ksm.c 64.6 KB
Newer Older
H
Hugh Dickins 已提交
1
/*
I
Izik Eidus 已提交
2 3 4 5 6
 * Memory merging support.
 *
 * This code enables dynamic sharing of identical pages found in different
 * memory areas, even if they are not shared by fork()
 *
I
Izik Eidus 已提交
7
 * Copyright (C) 2008-2009 Red Hat, Inc.
I
Izik Eidus 已提交
8 9 10 11
 * Authors:
 *	Izik Eidus
 *	Andrea Arcangeli
 *	Chris Wright
I
Izik Eidus 已提交
12
 *	Hugh Dickins
I
Izik Eidus 已提交
13 14
 *
 * This work is licensed under the terms of the GNU GPL, version 2.
H
Hugh Dickins 已提交
15 16 17
 */

#include <linux/errno.h>
I
Izik Eidus 已提交
18 19
#include <linux/mm.h>
#include <linux/fs.h>
H
Hugh Dickins 已提交
20
#include <linux/mman.h>
I
Izik Eidus 已提交
21 22 23 24 25 26 27 28 29 30 31
#include <linux/sched.h>
#include <linux/rwsem.h>
#include <linux/pagemap.h>
#include <linux/rmap.h>
#include <linux/spinlock.h>
#include <linux/jhash.h>
#include <linux/delay.h>
#include <linux/kthread.h>
#include <linux/wait.h>
#include <linux/slab.h>
#include <linux/rbtree.h>
32
#include <linux/memory.h>
I
Izik Eidus 已提交
33
#include <linux/mmu_notifier.h>
34
#include <linux/swap.h>
H
Hugh Dickins 已提交
35
#include <linux/ksm.h>
36
#include <linux/hashtable.h>
37
#include <linux/freezer.h>
38
#include <linux/oom.h>
P
Petr Holasek 已提交
39
#include <linux/numa.h>
H
Hugh Dickins 已提交
40

I
Izik Eidus 已提交
41
#include <asm/tlbflush.h>
H
Hugh Dickins 已提交
42
#include "internal.h"
I
Izik Eidus 已提交
43

H
Hugh Dickins 已提交
44 45 46 47 48 49 50 51
#ifdef CONFIG_NUMA
#define NUMA(x)		(x)
#define DO_NUMA(x)	do { (x); } while (0)
#else
#define NUMA(x)		(0)
#define DO_NUMA(x)	do { } while (0)
#endif

I
Izik Eidus 已提交
52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95
/*
 * A few notes about the KSM scanning process,
 * to make it easier to understand the data structures below:
 *
 * In order to reduce excessive scanning, KSM sorts the memory pages by their
 * contents into a data structure that holds pointers to the pages' locations.
 *
 * Since the contents of the pages may change at any moment, KSM cannot just
 * insert the pages into a normal sorted tree and expect it to find anything.
 * Therefore KSM uses two data structures - the stable and the unstable tree.
 *
 * The stable tree holds pointers to all the merged pages (ksm pages), sorted
 * by their contents.  Because each such page is write-protected, searching on
 * this tree is fully assured to be working (except when pages are unmapped),
 * and therefore this tree is called the stable tree.
 *
 * In addition to the stable tree, KSM uses a second data structure called the
 * unstable tree: this tree holds pointers to pages which have been found to
 * be "unchanged for a period of time".  The unstable tree sorts these pages
 * by their contents, but since they are not write-protected, KSM cannot rely
 * upon the unstable tree to work correctly - the unstable tree is liable to
 * be corrupted as its contents are modified, and so it is called unstable.
 *
 * KSM solves this problem by several techniques:
 *
 * 1) The unstable tree is flushed every time KSM completes scanning all
 *    memory areas, and then the tree is rebuilt again from the beginning.
 * 2) KSM will only insert into the unstable tree, pages whose hash value
 *    has not changed since the previous scan of all memory areas.
 * 3) The unstable tree is a RedBlack Tree - so its balancing is based on the
 *    colors of the nodes and not on their contents, assuring that even when
 *    the tree gets "corrupted" it won't get out of balance, so scanning time
 *    remains the same (also, searching and inserting nodes in an rbtree uses
 *    the same algorithm, so we have no overhead when we flush and rebuild).
 * 4) KSM never flushes the stable tree, which means that even if it were to
 *    take 10 attempts to find a page in the unstable tree, once it is found,
 *    it is secured in the stable tree.  (When we scan a new page, we first
 *    compare it against the stable tree, and then against the unstable tree.)
 */

/**
 * struct mm_slot - ksm information per mm that is being scanned
 * @link: link to the mm_slots hash list
 * @mm_list: link into the mm_slots list, rooted in ksm_mm_head
H
Hugh Dickins 已提交
96
 * @rmap_list: head for this mm_slot's singly-linked list of rmap_items
I
Izik Eidus 已提交
97 98 99 100 101
 * @mm: the mm that this information is valid for
 */
struct mm_slot {
	struct hlist_node link;
	struct list_head mm_list;
H
Hugh Dickins 已提交
102
	struct rmap_item *rmap_list;
I
Izik Eidus 已提交
103 104 105 106 107 108 109
	struct mm_struct *mm;
};

/**
 * struct ksm_scan - cursor for scanning
 * @mm_slot: the current mm_slot we are scanning
 * @address: the next address inside that to be scanned
H
Hugh Dickins 已提交
110
 * @rmap_list: link to the next rmap to be scanned in the rmap_list
I
Izik Eidus 已提交
111 112 113 114 115 116 117
 * @seqnr: count of completed full scans (needed when removing unstable node)
 *
 * There is only the one ksm_scan instance of this cursor structure.
 */
struct ksm_scan {
	struct mm_slot *mm_slot;
	unsigned long address;
H
Hugh Dickins 已提交
118
	struct rmap_item **rmap_list;
I
Izik Eidus 已提交
119 120 121
	unsigned long seqnr;
};

H
Hugh Dickins 已提交
122 123 124
/**
 * struct stable_node - node of the stable rbtree
 * @node: rb node of this ksm page in the stable tree
125 126
 * @head: (overlaying parent) &migrate_nodes indicates temporarily on that list
 * @list: linked into migrate_nodes, pending placement in the proper node tree
H
Hugh Dickins 已提交
127
 * @hlist: hlist head of rmap_items using this ksm page
128 129
 * @kpfn: page frame number of this ksm page (perhaps temporarily on wrong nid)
 * @nid: NUMA node id of stable tree in which linked (may not match kpfn)
H
Hugh Dickins 已提交
130 131
 */
struct stable_node {
132 133 134 135 136 137 138
	union {
		struct rb_node node;	/* when node of stable tree */
		struct {		/* when listed for migration */
			struct list_head *head;
			struct list_head list;
		};
	};
H
Hugh Dickins 已提交
139
	struct hlist_head hlist;
140
	unsigned long kpfn;
141 142 143
#ifdef CONFIG_NUMA
	int nid;
#endif
H
Hugh Dickins 已提交
144 145
};

I
Izik Eidus 已提交
146 147
/**
 * struct rmap_item - reverse mapping item for virtual addresses
H
Hugh Dickins 已提交
148
 * @rmap_list: next rmap_item in mm_slot's singly-linked rmap_list
H
Hugh Dickins 已提交
149
 * @anon_vma: pointer to anon_vma for this mm,address, when in stable tree
I
Izik Eidus 已提交
150 151 152
 * @mm: the memory structure this rmap_item is pointing into
 * @address: the virtual address this rmap_item tracks (+ flags in low bits)
 * @oldchecksum: previous checksum of the page at that virtual address
H
Hugh Dickins 已提交
153
 * @nid: NUMA node id of unstable tree in which linked (may not match page)
H
Hugh Dickins 已提交
154 155 156
 * @node: rb node of this rmap_item in the unstable tree
 * @head: pointer to stable_node heading this list in the stable tree
 * @hlist: link into hlist of rmap_items hanging off that stable_node
I
Izik Eidus 已提交
157 158
 */
struct rmap_item {
H
Hugh Dickins 已提交
159
	struct rmap_item *rmap_list;
H
Hugh Dickins 已提交
160
	struct anon_vma *anon_vma;	/* when stable */
I
Izik Eidus 已提交
161 162
	struct mm_struct *mm;
	unsigned long address;		/* + low bits used for flags below */
H
Hugh Dickins 已提交
163
	unsigned int oldchecksum;	/* when unstable */
P
Petr Holasek 已提交
164
#ifdef CONFIG_NUMA
H
Hugh Dickins 已提交
165
	int nid;
P
Petr Holasek 已提交
166
#endif
I
Izik Eidus 已提交
167
	union {
H
Hugh Dickins 已提交
168 169 170 171 172
		struct rb_node node;	/* when node of unstable tree */
		struct {		/* when listed from stable tree */
			struct stable_node *head;
			struct hlist_node hlist;
		};
I
Izik Eidus 已提交
173 174 175 176
	};
};

#define SEQNR_MASK	0x0ff	/* low bits of unstable tree seqnr */
H
Hugh Dickins 已提交
177 178
#define UNSTABLE_FLAG	0x100	/* is a node of the unstable tree */
#define STABLE_FLAG	0x200	/* is listed from the stable tree */
I
Izik Eidus 已提交
179 180

/* The stable and unstable tree heads */
P
Petr Holasek 已提交
181 182
static struct rb_root root_unstable_tree[MAX_NUMNODES];
static struct rb_root root_stable_tree[MAX_NUMNODES];
I
Izik Eidus 已提交
183

184 185 186
/* Recently migrated nodes of stable tree, pending proper placement */
static LIST_HEAD(migrate_nodes);

187 188
#define MM_SLOTS_HASH_BITS 10
static DEFINE_HASHTABLE(mm_slots_hash, MM_SLOTS_HASH_BITS);
I
Izik Eidus 已提交
189 190 191 192 193 194 195 196 197

static struct mm_slot ksm_mm_head = {
	.mm_list = LIST_HEAD_INIT(ksm_mm_head.mm_list),
};
static struct ksm_scan ksm_scan = {
	.mm_slot = &ksm_mm_head,
};

static struct kmem_cache *rmap_item_cache;
H
Hugh Dickins 已提交
198
static struct kmem_cache *stable_node_cache;
I
Izik Eidus 已提交
199 200 201
static struct kmem_cache *mm_slot_cache;

/* The number of nodes in the stable tree */
202
static unsigned long ksm_pages_shared;
I
Izik Eidus 已提交
203

H
Hugh Dickins 已提交
204
/* The number of page slots additionally sharing those nodes */
205
static unsigned long ksm_pages_sharing;
I
Izik Eidus 已提交
206

207 208 209 210 211 212
/* The number of nodes in the unstable tree */
static unsigned long ksm_pages_unshared;

/* The number of rmap_items in use: to calculate pages_volatile */
static unsigned long ksm_rmap_items;

I
Izik Eidus 已提交
213
/* Number of pages ksmd should scan in one batch */
214
static unsigned int ksm_thread_pages_to_scan = 100;
I
Izik Eidus 已提交
215 216

/* Milliseconds ksmd should sleep between batches */
H
Hugh Dickins 已提交
217
static unsigned int ksm_thread_sleep_millisecs = 20;
I
Izik Eidus 已提交
218

H
Hugh Dickins 已提交
219
#ifdef CONFIG_NUMA
P
Petr Holasek 已提交
220 221
/* Zeroed when merging across nodes is not allowed */
static unsigned int ksm_merge_across_nodes = 1;
H
Hugh Dickins 已提交
222 223 224
#else
#define ksm_merge_across_nodes	1U
#endif
P
Petr Holasek 已提交
225

I
Izik Eidus 已提交
226 227 228
#define KSM_RUN_STOP	0
#define KSM_RUN_MERGE	1
#define KSM_RUN_UNMERGE	2
229 230 231
#define KSM_RUN_OFFLINE	4
static unsigned long ksm_run = KSM_RUN_STOP;
static void wait_while_offlining(void);
I
Izik Eidus 已提交
232 233 234 235 236 237 238 239 240 241 242 243 244 245 246

static DECLARE_WAIT_QUEUE_HEAD(ksm_thread_wait);
static DEFINE_MUTEX(ksm_thread_mutex);
static DEFINE_SPINLOCK(ksm_mmlist_lock);

#define KSM_KMEM_CACHE(__struct, __flags) kmem_cache_create("ksm_"#__struct,\
		sizeof(struct __struct), __alignof__(struct __struct),\
		(__flags), NULL)

static int __init ksm_slab_init(void)
{
	rmap_item_cache = KSM_KMEM_CACHE(rmap_item, 0);
	if (!rmap_item_cache)
		goto out;

H
Hugh Dickins 已提交
247 248 249 250
	stable_node_cache = KSM_KMEM_CACHE(stable_node, 0);
	if (!stable_node_cache)
		goto out_free1;

I
Izik Eidus 已提交
251 252
	mm_slot_cache = KSM_KMEM_CACHE(mm_slot, 0);
	if (!mm_slot_cache)
H
Hugh Dickins 已提交
253
		goto out_free2;
I
Izik Eidus 已提交
254 255 256

	return 0;

H
Hugh Dickins 已提交
257 258 259
out_free2:
	kmem_cache_destroy(stable_node_cache);
out_free1:
I
Izik Eidus 已提交
260 261 262 263 264 265 266 267
	kmem_cache_destroy(rmap_item_cache);
out:
	return -ENOMEM;
}

static void __init ksm_slab_free(void)
{
	kmem_cache_destroy(mm_slot_cache);
H
Hugh Dickins 已提交
268
	kmem_cache_destroy(stable_node_cache);
I
Izik Eidus 已提交
269 270 271 272 273 274
	kmem_cache_destroy(rmap_item_cache);
	mm_slot_cache = NULL;
}

static inline struct rmap_item *alloc_rmap_item(void)
{
275 276 277 278 279 280
	struct rmap_item *rmap_item;

	rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
	if (rmap_item)
		ksm_rmap_items++;
	return rmap_item;
I
Izik Eidus 已提交
281 282 283 284
}

static inline void free_rmap_item(struct rmap_item *rmap_item)
{
285
	ksm_rmap_items--;
I
Izik Eidus 已提交
286 287 288 289
	rmap_item->mm = NULL;	/* debug safety */
	kmem_cache_free(rmap_item_cache, rmap_item);
}

H
Hugh Dickins 已提交
290 291 292 293 294 295 296 297 298 299
static inline struct stable_node *alloc_stable_node(void)
{
	return kmem_cache_alloc(stable_node_cache, GFP_KERNEL);
}

static inline void free_stable_node(struct stable_node *stable_node)
{
	kmem_cache_free(stable_node_cache, stable_node);
}

I
Izik Eidus 已提交
300 301 302 303 304 305 306 307 308 309 310 311 312 313 314
static inline struct mm_slot *alloc_mm_slot(void)
{
	if (!mm_slot_cache)	/* initialization failed */
		return NULL;
	return kmem_cache_zalloc(mm_slot_cache, GFP_KERNEL);
}

static inline void free_mm_slot(struct mm_slot *mm_slot)
{
	kmem_cache_free(mm_slot_cache, mm_slot);
}

static struct mm_slot *get_mm_slot(struct mm_struct *mm)
{
	struct hlist_node *node;
315 316 317 318 319
	struct mm_slot *slot;

	hash_for_each_possible(mm_slots_hash, slot, node, link, (unsigned long)mm)
		if (slot->mm == mm)
			return slot;
I
Izik Eidus 已提交
320 321 322 323 324 325 326 327

	return NULL;
}

static void insert_to_mm_slots_hash(struct mm_struct *mm,
				    struct mm_slot *mm_slot)
{
	mm_slot->mm = mm;
328
	hash_add(mm_slots_hash, &mm_slot->link, (unsigned long)mm);
I
Izik Eidus 已提交
329 330
}

H
Hugh Dickins 已提交
331 332 333 334 335 336 337 338 339 340 341 342 343
/*
 * ksmd, and unmerge_and_remove_all_rmap_items(), must not touch an mm's
 * page tables after it has passed through ksm_exit() - which, if necessary,
 * takes mmap_sem briefly to serialize against them.  ksm_exit() does not set
 * a special flag: they can just back out as soon as mm_users goes to zero.
 * ksm_test_exit() is used throughout to make this test for exit: in some
 * places for correctness, in some places just to avoid unnecessary work.
 */
static inline bool ksm_test_exit(struct mm_struct *mm)
{
	return atomic_read(&mm->mm_users) == 0;
}

I
Izik Eidus 已提交
344 345 346 347 348 349 350 351 352 353 354
/*
 * We use break_ksm to break COW on a ksm page: it's a stripped down
 *
 *	if (get_user_pages(current, mm, addr, 1, 1, 1, &page, NULL) == 1)
 *		put_page(page);
 *
 * but taking great care only to touch a ksm page, in a VM_MERGEABLE vma,
 * in case the application has unmapped and remapped mm,addr meanwhile.
 * Could a ksm page appear anywhere else?  Actually yes, in a VM_PFNMAP
 * mmap of /dev/mem or /dev/kmem, where we would not want to touch it.
 */
H
Hugh Dickins 已提交
355
static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
I
Izik Eidus 已提交
356 357
{
	struct page *page;
H
Hugh Dickins 已提交
358
	int ret = 0;
I
Izik Eidus 已提交
359 360 361 362

	do {
		cond_resched();
		page = follow_page(vma, addr, FOLL_GET);
363
		if (IS_ERR_OR_NULL(page))
I
Izik Eidus 已提交
364 365 366 367 368 369 370
			break;
		if (PageKsm(page))
			ret = handle_mm_fault(vma->vm_mm, vma, addr,
							FAULT_FLAG_WRITE);
		else
			ret = VM_FAULT_WRITE;
		put_page(page);
H
Hugh Dickins 已提交
371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400
	} while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
	/*
	 * We must loop because handle_mm_fault() may back out if there's
	 * any difficulty e.g. if pte accessed bit gets updated concurrently.
	 *
	 * VM_FAULT_WRITE is what we have been hoping for: it indicates that
	 * COW has been broken, even if the vma does not permit VM_WRITE;
	 * but note that a concurrent fault might break PageKsm for us.
	 *
	 * VM_FAULT_SIGBUS could occur if we race with truncation of the
	 * backing file, which also invalidates anonymous pages: that's
	 * okay, that truncation will have unmapped the PageKsm for us.
	 *
	 * VM_FAULT_OOM: at the time of writing (late July 2009), setting
	 * aside mem_cgroup limits, VM_FAULT_OOM would only be set if the
	 * current task has TIF_MEMDIE set, and will be OOM killed on return
	 * to user; and ksmd, having no mm, would never be chosen for that.
	 *
	 * But if the mm is in a limited mem_cgroup, then the fault may fail
	 * with VM_FAULT_OOM even if the current task is not TIF_MEMDIE; and
	 * even ksmd can fail in this way - though it's usually breaking ksm
	 * just to undo a merge it made a moment before, so unlikely to oom.
	 *
	 * That's a pity: we might therefore have more kernel pages allocated
	 * than we're counting as nodes in the stable tree; but ksm_do_scan
	 * will retry to break_cow on each pass, so should recover the page
	 * in due course.  The important thing is to not let VM_MERGEABLE
	 * be cleared while any such pages might remain in the area.
	 */
	return (ret & VM_FAULT_OOM) ? -ENOMEM : 0;
I
Izik Eidus 已提交
401 402
}

403 404 405 406 407 408 409 410 411 412 413 414 415 416
static struct vm_area_struct *find_mergeable_vma(struct mm_struct *mm,
		unsigned long addr)
{
	struct vm_area_struct *vma;
	if (ksm_test_exit(mm))
		return NULL;
	vma = find_vma(mm, addr);
	if (!vma || vma->vm_start > addr)
		return NULL;
	if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
		return NULL;
	return vma;
}

417
static void break_cow(struct rmap_item *rmap_item)
I
Izik Eidus 已提交
418
{
419 420
	struct mm_struct *mm = rmap_item->mm;
	unsigned long addr = rmap_item->address;
I
Izik Eidus 已提交
421 422
	struct vm_area_struct *vma;

H
Hugh Dickins 已提交
423 424 425 426
	/*
	 * It is not an accident that whenever we want to break COW
	 * to undo, we also need to drop a reference to the anon_vma.
	 */
427
	put_anon_vma(rmap_item->anon_vma);
H
Hugh Dickins 已提交
428

H
Hugh Dickins 已提交
429
	down_read(&mm->mmap_sem);
430 431 432
	vma = find_mergeable_vma(mm, addr);
	if (vma)
		break_ksm(vma, addr);
I
Izik Eidus 已提交
433 434 435
	up_read(&mm->mmap_sem);
}

A
Andrea Arcangeli 已提交
436 437 438
static struct page *page_trans_compound_anon(struct page *page)
{
	if (PageTransCompound(page)) {
439
		struct page *head = compound_trans_head(page);
A
Andrea Arcangeli 已提交
440
		/*
441 442
		 * head may actually be splitted and freed from under
		 * us but it's ok here.
A
Andrea Arcangeli 已提交
443 444 445 446 447 448 449
		 */
		if (PageAnon(head))
			return head;
	}
	return NULL;
}

I
Izik Eidus 已提交
450 451 452 453 454 455 456 457
static struct page *get_mergeable_page(struct rmap_item *rmap_item)
{
	struct mm_struct *mm = rmap_item->mm;
	unsigned long addr = rmap_item->address;
	struct vm_area_struct *vma;
	struct page *page;

	down_read(&mm->mmap_sem);
458 459
	vma = find_mergeable_vma(mm, addr);
	if (!vma)
I
Izik Eidus 已提交
460 461 462
		goto out;

	page = follow_page(vma, addr, FOLL_GET);
463
	if (IS_ERR_OR_NULL(page))
I
Izik Eidus 已提交
464
		goto out;
A
Andrea Arcangeli 已提交
465
	if (PageAnon(page) || page_trans_compound_anon(page)) {
I
Izik Eidus 已提交
466 467 468 469 470 471 472 473 474 475
		flush_anon_page(vma, page, addr);
		flush_dcache_page(page);
	} else {
		put_page(page);
out:		page = NULL;
	}
	up_read(&mm->mmap_sem);
	return page;
}

P
Petr Holasek 已提交
476 477 478 479 480 481 482 483
/*
 * This helper is used for getting right index into array of tree roots.
 * When merge_across_nodes knob is set to 1, there are only two rb-trees for
 * stable and unstable pages from all nodes with roots in index 0. Otherwise,
 * every node has its own stable and unstable tree.
 */
static inline int get_kpfn_nid(unsigned long kpfn)
{
H
Hugh Dickins 已提交
484
	return ksm_merge_across_nodes ? 0 : pfn_to_nid(kpfn);
P
Petr Holasek 已提交
485 486
}

H
Hugh Dickins 已提交
487 488 489 490 491 492 493 494 495 496
static void remove_node_from_stable_tree(struct stable_node *stable_node)
{
	struct rmap_item *rmap_item;
	struct hlist_node *hlist;

	hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
		if (rmap_item->hlist.next)
			ksm_pages_sharing--;
		else
			ksm_pages_shared--;
497
		put_anon_vma(rmap_item->anon_vma);
H
Hugh Dickins 已提交
498 499 500 501
		rmap_item->address &= PAGE_MASK;
		cond_resched();
	}

502 503 504 505 506
	if (stable_node->head == &migrate_nodes)
		list_del(&stable_node->list);
	else
		rb_erase(&stable_node->node,
			 &root_stable_tree[NUMA(stable_node->nid)]);
H
Hugh Dickins 已提交
507 508 509 510 511 512 513 514 515
	free_stable_node(stable_node);
}

/*
 * get_ksm_page: checks if the page indicated by the stable node
 * is still its ksm page, despite having held no reference to it.
 * In which case we can trust the content of the page, and it
 * returns the gotten page; but if the page has now been zapped,
 * remove the stale node from the stable tree and return NULL.
516
 * But beware, the stable node's page might be being migrated.
H
Hugh Dickins 已提交
517 518 519 520 521 522 523 524 525 526 527 528
 *
 * You would expect the stable_node to hold a reference to the ksm page.
 * But if it increments the page's count, swapping out has to wait for
 * ksmd to come around again before it can free the page, which may take
 * seconds or even minutes: much too unresponsive.  So instead we use a
 * "keyhole reference": access to the ksm page from the stable node peeps
 * out through its keyhole to see if that page still holds the right key,
 * pointing back to this stable node.  This relies on freeing a PageAnon
 * page to reset its page->mapping to NULL, and relies on no other use of
 * a page to put something that might look like our key in page->mapping.
 * is on its way to being freed; but it is an anomaly to bear in mind.
 */
H
Hugh Dickins 已提交
529
static struct page *get_ksm_page(struct stable_node *stable_node, bool locked)
H
Hugh Dickins 已提交
530 531 532
{
	struct page *page;
	void *expected_mapping;
533
	unsigned long kpfn;
H
Hugh Dickins 已提交
534 535 536

	expected_mapping = (void *)stable_node +
				(PAGE_MAPPING_ANON | PAGE_MAPPING_KSM);
537 538 539 540 541 542 543 544 545 546 547
again:
	kpfn = ACCESS_ONCE(stable_node->kpfn);
	page = pfn_to_page(kpfn);

	/*
	 * page is computed from kpfn, so on most architectures reading
	 * page->mapping is naturally ordered after reading node->kpfn,
	 * but on Alpha we need to be more careful.
	 */
	smp_read_barrier_depends();
	if (ACCESS_ONCE(page->mapping) != expected_mapping)
H
Hugh Dickins 已提交
548
		goto stale;
549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573

	/*
	 * We cannot do anything with the page while its refcount is 0.
	 * Usually 0 means free, or tail of a higher-order page: in which
	 * case this node is no longer referenced, and should be freed;
	 * however, it might mean that the page is under page_freeze_refs().
	 * The __remove_mapping() case is easy, again the node is now stale;
	 * but if page is swapcache in migrate_page_move_mapping(), it might
	 * still be our page, in which case it's essential to keep the node.
	 */
	while (!get_page_unless_zero(page)) {
		/*
		 * Another check for page->mapping != expected_mapping would
		 * work here too.  We have chosen the !PageSwapCache test to
		 * optimize the common case, when the page is or is about to
		 * be freed: PageSwapCache is cleared (under spin_lock_irq)
		 * in the freeze_refs section of __remove_mapping(); but Anon
		 * page->mapping reset to NULL later, in free_pages_prepare().
		 */
		if (!PageSwapCache(page))
			goto stale;
		cpu_relax();
	}

	if (ACCESS_ONCE(page->mapping) != expected_mapping) {
H
Hugh Dickins 已提交
574 575 576
		put_page(page);
		goto stale;
	}
577

H
Hugh Dickins 已提交
578 579
	if (locked) {
		lock_page(page);
580
		if (ACCESS_ONCE(page->mapping) != expected_mapping) {
H
Hugh Dickins 已提交
581 582 583 584 585
			unlock_page(page);
			put_page(page);
			goto stale;
		}
	}
H
Hugh Dickins 已提交
586
	return page;
587

H
Hugh Dickins 已提交
588
stale:
589 590 591 592 593 594 595 596 597
	/*
	 * We come here from above when page->mapping or !PageSwapCache
	 * suggests that the node is stale; but it might be under migration.
	 * We need smp_rmb(), matching the smp_wmb() in ksm_migrate_page(),
	 * before checking whether node->kpfn has been changed.
	 */
	smp_rmb();
	if (ACCESS_ONCE(stable_node->kpfn) != kpfn)
		goto again;
H
Hugh Dickins 已提交
598 599 600 601
	remove_node_from_stable_tree(stable_node);
	return NULL;
}

I
Izik Eidus 已提交
602 603 604 605 606 607
/*
 * Removing rmap_item from stable or unstable tree.
 * This function will clean the information from the stable/unstable tree.
 */
static void remove_rmap_item_from_tree(struct rmap_item *rmap_item)
{
H
Hugh Dickins 已提交
608 609
	if (rmap_item->address & STABLE_FLAG) {
		struct stable_node *stable_node;
H
Hugh Dickins 已提交
610
		struct page *page;
I
Izik Eidus 已提交
611

H
Hugh Dickins 已提交
612
		stable_node = rmap_item->head;
H
Hugh Dickins 已提交
613
		page = get_ksm_page(stable_node, true);
H
Hugh Dickins 已提交
614 615
		if (!page)
			goto out;
H
Hugh Dickins 已提交
616

H
Hugh Dickins 已提交
617
		hlist_del(&rmap_item->hlist);
H
Hugh Dickins 已提交
618 619
		unlock_page(page);
		put_page(page);
620

H
Hugh Dickins 已提交
621 622 623
		if (stable_node->hlist.first)
			ksm_pages_sharing--;
		else
H
Hugh Dickins 已提交
624
			ksm_pages_shared--;
I
Izik Eidus 已提交
625

626
		put_anon_vma(rmap_item->anon_vma);
627
		rmap_item->address &= PAGE_MASK;
I
Izik Eidus 已提交
628

H
Hugh Dickins 已提交
629
	} else if (rmap_item->address & UNSTABLE_FLAG) {
I
Izik Eidus 已提交
630 631
		unsigned char age;
		/*
H
Hugh Dickins 已提交
632
		 * Usually ksmd can and must skip the rb_erase, because
I
Izik Eidus 已提交
633
		 * root_unstable_tree was already reset to RB_ROOT.
H
Hugh Dickins 已提交
634 635 636
		 * But be careful when an mm is exiting: do the rb_erase
		 * if this rmap_item was inserted by this scan, rather
		 * than left over from before.
I
Izik Eidus 已提交
637 638
		 */
		age = (unsigned char)(ksm_scan.seqnr - rmap_item->address);
639
		BUG_ON(age > 1);
I
Izik Eidus 已提交
640
		if (!age)
P
Petr Holasek 已提交
641
			rb_erase(&rmap_item->node,
H
Hugh Dickins 已提交
642
				 &root_unstable_tree[NUMA(rmap_item->nid)]);
643
		ksm_pages_unshared--;
644
		rmap_item->address &= PAGE_MASK;
I
Izik Eidus 已提交
645
	}
H
Hugh Dickins 已提交
646
out:
I
Izik Eidus 已提交
647 648 649 650
	cond_resched();		/* we're called from many long loops */
}

static void remove_trailing_rmap_items(struct mm_slot *mm_slot,
H
Hugh Dickins 已提交
651
				       struct rmap_item **rmap_list)
I
Izik Eidus 已提交
652
{
H
Hugh Dickins 已提交
653 654 655
	while (*rmap_list) {
		struct rmap_item *rmap_item = *rmap_list;
		*rmap_list = rmap_item->rmap_list;
I
Izik Eidus 已提交
656 657 658 659 660 661
		remove_rmap_item_from_tree(rmap_item);
		free_rmap_item(rmap_item);
	}
}

/*
H
Hugh Dickins 已提交
662
 * Though it's very tempting to unmerge rmap_items from stable tree rather
I
Izik Eidus 已提交
663 664 665 666 667
 * than check every pte of a given vma, the locking doesn't quite work for
 * that - an rmap_item is assigned to the stable tree after inserting ksm
 * page and upping mmap_sem.  Nor does it fit with the way we skip dup'ing
 * rmap_items from parent to child at fork time (so as not to waste time
 * if exit comes before the next scan reaches it).
H
Hugh Dickins 已提交
668 669 670 671 672
 *
 * Similarly, although we'd like to remove rmap_items (so updating counts
 * and freeing memory) when unmerging an area, it's easier to leave that
 * to the next pass of ksmd - consider, for example, how ksmd might be
 * in cmp_and_merge_page on one of the rmap_items we would be removing.
I
Izik Eidus 已提交
673
 */
H
Hugh Dickins 已提交
674 675
static int unmerge_ksm_pages(struct vm_area_struct *vma,
			     unsigned long start, unsigned long end)
I
Izik Eidus 已提交
676 677
{
	unsigned long addr;
H
Hugh Dickins 已提交
678
	int err = 0;
I
Izik Eidus 已提交
679

H
Hugh Dickins 已提交
680
	for (addr = start; addr < end && !err; addr += PAGE_SIZE) {
H
Hugh Dickins 已提交
681 682
		if (ksm_test_exit(vma->vm_mm))
			break;
H
Hugh Dickins 已提交
683 684 685 686 687 688
		if (signal_pending(current))
			err = -ERESTARTSYS;
		else
			err = break_ksm(vma, addr);
	}
	return err;
I
Izik Eidus 已提交
689 690
}

H
Hugh Dickins 已提交
691 692 693 694
#ifdef CONFIG_SYSFS
/*
 * Only called through the sysfs control interface:
 */
695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728
static int remove_stable_node(struct stable_node *stable_node)
{
	struct page *page;
	int err;

	page = get_ksm_page(stable_node, true);
	if (!page) {
		/*
		 * get_ksm_page did remove_node_from_stable_tree itself.
		 */
		return 0;
	}

	if (WARN_ON_ONCE(page_mapped(page)))
		err = -EBUSY;
	else {
		/*
		 * This page might be in a pagevec waiting to be freed,
		 * or it might be PageSwapCache (perhaps under writeback),
		 * or it might have been removed from swapcache a moment ago.
		 */
		set_page_stable_node(page, NULL);
		remove_node_from_stable_tree(stable_node);
		err = 0;
	}

	unlock_page(page);
	put_page(page);
	return err;
}

static int remove_all_stable_nodes(void)
{
	struct stable_node *stable_node;
729
	struct list_head *this, *next;
730 731 732 733 734 735 736 737 738 739 740 741 742 743
	int nid;
	int err = 0;

	for (nid = 0; nid < nr_node_ids; nid++) {
		while (root_stable_tree[nid].rb_node) {
			stable_node = rb_entry(root_stable_tree[nid].rb_node,
						struct stable_node, node);
			if (remove_stable_node(stable_node)) {
				err = -EBUSY;
				break;	/* proceed to next nid */
			}
			cond_resched();
		}
	}
744 745 746 747 748 749
	list_for_each_safe(this, next, &migrate_nodes) {
		stable_node = list_entry(this, struct stable_node, list);
		if (remove_stable_node(stable_node))
			err = -EBUSY;
		cond_resched();
	}
750 751 752
	return err;
}

H
Hugh Dickins 已提交
753
static int unmerge_and_remove_all_rmap_items(void)
I
Izik Eidus 已提交
754 755 756 757
{
	struct mm_slot *mm_slot;
	struct mm_struct *mm;
	struct vm_area_struct *vma;
H
Hugh Dickins 已提交
758 759 760
	int err = 0;

	spin_lock(&ksm_mmlist_lock);
H
Hugh Dickins 已提交
761
	ksm_scan.mm_slot = list_entry(ksm_mm_head.mm_list.next,
H
Hugh Dickins 已提交
762 763
						struct mm_slot, mm_list);
	spin_unlock(&ksm_mmlist_lock);
I
Izik Eidus 已提交
764

H
Hugh Dickins 已提交
765 766
	for (mm_slot = ksm_scan.mm_slot;
			mm_slot != &ksm_mm_head; mm_slot = ksm_scan.mm_slot) {
I
Izik Eidus 已提交
767 768 769
		mm = mm_slot->mm;
		down_read(&mm->mmap_sem);
		for (vma = mm->mmap; vma; vma = vma->vm_next) {
H
Hugh Dickins 已提交
770 771
			if (ksm_test_exit(mm))
				break;
I
Izik Eidus 已提交
772 773
			if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
				continue;
H
Hugh Dickins 已提交
774 775
			err = unmerge_ksm_pages(vma,
						vma->vm_start, vma->vm_end);
H
Hugh Dickins 已提交
776 777
			if (err)
				goto error;
I
Izik Eidus 已提交
778
		}
H
Hugh Dickins 已提交
779

H
Hugh Dickins 已提交
780
		remove_trailing_rmap_items(mm_slot, &mm_slot->rmap_list);
H
Hugh Dickins 已提交
781 782

		spin_lock(&ksm_mmlist_lock);
H
Hugh Dickins 已提交
783
		ksm_scan.mm_slot = list_entry(mm_slot->mm_list.next,
H
Hugh Dickins 已提交
784
						struct mm_slot, mm_list);
H
Hugh Dickins 已提交
785
		if (ksm_test_exit(mm)) {
786
			hash_del(&mm_slot->link);
H
Hugh Dickins 已提交
787 788 789 790 791 792 793 794 795 796 797
			list_del(&mm_slot->mm_list);
			spin_unlock(&ksm_mmlist_lock);

			free_mm_slot(mm_slot);
			clear_bit(MMF_VM_MERGEABLE, &mm->flags);
			up_read(&mm->mmap_sem);
			mmdrop(mm);
		} else {
			spin_unlock(&ksm_mmlist_lock);
			up_read(&mm->mmap_sem);
		}
I
Izik Eidus 已提交
798 799
	}

800 801
	/* Clean up stable nodes, but don't worry if some are still busy */
	remove_all_stable_nodes();
H
Hugh Dickins 已提交
802
	ksm_scan.seqnr = 0;
H
Hugh Dickins 已提交
803 804 805 806
	return 0;

error:
	up_read(&mm->mmap_sem);
I
Izik Eidus 已提交
807
	spin_lock(&ksm_mmlist_lock);
H
Hugh Dickins 已提交
808
	ksm_scan.mm_slot = &ksm_mm_head;
I
Izik Eidus 已提交
809
	spin_unlock(&ksm_mmlist_lock);
H
Hugh Dickins 已提交
810
	return err;
I
Izik Eidus 已提交
811
}
H
Hugh Dickins 已提交
812
#endif /* CONFIG_SYSFS */
I
Izik Eidus 已提交
813 814 815 816

static u32 calc_checksum(struct page *page)
{
	u32 checksum;
817
	void *addr = kmap_atomic(page);
I
Izik Eidus 已提交
818
	checksum = jhash2(addr, PAGE_SIZE / 4, 17);
819
	kunmap_atomic(addr);
I
Izik Eidus 已提交
820 821 822 823 824 825 826 827
	return checksum;
}

static int memcmp_pages(struct page *page1, struct page *page2)
{
	char *addr1, *addr2;
	int ret;

828 829
	addr1 = kmap_atomic(page1);
	addr2 = kmap_atomic(page2);
I
Izik Eidus 已提交
830
	ret = memcmp(addr1, addr2, PAGE_SIZE);
831 832
	kunmap_atomic(addr2);
	kunmap_atomic(addr1);
I
Izik Eidus 已提交
833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849
	return ret;
}

static inline int pages_identical(struct page *page1, struct page *page2)
{
	return !memcmp_pages(page1, page2);
}

static int write_protect_page(struct vm_area_struct *vma, struct page *page,
			      pte_t *orig_pte)
{
	struct mm_struct *mm = vma->vm_mm;
	unsigned long addr;
	pte_t *ptep;
	spinlock_t *ptl;
	int swapped;
	int err = -EFAULT;
850 851
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
I
Izik Eidus 已提交
852 853 854 855 856

	addr = page_address_in_vma(page, vma);
	if (addr == -EFAULT)
		goto out;

A
Andrea Arcangeli 已提交
857
	BUG_ON(PageTransCompound(page));
858 859 860 861 862

	mmun_start = addr;
	mmun_end   = addr + PAGE_SIZE;
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);

I
Izik Eidus 已提交
863 864
	ptep = page_check_address(page, mm, addr, &ptl, 0);
	if (!ptep)
865
		goto out_mn;
I
Izik Eidus 已提交
866

867
	if (pte_write(*ptep) || pte_dirty(*ptep)) {
I
Izik Eidus 已提交
868 869 870 871 872
		pte_t entry;

		swapped = PageSwapCache(page);
		flush_cache_page(vma, addr, page_to_pfn(page));
		/*
L
Lucas De Marchi 已提交
873
		 * Ok this is tricky, when get_user_pages_fast() run it doesn't
I
Izik Eidus 已提交
874 875 876 877 878 879 880 881 882 883 884 885
		 * take any lock, therefore the check that we are going to make
		 * with the pagecount against the mapcount is racey and
		 * O_DIRECT can happen right after the check.
		 * So we clear the pte and flush the tlb before the check
		 * this assure us that no O_DIRECT can happen after the check
		 * or in the middle of the check.
		 */
		entry = ptep_clear_flush(vma, addr, ptep);
		/*
		 * Check that no O_DIRECT or similar I/O is in progress on the
		 * page
		 */
886
		if (page_mapcount(page) + 1 + swapped != page_count(page)) {
887
			set_pte_at(mm, addr, ptep, entry);
I
Izik Eidus 已提交
888 889
			goto out_unlock;
		}
890 891 892
		if (pte_dirty(entry))
			set_page_dirty(page);
		entry = pte_mkclean(pte_wrprotect(entry));
I
Izik Eidus 已提交
893 894 895 896 897 898 899
		set_pte_at_notify(mm, addr, ptep, entry);
	}
	*orig_pte = *ptep;
	err = 0;

out_unlock:
	pte_unmap_unlock(ptep, ptl);
900 901
out_mn:
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
I
Izik Eidus 已提交
902 903 904 905 906 907
out:
	return err;
}

/**
 * replace_page - replace page in vma by new ksm page
908 909 910
 * @vma:      vma that holds the pte pointing to page
 * @page:     the page we are replacing by kpage
 * @kpage:    the ksm page we replace page by
I
Izik Eidus 已提交
911 912 913 914
 * @orig_pte: the original value of the pte
 *
 * Returns 0 on success, -EFAULT on failure.
 */
915 916
static int replace_page(struct vm_area_struct *vma, struct page *page,
			struct page *kpage, pte_t orig_pte)
I
Izik Eidus 已提交
917 918 919 920 921 922 923
{
	struct mm_struct *mm = vma->vm_mm;
	pmd_t *pmd;
	pte_t *ptep;
	spinlock_t *ptl;
	unsigned long addr;
	int err = -EFAULT;
924 925
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
I
Izik Eidus 已提交
926

927
	addr = page_address_in_vma(page, vma);
I
Izik Eidus 已提交
928 929 930
	if (addr == -EFAULT)
		goto out;

B
Bob Liu 已提交
931 932
	pmd = mm_find_pmd(mm, addr);
	if (!pmd)
I
Izik Eidus 已提交
933
		goto out;
A
Andrea Arcangeli 已提交
934
	BUG_ON(pmd_trans_huge(*pmd));
I
Izik Eidus 已提交
935

936 937 938 939
	mmun_start = addr;
	mmun_end   = addr + PAGE_SIZE;
	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);

I
Izik Eidus 已提交
940 941 942
	ptep = pte_offset_map_lock(mm, pmd, addr, &ptl);
	if (!pte_same(*ptep, orig_pte)) {
		pte_unmap_unlock(ptep, ptl);
943
		goto out_mn;
I
Izik Eidus 已提交
944 945
	}

946
	get_page(kpage);
H
Hugh Dickins 已提交
947
	page_add_anon_rmap(kpage, vma, addr);
I
Izik Eidus 已提交
948 949 950

	flush_cache_page(vma, addr, pte_pfn(*ptep));
	ptep_clear_flush(vma, addr, ptep);
951
	set_pte_at_notify(mm, addr, ptep, mk_pte(kpage, vma->vm_page_prot));
I
Izik Eidus 已提交
952

953
	page_remove_rmap(page);
954 955
	if (!page_mapped(page))
		try_to_free_swap(page);
956
	put_page(page);
I
Izik Eidus 已提交
957 958 959

	pte_unmap_unlock(ptep, ptl);
	err = 0;
960 961
out_mn:
	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
I
Izik Eidus 已提交
962 963 964 965
out:
	return err;
}

A
Andrea Arcangeli 已提交
966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992
static int page_trans_compound_anon_split(struct page *page)
{
	int ret = 0;
	struct page *transhuge_head = page_trans_compound_anon(page);
	if (transhuge_head) {
		/* Get the reference on the head to split it. */
		if (get_page_unless_zero(transhuge_head)) {
			/*
			 * Recheck we got the reference while the head
			 * was still anonymous.
			 */
			if (PageAnon(transhuge_head))
				ret = split_huge_page(transhuge_head);
			else
				/*
				 * Retry later if split_huge_page run
				 * from under us.
				 */
				ret = 1;
			put_page(transhuge_head);
		} else
			/* Retry later if split_huge_page run from under us. */
			ret = 1;
	}
	return ret;
}

I
Izik Eidus 已提交
993 994
/*
 * try_to_merge_one_page - take two pages and merge them into one
995 996
 * @vma: the vma that holds the pte pointing to page
 * @page: the PageAnon page that we want to replace with kpage
997 998
 * @kpage: the PageKsm page that we want to map instead of page,
 *         or NULL the first time when we want to use page as kpage.
I
Izik Eidus 已提交
999 1000 1001 1002
 *
 * This function returns 0 if the pages were merged, -EFAULT otherwise.
 */
static int try_to_merge_one_page(struct vm_area_struct *vma,
1003
				 struct page *page, struct page *kpage)
I
Izik Eidus 已提交
1004 1005 1006 1007
{
	pte_t orig_pte = __pte(0);
	int err = -EFAULT;

H
Hugh Dickins 已提交
1008 1009 1010
	if (page == kpage)			/* ksm page forked */
		return 0;

I
Izik Eidus 已提交
1011 1012
	if (!(vma->vm_flags & VM_MERGEABLE))
		goto out;
A
Andrea Arcangeli 已提交
1013 1014 1015
	if (PageTransCompound(page) && page_trans_compound_anon_split(page))
		goto out;
	BUG_ON(PageTransCompound(page));
1016
	if (!PageAnon(page))
I
Izik Eidus 已提交
1017 1018 1019 1020 1021 1022 1023 1024 1025
		goto out;

	/*
	 * We need the page lock to read a stable PageSwapCache in
	 * write_protect_page().  We use trylock_page() instead of
	 * lock_page() because we don't want to wait here - we
	 * prefer to continue scanning and merging different pages,
	 * then come back to this page when it is unlocked.
	 */
1026
	if (!trylock_page(page))
1027
		goto out;
I
Izik Eidus 已提交
1028 1029 1030 1031 1032 1033
	/*
	 * If this anonymous page is mapped only here, its pte may need
	 * to be write-protected.  If it's mapped elsewhere, all of its
	 * ptes are necessarily already write-protected.  But in either
	 * case, we need to lock and check page_count is not raised.
	 */
1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046
	if (write_protect_page(vma, page, &orig_pte) == 0) {
		if (!kpage) {
			/*
			 * While we hold page lock, upgrade page from
			 * PageAnon+anon_vma to PageKsm+NULL stable_node:
			 * stable_tree_insert() will update stable_node.
			 */
			set_page_stable_node(page, NULL);
			mark_page_accessed(page);
			err = 0;
		} else if (pages_identical(page, kpage))
			err = replace_page(vma, page, kpage, orig_pte);
	}
I
Izik Eidus 已提交
1047

1048
	if ((vma->vm_flags & VM_LOCKED) && kpage && !err) {
H
Hugh Dickins 已提交
1049
		munlock_vma_page(page);
H
Hugh Dickins 已提交
1050 1051 1052 1053 1054 1055 1056
		if (!PageMlocked(kpage)) {
			unlock_page(page);
			lock_page(kpage);
			mlock_vma_page(kpage);
			page = kpage;		/* for final unlock */
		}
	}
H
Hugh Dickins 已提交
1057

1058
	unlock_page(page);
I
Izik Eidus 已提交
1059 1060 1061 1062
out:
	return err;
}

H
Hugh Dickins 已提交
1063 1064 1065
/*
 * try_to_merge_with_ksm_page - like try_to_merge_two_pages,
 * but no new kernel page is allocated: kpage must already be a ksm page.
1066 1067
 *
 * This function returns 0 if the pages were merged, -EFAULT otherwise.
H
Hugh Dickins 已提交
1068
 */
1069 1070
static int try_to_merge_with_ksm_page(struct rmap_item *rmap_item,
				      struct page *page, struct page *kpage)
H
Hugh Dickins 已提交
1071
{
1072
	struct mm_struct *mm = rmap_item->mm;
H
Hugh Dickins 已提交
1073 1074 1075
	struct vm_area_struct *vma;
	int err = -EFAULT;

1076 1077
	down_read(&mm->mmap_sem);
	if (ksm_test_exit(mm))
H
Hugh Dickins 已提交
1078
		goto out;
1079 1080
	vma = find_vma(mm, rmap_item->address);
	if (!vma || vma->vm_start > rmap_item->address)
H
Hugh Dickins 已提交
1081 1082
		goto out;

1083
	err = try_to_merge_one_page(vma, page, kpage);
H
Hugh Dickins 已提交
1084 1085 1086 1087
	if (err)
		goto out;

	/* Must get reference to anon_vma while still holding mmap_sem */
1088 1089
	rmap_item->anon_vma = vma->anon_vma;
	get_anon_vma(vma->anon_vma);
H
Hugh Dickins 已提交
1090
out:
1091
	up_read(&mm->mmap_sem);
H
Hugh Dickins 已提交
1092 1093 1094
	return err;
}

I
Izik Eidus 已提交
1095 1096 1097 1098
/*
 * try_to_merge_two_pages - take two identical pages and prepare them
 * to be merged into one page.
 *
1099 1100
 * This function returns the kpage if we successfully merged two identical
 * pages into one ksm page, NULL otherwise.
I
Izik Eidus 已提交
1101
 *
1102
 * Note that this function upgrades page to ksm page: if one of the pages
I
Izik Eidus 已提交
1103 1104
 * is already a ksm page, try_to_merge_with_ksm_page should be used.
 */
1105 1106 1107 1108
static struct page *try_to_merge_two_pages(struct rmap_item *rmap_item,
					   struct page *page,
					   struct rmap_item *tree_rmap_item,
					   struct page *tree_page)
I
Izik Eidus 已提交
1109
{
1110
	int err;
I
Izik Eidus 已提交
1111

1112
	err = try_to_merge_with_ksm_page(rmap_item, page, NULL);
I
Izik Eidus 已提交
1113
	if (!err) {
1114
		err = try_to_merge_with_ksm_page(tree_rmap_item,
1115
							tree_page, page);
I
Izik Eidus 已提交
1116
		/*
H
Hugh Dickins 已提交
1117 1118
		 * If that fails, we have a ksm page with only one pte
		 * pointing to it: so break it.
I
Izik Eidus 已提交
1119
		 */
H
Hugh Dickins 已提交
1120
		if (err)
1121
			break_cow(rmap_item);
I
Izik Eidus 已提交
1122
	}
1123
	return err ? NULL : page;
I
Izik Eidus 已提交
1124 1125 1126
}

/*
1127
 * stable_tree_search - search for page inside the stable tree
I
Izik Eidus 已提交
1128 1129 1130 1131
 *
 * This function checks if there is a page inside the stable tree
 * with identical content to the page that we are scanning right now.
 *
H
Hugh Dickins 已提交
1132
 * This function returns the stable tree node of identical content if found,
I
Izik Eidus 已提交
1133 1134
 * NULL otherwise.
 */
1135
static struct page *stable_tree_search(struct page *page)
I
Izik Eidus 已提交
1136
{
P
Petr Holasek 已提交
1137
	int nid;
1138 1139 1140 1141
	struct rb_node **new;
	struct rb_node *parent;
	struct stable_node *stable_node;
	struct stable_node *page_node;
I
Izik Eidus 已提交
1142

1143 1144 1145
	page_node = page_stable_node(page);
	if (page_node && page_node->head != &migrate_nodes) {
		/* ksm page forked */
1146
		get_page(page);
1147
		return page;
1148 1149
	}

P
Petr Holasek 已提交
1150
	nid = get_kpfn_nid(page_to_pfn(page));
1151 1152 1153
again:
	new = &root_stable_tree[nid].rb_node;
	parent = NULL;
P
Petr Holasek 已提交
1154

1155
	while (*new) {
H
Hugh Dickins 已提交
1156
		struct page *tree_page;
I
Izik Eidus 已提交
1157 1158
		int ret;

1159
		cond_resched();
1160
		stable_node = rb_entry(*new, struct stable_node, node);
H
Hugh Dickins 已提交
1161
		tree_page = get_ksm_page(stable_node, false);
H
Hugh Dickins 已提交
1162 1163
		if (!tree_page)
			return NULL;
I
Izik Eidus 已提交
1164

H
Hugh Dickins 已提交
1165
		ret = memcmp_pages(page, tree_page);
1166
		put_page(tree_page);
I
Izik Eidus 已提交
1167

1168
		parent = *new;
1169
		if (ret < 0)
1170
			new = &parent->rb_left;
1171
		else if (ret > 0)
1172
			new = &parent->rb_right;
1173 1174 1175 1176 1177 1178 1179 1180 1181
		else {
			/*
			 * Lock and unlock the stable_node's page (which
			 * might already have been migrated) so that page
			 * migration is sure to notice its raised count.
			 * It would be more elegant to return stable_node
			 * than kpage, but that involves more changes.
			 */
			tree_page = get_ksm_page(stable_node, true);
1182
			if (tree_page) {
1183
				unlock_page(tree_page);
1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197
				if (get_kpfn_nid(stable_node->kpfn) !=
						NUMA(stable_node->nid)) {
					put_page(tree_page);
					goto replace;
				}
				return tree_page;
			}
			/*
			 * There is now a place for page_node, but the tree may
			 * have been rebalanced, so re-evaluate parent and new.
			 */
			if (page_node)
				goto again;
			return NULL;
1198
		}
I
Izik Eidus 已提交
1199 1200
	}

1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224
	if (!page_node)
		return NULL;

	list_del(&page_node->list);
	DO_NUMA(page_node->nid = nid);
	rb_link_node(&page_node->node, parent, new);
	rb_insert_color(&page_node->node, &root_stable_tree[nid]);
	get_page(page);
	return page;

replace:
	if (page_node) {
		list_del(&page_node->list);
		DO_NUMA(page_node->nid = nid);
		rb_replace_node(&stable_node->node,
				&page_node->node, &root_stable_tree[nid]);
		get_page(page);
	} else {
		rb_erase(&stable_node->node, &root_stable_tree[nid]);
		page = NULL;
	}
	stable_node->head = &migrate_nodes;
	list_add(&stable_node->list, stable_node->head);
	return page;
I
Izik Eidus 已提交
1225 1226 1227
}

/*
H
Hugh Dickins 已提交
1228
 * stable_tree_insert - insert stable tree node pointing to new ksm page
I
Izik Eidus 已提交
1229 1230
 * into the stable tree.
 *
H
Hugh Dickins 已提交
1231 1232
 * This function returns the stable tree node just allocated on success,
 * NULL otherwise.
I
Izik Eidus 已提交
1233
 */
H
Hugh Dickins 已提交
1234
static struct stable_node *stable_tree_insert(struct page *kpage)
I
Izik Eidus 已提交
1235
{
P
Petr Holasek 已提交
1236 1237 1238
	int nid;
	unsigned long kpfn;
	struct rb_node **new;
I
Izik Eidus 已提交
1239
	struct rb_node *parent = NULL;
H
Hugh Dickins 已提交
1240
	struct stable_node *stable_node;
I
Izik Eidus 已提交
1241

P
Petr Holasek 已提交
1242 1243 1244 1245
	kpfn = page_to_pfn(kpage);
	nid = get_kpfn_nid(kpfn);
	new = &root_stable_tree[nid].rb_node;

I
Izik Eidus 已提交
1246
	while (*new) {
H
Hugh Dickins 已提交
1247
		struct page *tree_page;
I
Izik Eidus 已提交
1248 1249
		int ret;

1250
		cond_resched();
H
Hugh Dickins 已提交
1251
		stable_node = rb_entry(*new, struct stable_node, node);
H
Hugh Dickins 已提交
1252
		tree_page = get_ksm_page(stable_node, false);
H
Hugh Dickins 已提交
1253 1254
		if (!tree_page)
			return NULL;
I
Izik Eidus 已提交
1255

H
Hugh Dickins 已提交
1256 1257
		ret = memcmp_pages(kpage, tree_page);
		put_page(tree_page);
I
Izik Eidus 已提交
1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273

		parent = *new;
		if (ret < 0)
			new = &parent->rb_left;
		else if (ret > 0)
			new = &parent->rb_right;
		else {
			/*
			 * It is not a bug that stable_tree_search() didn't
			 * find this node: because at that time our page was
			 * not yet write-protected, so may have changed since.
			 */
			return NULL;
		}
	}

H
Hugh Dickins 已提交
1274 1275 1276
	stable_node = alloc_stable_node();
	if (!stable_node)
		return NULL;
I
Izik Eidus 已提交
1277

H
Hugh Dickins 已提交
1278
	INIT_HLIST_HEAD(&stable_node->hlist);
P
Petr Holasek 已提交
1279
	stable_node->kpfn = kpfn;
1280
	set_page_stable_node(kpage, stable_node);
1281
	DO_NUMA(stable_node->nid = nid);
H
Hugh Dickins 已提交
1282 1283
	rb_link_node(&stable_node->node, parent, new);
	rb_insert_color(&stable_node->node, &root_stable_tree[nid]);
1284

H
Hugh Dickins 已提交
1285
	return stable_node;
I
Izik Eidus 已提交
1286 1287 1288
}

/*
1289 1290
 * unstable_tree_search_insert - search for identical page,
 * else insert rmap_item into the unstable tree.
I
Izik Eidus 已提交
1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301
 *
 * This function searches for a page in the unstable tree identical to the
 * page currently being scanned; and if no identical page is found in the
 * tree, we insert rmap_item as a new object into the unstable tree.
 *
 * This function returns pointer to rmap_item found to be identical
 * to the currently scanned page, NULL otherwise.
 *
 * This function does both searching and inserting, because they share
 * the same walking algorithm in an rbtree.
 */
1302 1303 1304 1305
static
struct rmap_item *unstable_tree_search_insert(struct rmap_item *rmap_item,
					      struct page *page,
					      struct page **tree_pagep)
I
Izik Eidus 已提交
1306
{
P
Petr Holasek 已提交
1307 1308
	struct rb_node **new;
	struct rb_root *root;
I
Izik Eidus 已提交
1309
	struct rb_node *parent = NULL;
P
Petr Holasek 已提交
1310 1311 1312 1313 1314
	int nid;

	nid = get_kpfn_nid(page_to_pfn(page));
	root = &root_unstable_tree[nid];
	new = &root->rb_node;
I
Izik Eidus 已提交
1315 1316 1317

	while (*new) {
		struct rmap_item *tree_rmap_item;
1318
		struct page *tree_page;
I
Izik Eidus 已提交
1319 1320
		int ret;

H
Hugh Dickins 已提交
1321
		cond_resched();
I
Izik Eidus 已提交
1322
		tree_rmap_item = rb_entry(*new, struct rmap_item, node);
1323
		tree_page = get_mergeable_page(tree_rmap_item);
1324
		if (IS_ERR_OR_NULL(tree_page))
I
Izik Eidus 已提交
1325 1326 1327
			return NULL;

		/*
1328
		 * Don't substitute a ksm page for a forked page.
I
Izik Eidus 已提交
1329
		 */
1330 1331
		if (page == tree_page) {
			put_page(tree_page);
I
Izik Eidus 已提交
1332 1333 1334
			return NULL;
		}

P
Petr Holasek 已提交
1335 1336 1337 1338 1339 1340 1341 1342 1343 1344
		/*
		 * If tree_page has been migrated to another NUMA node, it
		 * will be flushed out and put into the right unstable tree
		 * next time: only merge with it if merge_across_nodes.
		 */
		if (!ksm_merge_across_nodes && page_to_nid(tree_page) != nid) {
			put_page(tree_page);
			return NULL;
		}

1345
		ret = memcmp_pages(page, tree_page);
I
Izik Eidus 已提交
1346 1347 1348

		parent = *new;
		if (ret < 0) {
1349
			put_page(tree_page);
I
Izik Eidus 已提交
1350 1351
			new = &parent->rb_left;
		} else if (ret > 0) {
1352
			put_page(tree_page);
I
Izik Eidus 已提交
1353 1354
			new = &parent->rb_right;
		} else {
1355
			*tree_pagep = tree_page;
I
Izik Eidus 已提交
1356 1357 1358 1359
			return tree_rmap_item;
		}
	}

H
Hugh Dickins 已提交
1360
	rmap_item->address |= UNSTABLE_FLAG;
I
Izik Eidus 已提交
1361
	rmap_item->address |= (ksm_scan.seqnr & SEQNR_MASK);
H
Hugh Dickins 已提交
1362
	DO_NUMA(rmap_item->nid = nid);
I
Izik Eidus 已提交
1363
	rb_link_node(&rmap_item->node, parent, new);
P
Petr Holasek 已提交
1364
	rb_insert_color(&rmap_item->node, root);
I
Izik Eidus 已提交
1365

1366
	ksm_pages_unshared++;
I
Izik Eidus 已提交
1367 1368 1369 1370 1371 1372 1373 1374 1375
	return NULL;
}

/*
 * stable_tree_append - add another rmap_item to the linked list of
 * rmap_items hanging off a given node of the stable tree, all sharing
 * the same ksm page.
 */
static void stable_tree_append(struct rmap_item *rmap_item,
H
Hugh Dickins 已提交
1376
			       struct stable_node *stable_node)
I
Izik Eidus 已提交
1377
{
H
Hugh Dickins 已提交
1378
	rmap_item->head = stable_node;
I
Izik Eidus 已提交
1379
	rmap_item->address |= STABLE_FLAG;
H
Hugh Dickins 已提交
1380
	hlist_add_head(&rmap_item->hlist, &stable_node->hlist);
H
Hugh Dickins 已提交
1381

H
Hugh Dickins 已提交
1382 1383 1384 1385
	if (rmap_item->hlist.next)
		ksm_pages_sharing++;
	else
		ksm_pages_shared++;
I
Izik Eidus 已提交
1386 1387 1388
}

/*
H
Hugh Dickins 已提交
1389 1390 1391 1392
 * cmp_and_merge_page - first see if page can be merged into the stable tree;
 * if not, compare checksum to previous and if it's the same, see if page can
 * be inserted into the unstable tree, or merged with a page already there and
 * both transferred to the stable tree.
I
Izik Eidus 已提交
1393 1394 1395 1396 1397 1398 1399
 *
 * @page: the page that we are searching identical page to.
 * @rmap_item: the reverse mapping into the virtual address of this page
 */
static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item)
{
	struct rmap_item *tree_rmap_item;
1400
	struct page *tree_page = NULL;
H
Hugh Dickins 已提交
1401
	struct stable_node *stable_node;
1402
	struct page *kpage;
I
Izik Eidus 已提交
1403 1404 1405
	unsigned int checksum;
	int err;

1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418
	stable_node = page_stable_node(page);
	if (stable_node) {
		if (stable_node->head != &migrate_nodes &&
		    get_kpfn_nid(stable_node->kpfn) != NUMA(stable_node->nid)) {
			rb_erase(&stable_node->node,
				 &root_stable_tree[NUMA(stable_node->nid)]);
			stable_node->head = &migrate_nodes;
			list_add(&stable_node->list, stable_node->head);
		}
		if (stable_node->head != &migrate_nodes &&
		    rmap_item->head == stable_node)
			return;
	}
I
Izik Eidus 已提交
1419 1420

	/* We first start with searching the page inside the stable tree */
1421
	kpage = stable_tree_search(page);
1422 1423 1424 1425 1426 1427 1428
	if (kpage == page && rmap_item->head == stable_node) {
		put_page(kpage);
		return;
	}

	remove_rmap_item_from_tree(rmap_item);

1429
	if (kpage) {
1430
		err = try_to_merge_with_ksm_page(rmap_item, page, kpage);
I
Izik Eidus 已提交
1431 1432 1433 1434 1435
		if (!err) {
			/*
			 * The page was successfully merged:
			 * add its rmap_item to the stable tree.
			 */
H
Hugh Dickins 已提交
1436
			lock_page(kpage);
1437
			stable_tree_append(rmap_item, page_stable_node(kpage));
H
Hugh Dickins 已提交
1438
			unlock_page(kpage);
I
Izik Eidus 已提交
1439
		}
1440
		put_page(kpage);
I
Izik Eidus 已提交
1441 1442 1443 1444
		return;
	}

	/*
H
Hugh Dickins 已提交
1445 1446 1447 1448
	 * If the hash value of the page has changed from the last time
	 * we calculated it, this page is changing frequently: therefore we
	 * don't want to insert it in the unstable tree, and we don't want
	 * to waste our time searching for something identical to it there.
I
Izik Eidus 已提交
1449 1450 1451 1452 1453 1454 1455
	 */
	checksum = calc_checksum(page);
	if (rmap_item->oldchecksum != checksum) {
		rmap_item->oldchecksum = checksum;
		return;
	}

1456 1457
	tree_rmap_item =
		unstable_tree_search_insert(rmap_item, page, &tree_page);
I
Izik Eidus 已提交
1458
	if (tree_rmap_item) {
1459 1460 1461
		kpage = try_to_merge_two_pages(rmap_item, page,
						tree_rmap_item, tree_page);
		put_page(tree_page);
I
Izik Eidus 已提交
1462 1463 1464 1465 1466
		/*
		 * As soon as we merge this page, we want to remove the
		 * rmap_item of the page we have merged with from the unstable
		 * tree, and insert it instead as new node in the stable tree.
		 */
1467
		if (kpage) {
1468
			remove_rmap_item_from_tree(tree_rmap_item);
1469

H
Hugh Dickins 已提交
1470
			lock_page(kpage);
H
Hugh Dickins 已提交
1471 1472 1473 1474 1475
			stable_node = stable_tree_insert(kpage);
			if (stable_node) {
				stable_tree_append(tree_rmap_item, stable_node);
				stable_tree_append(rmap_item, stable_node);
			}
H
Hugh Dickins 已提交
1476
			unlock_page(kpage);
H
Hugh Dickins 已提交
1477

I
Izik Eidus 已提交
1478 1479 1480 1481 1482 1483
			/*
			 * If we fail to insert the page into the stable tree,
			 * we will have 2 virtual addresses that are pointing
			 * to a ksm page left outside the stable tree,
			 * in which case we need to break_cow on both.
			 */
H
Hugh Dickins 已提交
1484
			if (!stable_node) {
1485 1486
				break_cow(tree_rmap_item);
				break_cow(rmap_item);
I
Izik Eidus 已提交
1487 1488 1489 1490 1491 1492
			}
		}
	}
}

static struct rmap_item *get_next_rmap_item(struct mm_slot *mm_slot,
H
Hugh Dickins 已提交
1493
					    struct rmap_item **rmap_list,
I
Izik Eidus 已提交
1494 1495 1496 1497
					    unsigned long addr)
{
	struct rmap_item *rmap_item;

H
Hugh Dickins 已提交
1498 1499
	while (*rmap_list) {
		rmap_item = *rmap_list;
1500
		if ((rmap_item->address & PAGE_MASK) == addr)
I
Izik Eidus 已提交
1501 1502 1503
			return rmap_item;
		if (rmap_item->address > addr)
			break;
H
Hugh Dickins 已提交
1504
		*rmap_list = rmap_item->rmap_list;
I
Izik Eidus 已提交
1505 1506 1507 1508 1509 1510 1511 1512 1513
		remove_rmap_item_from_tree(rmap_item);
		free_rmap_item(rmap_item);
	}

	rmap_item = alloc_rmap_item();
	if (rmap_item) {
		/* It has already been zeroed */
		rmap_item->mm = mm_slot->mm;
		rmap_item->address = addr;
H
Hugh Dickins 已提交
1514 1515
		rmap_item->rmap_list = *rmap_list;
		*rmap_list = rmap_item;
I
Izik Eidus 已提交
1516 1517 1518 1519 1520 1521 1522 1523 1524 1525
	}
	return rmap_item;
}

static struct rmap_item *scan_get_next_rmap_item(struct page **page)
{
	struct mm_struct *mm;
	struct mm_slot *slot;
	struct vm_area_struct *vma;
	struct rmap_item *rmap_item;
P
Petr Holasek 已提交
1526
	int nid;
I
Izik Eidus 已提交
1527 1528 1529 1530 1531 1532

	if (list_empty(&ksm_mm_head.mm_list))
		return NULL;

	slot = ksm_scan.mm_slot;
	if (slot == &ksm_mm_head) {
H
Hugh Dickins 已提交
1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544
		/*
		 * A number of pages can hang around indefinitely on per-cpu
		 * pagevecs, raised page count preventing write_protect_page
		 * from merging them.  Though it doesn't really matter much,
		 * it is puzzling to see some stuck in pages_volatile until
		 * other activity jostles them out, and they also prevented
		 * LTP's KSM test from succeeding deterministically; so drain
		 * them here (here rather than on entry to ksm_do_scan(),
		 * so we don't IPI too often when pages_to_scan is set low).
		 */
		lru_add_drain_all();

1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565
		/*
		 * Whereas stale stable_nodes on the stable_tree itself
		 * get pruned in the regular course of stable_tree_search(),
		 * those moved out to the migrate_nodes list can accumulate:
		 * so prune them once before each full scan.
		 */
		if (!ksm_merge_across_nodes) {
			struct stable_node *stable_node;
			struct list_head *this, *next;
			struct page *page;

			list_for_each_safe(this, next, &migrate_nodes) {
				stable_node = list_entry(this,
						struct stable_node, list);
				page = get_ksm_page(stable_node, false);
				if (page)
					put_page(page);
				cond_resched();
			}
		}

P
Petr Holasek 已提交
1566 1567
		for (nid = 0; nid < nr_node_ids; nid++)
			root_unstable_tree[nid] = RB_ROOT;
I
Izik Eidus 已提交
1568 1569 1570 1571 1572

		spin_lock(&ksm_mmlist_lock);
		slot = list_entry(slot->mm_list.next, struct mm_slot, mm_list);
		ksm_scan.mm_slot = slot;
		spin_unlock(&ksm_mmlist_lock);
1573 1574 1575 1576 1577 1578
		/*
		 * Although we tested list_empty() above, a racing __ksm_exit
		 * of the last mm on the list may have removed it since then.
		 */
		if (slot == &ksm_mm_head)
			return NULL;
I
Izik Eidus 已提交
1579 1580
next_mm:
		ksm_scan.address = 0;
H
Hugh Dickins 已提交
1581
		ksm_scan.rmap_list = &slot->rmap_list;
I
Izik Eidus 已提交
1582 1583 1584 1585
	}

	mm = slot->mm;
	down_read(&mm->mmap_sem);
H
Hugh Dickins 已提交
1586 1587 1588 1589 1590 1591
	if (ksm_test_exit(mm))
		vma = NULL;
	else
		vma = find_vma(mm, ksm_scan.address);

	for (; vma; vma = vma->vm_next) {
I
Izik Eidus 已提交
1592 1593 1594 1595 1596 1597 1598 1599
		if (!(vma->vm_flags & VM_MERGEABLE))
			continue;
		if (ksm_scan.address < vma->vm_start)
			ksm_scan.address = vma->vm_start;
		if (!vma->anon_vma)
			ksm_scan.address = vma->vm_end;

		while (ksm_scan.address < vma->vm_end) {
H
Hugh Dickins 已提交
1600 1601
			if (ksm_test_exit(mm))
				break;
I
Izik Eidus 已提交
1602
			*page = follow_page(vma, ksm_scan.address, FOLL_GET);
1603 1604 1605 1606 1607
			if (IS_ERR_OR_NULL(*page)) {
				ksm_scan.address += PAGE_SIZE;
				cond_resched();
				continue;
			}
A
Andrea Arcangeli 已提交
1608 1609
			if (PageAnon(*page) ||
			    page_trans_compound_anon(*page)) {
I
Izik Eidus 已提交
1610 1611 1612
				flush_anon_page(vma, *page, ksm_scan.address);
				flush_dcache_page(*page);
				rmap_item = get_next_rmap_item(slot,
H
Hugh Dickins 已提交
1613
					ksm_scan.rmap_list, ksm_scan.address);
I
Izik Eidus 已提交
1614
				if (rmap_item) {
H
Hugh Dickins 已提交
1615 1616
					ksm_scan.rmap_list =
							&rmap_item->rmap_list;
I
Izik Eidus 已提交
1617 1618 1619 1620 1621 1622
					ksm_scan.address += PAGE_SIZE;
				} else
					put_page(*page);
				up_read(&mm->mmap_sem);
				return rmap_item;
			}
1623
			put_page(*page);
I
Izik Eidus 已提交
1624 1625 1626 1627 1628
			ksm_scan.address += PAGE_SIZE;
			cond_resched();
		}
	}

H
Hugh Dickins 已提交
1629 1630
	if (ksm_test_exit(mm)) {
		ksm_scan.address = 0;
H
Hugh Dickins 已提交
1631
		ksm_scan.rmap_list = &slot->rmap_list;
H
Hugh Dickins 已提交
1632
	}
I
Izik Eidus 已提交
1633 1634 1635 1636
	/*
	 * Nuke all the rmap_items that are above this current rmap:
	 * because there were no VM_MERGEABLE vmas with such addresses.
	 */
H
Hugh Dickins 已提交
1637
	remove_trailing_rmap_items(slot, ksm_scan.rmap_list);
I
Izik Eidus 已提交
1638 1639

	spin_lock(&ksm_mmlist_lock);
1640 1641 1642 1643 1644 1645 1646
	ksm_scan.mm_slot = list_entry(slot->mm_list.next,
						struct mm_slot, mm_list);
	if (ksm_scan.address == 0) {
		/*
		 * We've completed a full scan of all vmas, holding mmap_sem
		 * throughout, and found no VM_MERGEABLE: so do the same as
		 * __ksm_exit does to remove this mm from all our lists now.
H
Hugh Dickins 已提交
1647 1648 1649 1650
		 * This applies either when cleaning up after __ksm_exit
		 * (but beware: we can reach here even before __ksm_exit),
		 * or when all VM_MERGEABLE areas have been unmapped (and
		 * mmap_sem then protects against race with MADV_MERGEABLE).
1651
		 */
1652
		hash_del(&slot->link);
1653
		list_del(&slot->mm_list);
H
Hugh Dickins 已提交
1654 1655
		spin_unlock(&ksm_mmlist_lock);

1656 1657
		free_mm_slot(slot);
		clear_bit(MMF_VM_MERGEABLE, &mm->flags);
H
Hugh Dickins 已提交
1658 1659 1660 1661 1662
		up_read(&mm->mmap_sem);
		mmdrop(mm);
	} else {
		spin_unlock(&ksm_mmlist_lock);
		up_read(&mm->mmap_sem);
1663
	}
I
Izik Eidus 已提交
1664 1665

	/* Repeat until we've completed scanning the whole list */
1666
	slot = ksm_scan.mm_slot;
I
Izik Eidus 已提交
1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680
	if (slot != &ksm_mm_head)
		goto next_mm;

	ksm_scan.seqnr++;
	return NULL;
}

/**
 * ksm_do_scan  - the ksm scanner main worker function.
 * @scan_npages - number of pages we want to scan before we return.
 */
static void ksm_do_scan(unsigned int scan_npages)
{
	struct rmap_item *rmap_item;
1681
	struct page *uninitialized_var(page);
I
Izik Eidus 已提交
1682

1683
	while (scan_npages-- && likely(!freezing(current))) {
I
Izik Eidus 已提交
1684 1685 1686 1687
		cond_resched();
		rmap_item = scan_get_next_rmap_item(&page);
		if (!rmap_item)
			return;
1688
		cmp_and_merge_page(page, rmap_item);
I
Izik Eidus 已提交
1689 1690 1691 1692
		put_page(page);
	}
}

H
Hugh Dickins 已提交
1693 1694 1695 1696 1697
static int ksmd_should_run(void)
{
	return (ksm_run & KSM_RUN_MERGE) && !list_empty(&ksm_mm_head.mm_list);
}

I
Izik Eidus 已提交
1698 1699
static int ksm_scan_thread(void *nothing)
{
1700
	set_freezable();
I
Izik Eidus 已提交
1701
	set_user_nice(current, 5);
I
Izik Eidus 已提交
1702 1703

	while (!kthread_should_stop()) {
H
Hugh Dickins 已提交
1704
		mutex_lock(&ksm_thread_mutex);
1705
		wait_while_offlining();
H
Hugh Dickins 已提交
1706
		if (ksmd_should_run())
I
Izik Eidus 已提交
1707
			ksm_do_scan(ksm_thread_pages_to_scan);
H
Hugh Dickins 已提交
1708 1709
		mutex_unlock(&ksm_thread_mutex);

1710 1711
		try_to_freeze();

H
Hugh Dickins 已提交
1712
		if (ksmd_should_run()) {
I
Izik Eidus 已提交
1713 1714 1715
			schedule_timeout_interruptible(
				msecs_to_jiffies(ksm_thread_sleep_millisecs));
		} else {
1716
			wait_event_freezable(ksm_thread_wait,
H
Hugh Dickins 已提交
1717
				ksmd_should_run() || kthread_should_stop());
I
Izik Eidus 已提交
1718 1719 1720 1721 1722
		}
	}
	return 0;
}

H
Hugh Dickins 已提交
1723 1724 1725 1726
int ksm_madvise(struct vm_area_struct *vma, unsigned long start,
		unsigned long end, int advice, unsigned long *vm_flags)
{
	struct mm_struct *mm = vma->vm_mm;
H
Hugh Dickins 已提交
1727
	int err;
H
Hugh Dickins 已提交
1728 1729 1730 1731 1732 1733 1734 1735

	switch (advice) {
	case MADV_MERGEABLE:
		/*
		 * Be somewhat over-protective for now!
		 */
		if (*vm_flags & (VM_MERGEABLE | VM_SHARED  | VM_MAYSHARE   |
				 VM_PFNMAP    | VM_IO      | VM_DONTEXPAND |
1736
				 VM_HUGETLB | VM_NONLINEAR | VM_MIXEDMAP))
H
Hugh Dickins 已提交
1737 1738
			return 0;		/* just ignore the advice */

1739 1740 1741 1742 1743
#ifdef VM_SAO
		if (*vm_flags & VM_SAO)
			return 0;
#endif

H
Hugh Dickins 已提交
1744 1745 1746 1747 1748
		if (!test_bit(MMF_VM_MERGEABLE, &mm->flags)) {
			err = __ksm_enter(mm);
			if (err)
				return err;
		}
H
Hugh Dickins 已提交
1749 1750 1751 1752 1753 1754 1755 1756

		*vm_flags |= VM_MERGEABLE;
		break;

	case MADV_UNMERGEABLE:
		if (!(*vm_flags & VM_MERGEABLE))
			return 0;		/* just ignore the advice */

H
Hugh Dickins 已提交
1757 1758 1759 1760 1761
		if (vma->anon_vma) {
			err = unmerge_ksm_pages(vma, start, end);
			if (err)
				return err;
		}
H
Hugh Dickins 已提交
1762 1763 1764 1765 1766 1767 1768 1769 1770 1771

		*vm_flags &= ~VM_MERGEABLE;
		break;
	}

	return 0;
}

int __ksm_enter(struct mm_struct *mm)
{
H
Hugh Dickins 已提交
1772 1773 1774 1775
	struct mm_slot *mm_slot;
	int needs_wakeup;

	mm_slot = alloc_mm_slot();
I
Izik Eidus 已提交
1776 1777 1778
	if (!mm_slot)
		return -ENOMEM;

H
Hugh Dickins 已提交
1779 1780 1781
	/* Check ksm_run too?  Would need tighter locking */
	needs_wakeup = list_empty(&ksm_mm_head.mm_list);

I
Izik Eidus 已提交
1782 1783 1784
	spin_lock(&ksm_mmlist_lock);
	insert_to_mm_slots_hash(mm, mm_slot);
	/*
1785 1786
	 * When KSM_RUN_MERGE (or KSM_RUN_STOP),
	 * insert just behind the scanning cursor, to let the area settle
I
Izik Eidus 已提交
1787 1788
	 * down a little; when fork is followed by immediate exec, we don't
	 * want ksmd to waste time setting up and tearing down an rmap_list.
1789 1790 1791 1792
	 *
	 * But when KSM_RUN_UNMERGE, it's important to insert ahead of its
	 * scanning cursor, otherwise KSM pages in newly forked mms will be
	 * missed: then we might as well insert at the end of the list.
I
Izik Eidus 已提交
1793
	 */
1794 1795 1796 1797
	if (ksm_run & KSM_RUN_UNMERGE)
		list_add_tail(&mm_slot->mm_list, &ksm_mm_head.mm_list);
	else
		list_add_tail(&mm_slot->mm_list, &ksm_scan.mm_slot->mm_list);
I
Izik Eidus 已提交
1798 1799
	spin_unlock(&ksm_mmlist_lock);

H
Hugh Dickins 已提交
1800
	set_bit(MMF_VM_MERGEABLE, &mm->flags);
H
Hugh Dickins 已提交
1801
	atomic_inc(&mm->mm_count);
H
Hugh Dickins 已提交
1802 1803 1804 1805

	if (needs_wakeup)
		wake_up_interruptible(&ksm_thread_wait);

H
Hugh Dickins 已提交
1806 1807 1808
	return 0;
}

1809
void __ksm_exit(struct mm_struct *mm)
H
Hugh Dickins 已提交
1810
{
1811
	struct mm_slot *mm_slot;
H
Hugh Dickins 已提交
1812
	int easy_to_free = 0;
1813

I
Izik Eidus 已提交
1814
	/*
H
Hugh Dickins 已提交
1815 1816 1817 1818 1819 1820
	 * This process is exiting: if it's straightforward (as is the
	 * case when ksmd was never running), free mm_slot immediately.
	 * But if it's at the cursor or has rmap_items linked to it, use
	 * mmap_sem to synchronize with any break_cows before pagetables
	 * are freed, and leave the mm_slot on the list for ksmd to free.
	 * Beware: ksm may already have noticed it exiting and freed the slot.
I
Izik Eidus 已提交
1821
	 */
H
Hugh Dickins 已提交
1822

1823 1824
	spin_lock(&ksm_mmlist_lock);
	mm_slot = get_mm_slot(mm);
H
Hugh Dickins 已提交
1825
	if (mm_slot && ksm_scan.mm_slot != mm_slot) {
H
Hugh Dickins 已提交
1826
		if (!mm_slot->rmap_list) {
1827
			hash_del(&mm_slot->link);
H
Hugh Dickins 已提交
1828 1829 1830 1831 1832 1833
			list_del(&mm_slot->mm_list);
			easy_to_free = 1;
		} else {
			list_move(&mm_slot->mm_list,
				  &ksm_scan.mm_slot->mm_list);
		}
1834 1835 1836
	}
	spin_unlock(&ksm_mmlist_lock);

H
Hugh Dickins 已提交
1837 1838 1839 1840 1841 1842 1843 1844
	if (easy_to_free) {
		free_mm_slot(mm_slot);
		clear_bit(MMF_VM_MERGEABLE, &mm->flags);
		mmdrop(mm);
	} else if (mm_slot) {
		down_write(&mm->mmap_sem);
		up_write(&mm->mmap_sem);
	}
I
Izik Eidus 已提交
1845 1846
}

1847
struct page *ksm_might_need_to_copy(struct page *page,
H
Hugh Dickins 已提交
1848 1849
			struct vm_area_struct *vma, unsigned long address)
{
1850
	struct anon_vma *anon_vma = page_anon_vma(page);
H
Hugh Dickins 已提交
1851 1852
	struct page *new_page;

1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865
	if (PageKsm(page)) {
		if (page_stable_node(page) &&
		    !(ksm_run & KSM_RUN_UNMERGE))
			return page;	/* no need to copy it */
	} else if (!anon_vma) {
		return page;		/* no need to copy it */
	} else if (anon_vma->root == vma->anon_vma->root &&
		 page->index == linear_page_index(vma, address)) {
		return page;		/* still no need to copy it */
	}
	if (!PageUptodate(page))
		return page;		/* let do_swap_page report the error */

H
Hugh Dickins 已提交
1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885
	new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
	if (new_page) {
		copy_user_highpage(new_page, page, address, vma);

		SetPageDirty(new_page);
		__SetPageUptodate(new_page);
		__set_page_locked(new_page);
	}

	return new_page;
}

int page_referenced_ksm(struct page *page, struct mem_cgroup *memcg,
			unsigned long *vm_flags)
{
	struct stable_node *stable_node;
	struct rmap_item *rmap_item;
	struct hlist_node *hlist;
	unsigned int mapcount = page_mapcount(page);
	int referenced = 0;
H
Hugh Dickins 已提交
1886
	int search_new_forks = 0;
H
Hugh Dickins 已提交
1887 1888 1889 1890 1891 1892 1893

	VM_BUG_ON(!PageKsm(page));
	VM_BUG_ON(!PageLocked(page));

	stable_node = page_stable_node(page);
	if (!stable_node)
		return 0;
H
Hugh Dickins 已提交
1894
again:
H
Hugh Dickins 已提交
1895
	hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
H
Hugh Dickins 已提交
1896
		struct anon_vma *anon_vma = rmap_item->anon_vma;
1897
		struct anon_vma_chain *vmac;
H
Hugh Dickins 已提交
1898
		struct vm_area_struct *vma;
H
Hugh Dickins 已提交
1899

H
Hugh Dickins 已提交
1900
		anon_vma_lock_read(anon_vma);
1901 1902
		anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
					       0, ULONG_MAX) {
1903
			vma = vmac->vma;
H
Hugh Dickins 已提交
1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917
			if (rmap_item->address < vma->vm_start ||
			    rmap_item->address >= vma->vm_end)
				continue;
			/*
			 * Initially we examine only the vma which covers this
			 * rmap_item; but later, if there is still work to do,
			 * we examine covering vmas in other mms: in case they
			 * were forked from the original since ksmd passed.
			 */
			if ((rmap_item->mm == vma->vm_mm) == search_new_forks)
				continue;

			if (memcg && !mm_match_cgroup(vma->vm_mm, memcg))
				continue;
H
Hugh Dickins 已提交
1918

H
Hugh Dickins 已提交
1919
			referenced += page_referenced_one(page, vma,
H
Hugh Dickins 已提交
1920
				rmap_item->address, &mapcount, vm_flags);
H
Hugh Dickins 已提交
1921 1922 1923
			if (!search_new_forks || !mapcount)
				break;
		}
H
Hugh Dickins 已提交
1924
		anon_vma_unlock_read(anon_vma);
H
Hugh Dickins 已提交
1925 1926 1927
		if (!mapcount)
			goto out;
	}
H
Hugh Dickins 已提交
1928 1929
	if (!search_new_forks++)
		goto again;
H
Hugh Dickins 已提交
1930 1931 1932 1933 1934 1935 1936 1937 1938 1939
out:
	return referenced;
}

int try_to_unmap_ksm(struct page *page, enum ttu_flags flags)
{
	struct stable_node *stable_node;
	struct hlist_node *hlist;
	struct rmap_item *rmap_item;
	int ret = SWAP_AGAIN;
H
Hugh Dickins 已提交
1940
	int search_new_forks = 0;
H
Hugh Dickins 已提交
1941 1942 1943 1944 1945 1946 1947

	VM_BUG_ON(!PageKsm(page));
	VM_BUG_ON(!PageLocked(page));

	stable_node = page_stable_node(page);
	if (!stable_node)
		return SWAP_FAIL;
H
Hugh Dickins 已提交
1948
again:
H
Hugh Dickins 已提交
1949
	hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
H
Hugh Dickins 已提交
1950
		struct anon_vma *anon_vma = rmap_item->anon_vma;
1951
		struct anon_vma_chain *vmac;
H
Hugh Dickins 已提交
1952
		struct vm_area_struct *vma;
H
Hugh Dickins 已提交
1953

H
Hugh Dickins 已提交
1954
		anon_vma_lock_read(anon_vma);
1955 1956
		anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
					       0, ULONG_MAX) {
1957
			vma = vmac->vma;
H
Hugh Dickins 已提交
1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972
			if (rmap_item->address < vma->vm_start ||
			    rmap_item->address >= vma->vm_end)
				continue;
			/*
			 * Initially we examine only the vma which covers this
			 * rmap_item; but later, if there is still work to do,
			 * we examine covering vmas in other mms: in case they
			 * were forked from the original since ksmd passed.
			 */
			if ((rmap_item->mm == vma->vm_mm) == search_new_forks)
				continue;

			ret = try_to_unmap_one(page, vma,
					rmap_item->address, flags);
			if (ret != SWAP_AGAIN || !page_mapped(page)) {
H
Hugh Dickins 已提交
1973
				anon_vma_unlock_read(anon_vma);
H
Hugh Dickins 已提交
1974 1975 1976
				goto out;
			}
		}
H
Hugh Dickins 已提交
1977
		anon_vma_unlock_read(anon_vma);
H
Hugh Dickins 已提交
1978
	}
H
Hugh Dickins 已提交
1979 1980
	if (!search_new_forks++)
		goto again;
H
Hugh Dickins 已提交
1981 1982 1983 1984
out:
	return ret;
}

1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003
#ifdef CONFIG_MIGRATION
int rmap_walk_ksm(struct page *page, int (*rmap_one)(struct page *,
		  struct vm_area_struct *, unsigned long, void *), void *arg)
{
	struct stable_node *stable_node;
	struct hlist_node *hlist;
	struct rmap_item *rmap_item;
	int ret = SWAP_AGAIN;
	int search_new_forks = 0;

	VM_BUG_ON(!PageKsm(page));
	VM_BUG_ON(!PageLocked(page));

	stable_node = page_stable_node(page);
	if (!stable_node)
		return ret;
again:
	hlist_for_each_entry(rmap_item, hlist, &stable_node->hlist, hlist) {
		struct anon_vma *anon_vma = rmap_item->anon_vma;
2004
		struct anon_vma_chain *vmac;
2005 2006
		struct vm_area_struct *vma;

H
Hugh Dickins 已提交
2007
		anon_vma_lock_read(anon_vma);
2008 2009
		anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root,
					       0, ULONG_MAX) {
2010
			vma = vmac->vma;
2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024
			if (rmap_item->address < vma->vm_start ||
			    rmap_item->address >= vma->vm_end)
				continue;
			/*
			 * Initially we examine only the vma which covers this
			 * rmap_item; but later, if there is still work to do,
			 * we examine covering vmas in other mms: in case they
			 * were forked from the original since ksmd passed.
			 */
			if ((rmap_item->mm == vma->vm_mm) == search_new_forks)
				continue;

			ret = rmap_one(page, vma, rmap_item->address, arg);
			if (ret != SWAP_AGAIN) {
H
Hugh Dickins 已提交
2025
				anon_vma_unlock_read(anon_vma);
2026 2027 2028
				goto out;
			}
		}
H
Hugh Dickins 已提交
2029
		anon_vma_unlock_read(anon_vma);
2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046
	}
	if (!search_new_forks++)
		goto again;
out:
	return ret;
}

void ksm_migrate_page(struct page *newpage, struct page *oldpage)
{
	struct stable_node *stable_node;

	VM_BUG_ON(!PageLocked(oldpage));
	VM_BUG_ON(!PageLocked(newpage));
	VM_BUG_ON(newpage->mapping != oldpage->mapping);

	stable_node = page_stable_node(newpage);
	if (stable_node) {
2047 2048
		VM_BUG_ON(stable_node->kpfn != page_to_pfn(oldpage));
		stable_node->kpfn = page_to_pfn(newpage);
2049 2050 2051 2052 2053 2054 2055 2056
		/*
		 * newpage->mapping was set in advance; now we need smp_wmb()
		 * to make sure that the new stable_node->kpfn is visible
		 * to get_ksm_page() before it can see that oldpage->mapping
		 * has gone stale (or that PageSwapCache has been cleared).
		 */
		smp_wmb();
		set_page_stable_node(oldpage, NULL);
2057 2058 2059 2060
	}
}
#endif /* CONFIG_MIGRATION */

2061
#ifdef CONFIG_MEMORY_HOTREMOVE
2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077
static int just_wait(void *word)
{
	schedule();
	return 0;
}

static void wait_while_offlining(void)
{
	while (ksm_run & KSM_RUN_OFFLINE) {
		mutex_unlock(&ksm_thread_mutex);
		wait_on_bit(&ksm_run, ilog2(KSM_RUN_OFFLINE),
				just_wait, TASK_UNINTERRUPTIBLE);
		mutex_lock(&ksm_thread_mutex);
	}
}

2078 2079
static void ksm_check_stable_tree(unsigned long start_pfn,
				  unsigned long end_pfn)
2080
{
2081
	struct stable_node *stable_node;
2082
	struct list_head *this, *next;
2083
	struct rb_node *node;
P
Petr Holasek 已提交
2084
	int nid;
2085

2086 2087 2088
	for (nid = 0; nid < nr_node_ids; nid++) {
		node = rb_first(&root_stable_tree[nid]);
		while (node) {
P
Petr Holasek 已提交
2089 2090
			stable_node = rb_entry(node, struct stable_node, node);
			if (stable_node->kpfn >= start_pfn &&
2091 2092 2093 2094 2095 2096 2097 2098 2099 2100
			    stable_node->kpfn < end_pfn) {
				/*
				 * Don't get_ksm_page, page has already gone:
				 * which is why we keep kpfn instead of page*
				 */
				remove_node_from_stable_tree(stable_node);
				node = rb_first(&root_stable_tree[nid]);
			} else
				node = rb_next(node);
			cond_resched();
P
Petr Holasek 已提交
2101
		}
2102
	}
2103 2104 2105 2106 2107 2108 2109
	list_for_each_safe(this, next, &migrate_nodes) {
		stable_node = list_entry(this, struct stable_node, list);
		if (stable_node->kpfn >= start_pfn &&
		    stable_node->kpfn < end_pfn)
			remove_node_from_stable_tree(stable_node);
		cond_resched();
	}
2110 2111 2112 2113 2114 2115 2116 2117 2118 2119
}

static int ksm_memory_callback(struct notifier_block *self,
			       unsigned long action, void *arg)
{
	struct memory_notify *mn = arg;

	switch (action) {
	case MEM_GOING_OFFLINE:
		/*
2120 2121 2122 2123 2124
		 * Prevent ksm_do_scan(), unmerge_and_remove_all_rmap_items()
		 * and remove_all_stable_nodes() while memory is going offline:
		 * it is unsafe for them to touch the stable tree at this time.
		 * But unmerge_ksm_pages(), rmap lookups and other entry points
		 * which do not need the ksm_thread_mutex are all safe.
2125
		 */
2126 2127 2128
		mutex_lock(&ksm_thread_mutex);
		ksm_run |= KSM_RUN_OFFLINE;
		mutex_unlock(&ksm_thread_mutex);
2129 2130 2131 2132 2133 2134
		break;

	case MEM_OFFLINE:
		/*
		 * Most of the work is done by page migration; but there might
		 * be a few stable_nodes left over, still pointing to struct
2135 2136 2137
		 * pages which have been offlined: prune those from the tree,
		 * otherwise get_ksm_page() might later try to access a
		 * non-existent struct page.
2138
		 */
2139 2140
		ksm_check_stable_tree(mn->start_pfn,
				      mn->start_pfn + mn->nr_pages);
2141 2142 2143
		/* fallthrough */

	case MEM_CANCEL_OFFLINE:
2144 2145
		mutex_lock(&ksm_thread_mutex);
		ksm_run &= ~KSM_RUN_OFFLINE;
2146
		mutex_unlock(&ksm_thread_mutex);
2147 2148 2149

		smp_mb();	/* wake_up_bit advises this */
		wake_up_bit(&ksm_run, ilog2(KSM_RUN_OFFLINE));
2150 2151 2152 2153
		break;
	}
	return NOTIFY_OK;
}
2154 2155 2156 2157
#else
static void wait_while_offlining(void)
{
}
2158 2159
#endif /* CONFIG_MEMORY_HOTREMOVE */

H
Hugh Dickins 已提交
2160 2161 2162 2163 2164
#ifdef CONFIG_SYSFS
/*
 * This all compiles without CONFIG_SYSFS, but is a waste of space.
 */

I
Izik Eidus 已提交
2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219
#define KSM_ATTR_RO(_name) \
	static struct kobj_attribute _name##_attr = __ATTR_RO(_name)
#define KSM_ATTR(_name) \
	static struct kobj_attribute _name##_attr = \
		__ATTR(_name, 0644, _name##_show, _name##_store)

static ssize_t sleep_millisecs_show(struct kobject *kobj,
				    struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%u\n", ksm_thread_sleep_millisecs);
}

static ssize_t sleep_millisecs_store(struct kobject *kobj,
				     struct kobj_attribute *attr,
				     const char *buf, size_t count)
{
	unsigned long msecs;
	int err;

	err = strict_strtoul(buf, 10, &msecs);
	if (err || msecs > UINT_MAX)
		return -EINVAL;

	ksm_thread_sleep_millisecs = msecs;

	return count;
}
KSM_ATTR(sleep_millisecs);

static ssize_t pages_to_scan_show(struct kobject *kobj,
				  struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%u\n", ksm_thread_pages_to_scan);
}

static ssize_t pages_to_scan_store(struct kobject *kobj,
				   struct kobj_attribute *attr,
				   const char *buf, size_t count)
{
	int err;
	unsigned long nr_pages;

	err = strict_strtoul(buf, 10, &nr_pages);
	if (err || nr_pages > UINT_MAX)
		return -EINVAL;

	ksm_thread_pages_to_scan = nr_pages;

	return count;
}
KSM_ATTR(pages_to_scan);

static ssize_t run_show(struct kobject *kobj, struct kobj_attribute *attr,
			char *buf)
{
2220
	return sprintf(buf, "%lu\n", ksm_run);
I
Izik Eidus 已提交
2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237
}

static ssize_t run_store(struct kobject *kobj, struct kobj_attribute *attr,
			 const char *buf, size_t count)
{
	int err;
	unsigned long flags;

	err = strict_strtoul(buf, 10, &flags);
	if (err || flags > UINT_MAX)
		return -EINVAL;
	if (flags > KSM_RUN_UNMERGE)
		return -EINVAL;

	/*
	 * KSM_RUN_MERGE sets ksmd running, and 0 stops it running.
	 * KSM_RUN_UNMERGE stops it running and unmerges all rmap_items,
2238 2239
	 * breaking COW to free the pages_shared (but leaves mm_slots
	 * on the list for when ksmd may be set running again).
I
Izik Eidus 已提交
2240 2241 2242
	 */

	mutex_lock(&ksm_thread_mutex);
2243
	wait_while_offlining();
I
Izik Eidus 已提交
2244 2245
	if (ksm_run != flags) {
		ksm_run = flags;
H
Hugh Dickins 已提交
2246
		if (flags & KSM_RUN_UNMERGE) {
2247
			set_current_oom_origin();
H
Hugh Dickins 已提交
2248
			err = unmerge_and_remove_all_rmap_items();
2249
			clear_current_oom_origin();
H
Hugh Dickins 已提交
2250 2251 2252 2253 2254
			if (err) {
				ksm_run = KSM_RUN_STOP;
				count = err;
			}
		}
I
Izik Eidus 已提交
2255 2256 2257 2258 2259 2260 2261 2262 2263 2264
	}
	mutex_unlock(&ksm_thread_mutex);

	if (flags & KSM_RUN_MERGE)
		wake_up_interruptible(&ksm_thread_wait);

	return count;
}
KSM_ATTR(run);

P
Petr Holasek 已提交
2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285
#ifdef CONFIG_NUMA
static ssize_t merge_across_nodes_show(struct kobject *kobj,
				struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%u\n", ksm_merge_across_nodes);
}

static ssize_t merge_across_nodes_store(struct kobject *kobj,
				   struct kobj_attribute *attr,
				   const char *buf, size_t count)
{
	int err;
	unsigned long knob;

	err = kstrtoul(buf, 10, &knob);
	if (err)
		return err;
	if (knob > 1)
		return -EINVAL;

	mutex_lock(&ksm_thread_mutex);
2286
	wait_while_offlining();
P
Petr Holasek 已提交
2287
	if (ksm_merge_across_nodes != knob) {
2288
		if (ksm_pages_shared || remove_all_stable_nodes())
P
Petr Holasek 已提交
2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299
			err = -EBUSY;
		else
			ksm_merge_across_nodes = knob;
	}
	mutex_unlock(&ksm_thread_mutex);

	return err ? err : count;
}
KSM_ATTR(merge_across_nodes);
#endif

2300 2301 2302 2303 2304 2305 2306 2307 2308 2309
static ssize_t pages_shared_show(struct kobject *kobj,
				 struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%lu\n", ksm_pages_shared);
}
KSM_ATTR_RO(pages_shared);

static ssize_t pages_sharing_show(struct kobject *kobj,
				  struct kobj_attribute *attr, char *buf)
{
H
Hugh Dickins 已提交
2310
	return sprintf(buf, "%lu\n", ksm_pages_sharing);
2311 2312 2313
}
KSM_ATTR_RO(pages_sharing);

2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344
static ssize_t pages_unshared_show(struct kobject *kobj,
				   struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%lu\n", ksm_pages_unshared);
}
KSM_ATTR_RO(pages_unshared);

static ssize_t pages_volatile_show(struct kobject *kobj,
				   struct kobj_attribute *attr, char *buf)
{
	long ksm_pages_volatile;

	ksm_pages_volatile = ksm_rmap_items - ksm_pages_shared
				- ksm_pages_sharing - ksm_pages_unshared;
	/*
	 * It was not worth any locking to calculate that statistic,
	 * but it might therefore sometimes be negative: conceal that.
	 */
	if (ksm_pages_volatile < 0)
		ksm_pages_volatile = 0;
	return sprintf(buf, "%ld\n", ksm_pages_volatile);
}
KSM_ATTR_RO(pages_volatile);

static ssize_t full_scans_show(struct kobject *kobj,
			       struct kobj_attribute *attr, char *buf)
{
	return sprintf(buf, "%lu\n", ksm_scan.seqnr);
}
KSM_ATTR_RO(full_scans);

I
Izik Eidus 已提交
2345 2346 2347 2348
static struct attribute *ksm_attrs[] = {
	&sleep_millisecs_attr.attr,
	&pages_to_scan_attr.attr,
	&run_attr.attr,
2349 2350
	&pages_shared_attr.attr,
	&pages_sharing_attr.attr,
2351 2352 2353
	&pages_unshared_attr.attr,
	&pages_volatile_attr.attr,
	&full_scans_attr.attr,
P
Petr Holasek 已提交
2354 2355 2356
#ifdef CONFIG_NUMA
	&merge_across_nodes_attr.attr,
#endif
I
Izik Eidus 已提交
2357 2358 2359 2360 2361 2362 2363
	NULL,
};

static struct attribute_group ksm_attr_group = {
	.attrs = ksm_attrs,
	.name = "ksm",
};
H
Hugh Dickins 已提交
2364
#endif /* CONFIG_SYSFS */
I
Izik Eidus 已提交
2365 2366 2367 2368 2369

static int __init ksm_init(void)
{
	struct task_struct *ksm_thread;
	int err;
P
Petr Holasek 已提交
2370
	int nid;
I
Izik Eidus 已提交
2371 2372 2373 2374 2375

	err = ksm_slab_init();
	if (err)
		goto out;

P
Petr Holasek 已提交
2376 2377 2378
	for (nid = 0; nid < nr_node_ids; nid++)
		root_stable_tree[nid] = RB_ROOT;

I
Izik Eidus 已提交
2379 2380 2381 2382
	ksm_thread = kthread_run(ksm_scan_thread, NULL, "ksmd");
	if (IS_ERR(ksm_thread)) {
		printk(KERN_ERR "ksm: creating kthread failed\n");
		err = PTR_ERR(ksm_thread);
L
Lai Jiangshan 已提交
2383
		goto out_free;
I
Izik Eidus 已提交
2384 2385
	}

H
Hugh Dickins 已提交
2386
#ifdef CONFIG_SYSFS
I
Izik Eidus 已提交
2387 2388 2389
	err = sysfs_create_group(mm_kobj, &ksm_attr_group);
	if (err) {
		printk(KERN_ERR "ksm: register sysfs failed\n");
H
Hugh Dickins 已提交
2390
		kthread_stop(ksm_thread);
L
Lai Jiangshan 已提交
2391
		goto out_free;
I
Izik Eidus 已提交
2392
	}
H
Hugh Dickins 已提交
2393 2394 2395
#else
	ksm_run = KSM_RUN_MERGE;	/* no way for user to start it */

H
Hugh Dickins 已提交
2396
#endif /* CONFIG_SYSFS */
I
Izik Eidus 已提交
2397

2398
#ifdef CONFIG_MEMORY_HOTREMOVE
2399
	/* There is no significance to this priority 100 */
2400 2401
	hotplug_memory_notifier(ksm_memory_callback, 100);
#endif
I
Izik Eidus 已提交
2402 2403
	return 0;

L
Lai Jiangshan 已提交
2404
out_free:
I
Izik Eidus 已提交
2405 2406 2407
	ksm_slab_free();
out:
	return err;
H
Hugh Dickins 已提交
2408
}
I
Izik Eidus 已提交
2409
module_init(ksm_init)