Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1 | #include <linux/kernel.h> |
| 2 | #include <linux/errno.h> |
| 3 | #include <linux/err.h> |
| 4 | #include <linux/spinlock.h> |
| 5 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 6 | #include <linux/mm.h> |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 7 | #include <linux/memremap.h> |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 8 | #include <linux/pagemap.h> |
| 9 | #include <linux/rmap.h> |
| 10 | #include <linux/swap.h> |
| 11 | #include <linux/swapops.h> |
| 12 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 13 | #include <linux/sched.h> |
| 14 | #include <linux/rwsem.h> |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 15 | #include <linux/hugetlb.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 16 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 17 | #include <asm/mmu_context.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 18 | #include <asm/pgtable.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 19 | #include <asm/tlbflush.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 20 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 21 | #include "internal.h" |
| 22 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 23 | static struct page *no_page_table(struct vm_area_struct *vma, |
| 24 | unsigned int flags) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 25 | { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 26 | /* |
| 27 | * When core dumping an enormous anonymous area that nobody |
| 28 | * has touched so far, we don't want to allocate unnecessary pages or |
| 29 | * page tables. Return error instead of NULL to skip handle_mm_fault, |
| 30 | * then get_dump_page() will return NULL to leave a hole in the dump. |
| 31 | * But we can only make this optimization where a hole would surely |
| 32 | * be zero-filled if handle_mm_fault() actually did handle it. |
| 33 | */ |
| 34 | if ((flags & FOLL_DUMP) && (!vma->vm_ops || !vma->vm_ops->fault)) |
| 35 | return ERR_PTR(-EFAULT); |
| 36 | return NULL; |
| 37 | } |
| 38 | |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 39 | static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, |
| 40 | pte_t *pte, unsigned int flags) |
| 41 | { |
| 42 | /* No page to get reference */ |
| 43 | if (flags & FOLL_GET) |
| 44 | return -EFAULT; |
| 45 | |
| 46 | if (flags & FOLL_TOUCH) { |
| 47 | pte_t entry = *pte; |
| 48 | |
| 49 | if (flags & FOLL_WRITE) |
| 50 | entry = pte_mkdirty(entry); |
| 51 | entry = pte_mkyoung(entry); |
| 52 | |
| 53 | if (!pte_same(*pte, entry)) { |
| 54 | set_pte_at(vma->vm_mm, address, pte, entry); |
| 55 | update_mmu_cache(vma, address, pte); |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | /* Proper page table entry exists, but no corresponding struct page */ |
| 60 | return -EEXIST; |
| 61 | } |
| 62 | |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 63 | /* |
| 64 | * FOLL_FORCE can write to even unwritable pte's, but only |
| 65 | * after we've gone through a COW cycle and they are dirty. |
| 66 | */ |
| 67 | static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) |
| 68 | { |
| 69 | return pte_write(pte) || |
| 70 | ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); |
| 71 | } |
| 72 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 73 | static struct page *follow_page_pte(struct vm_area_struct *vma, |
| 74 | unsigned long address, pmd_t *pmd, unsigned int flags) |
| 75 | { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 76 | struct mm_struct *mm = vma->vm_mm; |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 77 | struct dev_pagemap *pgmap = NULL; |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 78 | struct page *page; |
| 79 | spinlock_t *ptl; |
| 80 | pte_t *ptep, pte; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 81 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 82 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 83 | if (unlikely(pmd_bad(*pmd))) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 84 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 85 | |
| 86 | ptep = pte_offset_map_lock(mm, pmd, address, &ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 87 | pte = *ptep; |
| 88 | if (!pte_present(pte)) { |
| 89 | swp_entry_t entry; |
| 90 | /* |
| 91 | * KSM's break_ksm() relies upon recognizing a ksm page |
| 92 | * even while it is being migrated, so for that case we |
| 93 | * need migration_entry_wait(). |
| 94 | */ |
| 95 | if (likely(!(flags & FOLL_MIGRATION))) |
| 96 | goto no_page; |
Kirill A. Shutemov | 0661a33 | 2015-02-10 14:10:04 -0800 | [diff] [blame] | 97 | if (pte_none(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 98 | goto no_page; |
| 99 | entry = pte_to_swp_entry(pte); |
| 100 | if (!is_migration_entry(entry)) |
| 101 | goto no_page; |
| 102 | pte_unmap_unlock(ptep, ptl); |
| 103 | migration_entry_wait(mm, pmd, address); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 104 | goto retry; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 105 | } |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 106 | if ((flags & FOLL_NUMA) && pte_protnone(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 107 | goto no_page; |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 108 | if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 109 | pte_unmap_unlock(ptep, ptl); |
| 110 | return NULL; |
| 111 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 112 | |
| 113 | page = vm_normal_page(vma, address, pte); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 114 | if (!page && pte_devmap(pte) && (flags & FOLL_GET)) { |
| 115 | /* |
| 116 | * Only return device mapping pages in the FOLL_GET case since |
| 117 | * they are only valid while holding the pgmap reference. |
| 118 | */ |
| 119 | pgmap = get_dev_pagemap(pte_pfn(pte), NULL); |
| 120 | if (pgmap) |
| 121 | page = pte_page(pte); |
| 122 | else |
| 123 | goto no_page; |
| 124 | } else if (unlikely(!page)) { |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 125 | if (flags & FOLL_DUMP) { |
| 126 | /* Avoid special (like zero) pages in core dumps */ |
| 127 | page = ERR_PTR(-EFAULT); |
| 128 | goto out; |
| 129 | } |
| 130 | |
| 131 | if (is_zero_pfn(pte_pfn(pte))) { |
| 132 | page = pte_page(pte); |
| 133 | } else { |
| 134 | int ret; |
| 135 | |
| 136 | ret = follow_pfn_pte(vma, address, ptep, flags); |
| 137 | page = ERR_PTR(ret); |
| 138 | goto out; |
| 139 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 140 | } |
| 141 | |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 142 | if (flags & FOLL_SPLIT && PageTransCompound(page)) { |
| 143 | int ret; |
| 144 | get_page(page); |
| 145 | pte_unmap_unlock(ptep, ptl); |
| 146 | lock_page(page); |
| 147 | ret = split_huge_page(page); |
| 148 | unlock_page(page); |
| 149 | put_page(page); |
| 150 | if (ret) |
| 151 | return ERR_PTR(ret); |
| 152 | goto retry; |
| 153 | } |
| 154 | |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 155 | if (flags & FOLL_GET) { |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 156 | if (unlikely(!try_get_page(page))) { |
| 157 | page = ERR_PTR(-ENOMEM); |
| 158 | goto out; |
| 159 | } |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 160 | |
| 161 | /* drop the pgmap reference now that we hold the page */ |
| 162 | if (pgmap) { |
| 163 | put_dev_pagemap(pgmap); |
| 164 | pgmap = NULL; |
| 165 | } |
| 166 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 167 | if (flags & FOLL_TOUCH) { |
| 168 | if ((flags & FOLL_WRITE) && |
| 169 | !pte_dirty(pte) && !PageDirty(page)) |
| 170 | set_page_dirty(page); |
| 171 | /* |
| 172 | * pte_mkyoung() would be more correct here, but atomic care |
| 173 | * is needed to avoid losing the dirty bit: it is easier to use |
| 174 | * mark_page_accessed(). |
| 175 | */ |
| 176 | mark_page_accessed(page); |
| 177 | } |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 178 | if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) { |
Kirill A. Shutemov | e90309c | 2016-01-15 16:54:33 -0800 | [diff] [blame] | 179 | /* Do not mlock pte-mapped THP */ |
| 180 | if (PageTransCompound(page)) |
| 181 | goto out; |
| 182 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 183 | /* |
| 184 | * The preliminary mapping check is mainly to avoid the |
| 185 | * pointless overhead of lock_page on the ZERO_PAGE |
| 186 | * which might bounce very badly if there is contention. |
| 187 | * |
| 188 | * If the page is already locked, we don't need to |
| 189 | * handle it now - vmscan will handle it later if and |
| 190 | * when it attempts to reclaim the page. |
| 191 | */ |
| 192 | if (page->mapping && trylock_page(page)) { |
| 193 | lru_add_drain(); /* push cached pages to LRU */ |
| 194 | /* |
| 195 | * Because we lock page here, and migration is |
| 196 | * blocked by the pte's page reference, and we |
| 197 | * know the page is still mapped, we don't even |
| 198 | * need to check for file-cache page truncation. |
| 199 | */ |
| 200 | mlock_vma_page(page); |
| 201 | unlock_page(page); |
| 202 | } |
| 203 | } |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 204 | out: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 205 | pte_unmap_unlock(ptep, ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 206 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 207 | no_page: |
| 208 | pte_unmap_unlock(ptep, ptl); |
| 209 | if (!pte_none(pte)) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 210 | return NULL; |
| 211 | return no_page_table(vma, flags); |
| 212 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 213 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 214 | /** |
| 215 | * follow_page_mask - look up a page descriptor from a user-virtual address |
| 216 | * @vma: vm_area_struct mapping @address |
| 217 | * @address: virtual address to look up |
| 218 | * @flags: flags modifying lookup behaviour |
| 219 | * @page_mask: on output, *page_mask is set according to the size of the page |
| 220 | * |
| 221 | * @flags can have FOLL_ flags set, defined in <linux/mm.h> |
| 222 | * |
| 223 | * Returns the mapped (struct page *), %NULL if no mapping exists, or |
| 224 | * an error pointer if there is a mapping to something not represented |
| 225 | * by a page descriptor (see also vm_normal_page()). |
| 226 | */ |
| 227 | struct page *follow_page_mask(struct vm_area_struct *vma, |
| 228 | unsigned long address, unsigned int flags, |
| 229 | unsigned int *page_mask) |
| 230 | { |
| 231 | pgd_t *pgd; |
| 232 | pud_t *pud; |
| 233 | pmd_t *pmd; |
| 234 | spinlock_t *ptl; |
| 235 | struct page *page; |
| 236 | struct mm_struct *mm = vma->vm_mm; |
| 237 | |
| 238 | *page_mask = 0; |
| 239 | |
| 240 | page = follow_huge_addr(mm, address, flags & FOLL_WRITE); |
| 241 | if (!IS_ERR(page)) { |
| 242 | BUG_ON(flags & FOLL_GET); |
| 243 | return page; |
| 244 | } |
| 245 | |
| 246 | pgd = pgd_offset(mm, address); |
| 247 | if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd))) |
| 248 | return no_page_table(vma, flags); |
| 249 | |
| 250 | pud = pud_offset(pgd, address); |
| 251 | if (pud_none(*pud)) |
| 252 | return no_page_table(vma, flags); |
| 253 | if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) { |
Naoya Horiguchi | e66f17f | 2015-02-11 15:25:22 -0800 | [diff] [blame] | 254 | page = follow_huge_pud(mm, address, pud, flags); |
| 255 | if (page) |
| 256 | return page; |
| 257 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 258 | } |
| 259 | if (unlikely(pud_bad(*pud))) |
| 260 | return no_page_table(vma, flags); |
| 261 | |
| 262 | pmd = pmd_offset(pud, address); |
| 263 | if (pmd_none(*pmd)) |
| 264 | return no_page_table(vma, flags); |
| 265 | if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) { |
Naoya Horiguchi | e66f17f | 2015-02-11 15:25:22 -0800 | [diff] [blame] | 266 | page = follow_huge_pmd(mm, address, pmd, flags); |
| 267 | if (page) |
| 268 | return page; |
| 269 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 270 | } |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 271 | if ((flags & FOLL_NUMA) && pmd_protnone(*pmd)) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 272 | return no_page_table(vma, flags); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 273 | if (pmd_devmap(*pmd)) { |
| 274 | ptl = pmd_lock(mm, pmd); |
| 275 | page = follow_devmap_pmd(vma, address, pmd, flags); |
| 276 | spin_unlock(ptl); |
| 277 | if (page) |
| 278 | return page; |
| 279 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 280 | if (likely(!pmd_trans_huge(*pmd))) |
| 281 | return follow_page_pte(vma, address, pmd, flags); |
| 282 | |
| 283 | ptl = pmd_lock(mm, pmd); |
| 284 | if (unlikely(!pmd_trans_huge(*pmd))) { |
| 285 | spin_unlock(ptl); |
| 286 | return follow_page_pte(vma, address, pmd, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 287 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 288 | if (flags & FOLL_SPLIT) { |
| 289 | int ret; |
| 290 | page = pmd_page(*pmd); |
| 291 | if (is_huge_zero_page(page)) { |
| 292 | spin_unlock(ptl); |
| 293 | ret = 0; |
Kirill A. Shutemov | 78ddc53 | 2016-01-15 16:52:42 -0800 | [diff] [blame] | 294 | split_huge_pmd(vma, pmd, address); |
Naoya Horiguchi | 337d9ab | 2016-07-26 15:24:03 -0700 | [diff] [blame] | 295 | if (pmd_trans_unstable(pmd)) |
| 296 | ret = -EBUSY; |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 297 | } else { |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 298 | if (unlikely(!try_get_page(page))) { |
| 299 | spin_unlock(ptl); |
| 300 | return ERR_PTR(-ENOMEM); |
| 301 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 302 | spin_unlock(ptl); |
| 303 | lock_page(page); |
| 304 | ret = split_huge_page(page); |
| 305 | unlock_page(page); |
| 306 | put_page(page); |
Kirill A. Shutemov | baa355f | 2016-07-26 15:25:51 -0700 | [diff] [blame] | 307 | if (pmd_none(*pmd)) |
| 308 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 309 | } |
| 310 | |
| 311 | return ret ? ERR_PTR(ret) : |
| 312 | follow_page_pte(vma, address, pmd, flags); |
| 313 | } |
| 314 | |
| 315 | page = follow_trans_huge_pmd(vma, address, pmd, flags); |
| 316 | spin_unlock(ptl); |
| 317 | *page_mask = HPAGE_PMD_NR - 1; |
| 318 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 319 | } |
| 320 | |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 321 | static int get_gate_page(struct mm_struct *mm, unsigned long address, |
| 322 | unsigned int gup_flags, struct vm_area_struct **vma, |
| 323 | struct page **page) |
| 324 | { |
| 325 | pgd_t *pgd; |
| 326 | pud_t *pud; |
| 327 | pmd_t *pmd; |
| 328 | pte_t *pte; |
| 329 | int ret = -EFAULT; |
| 330 | |
| 331 | /* user gate pages are read-only */ |
| 332 | if (gup_flags & FOLL_WRITE) |
| 333 | return -EFAULT; |
| 334 | if (address > TASK_SIZE) |
| 335 | pgd = pgd_offset_k(address); |
| 336 | else |
| 337 | pgd = pgd_offset_gate(mm, address); |
| 338 | BUG_ON(pgd_none(*pgd)); |
| 339 | pud = pud_offset(pgd, address); |
| 340 | BUG_ON(pud_none(*pud)); |
| 341 | pmd = pmd_offset(pud, address); |
| 342 | if (pmd_none(*pmd)) |
| 343 | return -EFAULT; |
| 344 | VM_BUG_ON(pmd_trans_huge(*pmd)); |
| 345 | pte = pte_offset_map(pmd, address); |
| 346 | if (pte_none(*pte)) |
| 347 | goto unmap; |
| 348 | *vma = get_gate_vma(mm); |
| 349 | if (!page) |
| 350 | goto out; |
| 351 | *page = vm_normal_page(*vma, address, *pte); |
| 352 | if (!*page) { |
| 353 | if ((gup_flags & FOLL_DUMP) || !is_zero_pfn(pte_pfn(*pte))) |
| 354 | goto unmap; |
| 355 | *page = pte_page(*pte); |
| 356 | } |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 357 | if (unlikely(!try_get_page(*page))) { |
| 358 | ret = -ENOMEM; |
| 359 | goto unmap; |
| 360 | } |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 361 | out: |
| 362 | ret = 0; |
| 363 | unmap: |
| 364 | pte_unmap(pte); |
| 365 | return ret; |
| 366 | } |
| 367 | |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 368 | /* |
| 369 | * mmap_sem must be held on entry. If @nonblocking != NULL and |
| 370 | * *@flags does not include FOLL_NOWAIT, the mmap_sem may be released. |
| 371 | * If it is, *@nonblocking will be set to 0 and -EBUSY returned. |
| 372 | */ |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 373 | static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, |
| 374 | unsigned long address, unsigned int *flags, int *nonblocking) |
| 375 | { |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 376 | unsigned int fault_flags = 0; |
| 377 | int ret; |
| 378 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 379 | /* mlock all present pages, but do not fault in new pages */ |
| 380 | if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK) |
| 381 | return -ENOENT; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 382 | if (*flags & FOLL_WRITE) |
| 383 | fault_flags |= FAULT_FLAG_WRITE; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 384 | if (*flags & FOLL_REMOTE) |
| 385 | fault_flags |= FAULT_FLAG_REMOTE; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 386 | if (nonblocking) |
| 387 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 388 | if (*flags & FOLL_NOWAIT) |
| 389 | fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT; |
Andres Lagar-Cavilla | 234b239 | 2014-09-17 10:51:48 -0700 | [diff] [blame] | 390 | if (*flags & FOLL_TRIED) { |
| 391 | VM_WARN_ON_ONCE(fault_flags & FAULT_FLAG_ALLOW_RETRY); |
| 392 | fault_flags |= FAULT_FLAG_TRIED; |
| 393 | } |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 394 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 395 | ret = handle_mm_fault(vma, address, fault_flags); |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 396 | if (ret & VM_FAULT_ERROR) { |
| 397 | if (ret & VM_FAULT_OOM) |
| 398 | return -ENOMEM; |
| 399 | if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) |
| 400 | return *flags & FOLL_HWPOISON ? -EHWPOISON : -EFAULT; |
Linus Torvalds | 33692f2 | 2015-01-29 10:51:32 -0800 | [diff] [blame] | 401 | if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 402 | return -EFAULT; |
| 403 | BUG(); |
| 404 | } |
| 405 | |
| 406 | if (tsk) { |
| 407 | if (ret & VM_FAULT_MAJOR) |
| 408 | tsk->maj_flt++; |
| 409 | else |
| 410 | tsk->min_flt++; |
| 411 | } |
| 412 | |
| 413 | if (ret & VM_FAULT_RETRY) { |
| 414 | if (nonblocking) |
| 415 | *nonblocking = 0; |
| 416 | return -EBUSY; |
| 417 | } |
| 418 | |
| 419 | /* |
| 420 | * The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when |
| 421 | * necessary, even if maybe_mkwrite decided not to set pte_write. We |
| 422 | * can thus safely do subsequent page lookups as if they were reads. |
| 423 | * But only do so when looping for pte_write is futile: in some cases |
| 424 | * userspace may also be wanting to write to the gotten user page, |
| 425 | * which a read fault here might prevent (a readonly page might get |
| 426 | * reCOWed by userspace write). |
| 427 | */ |
| 428 | if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE)) |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 429 | *flags |= FOLL_COW; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 430 | return 0; |
| 431 | } |
| 432 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 433 | static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) |
| 434 | { |
| 435 | vm_flags_t vm_flags = vma->vm_flags; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 436 | int write = (gup_flags & FOLL_WRITE); |
| 437 | int foreign = (gup_flags & FOLL_REMOTE); |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 438 | |
| 439 | if (vm_flags & (VM_IO | VM_PFNMAP)) |
| 440 | return -EFAULT; |
| 441 | |
Willy Tarreau | 6f1abf8 | 2018-05-11 08:11:44 +0200 | [diff] [blame] | 442 | if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) |
| 443 | return -EFAULT; |
| 444 | |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 445 | if (write) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 446 | if (!(vm_flags & VM_WRITE)) { |
| 447 | if (!(gup_flags & FOLL_FORCE)) |
| 448 | return -EFAULT; |
| 449 | /* |
| 450 | * We used to let the write,force case do COW in a |
| 451 | * VM_MAYWRITE VM_SHARED !VM_WRITE vma, so ptrace could |
| 452 | * set a breakpoint in a read-only mapping of an |
| 453 | * executable, without corrupting the file (yet only |
| 454 | * when that file had been opened for writing!). |
| 455 | * Anon pages in shared mappings are surprising: now |
| 456 | * just reject it. |
| 457 | */ |
Hugh Dickins | 4643536 | 2016-01-30 18:03:16 -0800 | [diff] [blame] | 458 | if (!is_cow_mapping(vm_flags)) |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 459 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 460 | } |
| 461 | } else if (!(vm_flags & VM_READ)) { |
| 462 | if (!(gup_flags & FOLL_FORCE)) |
| 463 | return -EFAULT; |
| 464 | /* |
| 465 | * Is there actually any vma we can reach here which does not |
| 466 | * have VM_MAYREAD set? |
| 467 | */ |
| 468 | if (!(vm_flags & VM_MAYREAD)) |
| 469 | return -EFAULT; |
| 470 | } |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 471 | /* |
| 472 | * gups are always data accesses, not instruction |
| 473 | * fetches, so execute=false here |
| 474 | */ |
| 475 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 476 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 477 | return 0; |
| 478 | } |
| 479 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 480 | /** |
| 481 | * __get_user_pages() - pin user pages in memory |
| 482 | * @tsk: task_struct of target task |
| 483 | * @mm: mm_struct of target mm |
| 484 | * @start: starting user address |
| 485 | * @nr_pages: number of pages from start to pin |
| 486 | * @gup_flags: flags modifying pin behaviour |
| 487 | * @pages: array that receives pointers to the pages pinned. |
| 488 | * Should be at least nr_pages long. Or NULL, if caller |
| 489 | * only intends to ensure the pages are faulted in. |
| 490 | * @vmas: array of pointers to vmas corresponding to each page. |
| 491 | * Or NULL if the caller does not require them. |
| 492 | * @nonblocking: whether waiting for disk IO or mmap_sem contention |
| 493 | * |
| 494 | * Returns number of pages pinned. This may be fewer than the number |
| 495 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 496 | * were pinned, returns -errno. Each page returned must be released |
| 497 | * with a put_page() call when it is finished with. vmas will only |
| 498 | * remain valid while mmap_sem is held. |
| 499 | * |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 500 | * Must be called with mmap_sem held. It may be released. See below. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 501 | * |
| 502 | * __get_user_pages walks a process's page tables and takes a reference to |
| 503 | * each struct page that each user address corresponds to at a given |
| 504 | * instant. That is, it takes the page that would be accessed if a user |
| 505 | * thread accesses the given user virtual address at that instant. |
| 506 | * |
| 507 | * This does not guarantee that the page exists in the user mappings when |
| 508 | * __get_user_pages returns, and there may even be a completely different |
| 509 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 510 | * and subsequently re faulted). However it does guarantee that the page |
| 511 | * won't be freed completely. And mostly callers simply care that the page |
| 512 | * contains data that was valid *at some point in time*. Typically, an IO |
| 513 | * or similar operation cannot guarantee anything stronger anyway because |
| 514 | * locks can't be held over the syscall boundary. |
| 515 | * |
| 516 | * If @gup_flags & FOLL_WRITE == 0, the page must not be written to. If |
| 517 | * the page is written to, set_page_dirty (or set_page_dirty_lock, as |
| 518 | * appropriate) must be called after the page is finished with, and |
| 519 | * before put_page is called. |
| 520 | * |
| 521 | * If @nonblocking != NULL, __get_user_pages will not wait for disk IO |
| 522 | * or mmap_sem contention, and if waiting is needed to pin all pages, |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 523 | * *@nonblocking will be set to 0. Further, if @gup_flags does not |
| 524 | * include FOLL_NOWAIT, the mmap_sem will be released via up_read() in |
| 525 | * this case. |
| 526 | * |
| 527 | * A caller using such a combination of @nonblocking and @gup_flags |
| 528 | * must therefore hold the mmap_sem for reading only, and recognize |
| 529 | * when it's been released. Otherwise, it must be held for either |
| 530 | * reading or writing and will not be released. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 531 | * |
| 532 | * In most cases, get_user_pages or get_user_pages_fast should be used |
| 533 | * instead of __get_user_pages. __get_user_pages should be used only if |
| 534 | * you need some special @gup_flags. |
| 535 | */ |
Lorenzo Stoakes | 0d73175 | 2016-10-24 10:57:25 +0100 | [diff] [blame] | 536 | static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 537 | unsigned long start, unsigned long nr_pages, |
| 538 | unsigned int gup_flags, struct page **pages, |
| 539 | struct vm_area_struct **vmas, int *nonblocking) |
| 540 | { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 541 | long i = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 542 | unsigned int page_mask; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 543 | struct vm_area_struct *vma = NULL; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 544 | |
| 545 | if (!nr_pages) |
| 546 | return 0; |
| 547 | |
| 548 | VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET)); |
| 549 | |
| 550 | /* |
| 551 | * If FOLL_FORCE is set then do not force a full fault as the hinting |
| 552 | * fault information is unrelated to the reference behaviour of a task |
| 553 | * using the address space |
| 554 | */ |
| 555 | if (!(gup_flags & FOLL_FORCE)) |
| 556 | gup_flags |= FOLL_NUMA; |
| 557 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 558 | do { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 559 | struct page *page; |
| 560 | unsigned int foll_flags = gup_flags; |
| 561 | unsigned int page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 562 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 563 | /* first iteration or cross vma bound */ |
| 564 | if (!vma || start >= vma->vm_end) { |
| 565 | vma = find_extend_vma(mm, start); |
| 566 | if (!vma && in_gate_area(mm, start)) { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 567 | int ret; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 568 | ret = get_gate_page(mm, start & PAGE_MASK, |
| 569 | gup_flags, &vma, |
| 570 | pages ? &pages[i] : NULL); |
| 571 | if (ret) |
| 572 | return i ? : ret; |
| 573 | page_mask = 0; |
| 574 | goto next_page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 575 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 576 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 577 | if (!vma || check_vma_flags(vma, gup_flags)) |
| 578 | return i ? : -EFAULT; |
| 579 | if (is_vm_hugetlb_page(vma)) { |
| 580 | i = follow_hugetlb_page(mm, vma, pages, vmas, |
| 581 | &start, &nr_pages, i, |
| 582 | gup_flags); |
| 583 | continue; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 584 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 585 | } |
| 586 | retry: |
| 587 | /* |
| 588 | * If we have a pending SIGKILL, don't keep faulting pages and |
| 589 | * potentially allocating memory. |
| 590 | */ |
| 591 | if (unlikely(fatal_signal_pending(current))) |
| 592 | return i ? i : -ERESTARTSYS; |
| 593 | cond_resched(); |
| 594 | page = follow_page_mask(vma, start, foll_flags, &page_mask); |
| 595 | if (!page) { |
| 596 | int ret; |
| 597 | ret = faultin_page(tsk, vma, start, &foll_flags, |
| 598 | nonblocking); |
| 599 | switch (ret) { |
| 600 | case 0: |
| 601 | goto retry; |
| 602 | case -EFAULT: |
| 603 | case -ENOMEM: |
| 604 | case -EHWPOISON: |
| 605 | return i ? i : ret; |
| 606 | case -EBUSY: |
| 607 | return i; |
| 608 | case -ENOENT: |
| 609 | goto next_page; |
| 610 | } |
| 611 | BUG(); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 612 | } else if (PTR_ERR(page) == -EEXIST) { |
| 613 | /* |
| 614 | * Proper page table entry exists, but no corresponding |
| 615 | * struct page. |
| 616 | */ |
| 617 | goto next_page; |
| 618 | } else if (IS_ERR(page)) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 619 | return i ? i : PTR_ERR(page); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 620 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 621 | if (pages) { |
| 622 | pages[i] = page; |
| 623 | flush_anon_page(vma, page, start); |
| 624 | flush_dcache_page(page); |
| 625 | page_mask = 0; |
| 626 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 627 | next_page: |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 628 | if (vmas) { |
| 629 | vmas[i] = vma; |
| 630 | page_mask = 0; |
| 631 | } |
| 632 | page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask); |
| 633 | if (page_increm > nr_pages) |
| 634 | page_increm = nr_pages; |
| 635 | i += page_increm; |
| 636 | start += page_increm * PAGE_SIZE; |
| 637 | nr_pages -= page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 638 | } while (nr_pages); |
| 639 | return i; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 640 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 641 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 642 | bool vma_permits_fault(struct vm_area_struct *vma, unsigned int fault_flags) |
| 643 | { |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 644 | bool write = !!(fault_flags & FAULT_FLAG_WRITE); |
| 645 | bool foreign = !!(fault_flags & FAULT_FLAG_REMOTE); |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 646 | vm_flags_t vm_flags = write ? VM_WRITE : VM_READ; |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 647 | |
| 648 | if (!(vm_flags & vma->vm_flags)) |
| 649 | return false; |
| 650 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 651 | /* |
| 652 | * The architecture might have a hardware protection |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 653 | * mechanism other than read/write that can deny access. |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 654 | * |
| 655 | * gup always represents data access, not instruction |
| 656 | * fetches, so execute=false here: |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 657 | */ |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 658 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 659 | return false; |
| 660 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 661 | return true; |
| 662 | } |
| 663 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 664 | /* |
| 665 | * fixup_user_fault() - manually resolve a user page fault |
| 666 | * @tsk: the task_struct to use for page fault accounting, or |
| 667 | * NULL if faults are not to be recorded. |
| 668 | * @mm: mm_struct of target mm |
| 669 | * @address: user address |
| 670 | * @fault_flags:flags to pass down to handle_mm_fault() |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 671 | * @unlocked: did we unlock the mmap_sem while retrying, maybe NULL if caller |
| 672 | * does not allow retry |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 673 | * |
| 674 | * This is meant to be called in the specific scenario where for locking reasons |
| 675 | * we try to access user memory in atomic context (within a pagefault_disable() |
| 676 | * section), this returns -EFAULT, and we want to resolve the user fault before |
| 677 | * trying again. |
| 678 | * |
| 679 | * Typically this is meant to be used by the futex code. |
| 680 | * |
| 681 | * The main difference with get_user_pages() is that this function will |
| 682 | * unconditionally call handle_mm_fault() which will in turn perform all the |
| 683 | * necessary SW fixup of the dirty and young bits in the PTE, while |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 684 | * get_user_pages() only guarantees to update these in the struct page. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 685 | * |
| 686 | * This is important for some architectures where those bits also gate the |
| 687 | * access permission to the page because they are maintained in software. On |
| 688 | * such architectures, gup() will not be enough to make a subsequent access |
| 689 | * succeed. |
| 690 | * |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 691 | * This function will not return with an unlocked mmap_sem. So it has not the |
| 692 | * same semantics wrt the @mm->mmap_sem as does filemap_fault(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 693 | */ |
| 694 | int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 695 | unsigned long address, unsigned int fault_flags, |
| 696 | bool *unlocked) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 697 | { |
| 698 | struct vm_area_struct *vma; |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 699 | int ret, major = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 700 | |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 701 | if (unlocked) |
| 702 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 703 | |
| 704 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 705 | vma = find_extend_vma(mm, address); |
| 706 | if (!vma || address < vma->vm_start) |
| 707 | return -EFAULT; |
| 708 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 709 | if (!vma_permits_fault(vma, fault_flags)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 710 | return -EFAULT; |
| 711 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 712 | ret = handle_mm_fault(vma, address, fault_flags); |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 713 | major |= ret & VM_FAULT_MAJOR; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 714 | if (ret & VM_FAULT_ERROR) { |
| 715 | if (ret & VM_FAULT_OOM) |
| 716 | return -ENOMEM; |
| 717 | if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)) |
| 718 | return -EHWPOISON; |
Linus Torvalds | 33692f2 | 2015-01-29 10:51:32 -0800 | [diff] [blame] | 719 | if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 720 | return -EFAULT; |
| 721 | BUG(); |
| 722 | } |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 723 | |
| 724 | if (ret & VM_FAULT_RETRY) { |
| 725 | down_read(&mm->mmap_sem); |
| 726 | if (!(fault_flags & FAULT_FLAG_TRIED)) { |
| 727 | *unlocked = true; |
| 728 | fault_flags &= ~FAULT_FLAG_ALLOW_RETRY; |
| 729 | fault_flags |= FAULT_FLAG_TRIED; |
| 730 | goto retry; |
| 731 | } |
| 732 | } |
| 733 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 734 | if (tsk) { |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 735 | if (major) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 736 | tsk->maj_flt++; |
| 737 | else |
| 738 | tsk->min_flt++; |
| 739 | } |
| 740 | return 0; |
| 741 | } |
Paolo Bonzini | add6a0c | 2016-06-07 17:51:18 +0200 | [diff] [blame] | 742 | EXPORT_SYMBOL_GPL(fixup_user_fault); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 743 | |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 744 | static __always_inline long __get_user_pages_locked(struct task_struct *tsk, |
| 745 | struct mm_struct *mm, |
| 746 | unsigned long start, |
| 747 | unsigned long nr_pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 748 | struct page **pages, |
| 749 | struct vm_area_struct **vmas, |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 750 | int *locked, bool notify_drop, |
| 751 | unsigned int flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 752 | { |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 753 | long ret, pages_done; |
| 754 | bool lock_dropped; |
| 755 | |
| 756 | if (locked) { |
| 757 | /* if VM_FAULT_RETRY can be returned, vmas become invalid */ |
| 758 | BUG_ON(vmas); |
| 759 | /* check caller initialized locked */ |
| 760 | BUG_ON(*locked != 1); |
| 761 | } |
| 762 | |
| 763 | if (pages) |
| 764 | flags |= FOLL_GET; |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 765 | |
| 766 | pages_done = 0; |
| 767 | lock_dropped = false; |
| 768 | for (;;) { |
| 769 | ret = __get_user_pages(tsk, mm, start, nr_pages, flags, pages, |
| 770 | vmas, locked); |
| 771 | if (!locked) |
| 772 | /* VM_FAULT_RETRY couldn't trigger, bypass */ |
| 773 | return ret; |
| 774 | |
| 775 | /* VM_FAULT_RETRY cannot return errors */ |
| 776 | if (!*locked) { |
| 777 | BUG_ON(ret < 0); |
| 778 | BUG_ON(ret >= nr_pages); |
| 779 | } |
| 780 | |
| 781 | if (!pages) |
| 782 | /* If it's a prefault don't insist harder */ |
| 783 | return ret; |
| 784 | |
| 785 | if (ret > 0) { |
| 786 | nr_pages -= ret; |
| 787 | pages_done += ret; |
| 788 | if (!nr_pages) |
| 789 | break; |
| 790 | } |
| 791 | if (*locked) { |
| 792 | /* VM_FAULT_RETRY didn't trigger */ |
| 793 | if (!pages_done) |
| 794 | pages_done = ret; |
| 795 | break; |
| 796 | } |
| 797 | /* VM_FAULT_RETRY triggered, so seek to the faulting offset */ |
| 798 | pages += ret; |
| 799 | start += ret << PAGE_SHIFT; |
| 800 | |
| 801 | /* |
| 802 | * Repeat on the address that fired VM_FAULT_RETRY |
| 803 | * without FAULT_FLAG_ALLOW_RETRY but with |
| 804 | * FAULT_FLAG_TRIED. |
| 805 | */ |
| 806 | *locked = 1; |
| 807 | lock_dropped = true; |
| 808 | down_read(&mm->mmap_sem); |
| 809 | ret = __get_user_pages(tsk, mm, start, 1, flags | FOLL_TRIED, |
| 810 | pages, NULL, NULL); |
| 811 | if (ret != 1) { |
| 812 | BUG_ON(ret > 1); |
| 813 | if (!pages_done) |
| 814 | pages_done = ret; |
| 815 | break; |
| 816 | } |
| 817 | nr_pages--; |
| 818 | pages_done++; |
| 819 | if (!nr_pages) |
| 820 | break; |
| 821 | pages++; |
| 822 | start += PAGE_SIZE; |
| 823 | } |
| 824 | if (notify_drop && lock_dropped && *locked) { |
| 825 | /* |
| 826 | * We must let the caller know we temporarily dropped the lock |
| 827 | * and so the critical section protected by it was lost. |
| 828 | */ |
| 829 | up_read(&mm->mmap_sem); |
| 830 | *locked = 0; |
| 831 | } |
| 832 | return pages_done; |
| 833 | } |
| 834 | |
| 835 | /* |
| 836 | * We can leverage the VM_FAULT_RETRY functionality in the page fault |
| 837 | * paths better by using either get_user_pages_locked() or |
| 838 | * get_user_pages_unlocked(). |
| 839 | * |
| 840 | * get_user_pages_locked() is suitable to replace the form: |
| 841 | * |
| 842 | * down_read(&mm->mmap_sem); |
| 843 | * do_something() |
| 844 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 845 | * up_read(&mm->mmap_sem); |
| 846 | * |
| 847 | * to: |
| 848 | * |
| 849 | * int locked = 1; |
| 850 | * down_read(&mm->mmap_sem); |
| 851 | * do_something() |
| 852 | * get_user_pages_locked(tsk, mm, ..., pages, &locked); |
| 853 | * if (locked) |
| 854 | * up_read(&mm->mmap_sem); |
| 855 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 856 | long get_user_pages_locked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 857 | unsigned int gup_flags, struct page **pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 858 | int *locked) |
| 859 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 860 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 861 | pages, NULL, locked, true, |
| 862 | gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 863 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 864 | EXPORT_SYMBOL(get_user_pages_locked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 865 | |
| 866 | /* |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 867 | * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows to |
| 868 | * pass additional gup_flags as last parameter (like FOLL_HWPOISON). |
| 869 | * |
| 870 | * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the |
| 871 | * caller if required (just like with __get_user_pages). "FOLL_GET", |
| 872 | * "FOLL_WRITE" and "FOLL_FORCE" are set implicitly as needed |
| 873 | * according to the parameters "pages", "write", "force" |
| 874 | * respectively. |
| 875 | */ |
| 876 | __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, struct mm_struct *mm, |
| 877 | unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | d4944b0 | 2016-10-13 01:20:12 +0100 | [diff] [blame] | 878 | struct page **pages, unsigned int gup_flags) |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 879 | { |
| 880 | long ret; |
| 881 | int locked = 1; |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 882 | |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 883 | down_read(&mm->mmap_sem); |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 884 | ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, |
| 885 | &locked, false, gup_flags); |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 886 | if (locked) |
| 887 | up_read(&mm->mmap_sem); |
| 888 | return ret; |
| 889 | } |
| 890 | EXPORT_SYMBOL(__get_user_pages_unlocked); |
| 891 | |
| 892 | /* |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 893 | * get_user_pages_unlocked() is suitable to replace the form: |
| 894 | * |
| 895 | * down_read(&mm->mmap_sem); |
| 896 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 897 | * up_read(&mm->mmap_sem); |
| 898 | * |
| 899 | * with: |
| 900 | * |
| 901 | * get_user_pages_unlocked(tsk, mm, ..., pages); |
| 902 | * |
| 903 | * It is functionally equivalent to get_user_pages_fast so |
| 904 | * get_user_pages_fast should be used instead, if the two parameters |
| 905 | * "tsk" and "mm" are respectively equal to current and current->mm, |
| 906 | * or if "force" shall be set to 1 (get_user_pages_fast misses the |
| 907 | * "force" parameter). |
| 908 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 909 | long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 910 | struct page **pages, unsigned int gup_flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 911 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 912 | return __get_user_pages_unlocked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 913 | pages, gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 914 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 915 | EXPORT_SYMBOL(get_user_pages_unlocked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 916 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 917 | /* |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 918 | * get_user_pages_remote() - pin user pages in memory |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 919 | * @tsk: the task_struct to use for page fault accounting, or |
| 920 | * NULL if faults are not to be recorded. |
| 921 | * @mm: mm_struct of target mm |
| 922 | * @start: starting user address |
| 923 | * @nr_pages: number of pages from start to pin |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 924 | * @gup_flags: flags modifying lookup behaviour |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 925 | * @pages: array that receives pointers to the pages pinned. |
| 926 | * Should be at least nr_pages long. Or NULL, if caller |
| 927 | * only intends to ensure the pages are faulted in. |
| 928 | * @vmas: array of pointers to vmas corresponding to each page. |
| 929 | * Or NULL if the caller does not require them. |
| 930 | * |
| 931 | * Returns number of pages pinned. This may be fewer than the number |
| 932 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 933 | * were pinned, returns -errno. Each page returned must be released |
| 934 | * with a put_page() call when it is finished with. vmas will only |
| 935 | * remain valid while mmap_sem is held. |
| 936 | * |
| 937 | * Must be called with mmap_sem held for read or write. |
| 938 | * |
| 939 | * get_user_pages walks a process's page tables and takes a reference to |
| 940 | * each struct page that each user address corresponds to at a given |
| 941 | * instant. That is, it takes the page that would be accessed if a user |
| 942 | * thread accesses the given user virtual address at that instant. |
| 943 | * |
| 944 | * This does not guarantee that the page exists in the user mappings when |
| 945 | * get_user_pages returns, and there may even be a completely different |
| 946 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 947 | * and subsequently re faulted). However it does guarantee that the page |
| 948 | * won't be freed completely. And mostly callers simply care that the page |
| 949 | * contains data that was valid *at some point in time*. Typically, an IO |
| 950 | * or similar operation cannot guarantee anything stronger anyway because |
| 951 | * locks can't be held over the syscall boundary. |
| 952 | * |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 953 | * If gup_flags & FOLL_WRITE == 0, the page must not be written to. If the page |
| 954 | * is written to, set_page_dirty (or set_page_dirty_lock, as appropriate) must |
| 955 | * be called after the page is finished with, and before put_page is called. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 956 | * |
| 957 | * get_user_pages is typically used for fewer-copy IO operations, to get a |
| 958 | * handle on the memory by some means other than accesses via the user virtual |
| 959 | * addresses. The pages may be submitted for DMA to devices or accessed via |
| 960 | * their kernel linear mapping (via the kmap APIs). Care should be taken to |
| 961 | * use the correct cache flushing APIs. |
| 962 | * |
| 963 | * See also get_user_pages_fast, for performance critical applications. |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 964 | * |
| 965 | * get_user_pages should be phased out in favor of |
| 966 | * get_user_pages_locked|unlocked or get_user_pages_fast. Nothing |
| 967 | * should use get_user_pages because it cannot pass |
| 968 | * FAULT_FLAG_ALLOW_RETRY to handle_mm_fault. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 969 | */ |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 970 | long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm, |
| 971 | unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 972 | unsigned int gup_flags, struct page **pages, |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 973 | struct vm_area_struct **vmas) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 974 | { |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 975 | return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 976 | NULL, false, |
| 977 | gup_flags | FOLL_TOUCH | FOLL_REMOTE); |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 978 | } |
| 979 | EXPORT_SYMBOL(get_user_pages_remote); |
| 980 | |
| 981 | /* |
Dave Hansen | d4edcf0 | 2016-02-12 13:01:56 -0800 | [diff] [blame] | 982 | * This is the same as get_user_pages_remote(), just with a |
| 983 | * less-flexible calling convention where we assume that the task |
| 984 | * and mm being operated on are the current task's. We also |
| 985 | * obviously don't pass FOLL_REMOTE in here. |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 986 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 987 | long get_user_pages(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 988 | unsigned int gup_flags, struct page **pages, |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 989 | struct vm_area_struct **vmas) |
| 990 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 991 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 992 | pages, vmas, NULL, false, |
| 993 | gup_flags | FOLL_TOUCH); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 994 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 995 | EXPORT_SYMBOL(get_user_pages); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 996 | |
Dan Williams | b29ea3c | 2018-02-23 14:05:49 -0800 | [diff] [blame] | 997 | #ifdef CONFIG_FS_DAX |
| 998 | /* |
| 999 | * This is the same as get_user_pages() in that it assumes we are |
| 1000 | * operating on the current task's mm, but it goes further to validate |
| 1001 | * that the vmas associated with the address range are suitable for |
| 1002 | * longterm elevated page reference counts. For example, filesystem-dax |
| 1003 | * mappings are subject to the lifetime enforced by the filesystem and |
| 1004 | * we need guarantees that longterm users like RDMA and V4L2 only |
| 1005 | * establish mappings that have a kernel enforced revocation mechanism. |
| 1006 | * |
| 1007 | * "longterm" == userspace controlled elevated page count lifetime. |
| 1008 | * Contrast this to iov_iter_get_pages() usages which are transient. |
| 1009 | */ |
| 1010 | long get_user_pages_longterm(unsigned long start, unsigned long nr_pages, |
| 1011 | unsigned int gup_flags, struct page **pages, |
| 1012 | struct vm_area_struct **vmas_arg) |
| 1013 | { |
| 1014 | struct vm_area_struct **vmas = vmas_arg; |
| 1015 | struct vm_area_struct *vma_prev = NULL; |
| 1016 | long rc, i; |
| 1017 | |
| 1018 | if (!pages) |
| 1019 | return -EINVAL; |
| 1020 | |
| 1021 | if (!vmas) { |
| 1022 | vmas = kcalloc(nr_pages, sizeof(struct vm_area_struct *), |
| 1023 | GFP_KERNEL); |
| 1024 | if (!vmas) |
| 1025 | return -ENOMEM; |
| 1026 | } |
| 1027 | |
| 1028 | rc = get_user_pages(start, nr_pages, gup_flags, pages, vmas); |
| 1029 | |
| 1030 | for (i = 0; i < rc; i++) { |
| 1031 | struct vm_area_struct *vma = vmas[i]; |
| 1032 | |
| 1033 | if (vma == vma_prev) |
| 1034 | continue; |
| 1035 | |
| 1036 | vma_prev = vma; |
| 1037 | |
| 1038 | if (vma_is_fsdax(vma)) |
| 1039 | break; |
| 1040 | } |
| 1041 | |
| 1042 | /* |
| 1043 | * Either get_user_pages() failed, or the vma validation |
| 1044 | * succeeded, in either case we don't need to put_page() before |
| 1045 | * returning. |
| 1046 | */ |
| 1047 | if (i >= rc) |
| 1048 | goto out; |
| 1049 | |
| 1050 | for (i = 0; i < rc; i++) |
| 1051 | put_page(pages[i]); |
| 1052 | rc = -EOPNOTSUPP; |
| 1053 | out: |
| 1054 | if (vmas != vmas_arg) |
| 1055 | kfree(vmas); |
| 1056 | return rc; |
| 1057 | } |
| 1058 | EXPORT_SYMBOL(get_user_pages_longterm); |
| 1059 | #endif /* CONFIG_FS_DAX */ |
| 1060 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1061 | /** |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1062 | * populate_vma_page_range() - populate a range of pages in the vma. |
| 1063 | * @vma: target vma |
| 1064 | * @start: start address |
| 1065 | * @end: end address |
| 1066 | * @nonblocking: |
| 1067 | * |
| 1068 | * This takes care of mlocking the pages too if VM_LOCKED is set. |
| 1069 | * |
| 1070 | * return 0 on success, negative error code on error. |
| 1071 | * |
| 1072 | * vma->vm_mm->mmap_sem must be held. |
| 1073 | * |
| 1074 | * If @nonblocking is NULL, it may be held for read or write and will |
| 1075 | * be unperturbed. |
| 1076 | * |
| 1077 | * If @nonblocking is non-NULL, it must held for read only and may be |
| 1078 | * released. If it's released, *@nonblocking will be set to 0. |
| 1079 | */ |
| 1080 | long populate_vma_page_range(struct vm_area_struct *vma, |
| 1081 | unsigned long start, unsigned long end, int *nonblocking) |
| 1082 | { |
| 1083 | struct mm_struct *mm = vma->vm_mm; |
| 1084 | unsigned long nr_pages = (end - start) / PAGE_SIZE; |
| 1085 | int gup_flags; |
| 1086 | |
| 1087 | VM_BUG_ON(start & ~PAGE_MASK); |
| 1088 | VM_BUG_ON(end & ~PAGE_MASK); |
| 1089 | VM_BUG_ON_VMA(start < vma->vm_start, vma); |
| 1090 | VM_BUG_ON_VMA(end > vma->vm_end, vma); |
| 1091 | VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_sem), mm); |
| 1092 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 1093 | gup_flags = FOLL_TOUCH | FOLL_POPULATE | FOLL_MLOCK; |
| 1094 | if (vma->vm_flags & VM_LOCKONFAULT) |
| 1095 | gup_flags &= ~FOLL_POPULATE; |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1096 | /* |
| 1097 | * We want to touch writable mappings with a write fault in order |
| 1098 | * to break COW, except for shared mappings because these don't COW |
| 1099 | * and we would not want to dirty them for nothing. |
| 1100 | */ |
| 1101 | if ((vma->vm_flags & (VM_WRITE | VM_SHARED)) == VM_WRITE) |
| 1102 | gup_flags |= FOLL_WRITE; |
| 1103 | |
| 1104 | /* |
| 1105 | * We want mlock to succeed for regions that have any permissions |
| 1106 | * other than PROT_NONE. |
| 1107 | */ |
| 1108 | if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) |
| 1109 | gup_flags |= FOLL_FORCE; |
| 1110 | |
| 1111 | /* |
| 1112 | * We made sure addr is within a VMA, so the following will |
| 1113 | * not result in a stack expansion that recurses back here. |
| 1114 | */ |
| 1115 | return __get_user_pages(current, mm, start, nr_pages, gup_flags, |
| 1116 | NULL, NULL, nonblocking); |
| 1117 | } |
| 1118 | |
| 1119 | /* |
| 1120 | * __mm_populate - populate and/or mlock pages within a range of address space. |
| 1121 | * |
| 1122 | * This is used to implement mlock() and the MAP_POPULATE / MAP_LOCKED mmap |
| 1123 | * flags. VMAs must be already marked with the desired vm_flags, and |
| 1124 | * mmap_sem must not be held. |
| 1125 | */ |
| 1126 | int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) |
| 1127 | { |
| 1128 | struct mm_struct *mm = current->mm; |
| 1129 | unsigned long end, nstart, nend; |
| 1130 | struct vm_area_struct *vma = NULL; |
| 1131 | int locked = 0; |
| 1132 | long ret = 0; |
| 1133 | |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1134 | end = start + len; |
| 1135 | |
| 1136 | for (nstart = start; nstart < end; nstart = nend) { |
| 1137 | /* |
| 1138 | * We want to fault in pages for [nstart; end) address range. |
| 1139 | * Find first corresponding VMA. |
| 1140 | */ |
| 1141 | if (!locked) { |
| 1142 | locked = 1; |
| 1143 | down_read(&mm->mmap_sem); |
| 1144 | vma = find_vma(mm, nstart); |
| 1145 | } else if (nstart >= vma->vm_end) |
| 1146 | vma = vma->vm_next; |
| 1147 | if (!vma || vma->vm_start >= end) |
| 1148 | break; |
| 1149 | /* |
| 1150 | * Set [nstart; nend) to intersection of desired address |
| 1151 | * range with the first VMA. Also, skip undesirable VMA types. |
| 1152 | */ |
| 1153 | nend = min(end, vma->vm_end); |
| 1154 | if (vma->vm_flags & (VM_IO | VM_PFNMAP)) |
| 1155 | continue; |
| 1156 | if (nstart < vma->vm_start) |
| 1157 | nstart = vma->vm_start; |
| 1158 | /* |
| 1159 | * Now fault in a range of pages. populate_vma_page_range() |
| 1160 | * double checks the vma flags, so that it won't mlock pages |
| 1161 | * if the vma was already munlocked. |
| 1162 | */ |
| 1163 | ret = populate_vma_page_range(vma, nstart, nend, &locked); |
| 1164 | if (ret < 0) { |
| 1165 | if (ignore_errors) { |
| 1166 | ret = 0; |
| 1167 | continue; /* continue at next VMA */ |
| 1168 | } |
| 1169 | break; |
| 1170 | } |
| 1171 | nend = nstart + ret * PAGE_SIZE; |
| 1172 | ret = 0; |
| 1173 | } |
| 1174 | if (locked) |
| 1175 | up_read(&mm->mmap_sem); |
| 1176 | return ret; /* 0 or negative error code */ |
| 1177 | } |
| 1178 | |
| 1179 | /** |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1180 | * get_dump_page() - pin user page in memory while writing it to core dump |
| 1181 | * @addr: user address |
| 1182 | * |
| 1183 | * Returns struct page pointer of user page pinned for dump, |
Kirill A. Shutemov | ea1754a | 2016-04-01 15:29:48 +0300 | [diff] [blame] | 1184 | * to be freed afterwards by put_page(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1185 | * |
| 1186 | * Returns NULL on any kind of failure - a hole must then be inserted into |
| 1187 | * the corefile, to preserve alignment with its headers; and also returns |
| 1188 | * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - |
| 1189 | * allowing a hole to be left in the corefile to save diskspace. |
| 1190 | * |
| 1191 | * Called without mmap_sem, but after all other threads have been killed. |
| 1192 | */ |
| 1193 | #ifdef CONFIG_ELF_CORE |
| 1194 | struct page *get_dump_page(unsigned long addr) |
| 1195 | { |
| 1196 | struct vm_area_struct *vma; |
| 1197 | struct page *page; |
| 1198 | |
| 1199 | if (__get_user_pages(current, current->mm, addr, 1, |
| 1200 | FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma, |
| 1201 | NULL) < 1) |
| 1202 | return NULL; |
| 1203 | flush_cache_page(vma, addr, page_to_pfn(page)); |
| 1204 | return page; |
| 1205 | } |
| 1206 | #endif /* CONFIG_ELF_CORE */ |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1207 | |
| 1208 | /* |
| 1209 | * Generic RCU Fast GUP |
| 1210 | * |
| 1211 | * get_user_pages_fast attempts to pin user pages by walking the page |
| 1212 | * tables directly and avoids taking locks. Thus the walker needs to be |
| 1213 | * protected from page table pages being freed from under it, and should |
| 1214 | * block any THP splits. |
| 1215 | * |
| 1216 | * One way to achieve this is to have the walker disable interrupts, and |
| 1217 | * rely on IPIs from the TLB flushing code blocking before the page table |
| 1218 | * pages are freed. This is unsuitable for architectures that do not need |
| 1219 | * to broadcast an IPI when invalidating TLBs. |
| 1220 | * |
| 1221 | * Another way to achieve this is to batch up page table containing pages |
| 1222 | * belonging to more than one mm_user, then rcu_sched a callback to free those |
| 1223 | * pages. Disabling interrupts will allow the fast_gup walker to both block |
| 1224 | * the rcu_sched callback, and an IPI that we broadcast for splitting THPs |
| 1225 | * (which is a relatively rare event). The code below adopts this strategy. |
| 1226 | * |
| 1227 | * Before activating this code, please be aware that the following assumptions |
| 1228 | * are currently made: |
| 1229 | * |
| 1230 | * *) HAVE_RCU_TABLE_FREE is enabled, and tlb_remove_table is used to free |
| 1231 | * pages containing page tables. |
| 1232 | * |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1233 | * *) ptes can be read atomically by the architecture. |
| 1234 | * |
| 1235 | * *) access_ok is sufficient to validate userspace address ranges. |
| 1236 | * |
| 1237 | * The last two assumptions can be relaxed by the addition of helper functions. |
| 1238 | * |
| 1239 | * This code is based heavily on the PowerPC implementation by Nick Piggin. |
| 1240 | */ |
| 1241 | #ifdef CONFIG_HAVE_GENERIC_RCU_GUP |
| 1242 | |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 1243 | /* |
| 1244 | * Return the compund head page with ref appropriately incremented, |
| 1245 | * or NULL if that failed. |
| 1246 | */ |
| 1247 | static inline struct page *try_get_compound_head(struct page *page, int refs) |
| 1248 | { |
| 1249 | struct page *head = compound_head(page); |
| 1250 | if (WARN_ON_ONCE(page_ref_count(head) < 0)) |
| 1251 | return NULL; |
| 1252 | if (unlikely(!page_cache_add_speculative(head, refs))) |
| 1253 | return NULL; |
| 1254 | return head; |
| 1255 | } |
| 1256 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1257 | #ifdef __HAVE_ARCH_PTE_SPECIAL |
| 1258 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1259 | int write, struct page **pages, int *nr) |
| 1260 | { |
| 1261 | pte_t *ptep, *ptem; |
| 1262 | int ret = 0; |
| 1263 | |
| 1264 | ptem = ptep = pte_offset_map(&pmd, addr); |
| 1265 | do { |
| 1266 | /* |
| 1267 | * In the line below we are assuming that the pte can be read |
| 1268 | * atomically. If this is not the case for your architecture, |
| 1269 | * please wrap this in a helper function! |
| 1270 | * |
| 1271 | * for an example see gup_get_pte in arch/x86/mm/gup.c |
| 1272 | */ |
Jason Low | 9d8c47e | 2015-04-15 16:14:05 -0700 | [diff] [blame] | 1273 | pte_t pte = READ_ONCE(*ptep); |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1274 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1275 | |
| 1276 | /* |
| 1277 | * Similar to the PMD case below, NUMA hinting must take slow |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1278 | * path using the pte_protnone check. |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1279 | */ |
| 1280 | if (!pte_present(pte) || pte_special(pte) || |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1281 | pte_protnone(pte) || (write && !pte_write(pte))) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1282 | goto pte_unmap; |
| 1283 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 1284 | if (!arch_pte_access_permitted(pte, write)) |
| 1285 | goto pte_unmap; |
| 1286 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1287 | VM_BUG_ON(!pfn_valid(pte_pfn(pte))); |
| 1288 | page = pte_page(pte); |
| 1289 | |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 1290 | head = try_get_compound_head(page, 1); |
| 1291 | if (!head) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1292 | goto pte_unmap; |
| 1293 | |
| 1294 | if (unlikely(pte_val(pte) != pte_val(*ptep))) { |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1295 | put_page(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1296 | goto pte_unmap; |
| 1297 | } |
| 1298 | |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1299 | VM_BUG_ON_PAGE(compound_head(page) != head, page); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1300 | pages[*nr] = page; |
| 1301 | (*nr)++; |
| 1302 | |
| 1303 | } while (ptep++, addr += PAGE_SIZE, addr != end); |
| 1304 | |
| 1305 | ret = 1; |
| 1306 | |
| 1307 | pte_unmap: |
| 1308 | pte_unmap(ptem); |
| 1309 | return ret; |
| 1310 | } |
| 1311 | #else |
| 1312 | |
| 1313 | /* |
| 1314 | * If we can't determine whether or not a pte is special, then fail immediately |
| 1315 | * for ptes. Note, we can still pin HugeTLB and THP as these are guaranteed not |
| 1316 | * to be special. |
| 1317 | * |
| 1318 | * For a futex to be placed on a THP tail page, get_futex_key requires a |
| 1319 | * __get_user_pages_fast implementation that can pin pages. Thus it's still |
| 1320 | * useful to have gup_huge_pmd even if we can't operate on ptes. |
| 1321 | */ |
| 1322 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1323 | int write, struct page **pages, int *nr) |
| 1324 | { |
| 1325 | return 0; |
| 1326 | } |
| 1327 | #endif /* __HAVE_ARCH_PTE_SPECIAL */ |
| 1328 | |
| 1329 | static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, |
| 1330 | unsigned long end, int write, struct page **pages, int *nr) |
| 1331 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1332 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1333 | int refs; |
| 1334 | |
| 1335 | if (write && !pmd_write(orig)) |
| 1336 | return 0; |
| 1337 | |
| 1338 | refs = 0; |
Punit Agrawal | 26c02ad | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1339 | page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1340 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1341 | pages[*nr] = page; |
| 1342 | (*nr)++; |
| 1343 | page++; |
| 1344 | refs++; |
| 1345 | } while (addr += PAGE_SIZE, addr != end); |
| 1346 | |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 1347 | head = try_get_compound_head(pmd_page(orig), refs); |
| 1348 | if (!head) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1349 | *nr -= refs; |
| 1350 | return 0; |
| 1351 | } |
| 1352 | |
| 1353 | if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) { |
| 1354 | *nr -= refs; |
| 1355 | while (refs--) |
| 1356 | put_page(head); |
| 1357 | return 0; |
| 1358 | } |
| 1359 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1360 | return 1; |
| 1361 | } |
| 1362 | |
| 1363 | static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, |
| 1364 | unsigned long end, int write, struct page **pages, int *nr) |
| 1365 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1366 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1367 | int refs; |
| 1368 | |
| 1369 | if (write && !pud_write(orig)) |
| 1370 | return 0; |
| 1371 | |
| 1372 | refs = 0; |
Punit Agrawal | 26c02ad | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1373 | page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1374 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1375 | pages[*nr] = page; |
| 1376 | (*nr)++; |
| 1377 | page++; |
| 1378 | refs++; |
| 1379 | } while (addr += PAGE_SIZE, addr != end); |
| 1380 | |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 1381 | head = try_get_compound_head(pud_page(orig), refs); |
| 1382 | if (!head) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1383 | *nr -= refs; |
| 1384 | return 0; |
| 1385 | } |
| 1386 | |
| 1387 | if (unlikely(pud_val(orig) != pud_val(*pudp))) { |
| 1388 | *nr -= refs; |
| 1389 | while (refs--) |
| 1390 | put_page(head); |
| 1391 | return 0; |
| 1392 | } |
| 1393 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1394 | return 1; |
| 1395 | } |
| 1396 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1397 | static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr, |
| 1398 | unsigned long end, int write, |
| 1399 | struct page **pages, int *nr) |
| 1400 | { |
| 1401 | int refs; |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1402 | struct page *head, *page; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1403 | |
| 1404 | if (write && !pgd_write(orig)) |
| 1405 | return 0; |
| 1406 | |
| 1407 | refs = 0; |
Punit Agrawal | 26c02ad | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1408 | page = pgd_page(orig) + ((addr & ~PGDIR_MASK) >> PAGE_SHIFT); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1409 | do { |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1410 | pages[*nr] = page; |
| 1411 | (*nr)++; |
| 1412 | page++; |
| 1413 | refs++; |
| 1414 | } while (addr += PAGE_SIZE, addr != end); |
| 1415 | |
Linus Torvalds | 2ed768c | 2019-04-11 10:49:19 -0700 | [diff] [blame] | 1416 | head = try_get_compound_head(pgd_page(orig), refs); |
| 1417 | if (!head) { |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1418 | *nr -= refs; |
| 1419 | return 0; |
| 1420 | } |
| 1421 | |
| 1422 | if (unlikely(pgd_val(orig) != pgd_val(*pgdp))) { |
| 1423 | *nr -= refs; |
| 1424 | while (refs--) |
| 1425 | put_page(head); |
| 1426 | return 0; |
| 1427 | } |
| 1428 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1429 | return 1; |
| 1430 | } |
| 1431 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1432 | static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end, |
| 1433 | int write, struct page **pages, int *nr) |
| 1434 | { |
| 1435 | unsigned long next; |
| 1436 | pmd_t *pmdp; |
| 1437 | |
| 1438 | pmdp = pmd_offset(&pud, addr); |
| 1439 | do { |
Christian Borntraeger | 38c5ce9 | 2015-01-06 22:54:46 +0100 | [diff] [blame] | 1440 | pmd_t pmd = READ_ONCE(*pmdp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1441 | |
| 1442 | next = pmd_addr_end(addr, end); |
Kirill A. Shutemov | 4b471e8 | 2016-01-15 16:53:39 -0800 | [diff] [blame] | 1443 | if (pmd_none(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1444 | return 0; |
| 1445 | |
Yu Zhao | c133d8e | 2019-02-12 15:35:58 -0800 | [diff] [blame] | 1446 | if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd) || |
| 1447 | pmd_devmap(pmd))) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1448 | /* |
| 1449 | * NUMA hinting faults need to be handled in the GUP |
| 1450 | * slowpath for accounting purposes and so that they |
| 1451 | * can be serialised against THP migration. |
| 1452 | */ |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1453 | if (pmd_protnone(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1454 | return 0; |
| 1455 | |
| 1456 | if (!gup_huge_pmd(pmd, pmdp, addr, next, write, |
| 1457 | pages, nr)) |
| 1458 | return 0; |
| 1459 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1460 | } else if (unlikely(is_hugepd(__hugepd(pmd_val(pmd))))) { |
| 1461 | /* |
| 1462 | * architecture have different format for hugetlbfs |
| 1463 | * pmd format and THP pmd format |
| 1464 | */ |
| 1465 | if (!gup_huge_pd(__hugepd(pmd_val(pmd)), addr, |
| 1466 | PMD_SHIFT, next, write, pages, nr)) |
| 1467 | return 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1468 | } else if (!gup_pte_range(pmd, addr, next, write, pages, nr)) |
| 1469 | return 0; |
| 1470 | } while (pmdp++, addr = next, addr != end); |
| 1471 | |
| 1472 | return 1; |
| 1473 | } |
| 1474 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1475 | static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end, |
| 1476 | int write, struct page **pages, int *nr) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1477 | { |
| 1478 | unsigned long next; |
| 1479 | pud_t *pudp; |
| 1480 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1481 | pudp = pud_offset(&pgd, addr); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1482 | do { |
Christian Borntraeger | e37c698 | 2014-12-07 21:41:33 +0100 | [diff] [blame] | 1483 | pud_t pud = READ_ONCE(*pudp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1484 | |
| 1485 | next = pud_addr_end(addr, end); |
| 1486 | if (pud_none(pud)) |
| 1487 | return 0; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1488 | if (unlikely(pud_huge(pud))) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1489 | if (!gup_huge_pud(pud, pudp, addr, next, write, |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1490 | pages, nr)) |
| 1491 | return 0; |
| 1492 | } else if (unlikely(is_hugepd(__hugepd(pud_val(pud))))) { |
| 1493 | if (!gup_huge_pd(__hugepd(pud_val(pud)), addr, |
| 1494 | PUD_SHIFT, next, write, pages, nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1495 | return 0; |
| 1496 | } else if (!gup_pmd_range(pud, addr, next, write, pages, nr)) |
| 1497 | return 0; |
| 1498 | } while (pudp++, addr = next, addr != end); |
| 1499 | |
| 1500 | return 1; |
| 1501 | } |
| 1502 | |
| 1503 | /* |
| 1504 | * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to |
| 1505 | * the regular GUP. It will only return non-negative values. |
| 1506 | */ |
| 1507 | int __get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1508 | struct page **pages) |
| 1509 | { |
| 1510 | struct mm_struct *mm = current->mm; |
| 1511 | unsigned long addr, len, end; |
| 1512 | unsigned long next, flags; |
| 1513 | pgd_t *pgdp; |
| 1514 | int nr = 0; |
| 1515 | |
| 1516 | start &= PAGE_MASK; |
| 1517 | addr = start; |
| 1518 | len = (unsigned long) nr_pages << PAGE_SHIFT; |
| 1519 | end = start + len; |
| 1520 | |
| 1521 | if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, |
| 1522 | start, len))) |
| 1523 | return 0; |
| 1524 | |
| 1525 | /* |
| 1526 | * Disable interrupts. We use the nested form as we can already have |
| 1527 | * interrupts disabled by get_futex_key. |
| 1528 | * |
| 1529 | * With interrupts disabled, we block page table pages from being |
| 1530 | * freed from under us. See mmu_gather_tlb in asm-generic/tlb.h |
| 1531 | * for more details. |
| 1532 | * |
| 1533 | * We do not adopt an rcu_read_lock(.) here as we also want to |
| 1534 | * block IPIs that come from THPs splitting. |
| 1535 | */ |
| 1536 | |
| 1537 | local_irq_save(flags); |
| 1538 | pgdp = pgd_offset(mm, addr); |
| 1539 | do { |
Jason Low | 9d8c47e | 2015-04-15 16:14:05 -0700 | [diff] [blame] | 1540 | pgd_t pgd = READ_ONCE(*pgdp); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1541 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1542 | next = pgd_addr_end(addr, end); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1543 | if (pgd_none(pgd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1544 | break; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1545 | if (unlikely(pgd_huge(pgd))) { |
| 1546 | if (!gup_huge_pgd(pgd, pgdp, addr, next, write, |
| 1547 | pages, &nr)) |
| 1548 | break; |
| 1549 | } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) { |
| 1550 | if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr, |
| 1551 | PGDIR_SHIFT, next, write, pages, &nr)) |
| 1552 | break; |
| 1553 | } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1554 | break; |
| 1555 | } while (pgdp++, addr = next, addr != end); |
| 1556 | local_irq_restore(flags); |
| 1557 | |
| 1558 | return nr; |
| 1559 | } |
| 1560 | |
| 1561 | /** |
| 1562 | * get_user_pages_fast() - pin user pages in memory |
| 1563 | * @start: starting user address |
| 1564 | * @nr_pages: number of pages from start to pin |
| 1565 | * @write: whether pages will be written to |
| 1566 | * @pages: array that receives pointers to the pages pinned. |
| 1567 | * Should be at least nr_pages long. |
| 1568 | * |
| 1569 | * Attempt to pin user pages in memory without taking mm->mmap_sem. |
| 1570 | * If not successful, it will fall back to taking the lock and |
| 1571 | * calling get_user_pages(). |
| 1572 | * |
| 1573 | * Returns number of pages pinned. This may be fewer than the number |
| 1574 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 1575 | * were pinned, returns -errno. |
| 1576 | */ |
| 1577 | int get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1578 | struct page **pages) |
| 1579 | { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1580 | int nr, ret; |
| 1581 | |
| 1582 | start &= PAGE_MASK; |
| 1583 | nr = __get_user_pages_fast(start, nr_pages, write, pages); |
| 1584 | ret = nr; |
| 1585 | |
| 1586 | if (nr < nr_pages) { |
| 1587 | /* Try to get the remaining pages with get_user_pages */ |
| 1588 | start += nr << PAGE_SHIFT; |
| 1589 | pages += nr; |
| 1590 | |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 1591 | ret = get_user_pages_unlocked(start, nr_pages - nr, pages, |
| 1592 | write ? FOLL_WRITE : 0); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1593 | |
| 1594 | /* Have to be a bit careful with return values */ |
| 1595 | if (nr > 0) { |
| 1596 | if (ret < 0) |
| 1597 | ret = nr; |
| 1598 | else |
| 1599 | ret += nr; |
| 1600 | } |
| 1601 | } |
| 1602 | |
| 1603 | return ret; |
| 1604 | } |
| 1605 | |
| 1606 | #endif /* CONFIG_HAVE_GENERIC_RCU_GUP */ |