Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1 | #include <linux/kernel.h> |
| 2 | #include <linux/errno.h> |
| 3 | #include <linux/err.h> |
| 4 | #include <linux/spinlock.h> |
| 5 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 6 | #include <linux/mm.h> |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 7 | #include <linux/memremap.h> |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 8 | #include <linux/pagemap.h> |
| 9 | #include <linux/rmap.h> |
| 10 | #include <linux/swap.h> |
| 11 | #include <linux/swapops.h> |
| 12 | |
Ingo Molnar | 174cd4b | 2017-02-02 19:15:33 +0100 | [diff] [blame] | 13 | #include <linux/sched/signal.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 14 | #include <linux/rwsem.h> |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 15 | #include <linux/hugetlb.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 16 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 17 | #include <asm/mmu_context.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 18 | #include <asm/pgtable.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 19 | #include <asm/tlbflush.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 20 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 21 | #include "internal.h" |
| 22 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 23 | static struct page *no_page_table(struct vm_area_struct *vma, |
| 24 | unsigned int flags) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 25 | { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 26 | /* |
| 27 | * When core dumping an enormous anonymous area that nobody |
| 28 | * has touched so far, we don't want to allocate unnecessary pages or |
| 29 | * page tables. Return error instead of NULL to skip handle_mm_fault, |
| 30 | * then get_dump_page() will return NULL to leave a hole in the dump. |
| 31 | * But we can only make this optimization where a hole would surely |
| 32 | * be zero-filled if handle_mm_fault() actually did handle it. |
| 33 | */ |
| 34 | if ((flags & FOLL_DUMP) && (!vma->vm_ops || !vma->vm_ops->fault)) |
| 35 | return ERR_PTR(-EFAULT); |
| 36 | return NULL; |
| 37 | } |
| 38 | |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 39 | static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, |
| 40 | pte_t *pte, unsigned int flags) |
| 41 | { |
| 42 | /* No page to get reference */ |
| 43 | if (flags & FOLL_GET) |
| 44 | return -EFAULT; |
| 45 | |
| 46 | if (flags & FOLL_TOUCH) { |
| 47 | pte_t entry = *pte; |
| 48 | |
| 49 | if (flags & FOLL_WRITE) |
| 50 | entry = pte_mkdirty(entry); |
| 51 | entry = pte_mkyoung(entry); |
| 52 | |
| 53 | if (!pte_same(*pte, entry)) { |
| 54 | set_pte_at(vma->vm_mm, address, pte, entry); |
| 55 | update_mmu_cache(vma, address, pte); |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | /* Proper page table entry exists, but no corresponding struct page */ |
| 60 | return -EEXIST; |
| 61 | } |
| 62 | |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 63 | /* |
| 64 | * FOLL_FORCE can write to even unwritable pte's, but only |
| 65 | * after we've gone through a COW cycle and they are dirty. |
| 66 | */ |
| 67 | static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) |
| 68 | { |
| 69 | return pte_write(pte) || |
| 70 | ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); |
| 71 | } |
| 72 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 73 | static struct page *follow_page_pte(struct vm_area_struct *vma, |
| 74 | unsigned long address, pmd_t *pmd, unsigned int flags) |
| 75 | { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 76 | struct mm_struct *mm = vma->vm_mm; |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 77 | struct dev_pagemap *pgmap = NULL; |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 78 | struct page *page; |
| 79 | spinlock_t *ptl; |
| 80 | pte_t *ptep, pte; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 81 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 82 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 83 | if (unlikely(pmd_bad(*pmd))) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 84 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 85 | |
| 86 | ptep = pte_offset_map_lock(mm, pmd, address, &ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 87 | pte = *ptep; |
| 88 | if (!pte_present(pte)) { |
| 89 | swp_entry_t entry; |
| 90 | /* |
| 91 | * KSM's break_ksm() relies upon recognizing a ksm page |
| 92 | * even while it is being migrated, so for that case we |
| 93 | * need migration_entry_wait(). |
| 94 | */ |
| 95 | if (likely(!(flags & FOLL_MIGRATION))) |
| 96 | goto no_page; |
Kirill A. Shutemov | 0661a33 | 2015-02-10 14:10:04 -0800 | [diff] [blame] | 97 | if (pte_none(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 98 | goto no_page; |
| 99 | entry = pte_to_swp_entry(pte); |
| 100 | if (!is_migration_entry(entry)) |
| 101 | goto no_page; |
| 102 | pte_unmap_unlock(ptep, ptl); |
| 103 | migration_entry_wait(mm, pmd, address); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 104 | goto retry; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 105 | } |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 106 | if ((flags & FOLL_NUMA) && pte_protnone(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 107 | goto no_page; |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 108 | if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 109 | pte_unmap_unlock(ptep, ptl); |
| 110 | return NULL; |
| 111 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 112 | |
| 113 | page = vm_normal_page(vma, address, pte); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 114 | if (!page && pte_devmap(pte) && (flags & FOLL_GET)) { |
| 115 | /* |
| 116 | * Only return device mapping pages in the FOLL_GET case since |
| 117 | * they are only valid while holding the pgmap reference. |
| 118 | */ |
| 119 | pgmap = get_dev_pagemap(pte_pfn(pte), NULL); |
| 120 | if (pgmap) |
| 121 | page = pte_page(pte); |
| 122 | else |
| 123 | goto no_page; |
| 124 | } else if (unlikely(!page)) { |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 125 | if (flags & FOLL_DUMP) { |
| 126 | /* Avoid special (like zero) pages in core dumps */ |
| 127 | page = ERR_PTR(-EFAULT); |
| 128 | goto out; |
| 129 | } |
| 130 | |
| 131 | if (is_zero_pfn(pte_pfn(pte))) { |
| 132 | page = pte_page(pte); |
| 133 | } else { |
| 134 | int ret; |
| 135 | |
| 136 | ret = follow_pfn_pte(vma, address, ptep, flags); |
| 137 | page = ERR_PTR(ret); |
| 138 | goto out; |
| 139 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 140 | } |
| 141 | |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 142 | if (flags & FOLL_SPLIT && PageTransCompound(page)) { |
| 143 | int ret; |
| 144 | get_page(page); |
| 145 | pte_unmap_unlock(ptep, ptl); |
| 146 | lock_page(page); |
| 147 | ret = split_huge_page(page); |
| 148 | unlock_page(page); |
| 149 | put_page(page); |
| 150 | if (ret) |
| 151 | return ERR_PTR(ret); |
| 152 | goto retry; |
| 153 | } |
| 154 | |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 155 | if (flags & FOLL_GET) { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 156 | get_page(page); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 157 | |
| 158 | /* drop the pgmap reference now that we hold the page */ |
| 159 | if (pgmap) { |
| 160 | put_dev_pagemap(pgmap); |
| 161 | pgmap = NULL; |
| 162 | } |
| 163 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 164 | if (flags & FOLL_TOUCH) { |
| 165 | if ((flags & FOLL_WRITE) && |
| 166 | !pte_dirty(pte) && !PageDirty(page)) |
| 167 | set_page_dirty(page); |
| 168 | /* |
| 169 | * pte_mkyoung() would be more correct here, but atomic care |
| 170 | * is needed to avoid losing the dirty bit: it is easier to use |
| 171 | * mark_page_accessed(). |
| 172 | */ |
| 173 | mark_page_accessed(page); |
| 174 | } |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 175 | if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) { |
Kirill A. Shutemov | e90309c | 2016-01-15 16:54:33 -0800 | [diff] [blame] | 176 | /* Do not mlock pte-mapped THP */ |
| 177 | if (PageTransCompound(page)) |
| 178 | goto out; |
| 179 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 180 | /* |
| 181 | * The preliminary mapping check is mainly to avoid the |
| 182 | * pointless overhead of lock_page on the ZERO_PAGE |
| 183 | * which might bounce very badly if there is contention. |
| 184 | * |
| 185 | * If the page is already locked, we don't need to |
| 186 | * handle it now - vmscan will handle it later if and |
| 187 | * when it attempts to reclaim the page. |
| 188 | */ |
| 189 | if (page->mapping && trylock_page(page)) { |
| 190 | lru_add_drain(); /* push cached pages to LRU */ |
| 191 | /* |
| 192 | * Because we lock page here, and migration is |
| 193 | * blocked by the pte's page reference, and we |
| 194 | * know the page is still mapped, we don't even |
| 195 | * need to check for file-cache page truncation. |
| 196 | */ |
| 197 | mlock_vma_page(page); |
| 198 | unlock_page(page); |
| 199 | } |
| 200 | } |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 201 | out: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 202 | pte_unmap_unlock(ptep, ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 203 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 204 | no_page: |
| 205 | pte_unmap_unlock(ptep, ptl); |
| 206 | if (!pte_none(pte)) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 207 | return NULL; |
| 208 | return no_page_table(vma, flags); |
| 209 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 210 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 211 | static struct page *follow_pmd_mask(struct vm_area_struct *vma, |
| 212 | unsigned long address, pud_t *pudp, |
| 213 | unsigned int flags, unsigned int *page_mask) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 214 | { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 215 | pmd_t *pmd; |
| 216 | spinlock_t *ptl; |
| 217 | struct page *page; |
| 218 | struct mm_struct *mm = vma->vm_mm; |
| 219 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 220 | pmd = pmd_offset(pudp, address); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 221 | if (pmd_none(*pmd)) |
| 222 | return no_page_table(vma, flags); |
| 223 | if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) { |
Naoya Horiguchi | e66f17f | 2015-02-11 15:25:22 -0800 | [diff] [blame] | 224 | page = follow_huge_pmd(mm, address, pmd, flags); |
| 225 | if (page) |
| 226 | return page; |
| 227 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 228 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 229 | if (is_hugepd(__hugepd(pmd_val(*pmd)))) { |
| 230 | page = follow_huge_pd(vma, address, |
| 231 | __hugepd(pmd_val(*pmd)), flags, |
| 232 | PMD_SHIFT); |
| 233 | if (page) |
| 234 | return page; |
| 235 | return no_page_table(vma, flags); |
| 236 | } |
Zi Yan | 84c3fc4 | 2017-09-08 16:11:01 -0700 | [diff] [blame] | 237 | retry: |
| 238 | if (!pmd_present(*pmd)) { |
| 239 | if (likely(!(flags & FOLL_MIGRATION))) |
| 240 | return no_page_table(vma, flags); |
| 241 | VM_BUG_ON(thp_migration_supported() && |
| 242 | !is_pmd_migration_entry(*pmd)); |
| 243 | if (is_pmd_migration_entry(*pmd)) |
| 244 | pmd_migration_entry_wait(mm, pmd); |
| 245 | goto retry; |
| 246 | } |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 247 | if (pmd_devmap(*pmd)) { |
| 248 | ptl = pmd_lock(mm, pmd); |
| 249 | page = follow_devmap_pmd(vma, address, pmd, flags); |
| 250 | spin_unlock(ptl); |
| 251 | if (page) |
| 252 | return page; |
| 253 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 254 | if (likely(!pmd_trans_huge(*pmd))) |
| 255 | return follow_page_pte(vma, address, pmd, flags); |
| 256 | |
Aneesh Kumar K.V | db08f20 | 2017-02-24 14:59:53 -0800 | [diff] [blame] | 257 | if ((flags & FOLL_NUMA) && pmd_protnone(*pmd)) |
| 258 | return no_page_table(vma, flags); |
| 259 | |
Zi Yan | 84c3fc4 | 2017-09-08 16:11:01 -0700 | [diff] [blame] | 260 | retry_locked: |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 261 | ptl = pmd_lock(mm, pmd); |
Zi Yan | 84c3fc4 | 2017-09-08 16:11:01 -0700 | [diff] [blame] | 262 | if (unlikely(!pmd_present(*pmd))) { |
| 263 | spin_unlock(ptl); |
| 264 | if (likely(!(flags & FOLL_MIGRATION))) |
| 265 | return no_page_table(vma, flags); |
| 266 | pmd_migration_entry_wait(mm, pmd); |
| 267 | goto retry_locked; |
| 268 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 269 | if (unlikely(!pmd_trans_huge(*pmd))) { |
| 270 | spin_unlock(ptl); |
| 271 | return follow_page_pte(vma, address, pmd, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 272 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 273 | if (flags & FOLL_SPLIT) { |
| 274 | int ret; |
| 275 | page = pmd_page(*pmd); |
| 276 | if (is_huge_zero_page(page)) { |
| 277 | spin_unlock(ptl); |
| 278 | ret = 0; |
Kirill A. Shutemov | 78ddc53 | 2016-01-15 16:52:42 -0800 | [diff] [blame] | 279 | split_huge_pmd(vma, pmd, address); |
Naoya Horiguchi | 337d9ab | 2016-07-26 15:24:03 -0700 | [diff] [blame] | 280 | if (pmd_trans_unstable(pmd)) |
| 281 | ret = -EBUSY; |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 282 | } else { |
| 283 | get_page(page); |
| 284 | spin_unlock(ptl); |
| 285 | lock_page(page); |
| 286 | ret = split_huge_page(page); |
| 287 | unlock_page(page); |
| 288 | put_page(page); |
Kirill A. Shutemov | baa355f | 2016-07-26 15:25:51 -0700 | [diff] [blame] | 289 | if (pmd_none(*pmd)) |
| 290 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 291 | } |
| 292 | |
| 293 | return ret ? ERR_PTR(ret) : |
| 294 | follow_page_pte(vma, address, pmd, flags); |
| 295 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 296 | page = follow_trans_huge_pmd(vma, address, pmd, flags); |
| 297 | spin_unlock(ptl); |
| 298 | *page_mask = HPAGE_PMD_NR - 1; |
| 299 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 300 | } |
| 301 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 302 | |
| 303 | static struct page *follow_pud_mask(struct vm_area_struct *vma, |
| 304 | unsigned long address, p4d_t *p4dp, |
| 305 | unsigned int flags, unsigned int *page_mask) |
| 306 | { |
| 307 | pud_t *pud; |
| 308 | spinlock_t *ptl; |
| 309 | struct page *page; |
| 310 | struct mm_struct *mm = vma->vm_mm; |
| 311 | |
| 312 | pud = pud_offset(p4dp, address); |
| 313 | if (pud_none(*pud)) |
| 314 | return no_page_table(vma, flags); |
| 315 | if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) { |
| 316 | page = follow_huge_pud(mm, address, pud, flags); |
| 317 | if (page) |
| 318 | return page; |
| 319 | return no_page_table(vma, flags); |
| 320 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 321 | if (is_hugepd(__hugepd(pud_val(*pud)))) { |
| 322 | page = follow_huge_pd(vma, address, |
| 323 | __hugepd(pud_val(*pud)), flags, |
| 324 | PUD_SHIFT); |
| 325 | if (page) |
| 326 | return page; |
| 327 | return no_page_table(vma, flags); |
| 328 | } |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 329 | if (pud_devmap(*pud)) { |
| 330 | ptl = pud_lock(mm, pud); |
| 331 | page = follow_devmap_pud(vma, address, pud, flags); |
| 332 | spin_unlock(ptl); |
| 333 | if (page) |
| 334 | return page; |
| 335 | } |
| 336 | if (unlikely(pud_bad(*pud))) |
| 337 | return no_page_table(vma, flags); |
| 338 | |
| 339 | return follow_pmd_mask(vma, address, pud, flags, page_mask); |
| 340 | } |
| 341 | |
| 342 | |
| 343 | static struct page *follow_p4d_mask(struct vm_area_struct *vma, |
| 344 | unsigned long address, pgd_t *pgdp, |
| 345 | unsigned int flags, unsigned int *page_mask) |
| 346 | { |
| 347 | p4d_t *p4d; |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 348 | struct page *page; |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 349 | |
| 350 | p4d = p4d_offset(pgdp, address); |
| 351 | if (p4d_none(*p4d)) |
| 352 | return no_page_table(vma, flags); |
| 353 | BUILD_BUG_ON(p4d_huge(*p4d)); |
| 354 | if (unlikely(p4d_bad(*p4d))) |
| 355 | return no_page_table(vma, flags); |
| 356 | |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 357 | if (is_hugepd(__hugepd(p4d_val(*p4d)))) { |
| 358 | page = follow_huge_pd(vma, address, |
| 359 | __hugepd(p4d_val(*p4d)), flags, |
| 360 | P4D_SHIFT); |
| 361 | if (page) |
| 362 | return page; |
| 363 | return no_page_table(vma, flags); |
| 364 | } |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 365 | return follow_pud_mask(vma, address, p4d, flags, page_mask); |
| 366 | } |
| 367 | |
| 368 | /** |
| 369 | * follow_page_mask - look up a page descriptor from a user-virtual address |
| 370 | * @vma: vm_area_struct mapping @address |
| 371 | * @address: virtual address to look up |
| 372 | * @flags: flags modifying lookup behaviour |
| 373 | * @page_mask: on output, *page_mask is set according to the size of the page |
| 374 | * |
| 375 | * @flags can have FOLL_ flags set, defined in <linux/mm.h> |
| 376 | * |
| 377 | * Returns the mapped (struct page *), %NULL if no mapping exists, or |
| 378 | * an error pointer if there is a mapping to something not represented |
| 379 | * by a page descriptor (see also vm_normal_page()). |
| 380 | */ |
| 381 | struct page *follow_page_mask(struct vm_area_struct *vma, |
| 382 | unsigned long address, unsigned int flags, |
| 383 | unsigned int *page_mask) |
| 384 | { |
| 385 | pgd_t *pgd; |
| 386 | struct page *page; |
| 387 | struct mm_struct *mm = vma->vm_mm; |
| 388 | |
| 389 | *page_mask = 0; |
| 390 | |
| 391 | /* make this handle hugepd */ |
| 392 | page = follow_huge_addr(mm, address, flags & FOLL_WRITE); |
| 393 | if (!IS_ERR(page)) { |
| 394 | BUG_ON(flags & FOLL_GET); |
| 395 | return page; |
| 396 | } |
| 397 | |
| 398 | pgd = pgd_offset(mm, address); |
| 399 | |
| 400 | if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd))) |
| 401 | return no_page_table(vma, flags); |
| 402 | |
Anshuman Khandual | faaa5b6 | 2017-07-06 15:38:50 -0700 | [diff] [blame] | 403 | if (pgd_huge(*pgd)) { |
| 404 | page = follow_huge_pgd(mm, address, pgd, flags); |
| 405 | if (page) |
| 406 | return page; |
| 407 | return no_page_table(vma, flags); |
| 408 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 409 | if (is_hugepd(__hugepd(pgd_val(*pgd)))) { |
| 410 | page = follow_huge_pd(vma, address, |
| 411 | __hugepd(pgd_val(*pgd)), flags, |
| 412 | PGDIR_SHIFT); |
| 413 | if (page) |
| 414 | return page; |
| 415 | return no_page_table(vma, flags); |
| 416 | } |
Anshuman Khandual | faaa5b6 | 2017-07-06 15:38:50 -0700 | [diff] [blame] | 417 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 418 | return follow_p4d_mask(vma, address, pgd, flags, page_mask); |
| 419 | } |
| 420 | |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 421 | static int get_gate_page(struct mm_struct *mm, unsigned long address, |
| 422 | unsigned int gup_flags, struct vm_area_struct **vma, |
| 423 | struct page **page) |
| 424 | { |
| 425 | pgd_t *pgd; |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 426 | p4d_t *p4d; |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 427 | pud_t *pud; |
| 428 | pmd_t *pmd; |
| 429 | pte_t *pte; |
| 430 | int ret = -EFAULT; |
| 431 | |
| 432 | /* user gate pages are read-only */ |
| 433 | if (gup_flags & FOLL_WRITE) |
| 434 | return -EFAULT; |
| 435 | if (address > TASK_SIZE) |
| 436 | pgd = pgd_offset_k(address); |
| 437 | else |
| 438 | pgd = pgd_offset_gate(mm, address); |
| 439 | BUG_ON(pgd_none(*pgd)); |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 440 | p4d = p4d_offset(pgd, address); |
| 441 | BUG_ON(p4d_none(*p4d)); |
| 442 | pud = pud_offset(p4d, address); |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 443 | BUG_ON(pud_none(*pud)); |
| 444 | pmd = pmd_offset(pud, address); |
Zi Yan | 84c3fc4 | 2017-09-08 16:11:01 -0700 | [diff] [blame] | 445 | if (!pmd_present(*pmd)) |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 446 | return -EFAULT; |
| 447 | VM_BUG_ON(pmd_trans_huge(*pmd)); |
| 448 | pte = pte_offset_map(pmd, address); |
| 449 | if (pte_none(*pte)) |
| 450 | goto unmap; |
| 451 | *vma = get_gate_vma(mm); |
| 452 | if (!page) |
| 453 | goto out; |
| 454 | *page = vm_normal_page(*vma, address, *pte); |
| 455 | if (!*page) { |
| 456 | if ((gup_flags & FOLL_DUMP) || !is_zero_pfn(pte_pfn(*pte))) |
| 457 | goto unmap; |
| 458 | *page = pte_page(*pte); |
| 459 | } |
| 460 | get_page(*page); |
| 461 | out: |
| 462 | ret = 0; |
| 463 | unmap: |
| 464 | pte_unmap(pte); |
| 465 | return ret; |
| 466 | } |
| 467 | |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 468 | /* |
| 469 | * mmap_sem must be held on entry. If @nonblocking != NULL and |
| 470 | * *@flags does not include FOLL_NOWAIT, the mmap_sem may be released. |
| 471 | * If it is, *@nonblocking will be set to 0 and -EBUSY returned. |
| 472 | */ |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 473 | static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, |
| 474 | unsigned long address, unsigned int *flags, int *nonblocking) |
| 475 | { |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 476 | unsigned int fault_flags = 0; |
| 477 | int ret; |
| 478 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 479 | /* mlock all present pages, but do not fault in new pages */ |
| 480 | if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK) |
| 481 | return -ENOENT; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 482 | if (*flags & FOLL_WRITE) |
| 483 | fault_flags |= FAULT_FLAG_WRITE; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 484 | if (*flags & FOLL_REMOTE) |
| 485 | fault_flags |= FAULT_FLAG_REMOTE; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 486 | if (nonblocking) |
| 487 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 488 | if (*flags & FOLL_NOWAIT) |
| 489 | fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT; |
Andres Lagar-Cavilla | 234b239 | 2014-09-17 10:51:48 -0700 | [diff] [blame] | 490 | if (*flags & FOLL_TRIED) { |
| 491 | VM_WARN_ON_ONCE(fault_flags & FAULT_FLAG_ALLOW_RETRY); |
| 492 | fault_flags |= FAULT_FLAG_TRIED; |
| 493 | } |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 494 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 495 | ret = handle_mm_fault(vma, address, fault_flags); |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 496 | if (ret & VM_FAULT_ERROR) { |
James Morse | 9a291a7 | 2017-06-02 14:46:46 -0700 | [diff] [blame] | 497 | int err = vm_fault_to_errno(ret, *flags); |
| 498 | |
| 499 | if (err) |
| 500 | return err; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 501 | BUG(); |
| 502 | } |
| 503 | |
| 504 | if (tsk) { |
| 505 | if (ret & VM_FAULT_MAJOR) |
| 506 | tsk->maj_flt++; |
| 507 | else |
| 508 | tsk->min_flt++; |
| 509 | } |
| 510 | |
| 511 | if (ret & VM_FAULT_RETRY) { |
| 512 | if (nonblocking) |
| 513 | *nonblocking = 0; |
| 514 | return -EBUSY; |
| 515 | } |
| 516 | |
| 517 | /* |
| 518 | * The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when |
| 519 | * necessary, even if maybe_mkwrite decided not to set pte_write. We |
| 520 | * can thus safely do subsequent page lookups as if they were reads. |
| 521 | * But only do so when looping for pte_write is futile: in some cases |
| 522 | * userspace may also be wanting to write to the gotten user page, |
| 523 | * which a read fault here might prevent (a readonly page might get |
| 524 | * reCOWed by userspace write). |
| 525 | */ |
| 526 | if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE)) |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 527 | *flags |= FOLL_COW; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 528 | return 0; |
| 529 | } |
| 530 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 531 | static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) |
| 532 | { |
| 533 | vm_flags_t vm_flags = vma->vm_flags; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 534 | int write = (gup_flags & FOLL_WRITE); |
| 535 | int foreign = (gup_flags & FOLL_REMOTE); |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 536 | |
| 537 | if (vm_flags & (VM_IO | VM_PFNMAP)) |
| 538 | return -EFAULT; |
| 539 | |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 540 | if (write) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 541 | if (!(vm_flags & VM_WRITE)) { |
| 542 | if (!(gup_flags & FOLL_FORCE)) |
| 543 | return -EFAULT; |
| 544 | /* |
| 545 | * We used to let the write,force case do COW in a |
| 546 | * VM_MAYWRITE VM_SHARED !VM_WRITE vma, so ptrace could |
| 547 | * set a breakpoint in a read-only mapping of an |
| 548 | * executable, without corrupting the file (yet only |
| 549 | * when that file had been opened for writing!). |
| 550 | * Anon pages in shared mappings are surprising: now |
| 551 | * just reject it. |
| 552 | */ |
Hugh Dickins | 4643536 | 2016-01-30 18:03:16 -0800 | [diff] [blame] | 553 | if (!is_cow_mapping(vm_flags)) |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 554 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 555 | } |
| 556 | } else if (!(vm_flags & VM_READ)) { |
| 557 | if (!(gup_flags & FOLL_FORCE)) |
| 558 | return -EFAULT; |
| 559 | /* |
| 560 | * Is there actually any vma we can reach here which does not |
| 561 | * have VM_MAYREAD set? |
| 562 | */ |
| 563 | if (!(vm_flags & VM_MAYREAD)) |
| 564 | return -EFAULT; |
| 565 | } |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 566 | /* |
| 567 | * gups are always data accesses, not instruction |
| 568 | * fetches, so execute=false here |
| 569 | */ |
| 570 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 571 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 572 | return 0; |
| 573 | } |
| 574 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 575 | /** |
| 576 | * __get_user_pages() - pin user pages in memory |
| 577 | * @tsk: task_struct of target task |
| 578 | * @mm: mm_struct of target mm |
| 579 | * @start: starting user address |
| 580 | * @nr_pages: number of pages from start to pin |
| 581 | * @gup_flags: flags modifying pin behaviour |
| 582 | * @pages: array that receives pointers to the pages pinned. |
| 583 | * Should be at least nr_pages long. Or NULL, if caller |
| 584 | * only intends to ensure the pages are faulted in. |
| 585 | * @vmas: array of pointers to vmas corresponding to each page. |
| 586 | * Or NULL if the caller does not require them. |
| 587 | * @nonblocking: whether waiting for disk IO or mmap_sem contention |
| 588 | * |
| 589 | * Returns number of pages pinned. This may be fewer than the number |
| 590 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 591 | * were pinned, returns -errno. Each page returned must be released |
| 592 | * with a put_page() call when it is finished with. vmas will only |
| 593 | * remain valid while mmap_sem is held. |
| 594 | * |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 595 | * Must be called with mmap_sem held. It may be released. See below. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 596 | * |
| 597 | * __get_user_pages walks a process's page tables and takes a reference to |
| 598 | * each struct page that each user address corresponds to at a given |
| 599 | * instant. That is, it takes the page that would be accessed if a user |
| 600 | * thread accesses the given user virtual address at that instant. |
| 601 | * |
| 602 | * This does not guarantee that the page exists in the user mappings when |
| 603 | * __get_user_pages returns, and there may even be a completely different |
| 604 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 605 | * and subsequently re faulted). However it does guarantee that the page |
| 606 | * won't be freed completely. And mostly callers simply care that the page |
| 607 | * contains data that was valid *at some point in time*. Typically, an IO |
| 608 | * or similar operation cannot guarantee anything stronger anyway because |
| 609 | * locks can't be held over the syscall boundary. |
| 610 | * |
| 611 | * If @gup_flags & FOLL_WRITE == 0, the page must not be written to. If |
| 612 | * the page is written to, set_page_dirty (or set_page_dirty_lock, as |
| 613 | * appropriate) must be called after the page is finished with, and |
| 614 | * before put_page is called. |
| 615 | * |
| 616 | * If @nonblocking != NULL, __get_user_pages will not wait for disk IO |
| 617 | * or mmap_sem contention, and if waiting is needed to pin all pages, |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 618 | * *@nonblocking will be set to 0. Further, if @gup_flags does not |
| 619 | * include FOLL_NOWAIT, the mmap_sem will be released via up_read() in |
| 620 | * this case. |
| 621 | * |
| 622 | * A caller using such a combination of @nonblocking and @gup_flags |
| 623 | * must therefore hold the mmap_sem for reading only, and recognize |
| 624 | * when it's been released. Otherwise, it must be held for either |
| 625 | * reading or writing and will not be released. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 626 | * |
| 627 | * In most cases, get_user_pages or get_user_pages_fast should be used |
| 628 | * instead of __get_user_pages. __get_user_pages should be used only if |
| 629 | * you need some special @gup_flags. |
| 630 | */ |
Lorenzo Stoakes | 0d73175 | 2016-10-24 10:57:25 +0100 | [diff] [blame] | 631 | static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 632 | unsigned long start, unsigned long nr_pages, |
| 633 | unsigned int gup_flags, struct page **pages, |
| 634 | struct vm_area_struct **vmas, int *nonblocking) |
| 635 | { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 636 | long i = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 637 | unsigned int page_mask; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 638 | struct vm_area_struct *vma = NULL; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 639 | |
| 640 | if (!nr_pages) |
| 641 | return 0; |
| 642 | |
| 643 | VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET)); |
| 644 | |
| 645 | /* |
| 646 | * If FOLL_FORCE is set then do not force a full fault as the hinting |
| 647 | * fault information is unrelated to the reference behaviour of a task |
| 648 | * using the address space |
| 649 | */ |
| 650 | if (!(gup_flags & FOLL_FORCE)) |
| 651 | gup_flags |= FOLL_NUMA; |
| 652 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 653 | do { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 654 | struct page *page; |
| 655 | unsigned int foll_flags = gup_flags; |
| 656 | unsigned int page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 657 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 658 | /* first iteration or cross vma bound */ |
| 659 | if (!vma || start >= vma->vm_end) { |
| 660 | vma = find_extend_vma(mm, start); |
| 661 | if (!vma && in_gate_area(mm, start)) { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 662 | int ret; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 663 | ret = get_gate_page(mm, start & PAGE_MASK, |
| 664 | gup_flags, &vma, |
| 665 | pages ? &pages[i] : NULL); |
| 666 | if (ret) |
| 667 | return i ? : ret; |
| 668 | page_mask = 0; |
| 669 | goto next_page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 670 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 671 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 672 | if (!vma || check_vma_flags(vma, gup_flags)) |
| 673 | return i ? : -EFAULT; |
| 674 | if (is_vm_hugetlb_page(vma)) { |
| 675 | i = follow_hugetlb_page(mm, vma, pages, vmas, |
| 676 | &start, &nr_pages, i, |
Andrea Arcangeli | 87ffc11 | 2017-02-22 15:43:13 -0800 | [diff] [blame] | 677 | gup_flags, nonblocking); |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 678 | continue; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 679 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 680 | } |
| 681 | retry: |
| 682 | /* |
| 683 | * If we have a pending SIGKILL, don't keep faulting pages and |
| 684 | * potentially allocating memory. |
| 685 | */ |
| 686 | if (unlikely(fatal_signal_pending(current))) |
| 687 | return i ? i : -ERESTARTSYS; |
| 688 | cond_resched(); |
| 689 | page = follow_page_mask(vma, start, foll_flags, &page_mask); |
| 690 | if (!page) { |
| 691 | int ret; |
| 692 | ret = faultin_page(tsk, vma, start, &foll_flags, |
| 693 | nonblocking); |
| 694 | switch (ret) { |
| 695 | case 0: |
| 696 | goto retry; |
| 697 | case -EFAULT: |
| 698 | case -ENOMEM: |
| 699 | case -EHWPOISON: |
| 700 | return i ? i : ret; |
| 701 | case -EBUSY: |
| 702 | return i; |
| 703 | case -ENOENT: |
| 704 | goto next_page; |
| 705 | } |
| 706 | BUG(); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 707 | } else if (PTR_ERR(page) == -EEXIST) { |
| 708 | /* |
| 709 | * Proper page table entry exists, but no corresponding |
| 710 | * struct page. |
| 711 | */ |
| 712 | goto next_page; |
| 713 | } else if (IS_ERR(page)) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 714 | return i ? i : PTR_ERR(page); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 715 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 716 | if (pages) { |
| 717 | pages[i] = page; |
| 718 | flush_anon_page(vma, page, start); |
| 719 | flush_dcache_page(page); |
| 720 | page_mask = 0; |
| 721 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 722 | next_page: |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 723 | if (vmas) { |
| 724 | vmas[i] = vma; |
| 725 | page_mask = 0; |
| 726 | } |
| 727 | page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask); |
| 728 | if (page_increm > nr_pages) |
| 729 | page_increm = nr_pages; |
| 730 | i += page_increm; |
| 731 | start += page_increm * PAGE_SIZE; |
| 732 | nr_pages -= page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 733 | } while (nr_pages); |
| 734 | return i; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 735 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 736 | |
Tobias Klauser | 771ab43 | 2016-12-12 16:41:53 -0800 | [diff] [blame] | 737 | static bool vma_permits_fault(struct vm_area_struct *vma, |
| 738 | unsigned int fault_flags) |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 739 | { |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 740 | bool write = !!(fault_flags & FAULT_FLAG_WRITE); |
| 741 | bool foreign = !!(fault_flags & FAULT_FLAG_REMOTE); |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 742 | vm_flags_t vm_flags = write ? VM_WRITE : VM_READ; |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 743 | |
| 744 | if (!(vm_flags & vma->vm_flags)) |
| 745 | return false; |
| 746 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 747 | /* |
| 748 | * The architecture might have a hardware protection |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 749 | * mechanism other than read/write that can deny access. |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 750 | * |
| 751 | * gup always represents data access, not instruction |
| 752 | * fetches, so execute=false here: |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 753 | */ |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 754 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 755 | return false; |
| 756 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 757 | return true; |
| 758 | } |
| 759 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 760 | /* |
| 761 | * fixup_user_fault() - manually resolve a user page fault |
| 762 | * @tsk: the task_struct to use for page fault accounting, or |
| 763 | * NULL if faults are not to be recorded. |
| 764 | * @mm: mm_struct of target mm |
| 765 | * @address: user address |
| 766 | * @fault_flags:flags to pass down to handle_mm_fault() |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 767 | * @unlocked: did we unlock the mmap_sem while retrying, maybe NULL if caller |
| 768 | * does not allow retry |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 769 | * |
| 770 | * This is meant to be called in the specific scenario where for locking reasons |
| 771 | * we try to access user memory in atomic context (within a pagefault_disable() |
| 772 | * section), this returns -EFAULT, and we want to resolve the user fault before |
| 773 | * trying again. |
| 774 | * |
| 775 | * Typically this is meant to be used by the futex code. |
| 776 | * |
| 777 | * The main difference with get_user_pages() is that this function will |
| 778 | * unconditionally call handle_mm_fault() which will in turn perform all the |
| 779 | * necessary SW fixup of the dirty and young bits in the PTE, while |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 780 | * get_user_pages() only guarantees to update these in the struct page. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 781 | * |
| 782 | * This is important for some architectures where those bits also gate the |
| 783 | * access permission to the page because they are maintained in software. On |
| 784 | * such architectures, gup() will not be enough to make a subsequent access |
| 785 | * succeed. |
| 786 | * |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 787 | * This function will not return with an unlocked mmap_sem. So it has not the |
| 788 | * same semantics wrt the @mm->mmap_sem as does filemap_fault(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 789 | */ |
| 790 | int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 791 | unsigned long address, unsigned int fault_flags, |
| 792 | bool *unlocked) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 793 | { |
| 794 | struct vm_area_struct *vma; |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 795 | int ret, major = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 796 | |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 797 | if (unlocked) |
| 798 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 799 | |
| 800 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 801 | vma = find_extend_vma(mm, address); |
| 802 | if (!vma || address < vma->vm_start) |
| 803 | return -EFAULT; |
| 804 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 805 | if (!vma_permits_fault(vma, fault_flags)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 806 | return -EFAULT; |
| 807 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 808 | ret = handle_mm_fault(vma, address, fault_flags); |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 809 | major |= ret & VM_FAULT_MAJOR; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 810 | if (ret & VM_FAULT_ERROR) { |
James Morse | 9a291a7 | 2017-06-02 14:46:46 -0700 | [diff] [blame] | 811 | int err = vm_fault_to_errno(ret, 0); |
| 812 | |
| 813 | if (err) |
| 814 | return err; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 815 | BUG(); |
| 816 | } |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 817 | |
| 818 | if (ret & VM_FAULT_RETRY) { |
| 819 | down_read(&mm->mmap_sem); |
| 820 | if (!(fault_flags & FAULT_FLAG_TRIED)) { |
| 821 | *unlocked = true; |
| 822 | fault_flags &= ~FAULT_FLAG_ALLOW_RETRY; |
| 823 | fault_flags |= FAULT_FLAG_TRIED; |
| 824 | goto retry; |
| 825 | } |
| 826 | } |
| 827 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 828 | if (tsk) { |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 829 | if (major) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 830 | tsk->maj_flt++; |
| 831 | else |
| 832 | tsk->min_flt++; |
| 833 | } |
| 834 | return 0; |
| 835 | } |
Paolo Bonzini | add6a0c | 2016-06-07 17:51:18 +0200 | [diff] [blame] | 836 | EXPORT_SYMBOL_GPL(fixup_user_fault); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 837 | |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 838 | static __always_inline long __get_user_pages_locked(struct task_struct *tsk, |
| 839 | struct mm_struct *mm, |
| 840 | unsigned long start, |
| 841 | unsigned long nr_pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 842 | struct page **pages, |
| 843 | struct vm_area_struct **vmas, |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 844 | int *locked, bool notify_drop, |
| 845 | unsigned int flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 846 | { |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 847 | long ret, pages_done; |
| 848 | bool lock_dropped; |
| 849 | |
| 850 | if (locked) { |
| 851 | /* if VM_FAULT_RETRY can be returned, vmas become invalid */ |
| 852 | BUG_ON(vmas); |
| 853 | /* check caller initialized locked */ |
| 854 | BUG_ON(*locked != 1); |
| 855 | } |
| 856 | |
| 857 | if (pages) |
| 858 | flags |= FOLL_GET; |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 859 | |
| 860 | pages_done = 0; |
| 861 | lock_dropped = false; |
| 862 | for (;;) { |
| 863 | ret = __get_user_pages(tsk, mm, start, nr_pages, flags, pages, |
| 864 | vmas, locked); |
| 865 | if (!locked) |
| 866 | /* VM_FAULT_RETRY couldn't trigger, bypass */ |
| 867 | return ret; |
| 868 | |
| 869 | /* VM_FAULT_RETRY cannot return errors */ |
| 870 | if (!*locked) { |
| 871 | BUG_ON(ret < 0); |
| 872 | BUG_ON(ret >= nr_pages); |
| 873 | } |
| 874 | |
| 875 | if (!pages) |
| 876 | /* If it's a prefault don't insist harder */ |
| 877 | return ret; |
| 878 | |
| 879 | if (ret > 0) { |
| 880 | nr_pages -= ret; |
| 881 | pages_done += ret; |
| 882 | if (!nr_pages) |
| 883 | break; |
| 884 | } |
| 885 | if (*locked) { |
| 886 | /* VM_FAULT_RETRY didn't trigger */ |
| 887 | if (!pages_done) |
| 888 | pages_done = ret; |
| 889 | break; |
| 890 | } |
| 891 | /* VM_FAULT_RETRY triggered, so seek to the faulting offset */ |
| 892 | pages += ret; |
| 893 | start += ret << PAGE_SHIFT; |
| 894 | |
| 895 | /* |
| 896 | * Repeat on the address that fired VM_FAULT_RETRY |
| 897 | * without FAULT_FLAG_ALLOW_RETRY but with |
| 898 | * FAULT_FLAG_TRIED. |
| 899 | */ |
| 900 | *locked = 1; |
| 901 | lock_dropped = true; |
| 902 | down_read(&mm->mmap_sem); |
| 903 | ret = __get_user_pages(tsk, mm, start, 1, flags | FOLL_TRIED, |
| 904 | pages, NULL, NULL); |
| 905 | if (ret != 1) { |
| 906 | BUG_ON(ret > 1); |
| 907 | if (!pages_done) |
| 908 | pages_done = ret; |
| 909 | break; |
| 910 | } |
| 911 | nr_pages--; |
| 912 | pages_done++; |
| 913 | if (!nr_pages) |
| 914 | break; |
| 915 | pages++; |
| 916 | start += PAGE_SIZE; |
| 917 | } |
| 918 | if (notify_drop && lock_dropped && *locked) { |
| 919 | /* |
| 920 | * We must let the caller know we temporarily dropped the lock |
| 921 | * and so the critical section protected by it was lost. |
| 922 | */ |
| 923 | up_read(&mm->mmap_sem); |
| 924 | *locked = 0; |
| 925 | } |
| 926 | return pages_done; |
| 927 | } |
| 928 | |
| 929 | /* |
| 930 | * We can leverage the VM_FAULT_RETRY functionality in the page fault |
| 931 | * paths better by using either get_user_pages_locked() or |
| 932 | * get_user_pages_unlocked(). |
| 933 | * |
| 934 | * get_user_pages_locked() is suitable to replace the form: |
| 935 | * |
| 936 | * down_read(&mm->mmap_sem); |
| 937 | * do_something() |
| 938 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 939 | * up_read(&mm->mmap_sem); |
| 940 | * |
| 941 | * to: |
| 942 | * |
| 943 | * int locked = 1; |
| 944 | * down_read(&mm->mmap_sem); |
| 945 | * do_something() |
| 946 | * get_user_pages_locked(tsk, mm, ..., pages, &locked); |
| 947 | * if (locked) |
| 948 | * up_read(&mm->mmap_sem); |
| 949 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 950 | long get_user_pages_locked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 951 | unsigned int gup_flags, struct page **pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 952 | int *locked) |
| 953 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 954 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 955 | pages, NULL, locked, true, |
| 956 | gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 957 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 958 | EXPORT_SYMBOL(get_user_pages_locked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 959 | |
| 960 | /* |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 961 | * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows for |
| 962 | * tsk, mm to be specified. |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 963 | * |
| 964 | * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 965 | * caller if required (just like with __get_user_pages). "FOLL_GET" |
| 966 | * is set implicitly if "pages" is non-NULL. |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 967 | */ |
Lorenzo Stoakes | 8b7457e | 2016-12-14 15:06:55 -0800 | [diff] [blame] | 968 | static __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, |
| 969 | struct mm_struct *mm, unsigned long start, |
| 970 | unsigned long nr_pages, struct page **pages, |
| 971 | unsigned int gup_flags) |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 972 | { |
| 973 | long ret; |
| 974 | int locked = 1; |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 975 | |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 976 | down_read(&mm->mmap_sem); |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 977 | ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, |
| 978 | &locked, false, gup_flags); |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 979 | if (locked) |
| 980 | up_read(&mm->mmap_sem); |
| 981 | return ret; |
| 982 | } |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 983 | |
| 984 | /* |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 985 | * get_user_pages_unlocked() is suitable to replace the form: |
| 986 | * |
| 987 | * down_read(&mm->mmap_sem); |
| 988 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 989 | * up_read(&mm->mmap_sem); |
| 990 | * |
| 991 | * with: |
| 992 | * |
| 993 | * get_user_pages_unlocked(tsk, mm, ..., pages); |
| 994 | * |
| 995 | * It is functionally equivalent to get_user_pages_fast so |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 996 | * get_user_pages_fast should be used instead if specific gup_flags |
| 997 | * (e.g. FOLL_FORCE) are not required. |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 998 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 999 | long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 1000 | struct page **pages, unsigned int gup_flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 1001 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 1002 | return __get_user_pages_unlocked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 1003 | pages, gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 1004 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 1005 | EXPORT_SYMBOL(get_user_pages_unlocked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 1006 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1007 | /* |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1008 | * get_user_pages_remote() - pin user pages in memory |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1009 | * @tsk: the task_struct to use for page fault accounting, or |
| 1010 | * NULL if faults are not to be recorded. |
| 1011 | * @mm: mm_struct of target mm |
| 1012 | * @start: starting user address |
| 1013 | * @nr_pages: number of pages from start to pin |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1014 | * @gup_flags: flags modifying lookup behaviour |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1015 | * @pages: array that receives pointers to the pages pinned. |
| 1016 | * Should be at least nr_pages long. Or NULL, if caller |
| 1017 | * only intends to ensure the pages are faulted in. |
| 1018 | * @vmas: array of pointers to vmas corresponding to each page. |
| 1019 | * Or NULL if the caller does not require them. |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1020 | * @locked: pointer to lock flag indicating whether lock is held and |
| 1021 | * subsequently whether VM_FAULT_RETRY functionality can be |
| 1022 | * utilised. Lock must initially be held. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1023 | * |
| 1024 | * Returns number of pages pinned. This may be fewer than the number |
| 1025 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 1026 | * were pinned, returns -errno. Each page returned must be released |
| 1027 | * with a put_page() call when it is finished with. vmas will only |
| 1028 | * remain valid while mmap_sem is held. |
| 1029 | * |
| 1030 | * Must be called with mmap_sem held for read or write. |
| 1031 | * |
| 1032 | * get_user_pages walks a process's page tables and takes a reference to |
| 1033 | * each struct page that each user address corresponds to at a given |
| 1034 | * instant. That is, it takes the page that would be accessed if a user |
| 1035 | * thread accesses the given user virtual address at that instant. |
| 1036 | * |
| 1037 | * This does not guarantee that the page exists in the user mappings when |
| 1038 | * get_user_pages returns, and there may even be a completely different |
| 1039 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 1040 | * and subsequently re faulted). However it does guarantee that the page |
| 1041 | * won't be freed completely. And mostly callers simply care that the page |
| 1042 | * contains data that was valid *at some point in time*. Typically, an IO |
| 1043 | * or similar operation cannot guarantee anything stronger anyway because |
| 1044 | * locks can't be held over the syscall boundary. |
| 1045 | * |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1046 | * If gup_flags & FOLL_WRITE == 0, the page must not be written to. If the page |
| 1047 | * is written to, set_page_dirty (or set_page_dirty_lock, as appropriate) must |
| 1048 | * be called after the page is finished with, and before put_page is called. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1049 | * |
| 1050 | * get_user_pages is typically used for fewer-copy IO operations, to get a |
| 1051 | * handle on the memory by some means other than accesses via the user virtual |
| 1052 | * addresses. The pages may be submitted for DMA to devices or accessed via |
| 1053 | * their kernel linear mapping (via the kmap APIs). Care should be taken to |
| 1054 | * use the correct cache flushing APIs. |
| 1055 | * |
| 1056 | * See also get_user_pages_fast, for performance critical applications. |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 1057 | * |
| 1058 | * get_user_pages should be phased out in favor of |
| 1059 | * get_user_pages_locked|unlocked or get_user_pages_fast. Nothing |
| 1060 | * should use get_user_pages because it cannot pass |
| 1061 | * FAULT_FLAG_ALLOW_RETRY to handle_mm_fault. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1062 | */ |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1063 | long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm, |
| 1064 | unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1065 | unsigned int gup_flags, struct page **pages, |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1066 | struct vm_area_struct **vmas, int *locked) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1067 | { |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 1068 | return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas, |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1069 | locked, true, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1070 | gup_flags | FOLL_TOUCH | FOLL_REMOTE); |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1071 | } |
| 1072 | EXPORT_SYMBOL(get_user_pages_remote); |
| 1073 | |
| 1074 | /* |
Dave Hansen | d4edcf0 | 2016-02-12 13:01:56 -0800 | [diff] [blame] | 1075 | * This is the same as get_user_pages_remote(), just with a |
| 1076 | * less-flexible calling convention where we assume that the task |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1077 | * and mm being operated on are the current task's and don't allow |
| 1078 | * passing of a locked parameter. We also obviously don't pass |
| 1079 | * FOLL_REMOTE in here. |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1080 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 1081 | long get_user_pages(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 1082 | unsigned int gup_flags, struct page **pages, |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1083 | struct vm_area_struct **vmas) |
| 1084 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 1085 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 1086 | pages, vmas, NULL, false, |
| 1087 | gup_flags | FOLL_TOUCH); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1088 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 1089 | EXPORT_SYMBOL(get_user_pages); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1090 | |
| 1091 | /** |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1092 | * populate_vma_page_range() - populate a range of pages in the vma. |
| 1093 | * @vma: target vma |
| 1094 | * @start: start address |
| 1095 | * @end: end address |
| 1096 | * @nonblocking: |
| 1097 | * |
| 1098 | * This takes care of mlocking the pages too if VM_LOCKED is set. |
| 1099 | * |
| 1100 | * return 0 on success, negative error code on error. |
| 1101 | * |
| 1102 | * vma->vm_mm->mmap_sem must be held. |
| 1103 | * |
| 1104 | * If @nonblocking is NULL, it may be held for read or write and will |
| 1105 | * be unperturbed. |
| 1106 | * |
| 1107 | * If @nonblocking is non-NULL, it must held for read only and may be |
| 1108 | * released. If it's released, *@nonblocking will be set to 0. |
| 1109 | */ |
| 1110 | long populate_vma_page_range(struct vm_area_struct *vma, |
| 1111 | unsigned long start, unsigned long end, int *nonblocking) |
| 1112 | { |
| 1113 | struct mm_struct *mm = vma->vm_mm; |
| 1114 | unsigned long nr_pages = (end - start) / PAGE_SIZE; |
| 1115 | int gup_flags; |
| 1116 | |
| 1117 | VM_BUG_ON(start & ~PAGE_MASK); |
| 1118 | VM_BUG_ON(end & ~PAGE_MASK); |
| 1119 | VM_BUG_ON_VMA(start < vma->vm_start, vma); |
| 1120 | VM_BUG_ON_VMA(end > vma->vm_end, vma); |
| 1121 | VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_sem), mm); |
| 1122 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 1123 | gup_flags = FOLL_TOUCH | FOLL_POPULATE | FOLL_MLOCK; |
| 1124 | if (vma->vm_flags & VM_LOCKONFAULT) |
| 1125 | gup_flags &= ~FOLL_POPULATE; |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1126 | /* |
| 1127 | * We want to touch writable mappings with a write fault in order |
| 1128 | * to break COW, except for shared mappings because these don't COW |
| 1129 | * and we would not want to dirty them for nothing. |
| 1130 | */ |
| 1131 | if ((vma->vm_flags & (VM_WRITE | VM_SHARED)) == VM_WRITE) |
| 1132 | gup_flags |= FOLL_WRITE; |
| 1133 | |
| 1134 | /* |
| 1135 | * We want mlock to succeed for regions that have any permissions |
| 1136 | * other than PROT_NONE. |
| 1137 | */ |
| 1138 | if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) |
| 1139 | gup_flags |= FOLL_FORCE; |
| 1140 | |
| 1141 | /* |
| 1142 | * We made sure addr is within a VMA, so the following will |
| 1143 | * not result in a stack expansion that recurses back here. |
| 1144 | */ |
| 1145 | return __get_user_pages(current, mm, start, nr_pages, gup_flags, |
| 1146 | NULL, NULL, nonblocking); |
| 1147 | } |
| 1148 | |
| 1149 | /* |
| 1150 | * __mm_populate - populate and/or mlock pages within a range of address space. |
| 1151 | * |
| 1152 | * This is used to implement mlock() and the MAP_POPULATE / MAP_LOCKED mmap |
| 1153 | * flags. VMAs must be already marked with the desired vm_flags, and |
| 1154 | * mmap_sem must not be held. |
| 1155 | */ |
| 1156 | int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) |
| 1157 | { |
| 1158 | struct mm_struct *mm = current->mm; |
| 1159 | unsigned long end, nstart, nend; |
| 1160 | struct vm_area_struct *vma = NULL; |
| 1161 | int locked = 0; |
| 1162 | long ret = 0; |
| 1163 | |
| 1164 | VM_BUG_ON(start & ~PAGE_MASK); |
| 1165 | VM_BUG_ON(len != PAGE_ALIGN(len)); |
| 1166 | end = start + len; |
| 1167 | |
| 1168 | for (nstart = start; nstart < end; nstart = nend) { |
| 1169 | /* |
| 1170 | * We want to fault in pages for [nstart; end) address range. |
| 1171 | * Find first corresponding VMA. |
| 1172 | */ |
| 1173 | if (!locked) { |
| 1174 | locked = 1; |
| 1175 | down_read(&mm->mmap_sem); |
| 1176 | vma = find_vma(mm, nstart); |
| 1177 | } else if (nstart >= vma->vm_end) |
| 1178 | vma = vma->vm_next; |
| 1179 | if (!vma || vma->vm_start >= end) |
| 1180 | break; |
| 1181 | /* |
| 1182 | * Set [nstart; nend) to intersection of desired address |
| 1183 | * range with the first VMA. Also, skip undesirable VMA types. |
| 1184 | */ |
| 1185 | nend = min(end, vma->vm_end); |
| 1186 | if (vma->vm_flags & (VM_IO | VM_PFNMAP)) |
| 1187 | continue; |
| 1188 | if (nstart < vma->vm_start) |
| 1189 | nstart = vma->vm_start; |
| 1190 | /* |
| 1191 | * Now fault in a range of pages. populate_vma_page_range() |
| 1192 | * double checks the vma flags, so that it won't mlock pages |
| 1193 | * if the vma was already munlocked. |
| 1194 | */ |
| 1195 | ret = populate_vma_page_range(vma, nstart, nend, &locked); |
| 1196 | if (ret < 0) { |
| 1197 | if (ignore_errors) { |
| 1198 | ret = 0; |
| 1199 | continue; /* continue at next VMA */ |
| 1200 | } |
| 1201 | break; |
| 1202 | } |
| 1203 | nend = nstart + ret * PAGE_SIZE; |
| 1204 | ret = 0; |
| 1205 | } |
| 1206 | if (locked) |
| 1207 | up_read(&mm->mmap_sem); |
| 1208 | return ret; /* 0 or negative error code */ |
| 1209 | } |
| 1210 | |
| 1211 | /** |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1212 | * get_dump_page() - pin user page in memory while writing it to core dump |
| 1213 | * @addr: user address |
| 1214 | * |
| 1215 | * Returns struct page pointer of user page pinned for dump, |
Kirill A. Shutemov | ea1754a | 2016-04-01 15:29:48 +0300 | [diff] [blame] | 1216 | * to be freed afterwards by put_page(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1217 | * |
| 1218 | * Returns NULL on any kind of failure - a hole must then be inserted into |
| 1219 | * the corefile, to preserve alignment with its headers; and also returns |
| 1220 | * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - |
| 1221 | * allowing a hole to be left in the corefile to save diskspace. |
| 1222 | * |
| 1223 | * Called without mmap_sem, but after all other threads have been killed. |
| 1224 | */ |
| 1225 | #ifdef CONFIG_ELF_CORE |
| 1226 | struct page *get_dump_page(unsigned long addr) |
| 1227 | { |
| 1228 | struct vm_area_struct *vma; |
| 1229 | struct page *page; |
| 1230 | |
| 1231 | if (__get_user_pages(current, current->mm, addr, 1, |
| 1232 | FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma, |
| 1233 | NULL) < 1) |
| 1234 | return NULL; |
| 1235 | flush_cache_page(vma, addr, page_to_pfn(page)); |
| 1236 | return page; |
| 1237 | } |
| 1238 | #endif /* CONFIG_ELF_CORE */ |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1239 | |
| 1240 | /* |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1241 | * Generic Fast GUP |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1242 | * |
| 1243 | * get_user_pages_fast attempts to pin user pages by walking the page |
| 1244 | * tables directly and avoids taking locks. Thus the walker needs to be |
| 1245 | * protected from page table pages being freed from under it, and should |
| 1246 | * block any THP splits. |
| 1247 | * |
| 1248 | * One way to achieve this is to have the walker disable interrupts, and |
| 1249 | * rely on IPIs from the TLB flushing code blocking before the page table |
| 1250 | * pages are freed. This is unsuitable for architectures that do not need |
| 1251 | * to broadcast an IPI when invalidating TLBs. |
| 1252 | * |
| 1253 | * Another way to achieve this is to batch up page table containing pages |
| 1254 | * belonging to more than one mm_user, then rcu_sched a callback to free those |
| 1255 | * pages. Disabling interrupts will allow the fast_gup walker to both block |
| 1256 | * the rcu_sched callback, and an IPI that we broadcast for splitting THPs |
| 1257 | * (which is a relatively rare event). The code below adopts this strategy. |
| 1258 | * |
| 1259 | * Before activating this code, please be aware that the following assumptions |
| 1260 | * are currently made: |
| 1261 | * |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1262 | * *) Either HAVE_RCU_TABLE_FREE is enabled, and tlb_remove_table() is used to |
| 1263 | * free pages containing page tables or TLB flushing requires IPI broadcast. |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1264 | * |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1265 | * *) ptes can be read atomically by the architecture. |
| 1266 | * |
| 1267 | * *) access_ok is sufficient to validate userspace address ranges. |
| 1268 | * |
| 1269 | * The last two assumptions can be relaxed by the addition of helper functions. |
| 1270 | * |
| 1271 | * This code is based heavily on the PowerPC implementation by Nick Piggin. |
| 1272 | */ |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1273 | #ifdef CONFIG_HAVE_GENERIC_GUP |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1274 | |
Kirill A. Shutemov | 0005d20 | 2017-03-16 18:26:51 +0300 | [diff] [blame] | 1275 | #ifndef gup_get_pte |
| 1276 | /* |
| 1277 | * We assume that the PTE can be read atomically. If this is not the case for |
| 1278 | * your architecture, please provide the helper. |
| 1279 | */ |
| 1280 | static inline pte_t gup_get_pte(pte_t *ptep) |
| 1281 | { |
| 1282 | return READ_ONCE(*ptep); |
| 1283 | } |
| 1284 | #endif |
| 1285 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1286 | static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages) |
| 1287 | { |
| 1288 | while ((*nr) - nr_start) { |
| 1289 | struct page *page = pages[--(*nr)]; |
| 1290 | |
| 1291 | ClearPageReferenced(page); |
| 1292 | put_page(page); |
| 1293 | } |
| 1294 | } |
| 1295 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1296 | #ifdef __HAVE_ARCH_PTE_SPECIAL |
| 1297 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1298 | int write, struct page **pages, int *nr) |
| 1299 | { |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1300 | struct dev_pagemap *pgmap = NULL; |
| 1301 | int nr_start = *nr, ret = 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1302 | pte_t *ptep, *ptem; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1303 | |
| 1304 | ptem = ptep = pte_offset_map(&pmd, addr); |
| 1305 | do { |
Kirill A. Shutemov | 0005d20 | 2017-03-16 18:26:51 +0300 | [diff] [blame] | 1306 | pte_t pte = gup_get_pte(ptep); |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1307 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1308 | |
| 1309 | /* |
| 1310 | * Similar to the PMD case below, NUMA hinting must take slow |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1311 | * path using the pte_protnone check. |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1312 | */ |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1313 | if (pte_protnone(pte)) |
| 1314 | goto pte_unmap; |
| 1315 | |
| 1316 | if (!pte_access_permitted(pte, write)) |
| 1317 | goto pte_unmap; |
| 1318 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1319 | if (pte_devmap(pte)) { |
| 1320 | pgmap = get_dev_pagemap(pte_pfn(pte), pgmap); |
| 1321 | if (unlikely(!pgmap)) { |
| 1322 | undo_dev_pagemap(nr, nr_start, pages); |
| 1323 | goto pte_unmap; |
| 1324 | } |
| 1325 | } else if (pte_special(pte)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1326 | goto pte_unmap; |
| 1327 | |
| 1328 | VM_BUG_ON(!pfn_valid(pte_pfn(pte))); |
| 1329 | page = pte_page(pte); |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1330 | head = compound_head(page); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1331 | |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1332 | if (!page_cache_get_speculative(head)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1333 | goto pte_unmap; |
| 1334 | |
| 1335 | if (unlikely(pte_val(pte) != pte_val(*ptep))) { |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1336 | put_page(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1337 | goto pte_unmap; |
| 1338 | } |
| 1339 | |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1340 | VM_BUG_ON_PAGE(compound_head(page) != head, page); |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1341 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1342 | put_dev_pagemap(pgmap); |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1343 | SetPageReferenced(page); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1344 | pages[*nr] = page; |
| 1345 | (*nr)++; |
| 1346 | |
| 1347 | } while (ptep++, addr += PAGE_SIZE, addr != end); |
| 1348 | |
| 1349 | ret = 1; |
| 1350 | |
| 1351 | pte_unmap: |
| 1352 | pte_unmap(ptem); |
| 1353 | return ret; |
| 1354 | } |
| 1355 | #else |
| 1356 | |
| 1357 | /* |
| 1358 | * If we can't determine whether or not a pte is special, then fail immediately |
| 1359 | * for ptes. Note, we can still pin HugeTLB and THP as these are guaranteed not |
| 1360 | * to be special. |
| 1361 | * |
| 1362 | * For a futex to be placed on a THP tail page, get_futex_key requires a |
| 1363 | * __get_user_pages_fast implementation that can pin pages. Thus it's still |
| 1364 | * useful to have gup_huge_pmd even if we can't operate on ptes. |
| 1365 | */ |
| 1366 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1367 | int write, struct page **pages, int *nr) |
| 1368 | { |
| 1369 | return 0; |
| 1370 | } |
| 1371 | #endif /* __HAVE_ARCH_PTE_SPECIAL */ |
| 1372 | |
Oliver O'Halloran | 09180ca | 2017-09-06 16:20:58 -0700 | [diff] [blame] | 1373 | #if defined(__HAVE_ARCH_PTE_DEVMAP) && defined(CONFIG_TRANSPARENT_HUGEPAGE) |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1374 | static int __gup_device_huge(unsigned long pfn, unsigned long addr, |
| 1375 | unsigned long end, struct page **pages, int *nr) |
| 1376 | { |
| 1377 | int nr_start = *nr; |
| 1378 | struct dev_pagemap *pgmap = NULL; |
| 1379 | |
| 1380 | do { |
| 1381 | struct page *page = pfn_to_page(pfn); |
| 1382 | |
| 1383 | pgmap = get_dev_pagemap(pfn, pgmap); |
| 1384 | if (unlikely(!pgmap)) { |
| 1385 | undo_dev_pagemap(nr, nr_start, pages); |
| 1386 | return 0; |
| 1387 | } |
| 1388 | SetPageReferenced(page); |
| 1389 | pages[*nr] = page; |
| 1390 | get_page(page); |
| 1391 | put_dev_pagemap(pgmap); |
| 1392 | (*nr)++; |
| 1393 | pfn++; |
| 1394 | } while (addr += PAGE_SIZE, addr != end); |
| 1395 | return 1; |
| 1396 | } |
| 1397 | |
| 1398 | static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, |
| 1399 | unsigned long end, struct page **pages, int *nr) |
| 1400 | { |
| 1401 | unsigned long fault_pfn; |
| 1402 | |
| 1403 | fault_pfn = pmd_pfn(pmd) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); |
| 1404 | return __gup_device_huge(fault_pfn, addr, end, pages, nr); |
| 1405 | } |
| 1406 | |
| 1407 | static int __gup_device_huge_pud(pud_t pud, unsigned long addr, |
| 1408 | unsigned long end, struct page **pages, int *nr) |
| 1409 | { |
| 1410 | unsigned long fault_pfn; |
| 1411 | |
| 1412 | fault_pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); |
| 1413 | return __gup_device_huge(fault_pfn, addr, end, pages, nr); |
| 1414 | } |
| 1415 | #else |
| 1416 | static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, |
| 1417 | unsigned long end, struct page **pages, int *nr) |
| 1418 | { |
| 1419 | BUILD_BUG(); |
| 1420 | return 0; |
| 1421 | } |
| 1422 | |
| 1423 | static int __gup_device_huge_pud(pud_t pud, unsigned long addr, |
| 1424 | unsigned long end, struct page **pages, int *nr) |
| 1425 | { |
| 1426 | BUILD_BUG(); |
| 1427 | return 0; |
| 1428 | } |
| 1429 | #endif |
| 1430 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1431 | static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, |
| 1432 | unsigned long end, int write, struct page **pages, int *nr) |
| 1433 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1434 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1435 | int refs; |
| 1436 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1437 | if (!pmd_access_permitted(orig, write)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1438 | return 0; |
| 1439 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1440 | if (pmd_devmap(orig)) |
| 1441 | return __gup_device_huge_pmd(orig, addr, end, pages, nr); |
| 1442 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1443 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1444 | page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1445 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1446 | pages[*nr] = page; |
| 1447 | (*nr)++; |
| 1448 | page++; |
| 1449 | refs++; |
| 1450 | } while (addr += PAGE_SIZE, addr != end); |
| 1451 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1452 | head = compound_head(pmd_page(orig)); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1453 | if (!page_cache_add_speculative(head, refs)) { |
| 1454 | *nr -= refs; |
| 1455 | return 0; |
| 1456 | } |
| 1457 | |
| 1458 | if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) { |
| 1459 | *nr -= refs; |
| 1460 | while (refs--) |
| 1461 | put_page(head); |
| 1462 | return 0; |
| 1463 | } |
| 1464 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1465 | SetPageReferenced(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1466 | return 1; |
| 1467 | } |
| 1468 | |
| 1469 | static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, |
| 1470 | unsigned long end, int write, struct page **pages, int *nr) |
| 1471 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1472 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1473 | int refs; |
| 1474 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1475 | if (!pud_access_permitted(orig, write)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1476 | return 0; |
| 1477 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1478 | if (pud_devmap(orig)) |
| 1479 | return __gup_device_huge_pud(orig, addr, end, pages, nr); |
| 1480 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1481 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1482 | page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1483 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1484 | pages[*nr] = page; |
| 1485 | (*nr)++; |
| 1486 | page++; |
| 1487 | refs++; |
| 1488 | } while (addr += PAGE_SIZE, addr != end); |
| 1489 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1490 | head = compound_head(pud_page(orig)); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1491 | if (!page_cache_add_speculative(head, refs)) { |
| 1492 | *nr -= refs; |
| 1493 | return 0; |
| 1494 | } |
| 1495 | |
| 1496 | if (unlikely(pud_val(orig) != pud_val(*pudp))) { |
| 1497 | *nr -= refs; |
| 1498 | while (refs--) |
| 1499 | put_page(head); |
| 1500 | return 0; |
| 1501 | } |
| 1502 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1503 | SetPageReferenced(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1504 | return 1; |
| 1505 | } |
| 1506 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1507 | static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr, |
| 1508 | unsigned long end, int write, |
| 1509 | struct page **pages, int *nr) |
| 1510 | { |
| 1511 | int refs; |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1512 | struct page *head, *page; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1513 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1514 | if (!pgd_access_permitted(orig, write)) |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1515 | return 0; |
| 1516 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1517 | BUILD_BUG_ON(pgd_devmap(orig)); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1518 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1519 | page = pgd_page(orig) + ((addr & ~PGDIR_MASK) >> PAGE_SHIFT); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1520 | do { |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1521 | pages[*nr] = page; |
| 1522 | (*nr)++; |
| 1523 | page++; |
| 1524 | refs++; |
| 1525 | } while (addr += PAGE_SIZE, addr != end); |
| 1526 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1527 | head = compound_head(pgd_page(orig)); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1528 | if (!page_cache_add_speculative(head, refs)) { |
| 1529 | *nr -= refs; |
| 1530 | return 0; |
| 1531 | } |
| 1532 | |
| 1533 | if (unlikely(pgd_val(orig) != pgd_val(*pgdp))) { |
| 1534 | *nr -= refs; |
| 1535 | while (refs--) |
| 1536 | put_page(head); |
| 1537 | return 0; |
| 1538 | } |
| 1539 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1540 | SetPageReferenced(head); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1541 | return 1; |
| 1542 | } |
| 1543 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1544 | static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end, |
| 1545 | int write, struct page **pages, int *nr) |
| 1546 | { |
| 1547 | unsigned long next; |
| 1548 | pmd_t *pmdp; |
| 1549 | |
| 1550 | pmdp = pmd_offset(&pud, addr); |
| 1551 | do { |
Christian Borntraeger | 38c5ce9 | 2015-01-06 22:54:46 +0100 | [diff] [blame] | 1552 | pmd_t pmd = READ_ONCE(*pmdp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1553 | |
| 1554 | next = pmd_addr_end(addr, end); |
Zi Yan | 84c3fc4 | 2017-09-08 16:11:01 -0700 | [diff] [blame] | 1555 | if (!pmd_present(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1556 | return 0; |
| 1557 | |
| 1558 | if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) { |
| 1559 | /* |
| 1560 | * NUMA hinting faults need to be handled in the GUP |
| 1561 | * slowpath for accounting purposes and so that they |
| 1562 | * can be serialised against THP migration. |
| 1563 | */ |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1564 | if (pmd_protnone(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1565 | return 0; |
| 1566 | |
| 1567 | if (!gup_huge_pmd(pmd, pmdp, addr, next, write, |
| 1568 | pages, nr)) |
| 1569 | return 0; |
| 1570 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1571 | } else if (unlikely(is_hugepd(__hugepd(pmd_val(pmd))))) { |
| 1572 | /* |
| 1573 | * architecture have different format for hugetlbfs |
| 1574 | * pmd format and THP pmd format |
| 1575 | */ |
| 1576 | if (!gup_huge_pd(__hugepd(pmd_val(pmd)), addr, |
| 1577 | PMD_SHIFT, next, write, pages, nr)) |
| 1578 | return 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1579 | } else if (!gup_pte_range(pmd, addr, next, write, pages, nr)) |
| 1580 | return 0; |
| 1581 | } while (pmdp++, addr = next, addr != end); |
| 1582 | |
| 1583 | return 1; |
| 1584 | } |
| 1585 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1586 | static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end, |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1587 | int write, struct page **pages, int *nr) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1588 | { |
| 1589 | unsigned long next; |
| 1590 | pud_t *pudp; |
| 1591 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1592 | pudp = pud_offset(&p4d, addr); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1593 | do { |
Christian Borntraeger | e37c698 | 2014-12-07 21:41:33 +0100 | [diff] [blame] | 1594 | pud_t pud = READ_ONCE(*pudp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1595 | |
| 1596 | next = pud_addr_end(addr, end); |
| 1597 | if (pud_none(pud)) |
| 1598 | return 0; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1599 | if (unlikely(pud_huge(pud))) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1600 | if (!gup_huge_pud(pud, pudp, addr, next, write, |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1601 | pages, nr)) |
| 1602 | return 0; |
| 1603 | } else if (unlikely(is_hugepd(__hugepd(pud_val(pud))))) { |
| 1604 | if (!gup_huge_pd(__hugepd(pud_val(pud)), addr, |
| 1605 | PUD_SHIFT, next, write, pages, nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1606 | return 0; |
| 1607 | } else if (!gup_pmd_range(pud, addr, next, write, pages, nr)) |
| 1608 | return 0; |
| 1609 | } while (pudp++, addr = next, addr != end); |
| 1610 | |
| 1611 | return 1; |
| 1612 | } |
| 1613 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1614 | static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end, |
| 1615 | int write, struct page **pages, int *nr) |
| 1616 | { |
| 1617 | unsigned long next; |
| 1618 | p4d_t *p4dp; |
| 1619 | |
| 1620 | p4dp = p4d_offset(&pgd, addr); |
| 1621 | do { |
| 1622 | p4d_t p4d = READ_ONCE(*p4dp); |
| 1623 | |
| 1624 | next = p4d_addr_end(addr, end); |
| 1625 | if (p4d_none(p4d)) |
| 1626 | return 0; |
| 1627 | BUILD_BUG_ON(p4d_huge(p4d)); |
| 1628 | if (unlikely(is_hugepd(__hugepd(p4d_val(p4d))))) { |
| 1629 | if (!gup_huge_pd(__hugepd(p4d_val(p4d)), addr, |
| 1630 | P4D_SHIFT, next, write, pages, nr)) |
| 1631 | return 0; |
Kirill A. Shutemov | ce70df0 | 2017-03-13 08:22:13 +0300 | [diff] [blame] | 1632 | } else if (!gup_pud_range(p4d, addr, next, write, pages, nr)) |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1633 | return 0; |
| 1634 | } while (p4dp++, addr = next, addr != end); |
| 1635 | |
| 1636 | return 1; |
| 1637 | } |
| 1638 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1639 | /* |
| 1640 | * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to |
| 1641 | * the regular GUP. It will only return non-negative values. |
| 1642 | */ |
| 1643 | int __get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1644 | struct page **pages) |
| 1645 | { |
| 1646 | struct mm_struct *mm = current->mm; |
| 1647 | unsigned long addr, len, end; |
| 1648 | unsigned long next, flags; |
| 1649 | pgd_t *pgdp; |
| 1650 | int nr = 0; |
| 1651 | |
| 1652 | start &= PAGE_MASK; |
| 1653 | addr = start; |
| 1654 | len = (unsigned long) nr_pages << PAGE_SHIFT; |
| 1655 | end = start + len; |
| 1656 | |
| 1657 | if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, |
Arnd Bergmann | aa2369f | 2017-05-03 14:56:12 -0700 | [diff] [blame] | 1658 | (void __user *)start, len))) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1659 | return 0; |
| 1660 | |
| 1661 | /* |
| 1662 | * Disable interrupts. We use the nested form as we can already have |
| 1663 | * interrupts disabled by get_futex_key. |
| 1664 | * |
| 1665 | * With interrupts disabled, we block page table pages from being |
| 1666 | * freed from under us. See mmu_gather_tlb in asm-generic/tlb.h |
| 1667 | * for more details. |
| 1668 | * |
| 1669 | * We do not adopt an rcu_read_lock(.) here as we also want to |
| 1670 | * block IPIs that come from THPs splitting. |
| 1671 | */ |
| 1672 | |
| 1673 | local_irq_save(flags); |
| 1674 | pgdp = pgd_offset(mm, addr); |
| 1675 | do { |
Jason Low | 9d8c47e | 2015-04-15 16:14:05 -0700 | [diff] [blame] | 1676 | pgd_t pgd = READ_ONCE(*pgdp); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1677 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1678 | next = pgd_addr_end(addr, end); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1679 | if (pgd_none(pgd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1680 | break; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1681 | if (unlikely(pgd_huge(pgd))) { |
| 1682 | if (!gup_huge_pgd(pgd, pgdp, addr, next, write, |
| 1683 | pages, &nr)) |
| 1684 | break; |
| 1685 | } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) { |
| 1686 | if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr, |
| 1687 | PGDIR_SHIFT, next, write, pages, &nr)) |
| 1688 | break; |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1689 | } else if (!gup_p4d_range(pgd, addr, next, write, pages, &nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1690 | break; |
| 1691 | } while (pgdp++, addr = next, addr != end); |
| 1692 | local_irq_restore(flags); |
| 1693 | |
| 1694 | return nr; |
| 1695 | } |
| 1696 | |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1697 | #ifndef gup_fast_permitted |
| 1698 | /* |
| 1699 | * Check if it's allowed to use __get_user_pages_fast() for the range, or |
| 1700 | * we need to fall back to the slow version: |
| 1701 | */ |
| 1702 | bool gup_fast_permitted(unsigned long start, int nr_pages, int write) |
| 1703 | { |
| 1704 | unsigned long len, end; |
| 1705 | |
| 1706 | len = (unsigned long) nr_pages << PAGE_SHIFT; |
| 1707 | end = start + len; |
| 1708 | return end >= start; |
| 1709 | } |
| 1710 | #endif |
| 1711 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1712 | /** |
| 1713 | * get_user_pages_fast() - pin user pages in memory |
| 1714 | * @start: starting user address |
| 1715 | * @nr_pages: number of pages from start to pin |
| 1716 | * @write: whether pages will be written to |
| 1717 | * @pages: array that receives pointers to the pages pinned. |
| 1718 | * Should be at least nr_pages long. |
| 1719 | * |
| 1720 | * Attempt to pin user pages in memory without taking mm->mmap_sem. |
| 1721 | * If not successful, it will fall back to taking the lock and |
| 1722 | * calling get_user_pages(). |
| 1723 | * |
| 1724 | * Returns number of pages pinned. This may be fewer than the number |
| 1725 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 1726 | * were pinned, returns -errno. |
| 1727 | */ |
| 1728 | int get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1729 | struct page **pages) |
| 1730 | { |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1731 | int nr = 0, ret = 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1732 | |
| 1733 | start &= PAGE_MASK; |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1734 | |
| 1735 | if (gup_fast_permitted(start, nr_pages, write)) { |
| 1736 | nr = __get_user_pages_fast(start, nr_pages, write, pages); |
| 1737 | ret = nr; |
| 1738 | } |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1739 | |
| 1740 | if (nr < nr_pages) { |
| 1741 | /* Try to get the remaining pages with get_user_pages */ |
| 1742 | start += nr << PAGE_SHIFT; |
| 1743 | pages += nr; |
| 1744 | |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 1745 | ret = get_user_pages_unlocked(start, nr_pages - nr, pages, |
| 1746 | write ? FOLL_WRITE : 0); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1747 | |
| 1748 | /* Have to be a bit careful with return values */ |
| 1749 | if (nr > 0) { |
| 1750 | if (ret < 0) |
| 1751 | ret = nr; |
| 1752 | else |
| 1753 | ret += nr; |
| 1754 | } |
| 1755 | } |
| 1756 | |
| 1757 | return ret; |
| 1758 | } |
| 1759 | |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1760 | #endif /* CONFIG_HAVE_GENERIC_GUP */ |