huge_memory.c 78.3 KB
Newer Older
1 2 3 4 5 6 7
/*
 *  Copyright (C) 2009  Red Hat, Inc.
 *
 *  This work is licensed under the terms of the GNU GPL, version 2. See
 *  the COPYING file in the top-level directory.
 */

8 9
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

10 11 12 13 14 15 16
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/highmem.h>
#include <linux/hugetlb.h>
#include <linux/mmu_notifier.h>
#include <linux/rmap.h>
#include <linux/swap.h>
17
#include <linux/shrinker.h>
A
Andrea Arcangeli 已提交
18 19 20
#include <linux/mm_inline.h>
#include <linux/kthread.h>
#include <linux/khugepaged.h>
21
#include <linux/freezer.h>
A
Andrea Arcangeli 已提交
22
#include <linux/mman.h>
R
Ralf Baechle 已提交
23
#include <linux/pagemap.h>
24
#include <linux/migrate.h>
25
#include <linux/hashtable.h>
26

27 28 29 30
#include <asm/tlb.h>
#include <asm/pgalloc.h>
#include "internal.h"

A
Andrea Arcangeli 已提交
31
/*
32 33 34 35 36 37
 * By default transparent hugepage support is disabled in order that avoid
 * to risk increase the memory footprint of applications without a guaranteed
 * benefit. When transparent hugepage support is enabled, is for all mappings,
 * and khugepaged scans all mappings.
 * Defrag is invoked by khugepaged hugepage allocations and by page faults
 * for all hugepage allocations.
A
Andrea Arcangeli 已提交
38
 */
39
unsigned long transparent_hugepage_flags __read_mostly =
40
#ifdef CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS
A
Andrea Arcangeli 已提交
41
	(1<<TRANSPARENT_HUGEPAGE_FLAG)|
42 43 44 45
#endif
#ifdef CONFIG_TRANSPARENT_HUGEPAGE_MADVISE
	(1<<TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG)|
#endif
A
Andrea Arcangeli 已提交
46
	(1<<TRANSPARENT_HUGEPAGE_DEFRAG_FLAG)|
47 48
	(1<<TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG)|
	(1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
A
Andrea Arcangeli 已提交
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70

/* default scan 8*512 pte (or vmas) every 30 second */
static unsigned int khugepaged_pages_to_scan __read_mostly = HPAGE_PMD_NR*8;
static unsigned int khugepaged_pages_collapsed;
static unsigned int khugepaged_full_scans;
static unsigned int khugepaged_scan_sleep_millisecs __read_mostly = 10000;
/* during fragmentation poll the hugepage allocator once every minute */
static unsigned int khugepaged_alloc_sleep_millisecs __read_mostly = 60000;
static struct task_struct *khugepaged_thread __read_mostly;
static DEFINE_MUTEX(khugepaged_mutex);
static DEFINE_SPINLOCK(khugepaged_mm_lock);
static DECLARE_WAIT_QUEUE_HEAD(khugepaged_wait);
/*
 * default collapse hugepages if there is at least one pte mapped like
 * it would have happened if the vma was large enough during page
 * fault.
 */
static unsigned int khugepaged_max_ptes_none __read_mostly = HPAGE_PMD_NR-1;

static int khugepaged(void *none);
static int khugepaged_slab_init(void);

71 72 73
#define MM_SLOTS_HASH_BITS 10
static __read_mostly DEFINE_HASHTABLE(mm_slots_hash, MM_SLOTS_HASH_BITS);

A
Andrea Arcangeli 已提交
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
static struct kmem_cache *mm_slot_cache __read_mostly;

/**
 * struct mm_slot - hash lookup from mm to mm_slot
 * @hash: hash collision list
 * @mm_node: khugepaged scan list headed in khugepaged_scan.mm_head
 * @mm: the mm that this information is valid for
 */
struct mm_slot {
	struct hlist_node hash;
	struct list_head mm_node;
	struct mm_struct *mm;
};

/**
 * struct khugepaged_scan - cursor for scanning
 * @mm_head: the head of the mm list to scan
 * @mm_slot: the current mm_slot we are scanning
 * @address: the next address inside that to be scanned
 *
 * There is only the one khugepaged_scan instance of this cursor structure.
 */
struct khugepaged_scan {
	struct list_head mm_head;
	struct mm_slot *mm_slot;
	unsigned long address;
100 101
};
static struct khugepaged_scan khugepaged_scan = {
A
Andrea Arcangeli 已提交
102 103 104
	.mm_head = LIST_HEAD_INIT(khugepaged_scan.mm_head),
};

105 106 107 108 109 110 111

static int set_recommended_min_free_kbytes(void)
{
	struct zone *zone;
	int nr_zones = 0;
	unsigned long recommended_min;

112
	if (!khugepaged_enabled())
113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134
		return 0;

	for_each_populated_zone(zone)
		nr_zones++;

	/* Make sure at least 2 hugepages are free for MIGRATE_RESERVE */
	recommended_min = pageblock_nr_pages * nr_zones * 2;

	/*
	 * Make sure that on average at least two pageblocks are almost free
	 * of another type, one for a migratetype to fall back to and a
	 * second to avoid subsequent fallbacks of other types There are 3
	 * MIGRATE_TYPES we care about.
	 */
	recommended_min += pageblock_nr_pages * nr_zones *
			   MIGRATE_PCPTYPES * MIGRATE_PCPTYPES;

	/* don't ever allow to reserve more than 5% of the lowmem */
	recommended_min = min(recommended_min,
			      (unsigned long) nr_free_buffer_pages() / 20);
	recommended_min <<= (PAGE_SHIFT-10);

135 136 137 138 139 140
	if (recommended_min > min_free_kbytes) {
		if (user_min_free_kbytes >= 0)
			pr_info("raising min_free_kbytes from %d to %lu "
				"to help transparent hugepage allocations\n",
				min_free_kbytes, recommended_min);

141
		min_free_kbytes = recommended_min;
142
	}
143 144 145 146 147
	setup_per_zone_wmarks();
	return 0;
}
late_initcall(set_recommended_min_free_kbytes);

A
Andrea Arcangeli 已提交
148 149 150 151 152 153 154 155
static int start_khugepaged(void)
{
	int err = 0;
	if (khugepaged_enabled()) {
		if (!khugepaged_thread)
			khugepaged_thread = kthread_run(khugepaged, NULL,
							"khugepaged");
		if (unlikely(IS_ERR(khugepaged_thread))) {
156
			pr_err("khugepaged: kthread_run(khugepaged) failed\n");
A
Andrea Arcangeli 已提交
157 158 159
			err = PTR_ERR(khugepaged_thread);
			khugepaged_thread = NULL;
		}
160 161

		if (!list_empty(&khugepaged_scan.mm_head))
A
Andrea Arcangeli 已提交
162
			wake_up_interruptible(&khugepaged_wait);
163 164

		set_recommended_min_free_kbytes();
165 166 167 168
	} else if (khugepaged_thread) {
		kthread_stop(khugepaged_thread);
		khugepaged_thread = NULL;
	}
169

A
Andrea Arcangeli 已提交
170 171
	return err;
}
172

173
static atomic_t huge_zero_refcount;
174
static struct page *huge_zero_page __read_mostly;
175

176
static inline bool is_huge_zero_page(struct page *page)
177
{
178
	return ACCESS_ONCE(huge_zero_page) == page;
179
}
180

181 182
static inline bool is_huge_zero_pmd(pmd_t pmd)
{
183
	return is_huge_zero_page(pmd_page(pmd));
184 185
}

186
static struct page *get_huge_zero_page(void)
187 188 189 190
{
	struct page *zero_page;
retry:
	if (likely(atomic_inc_not_zero(&huge_zero_refcount)))
191
		return ACCESS_ONCE(huge_zero_page);
192 193

	zero_page = alloc_pages((GFP_TRANSHUGE | __GFP_ZERO) & ~__GFP_MOVABLE,
194
			HPAGE_PMD_ORDER);
195 196
	if (!zero_page) {
		count_vm_event(THP_ZERO_PAGE_ALLOC_FAILED);
197
		return NULL;
198 199
	}
	count_vm_event(THP_ZERO_PAGE_ALLOC);
200
	preempt_disable();
201
	if (cmpxchg(&huge_zero_page, NULL, zero_page)) {
202 203 204 205 206 207 208 209
		preempt_enable();
		__free_page(zero_page);
		goto retry;
	}

	/* We take additional reference here. It will be put back by shrinker */
	atomic_set(&huge_zero_refcount, 2);
	preempt_enable();
210
	return ACCESS_ONCE(huge_zero_page);
211 212
}

213
static void put_huge_zero_page(void)
214
{
215 216 217 218 219
	/*
	 * Counter should never go to zero here. Only shrinker can put
	 * last reference.
	 */
	BUG_ON(atomic_dec_and_test(&huge_zero_refcount));
220 221
}

222 223
static unsigned long shrink_huge_zero_page_count(struct shrinker *shrink,
					struct shrink_control *sc)
224
{
225 226 227
	/* we can free zero page only if last reference remains */
	return atomic_read(&huge_zero_refcount) == 1 ? HPAGE_PMD_NR : 0;
}
228

229 230 231
static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink,
				       struct shrink_control *sc)
{
232
	if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) {
233 234 235
		struct page *zero_page = xchg(&huge_zero_page, NULL);
		BUG_ON(zero_page == NULL);
		__free_page(zero_page);
236
		return HPAGE_PMD_NR;
237 238 239
	}

	return 0;
240 241
}

242
static struct shrinker huge_zero_page_shrinker = {
243 244
	.count_objects = shrink_huge_zero_page_count,
	.scan_objects = shrink_huge_zero_page_scan,
245 246 247
	.seeks = DEFAULT_SEEKS,
};

248
#ifdef CONFIG_SYSFS
A
Andrea Arcangeli 已提交
249

250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297
static ssize_t double_flag_show(struct kobject *kobj,
				struct kobj_attribute *attr, char *buf,
				enum transparent_hugepage_flag enabled,
				enum transparent_hugepage_flag req_madv)
{
	if (test_bit(enabled, &transparent_hugepage_flags)) {
		VM_BUG_ON(test_bit(req_madv, &transparent_hugepage_flags));
		return sprintf(buf, "[always] madvise never\n");
	} else if (test_bit(req_madv, &transparent_hugepage_flags))
		return sprintf(buf, "always [madvise] never\n");
	else
		return sprintf(buf, "always madvise [never]\n");
}
static ssize_t double_flag_store(struct kobject *kobj,
				 struct kobj_attribute *attr,
				 const char *buf, size_t count,
				 enum transparent_hugepage_flag enabled,
				 enum transparent_hugepage_flag req_madv)
{
	if (!memcmp("always", buf,
		    min(sizeof("always")-1, count))) {
		set_bit(enabled, &transparent_hugepage_flags);
		clear_bit(req_madv, &transparent_hugepage_flags);
	} else if (!memcmp("madvise", buf,
			   min(sizeof("madvise")-1, count))) {
		clear_bit(enabled, &transparent_hugepage_flags);
		set_bit(req_madv, &transparent_hugepage_flags);
	} else if (!memcmp("never", buf,
			   min(sizeof("never")-1, count))) {
		clear_bit(enabled, &transparent_hugepage_flags);
		clear_bit(req_madv, &transparent_hugepage_flags);
	} else
		return -EINVAL;

	return count;
}

static ssize_t enabled_show(struct kobject *kobj,
			    struct kobj_attribute *attr, char *buf)
{
	return double_flag_show(kobj, attr, buf,
				TRANSPARENT_HUGEPAGE_FLAG,
				TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG);
}
static ssize_t enabled_store(struct kobject *kobj,
			     struct kobj_attribute *attr,
			     const char *buf, size_t count)
{
A
Andrea Arcangeli 已提交
298 299 300 301 302 303 304
	ssize_t ret;

	ret = double_flag_store(kobj, attr, buf, count,
				TRANSPARENT_HUGEPAGE_FLAG,
				TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG);

	if (ret > 0) {
305 306 307 308 309 310
		int err;

		mutex_lock(&khugepaged_mutex);
		err = start_khugepaged();
		mutex_unlock(&khugepaged_mutex);

A
Andrea Arcangeli 已提交
311 312 313 314 315
		if (err)
			ret = err;
	}

	return ret;
316 317 318 319 320 321 322 323
}
static struct kobj_attribute enabled_attr =
	__ATTR(enabled, 0644, enabled_show, enabled_store);

static ssize_t single_flag_show(struct kobject *kobj,
				struct kobj_attribute *attr, char *buf,
				enum transparent_hugepage_flag flag)
{
324 325
	return sprintf(buf, "%d\n",
		       !!test_bit(flag, &transparent_hugepage_flags));
326
}
327

328 329 330 331 332
static ssize_t single_flag_store(struct kobject *kobj,
				 struct kobj_attribute *attr,
				 const char *buf, size_t count,
				 enum transparent_hugepage_flag flag)
{
333 334 335 336 337 338 339 340 341 342
	unsigned long value;
	int ret;

	ret = kstrtoul(buf, 10, &value);
	if (ret < 0)
		return ret;
	if (value > 1)
		return -EINVAL;

	if (value)
343
		set_bit(flag, &transparent_hugepage_flags);
344
	else
345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372
		clear_bit(flag, &transparent_hugepage_flags);

	return count;
}

/*
 * Currently defrag only disables __GFP_NOWAIT for allocation. A blind
 * __GFP_REPEAT is too aggressive, it's never worth swapping tons of
 * memory just to allocate one more hugepage.
 */
static ssize_t defrag_show(struct kobject *kobj,
			   struct kobj_attribute *attr, char *buf)
{
	return double_flag_show(kobj, attr, buf,
				TRANSPARENT_HUGEPAGE_DEFRAG_FLAG,
				TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG);
}
static ssize_t defrag_store(struct kobject *kobj,
			    struct kobj_attribute *attr,
			    const char *buf, size_t count)
{
	return double_flag_store(kobj, attr, buf, count,
				 TRANSPARENT_HUGEPAGE_DEFRAG_FLAG,
				 TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG);
}
static struct kobj_attribute defrag_attr =
	__ATTR(defrag, 0644, defrag_show, defrag_store);

373 374 375 376 377 378 379 380 381 382 383 384 385 386
static ssize_t use_zero_page_show(struct kobject *kobj,
		struct kobj_attribute *attr, char *buf)
{
	return single_flag_show(kobj, attr, buf,
				TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
}
static ssize_t use_zero_page_store(struct kobject *kobj,
		struct kobj_attribute *attr, const char *buf, size_t count)
{
	return single_flag_store(kobj, attr, buf, count,
				 TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
}
static struct kobj_attribute use_zero_page_attr =
	__ATTR(use_zero_page, 0644, use_zero_page_show, use_zero_page_store);
387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407
#ifdef CONFIG_DEBUG_VM
static ssize_t debug_cow_show(struct kobject *kobj,
				struct kobj_attribute *attr, char *buf)
{
	return single_flag_show(kobj, attr, buf,
				TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
}
static ssize_t debug_cow_store(struct kobject *kobj,
			       struct kobj_attribute *attr,
			       const char *buf, size_t count)
{
	return single_flag_store(kobj, attr, buf, count,
				 TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
}
static struct kobj_attribute debug_cow_attr =
	__ATTR(debug_cow, 0644, debug_cow_show, debug_cow_store);
#endif /* CONFIG_DEBUG_VM */

static struct attribute *hugepage_attr[] = {
	&enabled_attr.attr,
	&defrag_attr.attr,
408
	&use_zero_page_attr.attr,
409 410 411 412 413 414 415 416
#ifdef CONFIG_DEBUG_VM
	&debug_cow_attr.attr,
#endif
	NULL,
};

static struct attribute_group hugepage_attr_group = {
	.attrs = hugepage_attr,
A
Andrea Arcangeli 已提交
417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432
};

static ssize_t scan_sleep_millisecs_show(struct kobject *kobj,
					 struct kobj_attribute *attr,
					 char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_scan_sleep_millisecs);
}

static ssize_t scan_sleep_millisecs_store(struct kobject *kobj,
					  struct kobj_attribute *attr,
					  const char *buf, size_t count)
{
	unsigned long msecs;
	int err;

433
	err = kstrtoul(buf, 10, &msecs);
A
Andrea Arcangeli 已提交
434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459
	if (err || msecs > UINT_MAX)
		return -EINVAL;

	khugepaged_scan_sleep_millisecs = msecs;
	wake_up_interruptible(&khugepaged_wait);

	return count;
}
static struct kobj_attribute scan_sleep_millisecs_attr =
	__ATTR(scan_sleep_millisecs, 0644, scan_sleep_millisecs_show,
	       scan_sleep_millisecs_store);

static ssize_t alloc_sleep_millisecs_show(struct kobject *kobj,
					  struct kobj_attribute *attr,
					  char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_alloc_sleep_millisecs);
}

static ssize_t alloc_sleep_millisecs_store(struct kobject *kobj,
					   struct kobj_attribute *attr,
					   const char *buf, size_t count)
{
	unsigned long msecs;
	int err;

460
	err = kstrtoul(buf, 10, &msecs);
A
Andrea Arcangeli 已提交
461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485
	if (err || msecs > UINT_MAX)
		return -EINVAL;

	khugepaged_alloc_sleep_millisecs = msecs;
	wake_up_interruptible(&khugepaged_wait);

	return count;
}
static struct kobj_attribute alloc_sleep_millisecs_attr =
	__ATTR(alloc_sleep_millisecs, 0644, alloc_sleep_millisecs_show,
	       alloc_sleep_millisecs_store);

static ssize_t pages_to_scan_show(struct kobject *kobj,
				  struct kobj_attribute *attr,
				  char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_pages_to_scan);
}
static ssize_t pages_to_scan_store(struct kobject *kobj,
				   struct kobj_attribute *attr,
				   const char *buf, size_t count)
{
	int err;
	unsigned long pages;

486
	err = kstrtoul(buf, 10, &pages);
A
Andrea Arcangeli 已提交
487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553
	if (err || !pages || pages > UINT_MAX)
		return -EINVAL;

	khugepaged_pages_to_scan = pages;

	return count;
}
static struct kobj_attribute pages_to_scan_attr =
	__ATTR(pages_to_scan, 0644, pages_to_scan_show,
	       pages_to_scan_store);

static ssize_t pages_collapsed_show(struct kobject *kobj,
				    struct kobj_attribute *attr,
				    char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_pages_collapsed);
}
static struct kobj_attribute pages_collapsed_attr =
	__ATTR_RO(pages_collapsed);

static ssize_t full_scans_show(struct kobject *kobj,
			       struct kobj_attribute *attr,
			       char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_full_scans);
}
static struct kobj_attribute full_scans_attr =
	__ATTR_RO(full_scans);

static ssize_t khugepaged_defrag_show(struct kobject *kobj,
				      struct kobj_attribute *attr, char *buf)
{
	return single_flag_show(kobj, attr, buf,
				TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG);
}
static ssize_t khugepaged_defrag_store(struct kobject *kobj,
				       struct kobj_attribute *attr,
				       const char *buf, size_t count)
{
	return single_flag_store(kobj, attr, buf, count,
				 TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG);
}
static struct kobj_attribute khugepaged_defrag_attr =
	__ATTR(defrag, 0644, khugepaged_defrag_show,
	       khugepaged_defrag_store);

/*
 * max_ptes_none controls if khugepaged should collapse hugepages over
 * any unmapped ptes in turn potentially increasing the memory
 * footprint of the vmas. When max_ptes_none is 0 khugepaged will not
 * reduce the available free memory in the system as it
 * runs. Increasing max_ptes_none will instead potentially reduce the
 * free memory in the system during the khugepaged scan.
 */
static ssize_t khugepaged_max_ptes_none_show(struct kobject *kobj,
					     struct kobj_attribute *attr,
					     char *buf)
{
	return sprintf(buf, "%u\n", khugepaged_max_ptes_none);
}
static ssize_t khugepaged_max_ptes_none_store(struct kobject *kobj,
					      struct kobj_attribute *attr,
					      const char *buf, size_t count)
{
	int err;
	unsigned long max_ptes_none;

554
	err = kstrtoul(buf, 10, &max_ptes_none);
A
Andrea Arcangeli 已提交
555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579
	if (err || max_ptes_none > HPAGE_PMD_NR-1)
		return -EINVAL;

	khugepaged_max_ptes_none = max_ptes_none;

	return count;
}
static struct kobj_attribute khugepaged_max_ptes_none_attr =
	__ATTR(max_ptes_none, 0644, khugepaged_max_ptes_none_show,
	       khugepaged_max_ptes_none_store);

static struct attribute *khugepaged_attr[] = {
	&khugepaged_defrag_attr.attr,
	&khugepaged_max_ptes_none_attr.attr,
	&pages_to_scan_attr.attr,
	&pages_collapsed_attr.attr,
	&full_scans_attr.attr,
	&scan_sleep_millisecs_attr.attr,
	&alloc_sleep_millisecs_attr.attr,
	NULL,
};

static struct attribute_group khugepaged_attr_group = {
	.attrs = khugepaged_attr,
	.name = "khugepaged",
580 581
};

S
Shaohua Li 已提交
582
static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj)
583 584 585
{
	int err;

S
Shaohua Li 已提交
586 587
	*hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
	if (unlikely(!*hugepage_kobj)) {
588
		pr_err("failed to create transparent hugepage kobject\n");
S
Shaohua Li 已提交
589
		return -ENOMEM;
A
Andrea Arcangeli 已提交
590 591
	}

S
Shaohua Li 已提交
592
	err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
A
Andrea Arcangeli 已提交
593
	if (err) {
594
		pr_err("failed to register transparent hugepage group\n");
S
Shaohua Li 已提交
595
		goto delete_obj;
A
Andrea Arcangeli 已提交
596 597
	}

S
Shaohua Li 已提交
598
	err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
A
Andrea Arcangeli 已提交
599
	if (err) {
600
		pr_err("failed to register transparent hugepage group\n");
S
Shaohua Li 已提交
601
		goto remove_hp_group;
A
Andrea Arcangeli 已提交
602
	}
S
Shaohua Li 已提交
603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642

	return 0;

remove_hp_group:
	sysfs_remove_group(*hugepage_kobj, &hugepage_attr_group);
delete_obj:
	kobject_put(*hugepage_kobj);
	return err;
}

static void __init hugepage_exit_sysfs(struct kobject *hugepage_kobj)
{
	sysfs_remove_group(hugepage_kobj, &khugepaged_attr_group);
	sysfs_remove_group(hugepage_kobj, &hugepage_attr_group);
	kobject_put(hugepage_kobj);
}
#else
static inline int hugepage_init_sysfs(struct kobject **hugepage_kobj)
{
	return 0;
}

static inline void hugepage_exit_sysfs(struct kobject *hugepage_kobj)
{
}
#endif /* CONFIG_SYSFS */

static int __init hugepage_init(void)
{
	int err;
	struct kobject *hugepage_kobj;

	if (!has_transparent_hugepage()) {
		transparent_hugepage_flags = 0;
		return -EINVAL;
	}

	err = hugepage_init_sysfs(&hugepage_kobj);
	if (err)
		return err;
A
Andrea Arcangeli 已提交
643 644 645 646 647

	err = khugepaged_slab_init();
	if (err)
		goto out;

648 649
	register_shrinker(&huge_zero_page_shrinker);

650 651 652 653 654 655 656 657
	/*
	 * By default disable transparent hugepages on smaller systems,
	 * where the extra memory used could hurt more than TLB overhead
	 * is likely to save.  The admin can still enable it through /sys.
	 */
	if (totalram_pages < (512 << (20 - PAGE_SHIFT)))
		transparent_hugepage_flags = 0;

A
Andrea Arcangeli 已提交
658 659
	start_khugepaged();

S
Shaohua Li 已提交
660
	return 0;
A
Andrea Arcangeli 已提交
661
out:
S
Shaohua Li 已提交
662
	hugepage_exit_sysfs(hugepage_kobj);
A
Andrea Arcangeli 已提交
663
	return err;
664
}
665
subsys_initcall(hugepage_init);
666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692

static int __init setup_transparent_hugepage(char *str)
{
	int ret = 0;
	if (!str)
		goto out;
	if (!strcmp(str, "always")) {
		set_bit(TRANSPARENT_HUGEPAGE_FLAG,
			&transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			  &transparent_hugepage_flags);
		ret = 1;
	} else if (!strcmp(str, "madvise")) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
			  &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			&transparent_hugepage_flags);
		ret = 1;
	} else if (!strcmp(str, "never")) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
			  &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			  &transparent_hugepage_flags);
		ret = 1;
	}
out:
	if (!ret)
693
		pr_warn("transparent_hugepage= cannot parse, ignored\n");
694 695 696 697
	return ret;
}
__setup("transparent_hugepage=", setup_transparent_hugepage);

698
pmd_t maybe_pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma)
699 700 701 702 703 704
{
	if (likely(vma->vm_flags & VM_WRITE))
		pmd = pmd_mkwrite(pmd);
	return pmd;
}

705
static inline pmd_t mk_huge_pmd(struct page *page, pgprot_t prot)
B
Bob Liu 已提交
706 707
{
	pmd_t entry;
708
	entry = mk_pmd(page, prot);
B
Bob Liu 已提交
709 710 711 712
	entry = pmd_mkhuge(entry);
	return entry;
}

713 714 715 716 717
static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
					struct vm_area_struct *vma,
					unsigned long haddr, pmd_t *pmd,
					struct page *page)
{
718
	struct mem_cgroup *memcg;
719
	pgtable_t pgtable;
720
	spinlock_t *ptl;
721

722
	VM_BUG_ON_PAGE(!PageCompound(page), page);
723 724 725 726

	if (mem_cgroup_try_charge(page, mm, GFP_TRANSHUGE, &memcg))
		return VM_FAULT_OOM;

727
	pgtable = pte_alloc_one(mm, haddr);
728 729
	if (unlikely(!pgtable)) {
		mem_cgroup_cancel_charge(page, memcg);
730
		return VM_FAULT_OOM;
731
	}
732 733

	clear_huge_page(page, haddr, HPAGE_PMD_NR);
734 735 736 737 738
	/*
	 * The memory barrier inside __SetPageUptodate makes sure that
	 * clear_huge_page writes become visible before the set_pmd_at()
	 * write.
	 */
739 740
	__SetPageUptodate(page);

741
	ptl = pmd_lock(mm, pmd);
742
	if (unlikely(!pmd_none(*pmd))) {
743
		spin_unlock(ptl);
744
		mem_cgroup_cancel_charge(page, memcg);
745 746 747 748
		put_page(page);
		pte_free(mm, pgtable);
	} else {
		pmd_t entry;
749 750
		entry = mk_huge_pmd(page, vma->vm_page_prot);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
751
		page_add_new_anon_rmap(page, vma, haddr);
752 753
		mem_cgroup_commit_charge(page, memcg, false);
		lru_cache_add_active_or_unevictable(page, vma);
754
		pgtable_trans_huge_deposit(mm, pmd, pgtable);
755 756
		set_pmd_at(mm, haddr, pmd, entry);
		add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
757
		atomic_long_inc(&mm->nr_ptes);
758
		spin_unlock(ptl);
759 760
	}

761
	return 0;
762 763
}

764
static inline gfp_t alloc_hugepage_gfpmask(int defrag, gfp_t extra_gfp)
765
{
766
	return (GFP_TRANSHUGE & ~(defrag ? 0 : __GFP_WAIT)) | extra_gfp;
767 768 769 770
}

static inline struct page *alloc_hugepage_vma(int defrag,
					      struct vm_area_struct *vma,
771 772
					      unsigned long haddr, int nd,
					      gfp_t extra_gfp)
773
{
774
	return alloc_pages_vma(alloc_hugepage_gfpmask(defrag, extra_gfp),
775
			       HPAGE_PMD_ORDER, vma, haddr, nd);
776 777
}

778
/* Caller must hold page table lock. */
779
static bool set_huge_zero_page(pgtable_t pgtable, struct mm_struct *mm,
780
		struct vm_area_struct *vma, unsigned long haddr, pmd_t *pmd,
781
		struct page *zero_page)
782 783
{
	pmd_t entry;
784 785
	if (!pmd_none(*pmd))
		return false;
786
	entry = mk_pmd(zero_page, vma->vm_page_prot);
787 788
	entry = pmd_wrprotect(entry);
	entry = pmd_mkhuge(entry);
789
	pgtable_trans_huge_deposit(mm, pmd, pgtable);
790
	set_pmd_at(mm, haddr, pmd, entry);
791
	atomic_long_inc(&mm->nr_ptes);
792
	return true;
793 794
}

795 796 797 798 799 800 801
int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
			       unsigned long address, pmd_t *pmd,
			       unsigned int flags)
{
	struct page *page;
	unsigned long haddr = address & HPAGE_PMD_MASK;

802
	if (haddr < vma->vm_start || haddr + HPAGE_PMD_SIZE > vma->vm_end)
803
		return VM_FAULT_FALLBACK;
804 805 806 807 808 809
	if (unlikely(anon_vma_prepare(vma)))
		return VM_FAULT_OOM;
	if (unlikely(khugepaged_enter(vma)))
		return VM_FAULT_OOM;
	if (!(flags & FAULT_FLAG_WRITE) &&
			transparent_hugepage_use_zero_page()) {
810
		spinlock_t *ptl;
811 812 813 814 815
		pgtable_t pgtable;
		struct page *zero_page;
		bool set;
		pgtable = pte_alloc_one(mm, haddr);
		if (unlikely(!pgtable))
A
Andrea Arcangeli 已提交
816
			return VM_FAULT_OOM;
817 818 819
		zero_page = get_huge_zero_page();
		if (unlikely(!zero_page)) {
			pte_free(mm, pgtable);
820
			count_vm_event(THP_FAULT_FALLBACK);
821
			return VM_FAULT_FALLBACK;
A
Andrea Arcangeli 已提交
822
		}
823
		ptl = pmd_lock(mm, pmd);
824 825
		set = set_huge_zero_page(pgtable, mm, vma, haddr, pmd,
				zero_page);
826
		spin_unlock(ptl);
827 828 829
		if (!set) {
			pte_free(mm, pgtable);
			put_huge_zero_page();
830 831
		}
		return 0;
832
	}
833 834 835 836
	page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
			vma, haddr, numa_node_id(), 0);
	if (unlikely(!page)) {
		count_vm_event(THP_FAULT_FALLBACK);
837
		return VM_FAULT_FALLBACK;
838 839 840
	}
	if (unlikely(__do_huge_pmd_anonymous_page(mm, vma, haddr, pmd, page))) {
		put_page(page);
841
		count_vm_event(THP_FAULT_FALLBACK);
842
		return VM_FAULT_FALLBACK;
843 844
	}

845
	count_vm_event(THP_FAULT_ALLOC);
846
	return 0;
847 848 849 850 851 852
}

int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
		  pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long addr,
		  struct vm_area_struct *vma)
{
853
	spinlock_t *dst_ptl, *src_ptl;
854 855 856 857 858 859 860 861 862 863
	struct page *src_page;
	pmd_t pmd;
	pgtable_t pgtable;
	int ret;

	ret = -ENOMEM;
	pgtable = pte_alloc_one(dst_mm, addr);
	if (unlikely(!pgtable))
		goto out;

864 865 866
	dst_ptl = pmd_lock(dst_mm, dst_pmd);
	src_ptl = pmd_lockptr(src_mm, src_pmd);
	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
867 868 869 870 871 872 873

	ret = -EAGAIN;
	pmd = *src_pmd;
	if (unlikely(!pmd_trans_huge(pmd))) {
		pte_free(dst_mm, pgtable);
		goto out_unlock;
	}
874
	/*
875
	 * When page table lock is held, the huge zero pmd should not be
876 877 878 879
	 * under splitting since we don't split the page itself, only pmd to
	 * a page table.
	 */
	if (is_huge_zero_pmd(pmd)) {
880
		struct page *zero_page;
881
		bool set;
882 883 884 885 886
		/*
		 * get_huge_zero_page() will never allocate a new page here,
		 * since we already have a zero page to copy. It just takes a
		 * reference.
		 */
887
		zero_page = get_huge_zero_page();
888
		set = set_huge_zero_page(pgtable, dst_mm, vma, addr, dst_pmd,
889
				zero_page);
890
		BUG_ON(!set); /* unexpected !pmd_none(dst_pmd) */
891 892 893
		ret = 0;
		goto out_unlock;
	}
894

895 896
	if (unlikely(pmd_trans_splitting(pmd))) {
		/* split huge page running from under us */
897 898
		spin_unlock(src_ptl);
		spin_unlock(dst_ptl);
899 900 901 902 903 904
		pte_free(dst_mm, pgtable);

		wait_split_huge_page(vma->anon_vma, src_pmd); /* src_vma */
		goto out;
	}
	src_page = pmd_page(pmd);
905
	VM_BUG_ON_PAGE(!PageHead(src_page), src_page);
906 907 908 909 910 911
	get_page(src_page);
	page_dup_rmap(src_page);
	add_mm_counter(dst_mm, MM_ANONPAGES, HPAGE_PMD_NR);

	pmdp_set_wrprotect(src_mm, addr, src_pmd);
	pmd = pmd_mkold(pmd_wrprotect(pmd));
912
	pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable);
913
	set_pmd_at(dst_mm, addr, dst_pmd, pmd);
914
	atomic_long_inc(&dst_mm->nr_ptes);
915 916 917

	ret = 0;
out_unlock:
918 919
	spin_unlock(src_ptl);
	spin_unlock(dst_ptl);
920 921 922 923
out:
	return ret;
}

924 925 926 927 928 929
void huge_pmd_set_accessed(struct mm_struct *mm,
			   struct vm_area_struct *vma,
			   unsigned long address,
			   pmd_t *pmd, pmd_t orig_pmd,
			   int dirty)
{
930
	spinlock_t *ptl;
931 932 933
	pmd_t entry;
	unsigned long haddr;

934
	ptl = pmd_lock(mm, pmd);
935 936 937 938 939 940 941 942 943
	if (unlikely(!pmd_same(*pmd, orig_pmd)))
		goto unlock;

	entry = pmd_mkyoung(orig_pmd);
	haddr = address & HPAGE_PMD_MASK;
	if (pmdp_set_access_flags(vma, haddr, pmd, entry, dirty))
		update_mmu_cache_pmd(vma, address, pmd);

unlock:
944
	spin_unlock(ptl);
945 946
}

947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977
/*
 * Save CONFIG_DEBUG_PAGEALLOC from faulting falsely on tail pages
 * during copy_user_huge_page()'s copy_page_rep(): in the case when
 * the source page gets split and a tail freed before copy completes.
 * Called under pmd_lock of checked pmd, so safe from splitting itself.
 */
static void get_user_huge_page(struct page *page)
{
	if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
		struct page *endpage = page + HPAGE_PMD_NR;

		atomic_add(HPAGE_PMD_NR, &page->_count);
		while (++page < endpage)
			get_huge_page_tail(page);
	} else {
		get_page(page);
	}
}

static void put_user_huge_page(struct page *page)
{
	if (IS_ENABLED(CONFIG_DEBUG_PAGEALLOC)) {
		struct page *endpage = page + HPAGE_PMD_NR;

		while (page < endpage)
			put_page(page++);
	} else {
		put_page(page);
	}
}

978 979 980 981 982 983 984
static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
					struct vm_area_struct *vma,
					unsigned long address,
					pmd_t *pmd, pmd_t orig_pmd,
					struct page *page,
					unsigned long haddr)
{
985
	struct mem_cgroup *memcg;
986
	spinlock_t *ptl;
987 988 989 990
	pgtable_t pgtable;
	pmd_t _pmd;
	int ret = 0, i;
	struct page **pages;
991 992
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
993 994 995 996 997 998 999 1000 1001

	pages = kmalloc(sizeof(struct page *) * HPAGE_PMD_NR,
			GFP_KERNEL);
	if (unlikely(!pages)) {
		ret |= VM_FAULT_OOM;
		goto out;
	}

	for (i = 0; i < HPAGE_PMD_NR; i++) {
1002 1003
		pages[i] = alloc_page_vma_node(GFP_HIGHUSER_MOVABLE |
					       __GFP_OTHER_NODE,
1004
					       vma, address, page_to_nid(page));
A
Andrea Arcangeli 已提交
1005
		if (unlikely(!pages[i] ||
1006 1007
			     mem_cgroup_try_charge(pages[i], mm, GFP_KERNEL,
						   &memcg))) {
A
Andrea Arcangeli 已提交
1008
			if (pages[i])
1009
				put_page(pages[i]);
A
Andrea Arcangeli 已提交
1010
			while (--i >= 0) {
1011 1012 1013
				memcg = (void *)page_private(pages[i]);
				set_page_private(pages[i], 0);
				mem_cgroup_cancel_charge(pages[i], memcg);
A
Andrea Arcangeli 已提交
1014 1015
				put_page(pages[i]);
			}
1016 1017 1018 1019
			kfree(pages);
			ret |= VM_FAULT_OOM;
			goto out;
		}
1020
		set_page_private(pages[i], (unsigned long)memcg);
1021 1022 1023 1024
	}

	for (i = 0; i < HPAGE_PMD_NR; i++) {
		copy_user_highpage(pages[i], page + i,
1025
				   haddr + PAGE_SIZE * i, vma);
1026 1027 1028 1029
		__SetPageUptodate(pages[i]);
		cond_resched();
	}

1030 1031 1032 1033
	mmun_start = haddr;
	mmun_end   = haddr + HPAGE_PMD_SIZE;
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);

1034
	ptl = pmd_lock(mm, pmd);
1035 1036
	if (unlikely(!pmd_same(*pmd, orig_pmd)))
		goto out_free_pages;
1037
	VM_BUG_ON_PAGE(!PageHead(page), page);
1038

1039
	pmdp_clear_flush(vma, haddr, pmd);
1040 1041
	/* leave pmd empty until pte is filled */

1042
	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
1043 1044 1045 1046 1047 1048
	pmd_populate(mm, &_pmd, pgtable);

	for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
		pte_t *pte, entry;
		entry = mk_pte(pages[i], vma->vm_page_prot);
		entry = maybe_mkwrite(pte_mkdirty(entry), vma);
1049 1050
		memcg = (void *)page_private(pages[i]);
		set_page_private(pages[i], 0);
1051
		page_add_new_anon_rmap(pages[i], vma, haddr);
1052 1053
		mem_cgroup_commit_charge(pages[i], memcg, false);
		lru_cache_add_active_or_unevictable(pages[i], vma);
1054 1055 1056 1057 1058 1059 1060 1061 1062 1063
		pte = pte_offset_map(&_pmd, haddr);
		VM_BUG_ON(!pte_none(*pte));
		set_pte_at(mm, haddr, pte, entry);
		pte_unmap(pte);
	}
	kfree(pages);

	smp_wmb(); /* make pte visible before pmd */
	pmd_populate(mm, pmd, pgtable);
	page_remove_rmap(page);
1064
	spin_unlock(ptl);
1065

1066 1067
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);

1068 1069 1070 1071 1072 1073 1074
	ret |= VM_FAULT_WRITE;
	put_page(page);

out:
	return ret;

out_free_pages:
1075
	spin_unlock(ptl);
1076
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
A
Andrea Arcangeli 已提交
1077
	for (i = 0; i < HPAGE_PMD_NR; i++) {
1078 1079 1080
		memcg = (void *)page_private(pages[i]);
		set_page_private(pages[i], 0);
		mem_cgroup_cancel_charge(pages[i], memcg);
1081
		put_page(pages[i]);
A
Andrea Arcangeli 已提交
1082
	}
1083 1084 1085 1086 1087 1088 1089
	kfree(pages);
	goto out;
}

int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
			unsigned long address, pmd_t *pmd, pmd_t orig_pmd)
{
1090
	spinlock_t *ptl;
1091
	int ret = 0;
1092
	struct page *page = NULL, *new_page;
1093
	struct mem_cgroup *memcg;
1094
	unsigned long haddr;
1095 1096
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
1097

1098
	ptl = pmd_lockptr(mm, pmd);
1099
	VM_BUG_ON(!vma->anon_vma);
1100 1101 1102
	haddr = address & HPAGE_PMD_MASK;
	if (is_huge_zero_pmd(orig_pmd))
		goto alloc;
1103
	spin_lock(ptl);
1104 1105 1106 1107
	if (unlikely(!pmd_same(*pmd, orig_pmd)))
		goto out_unlock;

	page = pmd_page(orig_pmd);
1108
	VM_BUG_ON_PAGE(!PageCompound(page) || !PageHead(page), page);
1109 1110 1111 1112 1113
	if (page_mapcount(page) == 1) {
		pmd_t entry;
		entry = pmd_mkyoung(orig_pmd);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
		if (pmdp_set_access_flags(vma, haddr, pmd, entry,  1))
1114
			update_mmu_cache_pmd(vma, address, pmd);
1115 1116 1117
		ret |= VM_FAULT_WRITE;
		goto out_unlock;
	}
1118
	get_user_huge_page(page);
1119
	spin_unlock(ptl);
1120
alloc:
1121 1122
	if (transparent_hugepage_enabled(vma) &&
	    !transparent_hugepage_debug_cow())
1123
		new_page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
1124
					      vma, haddr, numa_node_id(), 0);
1125 1126 1127 1128
	else
		new_page = NULL;

	if (unlikely(!new_page)) {
1129
		if (!page) {
1130 1131
			split_huge_page_pmd(vma, address, pmd);
			ret |= VM_FAULT_FALLBACK;
1132 1133 1134
		} else {
			ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
					pmd, orig_pmd, page, haddr);
1135
			if (ret & VM_FAULT_OOM) {
1136
				split_huge_page(page);
1137 1138
				ret |= VM_FAULT_FALLBACK;
			}
1139
			put_user_huge_page(page);
1140
		}
1141
		count_vm_event(THP_FAULT_FALLBACK);
1142 1143 1144
		goto out;
	}

1145 1146
	if (unlikely(mem_cgroup_try_charge(new_page, mm,
					   GFP_TRANSHUGE, &memcg))) {
A
Andrea Arcangeli 已提交
1147
		put_page(new_page);
1148 1149
		if (page) {
			split_huge_page(page);
1150
			put_user_huge_page(page);
1151 1152 1153
		} else
			split_huge_page_pmd(vma, address, pmd);
		ret |= VM_FAULT_FALLBACK;
1154
		count_vm_event(THP_FAULT_FALLBACK);
A
Andrea Arcangeli 已提交
1155 1156 1157
		goto out;
	}

1158 1159
	count_vm_event(THP_FAULT_ALLOC);

1160
	if (!page)
1161 1162 1163
		clear_huge_page(new_page, haddr, HPAGE_PMD_NR);
	else
		copy_user_huge_page(new_page, page, haddr, vma, HPAGE_PMD_NR);
1164 1165
	__SetPageUptodate(new_page);

1166 1167 1168 1169
	mmun_start = haddr;
	mmun_end   = haddr + HPAGE_PMD_SIZE;
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);

1170
	spin_lock(ptl);
1171
	if (page)
1172
		put_user_huge_page(page);
A
Andrea Arcangeli 已提交
1173
	if (unlikely(!pmd_same(*pmd, orig_pmd))) {
1174
		spin_unlock(ptl);
1175
		mem_cgroup_cancel_charge(new_page, memcg);
1176
		put_page(new_page);
1177
		goto out_mn;
A
Andrea Arcangeli 已提交
1178
	} else {
1179
		pmd_t entry;
1180 1181
		entry = mk_huge_pmd(new_page, vma->vm_page_prot);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
1182
		pmdp_clear_flush(vma, haddr, pmd);
1183
		page_add_new_anon_rmap(new_page, vma, haddr);
1184 1185
		mem_cgroup_commit_charge(new_page, memcg, false);
		lru_cache_add_active_or_unevictable(new_page, vma);
1186
		set_pmd_at(mm, haddr, pmd, entry);
1187
		update_mmu_cache_pmd(vma, address, pmd);
1188
		if (!page) {
1189
			add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
1190 1191
			put_huge_zero_page();
		} else {
1192
			VM_BUG_ON_PAGE(!PageHead(page), page);
1193 1194 1195
			page_remove_rmap(page);
			put_page(page);
		}
1196 1197
		ret |= VM_FAULT_WRITE;
	}
1198
	spin_unlock(ptl);
1199 1200
out_mn:
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1201 1202
out:
	return ret;
1203
out_unlock:
1204
	spin_unlock(ptl);
1205
	return ret;
1206 1207
}

1208
struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
1209 1210 1211 1212
				   unsigned long addr,
				   pmd_t *pmd,
				   unsigned int flags)
{
1213
	struct mm_struct *mm = vma->vm_mm;
1214 1215
	struct page *page = NULL;

1216
	assert_spin_locked(pmd_lockptr(mm, pmd));
1217 1218 1219 1220

	if (flags & FOLL_WRITE && !pmd_write(*pmd))
		goto out;

1221 1222 1223 1224
	/* Avoid dumping huge zero page */
	if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
		return ERR_PTR(-EFAULT);

1225 1226 1227 1228
	/* Full NUMA hinting faults to serialise migration in fault paths */
	if ((flags & FOLL_NUMA) && pmd_numa(*pmd))
		goto out;

1229
	page = pmd_page(*pmd);
1230
	VM_BUG_ON_PAGE(!PageHead(page), page);
1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241
	if (flags & FOLL_TOUCH) {
		pmd_t _pmd;
		/*
		 * We should set the dirty bit only for FOLL_WRITE but
		 * for now the dirty bit in the pmd is meaningless.
		 * And if the dirty bit will become meaningful and
		 * we'll only set it with FOLL_WRITE, an atomic
		 * set_bit will be required on the pmd to set the
		 * young bit, instead of the current set_pmd_at.
		 */
		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
1242 1243 1244
		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
					  pmd, _pmd,  1))
			update_mmu_cache_pmd(vma, addr, pmd);
1245
	}
1246 1247 1248 1249 1250 1251 1252 1253
	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
		if (page->mapping && trylock_page(page)) {
			lru_add_drain();
			if (page->mapping)
				mlock_vma_page(page);
			unlock_page(page);
		}
	}
1254
	page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
1255
	VM_BUG_ON_PAGE(!PageCompound(page), page);
1256
	if (flags & FOLL_GET)
1257
		get_page_foll(page);
1258 1259 1260 1261 1262

out:
	return page;
}

1263
/* NUMA hinting page fault entry point for trans huge pmds */
1264 1265
int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
				unsigned long addr, pmd_t pmd, pmd_t *pmdp)
1266
{
1267
	spinlock_t *ptl;
1268
	struct anon_vma *anon_vma = NULL;
1269
	struct page *page;
1270
	unsigned long haddr = addr & HPAGE_PMD_MASK;
1271
	int page_nid = -1, this_nid = numa_node_id();
1272
	int target_nid, last_cpupid = -1;
1273 1274
	bool page_locked;
	bool migrated = false;
1275
	int flags = 0;
1276

1277
	ptl = pmd_lock(mm, pmdp);
1278 1279 1280
	if (unlikely(!pmd_same(pmd, *pmdp)))
		goto out_unlock;

1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291
	/*
	 * If there are potential migrations, wait for completion and retry
	 * without disrupting NUMA hinting information. Do not relock and
	 * check_same as the page may no longer be mapped.
	 */
	if (unlikely(pmd_trans_migrating(*pmdp))) {
		spin_unlock(ptl);
		wait_migrate_huge_page(vma->anon_vma, pmdp);
		goto out;
	}

1292
	page = pmd_page(pmd);
1293
	BUG_ON(is_huge_zero_page(page));
1294
	page_nid = page_to_nid(page);
1295
	last_cpupid = page_cpupid_last(page);
1296
	count_vm_numa_event(NUMA_HINT_FAULTS);
1297
	if (page_nid == this_nid) {
1298
		count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
1299 1300
		flags |= TNF_FAULT_LOCAL;
	}
1301

1302 1303 1304 1305 1306 1307 1308 1309
	/*
	 * Avoid grouping on DSO/COW pages in specific and RO pages
	 * in general, RO pages shouldn't hurt as much anyway since
	 * they can be in shared cache state.
	 */
	if (!pmd_write(pmd))
		flags |= TNF_NO_GROUP;

1310 1311 1312 1313
	/*
	 * Acquire the page lock to serialise THP migrations but avoid dropping
	 * page_table_lock if at all possible
	 */
1314 1315 1316 1317
	page_locked = trylock_page(page);
	target_nid = mpol_misplaced(page, vma, haddr);
	if (target_nid == -1) {
		/* If the page was locked, there are no parallel migrations */
1318
		if (page_locked)
1319
			goto clear_pmdnuma;
1320
	}
1321

1322
	/* Migration could have started since the pmd_trans_migrating check */
1323
	if (!page_locked) {
1324
		spin_unlock(ptl);
1325
		wait_on_page_locked(page);
1326
		page_nid = -1;
1327 1328 1329
		goto out;
	}

1330 1331 1332 1333
	/*
	 * Page is misplaced. Page lock serialises migrations. Acquire anon_vma
	 * to serialises splits
	 */
1334
	get_page(page);
1335
	spin_unlock(ptl);
1336
	anon_vma = page_lock_anon_vma_read(page);
1337

P
Peter Zijlstra 已提交
1338
	/* Confirm the PMD did not change while page_table_lock was released */
1339
	spin_lock(ptl);
1340 1341 1342
	if (unlikely(!pmd_same(pmd, *pmdp))) {
		unlock_page(page);
		put_page(page);
1343
		page_nid = -1;
1344
		goto out_unlock;
1345
	}
1346

1347 1348 1349 1350 1351 1352 1353
	/* Bail if we fail to protect against THP splits for any reason */
	if (unlikely(!anon_vma)) {
		put_page(page);
		page_nid = -1;
		goto clear_pmdnuma;
	}

1354 1355 1356 1357
	/*
	 * Migrate the THP to the requested node, returns with page unlocked
	 * and pmd_numa cleared.
	 */
1358
	spin_unlock(ptl);
1359
	migrated = migrate_misplaced_transhuge_page(mm, vma,
1360
				pmdp, pmd, addr, page, target_nid);
1361 1362
	if (migrated) {
		flags |= TNF_MIGRATED;
1363
		page_nid = target_nid;
1364
	}
1365

1366
	goto out;
1367
clear_pmdnuma:
1368
	BUG_ON(!PageLocked(page));
1369 1370 1371 1372
	pmd = pmd_mknonnuma(pmd);
	set_pmd_at(mm, haddr, pmdp, pmd);
	VM_BUG_ON(pmd_numa(*pmdp));
	update_mmu_cache_pmd(vma, addr, pmdp);
1373
	unlock_page(page);
1374
out_unlock:
1375
	spin_unlock(ptl);
1376 1377 1378 1379 1380

out:
	if (anon_vma)
		page_unlock_anon_vma_read(anon_vma);

1381
	if (page_nid != -1)
1382
		task_numa_fault(last_cpupid, page_nid, HPAGE_PMD_NR, flags);
1383

1384 1385 1386
	return 0;
}

1387
int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
S
Shaohua Li 已提交
1388
		 pmd_t *pmd, unsigned long addr)
1389
{
1390
	spinlock_t *ptl;
1391 1392
	int ret = 0;

1393
	if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
1394 1395
		struct page *page;
		pgtable_t pgtable;
1396
		pmd_t orig_pmd;
1397 1398 1399 1400 1401 1402
		/*
		 * For architectures like ppc64 we look at deposited pgtable
		 * when calling pmdp_get_and_clear. So do the
		 * pgtable_trans_huge_withdraw after finishing pmdp related
		 * operations.
		 */
1403
		orig_pmd = pmdp_get_and_clear(tlb->mm, addr, pmd);
1404
		tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
1405
		pgtable = pgtable_trans_huge_withdraw(tlb->mm, pmd);
1406
		if (is_huge_zero_pmd(orig_pmd)) {
1407
			atomic_long_dec(&tlb->mm->nr_ptes);
1408
			spin_unlock(ptl);
1409
			put_huge_zero_page();
1410 1411 1412
		} else {
			page = pmd_page(orig_pmd);
			page_remove_rmap(page);
1413
			VM_BUG_ON_PAGE(page_mapcount(page) < 0, page);
1414
			add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
1415
			VM_BUG_ON_PAGE(!PageHead(page), page);
1416
			atomic_long_dec(&tlb->mm->nr_ptes);
1417
			spin_unlock(ptl);
1418 1419
			tlb_remove_page(tlb, page);
		}
1420 1421 1422
		pte_free(tlb->mm, pgtable);
		ret = 1;
	}
1423 1424 1425
	return ret;
}

1426 1427 1428 1429
int mincore_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
		unsigned long addr, unsigned long end,
		unsigned char *vec)
{
1430
	spinlock_t *ptl;
1431 1432
	int ret = 0;

1433
	if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
1434 1435 1436 1437
		/*
		 * All logical pages in the range are present
		 * if backed by a huge page.
		 */
1438
		spin_unlock(ptl);
1439 1440 1441
		memset(vec, 1, (end - addr) >> PAGE_SHIFT);
		ret = 1;
	}
1442 1443 1444 1445

	return ret;
}

1446 1447 1448 1449 1450
int move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma,
		  unsigned long old_addr,
		  unsigned long new_addr, unsigned long old_end,
		  pmd_t *old_pmd, pmd_t *new_pmd)
{
1451
	spinlock_t *old_ptl, *new_ptl;
1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471
	int ret = 0;
	pmd_t pmd;

	struct mm_struct *mm = vma->vm_mm;

	if ((old_addr & ~HPAGE_PMD_MASK) ||
	    (new_addr & ~HPAGE_PMD_MASK) ||
	    old_end - old_addr < HPAGE_PMD_SIZE ||
	    (new_vma->vm_flags & VM_NOHUGEPAGE))
		goto out;

	/*
	 * The destination pmd shouldn't be established, free_pgtables()
	 * should have release it.
	 */
	if (WARN_ON(!pmd_none(*new_pmd))) {
		VM_BUG_ON(pmd_trans_huge(*new_pmd));
		goto out;
	}

1472 1473 1474 1475 1476
	/*
	 * We don't have to worry about the ordering of src and dst
	 * ptlocks because exclusive mmap_sem prevents deadlock.
	 */
	ret = __pmd_trans_huge_lock(old_pmd, vma, &old_ptl);
1477
	if (ret == 1) {
1478 1479 1480
		new_ptl = pmd_lockptr(mm, new_pmd);
		if (new_ptl != old_ptl)
			spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
1481 1482
		pmd = pmdp_get_and_clear(mm, old_addr, old_pmd);
		VM_BUG_ON(!pmd_none(*new_pmd));
1483

1484 1485
		if (pmd_move_must_withdraw(new_ptl, old_ptl)) {
			pgtable_t pgtable;
1486 1487 1488
			pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
			pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
		}
1489 1490 1491
		set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd));
		if (new_ptl != old_ptl)
			spin_unlock(new_ptl);
1492
		spin_unlock(old_ptl);
1493 1494 1495 1496 1497
	}
out:
	return ret;
}

1498 1499 1500 1501 1502 1503
/*
 * Returns
 *  - 0 if PMD could not be locked
 *  - 1 if PMD was locked but protections unchange and TLB flush unnecessary
 *  - HPAGE_PMD_NR is protections changed and TLB flush necessary
 */
1504
int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
1505
		unsigned long addr, pgprot_t newprot, int prot_numa)
1506 1507
{
	struct mm_struct *mm = vma->vm_mm;
1508
	spinlock_t *ptl;
1509 1510
	int ret = 0;

1511
	if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
1512
		pmd_t entry;
1513
		ret = 1;
1514
		if (!prot_numa) {
1515
			entry = pmdp_get_and_clear(mm, addr, pmd);
1516 1517
			if (pmd_numa(entry))
				entry = pmd_mknonnuma(entry);
1518
			entry = pmd_modify(entry, newprot);
1519
			ret = HPAGE_PMD_NR;
1520
			set_pmd_at(mm, addr, pmd, entry);
1521 1522
			BUG_ON(pmd_write(entry));
		} else {
1523 1524
			struct page *page = pmd_page(*pmd);

1525
			/*
1526 1527 1528 1529
			 * Do not trap faults against the zero page. The
			 * read-only data is likely to be read-cached on the
			 * local CPU cache and it is less useful to know about
			 * local vs remote hits on the zero page.
1530
			 */
1531
			if (!is_huge_zero_page(page) &&
1532
			    !pmd_numa(*pmd)) {
1533
				pmdp_set_numa(mm, addr, pmd);
1534
				ret = HPAGE_PMD_NR;
1535 1536
			}
		}
1537
		spin_unlock(ptl);
1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549
	}

	return ret;
}

/*
 * Returns 1 if a given pmd maps a stable (not under splitting) thp.
 * Returns -1 if it maps a thp under splitting. Returns 0 otherwise.
 *
 * Note that if it returns 1, this routine returns without unlocking page
 * table locks. So callers must unlock them.
 */
1550 1551
int __pmd_trans_huge_lock(pmd_t *pmd, struct vm_area_struct *vma,
		spinlock_t **ptl)
1552
{
1553
	*ptl = pmd_lock(vma->vm_mm, pmd);
1554 1555
	if (likely(pmd_trans_huge(*pmd))) {
		if (unlikely(pmd_trans_splitting(*pmd))) {
1556
			spin_unlock(*ptl);
1557
			wait_split_huge_page(vma->anon_vma, pmd);
1558
			return -1;
1559
		} else {
1560 1561 1562
			/* Thp mapped by 'pmd' is stable, so we can
			 * handle it as it is. */
			return 1;
1563
		}
1564
	}
1565
	spin_unlock(*ptl);
1566
	return 0;
1567 1568
}

1569 1570 1571 1572 1573 1574 1575 1576
/*
 * This function returns whether a given @page is mapped onto the @address
 * in the virtual space of @mm.
 *
 * When it's true, this function returns *pmd with holding the page table lock
 * and passing it back to the caller via @ptl.
 * If it's false, returns NULL without holding the page table lock.
 */
1577 1578 1579
pmd_t *page_check_address_pmd(struct page *page,
			      struct mm_struct *mm,
			      unsigned long address,
1580 1581
			      enum page_check_address_pmd_flag flag,
			      spinlock_t **ptl)
1582
{
1583 1584
	pgd_t *pgd;
	pud_t *pud;
1585
	pmd_t *pmd;
1586 1587

	if (address & ~HPAGE_PMD_MASK)
1588
		return NULL;
1589

1590 1591
	pgd = pgd_offset(mm, address);
	if (!pgd_present(*pgd))
1592
		return NULL;
1593 1594 1595 1596 1597
	pud = pud_offset(pgd, address);
	if (!pud_present(*pud))
		return NULL;
	pmd = pmd_offset(pud, address);

1598
	*ptl = pmd_lock(mm, pmd);
1599
	if (!pmd_present(*pmd))
1600
		goto unlock;
1601
	if (pmd_page(*pmd) != page)
1602
		goto unlock;
1603 1604 1605 1606 1607 1608 1609 1610 1611
	/*
	 * split_vma() may create temporary aliased mappings. There is
	 * no risk as long as all huge pmd are found and have their
	 * splitting bit set before __split_huge_page_refcount
	 * runs. Finding the same huge pmd more than once during the
	 * same rmap walk is not a problem.
	 */
	if (flag == PAGE_CHECK_ADDRESS_PMD_NOTSPLITTING_FLAG &&
	    pmd_trans_splitting(*pmd))
1612
		goto unlock;
1613 1614 1615
	if (pmd_trans_huge(*pmd)) {
		VM_BUG_ON(flag == PAGE_CHECK_ADDRESS_PMD_SPLITTING_FLAG &&
			  !pmd_trans_splitting(*pmd));
1616
		return pmd;
1617
	}
1618 1619 1620
unlock:
	spin_unlock(*ptl);
	return NULL;
1621 1622 1623 1624 1625 1626 1627
}

static int __split_huge_page_splitting(struct page *page,
				       struct vm_area_struct *vma,
				       unsigned long address)
{
	struct mm_struct *mm = vma->vm_mm;
1628
	spinlock_t *ptl;
1629 1630
	pmd_t *pmd;
	int ret = 0;
1631 1632 1633
	/* For mmu_notifiers */
	const unsigned long mmun_start = address;
	const unsigned long mmun_end   = address + HPAGE_PMD_SIZE;
1634

1635
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
1636
	pmd = page_check_address_pmd(page, mm, address,
1637
			PAGE_CHECK_ADDRESS_PMD_NOTSPLITTING_FLAG, &ptl);
1638 1639 1640 1641 1642
	if (pmd) {
		/*
		 * We can't temporarily set the pmd to null in order
		 * to split it, the pmd must remain marked huge at all
		 * times or the VM won't take the pmd_trans_huge paths
1643
		 * and it won't wait on the anon_vma->root->rwsem to
1644 1645
		 * serialize against split_huge_page*.
		 */
1646
		pmdp_splitting_flush(vma, address, pmd);
1647
		ret = 1;
1648
		spin_unlock(ptl);
1649
	}
1650
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1651 1652 1653 1654

	return ret;
}

1655 1656
static void __split_huge_page_refcount(struct page *page,
				       struct list_head *list)
1657 1658 1659
{
	int i;
	struct zone *zone = page_zone(page);
1660
	struct lruvec *lruvec;
1661
	int tail_count = 0;
1662 1663 1664

	/* prevent PageLRU to go away from under us, and freeze lru stats */
	spin_lock_irq(&zone->lru_lock);
1665 1666
	lruvec = mem_cgroup_page_lruvec(page, zone);

1667
	compound_lock(page);
1668 1669
	/* complete memcg works before add pages to LRU */
	mem_cgroup_split_huge_fixup(page);
1670

1671
	for (i = HPAGE_PMD_NR - 1; i >= 1; i--) {
1672 1673
		struct page *page_tail = page + i;

1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694
		/* tail_page->_mapcount cannot change */
		BUG_ON(page_mapcount(page_tail) < 0);
		tail_count += page_mapcount(page_tail);
		/* check for overflow */
		BUG_ON(tail_count < 0);
		BUG_ON(atomic_read(&page_tail->_count) != 0);
		/*
		 * tail_page->_count is zero and not changing from
		 * under us. But get_page_unless_zero() may be running
		 * from under us on the tail_page. If we used
		 * atomic_set() below instead of atomic_add(), we
		 * would then run atomic_set() concurrently with
		 * get_page_unless_zero(), and atomic_set() is
		 * implemented in C not using locked ops. spin_unlock
		 * on x86 sometime uses locked ops because of PPro
		 * errata 66, 92, so unless somebody can guarantee
		 * atomic_set() here would be safe on all archs (and
		 * not only on x86), it's safer to use atomic_add().
		 */
		atomic_add(page_mapcount(page) + page_mapcount(page_tail) + 1,
			   &page_tail->_count);
1695 1696

		/* after clearing PageTail the gup refcount can be released */
1697
		smp_mb__after_atomic();
1698

1699 1700 1701 1702 1703 1704
		/*
		 * retain hwpoison flag of the poisoned tail page:
		 *   fix for the unsuitable process killed on Guest Machine(KVM)
		 *   by the memory-failure.
		 */
		page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP | __PG_HWPOISON;
1705 1706 1707 1708
		page_tail->flags |= (page->flags &
				     ((1L << PG_referenced) |
				      (1L << PG_swapbacked) |
				      (1L << PG_mlocked) |
1709 1710 1711
				      (1L << PG_uptodate) |
				      (1L << PG_active) |
				      (1L << PG_unevictable)));
1712 1713
		page_tail->flags |= (1L << PG_dirty);

1714
		/* clear PageTail before overwriting first_page */
1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735
		smp_wmb();

		/*
		 * __split_huge_page_splitting() already set the
		 * splitting bit in all pmd that could map this
		 * hugepage, that will ensure no CPU can alter the
		 * mapcount on the head page. The mapcount is only
		 * accounted in the head page and it has to be
		 * transferred to all tail pages in the below code. So
		 * for this code to be safe, the split the mapcount
		 * can't change. But that doesn't mean userland can't
		 * keep changing and reading the page contents while
		 * we transfer the mapcount, so the pmd splitting
		 * status is achieved setting a reserved bit in the
		 * pmd, not by clearing the present bit.
		*/
		page_tail->_mapcount = page->_mapcount;

		BUG_ON(page_tail->mapping);
		page_tail->mapping = page->mapping;

1736
		page_tail->index = page->index + i;
1737
		page_cpupid_xchg_last(page_tail, page_cpupid_last(page));
1738 1739 1740 1741 1742 1743

		BUG_ON(!PageAnon(page_tail));
		BUG_ON(!PageUptodate(page_tail));
		BUG_ON(!PageDirty(page_tail));
		BUG_ON(!PageSwapBacked(page_tail));

1744
		lru_add_page_tail(page, page_tail, lruvec, list);
1745
	}
1746 1747
	atomic_sub(tail_count, &page->_count);
	BUG_ON(atomic_read(&page->_count) <= 0);
1748

1749
	__mod_zone_page_state(zone, NR_ANON_TRANSPARENT_HUGEPAGES, -1);
1750

1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779
	ClearPageCompound(page);
	compound_unlock(page);
	spin_unlock_irq(&zone->lru_lock);

	for (i = 1; i < HPAGE_PMD_NR; i++) {
		struct page *page_tail = page + i;
		BUG_ON(page_count(page_tail) <= 0);
		/*
		 * Tail pages may be freed if there wasn't any mapping
		 * like if add_to_swap() is running on a lru page that
		 * had its mapping zapped. And freeing these pages
		 * requires taking the lru_lock so we do the put_page
		 * of the tail pages after the split is complete.
		 */
		put_page(page_tail);
	}

	/*
	 * Only the head page (now become a regular page) is required
	 * to be pinned by the caller.
	 */
	BUG_ON(page_count(page) <= 0);
}

static int __split_huge_page_map(struct page *page,
				 struct vm_area_struct *vma,
				 unsigned long address)
{
	struct mm_struct *mm = vma->vm_mm;
1780
	spinlock_t *ptl;
1781 1782 1783 1784 1785 1786
	pmd_t *pmd, _pmd;
	int ret = 0, i;
	pgtable_t pgtable;
	unsigned long haddr;

	pmd = page_check_address_pmd(page, mm, address,
1787
			PAGE_CHECK_ADDRESS_PMD_SPLITTING_FLAG, &ptl);
1788
	if (pmd) {
1789
		pgtable = pgtable_trans_huge_withdraw(mm, pmd);
1790
		pmd_populate(mm, &_pmd, pgtable);
1791 1792
		if (pmd_write(*pmd))
			BUG_ON(page_mapcount(page) != 1);
1793

1794 1795
		haddr = address;
		for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
1796 1797
			pte_t *pte, entry;
			BUG_ON(PageCompound(page+i));
1798 1799 1800 1801 1802
			/*
			 * Note that pmd_numa is not transferred deliberately
			 * to avoid any possibility that pte_numa leaks to
			 * a PROT_NONE VMA by accident.
			 */
1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841
			entry = mk_pte(page + i, vma->vm_page_prot);
			entry = maybe_mkwrite(pte_mkdirty(entry), vma);
			if (!pmd_write(*pmd))
				entry = pte_wrprotect(entry);
			if (!pmd_young(*pmd))
				entry = pte_mkold(entry);
			pte = pte_offset_map(&_pmd, haddr);
			BUG_ON(!pte_none(*pte));
			set_pte_at(mm, haddr, pte, entry);
			pte_unmap(pte);
		}

		smp_wmb(); /* make pte visible before pmd */
		/*
		 * Up to this point the pmd is present and huge and
		 * userland has the whole access to the hugepage
		 * during the split (which happens in place). If we
		 * overwrite the pmd with the not-huge version
		 * pointing to the pte here (which of course we could
		 * if all CPUs were bug free), userland could trigger
		 * a small page size TLB miss on the small sized TLB
		 * while the hugepage TLB entry is still established
		 * in the huge TLB. Some CPU doesn't like that. See
		 * http://support.amd.com/us/Processor_TechDocs/41322.pdf,
		 * Erratum 383 on page 93. Intel should be safe but is
		 * also warns that it's only safe if the permission
		 * and cache attributes of the two entries loaded in
		 * the two TLB is identical (which should be the case
		 * here). But it is generally safer to never allow
		 * small and huge TLB entries for the same virtual
		 * address to be loaded simultaneously. So instead of
		 * doing "pmd_populate(); flush_tlb_range();" we first
		 * mark the current pmd notpresent (atomically because
		 * here the pmd_trans_huge and pmd_trans_splitting
		 * must remain set at all times on the pmd until the
		 * split is complete for this pmd), then we flush the
		 * SMP TLB and finally we write the non-huge version
		 * of the pmd entry with pmd_populate.
		 */
G
Gerald Schaefer 已提交
1842
		pmdp_invalidate(vma, address, pmd);
1843 1844
		pmd_populate(mm, pmd, pgtable);
		ret = 1;
1845
		spin_unlock(ptl);
1846 1847 1848 1849 1850
	}

	return ret;
}

1851
/* must be called with anon_vma->root->rwsem held */
1852
static void __split_huge_page(struct page *page,
1853 1854
			      struct anon_vma *anon_vma,
			      struct list_head *list)
1855 1856
{
	int mapcount, mapcount2;
1857
	pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
1858 1859 1860 1861 1862 1863
	struct anon_vma_chain *avc;

	BUG_ON(!PageHead(page));
	BUG_ON(PageTail(page));

	mapcount = 0;
1864
	anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff, pgoff) {
1865 1866 1867 1868 1869
		struct vm_area_struct *vma = avc->vma;
		unsigned long addr = vma_address(page, vma);
		BUG_ON(is_vma_temporary_stack(vma));
		mapcount += __split_huge_page_splitting(page, vma, addr);
	}
1870 1871 1872 1873 1874 1875 1876 1877 1878 1879
	/*
	 * It is critical that new vmas are added to the tail of the
	 * anon_vma list. This guarantes that if copy_huge_pmd() runs
	 * and establishes a child pmd before
	 * __split_huge_page_splitting() freezes the parent pmd (so if
	 * we fail to prevent copy_huge_pmd() from running until the
	 * whole __split_huge_page() is complete), we will still see
	 * the newly established pmd of the child later during the
	 * walk, to be able to set it as pmd_trans_splitting too.
	 */
1880
	if (mapcount != page_mapcount(page)) {
1881 1882
		pr_err("mapcount %d page_mapcount %d\n",
			mapcount, page_mapcount(page));
1883 1884
		BUG();
	}
1885

1886
	__split_huge_page_refcount(page, list);
1887 1888

	mapcount2 = 0;
1889
	anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff, pgoff) {
1890 1891 1892 1893 1894
		struct vm_area_struct *vma = avc->vma;
		unsigned long addr = vma_address(page, vma);
		BUG_ON(is_vma_temporary_stack(vma));
		mapcount2 += __split_huge_page_map(page, vma, addr);
	}
1895
	if (mapcount != mapcount2) {
1896 1897
		pr_err("mapcount %d mapcount2 %d page_mapcount %d\n",
			mapcount, mapcount2, page_mapcount(page));
1898 1899
		BUG();
	}
1900 1901
}

1902 1903 1904 1905 1906 1907 1908 1909
/*
 * Split a hugepage into normal pages. This doesn't change the position of head
 * page. If @list is null, tail pages will be added to LRU list, otherwise, to
 * @list. Both head page and tail pages will inherit mapping, flags, and so on
 * from the hugepage.
 * Return 0 if the hugepage is split successfully otherwise return 1.
 */
int split_huge_page_to_list(struct page *page, struct list_head *list)
1910 1911 1912 1913
{
	struct anon_vma *anon_vma;
	int ret = 1;

1914
	BUG_ON(is_huge_zero_page(page));
1915
	BUG_ON(!PageAnon(page));
1916 1917 1918 1919 1920 1921 1922 1923 1924

	/*
	 * The caller does not necessarily hold an mmap_sem that would prevent
	 * the anon_vma disappearing so we first we take a reference to it
	 * and then lock the anon_vma for write. This is similar to
	 * page_lock_anon_vma_read except the write lock is taken to serialise
	 * against parallel split or collapse operations.
	 */
	anon_vma = page_get_anon_vma(page);
1925 1926
	if (!anon_vma)
		goto out;
1927 1928
	anon_vma_lock_write(anon_vma);

1929 1930 1931 1932 1933
	ret = 0;
	if (!PageCompound(page))
		goto out_unlock;

	BUG_ON(!PageSwapBacked(page));
1934
	__split_huge_page(page, anon_vma, list);
1935
	count_vm_event(THP_SPLIT);
1936 1937 1938

	BUG_ON(PageCompound(page));
out_unlock:
1939
	anon_vma_unlock_write(anon_vma);
1940
	put_anon_vma(anon_vma);
1941 1942 1943 1944
out:
	return ret;
}

1945
#define VM_NO_THP (VM_SPECIAL | VM_HUGETLB | VM_SHARED | VM_MAYSHARE)
1946

1947 1948
int hugepage_madvise(struct vm_area_struct *vma,
		     unsigned long *vm_flags, int advice)
A
Andrea Arcangeli 已提交
1949
{
A
Andrea Arcangeli 已提交
1950 1951
	switch (advice) {
	case MADV_HUGEPAGE:
1952 1953 1954 1955 1956 1957 1958 1959 1960
#ifdef CONFIG_S390
		/*
		 * qemu blindly sets MADV_HUGEPAGE on all allocations, but s390
		 * can't handle this properly after s390_enable_sie, so we simply
		 * ignore the madvise to prevent qemu from causing a SIGSEGV.
		 */
		if (mm_has_pgste(vma->vm_mm))
			return 0;
#endif
A
Andrea Arcangeli 已提交
1961 1962 1963
		/*
		 * Be somewhat over-protective like KSM for now!
		 */
1964
		if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
A
Andrea Arcangeli 已提交
1965 1966 1967
			return -EINVAL;
		*vm_flags &= ~VM_NOHUGEPAGE;
		*vm_flags |= VM_HUGEPAGE;
1968 1969 1970 1971 1972 1973 1974
		/*
		 * If the vma become good for khugepaged to scan,
		 * register it here without waiting a page fault that
		 * may not happen any time soon.
		 */
		if (unlikely(khugepaged_enter_vma_merge(vma)))
			return -ENOMEM;
A
Andrea Arcangeli 已提交
1975 1976 1977 1978 1979
		break;
	case MADV_NOHUGEPAGE:
		/*
		 * Be somewhat over-protective like KSM for now!
		 */
1980
		if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
A
Andrea Arcangeli 已提交
1981 1982 1983
			return -EINVAL;
		*vm_flags &= ~VM_HUGEPAGE;
		*vm_flags |= VM_NOHUGEPAGE;
1984 1985 1986 1987 1988
		/*
		 * Setting VM_NOHUGEPAGE will prevent khugepaged from scanning
		 * this vma even if we leave the mm registered in khugepaged if
		 * it got registered before VM_NOHUGEPAGE was set.
		 */
A
Andrea Arcangeli 已提交
1989 1990
		break;
	}
A
Andrea Arcangeli 已提交
1991 1992 1993 1994

	return 0;
}

A
Andrea Arcangeli 已提交
1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021
static int __init khugepaged_slab_init(void)
{
	mm_slot_cache = kmem_cache_create("khugepaged_mm_slot",
					  sizeof(struct mm_slot),
					  __alignof__(struct mm_slot), 0, NULL);
	if (!mm_slot_cache)
		return -ENOMEM;

	return 0;
}

static inline struct mm_slot *alloc_mm_slot(void)
{
	if (!mm_slot_cache)	/* initialization failed */
		return NULL;
	return kmem_cache_zalloc(mm_slot_cache, GFP_KERNEL);
}

static inline void free_mm_slot(struct mm_slot *mm_slot)
{
	kmem_cache_free(mm_slot_cache, mm_slot);
}

static struct mm_slot *get_mm_slot(struct mm_struct *mm)
{
	struct mm_slot *mm_slot;

2022
	hash_for_each_possible(mm_slots_hash, mm_slot, hash, (unsigned long)mm)
A
Andrea Arcangeli 已提交
2023 2024
		if (mm == mm_slot->mm)
			return mm_slot;
2025

A
Andrea Arcangeli 已提交
2026 2027 2028 2029 2030 2031 2032
	return NULL;
}

static void insert_to_mm_slots_hash(struct mm_struct *mm,
				    struct mm_slot *mm_slot)
{
	mm_slot->mm = mm;
2033
	hash_add(mm_slots_hash, &mm_slot->hash, (long)mm);
A
Andrea Arcangeli 已提交
2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082
}

static inline int khugepaged_test_exit(struct mm_struct *mm)
{
	return atomic_read(&mm->mm_users) == 0;
}

int __khugepaged_enter(struct mm_struct *mm)
{
	struct mm_slot *mm_slot;
	int wakeup;

	mm_slot = alloc_mm_slot();
	if (!mm_slot)
		return -ENOMEM;

	/* __khugepaged_exit() must not run from under us */
	VM_BUG_ON(khugepaged_test_exit(mm));
	if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
		free_mm_slot(mm_slot);
		return 0;
	}

	spin_lock(&khugepaged_mm_lock);
	insert_to_mm_slots_hash(mm, mm_slot);
	/*
	 * Insert just behind the scanning cursor, to let the area settle
	 * down a little.
	 */
	wakeup = list_empty(&khugepaged_scan.mm_head);
	list_add_tail(&mm_slot->mm_node, &khugepaged_scan.mm_head);
	spin_unlock(&khugepaged_mm_lock);

	atomic_inc(&mm->mm_count);
	if (wakeup)
		wake_up_interruptible(&khugepaged_wait);

	return 0;
}

int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
{
	unsigned long hstart, hend;
	if (!vma->anon_vma)
		/*
		 * Not yet faulted in so we will register later in the
		 * page fault if needed.
		 */
		return 0;
2083
	if (vma->vm_ops)
A
Andrea Arcangeli 已提交
2084 2085
		/* khugepaged not yet working on file or special mappings */
		return 0;
2086
	VM_BUG_ON(vma->vm_flags & VM_NO_THP);
A
Andrea Arcangeli 已提交
2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101
	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
	hend = vma->vm_end & HPAGE_PMD_MASK;
	if (hstart < hend)
		return khugepaged_enter(vma);
	return 0;
}

void __khugepaged_exit(struct mm_struct *mm)
{
	struct mm_slot *mm_slot;
	int free = 0;

	spin_lock(&khugepaged_mm_lock);
	mm_slot = get_mm_slot(mm);
	if (mm_slot && khugepaged_scan.mm_slot != mm_slot) {
2102
		hash_del(&mm_slot->hash);
A
Andrea Arcangeli 已提交
2103 2104 2105
		list_del(&mm_slot->mm_node);
		free = 1;
	}
2106
	spin_unlock(&khugepaged_mm_lock);
A
Andrea Arcangeli 已提交
2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122

	if (free) {
		clear_bit(MMF_VM_HUGEPAGE, &mm->flags);
		free_mm_slot(mm_slot);
		mmdrop(mm);
	} else if (mm_slot) {
		/*
		 * This is required to serialize against
		 * khugepaged_test_exit() (which is guaranteed to run
		 * under mmap sem read mode). Stop here (after we
		 * return all pagetables will be destroyed) until
		 * khugepaged has finished working on the pagetables
		 * under the mmap_sem.
		 */
		down_write(&mm->mmap_sem);
		up_write(&mm->mmap_sem);
2123
	}
A
Andrea Arcangeli 已提交
2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148
}

static void release_pte_page(struct page *page)
{
	/* 0 stands for page_is_file_cache(page) == false */
	dec_zone_page_state(page, NR_ISOLATED_ANON + 0);
	unlock_page(page);
	putback_lru_page(page);
}

static void release_pte_pages(pte_t *pte, pte_t *_pte)
{
	while (--_pte >= pte) {
		pte_t pteval = *_pte;
		if (!pte_none(pteval))
			release_pte_page(pte_page(pteval));
	}
}

static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
					unsigned long address,
					pte_t *pte)
{
	struct page *page;
	pte_t *_pte;
2149
	int referenced = 0, none = 0;
A
Andrea Arcangeli 已提交
2150 2151 2152 2153 2154 2155
	for (_pte = pte; _pte < pte+HPAGE_PMD_NR;
	     _pte++, address += PAGE_SIZE) {
		pte_t pteval = *_pte;
		if (pte_none(pteval)) {
			if (++none <= khugepaged_max_ptes_none)
				continue;
2156
			else
A
Andrea Arcangeli 已提交
2157 2158
				goto out;
		}
2159
		if (!pte_present(pteval) || !pte_write(pteval))
A
Andrea Arcangeli 已提交
2160 2161
			goto out;
		page = vm_normal_page(vma, address, pteval);
2162
		if (unlikely(!page))
A
Andrea Arcangeli 已提交
2163
			goto out;
2164

2165 2166 2167
		VM_BUG_ON_PAGE(PageCompound(page), page);
		VM_BUG_ON_PAGE(!PageAnon(page), page);
		VM_BUG_ON_PAGE(!PageSwapBacked(page), page);
A
Andrea Arcangeli 已提交
2168 2169

		/* cannot use mapcount: can't collapse if there's a gup pin */
2170
		if (page_count(page) != 1)
A
Andrea Arcangeli 已提交
2171 2172 2173 2174 2175 2176 2177
			goto out;
		/*
		 * We can do it before isolate_lru_page because the
		 * page can't be freed from under us. NOTE: PG_lock
		 * is needed to serialize against split_huge_page
		 * when invoked from the VM.
		 */
2178
		if (!trylock_page(page))
A
Andrea Arcangeli 已提交
2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189
			goto out;
		/*
		 * Isolate the page to avoid collapsing an hugepage
		 * currently in use by the VM.
		 */
		if (isolate_lru_page(page)) {
			unlock_page(page);
			goto out;
		}
		/* 0 stands for page_is_file_cache(page) == false */
		inc_zone_page_state(page, NR_ISOLATED_ANON + 0);
2190 2191
		VM_BUG_ON_PAGE(!PageLocked(page), page);
		VM_BUG_ON_PAGE(PageLRU(page), page);
A
Andrea Arcangeli 已提交
2192 2193

		/* If there is no mapped pte young don't collapse the page */
A
Andrea Arcangeli 已提交
2194 2195
		if (pte_young(pteval) || PageReferenced(page) ||
		    mmu_notifier_test_young(vma->vm_mm, address))
A
Andrea Arcangeli 已提交
2196 2197
			referenced = 1;
	}
2198 2199
	if (likely(referenced))
		return 1;
A
Andrea Arcangeli 已提交
2200
out:
2201 2202
	release_pte_pages(pte, _pte);
	return 0;
A
Andrea Arcangeli 已提交
2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220
}

static void __collapse_huge_page_copy(pte_t *pte, struct page *page,
				      struct vm_area_struct *vma,
				      unsigned long address,
				      spinlock_t *ptl)
{
	pte_t *_pte;
	for (_pte = pte; _pte < pte+HPAGE_PMD_NR; _pte++) {
		pte_t pteval = *_pte;
		struct page *src_page;

		if (pte_none(pteval)) {
			clear_user_highpage(page, address);
			add_mm_counter(vma->vm_mm, MM_ANONPAGES, 1);
		} else {
			src_page = pte_page(pteval);
			copy_user_highpage(page, src_page, address, vma);
2221
			VM_BUG_ON_PAGE(page_mapcount(src_page) != 1, src_page);
A
Andrea Arcangeli 已提交
2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243
			release_pte_page(src_page);
			/*
			 * ptl mostly unnecessary, but preempt has to
			 * be disabled to update the per-cpu stats
			 * inside page_remove_rmap().
			 */
			spin_lock(ptl);
			/*
			 * paravirt calls inside pte_clear here are
			 * superfluous.
			 */
			pte_clear(vma->vm_mm, address, _pte);
			page_remove_rmap(src_page);
			spin_unlock(ptl);
			free_page_and_swap_cache(src_page);
		}

		address += PAGE_SIZE;
		page++;
	}
}

2244
static void khugepaged_alloc_sleep(void)
A
Andrea Arcangeli 已提交
2245
{
2246 2247 2248
	wait_event_freezable_timeout(khugepaged_wait, false,
			msecs_to_jiffies(khugepaged_alloc_sleep_millisecs));
}
A
Andrea Arcangeli 已提交
2249

2250 2251
static int khugepaged_node_load[MAX_NUMNODES];

2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275
static bool khugepaged_scan_abort(int nid)
{
	int i;

	/*
	 * If zone_reclaim_mode is disabled, then no extra effort is made to
	 * allocate memory locally.
	 */
	if (!zone_reclaim_mode)
		return false;

	/* If there is a count for this node already, it must be acceptable */
	if (khugepaged_node_load[nid])
		return false;

	for (i = 0; i < MAX_NUMNODES; i++) {
		if (!khugepaged_node_load[i])
			continue;
		if (node_distance(nid, i) > RECLAIM_DISTANCE)
			return true;
	}
	return false;
}

2276
#ifdef CONFIG_NUMA
2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301
static int khugepaged_find_target_node(void)
{
	static int last_khugepaged_target_node = NUMA_NO_NODE;
	int nid, target_node = 0, max_value = 0;

	/* find first node with max normal pages hit */
	for (nid = 0; nid < MAX_NUMNODES; nid++)
		if (khugepaged_node_load[nid] > max_value) {
			max_value = khugepaged_node_load[nid];
			target_node = nid;
		}

	/* do some balance if several nodes have the same hit record */
	if (target_node <= last_khugepaged_target_node)
		for (nid = last_khugepaged_target_node + 1; nid < MAX_NUMNODES;
				nid++)
			if (max_value == khugepaged_node_load[nid]) {
				target_node = nid;
				break;
			}

	last_khugepaged_target_node = target_node;
	return target_node;
}

2302 2303 2304 2305 2306 2307 2308
static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
{
	if (IS_ERR(*hpage)) {
		if (!*wait)
			return false;

		*wait = false;
2309
		*hpage = NULL;
2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323
		khugepaged_alloc_sleep();
	} else if (*hpage) {
		put_page(*hpage);
		*hpage = NULL;
	}

	return true;
}

static struct page
*khugepaged_alloc_page(struct page **hpage, struct mm_struct *mm,
		       struct vm_area_struct *vma, unsigned long address,
		       int node)
{
2324
	VM_BUG_ON_PAGE(*hpage, *hpage);
2325 2326 2327 2328 2329 2330 2331 2332 2333 2334
	/*
	 * Allocate the page while the vma is still valid and under
	 * the mmap_sem read mode so there is no memory allocation
	 * later when we take the mmap_sem in write mode. This is more
	 * friendly behavior (OTOH it may actually hide bugs) to
	 * filesystems in userland with daemons allocating memory in
	 * the userland I/O paths.  Allocating memory with the
	 * mmap_sem in read mode is good idea also to allow greater
	 * scalability.
	 */
2335 2336
	*hpage = alloc_pages_exact_node(node, alloc_hugepage_gfpmask(
		khugepaged_defrag(), __GFP_OTHER_NODE), HPAGE_PMD_ORDER);
2337 2338 2339 2340 2341
	/*
	 * After allocating the hugepage, release the mmap_sem read lock in
	 * preparation for taking it in write mode.
	 */
	up_read(&mm->mmap_sem);
2342
	if (unlikely(!*hpage)) {
2343
		count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
2344
		*hpage = ERR_PTR(-ENOMEM);
2345
		return NULL;
2346
	}
2347

2348
	count_vm_event(THP_COLLAPSE_ALLOC);
2349 2350 2351
	return *hpage;
}
#else
2352 2353 2354 2355 2356
static int khugepaged_find_target_node(void)
{
	return 0;
}

2357 2358 2359 2360 2361 2362
static inline struct page *alloc_hugepage(int defrag)
{
	return alloc_pages(alloc_hugepage_gfpmask(defrag, 0),
			   HPAGE_PMD_ORDER);
}

2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402
static struct page *khugepaged_alloc_hugepage(bool *wait)
{
	struct page *hpage;

	do {
		hpage = alloc_hugepage(khugepaged_defrag());
		if (!hpage) {
			count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
			if (!*wait)
				return NULL;

			*wait = false;
			khugepaged_alloc_sleep();
		} else
			count_vm_event(THP_COLLAPSE_ALLOC);
	} while (unlikely(!hpage) && likely(khugepaged_enabled()));

	return hpage;
}

static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
{
	if (!*hpage)
		*hpage = khugepaged_alloc_hugepage(wait);

	if (unlikely(!*hpage))
		return false;

	return true;
}

static struct page
*khugepaged_alloc_page(struct page **hpage, struct mm_struct *mm,
		       struct vm_area_struct *vma, unsigned long address,
		       int node)
{
	up_read(&mm->mmap_sem);
	VM_BUG_ON(!*hpage);
	return  *hpage;
}
2403 2404
#endif

B
Bob Liu 已提交
2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418
static bool hugepage_vma_check(struct vm_area_struct *vma)
{
	if ((!(vma->vm_flags & VM_HUGEPAGE) && !khugepaged_always()) ||
	    (vma->vm_flags & VM_NOHUGEPAGE))
		return false;

	if (!vma->anon_vma || vma->vm_ops)
		return false;
	if (is_vma_temporary_stack(vma))
		return false;
	VM_BUG_ON(vma->vm_flags & VM_NO_THP);
	return true;
}

2419 2420 2421 2422 2423 2424 2425 2426 2427 2428
static void collapse_huge_page(struct mm_struct *mm,
				   unsigned long address,
				   struct page **hpage,
				   struct vm_area_struct *vma,
				   int node)
{
	pmd_t *pmd, _pmd;
	pte_t *pte;
	pgtable_t pgtable;
	struct page *new_page;
2429
	spinlock_t *pmd_ptl, *pte_ptl;
2430 2431
	int isolated;
	unsigned long hstart, hend;
2432
	struct mem_cgroup *memcg;
2433 2434
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
2435 2436 2437 2438 2439 2440 2441 2442

	VM_BUG_ON(address & ~HPAGE_PMD_MASK);

	/* release the mmap_sem read lock. */
	new_page = khugepaged_alloc_page(hpage, mm, vma, address, node);
	if (!new_page)
		return;

2443 2444
	if (unlikely(mem_cgroup_try_charge(new_page, mm,
					   GFP_TRANSHUGE, &memcg)))
2445
		return;
A
Andrea Arcangeli 已提交
2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456

	/*
	 * Prevent all access to pagetables with the exception of
	 * gup_fast later hanlded by the ptep_clear_flush and the VM
	 * handled by the anon_vma lock + PG_lock.
	 */
	down_write(&mm->mmap_sem);
	if (unlikely(khugepaged_test_exit(mm)))
		goto out;

	vma = find_vma(mm, address);
2457 2458
	if (!vma)
		goto out;
A
Andrea Arcangeli 已提交
2459 2460 2461 2462
	hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
	hend = vma->vm_end & HPAGE_PMD_MASK;
	if (address < hstart || address + HPAGE_PMD_SIZE > hend)
		goto out;
B
Bob Liu 已提交
2463
	if (!hugepage_vma_check(vma))
2464
		goto out;
B
Bob Liu 已提交
2465 2466
	pmd = mm_find_pmd(mm, address);
	if (!pmd)
A
Andrea Arcangeli 已提交
2467 2468
		goto out;

2469
	anon_vma_lock_write(vma->anon_vma);
A
Andrea Arcangeli 已提交
2470 2471

	pte = pte_offset_map(pmd, address);
2472
	pte_ptl = pte_lockptr(mm, pmd);
A
Andrea Arcangeli 已提交
2473

2474 2475 2476
	mmun_start = address;
	mmun_end   = address + HPAGE_PMD_SIZE;
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
2477
	pmd_ptl = pmd_lock(mm, pmd); /* probably unnecessary */
A
Andrea Arcangeli 已提交
2478 2479 2480 2481 2482 2483
	/*
	 * After this gup_fast can't run anymore. This also removes
	 * any huge TLB entry from the CPU so we won't allow
	 * huge and small TLB entries for the same virtual address
	 * to avoid the risk of CPU bugs in that area.
	 */
2484
	_pmd = pmdp_clear_flush(vma, address, pmd);
2485
	spin_unlock(pmd_ptl);
2486
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
A
Andrea Arcangeli 已提交
2487

2488
	spin_lock(pte_ptl);
A
Andrea Arcangeli 已提交
2489
	isolated = __collapse_huge_page_isolate(vma, address, pte);
2490
	spin_unlock(pte_ptl);
A
Andrea Arcangeli 已提交
2491 2492

	if (unlikely(!isolated)) {
2493
		pte_unmap(pte);
2494
		spin_lock(pmd_ptl);
A
Andrea Arcangeli 已提交
2495
		BUG_ON(!pmd_none(*pmd));
2496 2497 2498 2499 2500 2501
		/*
		 * We can only use set_pmd_at when establishing
		 * hugepmds and never for establishing regular pmds that
		 * points to regular pagetables. Use pmd_populate for that
		 */
		pmd_populate(mm, pmd, pmd_pgtable(_pmd));
2502
		spin_unlock(pmd_ptl);
2503
		anon_vma_unlock_write(vma->anon_vma);
2504
		goto out;
A
Andrea Arcangeli 已提交
2505 2506 2507 2508 2509 2510
	}

	/*
	 * All pages are isolated and locked so anon_vma rmap
	 * can't run anymore.
	 */
2511
	anon_vma_unlock_write(vma->anon_vma);
A
Andrea Arcangeli 已提交
2512

2513
	__collapse_huge_page_copy(pte, new_page, vma, address, pte_ptl);
2514
	pte_unmap(pte);
A
Andrea Arcangeli 已提交
2515 2516 2517
	__SetPageUptodate(new_page);
	pgtable = pmd_pgtable(_pmd);

2518 2519
	_pmd = mk_huge_pmd(new_page, vma->vm_page_prot);
	_pmd = maybe_pmd_mkwrite(pmd_mkdirty(_pmd), vma);
A
Andrea Arcangeli 已提交
2520 2521 2522 2523 2524 2525 2526 2527

	/*
	 * spin_lock() below is not the equivalent of smp_wmb(), so
	 * this is needed to avoid the copy_huge_page writes to become
	 * visible after the set_pmd_at() write.
	 */
	smp_wmb();

2528
	spin_lock(pmd_ptl);
A
Andrea Arcangeli 已提交
2529 2530
	BUG_ON(!pmd_none(*pmd));
	page_add_new_anon_rmap(new_page, vma, address);
2531 2532
	mem_cgroup_commit_charge(new_page, memcg, false);
	lru_cache_add_active_or_unevictable(new_page, vma);
2533
	pgtable_trans_huge_deposit(mm, pmd, pgtable);
A
Andrea Arcangeli 已提交
2534
	set_pmd_at(mm, address, pmd, _pmd);
2535
	update_mmu_cache_pmd(vma, address, pmd);
2536
	spin_unlock(pmd_ptl);
A
Andrea Arcangeli 已提交
2537 2538

	*hpage = NULL;
2539

A
Andrea Arcangeli 已提交
2540
	khugepaged_pages_collapsed++;
2541
out_up_write:
A
Andrea Arcangeli 已提交
2542
	up_write(&mm->mmap_sem);
2543 2544
	return;

2545
out:
2546
	mem_cgroup_cancel_charge(new_page, memcg);
2547
	goto out_up_write;
A
Andrea Arcangeli 已提交
2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560
}

static int khugepaged_scan_pmd(struct mm_struct *mm,
			       struct vm_area_struct *vma,
			       unsigned long address,
			       struct page **hpage)
{
	pmd_t *pmd;
	pte_t *pte, *_pte;
	int ret = 0, referenced = 0, none = 0;
	struct page *page;
	unsigned long _address;
	spinlock_t *ptl;
D
David Rientjes 已提交
2561
	int node = NUMA_NO_NODE;
A
Andrea Arcangeli 已提交
2562 2563 2564

	VM_BUG_ON(address & ~HPAGE_PMD_MASK);

B
Bob Liu 已提交
2565 2566
	pmd = mm_find_pmd(mm, address);
	if (!pmd)
A
Andrea Arcangeli 已提交
2567 2568
		goto out;

2569
	memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
A
Andrea Arcangeli 已提交
2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584
	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
	for (_address = address, _pte = pte; _pte < pte+HPAGE_PMD_NR;
	     _pte++, _address += PAGE_SIZE) {
		pte_t pteval = *_pte;
		if (pte_none(pteval)) {
			if (++none <= khugepaged_max_ptes_none)
				continue;
			else
				goto out_unmap;
		}
		if (!pte_present(pteval) || !pte_write(pteval))
			goto out_unmap;
		page = vm_normal_page(vma, _address, pteval);
		if (unlikely(!page))
			goto out_unmap;
2585
		/*
2586 2587 2588 2589
		 * Record which node the original page is from and save this
		 * information to khugepaged_node_load[].
		 * Khupaged will allocate hugepage from the node has the max
		 * hit record.
2590
		 */
2591
		node = page_to_nid(page);
2592 2593
		if (khugepaged_scan_abort(node))
			goto out_unmap;
2594
		khugepaged_node_load[node]++;
2595
		VM_BUG_ON_PAGE(PageCompound(page), page);
A
Andrea Arcangeli 已提交
2596 2597 2598 2599 2600
		if (!PageLRU(page) || PageLocked(page) || !PageAnon(page))
			goto out_unmap;
		/* cannot use mapcount: can't collapse if there's a gup pin */
		if (page_count(page) != 1)
			goto out_unmap;
A
Andrea Arcangeli 已提交
2601 2602
		if (pte_young(pteval) || PageReferenced(page) ||
		    mmu_notifier_test_young(vma->vm_mm, address))
A
Andrea Arcangeli 已提交
2603 2604 2605 2606 2607 2608
			referenced = 1;
	}
	if (referenced)
		ret = 1;
out_unmap:
	pte_unmap_unlock(pte, ptl);
2609 2610
	if (ret) {
		node = khugepaged_find_target_node();
2611
		/* collapse_huge_page will return with the mmap_sem released */
2612
		collapse_huge_page(mm, address, hpage, vma, node);
2613
	}
A
Andrea Arcangeli 已提交
2614 2615 2616 2617 2618 2619 2620 2621
out:
	return ret;
}

static void collect_mm_slot(struct mm_slot *mm_slot)
{
	struct mm_struct *mm = mm_slot->mm;

2622
	VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
A
Andrea Arcangeli 已提交
2623 2624 2625

	if (khugepaged_test_exit(mm)) {
		/* free mm_slot */
2626
		hash_del(&mm_slot->hash);
A
Andrea Arcangeli 已提交
2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642
		list_del(&mm_slot->mm_node);

		/*
		 * Not strictly needed because the mm exited already.
		 *
		 * clear_bit(MMF_VM_HUGEPAGE, &mm->flags);
		 */

		/* khugepaged_mm_lock actually not necessary for the below */
		free_mm_slot(mm_slot);
		mmdrop(mm);
	}
}

static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
					    struct page **hpage)
2643 2644
	__releases(&khugepaged_mm_lock)
	__acquires(&khugepaged_mm_lock)
A
Andrea Arcangeli 已提交
2645 2646 2647 2648 2649 2650 2651
{
	struct mm_slot *mm_slot;
	struct mm_struct *mm;
	struct vm_area_struct *vma;
	int progress = 0;

	VM_BUG_ON(!pages);
2652
	VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
A
Andrea Arcangeli 已提交
2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679

	if (khugepaged_scan.mm_slot)
		mm_slot = khugepaged_scan.mm_slot;
	else {
		mm_slot = list_entry(khugepaged_scan.mm_head.next,
				     struct mm_slot, mm_node);
		khugepaged_scan.address = 0;
		khugepaged_scan.mm_slot = mm_slot;
	}
	spin_unlock(&khugepaged_mm_lock);

	mm = mm_slot->mm;
	down_read(&mm->mmap_sem);
	if (unlikely(khugepaged_test_exit(mm)))
		vma = NULL;
	else
		vma = find_vma(mm, khugepaged_scan.address);

	progress++;
	for (; vma; vma = vma->vm_next) {
		unsigned long hstart, hend;

		cond_resched();
		if (unlikely(khugepaged_test_exit(mm))) {
			progress++;
			break;
		}
B
Bob Liu 已提交
2680 2681
		if (!hugepage_vma_check(vma)) {
skip:
A
Andrea Arcangeli 已提交
2682 2683 2684 2685 2686
			progress++;
			continue;
		}
		hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
		hend = vma->vm_end & HPAGE_PMD_MASK;
2687 2688 2689 2690
		if (hstart >= hend)
			goto skip;
		if (khugepaged_scan.address > hend)
			goto skip;
A
Andrea Arcangeli 已提交
2691 2692
		if (khugepaged_scan.address < hstart)
			khugepaged_scan.address = hstart;
2693
		VM_BUG_ON(khugepaged_scan.address & ~HPAGE_PMD_MASK);
A
Andrea Arcangeli 已提交
2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718 2719 2720 2721

		while (khugepaged_scan.address < hend) {
			int ret;
			cond_resched();
			if (unlikely(khugepaged_test_exit(mm)))
				goto breakouterloop;

			VM_BUG_ON(khugepaged_scan.address < hstart ||
				  khugepaged_scan.address + HPAGE_PMD_SIZE >
				  hend);
			ret = khugepaged_scan_pmd(mm, vma,
						  khugepaged_scan.address,
						  hpage);
			/* move to next address */
			khugepaged_scan.address += HPAGE_PMD_SIZE;
			progress += HPAGE_PMD_NR;
			if (ret)
				/* we released mmap_sem so break loop */
				goto breakouterloop_mmap_sem;
			if (progress >= pages)
				goto breakouterloop;
		}
	}
breakouterloop:
	up_read(&mm->mmap_sem); /* exit_mmap will destroy ptes after this */
breakouterloop_mmap_sem:

	spin_lock(&khugepaged_mm_lock);
2722
	VM_BUG_ON(khugepaged_scan.mm_slot != mm_slot);
A
Andrea Arcangeli 已提交
2723 2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755 2756 2757
	/*
	 * Release the current mm_slot if this mm is about to die, or
	 * if we scanned all vmas of this mm.
	 */
	if (khugepaged_test_exit(mm) || !vma) {
		/*
		 * Make sure that if mm_users is reaching zero while
		 * khugepaged runs here, khugepaged_exit will find
		 * mm_slot not pointing to the exiting mm.
		 */
		if (mm_slot->mm_node.next != &khugepaged_scan.mm_head) {
			khugepaged_scan.mm_slot = list_entry(
				mm_slot->mm_node.next,
				struct mm_slot, mm_node);
			khugepaged_scan.address = 0;
		} else {
			khugepaged_scan.mm_slot = NULL;
			khugepaged_full_scans++;
		}

		collect_mm_slot(mm_slot);
	}

	return progress;
}

static int khugepaged_has_work(void)
{
	return !list_empty(&khugepaged_scan.mm_head) &&
		khugepaged_enabled();
}

static int khugepaged_wait_event(void)
{
	return !list_empty(&khugepaged_scan.mm_head) ||
2758
		kthread_should_stop();
A
Andrea Arcangeli 已提交
2759 2760
}

2761
static void khugepaged_do_scan(void)
A
Andrea Arcangeli 已提交
2762
{
2763
	struct page *hpage = NULL;
A
Andrea Arcangeli 已提交
2764 2765
	unsigned int progress = 0, pass_through_head = 0;
	unsigned int pages = khugepaged_pages_to_scan;
2766
	bool wait = true;
A
Andrea Arcangeli 已提交
2767 2768 2769 2770

	barrier(); /* write khugepaged_pages_to_scan to local stack */

	while (progress < pages) {
2771
		if (!khugepaged_prealloc_page(&hpage, &wait))
2772
			break;
2773

2774
		cond_resched();
A
Andrea Arcangeli 已提交
2775

2776 2777 2778
		if (unlikely(kthread_should_stop() || freezing(current)))
			break;

A
Andrea Arcangeli 已提交
2779 2780 2781 2782 2783 2784
		spin_lock(&khugepaged_mm_lock);
		if (!khugepaged_scan.mm_slot)
			pass_through_head++;
		if (khugepaged_has_work() &&
		    pass_through_head < 2)
			progress += khugepaged_scan_mm_slot(pages - progress,
2785
							    &hpage);
A
Andrea Arcangeli 已提交
2786 2787 2788 2789 2790
		else
			progress = pages;
		spin_unlock(&khugepaged_mm_lock);
	}

2791 2792
	if (!IS_ERR_OR_NULL(hpage))
		put_page(hpage);
2793 2794
}

2795 2796 2797 2798 2799 2800 2801 2802 2803 2804 2805 2806 2807 2808 2809 2810 2811 2812
static void khugepaged_wait_work(void)
{
	try_to_freeze();

	if (khugepaged_has_work()) {
		if (!khugepaged_scan_sleep_millisecs)
			return;

		wait_event_freezable_timeout(khugepaged_wait,
					     kthread_should_stop(),
			msecs_to_jiffies(khugepaged_scan_sleep_millisecs));
		return;
	}

	if (khugepaged_enabled())
		wait_event_freezable(khugepaged_wait, khugepaged_wait_event());
}

A
Andrea Arcangeli 已提交
2813 2814 2815 2816
static int khugepaged(void *none)
{
	struct mm_slot *mm_slot;

2817
	set_freezable();
2818
	set_user_nice(current, MAX_NICE);
A
Andrea Arcangeli 已提交
2819

X
Xiao Guangrong 已提交
2820 2821 2822 2823
	while (!kthread_should_stop()) {
		khugepaged_do_scan();
		khugepaged_wait_work();
	}
A
Andrea Arcangeli 已提交
2824 2825 2826 2827 2828 2829 2830 2831 2832 2833

	spin_lock(&khugepaged_mm_lock);
	mm_slot = khugepaged_scan.mm_slot;
	khugepaged_scan.mm_slot = NULL;
	if (mm_slot)
		collect_mm_slot(mm_slot);
	spin_unlock(&khugepaged_mm_lock);
	return 0;
}

2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844
static void __split_huge_zero_page_pmd(struct vm_area_struct *vma,
		unsigned long haddr, pmd_t *pmd)
{
	struct mm_struct *mm = vma->vm_mm;
	pgtable_t pgtable;
	pmd_t _pmd;
	int i;

	pmdp_clear_flush(vma, haddr, pmd);
	/* leave pmd empty until pte is filled */

2845
	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858
	pmd_populate(mm, &_pmd, pgtable);

	for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
		pte_t *pte, entry;
		entry = pfn_pte(my_zero_pfn(haddr), vma->vm_page_prot);
		entry = pte_mkspecial(entry);
		pte = pte_offset_map(&_pmd, haddr);
		VM_BUG_ON(!pte_none(*pte));
		set_pte_at(mm, haddr, pte, entry);
		pte_unmap(pte);
	}
	smp_wmb(); /* make pte visible before pmd */
	pmd_populate(mm, pmd, pgtable);
2859
	put_huge_zero_page();
2860 2861
}

2862 2863
void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address,
		pmd_t *pmd)
2864
{
2865
	spinlock_t *ptl;
2866
	struct page *page;
2867
	struct mm_struct *mm = vma->vm_mm;
2868 2869 2870
	unsigned long haddr = address & HPAGE_PMD_MASK;
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
2871 2872

	BUG_ON(vma->vm_start > haddr || vma->vm_end < haddr + HPAGE_PMD_SIZE);
2873

2874 2875
	mmun_start = haddr;
	mmun_end   = haddr + HPAGE_PMD_SIZE;
2876
again:
2877
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
2878
	ptl = pmd_lock(mm, pmd);
2879
	if (unlikely(!pmd_trans_huge(*pmd))) {
2880
		spin_unlock(ptl);
2881 2882 2883 2884 2885
		mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
		return;
	}
	if (is_huge_zero_pmd(*pmd)) {
		__split_huge_zero_page_pmd(vma, haddr, pmd);
2886
		spin_unlock(ptl);
2887
		mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
2888 2889 2890
		return;
	}
	page = pmd_page(*pmd);
2891
	VM_BUG_ON_PAGE(!page_count(page), page);
2892
	get_page(page);
2893
	spin_unlock(ptl);
2894
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
2895 2896 2897 2898

	split_huge_page(page);

	put_page(page);
2899 2900 2901 2902 2903 2904 2905 2906

	/*
	 * We don't always have down_write of mmap_sem here: a racing
	 * do_huge_pmd_wp_page() might have copied-on-write to another
	 * huge page before our split_huge_page() got the anon_vma lock.
	 */
	if (unlikely(pmd_trans_huge(*pmd)))
		goto again;
2907
}
2908

2909 2910 2911 2912 2913 2914 2915 2916 2917 2918
void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address,
		pmd_t *pmd)
{
	struct vm_area_struct *vma;

	vma = find_vma(mm, address);
	BUG_ON(vma == NULL);
	split_huge_page_pmd(vma, address, pmd);
}

2919 2920 2921
static void split_huge_page_address(struct mm_struct *mm,
				    unsigned long address)
{
2922 2923
	pgd_t *pgd;
	pud_t *pud;
2924 2925 2926 2927
	pmd_t *pmd;

	VM_BUG_ON(!(address & ~HPAGE_PMD_MASK));

2928 2929 2930 2931 2932 2933 2934 2935 2936 2937
	pgd = pgd_offset(mm, address);
	if (!pgd_present(*pgd))
		return;

	pud = pud_offset(pgd, address);
	if (!pud_present(*pud))
		return;

	pmd = pmd_offset(pud, address);
	if (!pmd_present(*pmd))
2938 2939 2940 2941 2942
		return;
	/*
	 * Caller holds the mmap_sem write mode, so a huge pmd cannot
	 * materialize from under us.
	 */
2943
	split_huge_page_pmd_mm(mm, address, pmd);
2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961 2962 2963 2964 2965 2966 2967 2968 2969 2970 2971 2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983 2984 2985
}

void __vma_adjust_trans_huge(struct vm_area_struct *vma,
			     unsigned long start,
			     unsigned long end,
			     long adjust_next)
{
	/*
	 * If the new start address isn't hpage aligned and it could
	 * previously contain an hugepage: check if we need to split
	 * an huge pmd.
	 */
	if (start & ~HPAGE_PMD_MASK &&
	    (start & HPAGE_PMD_MASK) >= vma->vm_start &&
	    (start & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
		split_huge_page_address(vma->vm_mm, start);

	/*
	 * If the new end address isn't hpage aligned and it could
	 * previously contain an hugepage: check if we need to split
	 * an huge pmd.
	 */
	if (end & ~HPAGE_PMD_MASK &&
	    (end & HPAGE_PMD_MASK) >= vma->vm_start &&
	    (end & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
		split_huge_page_address(vma->vm_mm, end);

	/*
	 * If we're also updating the vma->vm_next->vm_start, if the new
	 * vm_next->vm_start isn't page aligned and it could previously
	 * contain an hugepage: check if we need to split an huge pmd.
	 */
	if (adjust_next > 0) {
		struct vm_area_struct *next = vma->vm_next;
		unsigned long nstart = next->vm_start;
		nstart += adjust_next << PAGE_SHIFT;
		if (nstart & ~HPAGE_PMD_MASK &&
		    (nstart & HPAGE_PMD_MASK) >= next->vm_start &&
		    (nstart & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= next->vm_end)
			split_huge_page_address(next->vm_mm, nstart);
	}
}