blob: d8ce5ff6145492469a3b81640946fca58d7e8002 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * mm/rmap.c - physical to virtual reverse mappings
3 *
4 * Copyright 2001, Rik van Riel <riel@conectiva.com.br>
5 * Released under the General Public License (GPL).
6 *
7 * Simple, low overhead reverse mapping scheme.
8 * Please try to keep this thing as modular as possible.
9 *
10 * Provides methods for unmapping each kind of mapped page:
11 * the anon methods track anonymous pages, and
12 * the file methods track pages belonging to an inode.
13 *
14 * Original design by Rik van Riel <riel@conectiva.com.br> 2001
15 * File methods by Dave McCracken <dmccr@us.ibm.com> 2003, 2004
16 * Anonymous methods by Andrea Arcangeli <andrea@suse.de> 2004
17 * Contributions by Hugh Dickins <hugh@veritas.com> 2003, 2004
18 */
19
20/*
21 * Lock ordering in mm:
22 *
Jes Sorensen1b1dcc12006-01-09 15:59:24 -080023 * inode->i_mutex (while writing or truncating, not reading or faulting)
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 * inode->i_alloc_sem
25 *
26 * When a page fault occurs in writing from user to file, down_read
Jes Sorensen1b1dcc12006-01-09 15:59:24 -080027 * of mmap_sem nests within i_mutex; in sys_msync, i_mutex nests within
28 * down_read of mmap_sem; i_mutex and down_write of mmap_sem are never
29 * taken together; in truncation, i_mutex is taken outermost.
Linus Torvalds1da177e2005-04-16 15:20:36 -070030 *
31 * mm->mmap_sem
32 * page->flags PG_locked (lock_page)
33 * mapping->i_mmap_lock
34 * anon_vma->lock
Hugh Dickinsb8072f02005-10-29 18:16:41 -070035 * mm->page_table_lock or pte_lock
Nick Piggin053837f2006-01-18 17:42:27 -080036 * zone->lru_lock (in mark_page_accessed, isolate_lru_page)
Hugh Dickins5d337b92005-09-03 15:54:41 -070037 * swap_lock (in swap_duplicate, swap_info_get)
Linus Torvalds1da177e2005-04-16 15:20:36 -070038 * mmlist_lock (in mmput, drain_mmlist and others)
Linus Torvalds1da177e2005-04-16 15:20:36 -070039 * mapping->private_lock (in __set_page_dirty_buffers)
40 * inode_lock (in set_page_dirty's __mark_inode_dirty)
41 * sb_lock (within inode_lock in fs/fs-writeback.c)
42 * mapping->tree_lock (widely used, in set_page_dirty,
43 * in arch-dependent flush_dcache_mmap_lock,
44 * within inode_lock in __sync_single_inode)
45 */
46
47#include <linux/mm.h>
48#include <linux/pagemap.h>
49#include <linux/swap.h>
50#include <linux/swapops.h>
51#include <linux/slab.h>
52#include <linux/init.h>
53#include <linux/rmap.h>
54#include <linux/rcupdate.h>
Christoph Lametera48d07a2006-02-01 03:05:38 -080055#include <linux/module.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070056
57#include <asm/tlbflush.h>
58
59//#define RMAP_DEBUG /* can be enabled only for debugging */
60
61kmem_cache_t *anon_vma_cachep;
62
63static inline void validate_anon_vma(struct vm_area_struct *find_vma)
64{
65#ifdef RMAP_DEBUG
66 struct anon_vma *anon_vma = find_vma->anon_vma;
67 struct vm_area_struct *vma;
68 unsigned int mapcount = 0;
69 int found = 0;
70
71 list_for_each_entry(vma, &anon_vma->head, anon_vma_node) {
72 mapcount++;
73 BUG_ON(mapcount > 100000);
74 if (vma == find_vma)
75 found = 1;
76 }
77 BUG_ON(!found);
78#endif
79}
80
81/* This must be called under the mmap_sem. */
82int anon_vma_prepare(struct vm_area_struct *vma)
83{
84 struct anon_vma *anon_vma = vma->anon_vma;
85
86 might_sleep();
87 if (unlikely(!anon_vma)) {
88 struct mm_struct *mm = vma->vm_mm;
89 struct anon_vma *allocated, *locked;
90
91 anon_vma = find_mergeable_anon_vma(vma);
92 if (anon_vma) {
93 allocated = NULL;
94 locked = anon_vma;
95 spin_lock(&locked->lock);
96 } else {
97 anon_vma = anon_vma_alloc();
98 if (unlikely(!anon_vma))
99 return -ENOMEM;
100 allocated = anon_vma;
101 locked = NULL;
102 }
103
104 /* page_table_lock to protect against threads */
105 spin_lock(&mm->page_table_lock);
106 if (likely(!vma->anon_vma)) {
107 vma->anon_vma = anon_vma;
108 list_add(&vma->anon_vma_node, &anon_vma->head);
109 allocated = NULL;
110 }
111 spin_unlock(&mm->page_table_lock);
112
113 if (locked)
114 spin_unlock(&locked->lock);
115 if (unlikely(allocated))
116 anon_vma_free(allocated);
117 }
118 return 0;
119}
120
121void __anon_vma_merge(struct vm_area_struct *vma, struct vm_area_struct *next)
122{
123 BUG_ON(vma->anon_vma != next->anon_vma);
124 list_del(&next->anon_vma_node);
125}
126
127void __anon_vma_link(struct vm_area_struct *vma)
128{
129 struct anon_vma *anon_vma = vma->anon_vma;
130
131 if (anon_vma) {
132 list_add(&vma->anon_vma_node, &anon_vma->head);
133 validate_anon_vma(vma);
134 }
135}
136
137void anon_vma_link(struct vm_area_struct *vma)
138{
139 struct anon_vma *anon_vma = vma->anon_vma;
140
141 if (anon_vma) {
142 spin_lock(&anon_vma->lock);
143 list_add(&vma->anon_vma_node, &anon_vma->head);
144 validate_anon_vma(vma);
145 spin_unlock(&anon_vma->lock);
146 }
147}
148
149void anon_vma_unlink(struct vm_area_struct *vma)
150{
151 struct anon_vma *anon_vma = vma->anon_vma;
152 int empty;
153
154 if (!anon_vma)
155 return;
156
157 spin_lock(&anon_vma->lock);
158 validate_anon_vma(vma);
159 list_del(&vma->anon_vma_node);
160
161 /* We must garbage collect the anon_vma if it's empty */
162 empty = list_empty(&anon_vma->head);
163 spin_unlock(&anon_vma->lock);
164
165 if (empty)
166 anon_vma_free(anon_vma);
167}
168
169static void anon_vma_ctor(void *data, kmem_cache_t *cachep, unsigned long flags)
170{
171 if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
172 SLAB_CTOR_CONSTRUCTOR) {
173 struct anon_vma *anon_vma = data;
174
175 spin_lock_init(&anon_vma->lock);
176 INIT_LIST_HEAD(&anon_vma->head);
177 }
178}
179
180void __init anon_vma_init(void)
181{
182 anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
183 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC, anon_vma_ctor, NULL);
184}
185
186/*
187 * Getting a lock on a stable anon_vma from a page off the LRU is
188 * tricky: page_lock_anon_vma rely on RCU to guard against the races.
189 */
190static struct anon_vma *page_lock_anon_vma(struct page *page)
191{
192 struct anon_vma *anon_vma = NULL;
193 unsigned long anon_mapping;
194
195 rcu_read_lock();
196 anon_mapping = (unsigned long) page->mapping;
197 if (!(anon_mapping & PAGE_MAPPING_ANON))
198 goto out;
199 if (!page_mapped(page))
200 goto out;
201
202 anon_vma = (struct anon_vma *) (anon_mapping - PAGE_MAPPING_ANON);
203 spin_lock(&anon_vma->lock);
204out:
205 rcu_read_unlock();
206 return anon_vma;
207}
208
Christoph Lametera3351e52006-02-01 03:05:39 -0800209#ifdef CONFIG_MIGRATION
210/*
211 * Remove an anonymous page from swap replacing the swap pte's
212 * through real pte's pointing to valid pages and then releasing
213 * the page from the swap cache.
214 *
Christoph Lametere8788c02006-02-28 16:59:16 -0800215 * Must hold page lock on page and mmap_sem of one vma that contains
216 * the page.
Christoph Lametera3351e52006-02-01 03:05:39 -0800217 */
218void remove_from_swap(struct page *page)
219{
220 struct anon_vma *anon_vma;
221 struct vm_area_struct *vma;
Christoph Lametere8788c02006-02-28 16:59:16 -0800222 unsigned long mapping;
Christoph Lametera3351e52006-02-01 03:05:39 -0800223
Christoph Lametere8788c02006-02-28 16:59:16 -0800224 if (!PageSwapCache(page))
Christoph Lametera3351e52006-02-01 03:05:39 -0800225 return;
226
Christoph Lametere8788c02006-02-28 16:59:16 -0800227 mapping = (unsigned long)page->mapping;
228
229 if (!mapping || (mapping & PAGE_MAPPING_ANON) == 0)
Christoph Lametera3351e52006-02-01 03:05:39 -0800230 return;
231
Christoph Lametere8788c02006-02-28 16:59:16 -0800232 /*
233 * We hold the mmap_sem lock. So no need to call page_lock_anon_vma.
234 */
235 anon_vma = (struct anon_vma *) (mapping - PAGE_MAPPING_ANON);
236 spin_lock(&anon_vma->lock);
237
Christoph Lametera3351e52006-02-01 03:05:39 -0800238 list_for_each_entry(vma, &anon_vma->head, anon_vma_node)
239 remove_vma_swap(vma, page);
240
241 spin_unlock(&anon_vma->lock);
Christoph Lametera3351e52006-02-01 03:05:39 -0800242 delete_from_swap_cache(page);
243}
Christoph Lametere965f962006-02-01 03:05:41 -0800244EXPORT_SYMBOL(remove_from_swap);
Christoph Lametera3351e52006-02-01 03:05:39 -0800245#endif
246
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247/*
248 * At what user virtual address is page expected in vma?
249 */
250static inline unsigned long
251vma_address(struct page *page, struct vm_area_struct *vma)
252{
253 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
254 unsigned long address;
255
256 address = vma->vm_start + ((pgoff - vma->vm_pgoff) << PAGE_SHIFT);
257 if (unlikely(address < vma->vm_start || address >= vma->vm_end)) {
258 /* page should be within any vma from prio_tree_next */
259 BUG_ON(!PageAnon(page));
260 return -EFAULT;
261 }
262 return address;
263}
264
265/*
266 * At what user virtual address is page expected in vma? checking that the
Hugh Dickinsee498ed2005-11-21 21:32:18 -0800267 * page matches the vma: currently only used on anon pages, by unuse_vma;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700268 */
269unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
270{
271 if (PageAnon(page)) {
272 if ((void *)vma->anon_vma !=
273 (void *)page->mapping - PAGE_MAPPING_ANON)
274 return -EFAULT;
275 } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
Hugh Dickinsee498ed2005-11-21 21:32:18 -0800276 if (!vma->vm_file ||
277 vma->vm_file->f_mapping != page->mapping)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278 return -EFAULT;
279 } else
280 return -EFAULT;
281 return vma_address(page, vma);
282}
283
284/*
Nikita Danilov81b40822005-05-01 08:58:36 -0700285 * Check that @page is mapped at @address into @mm.
286 *
Hugh Dickinsb8072f02005-10-29 18:16:41 -0700287 * On success returns with pte mapped and locked.
Nikita Danilov81b40822005-05-01 08:58:36 -0700288 */
Carsten Otteceffc072005-06-23 22:05:25 -0700289pte_t *page_check_address(struct page *page, struct mm_struct *mm,
Hugh Dickinsc0718802005-10-29 18:16:31 -0700290 unsigned long address, spinlock_t **ptlp)
Nikita Danilov81b40822005-05-01 08:58:36 -0700291{
292 pgd_t *pgd;
293 pud_t *pud;
294 pmd_t *pmd;
295 pte_t *pte;
Hugh Dickinsc0718802005-10-29 18:16:31 -0700296 spinlock_t *ptl;
Nikita Danilov81b40822005-05-01 08:58:36 -0700297
Nikita Danilov81b40822005-05-01 08:58:36 -0700298 pgd = pgd_offset(mm, address);
Hugh Dickinsc0718802005-10-29 18:16:31 -0700299 if (!pgd_present(*pgd))
300 return NULL;
301
302 pud = pud_offset(pgd, address);
303 if (!pud_present(*pud))
304 return NULL;
305
306 pmd = pmd_offset(pud, address);
307 if (!pmd_present(*pmd))
308 return NULL;
309
310 pte = pte_offset_map(pmd, address);
311 /* Make a quick check before getting the lock */
312 if (!pte_present(*pte)) {
313 pte_unmap(pte);
314 return NULL;
Nikita Danilov81b40822005-05-01 08:58:36 -0700315 }
Hugh Dickinsc0718802005-10-29 18:16:31 -0700316
Hugh Dickins4c21e2f2005-10-29 18:16:40 -0700317 ptl = pte_lockptr(mm, pmd);
Hugh Dickinsc0718802005-10-29 18:16:31 -0700318 spin_lock(ptl);
319 if (pte_present(*pte) && page_to_pfn(page) == pte_pfn(*pte)) {
320 *ptlp = ptl;
321 return pte;
322 }
323 pte_unmap_unlock(pte, ptl);
324 return NULL;
Nikita Danilov81b40822005-05-01 08:58:36 -0700325}
326
327/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700328 * Subfunctions of page_referenced: page_referenced_one called
329 * repeatedly from either page_referenced_anon or page_referenced_file.
330 */
331static int page_referenced_one(struct page *page,
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800332 struct vm_area_struct *vma, unsigned int *mapcount)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333{
334 struct mm_struct *mm = vma->vm_mm;
335 unsigned long address;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700336 pte_t *pte;
Hugh Dickinsc0718802005-10-29 18:16:31 -0700337 spinlock_t *ptl;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338 int referenced = 0;
339
Linus Torvalds1da177e2005-04-16 15:20:36 -0700340 address = vma_address(page, vma);
341 if (address == -EFAULT)
342 goto out;
343
Hugh Dickinsc0718802005-10-29 18:16:31 -0700344 pte = page_check_address(page, mm, address, &ptl);
345 if (!pte)
346 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347
Hugh Dickinsc0718802005-10-29 18:16:31 -0700348 if (ptep_clear_flush_young(vma, address, pte))
349 referenced++;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700350
Hugh Dickinsc0718802005-10-29 18:16:31 -0700351 /* Pretend the page is referenced if the task has the
352 swap token and is in the middle of a page fault. */
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800353 if (mm != current->mm && has_swap_token(mm) &&
Hugh Dickinsc0718802005-10-29 18:16:31 -0700354 rwsem_is_locked(&mm->mmap_sem))
355 referenced++;
356
357 (*mapcount)--;
358 pte_unmap_unlock(pte, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700359out:
360 return referenced;
361}
362
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800363static int page_referenced_anon(struct page *page)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364{
365 unsigned int mapcount;
366 struct anon_vma *anon_vma;
367 struct vm_area_struct *vma;
368 int referenced = 0;
369
370 anon_vma = page_lock_anon_vma(page);
371 if (!anon_vma)
372 return referenced;
373
374 mapcount = page_mapcount(page);
375 list_for_each_entry(vma, &anon_vma->head, anon_vma_node) {
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800376 referenced += page_referenced_one(page, vma, &mapcount);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700377 if (!mapcount)
378 break;
379 }
380 spin_unlock(&anon_vma->lock);
381 return referenced;
382}
383
384/**
385 * page_referenced_file - referenced check for object-based rmap
386 * @page: the page we're checking references on.
387 *
388 * For an object-based mapped page, find all the places it is mapped and
389 * check/clear the referenced flag. This is done by following the page->mapping
390 * pointer, then walking the chain of vmas it holds. It returns the number
391 * of references it found.
392 *
393 * This function is only called from page_referenced for object-based pages.
394 */
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800395static int page_referenced_file(struct page *page)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700396{
397 unsigned int mapcount;
398 struct address_space *mapping = page->mapping;
399 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
400 struct vm_area_struct *vma;
401 struct prio_tree_iter iter;
402 int referenced = 0;
403
404 /*
405 * The caller's checks on page->mapping and !PageAnon have made
406 * sure that this is a file page: the check for page->mapping
407 * excludes the case just before it gets set on an anon page.
408 */
409 BUG_ON(PageAnon(page));
410
411 /*
412 * The page lock not only makes sure that page->mapping cannot
413 * suddenly be NULLified by truncation, it makes sure that the
414 * structure at mapping cannot be freed and reused yet,
415 * so we can safely take mapping->i_mmap_lock.
416 */
417 BUG_ON(!PageLocked(page));
418
419 spin_lock(&mapping->i_mmap_lock);
420
421 /*
422 * i_mmap_lock does not stabilize mapcount at all, but mapcount
423 * is more likely to be accurate if we note it after spinning.
424 */
425 mapcount = page_mapcount(page);
426
427 vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
428 if ((vma->vm_flags & (VM_LOCKED|VM_MAYSHARE))
429 == (VM_LOCKED|VM_MAYSHARE)) {
430 referenced++;
431 break;
432 }
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800433 referenced += page_referenced_one(page, vma, &mapcount);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700434 if (!mapcount)
435 break;
436 }
437
438 spin_unlock(&mapping->i_mmap_lock);
439 return referenced;
440}
441
442/**
443 * page_referenced - test if the page was referenced
444 * @page: the page to test
445 * @is_locked: caller holds lock on the page
446 *
447 * Quick test_and_clear_referenced for all mappings to a page,
448 * returns the number of ptes which referenced the page.
449 */
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800450int page_referenced(struct page *page, int is_locked)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700451{
452 int referenced = 0;
453
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454 if (page_test_and_clear_young(page))
455 referenced++;
456
457 if (TestClearPageReferenced(page))
458 referenced++;
459
460 if (page_mapped(page) && page->mapping) {
461 if (PageAnon(page))
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800462 referenced += page_referenced_anon(page);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700463 else if (is_locked)
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800464 referenced += page_referenced_file(page);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700465 else if (TestSetPageLocked(page))
466 referenced++;
467 else {
468 if (page->mapping)
Rik van Rielf7b7fd82005-11-28 13:44:07 -0800469 referenced += page_referenced_file(page);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700470 unlock_page(page);
471 }
472 }
473 return referenced;
474}
475
476/**
Nick Piggin9617d952006-01-06 00:11:12 -0800477 * page_set_anon_rmap - setup new anonymous rmap
478 * @page: the page to add the mapping to
479 * @vma: the vm area in which the mapping is added
480 * @address: the user virtual address mapped
481 */
482static void __page_set_anon_rmap(struct page *page,
483 struct vm_area_struct *vma, unsigned long address)
484{
485 struct anon_vma *anon_vma = vma->anon_vma;
486
487 BUG_ON(!anon_vma);
488 anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
489 page->mapping = (struct address_space *) anon_vma;
490
491 page->index = linear_page_index(vma, address);
492
Nick Piggina74609f2006-01-06 00:11:20 -0800493 /*
494 * nr_mapped state can be updated without turning off
495 * interrupts because it is not modified via interrupt.
496 */
497 __inc_page_state(nr_mapped);
Nick Piggin9617d952006-01-06 00:11:12 -0800498}
499
500/**
Linus Torvalds1da177e2005-04-16 15:20:36 -0700501 * page_add_anon_rmap - add pte mapping to an anonymous page
502 * @page: the page to add the mapping to
503 * @vma: the vm area in which the mapping is added
504 * @address: the user virtual address mapped
505 *
Hugh Dickinsb8072f02005-10-29 18:16:41 -0700506 * The caller needs to hold the pte lock.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700507 */
508void page_add_anon_rmap(struct page *page,
509 struct vm_area_struct *vma, unsigned long address)
510{
Nick Piggin9617d952006-01-06 00:11:12 -0800511 if (atomic_inc_and_test(&page->_mapcount))
512 __page_set_anon_rmap(page, vma, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700513 /* else checking page index and mapping is racy */
514}
515
Nick Piggin9617d952006-01-06 00:11:12 -0800516/*
517 * page_add_new_anon_rmap - add pte mapping to a new anonymous page
518 * @page: the page to add the mapping to
519 * @vma: the vm area in which the mapping is added
520 * @address: the user virtual address mapped
521 *
522 * Same as page_add_anon_rmap but must only be called on *new* pages.
523 * This means the inc-and-test can be bypassed.
524 */
525void page_add_new_anon_rmap(struct page *page,
526 struct vm_area_struct *vma, unsigned long address)
527{
528 atomic_set(&page->_mapcount, 0); /* elevate count by 1 (starts at -1) */
529 __page_set_anon_rmap(page, vma, address);
530}
531
Linus Torvalds1da177e2005-04-16 15:20:36 -0700532/**
533 * page_add_file_rmap - add pte mapping to a file page
534 * @page: the page to add the mapping to
535 *
Hugh Dickinsb8072f02005-10-29 18:16:41 -0700536 * The caller needs to hold the pte lock.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537 */
538void page_add_file_rmap(struct page *page)
539{
540 BUG_ON(PageAnon(page));
Nick Pigginb5810032005-10-29 18:16:12 -0700541 BUG_ON(!pfn_valid(page_to_pfn(page)));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700542
543 if (atomic_inc_and_test(&page->_mapcount))
Nick Piggina74609f2006-01-06 00:11:20 -0800544 __inc_page_state(nr_mapped);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700545}
546
547/**
548 * page_remove_rmap - take down pte mapping from a page
549 * @page: page to remove mapping from
550 *
Hugh Dickinsb8072f02005-10-29 18:16:41 -0700551 * The caller needs to hold the pte lock.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552 */
553void page_remove_rmap(struct page *page)
554{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700555 if (atomic_add_negative(-1, &page->_mapcount)) {
Dave Jonesef2bf0d2006-01-08 01:01:00 -0800556 if (page_mapcount(page) < 0) {
557 printk (KERN_EMERG "Eeek! page_mapcount(page) went negative! (%d)\n", page_mapcount(page));
558 printk (KERN_EMERG " page->flags = %lx\n", page->flags);
559 printk (KERN_EMERG " page->count = %x\n", page_count(page));
560 printk (KERN_EMERG " page->mapping = %p\n", page->mapping);
561 }
562
Linus Torvalds1da177e2005-04-16 15:20:36 -0700563 BUG_ON(page_mapcount(page) < 0);
564 /*
565 * It would be tidy to reset the PageAnon mapping here,
566 * but that might overwrite a racing page_add_anon_rmap
567 * which increments mapcount after us but sets mapping
568 * before us: so leave the reset to free_hot_cold_page,
569 * and remember that it's only reliable while mapped.
570 * Leaving it set also helps swapoff to reinstate ptes
571 * faster for those pages still in swapcache.
572 */
573 if (page_test_and_clear_dirty(page))
574 set_page_dirty(page);
Nick Piggina74609f2006-01-06 00:11:20 -0800575 __dec_page_state(nr_mapped);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700576 }
577}
578
579/*
580 * Subfunctions of try_to_unmap: try_to_unmap_one called
581 * repeatedly from either try_to_unmap_anon or try_to_unmap_file.
582 */
Christoph Lametera48d07a2006-02-01 03:05:38 -0800583static int try_to_unmap_one(struct page *page, struct vm_area_struct *vma,
584 int ignore_refs)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585{
586 struct mm_struct *mm = vma->vm_mm;
587 unsigned long address;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 pte_t *pte;
589 pte_t pteval;
Hugh Dickinsc0718802005-10-29 18:16:31 -0700590 spinlock_t *ptl;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591 int ret = SWAP_AGAIN;
592
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 address = vma_address(page, vma);
594 if (address == -EFAULT)
595 goto out;
596
Hugh Dickinsc0718802005-10-29 18:16:31 -0700597 pte = page_check_address(page, mm, address, &ptl);
598 if (!pte)
Nikita Danilov81b40822005-05-01 08:58:36 -0700599 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600
601 /*
602 * If the page is mlock()d, we cannot swap it out.
603 * If it's recently referenced (perhaps page_referenced
604 * skipped over this mm) then we should reactivate it.
605 */
Hugh Dickins101d2be2005-11-21 21:32:16 -0800606 if ((vma->vm_flags & VM_LOCKED) ||
Christoph Lametera48d07a2006-02-01 03:05:38 -0800607 (ptep_clear_flush_young(vma, address, pte)
608 && !ignore_refs)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700609 ret = SWAP_FAIL;
610 goto out_unmap;
611 }
612
Linus Torvalds1da177e2005-04-16 15:20:36 -0700613 /* Nuke the page table entry. */
614 flush_cache_page(vma, address, page_to_pfn(page));
615 pteval = ptep_clear_flush(vma, address, pte);
616
617 /* Move the dirty bit to the physical page now the pte is gone. */
618 if (pte_dirty(pteval))
619 set_page_dirty(page);
620
Hugh Dickins365e9c872005-10-29 18:16:18 -0700621 /* Update high watermark before we lower rss */
622 update_hiwater_rss(mm);
623
Linus Torvalds1da177e2005-04-16 15:20:36 -0700624 if (PageAnon(page)) {
Hugh Dickins4c21e2f2005-10-29 18:16:40 -0700625 swp_entry_t entry = { .val = page_private(page) };
Linus Torvalds1da177e2005-04-16 15:20:36 -0700626 /*
627 * Store the swap location in the pte.
628 * See handle_pte_fault() ...
629 */
630 BUG_ON(!PageSwapCache(page));
631 swap_duplicate(entry);
632 if (list_empty(&mm->mmlist)) {
633 spin_lock(&mmlist_lock);
Hugh Dickinsf412ac02005-10-29 18:16:41 -0700634 if (list_empty(&mm->mmlist))
635 list_add(&mm->mmlist, &init_mm.mmlist);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700636 spin_unlock(&mmlist_lock);
637 }
638 set_pte_at(mm, address, pte, swp_entry_to_pte(entry));
639 BUG_ON(pte_file(*pte));
640 dec_mm_counter(mm, anon_rss);
Hugh Dickins42946212005-10-29 18:16:05 -0700641 } else
642 dec_mm_counter(mm, file_rss);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700643
Linus Torvalds1da177e2005-04-16 15:20:36 -0700644 page_remove_rmap(page);
645 page_cache_release(page);
646
647out_unmap:
Hugh Dickinsc0718802005-10-29 18:16:31 -0700648 pte_unmap_unlock(pte, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700649out:
650 return ret;
651}
652
653/*
654 * objrmap doesn't work for nonlinear VMAs because the assumption that
655 * offset-into-file correlates with offset-into-virtual-addresses does not hold.
656 * Consequently, given a particular page and its ->index, we cannot locate the
657 * ptes which are mapping that page without an exhaustive linear search.
658 *
659 * So what this code does is a mini "virtual scan" of each nonlinear VMA which
660 * maps the file to which the target page belongs. The ->vm_private_data field
661 * holds the current cursor into that scan. Successive searches will circulate
662 * around the vma's virtual address space.
663 *
664 * So as more replacement pressure is applied to the pages in a nonlinear VMA,
665 * more scanning pressure is placed against them as well. Eventually pages
666 * will become fully unmapped and are eligible for eviction.
667 *
668 * For very sparsely populated VMAs this is a little inefficient - chances are
669 * there there won't be many ptes located within the scan cluster. In this case
670 * maybe we could scan further - to the end of the pte page, perhaps.
671 */
672#define CLUSTER_SIZE min(32*PAGE_SIZE, PMD_SIZE)
673#define CLUSTER_MASK (~(CLUSTER_SIZE - 1))
674
675static void try_to_unmap_cluster(unsigned long cursor,
676 unsigned int *mapcount, struct vm_area_struct *vma)
677{
678 struct mm_struct *mm = vma->vm_mm;
679 pgd_t *pgd;
680 pud_t *pud;
681 pmd_t *pmd;
Hugh Dickinsc0718802005-10-29 18:16:31 -0700682 pte_t *pte;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700683 pte_t pteval;
Hugh Dickinsc0718802005-10-29 18:16:31 -0700684 spinlock_t *ptl;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700685 struct page *page;
686 unsigned long address;
687 unsigned long end;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700688
Linus Torvalds1da177e2005-04-16 15:20:36 -0700689 address = (vma->vm_start + cursor) & CLUSTER_MASK;
690 end = address + CLUSTER_SIZE;
691 if (address < vma->vm_start)
692 address = vma->vm_start;
693 if (end > vma->vm_end)
694 end = vma->vm_end;
695
696 pgd = pgd_offset(mm, address);
697 if (!pgd_present(*pgd))
Hugh Dickinsc0718802005-10-29 18:16:31 -0700698 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700699
700 pud = pud_offset(pgd, address);
701 if (!pud_present(*pud))
Hugh Dickinsc0718802005-10-29 18:16:31 -0700702 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700703
704 pmd = pmd_offset(pud, address);
705 if (!pmd_present(*pmd))
Hugh Dickinsc0718802005-10-29 18:16:31 -0700706 return;
707
708 pte = pte_offset_map_lock(mm, pmd, address, &ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700709
Hugh Dickins365e9c872005-10-29 18:16:18 -0700710 /* Update high watermark before we lower rss */
711 update_hiwater_rss(mm);
712
Hugh Dickinsc0718802005-10-29 18:16:31 -0700713 for (; address < end; pte++, address += PAGE_SIZE) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700714 if (!pte_present(*pte))
715 continue;
Linus Torvalds6aab3412005-11-28 14:34:23 -0800716 page = vm_normal_page(vma, address, *pte);
717 BUG_ON(!page || PageAnon(page));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700718
719 if (ptep_clear_flush_young(vma, address, pte))
720 continue;
721
722 /* Nuke the page table entry. */
Ben Collinseca35132005-11-29 11:45:26 -0800723 flush_cache_page(vma, address, pte_pfn(*pte));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700724 pteval = ptep_clear_flush(vma, address, pte);
725
726 /* If nonlinear, store the file page offset in the pte. */
727 if (page->index != linear_page_index(vma, address))
728 set_pte_at(mm, address, pte, pgoff_to_pte(page->index));
729
730 /* Move the dirty bit to the physical page now the pte is gone. */
731 if (pte_dirty(pteval))
732 set_page_dirty(page);
733
734 page_remove_rmap(page);
735 page_cache_release(page);
Hugh Dickins42946212005-10-29 18:16:05 -0700736 dec_mm_counter(mm, file_rss);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700737 (*mapcount)--;
738 }
Hugh Dickinsc0718802005-10-29 18:16:31 -0700739 pte_unmap_unlock(pte - 1, ptl);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700740}
741
Christoph Lametera48d07a2006-02-01 03:05:38 -0800742static int try_to_unmap_anon(struct page *page, int ignore_refs)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700743{
744 struct anon_vma *anon_vma;
745 struct vm_area_struct *vma;
746 int ret = SWAP_AGAIN;
747
748 anon_vma = page_lock_anon_vma(page);
749 if (!anon_vma)
750 return ret;
751
752 list_for_each_entry(vma, &anon_vma->head, anon_vma_node) {
Christoph Lametera48d07a2006-02-01 03:05:38 -0800753 ret = try_to_unmap_one(page, vma, ignore_refs);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700754 if (ret == SWAP_FAIL || !page_mapped(page))
755 break;
756 }
757 spin_unlock(&anon_vma->lock);
758 return ret;
759}
760
761/**
762 * try_to_unmap_file - unmap file page using the object-based rmap method
763 * @page: the page to unmap
764 *
765 * Find all the mappings of a page using the mapping pointer and the vma chains
766 * contained in the address_space struct it points to.
767 *
768 * This function is only called from try_to_unmap for object-based pages.
769 */
Christoph Lametera48d07a2006-02-01 03:05:38 -0800770static int try_to_unmap_file(struct page *page, int ignore_refs)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700771{
772 struct address_space *mapping = page->mapping;
773 pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
774 struct vm_area_struct *vma;
775 struct prio_tree_iter iter;
776 int ret = SWAP_AGAIN;
777 unsigned long cursor;
778 unsigned long max_nl_cursor = 0;
779 unsigned long max_nl_size = 0;
780 unsigned int mapcount;
781
782 spin_lock(&mapping->i_mmap_lock);
783 vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
Christoph Lametera48d07a2006-02-01 03:05:38 -0800784 ret = try_to_unmap_one(page, vma, ignore_refs);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700785 if (ret == SWAP_FAIL || !page_mapped(page))
786 goto out;
787 }
788
789 if (list_empty(&mapping->i_mmap_nonlinear))
790 goto out;
791
792 list_for_each_entry(vma, &mapping->i_mmap_nonlinear,
793 shared.vm_set.list) {
Hugh Dickins101d2be2005-11-21 21:32:16 -0800794 if (vma->vm_flags & VM_LOCKED)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700795 continue;
796 cursor = (unsigned long) vma->vm_private_data;
797 if (cursor > max_nl_cursor)
798 max_nl_cursor = cursor;
799 cursor = vma->vm_end - vma->vm_start;
800 if (cursor > max_nl_size)
801 max_nl_size = cursor;
802 }
803
804 if (max_nl_size == 0) { /* any nonlinears locked or reserved */
805 ret = SWAP_FAIL;
806 goto out;
807 }
808
809 /*
810 * We don't try to search for this page in the nonlinear vmas,
811 * and page_referenced wouldn't have found it anyway. Instead
812 * just walk the nonlinear vmas trying to age and unmap some.
813 * The mapcount of the page we came in with is irrelevant,
814 * but even so use it as a guide to how hard we should try?
815 */
816 mapcount = page_mapcount(page);
817 if (!mapcount)
818 goto out;
819 cond_resched_lock(&mapping->i_mmap_lock);
820
821 max_nl_size = (max_nl_size + CLUSTER_SIZE - 1) & CLUSTER_MASK;
822 if (max_nl_cursor == 0)
823 max_nl_cursor = CLUSTER_SIZE;
824
825 do {
826 list_for_each_entry(vma, &mapping->i_mmap_nonlinear,
827 shared.vm_set.list) {
Hugh Dickins101d2be2005-11-21 21:32:16 -0800828 if (vma->vm_flags & VM_LOCKED)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700829 continue;
830 cursor = (unsigned long) vma->vm_private_data;
Hugh Dickins839b9682005-09-03 15:54:43 -0700831 while ( cursor < max_nl_cursor &&
Linus Torvalds1da177e2005-04-16 15:20:36 -0700832 cursor < vma->vm_end - vma->vm_start) {
833 try_to_unmap_cluster(cursor, &mapcount, vma);
834 cursor += CLUSTER_SIZE;
835 vma->vm_private_data = (void *) cursor;
836 if ((int)mapcount <= 0)
837 goto out;
838 }
839 vma->vm_private_data = (void *) max_nl_cursor;
840 }
841 cond_resched_lock(&mapping->i_mmap_lock);
842 max_nl_cursor += CLUSTER_SIZE;
843 } while (max_nl_cursor <= max_nl_size);
844
845 /*
846 * Don't loop forever (perhaps all the remaining pages are
847 * in locked vmas). Reset cursor on all unreserved nonlinear
848 * vmas, now forgetting on which ones it had fallen behind.
849 */
Hugh Dickins101d2be2005-11-21 21:32:16 -0800850 list_for_each_entry(vma, &mapping->i_mmap_nonlinear, shared.vm_set.list)
851 vma->vm_private_data = NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700852out:
853 spin_unlock(&mapping->i_mmap_lock);
854 return ret;
855}
856
857/**
858 * try_to_unmap - try to remove all page table mappings to a page
859 * @page: the page to get unmapped
860 *
861 * Tries to remove all the page table entries which are mapping this
862 * page, used in the pageout path. Caller must hold the page lock.
863 * Return values are:
864 *
865 * SWAP_SUCCESS - we succeeded in removing all mappings
866 * SWAP_AGAIN - we missed a mapping, try again later
867 * SWAP_FAIL - the page is unswappable
868 */
Christoph Lametera48d07a2006-02-01 03:05:38 -0800869int try_to_unmap(struct page *page, int ignore_refs)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700870{
871 int ret;
872
Linus Torvalds1da177e2005-04-16 15:20:36 -0700873 BUG_ON(!PageLocked(page));
874
875 if (PageAnon(page))
Christoph Lametera48d07a2006-02-01 03:05:38 -0800876 ret = try_to_unmap_anon(page, ignore_refs);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700877 else
Christoph Lametera48d07a2006-02-01 03:05:38 -0800878 ret = try_to_unmap_file(page, ignore_refs);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700879
880 if (!page_mapped(page))
881 ret = SWAP_SUCCESS;
882 return ret;
883}
Nikita Danilov81b40822005-05-01 08:58:36 -0700884