 1 for the reference taken by isolate_lru_page().
	 */
	if (PageTransHuge(page) && page_count(page) != 3) {
		putback_lru_page(page);
		return 0;
1649 1650
	}

1651 1652 1653 1654
	page_lru = page_is_file_cache(page);
	mod_zone_page_state(page_zone(page), NR_ISOLATED_ANON + page_lru,
				hpage_nr_pages(page));

1655
	/*
1656 1657 1658
	 * Isolating the page has taken another reference, so the
	 * caller's reference can be safely dropped without the page
	 * disappearing underneath us during migration.
1659 1660
	 */
	put_page(page);
1661
	return 1;
1662 1663
}

1664 1665 1666 1667 1668 1669
bool pmd_trans_migrating(pmd_t pmd)
{
	struct page *page = pmd_page(pmd);
	return PageLocked(page);
}

1670 1671 1672 1673 1674
/*
 * Attempt to migrate a misplaced page to the specified destination
 * node. Caller is expected to have an elevated reference count on
 * the page that will be dropped by this function before returning.
 */
1675 1676
int migrate_misplaced_page(struct page *page, struct vm_area_struct *vma,
			   int node)
1677 1678
{
	pg_data_t *pgdat = NODE_DATA(node);
1679
	int isolated;
1680 1681 1682 1683
	int nr_remaining;
	LIST_HEAD(migratepages);

	/*
1684 1685
	 * Don't migrate file pages that are mapped in multiple processes
	 * with execute permissions as they are probably shared libraries.
1686
	 */
1687 1688
	if (page_mapcount(page) != 1 && page_is_file_cache(page) &&
	    (vma->vm_flags & VM_EXEC))
1689 1690 1691 1692 1693 1694 1695
		goto out;

	/*
	 * Rate-limit the amount of data that is being migrated to a node.
	 * Optimal placement is no good if the memory bus is saturated and
	 * all the time is being spent migrating!
	 */
1696
	if (numamigrate_update_ratelimit(pgdat, 1))
1697 1698 1699 1700 1701 1702 1703
		goto out;

	isolated = numamigrate_isolate_page(pgdat, page);
	if (!isolated)
		goto out;

	list_add(&page->lru, &migratepages);
1704
	nr_remaining = migrate_pages(&migratepages, alloc_misplaced_dst_page,
1705 1706
				     NULL, node, MIGRATE_ASYNC,
				     MR_NUMA_MISPLACED);
1707
	if (nr_remaining) {
1708 1709 1710 1711 1712 1713
		if (!list_empty(&migratepages)) {
			list_del(&page->lru);
			dec_zone_page_state(page, NR_ISOLATED_ANON +
					page_is_file_cache(page));
			putback_lru_page(page);
		}
1714 1715 1716
		isolated = 0;
	} else
		count_vm_numa_event(NUMA_PAGE_MIGRATE);
1717 1718
	BUG_ON(!list_empty(&migratepages));
	return isolated;
1719 1720 1721 1722

out:
	put_page(page);
	return 0;
1723
}
1724
#endif /* CONFIG_NUMA_BALANCING */
1725

1726
#if defined(CONFIG_NUMA_BALANCING) && defined(CONFIG_TRANSPARENT_HUGEPAGE)
1727 1728 1729 1730
/*
 * Migrates a THP to a given target node. page must be locked and is unlocked
 * before returning.
 */
1731 1732 1733 1734 1735 1736
int migrate_misplaced_transhuge_page(struct mm_struct *mm,
				struct vm_area_struct *vma,
				pmd_t *pmd, pmd_t entry,
				unsigned long address,
				struct page *page, int node)
{
1737
	spinlock_t *ptl;
1738 1739 1740 1741
	pg_data_t *pgdat = NODE_DATA(node);
	int isolated = 0;
	struct page *new_page = NULL;
	int page_lru = page_is_file_cache(page);
1742 1743
	unsigned long mmun_start = address & HPAGE_PMD_MASK;
	unsigned long mmun_end = mmun_start + HPAGE_PMD_SIZE;
1744
	pmd_t orig_entry;
1745 1746 1747 1748 1749 1750

	/*
	 * Rate-limit the amount of data that is being migrated to a node.
	 * Optimal placement is no good if the memory bus is saturated and
	 * all the time is being spent migrating!
	 */
1751
	if (numamigrate_update_ratelimit(pgdat, HPAGE_PMD_NR))
1752 1753 1754
		goto out_dropref;

	new_page = alloc_pages_node(node,
1755
		(GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_RECLAIM,
1756
		HPAGE_PMD_ORDER);
1757 1758 1759
	if (!new_page)
		goto out_fail;

1760
	isolated = numamigrate_isolate_page(pgdat, page);
1761
	if (!isolated) {
1762
		put_page(new_page);
1763
		goto out_fail;
1764 1765
	}

1766 1767 1768
	if (mm_tlb_flush_pending(mm))
		flush_tlb_range(vma, mmun_start, mmun_end);

1769
	/* Prepare a page as a migration target */
1770
	__SetPageLocked(new_page);
1771 1772 1773 1774 1775 1776 1777 1778 1779
	SetPageSwapBacked(new_page);

	/* anon mapping, we can simply copy page->mapping to the new page: */
	new_page->mapping = page->mapping;
	new_page->index = page->index;
	migrate_page_copy(new_page, page);
	WARN_ON(PageLRU(new_page));

	/* Recheck the target PMD */
1780
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
1781
	ptl = pmd_lock(mm, pmd);
1782 1783
	if (unlikely(!pmd_same(*pmd, entry) || page_count(page) != 2)) {
fail_putback:
1784
		spin_unlock(ptl);
1785
		mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1786 1787 1788 1789 1790 1791 1792 1793 1794 1795

		/* Reverse changes made by migrate_page_copy() */
		if (TestClearPageActive(new_page))
			SetPageActive(page);
		if (TestClearPageUnevictable(new_page))
			SetPageUnevictable(page);

		unlock_page(new_page);
		put_page(new_page);		/* Free it */

1796 1797
		/* Retake the callers reference and putback on LRU */
		get_page(page);
1798
		putback_lru_page(page);
1799 1800
		mod_zone_page_state(page_zone(page),
			 NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
1801 1802

		goto out_unlock;
1803 1804
	}

1805
	orig_entry = *pmd;
1806 1807
	entry = mk_pmd(new_page, vma->vm_page_prot);
	entry = pmd_mkhuge(entry);
1808
	entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
1809

1810 1811 1812 1813 1814 1815 1816
	/*
	 * Clear the old entry under pagetable lock and establish the new PTE.
	 * Any parallel GUP will either observe the old page blocking on the
	 * page lock, block on the page table lock or observe the new page.
	 * The SetPageUptodate on the new page and page_add_new_anon_rmap
	 * guarantee the copy is visible before the pagetable update.
	 */
1817
	flush_cache_range(vma, mmun_start, mmun_end);
1818
	page_add_anon_rmap(new_page, vma, mmun_start, true);
1819
	pmdp_huge_clear_flush_notify(vma, mmun_start, pmd);
1820 1821
	set_pmd_at(mm, mmun_start, pmd, entry);
	flush_tlb_range(vma, mmun_start, mmun_end);
1822
	update_mmu_cache_pmd(vma, address, &entry);
1823 1824

	if (page_count(page) != 2) {
1825 1826
		set_pmd_at(mm, mmun_start, pmd, orig_entry);
		flush_tlb_range(vma, mmun_start, mmun_end);
1827
		mmu_notifier_invalidate_range(mm, mmun_start, mmun_end);
1828
		update_mmu_cache_pmd(vma, address, &entry);
1829
		page_remove_rmap(new_page, true);
1830 1831 1832
		goto fail_putback;
	}

1833
	mlock_migrate_page(new_page, page);
1834 1835
	set_page_memcg(new_page, page_memcg(page));
	set_page_memcg(page, NULL);
1836
	page_remove_rmap(page, true);
1837

1838
	spin_unlock(ptl);
1839
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1840

1841 1842 1843 1844
	/* Take an "isolate" reference and put new page on the LRU. */
	get_page(new_page);
	putback_lru_page(new_page);

1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857
	unlock_page(new_page);
	unlock_page(page);
	put_page(page);			/* Drop the rmap reference */
	put_page(page);			/* Drop the LRU isolation reference */

	count_vm_events(PGMIGRATE_SUCCESS, HPAGE_PMD_NR);
	count_vm_numa_events(NUMA_PAGE_MIGRATE, HPAGE_PMD_NR);

	mod_zone_page_state(page_zone(page),
			NR_ISOLATED_ANON + page_lru,
			-HPAGE_PMD_NR);
	return isolated;

1858 1859
out_fail:
	count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
1860
out_dropref:
1861 1862
	ptl = pmd_lock(mm, pmd);
	if (pmd_same(*pmd, entry)) {
1863
		entry = pmd_modify(entry, vma->vm_page_prot);
1864
		set_pmd_at(mm, mmun_start, pmd, entry);
1865 1866 1867
		update_mmu_cache_pmd(vma, address, &entry);
	}
	spin_unlock(ptl);
1868

1869
out_unlock:
1870
	unlock_page(page);
1871 1872 1873
	put_page(page);
	return 0;
}
1874 1875 1876
#endif /* CONFIG_NUMA_BALANCING */

#endif /* CONFIG_NUMA */