huge_memory.c 73.7 KB
Newer Older
1 2 3 4 5 6 7
/*
 *  Copyright (C) 2009  Red Hat, Inc.
 *
 *  This work is licensed under the terms of the GNU GPL, version 2. See
 *  the COPYING file in the top-level directory.
 */

8 9
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

10 11
#include <linux/mm.h>
#include <linux/sched.h>
12
#include <linux/sched/coredump.h>
13
#include <linux/sched/numa_balancing.h>
14 15 16 17 18
#include <linux/highmem.h>
#include <linux/hugetlb.h>
#include <linux/mmu_notifier.h>
#include <linux/rmap.h>
#include <linux/swap.h>
19
#include <linux/shrinker.h>
A
Andrea Arcangeli 已提交
20
#include <linux/mm_inline.h>
21
#include <linux/swapops.h>
M
Matthew Wilcox 已提交
22
#include <linux/dax.h>
A
Andrea Arcangeli 已提交
23
#include <linux/khugepaged.h>
24
#include <linux/freezer.h>
25
#include <linux/pfn_t.h>
A
Andrea Arcangeli 已提交
26
#include <linux/mman.h>
27
#include <linux/memremap.h>
R
Ralf Baechle 已提交
28
#include <linux/pagemap.h>
29
#include <linux/debugfs.h>
30
#include <linux/migrate.h>
31
#include <linux/hashtable.h>
32
#include <linux/userfaultfd_k.h>
33
#include <linux/page_idle.h>
34
#include <linux/shmem_fs.h>
35

36 37 38 39
#include <asm/tlb.h>
#include <asm/pgalloc.h>
#include "internal.h"

A
Andrea Arcangeli 已提交
40
/*
41 42 43 44 45 46
 * By default transparent hugepage support is disabled in order that avoid
 * to risk increase the memory footprint of applications without a guaranteed
 * benefit. When transparent hugepage support is enabled, is for all mappings,
 * and khugepaged scans all mappings.
 * Defrag is invoked by khugepaged hugepage allocations and by page faults
 * for all hugepage allocations.
A
Andrea Arcangeli 已提交
47
 */
48
unsigned long transparent_hugepage_flags __read_mostly =
49
#ifdef CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS
A
Andrea Arcangeli 已提交
50
	(1<<TRANSPARENT_HUGEPAGE_FLAG)|
51 52 53 54
#endif
#ifdef CONFIG_TRANSPARENT_HUGEPAGE_MADVISE
	(1<<TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG)|
#endif
55
	(1<<TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG)|
56 57
	(1<<TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG)|
	(1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
A
Andrea Arcangeli 已提交
58

59
static struct shrinker deferred_split_shrinker;
60

61
static atomic_t huge_zero_refcount;
62
struct page *huge_zero_page __read_mostly;
63

64
static struct page *get_huge_zero_page(void)
65 66 67 68
{
	struct page *zero_page;
retry:
	if (likely(atomic_inc_not_zero(&huge_zero_refcount)))
69
		return READ_ONCE(huge_zero_page);
70 71

	zero_page = alloc_pages((GFP_TRANSHUGE | __GFP_ZERO) & ~__GFP_MOVABLE,
72
			HPAGE_PMD_ORDER);
73 74
	if (!zero_page) {
		count_vm_event(THP_ZERO_PAGE_ALLOC_FAILED);
75
		return NULL;
76 77
	}
	count_vm_event(THP_ZERO_PAGE_ALLOC);
78
	preempt_disable();
79
	if (cmpxchg(&huge_zero_page, NULL, zero_page)) {
80
		preempt_enable();
81
		__free_pages(zero_page, compound_order(zero_page));
82 83 84 85 86 87
		goto retry;
	}

	/* We take additional reference here. It will be put back by shrinker */
	atomic_set(&huge_zero_refcount, 2);
	preempt_enable();
88
	return READ_ONCE(huge_zero_page);
89 90
}

91
static void put_huge_zero_page(void)
92
{
93 94 95 96 97
	/*
	 * Counter should never go to zero here. Only shrinker can put
	 * last reference.
	 */
	BUG_ON(atomic_dec_and_test(&huge_zero_refcount));
98 99
}

100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119
struct page *mm_get_huge_zero_page(struct mm_struct *mm)
{
	if (test_bit(MMF_HUGE_ZERO_PAGE, &mm->flags))
		return READ_ONCE(huge_zero_page);

	if (!get_huge_zero_page())
		return NULL;

	if (test_and_set_bit(MMF_HUGE_ZERO_PAGE, &mm->flags))
		put_huge_zero_page();

	return READ_ONCE(huge_zero_page);
}

void mm_put_huge_zero_page(struct mm_struct *mm)
{
	if (test_bit(MMF_HUGE_ZERO_PAGE, &mm->flags))
		put_huge_zero_page();
}

120 121
static unsigned long shrink_huge_zero_page_count(struct shrinker *shrink,
					struct shrink_control *sc)
122
{
123 124 125
	/* we can free zero page only if last reference remains */
	return atomic_read(&huge_zero_refcount) == 1 ? HPAGE_PMD_NR : 0;
}
126

127 128 129
static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink,
				       struct shrink_control *sc)
{
130
	if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) {
131 132
		struct page *zero_page = xchg(&huge_zero_page, NULL);
		BUG_ON(zero_page == NULL);
133
		__free_pages(zero_page, compound_order(zero_page));
134
		return HPAGE_PMD_NR;
135 136 137
	}

	return 0;
138 139
}

140
static struct shrinker huge_zero_page_shrinker = {
141 142
	.count_objects = shrink_huge_zero_page_count,
	.scan_objects = shrink_huge_zero_page_scan,
143 144 145
	.seeks = DEFAULT_SEEKS,
};

146 147 148 149
#ifdef CONFIG_SYSFS
static ssize_t enabled_show(struct kobject *kobj,
			    struct kobj_attribute *attr, char *buf)
{
150 151 152 153 154 155
	if (test_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags))
		return sprintf(buf, "[always] madvise never\n");
	else if (test_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags))
		return sprintf(buf, "always [madvise] never\n");
	else
		return sprintf(buf, "always madvise [never]\n");
156
}
157

158 159 160 161
static ssize_t enabled_store(struct kobject *kobj,
			     struct kobj_attribute *attr,
			     const char *buf, size_t count)
{
162
	ssize_t ret = count;
A
Andrea Arcangeli 已提交
163

164 165 166 167 168 169 170 171 172 173 174 175 176 177
	if (!memcmp("always", buf,
		    min(sizeof("always")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
	} else if (!memcmp("madvise", buf,
			   min(sizeof("madvise")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
	} else if (!memcmp("never", buf,
			   min(sizeof("never")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags);
	} else
		ret = -EINVAL;
A
Andrea Arcangeli 已提交
178 179

	if (ret > 0) {
180
		int err = start_stop_khugepaged();
A
Andrea Arcangeli 已提交
181 182 183 184
		if (err)
			ret = err;
	}
	return ret;
185 186 187 188
}
static struct kobj_attribute enabled_attr =
	__ATTR(enabled, 0644, enabled_show, enabled_store);

189
ssize_t single_hugepage_flag_show(struct kobject *kobj,
190 191 192
				struct kobj_attribute *attr, char *buf,
				enum transparent_hugepage_flag flag)
{
193 194
	return sprintf(buf, "%d\n",
		       !!test_bit(flag, &transparent_hugepage_flags));
195
}
196

197
ssize_t single_hugepage_flag_store(struct kobject *kobj,
198 199 200 201
				 struct kobj_attribute *attr,
				 const char *buf, size_t count,
				 enum transparent_hugepage_flag flag)
{
202 203 204 205 206 207 208 209 210 211
	unsigned long value;
	int ret;

	ret = kstrtoul(buf, 10, &value);
	if (ret < 0)
		return ret;
	if (value > 1)
		return -EINVAL;

	if (value)
212
		set_bit(flag, &transparent_hugepage_flags);
213
	else
214 215 216 217 218 219 220 221
		clear_bit(flag, &transparent_hugepage_flags);

	return count;
}

static ssize_t defrag_show(struct kobject *kobj,
			   struct kobj_attribute *attr, char *buf)
{
222
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
223
		return sprintf(buf, "[always] defer defer+madvise madvise never\n");
224
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
225 226 227 228 229 230
		return sprintf(buf, "always [defer] defer+madvise madvise never\n");
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
		return sprintf(buf, "always defer [defer+madvise] madvise never\n");
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
		return sprintf(buf, "always defer defer+madvise [madvise] never\n");
	return sprintf(buf, "always defer defer+madvise madvise [never]\n");
231
}
232

233 234 235 236
static ssize_t defrag_store(struct kobject *kobj,
			    struct kobj_attribute *attr,
			    const char *buf, size_t count)
{
237 238 239 240 241 242 243 244 245 246 247 248
	if (!memcmp("always", buf,
		    min(sizeof("always")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
	} else if (!memcmp("defer+madvise", buf,
		    min(sizeof("defer+madvise")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
249 250 251 252 253 254
	} else if (!memcmp("defer", buf,
		    min(sizeof("defer")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270
	} else if (!memcmp("madvise", buf,
			   min(sizeof("madvise")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
	} else if (!memcmp("never", buf,
			   min(sizeof("never")-1, count))) {
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags);
	} else
		return -EINVAL;

	return count;
271 272 273 274
}
static struct kobj_attribute defrag_attr =
	__ATTR(defrag, 0644, defrag_show, defrag_store);

275 276 277
static ssize_t use_zero_page_show(struct kobject *kobj,
		struct kobj_attribute *attr, char *buf)
{
278
	return single_hugepage_flag_show(kobj, attr, buf,
279 280 281 282 283
				TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
}
static ssize_t use_zero_page_store(struct kobject *kobj,
		struct kobj_attribute *attr, const char *buf, size_t count)
{
284
	return single_hugepage_flag_store(kobj, attr, buf, count,
285 286 287 288
				 TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
}
static struct kobj_attribute use_zero_page_attr =
	__ATTR(use_zero_page, 0644, use_zero_page_show, use_zero_page_store);
289 290 291 292 293 294 295 296 297

static ssize_t hpage_pmd_size_show(struct kobject *kobj,
		struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%lu\n", HPAGE_PMD_SIZE);
}
static struct kobj_attribute hpage_pmd_size_attr =
	__ATTR_RO(hpage_pmd_size);

298 299 300 301
#ifdef CONFIG_DEBUG_VM
static ssize_t debug_cow_show(struct kobject *kobj,
				struct kobj_attribute *attr, char *buf)
{
302
	return single_hugepage_flag_show(kobj, attr, buf,
303 304 305 306 307 308
				TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
}
static ssize_t debug_cow_store(struct kobject *kobj,
			       struct kobj_attribute *attr,
			       const char *buf, size_t count)
{
309
	return single_hugepage_flag_store(kobj, attr, buf, count,
310 311 312 313 314 315 316 317 318
				 TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
}
static struct kobj_attribute debug_cow_attr =
	__ATTR(debug_cow, 0644, debug_cow_show, debug_cow_store);
#endif /* CONFIG_DEBUG_VM */

static struct attribute *hugepage_attr[] = {
	&enabled_attr.attr,
	&defrag_attr.attr,
319
	&use_zero_page_attr.attr,
320
	&hpage_pmd_size_attr.attr,
321
#if defined(CONFIG_SHMEM) && defined(CONFIG_TRANSPARENT_HUGE_PAGECACHE)
322 323
	&shmem_enabled_attr.attr,
#endif
324 325 326 327 328 329 330 331
#ifdef CONFIG_DEBUG_VM
	&debug_cow_attr.attr,
#endif
	NULL,
};

static struct attribute_group hugepage_attr_group = {
	.attrs = hugepage_attr,
A
Andrea Arcangeli 已提交
332 333
};

S
Shaohua Li 已提交
334
static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj)
335 336 337
{
	int err;

S
Shaohua Li 已提交
338 339
	*hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
	if (unlikely(!*hugepage_kobj)) {
340
		pr_err("failed to create transparent hugepage kobject\n");
S
Shaohua Li 已提交
341
		return -ENOMEM;
A
Andrea Arcangeli 已提交
342 343
	}

S
Shaohua Li 已提交
344
	err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
A
Andrea Arcangeli 已提交
345
	if (err) {
346
		pr_err("failed to register transparent hugepage group\n");
S
Shaohua Li 已提交
347
		goto delete_obj;
A
Andrea Arcangeli 已提交
348 349
	}

S
Shaohua Li 已提交
350
	err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
A
Andrea Arcangeli 已提交
351
	if (err) {
352
		pr_err("failed to register transparent hugepage group\n");
S
Shaohua Li 已提交
353
		goto remove_hp_group;
A
Andrea Arcangeli 已提交
354
	}
S
Shaohua Li 已提交
355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391

	return 0;

remove_hp_group:
	sysfs_remove_group(*hugepage_kobj, &hugepage_attr_group);
delete_obj:
	kobject_put(*hugepage_kobj);
	return err;
}

static void __init hugepage_exit_sysfs(struct kobject *hugepage_kobj)
{
	sysfs_remove_group(hugepage_kobj, &khugepaged_attr_group);
	sysfs_remove_group(hugepage_kobj, &hugepage_attr_group);
	kobject_put(hugepage_kobj);
}
#else
static inline int hugepage_init_sysfs(struct kobject **hugepage_kobj)
{
	return 0;
}

static inline void hugepage_exit_sysfs(struct kobject *hugepage_kobj)
{
}
#endif /* CONFIG_SYSFS */

static int __init hugepage_init(void)
{
	int err;
	struct kobject *hugepage_kobj;

	if (!has_transparent_hugepage()) {
		transparent_hugepage_flags = 0;
		return -EINVAL;
	}

392 393 394 395 396 397 398 399 400 401
	/*
	 * hugepages can't be allocated by the buddy allocator
	 */
	MAYBE_BUILD_BUG_ON(HPAGE_PMD_ORDER >= MAX_ORDER);
	/*
	 * we use page->mapping and page->index in second tail page
	 * as list_head: assuming THP order >= 2
	 */
	MAYBE_BUILD_BUG_ON(HPAGE_PMD_ORDER < 2);

S
Shaohua Li 已提交
402 403
	err = hugepage_init_sysfs(&hugepage_kobj);
	if (err)
404
		goto err_sysfs;
A
Andrea Arcangeli 已提交
405

406
	err = khugepaged_init();
A
Andrea Arcangeli 已提交
407
	if (err)
408
		goto err_slab;
A
Andrea Arcangeli 已提交
409

410 411 412
	err = register_shrinker(&huge_zero_page_shrinker);
	if (err)
		goto err_hzp_shrinker;
413 414 415
	err = register_shrinker(&deferred_split_shrinker);
	if (err)
		goto err_split_shrinker;
416

417 418 419 420 421
	/*
	 * By default disable transparent hugepages on smaller systems,
	 * where the extra memory used could hurt more than TLB overhead
	 * is likely to save.  The admin can still enable it through /sys.
	 */
422
	if (totalram_pages < (512 << (20 - PAGE_SHIFT))) {
423
		transparent_hugepage_flags = 0;
424 425
		return 0;
	}
426

427
	err = start_stop_khugepaged();
428 429
	if (err)
		goto err_khugepaged;
A
Andrea Arcangeli 已提交
430

S
Shaohua Li 已提交
431
	return 0;
432
err_khugepaged:
433 434
	unregister_shrinker(&deferred_split_shrinker);
err_split_shrinker:
435 436
	unregister_shrinker(&huge_zero_page_shrinker);
err_hzp_shrinker:
437
	khugepaged_destroy();
438
err_slab:
S
Shaohua Li 已提交
439
	hugepage_exit_sysfs(hugepage_kobj);
440
err_sysfs:
A
Andrea Arcangeli 已提交
441
	return err;
442
}
443
subsys_initcall(hugepage_init);
444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470

static int __init setup_transparent_hugepage(char *str)
{
	int ret = 0;
	if (!str)
		goto out;
	if (!strcmp(str, "always")) {
		set_bit(TRANSPARENT_HUGEPAGE_FLAG,
			&transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			  &transparent_hugepage_flags);
		ret = 1;
	} else if (!strcmp(str, "madvise")) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
			  &transparent_hugepage_flags);
		set_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			&transparent_hugepage_flags);
		ret = 1;
	} else if (!strcmp(str, "never")) {
		clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
			  &transparent_hugepage_flags);
		clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
			  &transparent_hugepage_flags);
		ret = 1;
	}
out:
	if (!ret)
471
		pr_warn("transparent_hugepage= cannot parse, ignored\n");
472 473 474 475
	return ret;
}
__setup("transparent_hugepage=", setup_transparent_hugepage);

476
pmd_t maybe_pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma)
477 478 479 480 481 482
{
	if (likely(vma->vm_flags & VM_WRITE))
		pmd = pmd_mkwrite(pmd);
	return pmd;
}

483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502
static inline struct list_head *page_deferred_list(struct page *page)
{
	/*
	 * ->lru in the tail pages is occupied by compound_head.
	 * Let's use ->mapping + ->index in the second tail page as list_head.
	 */
	return (struct list_head *)&page[2].mapping;
}

void prep_transhuge_page(struct page *page)
{
	/*
	 * we use page->mapping and page->indexlru in second tail page
	 * as list_head: assuming THP order >= 2
	 */

	INIT_LIST_HEAD(page_deferred_list(page));
	set_compound_page_dtor(page, TRANSHUGE_PAGE_DTOR);
}

503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545
unsigned long __thp_get_unmapped_area(struct file *filp, unsigned long len,
		loff_t off, unsigned long flags, unsigned long size)
{
	unsigned long addr;
	loff_t off_end = off + len;
	loff_t off_align = round_up(off, size);
	unsigned long len_pad;

	if (off_end <= off_align || (off_end - off_align) < size)
		return 0;

	len_pad = len + size;
	if (len_pad < len || (off + len_pad) < off)
		return 0;

	addr = current->mm->get_unmapped_area(filp, 0, len_pad,
					      off >> PAGE_SHIFT, flags);
	if (IS_ERR_VALUE(addr))
		return 0;

	addr += (off - addr) & (size - 1);
	return addr;
}

unsigned long thp_get_unmapped_area(struct file *filp, unsigned long addr,
		unsigned long len, unsigned long pgoff, unsigned long flags)
{
	loff_t off = (loff_t)pgoff << PAGE_SHIFT;

	if (addr)
		goto out;
	if (!IS_DAX(filp->f_mapping->host) || !IS_ENABLED(CONFIG_FS_DAX_PMD))
		goto out;

	addr = __thp_get_unmapped_area(filp, len, off, flags, PMD_SIZE);
	if (addr)
		return addr;

 out:
	return current->mm->get_unmapped_area(filp, addr, len, pgoff, flags);
}
EXPORT_SYMBOL_GPL(thp_get_unmapped_area);

J
Jan Kara 已提交
546
static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page,
K
Kirill A. Shutemov 已提交
547
		gfp_t gfp)
548
{
J
Jan Kara 已提交
549
	struct vm_area_struct *vma = vmf->vma;
550
	struct mem_cgroup *memcg;
551
	pgtable_t pgtable;
J
Jan Kara 已提交
552
	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
553

554
	VM_BUG_ON_PAGE(!PageCompound(page), page);
555

K
Kirill A. Shutemov 已提交
556
	if (mem_cgroup_try_charge(page, vma->vm_mm, gfp, &memcg, true)) {
557 558 559 560
		put_page(page);
		count_vm_event(THP_FAULT_FALLBACK);
		return VM_FAULT_FALLBACK;
	}
561

K
Kirill A. Shutemov 已提交
562
	pgtable = pte_alloc_one(vma->vm_mm, haddr);
563
	if (unlikely(!pgtable)) {
564
		mem_cgroup_cancel_charge(page, memcg, true);
565
		put_page(page);
566
		return VM_FAULT_OOM;
567
	}
568 569

	clear_huge_page(page, haddr, HPAGE_PMD_NR);
570 571 572 573 574
	/*
	 * The memory barrier inside __SetPageUptodate makes sure that
	 * clear_huge_page writes become visible before the set_pmd_at()
	 * write.
	 */
575 576
	__SetPageUptodate(page);

J
Jan Kara 已提交
577 578 579
	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
	if (unlikely(!pmd_none(*vmf->pmd))) {
		spin_unlock(vmf->ptl);
580
		mem_cgroup_cancel_charge(page, memcg, true);
581
		put_page(page);
K
Kirill A. Shutemov 已提交
582
		pte_free(vma->vm_mm, pgtable);
583 584
	} else {
		pmd_t entry;
585 586 587 588 589

		/* Deliver the page fault to userland */
		if (userfaultfd_missing(vma)) {
			int ret;

J
Jan Kara 已提交
590
			spin_unlock(vmf->ptl);
591
			mem_cgroup_cancel_charge(page, memcg, true);
592
			put_page(page);
K
Kirill A. Shutemov 已提交
593
			pte_free(vma->vm_mm, pgtable);
J
Jan Kara 已提交
594
			ret = handle_userfault(vmf, VM_UFFD_MISSING);
595 596 597 598
			VM_BUG_ON(ret & VM_FAULT_FALLBACK);
			return ret;
		}

599 600
		entry = mk_huge_pmd(page, vma->vm_page_prot);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
601
		page_add_new_anon_rmap(page, vma, haddr, true);
602
		mem_cgroup_commit_charge(page, memcg, false, true);
603
		lru_cache_add_active_or_unevictable(page, vma);
J
Jan Kara 已提交
604 605
		pgtable_trans_huge_deposit(vma->vm_mm, vmf->pmd, pgtable);
		set_pmd_at(vma->vm_mm, haddr, vmf->pmd, entry);
K
Kirill A. Shutemov 已提交
606 607
		add_mm_counter(vma->vm_mm, MM_ANONPAGES, HPAGE_PMD_NR);
		atomic_long_inc(&vma->vm_mm->nr_ptes);
J
Jan Kara 已提交
608
		spin_unlock(vmf->ptl);
609
		count_vm_event(THP_FAULT_ALLOC);
610 611
	}

612
	return 0;
613 614
}

615
/*
616 617 618 619 620 621 622
 * always: directly stall for all thp allocations
 * defer: wake kswapd and fail if not immediately available
 * defer+madvise: wake kswapd and directly stall for MADV_HUGEPAGE, otherwise
 *		  fail if not immediately available
 * madvise: directly stall for MADV_HUGEPAGE, otherwise fail if not immediately
 *	    available
 * never: never stall for any thp allocation
623 624 625
 */
static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma)
{
626
	const bool vma_madvised = !!(vma->vm_flags & VM_HUGEPAGE);
627

628
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
629
		return GFP_TRANSHUGE | (vma_madvised ? 0 : __GFP_NORETRY);
630 631 632 633 634 635 636 637
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
		return GFP_TRANSHUGE_LIGHT | __GFP_KSWAPD_RECLAIM;
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags))
		return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
							     __GFP_KSWAPD_RECLAIM);
	if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
		return GFP_TRANSHUGE_LIGHT | (vma_madvised ? __GFP_DIRECT_RECLAIM :
							     0);
638
	return GFP_TRANSHUGE_LIGHT;
639 640
}

641
/* Caller must hold page table lock. */
642
static bool set_huge_zero_page(pgtable_t pgtable, struct mm_struct *mm,
643
		struct vm_area_struct *vma, unsigned long haddr, pmd_t *pmd,
644
		struct page *zero_page)
645 646
{
	pmd_t entry;
A
Andrew Morton 已提交
647 648
	if (!pmd_none(*pmd))
		return false;
649
	entry = mk_pmd(zero_page, vma->vm_page_prot);
650
	entry = pmd_mkhuge(entry);
651 652
	if (pgtable)
		pgtable_trans_huge_deposit(mm, pmd, pgtable);
653
	set_pmd_at(mm, haddr, pmd, entry);
654
	atomic_long_inc(&mm->nr_ptes);
A
Andrew Morton 已提交
655
	return true;
656 657
}

J
Jan Kara 已提交
658
int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
659
{
J
Jan Kara 已提交
660
	struct vm_area_struct *vma = vmf->vma;
661
	gfp_t gfp;
662
	struct page *page;
J
Jan Kara 已提交
663
	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
664

665
	if (haddr < vma->vm_start || haddr + HPAGE_PMD_SIZE > vma->vm_end)
666
		return VM_FAULT_FALLBACK;
667 668
	if (unlikely(anon_vma_prepare(vma)))
		return VM_FAULT_OOM;
669
	if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
670
		return VM_FAULT_OOM;
J
Jan Kara 已提交
671
	if (!(vmf->flags & FAULT_FLAG_WRITE) &&
K
Kirill A. Shutemov 已提交
672
			!mm_forbids_zeropage(vma->vm_mm) &&
673 674 675 676
			transparent_hugepage_use_zero_page()) {
		pgtable_t pgtable;
		struct page *zero_page;
		bool set;
677
		int ret;
K
Kirill A. Shutemov 已提交
678
		pgtable = pte_alloc_one(vma->vm_mm, haddr);
679
		if (unlikely(!pgtable))
A
Andrea Arcangeli 已提交
680
			return VM_FAULT_OOM;
681
		zero_page = mm_get_huge_zero_page(vma->vm_mm);
682
		if (unlikely(!zero_page)) {
K
Kirill A. Shutemov 已提交
683
			pte_free(vma->vm_mm, pgtable);
684
			count_vm_event(THP_FAULT_FALLBACK);
685
			return VM_FAULT_FALLBACK;
A
Andrea Arcangeli 已提交
686
		}
J
Jan Kara 已提交
687
		vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
688 689
		ret = 0;
		set = false;
J
Jan Kara 已提交
690
		if (pmd_none(*vmf->pmd)) {
691
			if (userfaultfd_missing(vma)) {
J
Jan Kara 已提交
692 693
				spin_unlock(vmf->ptl);
				ret = handle_userfault(vmf, VM_UFFD_MISSING);
694 695
				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
			} else {
K
Kirill A. Shutemov 已提交
696
				set_huge_zero_page(pgtable, vma->vm_mm, vma,
J
Jan Kara 已提交
697 698
						   haddr, vmf->pmd, zero_page);
				spin_unlock(vmf->ptl);
699 700 701
				set = true;
			}
		} else
J
Jan Kara 已提交
702
			spin_unlock(vmf->ptl);
703
		if (!set)
K
Kirill A. Shutemov 已提交
704
			pte_free(vma->vm_mm, pgtable);
705
		return ret;
706
	}
707
	gfp = alloc_hugepage_direct_gfpmask(vma);
708
	page = alloc_hugepage_vma(gfp, vma, haddr, HPAGE_PMD_ORDER);
709 710
	if (unlikely(!page)) {
		count_vm_event(THP_FAULT_FALLBACK);
711
		return VM_FAULT_FALLBACK;
712
	}
713
	prep_transhuge_page(page);
J
Jan Kara 已提交
714
	return __do_huge_pmd_anonymous_page(vmf, page, gfp);
715 716
}

717
static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
718
		pmd_t *pmd, pfn_t pfn, pgprot_t prot, bool write)
M
Matthew Wilcox 已提交
719 720 721 722 723 724
{
	struct mm_struct *mm = vma->vm_mm;
	pmd_t entry;
	spinlock_t *ptl;

	ptl = pmd_lock(mm, pmd);
725 726 727
	entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
	if (pfn_t_devmap(pfn))
		entry = pmd_mkdevmap(entry);
728 729 730
	if (write) {
		entry = pmd_mkyoung(pmd_mkdirty(entry));
		entry = maybe_pmd_mkwrite(entry, vma);
M
Matthew Wilcox 已提交
731
	}
732 733
	set_pmd_at(mm, addr, pmd, entry);
	update_mmu_cache_pmd(vma, addr, pmd);
M
Matthew Wilcox 已提交
734 735 736 737
	spin_unlock(ptl);
}

int vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
738
			pmd_t *pmd, pfn_t pfn, bool write)
M
Matthew Wilcox 已提交
739 740 741 742 743 744 745 746 747 748 749
{
	pgprot_t pgprot = vma->vm_page_prot;
	/*
	 * If we had pmd_special, we could avoid all these restrictions,
	 * but we need to be consistent with PTEs and architectures that
	 * can't support a 'special' bit.
	 */
	BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
	BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
						(VM_PFNMAP|VM_MIXEDMAP));
	BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
750
	BUG_ON(!pfn_t_devmap(pfn));
M
Matthew Wilcox 已提交
751 752 753

	if (addr < vma->vm_start || addr >= vma->vm_end)
		return VM_FAULT_SIGBUS;
754 755 756

	track_pfn_insert(vma, &pgprot, pfn);

757 758
	insert_pfn_pmd(vma, addr, pmd, pfn, pgprot, write);
	return VM_FAULT_NOPAGE;
M
Matthew Wilcox 已提交
759
}
760
EXPORT_SYMBOL_GPL(vmf_insert_pfn_pmd);
M
Matthew Wilcox 已提交
761

762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815
#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
static pud_t maybe_pud_mkwrite(pud_t pud, struct vm_area_struct *vma)
{
	if (likely(vma->vm_flags & VM_WRITE))
		pud = pud_mkwrite(pud);
	return pud;
}

static void insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
		pud_t *pud, pfn_t pfn, pgprot_t prot, bool write)
{
	struct mm_struct *mm = vma->vm_mm;
	pud_t entry;
	spinlock_t *ptl;

	ptl = pud_lock(mm, pud);
	entry = pud_mkhuge(pfn_t_pud(pfn, prot));
	if (pfn_t_devmap(pfn))
		entry = pud_mkdevmap(entry);
	if (write) {
		entry = pud_mkyoung(pud_mkdirty(entry));
		entry = maybe_pud_mkwrite(entry, vma);
	}
	set_pud_at(mm, addr, pud, entry);
	update_mmu_cache_pud(vma, addr, pud);
	spin_unlock(ptl);
}

int vmf_insert_pfn_pud(struct vm_area_struct *vma, unsigned long addr,
			pud_t *pud, pfn_t pfn, bool write)
{
	pgprot_t pgprot = vma->vm_page_prot;
	/*
	 * If we had pud_special, we could avoid all these restrictions,
	 * but we need to be consistent with PTEs and architectures that
	 * can't support a 'special' bit.
	 */
	BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
	BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
						(VM_PFNMAP|VM_MIXEDMAP));
	BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
	BUG_ON(!pfn_t_devmap(pfn));

	if (addr < vma->vm_start || addr >= vma->vm_end)
		return VM_FAULT_SIGBUS;

	track_pfn_insert(vma, &pgprot, pfn);

	insert_pfn_pud(vma, addr, pud, pfn, pgprot, write);
	return VM_FAULT_NOPAGE;
}
EXPORT_SYMBOL_GPL(vmf_insert_pfn_pud);
#endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */

816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843
static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
		pmd_t *pmd)
{
	pmd_t _pmd;

	/*
	 * We should set the dirty bit only for FOLL_WRITE but for now
	 * the dirty bit in the pmd is meaningless.  And if the dirty
	 * bit will become meaningful and we'll only set it with
	 * FOLL_WRITE, an atomic set_bit will be required on the pmd to
	 * set the young bit, instead of the current set_pmd_at.
	 */
	_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
	if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
				pmd, _pmd,  1))
		update_mmu_cache_pmd(vma, addr, pmd);
}

struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
		pmd_t *pmd, int flags)
{
	unsigned long pfn = pmd_pfn(*pmd);
	struct mm_struct *mm = vma->vm_mm;
	struct dev_pagemap *pgmap;
	struct page *page;

	assert_spin_locked(pmd_lockptr(mm, pmd));

844 845 846 847 848 849
	/*
	 * When we COW a devmap PMD entry, we split it into PTEs, so we should
	 * not be in this function with `flags & FOLL_COW` set.
	 */
	WARN_ONCE(flags & FOLL_COW, "mm: In follow_devmap_pmd with FOLL_COW set");

850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878
	if (flags & FOLL_WRITE && !pmd_write(*pmd))
		return NULL;

	if (pmd_present(*pmd) && pmd_devmap(*pmd))
		/* pass */;
	else
		return NULL;

	if (flags & FOLL_TOUCH)
		touch_pmd(vma, addr, pmd);

	/*
	 * device mapped pages can only be returned if the
	 * caller will manage the page reference count.
	 */
	if (!(flags & FOLL_GET))
		return ERR_PTR(-EEXIST);

	pfn += (addr & ~PMD_MASK) >> PAGE_SHIFT;
	pgmap = get_dev_pagemap(pfn, NULL);
	if (!pgmap)
		return ERR_PTR(-EFAULT);
	page = pfn_to_page(pfn);
	get_page(page);
	put_dev_pagemap(pgmap);

	return page;
}

879 880 881 882
int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
		  pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long addr,
		  struct vm_area_struct *vma)
{
883
	spinlock_t *dst_ptl, *src_ptl;
884 885
	struct page *src_page;
	pmd_t pmd;
886
	pgtable_t pgtable = NULL;
887
	int ret = -ENOMEM;
888

889 890 891 892 893 894 895
	/* Skip if can be re-fill on fault */
	if (!vma_is_anonymous(vma))
		return 0;

	pgtable = pte_alloc_one(dst_mm, addr);
	if (unlikely(!pgtable))
		goto out;
896

897 898 899
	dst_ptl = pmd_lock(dst_mm, dst_pmd);
	src_ptl = pmd_lockptr(src_mm, src_pmd);
	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
900 901 902

	ret = -EAGAIN;
	pmd = *src_pmd;
903
	if (unlikely(!pmd_trans_huge(pmd))) {
904 905 906
		pte_free(dst_mm, pgtable);
		goto out_unlock;
	}
907
	/*
908
	 * When page table lock is held, the huge zero pmd should not be
909 910 911 912
	 * under splitting since we don't split the page itself, only pmd to
	 * a page table.
	 */
	if (is_huge_zero_pmd(pmd)) {
913
		struct page *zero_page;
914 915 916 917 918
		/*
		 * get_huge_zero_page() will never allocate a new page here,
		 * since we already have a zero page to copy. It just takes a
		 * reference.
		 */
919
		zero_page = mm_get_huge_zero_page(dst_mm);
920
		set_huge_zero_page(pgtable, dst_mm, vma, addr, dst_pmd,
921
				zero_page);
922 923 924
		ret = 0;
		goto out_unlock;
	}
925

926 927 928 929 930 931 932
	src_page = pmd_page(pmd);
	VM_BUG_ON_PAGE(!PageHead(src_page), src_page);
	get_page(src_page);
	page_dup_rmap(src_page, true);
	add_mm_counter(dst_mm, MM_ANONPAGES, HPAGE_PMD_NR);
	atomic_long_inc(&dst_mm->nr_ptes);
	pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable);
933 934 935 936 937 938 939

	pmdp_set_wrprotect(src_mm, addr, src_pmd);
	pmd = pmd_mkold(pmd_wrprotect(pmd));
	set_pmd_at(dst_mm, addr, dst_pmd, pmd);

	ret = 0;
out_unlock:
940 941
	spin_unlock(src_ptl);
	spin_unlock(dst_ptl);
942 943 944 945
out:
	return ret;
}

946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062
#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
static void touch_pud(struct vm_area_struct *vma, unsigned long addr,
		pud_t *pud)
{
	pud_t _pud;

	/*
	 * We should set the dirty bit only for FOLL_WRITE but for now
	 * the dirty bit in the pud is meaningless.  And if the dirty
	 * bit will become meaningful and we'll only set it with
	 * FOLL_WRITE, an atomic set_bit will be required on the pud to
	 * set the young bit, instead of the current set_pud_at.
	 */
	_pud = pud_mkyoung(pud_mkdirty(*pud));
	if (pudp_set_access_flags(vma, addr & HPAGE_PUD_MASK,
				pud, _pud,  1))
		update_mmu_cache_pud(vma, addr, pud);
}

struct page *follow_devmap_pud(struct vm_area_struct *vma, unsigned long addr,
		pud_t *pud, int flags)
{
	unsigned long pfn = pud_pfn(*pud);
	struct mm_struct *mm = vma->vm_mm;
	struct dev_pagemap *pgmap;
	struct page *page;

	assert_spin_locked(pud_lockptr(mm, pud));

	if (flags & FOLL_WRITE && !pud_write(*pud))
		return NULL;

	if (pud_present(*pud) && pud_devmap(*pud))
		/* pass */;
	else
		return NULL;

	if (flags & FOLL_TOUCH)
		touch_pud(vma, addr, pud);

	/*
	 * device mapped pages can only be returned if the
	 * caller will manage the page reference count.
	 */
	if (!(flags & FOLL_GET))
		return ERR_PTR(-EEXIST);

	pfn += (addr & ~PUD_MASK) >> PAGE_SHIFT;
	pgmap = get_dev_pagemap(pfn, NULL);
	if (!pgmap)
		return ERR_PTR(-EFAULT);
	page = pfn_to_page(pfn);
	get_page(page);
	put_dev_pagemap(pgmap);

	return page;
}

int copy_huge_pud(struct mm_struct *dst_mm, struct mm_struct *src_mm,
		  pud_t *dst_pud, pud_t *src_pud, unsigned long addr,
		  struct vm_area_struct *vma)
{
	spinlock_t *dst_ptl, *src_ptl;
	pud_t pud;
	int ret;

	dst_ptl = pud_lock(dst_mm, dst_pud);
	src_ptl = pud_lockptr(src_mm, src_pud);
	spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);

	ret = -EAGAIN;
	pud = *src_pud;
	if (unlikely(!pud_trans_huge(pud) && !pud_devmap(pud)))
		goto out_unlock;

	/*
	 * When page table lock is held, the huge zero pud should not be
	 * under splitting since we don't split the page itself, only pud to
	 * a page table.
	 */
	if (is_huge_zero_pud(pud)) {
		/* No huge zero pud yet */
	}

	pudp_set_wrprotect(src_mm, addr, src_pud);
	pud = pud_mkold(pud_wrprotect(pud));
	set_pud_at(dst_mm, addr, dst_pud, pud);

	ret = 0;
out_unlock:
	spin_unlock(src_ptl);
	spin_unlock(dst_ptl);
	return ret;
}

void huge_pud_set_accessed(struct vm_fault *vmf, pud_t orig_pud)
{
	pud_t entry;
	unsigned long haddr;
	bool write = vmf->flags & FAULT_FLAG_WRITE;

	vmf->ptl = pud_lock(vmf->vma->vm_mm, vmf->pud);
	if (unlikely(!pud_same(*vmf->pud, orig_pud)))
		goto unlock;

	entry = pud_mkyoung(orig_pud);
	if (write)
		entry = pud_mkdirty(entry);
	haddr = vmf->address & HPAGE_PUD_MASK;
	if (pudp_set_access_flags(vmf->vma, haddr, vmf->pud, entry, write))
		update_mmu_cache_pud(vmf->vma, vmf->address, vmf->pud);

unlock:
	spin_unlock(vmf->ptl);
}
#endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */

J
Jan Kara 已提交
1063
void huge_pmd_set_accessed(struct vm_fault *vmf, pmd_t orig_pmd)
1064 1065 1066
{
	pmd_t entry;
	unsigned long haddr;
1067
	bool write = vmf->flags & FAULT_FLAG_WRITE;
1068

J
Jan Kara 已提交
1069 1070
	vmf->ptl = pmd_lock(vmf->vma->vm_mm, vmf->pmd);
	if (unlikely(!pmd_same(*vmf->pmd, orig_pmd)))
1071 1072 1073
		goto unlock;

	entry = pmd_mkyoung(orig_pmd);
1074 1075
	if (write)
		entry = pmd_mkdirty(entry);
J
Jan Kara 已提交
1076
	haddr = vmf->address & HPAGE_PMD_MASK;
1077
	if (pmdp_set_access_flags(vmf->vma, haddr, vmf->pmd, entry, write))
J
Jan Kara 已提交
1078
		update_mmu_cache_pmd(vmf->vma, vmf->address, vmf->pmd);
1079 1080

unlock:
J
Jan Kara 已提交
1081
	spin_unlock(vmf->ptl);
1082 1083
}

J
Jan Kara 已提交
1084
static int do_huge_pmd_wp_page_fallback(struct vm_fault *vmf, pmd_t orig_pmd,
K
Kirill A. Shutemov 已提交
1085
		struct page *page)
1086
{
J
Jan Kara 已提交
1087 1088
	struct vm_area_struct *vma = vmf->vma;
	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
1089
	struct mem_cgroup *memcg;
1090 1091 1092 1093
	pgtable_t pgtable;
	pmd_t _pmd;
	int ret = 0, i;
	struct page **pages;
1094 1095
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
1096 1097 1098 1099 1100 1101 1102 1103 1104

	pages = kmalloc(sizeof(struct page *) * HPAGE_PMD_NR,
			GFP_KERNEL);
	if (unlikely(!pages)) {
		ret |= VM_FAULT_OOM;
		goto out;
	}

	for (i = 0; i < HPAGE_PMD_NR; i++) {
M
Michal Hocko 已提交
1105
		pages[i] = alloc_page_vma_node(GFP_HIGHUSER_MOVABLE, vma,
J
Jan Kara 已提交
1106
					       vmf->address, page_to_nid(page));
A
Andrea Arcangeli 已提交
1107
		if (unlikely(!pages[i] ||
K
Kirill A. Shutemov 已提交
1108 1109
			     mem_cgroup_try_charge(pages[i], vma->vm_mm,
				     GFP_KERNEL, &memcg, false))) {
A
Andrea Arcangeli 已提交
1110
			if (pages[i])
1111
				put_page(pages[i]);
A
Andrea Arcangeli 已提交
1112
			while (--i >= 0) {
1113 1114
				memcg = (void *)page_private(pages[i]);
				set_page_private(pages[i], 0);
1115 1116
				mem_cgroup_cancel_charge(pages[i], memcg,
						false);
A
Andrea Arcangeli 已提交
1117 1118
				put_page(pages[i]);
			}
1119 1120 1121 1122
			kfree(pages);
			ret |= VM_FAULT_OOM;
			goto out;
		}
1123
		set_page_private(pages[i], (unsigned long)memcg);
1124 1125 1126 1127
	}

	for (i = 0; i < HPAGE_PMD_NR; i++) {
		copy_user_highpage(pages[i], page + i,
1128
				   haddr + PAGE_SIZE * i, vma);
1129 1130 1131 1132
		__SetPageUptodate(pages[i]);
		cond_resched();
	}

1133 1134
	mmun_start = haddr;
	mmun_end   = haddr + HPAGE_PMD_SIZE;
K
Kirill A. Shutemov 已提交
1135
	mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end);
1136

J
Jan Kara 已提交
1137 1138
	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
	if (unlikely(!pmd_same(*vmf->pmd, orig_pmd)))
1139
		goto out_free_pages;
1140
	VM_BUG_ON_PAGE(!PageHead(page), page);
1141

J
Jan Kara 已提交
1142
	pmdp_huge_clear_flush_notify(vma, haddr, vmf->pmd);
1143 1144
	/* leave pmd empty until pte is filled */

J
Jan Kara 已提交
1145
	pgtable = pgtable_trans_huge_withdraw(vma->vm_mm, vmf->pmd);
K
Kirill A. Shutemov 已提交
1146
	pmd_populate(vma->vm_mm, &_pmd, pgtable);
1147 1148

	for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
K
Kirill A. Shutemov 已提交
1149
		pte_t entry;
1150 1151
		entry = mk_pte(pages[i], vma->vm_page_prot);
		entry = maybe_mkwrite(pte_mkdirty(entry), vma);
1152 1153
		memcg = (void *)page_private(pages[i]);
		set_page_private(pages[i], 0);
J
Jan Kara 已提交
1154
		page_add_new_anon_rmap(pages[i], vmf->vma, haddr, false);
1155
		mem_cgroup_commit_charge(pages[i], memcg, false, false);
1156
		lru_cache_add_active_or_unevictable(pages[i], vma);
J
Jan Kara 已提交
1157 1158 1159 1160
		vmf->pte = pte_offset_map(&_pmd, haddr);
		VM_BUG_ON(!pte_none(*vmf->pte));
		set_pte_at(vma->vm_mm, haddr, vmf->pte, entry);
		pte_unmap(vmf->pte);
1161 1162 1163 1164
	}
	kfree(pages);

	smp_wmb(); /* make pte visible before pmd */
J
Jan Kara 已提交
1165
	pmd_populate(vma->vm_mm, vmf->pmd, pgtable);
1166
	page_remove_rmap(page, true);
J
Jan Kara 已提交
1167
	spin_unlock(vmf->ptl);
1168

K
Kirill A. Shutemov 已提交
1169
	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
1170

1171 1172 1173 1174 1175 1176 1177
	ret |= VM_FAULT_WRITE;
	put_page(page);

out:
	return ret;

out_free_pages:
J
Jan Kara 已提交
1178
	spin_unlock(vmf->ptl);
K
Kirill A. Shutemov 已提交
1179
	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
A
Andrea Arcangeli 已提交
1180
	for (i = 0; i < HPAGE_PMD_NR; i++) {
1181 1182
		memcg = (void *)page_private(pages[i]);
		set_page_private(pages[i], 0);
1183
		mem_cgroup_cancel_charge(pages[i], memcg, false);
1184
		put_page(pages[i]);
A
Andrea Arcangeli 已提交
1185
	}
1186 1187 1188 1189
	kfree(pages);
	goto out;
}

J
Jan Kara 已提交
1190
int do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd)
1191
{
J
Jan Kara 已提交
1192
	struct vm_area_struct *vma = vmf->vma;
1193
	struct page *page = NULL, *new_page;
1194
	struct mem_cgroup *memcg;
J
Jan Kara 已提交
1195
	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
1196 1197
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
1198
	gfp_t huge_gfp;			/* for allocation and charge */
K
Kirill A. Shutemov 已提交
1199
	int ret = 0;
1200

J
Jan Kara 已提交
1201
	vmf->ptl = pmd_lockptr(vma->vm_mm, vmf->pmd);
1202
	VM_BUG_ON_VMA(!vma->anon_vma, vma);
1203 1204
	if (is_huge_zero_pmd(orig_pmd))
		goto alloc;
J
Jan Kara 已提交
1205 1206
	spin_lock(vmf->ptl);
	if (unlikely(!pmd_same(*vmf->pmd, orig_pmd)))
1207 1208 1209
		goto out_unlock;

	page = pmd_page(orig_pmd);
1210
	VM_BUG_ON_PAGE(!PageCompound(page) || !PageHead(page), page);
1211 1212
	/*
	 * We can only reuse the page if nobody else maps the huge page or it's
1213
	 * part.
1214
	 */
1215
	if (page_trans_huge_mapcount(page, NULL) == 1) {
1216 1217 1218
		pmd_t entry;
		entry = pmd_mkyoung(orig_pmd);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
J
Jan Kara 已提交
1219 1220
		if (pmdp_set_access_flags(vma, haddr, vmf->pmd, entry,  1))
			update_mmu_cache_pmd(vma, vmf->address, vmf->pmd);
1221 1222 1223
		ret |= VM_FAULT_WRITE;
		goto out_unlock;
	}
1224
	get_page(page);
J
Jan Kara 已提交
1225
	spin_unlock(vmf->ptl);
1226
alloc:
1227
	if (transparent_hugepage_enabled(vma) &&
1228
	    !transparent_hugepage_debug_cow()) {
1229
		huge_gfp = alloc_hugepage_direct_gfpmask(vma);
1230
		new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
1231
	} else
1232 1233
		new_page = NULL;

1234 1235 1236
	if (likely(new_page)) {
		prep_transhuge_page(new_page);
	} else {
1237
		if (!page) {
J
Jan Kara 已提交
1238
			split_huge_pmd(vma, vmf->pmd, vmf->address);
1239
			ret |= VM_FAULT_FALLBACK;
1240
		} else {
J
Jan Kara 已提交
1241
			ret = do_huge_pmd_wp_page_fallback(vmf, orig_pmd, page);
1242
			if (ret & VM_FAULT_OOM) {
J
Jan Kara 已提交
1243
				split_huge_pmd(vma, vmf->pmd, vmf->address);
1244 1245
				ret |= VM_FAULT_FALLBACK;
			}
1246
			put_page(page);
1247
		}
1248
		count_vm_event(THP_FAULT_FALLBACK);
1249 1250 1251
		goto out;
	}

K
Kirill A. Shutemov 已提交
1252 1253
	if (unlikely(mem_cgroup_try_charge(new_page, vma->vm_mm,
					huge_gfp, &memcg, true))) {
A
Andrea Arcangeli 已提交
1254
		put_page(new_page);
J
Jan Kara 已提交
1255
		split_huge_pmd(vma, vmf->pmd, vmf->address);
K
Kirill A. Shutemov 已提交
1256
		if (page)
1257
			put_page(page);
1258
		ret |= VM_FAULT_FALLBACK;
1259
		count_vm_event(THP_FAULT_FALLBACK);
A
Andrea Arcangeli 已提交
1260 1261 1262
		goto out;
	}

1263 1264
	count_vm_event(THP_FAULT_ALLOC);

1265
	if (!page)
1266 1267 1268
		clear_huge_page(new_page, haddr, HPAGE_PMD_NR);
	else
		copy_user_huge_page(new_page, page, haddr, vma, HPAGE_PMD_NR);
1269 1270
	__SetPageUptodate(new_page);

1271 1272
	mmun_start = haddr;
	mmun_end   = haddr + HPAGE_PMD_SIZE;
K
Kirill A. Shutemov 已提交
1273
	mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end);
1274

J
Jan Kara 已提交
1275
	spin_lock(vmf->ptl);
1276
	if (page)
1277
		put_page(page);
J
Jan Kara 已提交
1278 1279
	if (unlikely(!pmd_same(*vmf->pmd, orig_pmd))) {
		spin_unlock(vmf->ptl);
1280
		mem_cgroup_cancel_charge(new_page, memcg, true);
1281
		put_page(new_page);
1282
		goto out_mn;
A
Andrea Arcangeli 已提交
1283
	} else {
1284
		pmd_t entry;
1285 1286
		entry = mk_huge_pmd(new_page, vma->vm_page_prot);
		entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
J
Jan Kara 已提交
1287
		pmdp_huge_clear_flush_notify(vma, haddr, vmf->pmd);
1288
		page_add_new_anon_rmap(new_page, vma, haddr, true);
1289
		mem_cgroup_commit_charge(new_page, memcg, false, true);
1290
		lru_cache_add_active_or_unevictable(new_page, vma);
J
Jan Kara 已提交
1291 1292
		set_pmd_at(vma->vm_mm, haddr, vmf->pmd, entry);
		update_mmu_cache_pmd(vma, vmf->address, vmf->pmd);
1293
		if (!page) {
K
Kirill A. Shutemov 已提交
1294
			add_mm_counter(vma->vm_mm, MM_ANONPAGES, HPAGE_PMD_NR);
1295
		} else {
1296
			VM_BUG_ON_PAGE(!PageHead(page), page);
1297
			page_remove_rmap(page, true);
1298 1299
			put_page(page);
		}
1300 1301
		ret |= VM_FAULT_WRITE;
	}
J
Jan Kara 已提交
1302
	spin_unlock(vmf->ptl);
1303
out_mn:
K
Kirill A. Shutemov 已提交
1304
	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
1305 1306
out:
	return ret;
1307
out_unlock:
J
Jan Kara 已提交
1308
	spin_unlock(vmf->ptl);
1309
	return ret;
1310 1311
}

1312 1313 1314 1315 1316 1317 1318 1319 1320 1321
/*
 * FOLL_FORCE can write to even unwritable pmd's, but only
 * after we've gone through a COW cycle and they are dirty.
 */
static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
{
	return pmd_write(pmd) ||
	       ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
}

1322
struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
1323 1324 1325 1326
				   unsigned long addr,
				   pmd_t *pmd,
				   unsigned int flags)
{
1327
	struct mm_struct *mm = vma->vm_mm;
1328 1329
	struct page *page = NULL;

1330
	assert_spin_locked(pmd_lockptr(mm, pmd));
1331

1332
	if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags))
1333 1334
		goto out;

1335 1336 1337 1338
	/* Avoid dumping huge zero page */
	if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
		return ERR_PTR(-EFAULT);

1339
	/* Full NUMA hinting faults to serialise migration in fault paths */
1340
	if ((flags & FOLL_NUMA) && pmd_protnone(*pmd))
1341 1342
		goto out;

1343
	page = pmd_page(*pmd);
1344
	VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
1345 1346
	if (flags & FOLL_TOUCH)
		touch_pmd(vma, addr, pmd);
E
Eric B Munson 已提交
1347
	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
1348 1349 1350 1351
		/*
		 * We don't mlock() pte-mapped THPs. This way we can avoid
		 * leaking mlocked pages into non-VM_LOCKED VMAs.
		 *
1352 1353
		 * For anon THP:
		 *
1354 1355 1356 1357 1358 1359 1360
		 * In most cases the pmd is the only mapping of the page as we
		 * break COW for the mlock() -- see gup_flags |= FOLL_WRITE for
		 * writable private mappings in populate_vma_page_range().
		 *
		 * The only scenario when we have the page shared here is if we
		 * mlocking read-only mapping shared over fork(). We skip
		 * mlocking such pages.
1361 1362 1363 1364 1365 1366
		 *
		 * For file THP:
		 *
		 * We can expect PageDoubleMap() to be stable under page lock:
		 * for file pages we set it in page_add_file_rmap(), which
		 * requires page to be locked.
1367
		 */
1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378

		if (PageAnon(page) && compound_mapcount(page) != 1)
			goto skip_mlock;
		if (PageDoubleMap(page) || !page->mapping)
			goto skip_mlock;
		if (!trylock_page(page))
			goto skip_mlock;
		lru_add_drain();
		if (page->mapping && !PageDoubleMap(page))
			mlock_vma_page(page);
		unlock_page(page);
1379
	}
1380
skip_mlock:
1381
	page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
1382
	VM_BUG_ON_PAGE(!PageCompound(page) && !is_zone_device_page(page), page);
1383
	if (flags & FOLL_GET)
1384
		get_page(page);
1385 1386 1387 1388 1389

out:
	return page;
}

1390
/* NUMA hinting page fault entry point for trans huge pmds */
J
Jan Kara 已提交
1391
int do_huge_pmd_numa_page(struct vm_fault *vmf, pmd_t pmd)
1392
{
J
Jan Kara 已提交
1393
	struct vm_area_struct *vma = vmf->vma;
1394
	struct anon_vma *anon_vma = NULL;
1395
	struct page *page;
J
Jan Kara 已提交
1396
	unsigned long haddr = vmf->address & HPAGE_PMD_MASK;
1397
	int page_nid = -1, this_nid = numa_node_id();
1398
	int target_nid, last_cpupid = -1;
1399 1400
	bool page_locked;
	bool migrated = false;
1401
	bool was_writable;
1402
	int flags = 0;
1403

J
Jan Kara 已提交
1404 1405
	vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
	if (unlikely(!pmd_same(pmd, *vmf->pmd)))
1406 1407
		goto out_unlock;

1408 1409 1410 1411 1412
	/*
	 * If there are potential migrations, wait for completion and retry
	 * without disrupting NUMA hinting information. Do not relock and
	 * check_same as the page may no longer be mapped.
	 */
J
Jan Kara 已提交
1413 1414 1415
	if (unlikely(pmd_trans_migrating(*vmf->pmd))) {
		page = pmd_page(*vmf->pmd);
		spin_unlock(vmf->ptl);
1416
		wait_on_page_locked(page);
1417 1418 1419
		goto out;
	}

1420
	page = pmd_page(pmd);
1421
	BUG_ON(is_huge_zero_page(page));
1422
	page_nid = page_to_nid(page);
1423
	last_cpupid = page_cpupid_last(page);
1424
	count_vm_numa_event(NUMA_HINT_FAULTS);
1425
	if (page_nid == this_nid) {
1426
		count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
1427 1428
		flags |= TNF_FAULT_LOCAL;
	}
1429

1430
	/* See similar comment in do_numa_page for explanation */
1431
	if (!pmd_savedwrite(pmd))
1432 1433
		flags |= TNF_NO_GROUP;

1434 1435 1436 1437
	/*
	 * Acquire the page lock to serialise THP migrations but avoid dropping
	 * page_table_lock if at all possible
	 */
1438 1439 1440 1441
	page_locked = trylock_page(page);
	target_nid = mpol_misplaced(page, vma, haddr);
	if (target_nid == -1) {
		/* If the page was locked, there are no parallel migrations */
1442
		if (page_locked)
1443
			goto clear_pmdnuma;
1444
	}
1445

1446
	/* Migration could have started since the pmd_trans_migrating check */
1447
	if (!page_locked) {
J
Jan Kara 已提交
1448
		spin_unlock(vmf->ptl);
1449
		wait_on_page_locked(page);
1450
		page_nid = -1;
1451 1452 1453
		goto out;
	}

1454 1455 1456 1457
	/*
	 * Page is misplaced. Page lock serialises migrations. Acquire anon_vma
	 * to serialises splits
	 */
1458
	get_page(page);
J
Jan Kara 已提交
1459
	spin_unlock(vmf->ptl);
1460
	anon_vma = page_lock_anon_vma_read(page);
1461

P
Peter Zijlstra 已提交
1462
	/* Confirm the PMD did not change while page_table_lock was released */
J
Jan Kara 已提交
1463 1464
	spin_lock(vmf->ptl);
	if (unlikely(!pmd_same(pmd, *vmf->pmd))) {
1465 1466
		unlock_page(page);
		put_page(page);
1467
		page_nid = -1;
1468
		goto out_unlock;
1469
	}
1470

1471 1472 1473 1474 1475 1476 1477
	/* Bail if we fail to protect against THP splits for any reason */
	if (unlikely(!anon_vma)) {
		put_page(page);
		page_nid = -1;
		goto clear_pmdnuma;
	}

1478 1479
	/*
	 * Migrate the THP to the requested node, returns with page unlocked
1480
	 * and access rights restored.
1481
	 */
J
Jan Kara 已提交
1482
	spin_unlock(vmf->ptl);
K
Kirill A. Shutemov 已提交
1483
	migrated = migrate_misplaced_transhuge_page(vma->vm_mm, vma,
J
Jan Kara 已提交
1484
				vmf->pmd, pmd, vmf->address, page, target_nid);
1485 1486
	if (migrated) {
		flags |= TNF_MIGRATED;
1487
		page_nid = target_nid;
1488 1489
	} else
		flags |= TNF_MIGRATE_FAIL;
1490

1491
	goto out;
1492
clear_pmdnuma:
1493
	BUG_ON(!PageLocked(page));
1494
	was_writable = pmd_savedwrite(pmd);
1495
	pmd = pmd_modify(pmd, vma->vm_page_prot);
1496
	pmd = pmd_mkyoung(pmd);
1497 1498
	if (was_writable)
		pmd = pmd_mkwrite(pmd);
J
Jan Kara 已提交
1499 1500
	set_pmd_at(vma->vm_mm, haddr, vmf->pmd, pmd);
	update_mmu_cache_pmd(vma, vmf->address, vmf->pmd);
1501
	unlock_page(page);
1502
out_unlock:
J
Jan Kara 已提交
1503
	spin_unlock(vmf->ptl);
1504 1505 1506 1507 1508

out:
	if (anon_vma)
		page_unlock_anon_vma_read(anon_vma);

1509
	if (page_nid != -1)
J
Jan Kara 已提交
1510
		task_numa_fault(last_cpupid, page_nid, HPAGE_PMD_NR,
1511
				flags);
1512

1513 1514 1515
	return 0;
}

1516 1517 1518 1519 1520
/*
 * Return true if we do MADV_FREE successfully on entire pmd page.
 * Otherwise, return false.
 */
bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
1521 1522 1523 1524 1525 1526
		pmd_t *pmd, unsigned long addr, unsigned long next)
{
	spinlock_t *ptl;
	pmd_t orig_pmd;
	struct page *page;
	struct mm_struct *mm = tlb->mm;
1527
	bool ret = false;
1528

1529 1530
	tlb_remove_check_page_size_change(tlb, HPAGE_PMD_SIZE);

1531 1532
	ptl = pmd_trans_huge_lock(pmd, vma);
	if (!ptl)
1533
		goto out_unlocked;
1534 1535

	orig_pmd = *pmd;
1536
	if (is_huge_zero_pmd(orig_pmd))
1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556
		goto out;

	page = pmd_page(orig_pmd);
	/*
	 * If other processes are mapping this page, we couldn't discard
	 * the page unless they all do MADV_FREE so let's skip the page.
	 */
	if (page_mapcount(page) != 1)
		goto out;

	if (!trylock_page(page))
		goto out;

	/*
	 * If user want to discard part-pages of THP, split it so MADV_FREE
	 * will deactivate only them.
	 */
	if (next - addr != HPAGE_PMD_SIZE) {
		get_page(page);
		spin_unlock(ptl);
1557
		split_huge_page(page);
1558 1559 1560 1561 1562 1563 1564 1565 1566 1567
		put_page(page);
		unlock_page(page);
		goto out_unlocked;
	}

	if (PageDirty(page))
		ClearPageDirty(page);
	unlock_page(page);

	if (pmd_young(orig_pmd) || pmd_dirty(orig_pmd)) {
1568
		pmdp_invalidate(vma, addr, pmd);
1569 1570 1571 1572 1573 1574
		orig_pmd = pmd_mkold(orig_pmd);
		orig_pmd = pmd_mkclean(orig_pmd);

		set_pmd_at(mm, addr, pmd, orig_pmd);
		tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
	}
S
Shaohua Li 已提交
1575 1576

	mark_page_lazyfree(page);
1577
	ret = true;
1578 1579 1580 1581 1582 1583
out:
	spin_unlock(ptl);
out_unlocked:
	return ret;
}

1584 1585 1586 1587 1588 1589 1590 1591 1592
static inline void zap_deposited_table(struct mm_struct *mm, pmd_t *pmd)
{
	pgtable_t pgtable;

	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
	pte_free(mm, pgtable);
	atomic_long_dec(&mm->nr_ptes);
}

1593
int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
S
Shaohua Li 已提交
1594
		 pmd_t *pmd, unsigned long addr)
1595
{
1596
	pmd_t orig_pmd;
1597
	spinlock_t *ptl;
1598

1599 1600
	tlb_remove_check_page_size_change(tlb, HPAGE_PMD_SIZE);

1601 1602
	ptl = __pmd_trans_huge_lock(pmd, vma);
	if (!ptl)
1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615
		return 0;
	/*
	 * For architectures like ppc64 we look at deposited pgtable
	 * when calling pmdp_huge_get_and_clear. So do the
	 * pgtable_trans_huge_withdraw after finishing pmdp related
	 * operations.
	 */
	orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
			tlb->fullmm);
	tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
	if (vma_is_dax(vma)) {
		spin_unlock(ptl);
		if (is_huge_zero_pmd(orig_pmd))
1616
			tlb_remove_page_size(tlb, pmd_page(orig_pmd), HPAGE_PMD_SIZE);
1617 1618 1619 1620
	} else if (is_huge_zero_pmd(orig_pmd)) {
		pte_free(tlb->mm, pgtable_trans_huge_withdraw(tlb->mm, pmd));
		atomic_long_dec(&tlb->mm->nr_ptes);
		spin_unlock(ptl);
1621
		tlb_remove_page_size(tlb, pmd_page(orig_pmd), HPAGE_PMD_SIZE);
1622 1623
	} else {
		struct page *page = pmd_page(orig_pmd);
1624
		page_remove_rmap(page, true);
1625 1626
		VM_BUG_ON_PAGE(page_mapcount(page) < 0, page);
		VM_BUG_ON_PAGE(!PageHead(page), page);
1627 1628 1629 1630 1631 1632 1633
		if (PageAnon(page)) {
			pgtable_t pgtable;
			pgtable = pgtable_trans_huge_withdraw(tlb->mm, pmd);
			pte_free(tlb->mm, pgtable);
			atomic_long_dec(&tlb->mm->nr_ptes);
			add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
		} else {
1634 1635
			if (arch_needs_pgtable_deposit())
				zap_deposited_table(tlb->mm, pmd);
1636 1637
			add_mm_counter(tlb->mm, MM_FILEPAGES, -HPAGE_PMD_NR);
		}
1638
		spin_unlock(ptl);
1639
		tlb_remove_page_size(tlb, page, HPAGE_PMD_SIZE);
1640
	}
1641
	return 1;
1642 1643
}

1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658
#ifndef pmd_move_must_withdraw
static inline int pmd_move_must_withdraw(spinlock_t *new_pmd_ptl,
					 spinlock_t *old_pmd_ptl,
					 struct vm_area_struct *vma)
{
	/*
	 * With split pmd lock we also need to move preallocated
	 * PTE page table if new_pmd is on different PMD page table.
	 *
	 * We also don't deposit and withdraw tables for file pages.
	 */
	return (new_pmd_ptl != old_pmd_ptl) && vma_is_anonymous(vma);
}
#endif

1659
bool move_huge_pmd(struct vm_area_struct *vma, unsigned long old_addr,
1660
		  unsigned long new_addr, unsigned long old_end,
1661
		  pmd_t *old_pmd, pmd_t *new_pmd, bool *need_flush)
1662
{
1663
	spinlock_t *old_ptl, *new_ptl;
1664 1665
	pmd_t pmd;
	struct mm_struct *mm = vma->vm_mm;
1666
	bool force_flush = false;
1667 1668 1669

	if ((old_addr & ~HPAGE_PMD_MASK) ||
	    (new_addr & ~HPAGE_PMD_MASK) ||
1670
	    old_end - old_addr < HPAGE_PMD_SIZE)
1671
		return false;
1672 1673 1674 1675 1676 1677 1678

	/*
	 * The destination pmd shouldn't be established, free_pgtables()
	 * should have release it.
	 */
	if (WARN_ON(!pmd_none(*new_pmd))) {
		VM_BUG_ON(pmd_trans_huge(*new_pmd));
1679
		return false;
1680 1681
	}

1682 1683 1684 1685
	/*
	 * We don't have to worry about the ordering of src and dst
	 * ptlocks because exclusive mmap_sem prevents deadlock.
	 */
1686 1687
	old_ptl = __pmd_trans_huge_lock(old_pmd, vma);
	if (old_ptl) {
1688 1689 1690
		new_ptl = pmd_lockptr(mm, new_pmd);
		if (new_ptl != old_ptl)
			spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
1691
		pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
1692 1693
		if (pmd_present(pmd) && pmd_dirty(pmd))
			force_flush = true;
1694
		VM_BUG_ON(!pmd_none(*new_pmd));
1695

1696
		if (pmd_move_must_withdraw(new_ptl, old_ptl, vma)) {
1697
			pgtable_t pgtable;
1698 1699 1700
			pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
			pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
		}
1701 1702 1703
		set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd));
		if (new_ptl != old_ptl)
			spin_unlock(new_ptl);
1704 1705 1706 1707
		if (force_flush)
			flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE);
		else
			*need_flush = true;
1708
		spin_unlock(old_ptl);
1709
		return true;
1710
	}
1711
	return false;
1712 1713
}

1714 1715 1716 1717 1718 1719
/*
 * Returns
 *  - 0 if PMD could not be locked
 *  - 1 if PMD was locked but protections unchange and TLB flush unnecessary
 *  - HPAGE_PMD_NR is protections changed and TLB flush necessary
 */
1720
int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
1721
		unsigned long addr, pgprot_t newprot, int prot_numa)
1722 1723
{
	struct mm_struct *mm = vma->vm_mm;
1724
	spinlock_t *ptl;
1725 1726 1727
	pmd_t entry;
	bool preserve_write;
	int ret;
1728

1729
	ptl = __pmd_trans_huge_lock(pmd, vma);
1730 1731
	if (!ptl)
		return 0;
1732

1733 1734
	preserve_write = prot_numa && pmd_write(*pmd);
	ret = 1;
1735

1736 1737 1738 1739 1740 1741 1742
	/*
	 * Avoid trapping faults against the zero page. The read-only
	 * data is likely to be read-cached on the local CPU and
	 * local/remote hits to the zero page are not interesting.
	 */
	if (prot_numa && is_huge_zero_pmd(*pmd))
		goto unlock;
1743

1744 1745 1746
	if (prot_numa && pmd_protnone(*pmd))
		goto unlock;

1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779
	/*
	 * In case prot_numa, we are under down_read(mmap_sem). It's critical
	 * to not clear pmd intermittently to avoid race with MADV_DONTNEED
	 * which is also under down_read(mmap_sem):
	 *
	 *	CPU0:				CPU1:
	 *				change_huge_pmd(prot_numa=1)
	 *				 pmdp_huge_get_and_clear_notify()
	 * madvise_dontneed()
	 *  zap_pmd_range()
	 *   pmd_trans_huge(*pmd) == 0 (without ptl)
	 *   // skip the pmd
	 *				 set_pmd_at();
	 *				 // pmd is re-established
	 *
	 * The race makes MADV_DONTNEED miss the huge pmd and don't clear it
	 * which may break userspace.
	 *
	 * pmdp_invalidate() is required to make sure we don't miss
	 * dirty/young flags set by hardware.
	 */
	entry = *pmd;
	pmdp_invalidate(vma, addr, pmd);

	/*
	 * Recover dirty/young flags.  It relies on pmdp_invalidate to not
	 * corrupt them.
	 */
	if (pmd_dirty(*pmd))
		entry = pmd_mkdirty(entry);
	if (pmd_young(*pmd))
		entry = pmd_mkyoung(entry);

1780 1781 1782 1783 1784 1785 1786 1787
	entry = pmd_modify(entry, newprot);
	if (preserve_write)
		entry = pmd_mk_savedwrite(entry);
	ret = HPAGE_PMD_NR;
	set_pmd_at(mm, addr, pmd, entry);
	BUG_ON(vma_is_anonymous(vma) && !preserve_write && pmd_write(entry));
unlock:
	spin_unlock(ptl);
1788 1789 1790 1791
	return ret;
}

/*
1792
 * Returns page table lock pointer if a given pmd maps a thp, NULL otherwise.
1793
 *
1794 1795
 * Note that if it returns page table lock pointer, this routine returns without
 * unlocking page table lock. So callers must unlock it.
1796
 */
1797
spinlock_t *__pmd_trans_huge_lock(pmd_t *pmd, struct vm_area_struct *vma)
1798
{
1799 1800
	spinlock_t *ptl;
	ptl = pmd_lock(vma->vm_mm, pmd);
1801
	if (likely(pmd_trans_huge(*pmd) || pmd_devmap(*pmd)))
1802 1803 1804
		return ptl;
	spin_unlock(ptl);
	return NULL;
1805 1806
}

1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860
/*
 * Returns true if a given pud maps a thp, false otherwise.
 *
 * Note that if it returns true, this routine returns without unlocking page
 * table lock. So callers must unlock it.
 */
spinlock_t *__pud_trans_huge_lock(pud_t *pud, struct vm_area_struct *vma)
{
	spinlock_t *ptl;

	ptl = pud_lock(vma->vm_mm, pud);
	if (likely(pud_trans_huge(*pud) || pud_devmap(*pud)))
		return ptl;
	spin_unlock(ptl);
	return NULL;
}

#ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
int zap_huge_pud(struct mmu_gather *tlb, struct vm_area_struct *vma,
		 pud_t *pud, unsigned long addr)
{
	pud_t orig_pud;
	spinlock_t *ptl;

	ptl = __pud_trans_huge_lock(pud, vma);
	if (!ptl)
		return 0;
	/*
	 * For architectures like ppc64 we look at deposited pgtable
	 * when calling pudp_huge_get_and_clear. So do the
	 * pgtable_trans_huge_withdraw after finishing pudp related
	 * operations.
	 */
	orig_pud = pudp_huge_get_and_clear_full(tlb->mm, addr, pud,
			tlb->fullmm);
	tlb_remove_pud_tlb_entry(tlb, pud, addr);
	if (vma_is_dax(vma)) {
		spin_unlock(ptl);
		/* No zero page support yet */
	} else {
		/* No support for anonymous PUD pages yet */
		BUG();
	}
	return 1;
}

static void __split_huge_pud_locked(struct vm_area_struct *vma, pud_t *pud,
		unsigned long haddr)
{
	VM_BUG_ON(haddr & ~HPAGE_PUD_MASK);
	VM_BUG_ON_VMA(vma->vm_start > haddr, vma);
	VM_BUG_ON_VMA(vma->vm_end < haddr + HPAGE_PUD_SIZE, vma);
	VM_BUG_ON(!pud_trans_huge(*pud) && !pud_devmap(*pud));

1861
	count_vm_event(THP_SPLIT_PUD);
1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884

	pudp_huge_clear_flush_notify(vma, haddr, pud);
}

void __split_huge_pud(struct vm_area_struct *vma, pud_t *pud,
		unsigned long address)
{
	spinlock_t *ptl;
	struct mm_struct *mm = vma->vm_mm;
	unsigned long haddr = address & HPAGE_PUD_MASK;

	mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PUD_SIZE);
	ptl = pud_lock(mm, pud);
	if (unlikely(!pud_trans_huge(*pud) && !pud_devmap(*pud)))
		goto out;
	__split_huge_pud_locked(vma, pud, haddr);

out:
	spin_unlock(ptl);
	mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PUD_SIZE);
}
#endif /* CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */

1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912
static void __split_huge_zero_page_pmd(struct vm_area_struct *vma,
		unsigned long haddr, pmd_t *pmd)
{
	struct mm_struct *mm = vma->vm_mm;
	pgtable_t pgtable;
	pmd_t _pmd;
	int i;

	/* leave pmd empty until pte is filled */
	pmdp_huge_clear_flush_notify(vma, haddr, pmd);

	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
	pmd_populate(mm, &_pmd, pgtable);

	for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
		pte_t *pte, entry;
		entry = pfn_pte(my_zero_pfn(haddr), vma->vm_page_prot);
		entry = pte_mkspecial(entry);
		pte = pte_offset_map(&_pmd, haddr);
		VM_BUG_ON(!pte_none(*pte));
		set_pte_at(mm, haddr, pte, entry);
		pte_unmap(pte);
	}
	smp_wmb(); /* make pte visible before pmd */
	pmd_populate(mm, pmd, pgtable);
}

static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
1913
		unsigned long haddr, bool freeze)
1914 1915 1916 1917 1918
{
	struct mm_struct *mm = vma->vm_mm;
	struct page *page;
	pgtable_t pgtable;
	pmd_t _pmd;
1919
	bool young, write, dirty, soft_dirty;
1920
	unsigned long addr;
1921 1922 1923 1924 1925
	int i;

	VM_BUG_ON(haddr & ~HPAGE_PMD_MASK);
	VM_BUG_ON_VMA(vma->vm_start > haddr, vma);
	VM_BUG_ON_VMA(vma->vm_end < haddr + HPAGE_PMD_SIZE, vma);
1926
	VM_BUG_ON(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd));
1927 1928 1929

	count_vm_event(THP_SPLIT_PMD);

1930 1931
	if (!vma_is_anonymous(vma)) {
		_pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd);
1932 1933 1934 1935 1936 1937
		/*
		 * We are going to unmap this huge page. So
		 * just go ahead and zap it
		 */
		if (arch_needs_pgtable_deposit())
			zap_deposited_table(mm, pmd);
1938 1939 1940 1941 1942 1943 1944 1945
		if (vma_is_dax(vma))
			return;
		page = pmd_page(_pmd);
		if (!PageReferenced(page) && pmd_young(_pmd))
			SetPageReferenced(page);
		page_remove_rmap(page, true);
		put_page(page);
		add_mm_counter(mm, MM_FILEPAGES, -HPAGE_PMD_NR);
1946 1947 1948 1949 1950 1951 1952
		return;
	} else if (is_huge_zero_pmd(*pmd)) {
		return __split_huge_zero_page_pmd(vma, haddr, pmd);
	}

	page = pmd_page(*pmd);
	VM_BUG_ON_PAGE(!page_count(page), page);
1953
	page_ref_add(page, HPAGE_PMD_NR - 1);
1954 1955
	write = pmd_write(*pmd);
	young = pmd_young(*pmd);
1956
	dirty = pmd_dirty(*pmd);
1957
	soft_dirty = pmd_soft_dirty(*pmd);
1958

1959
	pmdp_huge_split_prepare(vma, haddr, pmd);
1960 1961 1962
	pgtable = pgtable_trans_huge_withdraw(mm, pmd);
	pmd_populate(mm, &_pmd, pgtable);

1963
	for (i = 0, addr = haddr; i < HPAGE_PMD_NR; i++, addr += PAGE_SIZE) {
1964 1965 1966 1967 1968 1969
		pte_t entry, *pte;
		/*
		 * Note that NUMA hinting access restrictions are not
		 * transferred to avoid any possibility of altering
		 * permissions across VMAs.
		 */
1970 1971 1972 1973
		if (freeze) {
			swp_entry_t swp_entry;
			swp_entry = make_migration_entry(page + i, write);
			entry = swp_entry_to_pte(swp_entry);
1974 1975
			if (soft_dirty)
				entry = pte_swp_mksoft_dirty(entry);
1976
		} else {
1977
			entry = mk_pte(page + i, READ_ONCE(vma->vm_page_prot));
1978
			entry = maybe_mkwrite(entry, vma);
1979 1980 1981 1982
			if (!write)
				entry = pte_wrprotect(entry);
			if (!young)
				entry = pte_mkold(entry);
1983 1984
			if (soft_dirty)
				entry = pte_mksoft_dirty(entry);
1985
		}
1986 1987
		if (dirty)
			SetPageDirty(page + i);
1988
		pte = pte_offset_map(&_pmd, addr);
1989
		BUG_ON(!pte_none(*pte));
1990
		set_pte_at(mm, addr, pte, entry);
1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005
		atomic_inc(&page[i]._mapcount);
		pte_unmap(pte);
	}

	/*
	 * Set PG_double_map before dropping compound_mapcount to avoid
	 * false-negative page_mapped().
	 */
	if (compound_mapcount(page) > 1 && !TestSetPageDoubleMap(page)) {
		for (i = 0; i < HPAGE_PMD_NR; i++)
			atomic_inc(&page[i]._mapcount);
	}

	if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
		/* Last compound_mapcount is gone. */
2006
		__dec_node_page_state(page, NR_ANON_THPS);
2007 2008 2009 2010 2011 2012 2013 2014
		if (TestClearPageDoubleMap(page)) {
			/* No need in mapcount reference anymore */
			for (i = 0; i < HPAGE_PMD_NR; i++)
				atomic_dec(&page[i]._mapcount);
		}
	}

	smp_wmb(); /* make pte visible before pmd */
2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036
	/*
	 * Up to this point the pmd is present and huge and userland has the
	 * whole access to the hugepage during the split (which happens in
	 * place). If we overwrite the pmd with the not-huge version pointing
	 * to the pte here (which of course we could if all CPUs were bug
	 * free), userland could trigger a small page size TLB miss on the
	 * small sized TLB while the hugepage TLB entry is still established in
	 * the huge TLB. Some CPU doesn't like that.
	 * See http://support.amd.com/us/Processor_TechDocs/41322.pdf, Erratum
	 * 383 on page 93. Intel should be safe but is also warns that it's
	 * only safe if the permission and cache attributes of the two entries
	 * loaded in the two TLB is identical (which should be the case here).
	 * But it is generally safer to never allow small and huge TLB entries
	 * for the same virtual address to be loaded simultaneously. So instead
	 * of doing "pmd_populate(); flush_pmd_tlb_range();" we first mark the
	 * current pmd notpresent (atomically because here the pmd_trans_huge
	 * and pmd_trans_splitting must remain set at all times on the pmd
	 * until the split is complete for this pmd), then we flush the SMP TLB
	 * and finally we write the non-huge version of the pmd entry with
	 * pmd_populate.
	 */
	pmdp_invalidate(vma, haddr, pmd);
2037
	pmd_populate(mm, pmd, pgtable);
2038 2039

	if (freeze) {
2040
		for (i = 0; i < HPAGE_PMD_NR; i++) {
2041 2042 2043 2044
			page_remove_rmap(page + i, false);
			put_page(page + i);
		}
	}
2045 2046 2047
}

void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
2048
		unsigned long address, bool freeze, struct page *page)
2049 2050 2051 2052 2053 2054 2055
{
	spinlock_t *ptl;
	struct mm_struct *mm = vma->vm_mm;
	unsigned long haddr = address & HPAGE_PMD_MASK;

	mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
	ptl = pmd_lock(mm, pmd);
2056 2057 2058 2059 2060 2061 2062 2063 2064

	/*
	 * If caller asks to setup a migration entries, we need a page to check
	 * pmd against. Otherwise we can end up replacing wrong page.
	 */
	VM_BUG_ON(freeze && !page);
	if (page && page != pmd_page(*pmd))
	        goto out;

2065
	if (pmd_trans_huge(*pmd)) {
2066
		page = pmd_page(*pmd);
2067
		if (PageMlocked(page))
2068
			clear_page_mlock(page);
2069
	} else if (!pmd_devmap(*pmd))
2070
		goto out;
2071
	__split_huge_pmd_locked(vma, pmd, haddr, freeze);
2072
out:
2073 2074 2075 2076
	spin_unlock(ptl);
	mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PMD_SIZE);
}

2077 2078
void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address,
		bool freeze, struct page *page)
2079
{
2080
	pgd_t *pgd;
2081
	p4d_t *p4d;
2082
	pud_t *pud;
2083 2084
	pmd_t *pmd;

2085
	pgd = pgd_offset(vma->vm_mm, address);
2086 2087 2088
	if (!pgd_present(*pgd))
		return;

2089 2090 2091 2092 2093
	p4d = p4d_offset(pgd, address);
	if (!p4d_present(*p4d))
		return;

	pud = pud_offset(p4d, address);
2094 2095 2096 2097
	if (!pud_present(*pud))
		return;

	pmd = pmd_offset(pud, address);
2098

2099
	__split_huge_pmd(vma, pmd, address, freeze, page);
2100 2101
}

2102
void vma_adjust_trans_huge(struct vm_area_struct *vma,
2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114
			     unsigned long start,
			     unsigned long end,
			     long adjust_next)
{
	/*
	 * If the new start address isn't hpage aligned and it could
	 * previously contain an hugepage: check if we need to split
	 * an huge pmd.
	 */
	if (start & ~HPAGE_PMD_MASK &&
	    (start & HPAGE_PMD_MASK) >= vma->vm_start &&
	    (start & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
2115
		split_huge_pmd_address(vma, start, false, NULL);
2116 2117 2118 2119 2120 2121 2122 2123 2124

	/*
	 * If the new end address isn't hpage aligned and it could
	 * previously contain an hugepage: check if we need to split
	 * an huge pmd.
	 */
	if (end & ~HPAGE_PMD_MASK &&
	    (end & HPAGE_PMD_MASK) >= vma->vm_start &&
	    (end & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
2125
		split_huge_pmd_address(vma, end, false, NULL);
2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138

	/*
	 * If we're also updating the vma->vm_next->vm_start, if the new
	 * vm_next->vm_start isn't page aligned and it could previously
	 * contain an hugepage: check if we need to split an huge pmd.
	 */
	if (adjust_next > 0) {
		struct vm_area_struct *next = vma->vm_next;
		unsigned long nstart = next->vm_start;
		nstart += adjust_next << PAGE_SHIFT;
		if (nstart & ~HPAGE_PMD_MASK &&
		    (nstart & HPAGE_PMD_MASK) >= next->vm_start &&
		    (nstart & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= next->vm_end)
2139
			split_huge_pmd_address(next, nstart, false, NULL);
2140 2141
	}
}
2142

2143
static void freeze_page(struct page *page)
2144
{
2145
	enum ttu_flags ttu_flags = TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS |
2146
		TTU_RMAP_LOCKED | TTU_SPLIT_HUGE_PMD;
M
Minchan Kim 已提交
2147
	bool unmap_success;
2148 2149 2150

	VM_BUG_ON_PAGE(!PageHead(page), page);

2151 2152 2153
	if (PageAnon(page))
		ttu_flags |= TTU_MIGRATION;

M
Minchan Kim 已提交
2154 2155
	unmap_success = try_to_unmap(page, ttu_flags);
	VM_BUG_ON_PAGE(!unmap_success, page);
2156 2157
}

2158
static void unfreeze_page(struct page *page)
2159
{
2160
	int i;
2161 2162 2163 2164 2165 2166
	if (PageTransHuge(page)) {
		remove_migration_ptes(page, page, true);
	} else {
		for (i = 0; i < HPAGE_PMD_NR; i++)
			remove_migration_ptes(page + i, page + i, true);
	}
2167 2168
}

2169
static void __split_huge_page_tail(struct page *head, int tail,
2170 2171 2172 2173
		struct lruvec *lruvec, struct list_head *list)
{
	struct page *page_tail = head + tail;

2174
	VM_BUG_ON_PAGE(atomic_read(&page_tail->_mapcount) != -1, page_tail);
2175
	VM_BUG_ON_PAGE(page_ref_count(page_tail) != 0, page_tail);
2176 2177

	/*
2178
	 * tail_page->_refcount is zero and not changing from under us. But
2179
	 * get_page_unless_zero() may be running from under us on the
2180 2181
	 * tail_page. If we used atomic_set() below instead of atomic_inc() or
	 * atomic_add(), we would then run atomic_set() concurrently with
2182 2183 2184 2185
	 * get_page_unless_zero(), and atomic_set() is implemented in C not
	 * using locked ops. spin_unlock on x86 sometime uses locked ops
	 * because of PPro errata 66, 92, so unless somebody can guarantee
	 * atomic_set() here would be safe on all archs (and not only on x86),
2186
	 * it's safer to use atomic_inc()/atomic_add().
2187
	 */
2188 2189 2190 2191 2192 2193
	if (PageAnon(head)) {
		page_ref_inc(page_tail);
	} else {
		/* Additional pin to radix tree */
		page_ref_add(page_tail, 2);
	}
2194 2195 2196 2197 2198 2199 2200 2201 2202

	page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
	page_tail->flags |= (head->flags &
			((1L << PG_referenced) |
			 (1L << PG_swapbacked) |
			 (1L << PG_mlocked) |
			 (1L << PG_uptodate) |
			 (1L << PG_active) |
			 (1L << PG_locked) |
2203 2204
			 (1L << PG_unevictable) |
			 (1L << PG_dirty)));
2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219

	/*
	 * After clearing PageTail the gup refcount can be released.
	 * Page flags also must be visible before we make the page non-compound.
	 */
	smp_wmb();

	clear_compound_head(page_tail);

	if (page_is_young(head))
		set_page_young(page_tail);
	if (page_is_idle(head))
		set_page_idle(page_tail);

	/* ->mapping in first tail page is compound_mapcount */
2220
	VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
2221 2222 2223 2224 2225 2226 2227 2228
			page_tail);
	page_tail->mapping = head->mapping;

	page_tail->index = head->index + tail;
	page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
	lru_add_page_tail(head, page_tail, lruvec, list);
}

2229 2230
static void __split_huge_page(struct page *page, struct list_head *list,
		unsigned long flags)
2231 2232 2233 2234
{
	struct page *head = compound_head(page);
	struct zone *zone = page_zone(head);
	struct lruvec *lruvec;
2235
	pgoff_t end = -1;
2236
	int i;
2237

M
Mel Gorman 已提交
2238
	lruvec = mem_cgroup_page_lruvec(head, zone->zone_pgdat);
2239 2240 2241 2242

	/* complete memcg works before add pages to LRU */
	mem_cgroup_split_huge_fixup(head);

2243 2244 2245 2246
	if (!PageAnon(page))
		end = DIV_ROUND_UP(i_size_read(head->mapping->host), PAGE_SIZE);

	for (i = HPAGE_PMD_NR - 1; i >= 1; i--) {
2247
		__split_huge_page_tail(head, i, lruvec, list);
2248 2249 2250 2251
		/* Some pages can be beyond i_size: drop them from page cache */
		if (head[i].index >= end) {
			__ClearPageDirty(head + i);
			__delete_from_page_cache(head + i, NULL);
2252 2253
			if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head))
				shmem_uncharge(head->mapping->host, 1);
2254 2255 2256
			put_page(head + i);
		}
	}
2257 2258

	ClearPageCompound(head);
2259 2260 2261 2262 2263 2264 2265 2266 2267
	/* See comment in __split_huge_page_tail() */
	if (PageAnon(head)) {
		page_ref_inc(head);
	} else {
		/* Additional pin to radix tree */
		page_ref_add(head, 2);
		spin_unlock(&head->mapping->tree_lock);
	}

2268
	spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
2269

2270
	unfreeze_page(head);
2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288

	for (i = 0; i < HPAGE_PMD_NR; i++) {
		struct page *subpage = head + i;
		if (subpage == page)
			continue;
		unlock_page(subpage);

		/*
		 * Subpages may be freed if there wasn't any mapping
		 * like if add_to_swap() is running on a lru page that
		 * had its mapping zapped. And freeing these pages
		 * requires taking the lru_lock so we do the put_page
		 * of the tail pages after the split is complete.
		 */
		put_page(subpage);
	}
}

2289 2290
int total_mapcount(struct page *page)
{
K
Kirill A. Shutemov 已提交
2291
	int i, compound, ret;
2292 2293 2294 2295 2296 2297

	VM_BUG_ON_PAGE(PageTail(page), page);

	if (likely(!PageCompound(page)))
		return atomic_read(&page->_mapcount) + 1;

K
Kirill A. Shutemov 已提交
2298
	compound = compound_mapcount(page);
2299
	if (PageHuge(page))
K
Kirill A. Shutemov 已提交
2300 2301
		return compound;
	ret = compound;
2302 2303
	for (i = 0; i < HPAGE_PMD_NR; i++)
		ret += atomic_read(&page[i]._mapcount) + 1;
K
Kirill A. Shutemov 已提交
2304 2305 2306
	/* File pages has compound_mapcount included in _mapcount */
	if (!PageAnon(page))
		return ret - compound * HPAGE_PMD_NR;
2307 2308 2309 2310 2311
	if (PageDoubleMap(page))
		ret -= HPAGE_PMD_NR;
	return ret;
}

2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369
/*
 * This calculates accurately how many mappings a transparent hugepage
 * has (unlike page_mapcount() which isn't fully accurate). This full
 * accuracy is primarily needed to know if copy-on-write faults can
 * reuse the page and change the mapping to read-write instead of
 * copying them. At the same time this returns the total_mapcount too.
 *
 * The function returns the highest mapcount any one of the subpages
 * has. If the return value is one, even if different processes are
 * mapping different subpages of the transparent hugepage, they can
 * all reuse it, because each process is reusing a different subpage.
 *
 * The total_mapcount is instead counting all virtual mappings of the
 * subpages. If the total_mapcount is equal to "one", it tells the
 * caller all mappings belong to the same "mm" and in turn the
 * anon_vma of the transparent hugepage can become the vma->anon_vma
 * local one as no other process may be mapping any of the subpages.
 *
 * It would be more accurate to replace page_mapcount() with
 * page_trans_huge_mapcount(), however we only use
 * page_trans_huge_mapcount() in the copy-on-write faults where we
 * need full accuracy to avoid breaking page pinning, because
 * page_trans_huge_mapcount() is slower than page_mapcount().
 */
int page_trans_huge_mapcount(struct page *page, int *total_mapcount)
{
	int i, ret, _total_mapcount, mapcount;

	/* hugetlbfs shouldn't call it */
	VM_BUG_ON_PAGE(PageHuge(page), page);

	if (likely(!PageTransCompound(page))) {
		mapcount = atomic_read(&page->_mapcount) + 1;
		if (total_mapcount)
			*total_mapcount = mapcount;
		return mapcount;
	}

	page = compound_head(page);

	_total_mapcount = ret = 0;
	for (i = 0; i < HPAGE_PMD_NR; i++) {
		mapcount = atomic_read(&page[i]._mapcount) + 1;
		ret = max(ret, mapcount);
		_total_mapcount += mapcount;
	}
	if (PageDoubleMap(page)) {
		ret -= 1;
		_total_mapcount -= HPAGE_PMD_NR;
	}
	mapcount = compound_mapcount(page);
	ret += mapcount;
	_total_mapcount += mapcount;
	if (total_mapcount)
		*total_mapcount = _total_mapcount;
	return ret;
}

2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391
/*
 * This function splits huge page into normal pages. @page can point to any
 * subpage of huge page to split. Split doesn't change the position of @page.
 *
 * Only caller must hold pin on the @page, otherwise split fails with -EBUSY.
 * The huge page must be locked.
 *
 * If @list is null, tail pages will be added to LRU list, otherwise, to @list.
 *
 * Both head page and tail pages will inherit mapping, flags, and so on from
 * the hugepage.
 *
 * GUP pin and PG_locked transferred to @page. Rest subpages can be freed if
 * they are not mapped.
 *
 * Returns 0 if the hugepage is split successfully.
 * Returns -EBUSY if the page is pinned or if anon_vma disappeared from under
 * us.
 */
int split_huge_page_to_list(struct page *page, struct list_head *list)
{
	struct page *head = compound_head(page);
2392
	struct pglist_data *pgdata = NODE_DATA(page_to_nid(head));
2393 2394 2395
	struct anon_vma *anon_vma = NULL;
	struct address_space *mapping = NULL;
	int count, mapcount, extra_pins, ret;
2396
	bool mlocked;
2397
	unsigned long flags;
2398 2399 2400 2401 2402

	VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
	VM_BUG_ON_PAGE(!PageLocked(page), page);
	VM_BUG_ON_PAGE(!PageCompound(page), page);

2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432
	if (PageAnon(head)) {
		/*
		 * The caller does not necessarily hold an mmap_sem that would
		 * prevent the anon_vma disappearing so we first we take a
		 * reference to it and then lock the anon_vma for write. This
		 * is similar to page_lock_anon_vma_read except the write lock
		 * is taken to serialise against parallel split or collapse
		 * operations.
		 */
		anon_vma = page_get_anon_vma(head);
		if (!anon_vma) {
			ret = -EBUSY;
			goto out;
		}
		extra_pins = 0;
		mapping = NULL;
		anon_vma_lock_write(anon_vma);
	} else {
		mapping = head->mapping;

		/* Truncated ? */
		if (!mapping) {
			ret = -EBUSY;
			goto out;
		}

		/* Addidional pins from radix tree */
		extra_pins = HPAGE_PMD_NR;
		anon_vma = NULL;
		i_mmap_lock_read(mapping);
2433 2434 2435 2436 2437 2438
	}

	/*
	 * Racy check if we can split the page, before freeze_page() will
	 * split PMDs
	 */
2439
	if (total_mapcount(head) != page_count(head) - extra_pins - 1) {
2440 2441 2442 2443
		ret = -EBUSY;
		goto out_unlock;
	}

2444
	mlocked = PageMlocked(page);
2445
	freeze_page(head);
2446 2447
	VM_BUG_ON_PAGE(compound_mapcount(head), head);

2448 2449 2450 2451
	/* Make sure the page is not on per-CPU pagevec as it takes pin */
	if (mlocked)
		lru_add_drain();

2452
	/* prevent PageLRU to go away from under us, and freeze lru stats */
2453
	spin_lock_irqsave(zone_lru_lock(page_zone(head)), flags);
2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469

	if (mapping) {
		void **pslot;

		spin_lock(&mapping->tree_lock);
		pslot = radix_tree_lookup_slot(&mapping->page_tree,
				page_index(head));
		/*
		 * Check if the head page is present in radix tree.
		 * We assume all tail are present too, if head is there.
		 */
		if (radix_tree_deref_slot_protected(pslot,
					&mapping->tree_lock) != head)
			goto fail;
	}

2470
	/* Prevent deferred_split_scan() touching ->_refcount */
2471
	spin_lock(&pgdata->split_queue_lock);
2472 2473
	count = page_count(head);
	mapcount = total_mapcount(head);
2474
	if (!mapcount && page_ref_freeze(head, 1 + extra_pins)) {
2475
		if (!list_empty(page_deferred_list(head))) {
2476
			pgdata->split_queue_len--;
2477 2478
			list_del(page_deferred_list(head));
		}
2479
		if (mapping)
2480
			__dec_node_page_state(page, NR_SHMEM_THPS);
2481 2482
		spin_unlock(&pgdata->split_queue_lock);
		__split_huge_page(page, list, flags);
2483 2484
		ret = 0;
	} else {
2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495
		if (IS_ENABLED(CONFIG_DEBUG_VM) && mapcount) {
			pr_alert("total_mapcount: %u, page_count(): %u\n",
					mapcount, count);
			if (PageTail(page))
				dump_page(head, NULL);
			dump_page(page, "total_mapcount(head) > 0");
			BUG();
		}
		spin_unlock(&pgdata->split_queue_lock);
fail:		if (mapping)
			spin_unlock(&mapping->tree_lock);
2496
		spin_unlock_irqrestore(zone_lru_lock(page_zone(head)), flags);
2497
		unfreeze_page(head);
2498 2499 2500 2501
		ret = -EBUSY;
	}

out_unlock:
2502 2503 2504 2505 2506 2507
	if (anon_vma) {
		anon_vma_unlock_write(anon_vma);
		put_anon_vma(anon_vma);
	}
	if (mapping)
		i_mmap_unlock_read(mapping);
2508 2509 2510 2511
out:
	count_vm_event(!ret ? THP_SPLIT_PAGE : THP_SPLIT_PAGE_FAILED);
	return ret;
}
2512 2513 2514

void free_transhuge_page(struct page *page)
{
2515
	struct pglist_data *pgdata = NODE_DATA(page_to_nid(page));
2516 2517
	unsigned long flags;

2518
	spin_lock_irqsave(&pgdata->split_queue_lock, flags);
2519
	if (!list_empty(page_deferred_list(page))) {
2520
		pgdata->split_queue_len--;
2521 2522
		list_del(page_deferred_list(page));
	}
2523
	spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
2524 2525 2526 2527 2528
	free_compound_page(page);
}

void deferred_split_huge_page(struct page *page)
{
2529
	struct pglist_data *pgdata = NODE_DATA(page_to_nid(page));
2530 2531 2532 2533
	unsigned long flags;

	VM_BUG_ON_PAGE(!PageTransHuge(page), page);

2534
	spin_lock_irqsave(&pgdata->split_queue_lock, flags);
2535
	if (list_empty(page_deferred_list(page))) {
2536
		count_vm_event(THP_DEFERRED_SPLIT_PAGE);
2537 2538
		list_add_tail(page_deferred_list(page), &pgdata->split_queue);
		pgdata->split_queue_len++;
2539
	}
2540
	spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
2541 2542 2543 2544 2545
}

static unsigned long deferred_split_count(struct shrinker *shrink,
		struct shrink_control *sc)
{
2546
	struct pglist_data *pgdata = NODE_DATA(sc->nid);
2547
	return ACCESS_ONCE(pgdata->split_queue_len);
2548 2549 2550 2551 2552
}

static unsigned long deferred_split_scan(struct shrinker *shrink,
		struct shrink_control *sc)
{
2553
	struct pglist_data *pgdata = NODE_DATA(sc->nid);
2554 2555 2556 2557 2558
	unsigned long flags;
	LIST_HEAD(list), *pos, *next;
	struct page *page;
	int split = 0;

2559
	spin_lock_irqsave(&pgdata->split_queue_lock, flags);
2560
	/* Take pin on all head pages to avoid freeing them under us */
2561
	list_for_each_safe(pos, next, &pgdata->split_queue) {
2562 2563
		page = list_entry((void *)pos, struct page, mapping);
		page = compound_head(page);
2564 2565 2566 2567
		if (get_page_unless_zero(page)) {
			list_move(page_deferred_list(page), &list);
		} else {
			/* We lost race with put_compound_page() */
2568
			list_del_init(page_deferred_list(page));
2569
			pgdata->split_queue_len--;
2570
		}
2571 2572
		if (!--sc->nr_to_scan)
			break;
2573
	}
2574
	spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585

	list_for_each_safe(pos, next, &list) {
		page = list_entry((void *)pos, struct page, mapping);
		lock_page(page);
		/* split_huge_page() removes page from list on success */
		if (!split_huge_page(page))
			split++;
		unlock_page(page);
		put_page(page);
	}

2586 2587 2588
	spin_lock_irqsave(&pgdata->split_queue_lock, flags);
	list_splice_tail(&list, &pgdata->split_queue);
	spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
2589

2590 2591 2592 2593 2594 2595 2596
	/*
	 * Stop shrinker if we didn't split any page, but the queue is empty.
	 * This can happen if pages were freed under us.
	 */
	if (!split && list_empty(&pgdata->split_queue))
		return SHRINK_STOP;
	return split;
2597 2598 2599 2600 2601 2602
}

static struct shrinker deferred_split_shrinker = {
	.count_objects = deferred_split_count,
	.scan_objects = deferred_split_scan,
	.seeks = DEFAULT_SEEKS,
2603
	.flags = SHRINKER_NUMA_AWARE,
2604
};
2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629

#ifdef CONFIG_DEBUG_FS
static int split_huge_pages_set(void *data, u64 val)
{
	struct zone *zone;
	struct page *page;
	unsigned long pfn, max_zone_pfn;
	unsigned long total = 0, split = 0;

	if (val != 1)
		return -EINVAL;

	for_each_populated_zone(zone) {
		max_zone_pfn = zone_end_pfn(zone);
		for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) {
			if (!pfn_valid(pfn))
				continue;

			page = pfn_to_page(pfn);
			if (!get_page_unless_zero(page))
				continue;

			if (zone != page_zone(page))
				goto next;

2630
			if (!PageHead(page) || PageHuge(page) || !PageLRU(page))
2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642
				goto next;

			total++;
			lock_page(page);
			if (!split_huge_page(page))
				split++;
			unlock_page(page);
next:
			put_page(page);
		}
	}

2643
	pr_info("%lu of %lu THP split\n", split, total);
2644 2645 2646 2647 2648 2649 2650 2651 2652 2653

	return 0;
}
DEFINE_SIMPLE_ATTRIBUTE(split_huge_pages_fops, NULL, split_huge_pages_set,
		"%llu\n");

static int __init split_huge_pages_debugfs(void)
{
	void *ret;

2654
	ret = debugfs_create_file("split_huge_pages", 0200, NULL, NULL,
2655 2656 2657 2658 2659 2660 2661
			&split_huge_pages_fops);
	if (!ret)
		pr_warn("Failed to create split_huge_pages in debugfs");
	return 0;
}
late_initcall(split_huge_pages_debugfs);
#endif