Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1 | #include <linux/kernel.h> |
| 2 | #include <linux/errno.h> |
| 3 | #include <linux/err.h> |
| 4 | #include <linux/spinlock.h> |
| 5 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 6 | #include <linux/mm.h> |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 7 | #include <linux/memremap.h> |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 8 | #include <linux/pagemap.h> |
| 9 | #include <linux/rmap.h> |
| 10 | #include <linux/swap.h> |
| 11 | #include <linux/swapops.h> |
| 12 | |
Ingo Molnar | 174cd4b | 2017-02-02 19:15:33 +0100 | [diff] [blame] | 13 | #include <linux/sched/signal.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 14 | #include <linux/rwsem.h> |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 15 | #include <linux/hugetlb.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 16 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 17 | #include <asm/mmu_context.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 18 | #include <asm/pgtable.h> |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 19 | #include <asm/tlbflush.h> |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 20 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 21 | #include "internal.h" |
| 22 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 23 | static struct page *no_page_table(struct vm_area_struct *vma, |
| 24 | unsigned int flags) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 25 | { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 26 | /* |
| 27 | * When core dumping an enormous anonymous area that nobody |
| 28 | * has touched so far, we don't want to allocate unnecessary pages or |
| 29 | * page tables. Return error instead of NULL to skip handle_mm_fault, |
| 30 | * then get_dump_page() will return NULL to leave a hole in the dump. |
| 31 | * But we can only make this optimization where a hole would surely |
| 32 | * be zero-filled if handle_mm_fault() actually did handle it. |
| 33 | */ |
| 34 | if ((flags & FOLL_DUMP) && (!vma->vm_ops || !vma->vm_ops->fault)) |
| 35 | return ERR_PTR(-EFAULT); |
| 36 | return NULL; |
| 37 | } |
| 38 | |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 39 | static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, |
| 40 | pte_t *pte, unsigned int flags) |
| 41 | { |
| 42 | /* No page to get reference */ |
| 43 | if (flags & FOLL_GET) |
| 44 | return -EFAULT; |
| 45 | |
| 46 | if (flags & FOLL_TOUCH) { |
| 47 | pte_t entry = *pte; |
| 48 | |
| 49 | if (flags & FOLL_WRITE) |
| 50 | entry = pte_mkdirty(entry); |
| 51 | entry = pte_mkyoung(entry); |
| 52 | |
| 53 | if (!pte_same(*pte, entry)) { |
| 54 | set_pte_at(vma->vm_mm, address, pte, entry); |
| 55 | update_mmu_cache(vma, address, pte); |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | /* Proper page table entry exists, but no corresponding struct page */ |
| 60 | return -EEXIST; |
| 61 | } |
| 62 | |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 63 | /* |
| 64 | * FOLL_FORCE can write to even unwritable pte's, but only |
| 65 | * after we've gone through a COW cycle and they are dirty. |
| 66 | */ |
| 67 | static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) |
| 68 | { |
| 69 | return pte_write(pte) || |
| 70 | ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); |
| 71 | } |
| 72 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 73 | static struct page *follow_page_pte(struct vm_area_struct *vma, |
| 74 | unsigned long address, pmd_t *pmd, unsigned int flags) |
| 75 | { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 76 | struct mm_struct *mm = vma->vm_mm; |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 77 | struct dev_pagemap *pgmap = NULL; |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 78 | struct page *page; |
| 79 | spinlock_t *ptl; |
| 80 | pte_t *ptep, pte; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 81 | |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 82 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 83 | if (unlikely(pmd_bad(*pmd))) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 84 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 85 | |
| 86 | ptep = pte_offset_map_lock(mm, pmd, address, &ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 87 | pte = *ptep; |
| 88 | if (!pte_present(pte)) { |
| 89 | swp_entry_t entry; |
| 90 | /* |
| 91 | * KSM's break_ksm() relies upon recognizing a ksm page |
| 92 | * even while it is being migrated, so for that case we |
| 93 | * need migration_entry_wait(). |
| 94 | */ |
| 95 | if (likely(!(flags & FOLL_MIGRATION))) |
| 96 | goto no_page; |
Kirill A. Shutemov | 0661a33 | 2015-02-10 14:10:04 -0800 | [diff] [blame] | 97 | if (pte_none(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 98 | goto no_page; |
| 99 | entry = pte_to_swp_entry(pte); |
| 100 | if (!is_migration_entry(entry)) |
| 101 | goto no_page; |
| 102 | pte_unmap_unlock(ptep, ptl); |
| 103 | migration_entry_wait(mm, pmd, address); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 104 | goto retry; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 105 | } |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 106 | if ((flags & FOLL_NUMA) && pte_protnone(pte)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 107 | goto no_page; |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 108 | if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 109 | pte_unmap_unlock(ptep, ptl); |
| 110 | return NULL; |
| 111 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 112 | |
| 113 | page = vm_normal_page(vma, address, pte); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 114 | if (!page && pte_devmap(pte) && (flags & FOLL_GET)) { |
| 115 | /* |
| 116 | * Only return device mapping pages in the FOLL_GET case since |
| 117 | * they are only valid while holding the pgmap reference. |
| 118 | */ |
| 119 | pgmap = get_dev_pagemap(pte_pfn(pte), NULL); |
| 120 | if (pgmap) |
| 121 | page = pte_page(pte); |
| 122 | else |
| 123 | goto no_page; |
| 124 | } else if (unlikely(!page)) { |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 125 | if (flags & FOLL_DUMP) { |
| 126 | /* Avoid special (like zero) pages in core dumps */ |
| 127 | page = ERR_PTR(-EFAULT); |
| 128 | goto out; |
| 129 | } |
| 130 | |
| 131 | if (is_zero_pfn(pte_pfn(pte))) { |
| 132 | page = pte_page(pte); |
| 133 | } else { |
| 134 | int ret; |
| 135 | |
| 136 | ret = follow_pfn_pte(vma, address, ptep, flags); |
| 137 | page = ERR_PTR(ret); |
| 138 | goto out; |
| 139 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 140 | } |
| 141 | |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 142 | if (flags & FOLL_SPLIT && PageTransCompound(page)) { |
| 143 | int ret; |
| 144 | get_page(page); |
| 145 | pte_unmap_unlock(ptep, ptl); |
| 146 | lock_page(page); |
| 147 | ret = split_huge_page(page); |
| 148 | unlock_page(page); |
| 149 | put_page(page); |
| 150 | if (ret) |
| 151 | return ERR_PTR(ret); |
| 152 | goto retry; |
| 153 | } |
| 154 | |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 155 | if (flags & FOLL_GET) { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 156 | get_page(page); |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 157 | |
| 158 | /* drop the pgmap reference now that we hold the page */ |
| 159 | if (pgmap) { |
| 160 | put_dev_pagemap(pgmap); |
| 161 | pgmap = NULL; |
| 162 | } |
| 163 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 164 | if (flags & FOLL_TOUCH) { |
| 165 | if ((flags & FOLL_WRITE) && |
| 166 | !pte_dirty(pte) && !PageDirty(page)) |
| 167 | set_page_dirty(page); |
| 168 | /* |
| 169 | * pte_mkyoung() would be more correct here, but atomic care |
| 170 | * is needed to avoid losing the dirty bit: it is easier to use |
| 171 | * mark_page_accessed(). |
| 172 | */ |
| 173 | mark_page_accessed(page); |
| 174 | } |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 175 | if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) { |
Kirill A. Shutemov | e90309c | 2016-01-15 16:54:33 -0800 | [diff] [blame] | 176 | /* Do not mlock pte-mapped THP */ |
| 177 | if (PageTransCompound(page)) |
| 178 | goto out; |
| 179 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 180 | /* |
| 181 | * The preliminary mapping check is mainly to avoid the |
| 182 | * pointless overhead of lock_page on the ZERO_PAGE |
| 183 | * which might bounce very badly if there is contention. |
| 184 | * |
| 185 | * If the page is already locked, we don't need to |
| 186 | * handle it now - vmscan will handle it later if and |
| 187 | * when it attempts to reclaim the page. |
| 188 | */ |
| 189 | if (page->mapping && trylock_page(page)) { |
| 190 | lru_add_drain(); /* push cached pages to LRU */ |
| 191 | /* |
| 192 | * Because we lock page here, and migration is |
| 193 | * blocked by the pte's page reference, and we |
| 194 | * know the page is still mapped, we don't even |
| 195 | * need to check for file-cache page truncation. |
| 196 | */ |
| 197 | mlock_vma_page(page); |
| 198 | unlock_page(page); |
| 199 | } |
| 200 | } |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 201 | out: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 202 | pte_unmap_unlock(ptep, ptl); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 203 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 204 | no_page: |
| 205 | pte_unmap_unlock(ptep, ptl); |
| 206 | if (!pte_none(pte)) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 207 | return NULL; |
| 208 | return no_page_table(vma, flags); |
| 209 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 210 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 211 | static struct page *follow_pmd_mask(struct vm_area_struct *vma, |
| 212 | unsigned long address, pud_t *pudp, |
| 213 | unsigned int flags, unsigned int *page_mask) |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 214 | { |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 215 | pmd_t *pmd; |
| 216 | spinlock_t *ptl; |
| 217 | struct page *page; |
| 218 | struct mm_struct *mm = vma->vm_mm; |
| 219 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 220 | pmd = pmd_offset(pudp, address); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 221 | if (pmd_none(*pmd)) |
| 222 | return no_page_table(vma, flags); |
| 223 | if (pmd_huge(*pmd) && vma->vm_flags & VM_HUGETLB) { |
Naoya Horiguchi | e66f17f | 2015-02-11 15:25:22 -0800 | [diff] [blame] | 224 | page = follow_huge_pmd(mm, address, pmd, flags); |
| 225 | if (page) |
| 226 | return page; |
| 227 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 228 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 229 | if (is_hugepd(__hugepd(pmd_val(*pmd)))) { |
| 230 | page = follow_huge_pd(vma, address, |
| 231 | __hugepd(pmd_val(*pmd)), flags, |
| 232 | PMD_SHIFT); |
| 233 | if (page) |
| 234 | return page; |
| 235 | return no_page_table(vma, flags); |
| 236 | } |
Dan Williams | 3565fce | 2016-01-15 16:56:55 -0800 | [diff] [blame] | 237 | if (pmd_devmap(*pmd)) { |
| 238 | ptl = pmd_lock(mm, pmd); |
| 239 | page = follow_devmap_pmd(vma, address, pmd, flags); |
| 240 | spin_unlock(ptl); |
| 241 | if (page) |
| 242 | return page; |
| 243 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 244 | if (likely(!pmd_trans_huge(*pmd))) |
| 245 | return follow_page_pte(vma, address, pmd, flags); |
| 246 | |
Aneesh Kumar K.V | db08f20 | 2017-02-24 14:59:53 -0800 | [diff] [blame] | 247 | if ((flags & FOLL_NUMA) && pmd_protnone(*pmd)) |
| 248 | return no_page_table(vma, flags); |
| 249 | |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 250 | ptl = pmd_lock(mm, pmd); |
| 251 | if (unlikely(!pmd_trans_huge(*pmd))) { |
| 252 | spin_unlock(ptl); |
| 253 | return follow_page_pte(vma, address, pmd, flags); |
Kirill A. Shutemov | 69e68b4 | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 254 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 255 | if (flags & FOLL_SPLIT) { |
| 256 | int ret; |
| 257 | page = pmd_page(*pmd); |
| 258 | if (is_huge_zero_page(page)) { |
| 259 | spin_unlock(ptl); |
| 260 | ret = 0; |
Kirill A. Shutemov | 78ddc53 | 2016-01-15 16:52:42 -0800 | [diff] [blame] | 261 | split_huge_pmd(vma, pmd, address); |
Naoya Horiguchi | 337d9ab | 2016-07-26 15:24:03 -0700 | [diff] [blame] | 262 | if (pmd_trans_unstable(pmd)) |
| 263 | ret = -EBUSY; |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 264 | } else { |
| 265 | get_page(page); |
| 266 | spin_unlock(ptl); |
| 267 | lock_page(page); |
| 268 | ret = split_huge_page(page); |
| 269 | unlock_page(page); |
| 270 | put_page(page); |
Kirill A. Shutemov | baa355f | 2016-07-26 15:25:51 -0700 | [diff] [blame] | 271 | if (pmd_none(*pmd)) |
| 272 | return no_page_table(vma, flags); |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 273 | } |
| 274 | |
| 275 | return ret ? ERR_PTR(ret) : |
| 276 | follow_page_pte(vma, address, pmd, flags); |
| 277 | } |
Kirill A. Shutemov | 6742d29 | 2016-01-15 16:52:28 -0800 | [diff] [blame] | 278 | page = follow_trans_huge_pmd(vma, address, pmd, flags); |
| 279 | spin_unlock(ptl); |
| 280 | *page_mask = HPAGE_PMD_NR - 1; |
| 281 | return page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 282 | } |
| 283 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 284 | |
| 285 | static struct page *follow_pud_mask(struct vm_area_struct *vma, |
| 286 | unsigned long address, p4d_t *p4dp, |
| 287 | unsigned int flags, unsigned int *page_mask) |
| 288 | { |
| 289 | pud_t *pud; |
| 290 | spinlock_t *ptl; |
| 291 | struct page *page; |
| 292 | struct mm_struct *mm = vma->vm_mm; |
| 293 | |
| 294 | pud = pud_offset(p4dp, address); |
| 295 | if (pud_none(*pud)) |
| 296 | return no_page_table(vma, flags); |
| 297 | if (pud_huge(*pud) && vma->vm_flags & VM_HUGETLB) { |
| 298 | page = follow_huge_pud(mm, address, pud, flags); |
| 299 | if (page) |
| 300 | return page; |
| 301 | return no_page_table(vma, flags); |
| 302 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 303 | if (is_hugepd(__hugepd(pud_val(*pud)))) { |
| 304 | page = follow_huge_pd(vma, address, |
| 305 | __hugepd(pud_val(*pud)), flags, |
| 306 | PUD_SHIFT); |
| 307 | if (page) |
| 308 | return page; |
| 309 | return no_page_table(vma, flags); |
| 310 | } |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 311 | if (pud_devmap(*pud)) { |
| 312 | ptl = pud_lock(mm, pud); |
| 313 | page = follow_devmap_pud(vma, address, pud, flags); |
| 314 | spin_unlock(ptl); |
| 315 | if (page) |
| 316 | return page; |
| 317 | } |
| 318 | if (unlikely(pud_bad(*pud))) |
| 319 | return no_page_table(vma, flags); |
| 320 | |
| 321 | return follow_pmd_mask(vma, address, pud, flags, page_mask); |
| 322 | } |
| 323 | |
| 324 | |
| 325 | static struct page *follow_p4d_mask(struct vm_area_struct *vma, |
| 326 | unsigned long address, pgd_t *pgdp, |
| 327 | unsigned int flags, unsigned int *page_mask) |
| 328 | { |
| 329 | p4d_t *p4d; |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 330 | struct page *page; |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 331 | |
| 332 | p4d = p4d_offset(pgdp, address); |
| 333 | if (p4d_none(*p4d)) |
| 334 | return no_page_table(vma, flags); |
| 335 | BUILD_BUG_ON(p4d_huge(*p4d)); |
| 336 | if (unlikely(p4d_bad(*p4d))) |
| 337 | return no_page_table(vma, flags); |
| 338 | |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 339 | if (is_hugepd(__hugepd(p4d_val(*p4d)))) { |
| 340 | page = follow_huge_pd(vma, address, |
| 341 | __hugepd(p4d_val(*p4d)), flags, |
| 342 | P4D_SHIFT); |
| 343 | if (page) |
| 344 | return page; |
| 345 | return no_page_table(vma, flags); |
| 346 | } |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 347 | return follow_pud_mask(vma, address, p4d, flags, page_mask); |
| 348 | } |
| 349 | |
| 350 | /** |
| 351 | * follow_page_mask - look up a page descriptor from a user-virtual address |
| 352 | * @vma: vm_area_struct mapping @address |
| 353 | * @address: virtual address to look up |
| 354 | * @flags: flags modifying lookup behaviour |
| 355 | * @page_mask: on output, *page_mask is set according to the size of the page |
| 356 | * |
| 357 | * @flags can have FOLL_ flags set, defined in <linux/mm.h> |
| 358 | * |
| 359 | * Returns the mapped (struct page *), %NULL if no mapping exists, or |
| 360 | * an error pointer if there is a mapping to something not represented |
| 361 | * by a page descriptor (see also vm_normal_page()). |
| 362 | */ |
| 363 | struct page *follow_page_mask(struct vm_area_struct *vma, |
| 364 | unsigned long address, unsigned int flags, |
| 365 | unsigned int *page_mask) |
| 366 | { |
| 367 | pgd_t *pgd; |
| 368 | struct page *page; |
| 369 | struct mm_struct *mm = vma->vm_mm; |
| 370 | |
| 371 | *page_mask = 0; |
| 372 | |
| 373 | /* make this handle hugepd */ |
| 374 | page = follow_huge_addr(mm, address, flags & FOLL_WRITE); |
| 375 | if (!IS_ERR(page)) { |
| 376 | BUG_ON(flags & FOLL_GET); |
| 377 | return page; |
| 378 | } |
| 379 | |
| 380 | pgd = pgd_offset(mm, address); |
| 381 | |
| 382 | if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd))) |
| 383 | return no_page_table(vma, flags); |
| 384 | |
Anshuman Khandual | faaa5b6 | 2017-07-06 15:38:50 -0700 | [diff] [blame] | 385 | if (pgd_huge(*pgd)) { |
| 386 | page = follow_huge_pgd(mm, address, pgd, flags); |
| 387 | if (page) |
| 388 | return page; |
| 389 | return no_page_table(vma, flags); |
| 390 | } |
Aneesh Kumar K.V | 4dc7145 | 2017-07-06 15:38:56 -0700 | [diff] [blame] | 391 | if (is_hugepd(__hugepd(pgd_val(*pgd)))) { |
| 392 | page = follow_huge_pd(vma, address, |
| 393 | __hugepd(pgd_val(*pgd)), flags, |
| 394 | PGDIR_SHIFT); |
| 395 | if (page) |
| 396 | return page; |
| 397 | return no_page_table(vma, flags); |
| 398 | } |
Anshuman Khandual | faaa5b6 | 2017-07-06 15:38:50 -0700 | [diff] [blame] | 399 | |
Aneesh Kumar K.V | 080dbb6 | 2017-07-06 15:38:44 -0700 | [diff] [blame] | 400 | return follow_p4d_mask(vma, address, pgd, flags, page_mask); |
| 401 | } |
| 402 | |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 403 | static int get_gate_page(struct mm_struct *mm, unsigned long address, |
| 404 | unsigned int gup_flags, struct vm_area_struct **vma, |
| 405 | struct page **page) |
| 406 | { |
| 407 | pgd_t *pgd; |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 408 | p4d_t *p4d; |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 409 | pud_t *pud; |
| 410 | pmd_t *pmd; |
| 411 | pte_t *pte; |
| 412 | int ret = -EFAULT; |
| 413 | |
| 414 | /* user gate pages are read-only */ |
| 415 | if (gup_flags & FOLL_WRITE) |
| 416 | return -EFAULT; |
| 417 | if (address > TASK_SIZE) |
| 418 | pgd = pgd_offset_k(address); |
| 419 | else |
| 420 | pgd = pgd_offset_gate(mm, address); |
| 421 | BUG_ON(pgd_none(*pgd)); |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 422 | p4d = p4d_offset(pgd, address); |
| 423 | BUG_ON(p4d_none(*p4d)); |
| 424 | pud = pud_offset(p4d, address); |
Kirill A. Shutemov | f2b495c | 2014-06-04 16:08:11 -0700 | [diff] [blame] | 425 | BUG_ON(pud_none(*pud)); |
| 426 | pmd = pmd_offset(pud, address); |
| 427 | if (pmd_none(*pmd)) |
| 428 | return -EFAULT; |
| 429 | VM_BUG_ON(pmd_trans_huge(*pmd)); |
| 430 | pte = pte_offset_map(pmd, address); |
| 431 | if (pte_none(*pte)) |
| 432 | goto unmap; |
| 433 | *vma = get_gate_vma(mm); |
| 434 | if (!page) |
| 435 | goto out; |
| 436 | *page = vm_normal_page(*vma, address, *pte); |
| 437 | if (!*page) { |
| 438 | if ((gup_flags & FOLL_DUMP) || !is_zero_pfn(pte_pfn(*pte))) |
| 439 | goto unmap; |
| 440 | *page = pte_page(*pte); |
| 441 | } |
| 442 | get_page(*page); |
| 443 | out: |
| 444 | ret = 0; |
| 445 | unmap: |
| 446 | pte_unmap(pte); |
| 447 | return ret; |
| 448 | } |
| 449 | |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 450 | /* |
| 451 | * mmap_sem must be held on entry. If @nonblocking != NULL and |
| 452 | * *@flags does not include FOLL_NOWAIT, the mmap_sem may be released. |
| 453 | * If it is, *@nonblocking will be set to 0 and -EBUSY returned. |
| 454 | */ |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 455 | static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, |
| 456 | unsigned long address, unsigned int *flags, int *nonblocking) |
| 457 | { |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 458 | unsigned int fault_flags = 0; |
| 459 | int ret; |
| 460 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 461 | /* mlock all present pages, but do not fault in new pages */ |
| 462 | if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK) |
| 463 | return -ENOENT; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 464 | if (*flags & FOLL_WRITE) |
| 465 | fault_flags |= FAULT_FLAG_WRITE; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 466 | if (*flags & FOLL_REMOTE) |
| 467 | fault_flags |= FAULT_FLAG_REMOTE; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 468 | if (nonblocking) |
| 469 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 470 | if (*flags & FOLL_NOWAIT) |
| 471 | fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_RETRY_NOWAIT; |
Andres Lagar-Cavilla | 234b239 | 2014-09-17 10:51:48 -0700 | [diff] [blame] | 472 | if (*flags & FOLL_TRIED) { |
| 473 | VM_WARN_ON_ONCE(fault_flags & FAULT_FLAG_ALLOW_RETRY); |
| 474 | fault_flags |= FAULT_FLAG_TRIED; |
| 475 | } |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 476 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 477 | ret = handle_mm_fault(vma, address, fault_flags); |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 478 | if (ret & VM_FAULT_ERROR) { |
James Morse | 9a291a7 | 2017-06-02 14:46:46 -0700 | [diff] [blame] | 479 | int err = vm_fault_to_errno(ret, *flags); |
| 480 | |
| 481 | if (err) |
| 482 | return err; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 483 | BUG(); |
| 484 | } |
| 485 | |
| 486 | if (tsk) { |
| 487 | if (ret & VM_FAULT_MAJOR) |
| 488 | tsk->maj_flt++; |
| 489 | else |
| 490 | tsk->min_flt++; |
| 491 | } |
| 492 | |
| 493 | if (ret & VM_FAULT_RETRY) { |
| 494 | if (nonblocking) |
| 495 | *nonblocking = 0; |
| 496 | return -EBUSY; |
| 497 | } |
| 498 | |
| 499 | /* |
| 500 | * The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when |
| 501 | * necessary, even if maybe_mkwrite decided not to set pte_write. We |
| 502 | * can thus safely do subsequent page lookups as if they were reads. |
| 503 | * But only do so when looping for pte_write is futile: in some cases |
| 504 | * userspace may also be wanting to write to the gotten user page, |
| 505 | * which a read fault here might prevent (a readonly page might get |
| 506 | * reCOWed by userspace write). |
| 507 | */ |
| 508 | if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE)) |
Linus Torvalds | 19be0ea | 2016-10-13 13:07:36 -0700 | [diff] [blame] | 509 | *flags |= FOLL_COW; |
Kirill A. Shutemov | 1674448 | 2014-06-04 16:08:12 -0700 | [diff] [blame] | 510 | return 0; |
| 511 | } |
| 512 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 513 | static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) |
| 514 | { |
| 515 | vm_flags_t vm_flags = vma->vm_flags; |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 516 | int write = (gup_flags & FOLL_WRITE); |
| 517 | int foreign = (gup_flags & FOLL_REMOTE); |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 518 | |
| 519 | if (vm_flags & (VM_IO | VM_PFNMAP)) |
| 520 | return -EFAULT; |
| 521 | |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 522 | if (write) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 523 | if (!(vm_flags & VM_WRITE)) { |
| 524 | if (!(gup_flags & FOLL_FORCE)) |
| 525 | return -EFAULT; |
| 526 | /* |
| 527 | * We used to let the write,force case do COW in a |
| 528 | * VM_MAYWRITE VM_SHARED !VM_WRITE vma, so ptrace could |
| 529 | * set a breakpoint in a read-only mapping of an |
| 530 | * executable, without corrupting the file (yet only |
| 531 | * when that file had been opened for writing!). |
| 532 | * Anon pages in shared mappings are surprising: now |
| 533 | * just reject it. |
| 534 | */ |
Hugh Dickins | 4643536 | 2016-01-30 18:03:16 -0800 | [diff] [blame] | 535 | if (!is_cow_mapping(vm_flags)) |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 536 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 537 | } |
| 538 | } else if (!(vm_flags & VM_READ)) { |
| 539 | if (!(gup_flags & FOLL_FORCE)) |
| 540 | return -EFAULT; |
| 541 | /* |
| 542 | * Is there actually any vma we can reach here which does not |
| 543 | * have VM_MAYREAD set? |
| 544 | */ |
| 545 | if (!(vm_flags & VM_MAYREAD)) |
| 546 | return -EFAULT; |
| 547 | } |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 548 | /* |
| 549 | * gups are always data accesses, not instruction |
| 550 | * fetches, so execute=false here |
| 551 | */ |
| 552 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 553 | return -EFAULT; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 554 | return 0; |
| 555 | } |
| 556 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 557 | /** |
| 558 | * __get_user_pages() - pin user pages in memory |
| 559 | * @tsk: task_struct of target task |
| 560 | * @mm: mm_struct of target mm |
| 561 | * @start: starting user address |
| 562 | * @nr_pages: number of pages from start to pin |
| 563 | * @gup_flags: flags modifying pin behaviour |
| 564 | * @pages: array that receives pointers to the pages pinned. |
| 565 | * Should be at least nr_pages long. Or NULL, if caller |
| 566 | * only intends to ensure the pages are faulted in. |
| 567 | * @vmas: array of pointers to vmas corresponding to each page. |
| 568 | * Or NULL if the caller does not require them. |
| 569 | * @nonblocking: whether waiting for disk IO or mmap_sem contention |
| 570 | * |
| 571 | * Returns number of pages pinned. This may be fewer than the number |
| 572 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 573 | * were pinned, returns -errno. Each page returned must be released |
| 574 | * with a put_page() call when it is finished with. vmas will only |
| 575 | * remain valid while mmap_sem is held. |
| 576 | * |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 577 | * Must be called with mmap_sem held. It may be released. See below. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 578 | * |
| 579 | * __get_user_pages walks a process's page tables and takes a reference to |
| 580 | * each struct page that each user address corresponds to at a given |
| 581 | * instant. That is, it takes the page that would be accessed if a user |
| 582 | * thread accesses the given user virtual address at that instant. |
| 583 | * |
| 584 | * This does not guarantee that the page exists in the user mappings when |
| 585 | * __get_user_pages returns, and there may even be a completely different |
| 586 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 587 | * and subsequently re faulted). However it does guarantee that the page |
| 588 | * won't be freed completely. And mostly callers simply care that the page |
| 589 | * contains data that was valid *at some point in time*. Typically, an IO |
| 590 | * or similar operation cannot guarantee anything stronger anyway because |
| 591 | * locks can't be held over the syscall boundary. |
| 592 | * |
| 593 | * If @gup_flags & FOLL_WRITE == 0, the page must not be written to. If |
| 594 | * the page is written to, set_page_dirty (or set_page_dirty_lock, as |
| 595 | * appropriate) must be called after the page is finished with, and |
| 596 | * before put_page is called. |
| 597 | * |
| 598 | * If @nonblocking != NULL, __get_user_pages will not wait for disk IO |
| 599 | * or mmap_sem contention, and if waiting is needed to pin all pages, |
Paul Cassella | 9a95f3c | 2014-08-06 16:07:24 -0700 | [diff] [blame] | 600 | * *@nonblocking will be set to 0. Further, if @gup_flags does not |
| 601 | * include FOLL_NOWAIT, the mmap_sem will be released via up_read() in |
| 602 | * this case. |
| 603 | * |
| 604 | * A caller using such a combination of @nonblocking and @gup_flags |
| 605 | * must therefore hold the mmap_sem for reading only, and recognize |
| 606 | * when it's been released. Otherwise, it must be held for either |
| 607 | * reading or writing and will not be released. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 608 | * |
| 609 | * In most cases, get_user_pages or get_user_pages_fast should be used |
| 610 | * instead of __get_user_pages. __get_user_pages should be used only if |
| 611 | * you need some special @gup_flags. |
| 612 | */ |
Lorenzo Stoakes | 0d73175 | 2016-10-24 10:57:25 +0100 | [diff] [blame] | 613 | static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm, |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 614 | unsigned long start, unsigned long nr_pages, |
| 615 | unsigned int gup_flags, struct page **pages, |
| 616 | struct vm_area_struct **vmas, int *nonblocking) |
| 617 | { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 618 | long i = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 619 | unsigned int page_mask; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 620 | struct vm_area_struct *vma = NULL; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 621 | |
| 622 | if (!nr_pages) |
| 623 | return 0; |
| 624 | |
| 625 | VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET)); |
| 626 | |
| 627 | /* |
| 628 | * If FOLL_FORCE is set then do not force a full fault as the hinting |
| 629 | * fault information is unrelated to the reference behaviour of a task |
| 630 | * using the address space |
| 631 | */ |
| 632 | if (!(gup_flags & FOLL_FORCE)) |
| 633 | gup_flags |= FOLL_NUMA; |
| 634 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 635 | do { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 636 | struct page *page; |
| 637 | unsigned int foll_flags = gup_flags; |
| 638 | unsigned int page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 639 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 640 | /* first iteration or cross vma bound */ |
| 641 | if (!vma || start >= vma->vm_end) { |
| 642 | vma = find_extend_vma(mm, start); |
| 643 | if (!vma && in_gate_area(mm, start)) { |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 644 | int ret; |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 645 | ret = get_gate_page(mm, start & PAGE_MASK, |
| 646 | gup_flags, &vma, |
| 647 | pages ? &pages[i] : NULL); |
| 648 | if (ret) |
| 649 | return i ? : ret; |
| 650 | page_mask = 0; |
| 651 | goto next_page; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 652 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 653 | |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 654 | if (!vma || check_vma_flags(vma, gup_flags)) |
| 655 | return i ? : -EFAULT; |
| 656 | if (is_vm_hugetlb_page(vma)) { |
| 657 | i = follow_hugetlb_page(mm, vma, pages, vmas, |
| 658 | &start, &nr_pages, i, |
Andrea Arcangeli | 87ffc11 | 2017-02-22 15:43:13 -0800 | [diff] [blame] | 659 | gup_flags, nonblocking); |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 660 | continue; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 661 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 662 | } |
| 663 | retry: |
| 664 | /* |
| 665 | * If we have a pending SIGKILL, don't keep faulting pages and |
| 666 | * potentially allocating memory. |
| 667 | */ |
| 668 | if (unlikely(fatal_signal_pending(current))) |
| 669 | return i ? i : -ERESTARTSYS; |
| 670 | cond_resched(); |
| 671 | page = follow_page_mask(vma, start, foll_flags, &page_mask); |
| 672 | if (!page) { |
| 673 | int ret; |
| 674 | ret = faultin_page(tsk, vma, start, &foll_flags, |
| 675 | nonblocking); |
| 676 | switch (ret) { |
| 677 | case 0: |
| 678 | goto retry; |
| 679 | case -EFAULT: |
| 680 | case -ENOMEM: |
| 681 | case -EHWPOISON: |
| 682 | return i ? i : ret; |
| 683 | case -EBUSY: |
| 684 | return i; |
| 685 | case -ENOENT: |
| 686 | goto next_page; |
| 687 | } |
| 688 | BUG(); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 689 | } else if (PTR_ERR(page) == -EEXIST) { |
| 690 | /* |
| 691 | * Proper page table entry exists, but no corresponding |
| 692 | * struct page. |
| 693 | */ |
| 694 | goto next_page; |
| 695 | } else if (IS_ERR(page)) { |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 696 | return i ? i : PTR_ERR(page); |
Kirill A. Shutemov | 1027e44 | 2015-09-04 15:47:55 -0700 | [diff] [blame] | 697 | } |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 698 | if (pages) { |
| 699 | pages[i] = page; |
| 700 | flush_anon_page(vma, page, start); |
| 701 | flush_dcache_page(page); |
| 702 | page_mask = 0; |
| 703 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 704 | next_page: |
Kirill A. Shutemov | fa5bb20 | 2014-06-04 16:08:13 -0700 | [diff] [blame] | 705 | if (vmas) { |
| 706 | vmas[i] = vma; |
| 707 | page_mask = 0; |
| 708 | } |
| 709 | page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask); |
| 710 | if (page_increm > nr_pages) |
| 711 | page_increm = nr_pages; |
| 712 | i += page_increm; |
| 713 | start += page_increm * PAGE_SIZE; |
| 714 | nr_pages -= page_increm; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 715 | } while (nr_pages); |
| 716 | return i; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 717 | } |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 718 | |
Tobias Klauser | 771ab43 | 2016-12-12 16:41:53 -0800 | [diff] [blame] | 719 | static bool vma_permits_fault(struct vm_area_struct *vma, |
| 720 | unsigned int fault_flags) |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 721 | { |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 722 | bool write = !!(fault_flags & FAULT_FLAG_WRITE); |
| 723 | bool foreign = !!(fault_flags & FAULT_FLAG_REMOTE); |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 724 | vm_flags_t vm_flags = write ? VM_WRITE : VM_READ; |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 725 | |
| 726 | if (!(vm_flags & vma->vm_flags)) |
| 727 | return false; |
| 728 | |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 729 | /* |
| 730 | * The architecture might have a hardware protection |
Dave Hansen | 1b2ee12 | 2016-02-12 13:02:21 -0800 | [diff] [blame] | 731 | * mechanism other than read/write that can deny access. |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 732 | * |
| 733 | * gup always represents data access, not instruction |
| 734 | * fetches, so execute=false here: |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 735 | */ |
Dave Hansen | d61172b | 2016-02-12 13:02:24 -0800 | [diff] [blame] | 736 | if (!arch_vma_access_permitted(vma, write, false, foreign)) |
Dave Hansen | 33a709b | 2016-02-12 13:02:19 -0800 | [diff] [blame] | 737 | return false; |
| 738 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 739 | return true; |
| 740 | } |
| 741 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 742 | /* |
| 743 | * fixup_user_fault() - manually resolve a user page fault |
| 744 | * @tsk: the task_struct to use for page fault accounting, or |
| 745 | * NULL if faults are not to be recorded. |
| 746 | * @mm: mm_struct of target mm |
| 747 | * @address: user address |
| 748 | * @fault_flags:flags to pass down to handle_mm_fault() |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 749 | * @unlocked: did we unlock the mmap_sem while retrying, maybe NULL if caller |
| 750 | * does not allow retry |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 751 | * |
| 752 | * This is meant to be called in the specific scenario where for locking reasons |
| 753 | * we try to access user memory in atomic context (within a pagefault_disable() |
| 754 | * section), this returns -EFAULT, and we want to resolve the user fault before |
| 755 | * trying again. |
| 756 | * |
| 757 | * Typically this is meant to be used by the futex code. |
| 758 | * |
| 759 | * The main difference with get_user_pages() is that this function will |
| 760 | * unconditionally call handle_mm_fault() which will in turn perform all the |
| 761 | * necessary SW fixup of the dirty and young bits in the PTE, while |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 762 | * get_user_pages() only guarantees to update these in the struct page. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 763 | * |
| 764 | * This is important for some architectures where those bits also gate the |
| 765 | * access permission to the page because they are maintained in software. On |
| 766 | * such architectures, gup() will not be enough to make a subsequent access |
| 767 | * succeed. |
| 768 | * |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 769 | * This function will not return with an unlocked mmap_sem. So it has not the |
| 770 | * same semantics wrt the @mm->mmap_sem as does filemap_fault(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 771 | */ |
| 772 | int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm, |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 773 | unsigned long address, unsigned int fault_flags, |
| 774 | bool *unlocked) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 775 | { |
| 776 | struct vm_area_struct *vma; |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 777 | int ret, major = 0; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 778 | |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 779 | if (unlocked) |
| 780 | fault_flags |= FAULT_FLAG_ALLOW_RETRY; |
| 781 | |
| 782 | retry: |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 783 | vma = find_extend_vma(mm, address); |
| 784 | if (!vma || address < vma->vm_start) |
| 785 | return -EFAULT; |
| 786 | |
Dave Hansen | d4925e0 | 2016-02-12 13:02:16 -0800 | [diff] [blame] | 787 | if (!vma_permits_fault(vma, fault_flags)) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 788 | return -EFAULT; |
| 789 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 790 | ret = handle_mm_fault(vma, address, fault_flags); |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 791 | major |= ret & VM_FAULT_MAJOR; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 792 | if (ret & VM_FAULT_ERROR) { |
James Morse | 9a291a7 | 2017-06-02 14:46:46 -0700 | [diff] [blame] | 793 | int err = vm_fault_to_errno(ret, 0); |
| 794 | |
| 795 | if (err) |
| 796 | return err; |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 797 | BUG(); |
| 798 | } |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 799 | |
| 800 | if (ret & VM_FAULT_RETRY) { |
| 801 | down_read(&mm->mmap_sem); |
| 802 | if (!(fault_flags & FAULT_FLAG_TRIED)) { |
| 803 | *unlocked = true; |
| 804 | fault_flags &= ~FAULT_FLAG_ALLOW_RETRY; |
| 805 | fault_flags |= FAULT_FLAG_TRIED; |
| 806 | goto retry; |
| 807 | } |
| 808 | } |
| 809 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 810 | if (tsk) { |
Dominik Dingel | 4a9e1cd | 2016-01-15 16:57:04 -0800 | [diff] [blame] | 811 | if (major) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 812 | tsk->maj_flt++; |
| 813 | else |
| 814 | tsk->min_flt++; |
| 815 | } |
| 816 | return 0; |
| 817 | } |
Paolo Bonzini | add6a0c | 2016-06-07 17:51:18 +0200 | [diff] [blame] | 818 | EXPORT_SYMBOL_GPL(fixup_user_fault); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 819 | |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 820 | static __always_inline long __get_user_pages_locked(struct task_struct *tsk, |
| 821 | struct mm_struct *mm, |
| 822 | unsigned long start, |
| 823 | unsigned long nr_pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 824 | struct page **pages, |
| 825 | struct vm_area_struct **vmas, |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 826 | int *locked, bool notify_drop, |
| 827 | unsigned int flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 828 | { |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 829 | long ret, pages_done; |
| 830 | bool lock_dropped; |
| 831 | |
| 832 | if (locked) { |
| 833 | /* if VM_FAULT_RETRY can be returned, vmas become invalid */ |
| 834 | BUG_ON(vmas); |
| 835 | /* check caller initialized locked */ |
| 836 | BUG_ON(*locked != 1); |
| 837 | } |
| 838 | |
| 839 | if (pages) |
| 840 | flags |= FOLL_GET; |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 841 | |
| 842 | pages_done = 0; |
| 843 | lock_dropped = false; |
| 844 | for (;;) { |
| 845 | ret = __get_user_pages(tsk, mm, start, nr_pages, flags, pages, |
| 846 | vmas, locked); |
| 847 | if (!locked) |
| 848 | /* VM_FAULT_RETRY couldn't trigger, bypass */ |
| 849 | return ret; |
| 850 | |
| 851 | /* VM_FAULT_RETRY cannot return errors */ |
| 852 | if (!*locked) { |
| 853 | BUG_ON(ret < 0); |
| 854 | BUG_ON(ret >= nr_pages); |
| 855 | } |
| 856 | |
| 857 | if (!pages) |
| 858 | /* If it's a prefault don't insist harder */ |
| 859 | return ret; |
| 860 | |
| 861 | if (ret > 0) { |
| 862 | nr_pages -= ret; |
| 863 | pages_done += ret; |
| 864 | if (!nr_pages) |
| 865 | break; |
| 866 | } |
| 867 | if (*locked) { |
| 868 | /* VM_FAULT_RETRY didn't trigger */ |
| 869 | if (!pages_done) |
| 870 | pages_done = ret; |
| 871 | break; |
| 872 | } |
| 873 | /* VM_FAULT_RETRY triggered, so seek to the faulting offset */ |
| 874 | pages += ret; |
| 875 | start += ret << PAGE_SHIFT; |
| 876 | |
| 877 | /* |
| 878 | * Repeat on the address that fired VM_FAULT_RETRY |
| 879 | * without FAULT_FLAG_ALLOW_RETRY but with |
| 880 | * FAULT_FLAG_TRIED. |
| 881 | */ |
| 882 | *locked = 1; |
| 883 | lock_dropped = true; |
| 884 | down_read(&mm->mmap_sem); |
| 885 | ret = __get_user_pages(tsk, mm, start, 1, flags | FOLL_TRIED, |
| 886 | pages, NULL, NULL); |
| 887 | if (ret != 1) { |
| 888 | BUG_ON(ret > 1); |
| 889 | if (!pages_done) |
| 890 | pages_done = ret; |
| 891 | break; |
| 892 | } |
| 893 | nr_pages--; |
| 894 | pages_done++; |
| 895 | if (!nr_pages) |
| 896 | break; |
| 897 | pages++; |
| 898 | start += PAGE_SIZE; |
| 899 | } |
| 900 | if (notify_drop && lock_dropped && *locked) { |
| 901 | /* |
| 902 | * We must let the caller know we temporarily dropped the lock |
| 903 | * and so the critical section protected by it was lost. |
| 904 | */ |
| 905 | up_read(&mm->mmap_sem); |
| 906 | *locked = 0; |
| 907 | } |
| 908 | return pages_done; |
| 909 | } |
| 910 | |
| 911 | /* |
| 912 | * We can leverage the VM_FAULT_RETRY functionality in the page fault |
| 913 | * paths better by using either get_user_pages_locked() or |
| 914 | * get_user_pages_unlocked(). |
| 915 | * |
| 916 | * get_user_pages_locked() is suitable to replace the form: |
| 917 | * |
| 918 | * down_read(&mm->mmap_sem); |
| 919 | * do_something() |
| 920 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 921 | * up_read(&mm->mmap_sem); |
| 922 | * |
| 923 | * to: |
| 924 | * |
| 925 | * int locked = 1; |
| 926 | * down_read(&mm->mmap_sem); |
| 927 | * do_something() |
| 928 | * get_user_pages_locked(tsk, mm, ..., pages, &locked); |
| 929 | * if (locked) |
| 930 | * up_read(&mm->mmap_sem); |
| 931 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 932 | long get_user_pages_locked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 933 | unsigned int gup_flags, struct page **pages, |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 934 | int *locked) |
| 935 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 936 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 3b91317 | 2016-10-13 01:20:14 +0100 | [diff] [blame] | 937 | pages, NULL, locked, true, |
| 938 | gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 939 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 940 | EXPORT_SYMBOL(get_user_pages_locked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 941 | |
| 942 | /* |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 943 | * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows for |
| 944 | * tsk, mm to be specified. |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 945 | * |
| 946 | * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 947 | * caller if required (just like with __get_user_pages). "FOLL_GET" |
| 948 | * is set implicitly if "pages" is non-NULL. |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 949 | */ |
Lorenzo Stoakes | 8b7457e | 2016-12-14 15:06:55 -0800 | [diff] [blame] | 950 | static __always_inline long __get_user_pages_unlocked(struct task_struct *tsk, |
| 951 | struct mm_struct *mm, unsigned long start, |
| 952 | unsigned long nr_pages, struct page **pages, |
| 953 | unsigned int gup_flags) |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 954 | { |
| 955 | long ret; |
| 956 | int locked = 1; |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 957 | |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 958 | down_read(&mm->mmap_sem); |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 959 | ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL, |
| 960 | &locked, false, gup_flags); |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 961 | if (locked) |
| 962 | up_read(&mm->mmap_sem); |
| 963 | return ret; |
| 964 | } |
Andrea Arcangeli | 0fd71a5 | 2015-02-11 15:27:20 -0800 | [diff] [blame] | 965 | |
| 966 | /* |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 967 | * get_user_pages_unlocked() is suitable to replace the form: |
| 968 | * |
| 969 | * down_read(&mm->mmap_sem); |
| 970 | * get_user_pages(tsk, mm, ..., pages, NULL); |
| 971 | * up_read(&mm->mmap_sem); |
| 972 | * |
| 973 | * with: |
| 974 | * |
| 975 | * get_user_pages_unlocked(tsk, mm, ..., pages); |
| 976 | * |
| 977 | * It is functionally equivalent to get_user_pages_fast so |
Lorenzo Stoakes | 80a7951 | 2016-12-12 16:42:46 -0800 | [diff] [blame] | 978 | * get_user_pages_fast should be used instead if specific gup_flags |
| 979 | * (e.g. FOLL_FORCE) are not required. |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 980 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 981 | long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 982 | struct page **pages, unsigned int gup_flags) |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 983 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 984 | return __get_user_pages_unlocked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 985 | pages, gup_flags | FOLL_TOUCH); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 986 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 987 | EXPORT_SYMBOL(get_user_pages_unlocked); |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 988 | |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 989 | /* |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 990 | * get_user_pages_remote() - pin user pages in memory |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 991 | * @tsk: the task_struct to use for page fault accounting, or |
| 992 | * NULL if faults are not to be recorded. |
| 993 | * @mm: mm_struct of target mm |
| 994 | * @start: starting user address |
| 995 | * @nr_pages: number of pages from start to pin |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 996 | * @gup_flags: flags modifying lookup behaviour |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 997 | * @pages: array that receives pointers to the pages pinned. |
| 998 | * Should be at least nr_pages long. Or NULL, if caller |
| 999 | * only intends to ensure the pages are faulted in. |
| 1000 | * @vmas: array of pointers to vmas corresponding to each page. |
| 1001 | * Or NULL if the caller does not require them. |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1002 | * @locked: pointer to lock flag indicating whether lock is held and |
| 1003 | * subsequently whether VM_FAULT_RETRY functionality can be |
| 1004 | * utilised. Lock must initially be held. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1005 | * |
| 1006 | * Returns number of pages pinned. This may be fewer than the number |
| 1007 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 1008 | * were pinned, returns -errno. Each page returned must be released |
| 1009 | * with a put_page() call when it is finished with. vmas will only |
| 1010 | * remain valid while mmap_sem is held. |
| 1011 | * |
| 1012 | * Must be called with mmap_sem held for read or write. |
| 1013 | * |
| 1014 | * get_user_pages walks a process's page tables and takes a reference to |
| 1015 | * each struct page that each user address corresponds to at a given |
| 1016 | * instant. That is, it takes the page that would be accessed if a user |
| 1017 | * thread accesses the given user virtual address at that instant. |
| 1018 | * |
| 1019 | * This does not guarantee that the page exists in the user mappings when |
| 1020 | * get_user_pages returns, and there may even be a completely different |
| 1021 | * page there in some cases (eg. if mmapped pagecache has been invalidated |
| 1022 | * and subsequently re faulted). However it does guarantee that the page |
| 1023 | * won't be freed completely. And mostly callers simply care that the page |
| 1024 | * contains data that was valid *at some point in time*. Typically, an IO |
| 1025 | * or similar operation cannot guarantee anything stronger anyway because |
| 1026 | * locks can't be held over the syscall boundary. |
| 1027 | * |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1028 | * If gup_flags & FOLL_WRITE == 0, the page must not be written to. If the page |
| 1029 | * is written to, set_page_dirty (or set_page_dirty_lock, as appropriate) must |
| 1030 | * be called after the page is finished with, and before put_page is called. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1031 | * |
| 1032 | * get_user_pages is typically used for fewer-copy IO operations, to get a |
| 1033 | * handle on the memory by some means other than accesses via the user virtual |
| 1034 | * addresses. The pages may be submitted for DMA to devices or accessed via |
| 1035 | * their kernel linear mapping (via the kmap APIs). Care should be taken to |
| 1036 | * use the correct cache flushing APIs. |
| 1037 | * |
| 1038 | * See also get_user_pages_fast, for performance critical applications. |
Andrea Arcangeli | f0818f4 | 2015-02-11 15:27:17 -0800 | [diff] [blame] | 1039 | * |
| 1040 | * get_user_pages should be phased out in favor of |
| 1041 | * get_user_pages_locked|unlocked or get_user_pages_fast. Nothing |
| 1042 | * should use get_user_pages because it cannot pass |
| 1043 | * FAULT_FLAG_ALLOW_RETRY to handle_mm_fault. |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1044 | */ |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1045 | long get_user_pages_remote(struct task_struct *tsk, struct mm_struct *mm, |
| 1046 | unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1047 | unsigned int gup_flags, struct page **pages, |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1048 | struct vm_area_struct **vmas, int *locked) |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1049 | { |
Lorenzo Stoakes | 859110d | 2016-10-13 01:20:11 +0100 | [diff] [blame] | 1050 | return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas, |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1051 | locked, true, |
Lorenzo Stoakes | 9beae1e | 2016-10-13 01:20:17 +0100 | [diff] [blame] | 1052 | gup_flags | FOLL_TOUCH | FOLL_REMOTE); |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1053 | } |
| 1054 | EXPORT_SYMBOL(get_user_pages_remote); |
| 1055 | |
| 1056 | /* |
Dave Hansen | d4edcf0 | 2016-02-12 13:01:56 -0800 | [diff] [blame] | 1057 | * This is the same as get_user_pages_remote(), just with a |
| 1058 | * less-flexible calling convention where we assume that the task |
Lorenzo Stoakes | 5b56d49 | 2016-12-14 15:06:52 -0800 | [diff] [blame] | 1059 | * and mm being operated on are the current task's and don't allow |
| 1060 | * passing of a locked parameter. We also obviously don't pass |
| 1061 | * FOLL_REMOTE in here. |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1062 | */ |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 1063 | long get_user_pages(unsigned long start, unsigned long nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 1064 | unsigned int gup_flags, struct page **pages, |
Dave Hansen | 1e98779 | 2016-02-12 13:01:54 -0800 | [diff] [blame] | 1065 | struct vm_area_struct **vmas) |
| 1066 | { |
Dave Hansen | cde7014 | 2016-02-12 13:01:55 -0800 | [diff] [blame] | 1067 | return __get_user_pages_locked(current, current->mm, start, nr_pages, |
Lorenzo Stoakes | 768ae30 | 2016-10-13 01:20:16 +0100 | [diff] [blame] | 1068 | pages, vmas, NULL, false, |
| 1069 | gup_flags | FOLL_TOUCH); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1070 | } |
Ingo Molnar | c12d2da | 2016-04-04 10:24:58 +0200 | [diff] [blame] | 1071 | EXPORT_SYMBOL(get_user_pages); |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1072 | |
| 1073 | /** |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1074 | * populate_vma_page_range() - populate a range of pages in the vma. |
| 1075 | * @vma: target vma |
| 1076 | * @start: start address |
| 1077 | * @end: end address |
| 1078 | * @nonblocking: |
| 1079 | * |
| 1080 | * This takes care of mlocking the pages too if VM_LOCKED is set. |
| 1081 | * |
| 1082 | * return 0 on success, negative error code on error. |
| 1083 | * |
| 1084 | * vma->vm_mm->mmap_sem must be held. |
| 1085 | * |
| 1086 | * If @nonblocking is NULL, it may be held for read or write and will |
| 1087 | * be unperturbed. |
| 1088 | * |
| 1089 | * If @nonblocking is non-NULL, it must held for read only and may be |
| 1090 | * released. If it's released, *@nonblocking will be set to 0. |
| 1091 | */ |
| 1092 | long populate_vma_page_range(struct vm_area_struct *vma, |
| 1093 | unsigned long start, unsigned long end, int *nonblocking) |
| 1094 | { |
| 1095 | struct mm_struct *mm = vma->vm_mm; |
| 1096 | unsigned long nr_pages = (end - start) / PAGE_SIZE; |
| 1097 | int gup_flags; |
| 1098 | |
| 1099 | VM_BUG_ON(start & ~PAGE_MASK); |
| 1100 | VM_BUG_ON(end & ~PAGE_MASK); |
| 1101 | VM_BUG_ON_VMA(start < vma->vm_start, vma); |
| 1102 | VM_BUG_ON_VMA(end > vma->vm_end, vma); |
| 1103 | VM_BUG_ON_MM(!rwsem_is_locked(&mm->mmap_sem), mm); |
| 1104 | |
Eric B Munson | de60f5f | 2015-11-05 18:51:36 -0800 | [diff] [blame] | 1105 | gup_flags = FOLL_TOUCH | FOLL_POPULATE | FOLL_MLOCK; |
| 1106 | if (vma->vm_flags & VM_LOCKONFAULT) |
| 1107 | gup_flags &= ~FOLL_POPULATE; |
Kirill A. Shutemov | acc3c8d | 2015-04-14 15:44:45 -0700 | [diff] [blame] | 1108 | /* |
| 1109 | * We want to touch writable mappings with a write fault in order |
| 1110 | * to break COW, except for shared mappings because these don't COW |
| 1111 | * and we would not want to dirty them for nothing. |
| 1112 | */ |
| 1113 | if ((vma->vm_flags & (VM_WRITE | VM_SHARED)) == VM_WRITE) |
| 1114 | gup_flags |= FOLL_WRITE; |
| 1115 | |
| 1116 | /* |
| 1117 | * We want mlock to succeed for regions that have any permissions |
| 1118 | * other than PROT_NONE. |
| 1119 | */ |
| 1120 | if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) |
| 1121 | gup_flags |= FOLL_FORCE; |
| 1122 | |
| 1123 | /* |
| 1124 | * We made sure addr is within a VMA, so the following will |
| 1125 | * not result in a stack expansion that recurses back here. |
| 1126 | */ |
| 1127 | return __get_user_pages(current, mm, start, nr_pages, gup_flags, |
| 1128 | NULL, NULL, nonblocking); |
| 1129 | } |
| 1130 | |
| 1131 | /* |
| 1132 | * __mm_populate - populate and/or mlock pages within a range of address space. |
| 1133 | * |
| 1134 | * This is used to implement mlock() and the MAP_POPULATE / MAP_LOCKED mmap |
| 1135 | * flags. VMAs must be already marked with the desired vm_flags, and |
| 1136 | * mmap_sem must not be held. |
| 1137 | */ |
| 1138 | int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) |
| 1139 | { |
| 1140 | struct mm_struct *mm = current->mm; |
| 1141 | unsigned long end, nstart, nend; |
| 1142 | struct vm_area_struct *vma = NULL; |
| 1143 | int locked = 0; |
| 1144 | long ret = 0; |
| 1145 | |
| 1146 | VM_BUG_ON(start & ~PAGE_MASK); |
| 1147 | VM_BUG_ON(len != PAGE_ALIGN(len)); |
| 1148 | end = start + len; |
| 1149 | |
| 1150 | for (nstart = start; nstart < end; nstart = nend) { |
| 1151 | /* |
| 1152 | * We want to fault in pages for [nstart; end) address range. |
| 1153 | * Find first corresponding VMA. |
| 1154 | */ |
| 1155 | if (!locked) { |
| 1156 | locked = 1; |
| 1157 | down_read(&mm->mmap_sem); |
| 1158 | vma = find_vma(mm, nstart); |
| 1159 | } else if (nstart >= vma->vm_end) |
| 1160 | vma = vma->vm_next; |
| 1161 | if (!vma || vma->vm_start >= end) |
| 1162 | break; |
| 1163 | /* |
| 1164 | * Set [nstart; nend) to intersection of desired address |
| 1165 | * range with the first VMA. Also, skip undesirable VMA types. |
| 1166 | */ |
| 1167 | nend = min(end, vma->vm_end); |
| 1168 | if (vma->vm_flags & (VM_IO | VM_PFNMAP)) |
| 1169 | continue; |
| 1170 | if (nstart < vma->vm_start) |
| 1171 | nstart = vma->vm_start; |
| 1172 | /* |
| 1173 | * Now fault in a range of pages. populate_vma_page_range() |
| 1174 | * double checks the vma flags, so that it won't mlock pages |
| 1175 | * if the vma was already munlocked. |
| 1176 | */ |
| 1177 | ret = populate_vma_page_range(vma, nstart, nend, &locked); |
| 1178 | if (ret < 0) { |
| 1179 | if (ignore_errors) { |
| 1180 | ret = 0; |
| 1181 | continue; /* continue at next VMA */ |
| 1182 | } |
| 1183 | break; |
| 1184 | } |
| 1185 | nend = nstart + ret * PAGE_SIZE; |
| 1186 | ret = 0; |
| 1187 | } |
| 1188 | if (locked) |
| 1189 | up_read(&mm->mmap_sem); |
| 1190 | return ret; /* 0 or negative error code */ |
| 1191 | } |
| 1192 | |
| 1193 | /** |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1194 | * get_dump_page() - pin user page in memory while writing it to core dump |
| 1195 | * @addr: user address |
| 1196 | * |
| 1197 | * Returns struct page pointer of user page pinned for dump, |
Kirill A. Shutemov | ea1754a | 2016-04-01 15:29:48 +0300 | [diff] [blame] | 1198 | * to be freed afterwards by put_page(). |
Kirill A. Shutemov | 4bbd4c7 | 2014-06-04 16:08:10 -0700 | [diff] [blame] | 1199 | * |
| 1200 | * Returns NULL on any kind of failure - a hole must then be inserted into |
| 1201 | * the corefile, to preserve alignment with its headers; and also returns |
| 1202 | * NULL wherever the ZERO_PAGE, or an anonymous pte_none, has been found - |
| 1203 | * allowing a hole to be left in the corefile to save diskspace. |
| 1204 | * |
| 1205 | * Called without mmap_sem, but after all other threads have been killed. |
| 1206 | */ |
| 1207 | #ifdef CONFIG_ELF_CORE |
| 1208 | struct page *get_dump_page(unsigned long addr) |
| 1209 | { |
| 1210 | struct vm_area_struct *vma; |
| 1211 | struct page *page; |
| 1212 | |
| 1213 | if (__get_user_pages(current, current->mm, addr, 1, |
| 1214 | FOLL_FORCE | FOLL_DUMP | FOLL_GET, &page, &vma, |
| 1215 | NULL) < 1) |
| 1216 | return NULL; |
| 1217 | flush_cache_page(vma, addr, page_to_pfn(page)); |
| 1218 | return page; |
| 1219 | } |
| 1220 | #endif /* CONFIG_ELF_CORE */ |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1221 | |
| 1222 | /* |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1223 | * Generic Fast GUP |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1224 | * |
| 1225 | * get_user_pages_fast attempts to pin user pages by walking the page |
| 1226 | * tables directly and avoids taking locks. Thus the walker needs to be |
| 1227 | * protected from page table pages being freed from under it, and should |
| 1228 | * block any THP splits. |
| 1229 | * |
| 1230 | * One way to achieve this is to have the walker disable interrupts, and |
| 1231 | * rely on IPIs from the TLB flushing code blocking before the page table |
| 1232 | * pages are freed. This is unsuitable for architectures that do not need |
| 1233 | * to broadcast an IPI when invalidating TLBs. |
| 1234 | * |
| 1235 | * Another way to achieve this is to batch up page table containing pages |
| 1236 | * belonging to more than one mm_user, then rcu_sched a callback to free those |
| 1237 | * pages. Disabling interrupts will allow the fast_gup walker to both block |
| 1238 | * the rcu_sched callback, and an IPI that we broadcast for splitting THPs |
| 1239 | * (which is a relatively rare event). The code below adopts this strategy. |
| 1240 | * |
| 1241 | * Before activating this code, please be aware that the following assumptions |
| 1242 | * are currently made: |
| 1243 | * |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1244 | * *) Either HAVE_RCU_TABLE_FREE is enabled, and tlb_remove_table() is used to |
| 1245 | * free pages containing page tables or TLB flushing requires IPI broadcast. |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1246 | * |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1247 | * *) ptes can be read atomically by the architecture. |
| 1248 | * |
| 1249 | * *) access_ok is sufficient to validate userspace address ranges. |
| 1250 | * |
| 1251 | * The last two assumptions can be relaxed by the addition of helper functions. |
| 1252 | * |
| 1253 | * This code is based heavily on the PowerPC implementation by Nick Piggin. |
| 1254 | */ |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1255 | #ifdef CONFIG_HAVE_GENERIC_GUP |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1256 | |
Kirill A. Shutemov | 0005d20 | 2017-03-16 18:26:51 +0300 | [diff] [blame] | 1257 | #ifndef gup_get_pte |
| 1258 | /* |
| 1259 | * We assume that the PTE can be read atomically. If this is not the case for |
| 1260 | * your architecture, please provide the helper. |
| 1261 | */ |
| 1262 | static inline pte_t gup_get_pte(pte_t *ptep) |
| 1263 | { |
| 1264 | return READ_ONCE(*ptep); |
| 1265 | } |
| 1266 | #endif |
| 1267 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1268 | static void undo_dev_pagemap(int *nr, int nr_start, struct page **pages) |
| 1269 | { |
| 1270 | while ((*nr) - nr_start) { |
| 1271 | struct page *page = pages[--(*nr)]; |
| 1272 | |
| 1273 | ClearPageReferenced(page); |
| 1274 | put_page(page); |
| 1275 | } |
| 1276 | } |
| 1277 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1278 | #ifdef __HAVE_ARCH_PTE_SPECIAL |
| 1279 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1280 | int write, struct page **pages, int *nr) |
| 1281 | { |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1282 | struct dev_pagemap *pgmap = NULL; |
| 1283 | int nr_start = *nr, ret = 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1284 | pte_t *ptep, *ptem; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1285 | |
| 1286 | ptem = ptep = pte_offset_map(&pmd, addr); |
| 1287 | do { |
Kirill A. Shutemov | 0005d20 | 2017-03-16 18:26:51 +0300 | [diff] [blame] | 1288 | pte_t pte = gup_get_pte(ptep); |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1289 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1290 | |
| 1291 | /* |
| 1292 | * Similar to the PMD case below, NUMA hinting must take slow |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1293 | * path using the pte_protnone check. |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1294 | */ |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1295 | if (pte_protnone(pte)) |
| 1296 | goto pte_unmap; |
| 1297 | |
| 1298 | if (!pte_access_permitted(pte, write)) |
| 1299 | goto pte_unmap; |
| 1300 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1301 | if (pte_devmap(pte)) { |
| 1302 | pgmap = get_dev_pagemap(pte_pfn(pte), pgmap); |
| 1303 | if (unlikely(!pgmap)) { |
| 1304 | undo_dev_pagemap(nr, nr_start, pages); |
| 1305 | goto pte_unmap; |
| 1306 | } |
| 1307 | } else if (pte_special(pte)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1308 | goto pte_unmap; |
| 1309 | |
| 1310 | VM_BUG_ON(!pfn_valid(pte_pfn(pte))); |
| 1311 | page = pte_page(pte); |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1312 | head = compound_head(page); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1313 | |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1314 | if (!page_cache_get_speculative(head)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1315 | goto pte_unmap; |
| 1316 | |
| 1317 | if (unlikely(pte_val(pte) != pte_val(*ptep))) { |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1318 | put_page(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1319 | goto pte_unmap; |
| 1320 | } |
| 1321 | |
Kirill A. Shutemov | 7aef417 | 2016-01-15 16:52:32 -0800 | [diff] [blame] | 1322 | VM_BUG_ON_PAGE(compound_head(page) != head, page); |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1323 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1324 | put_dev_pagemap(pgmap); |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1325 | SetPageReferenced(page); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1326 | pages[*nr] = page; |
| 1327 | (*nr)++; |
| 1328 | |
| 1329 | } while (ptep++, addr += PAGE_SIZE, addr != end); |
| 1330 | |
| 1331 | ret = 1; |
| 1332 | |
| 1333 | pte_unmap: |
| 1334 | pte_unmap(ptem); |
| 1335 | return ret; |
| 1336 | } |
| 1337 | #else |
| 1338 | |
| 1339 | /* |
| 1340 | * If we can't determine whether or not a pte is special, then fail immediately |
| 1341 | * for ptes. Note, we can still pin HugeTLB and THP as these are guaranteed not |
| 1342 | * to be special. |
| 1343 | * |
| 1344 | * For a futex to be placed on a THP tail page, get_futex_key requires a |
| 1345 | * __get_user_pages_fast implementation that can pin pages. Thus it's still |
| 1346 | * useful to have gup_huge_pmd even if we can't operate on ptes. |
| 1347 | */ |
| 1348 | static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end, |
| 1349 | int write, struct page **pages, int *nr) |
| 1350 | { |
| 1351 | return 0; |
| 1352 | } |
| 1353 | #endif /* __HAVE_ARCH_PTE_SPECIAL */ |
| 1354 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1355 | #ifdef __HAVE_ARCH_PTE_DEVMAP |
| 1356 | static int __gup_device_huge(unsigned long pfn, unsigned long addr, |
| 1357 | unsigned long end, struct page **pages, int *nr) |
| 1358 | { |
| 1359 | int nr_start = *nr; |
| 1360 | struct dev_pagemap *pgmap = NULL; |
| 1361 | |
| 1362 | do { |
| 1363 | struct page *page = pfn_to_page(pfn); |
| 1364 | |
| 1365 | pgmap = get_dev_pagemap(pfn, pgmap); |
| 1366 | if (unlikely(!pgmap)) { |
| 1367 | undo_dev_pagemap(nr, nr_start, pages); |
| 1368 | return 0; |
| 1369 | } |
| 1370 | SetPageReferenced(page); |
| 1371 | pages[*nr] = page; |
| 1372 | get_page(page); |
| 1373 | put_dev_pagemap(pgmap); |
| 1374 | (*nr)++; |
| 1375 | pfn++; |
| 1376 | } while (addr += PAGE_SIZE, addr != end); |
| 1377 | return 1; |
| 1378 | } |
| 1379 | |
| 1380 | static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, |
| 1381 | unsigned long end, struct page **pages, int *nr) |
| 1382 | { |
| 1383 | unsigned long fault_pfn; |
| 1384 | |
| 1385 | fault_pfn = pmd_pfn(pmd) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); |
| 1386 | return __gup_device_huge(fault_pfn, addr, end, pages, nr); |
| 1387 | } |
| 1388 | |
| 1389 | static int __gup_device_huge_pud(pud_t pud, unsigned long addr, |
| 1390 | unsigned long end, struct page **pages, int *nr) |
| 1391 | { |
| 1392 | unsigned long fault_pfn; |
| 1393 | |
| 1394 | fault_pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); |
| 1395 | return __gup_device_huge(fault_pfn, addr, end, pages, nr); |
| 1396 | } |
| 1397 | #else |
| 1398 | static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, |
| 1399 | unsigned long end, struct page **pages, int *nr) |
| 1400 | { |
| 1401 | BUILD_BUG(); |
| 1402 | return 0; |
| 1403 | } |
| 1404 | |
| 1405 | static int __gup_device_huge_pud(pud_t pud, unsigned long addr, |
| 1406 | unsigned long end, struct page **pages, int *nr) |
| 1407 | { |
| 1408 | BUILD_BUG(); |
| 1409 | return 0; |
| 1410 | } |
| 1411 | #endif |
| 1412 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1413 | static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, |
| 1414 | unsigned long end, int write, struct page **pages, int *nr) |
| 1415 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1416 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1417 | int refs; |
| 1418 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1419 | if (!pmd_access_permitted(orig, write)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1420 | return 0; |
| 1421 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1422 | if (pmd_devmap(orig)) |
| 1423 | return __gup_device_huge_pmd(orig, addr, end, pages, nr); |
| 1424 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1425 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1426 | page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1427 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1428 | pages[*nr] = page; |
| 1429 | (*nr)++; |
| 1430 | page++; |
| 1431 | refs++; |
| 1432 | } while (addr += PAGE_SIZE, addr != end); |
| 1433 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1434 | head = compound_head(pmd_page(orig)); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1435 | if (!page_cache_add_speculative(head, refs)) { |
| 1436 | *nr -= refs; |
| 1437 | return 0; |
| 1438 | } |
| 1439 | |
| 1440 | if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) { |
| 1441 | *nr -= refs; |
| 1442 | while (refs--) |
| 1443 | put_page(head); |
| 1444 | return 0; |
| 1445 | } |
| 1446 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1447 | SetPageReferenced(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1448 | return 1; |
| 1449 | } |
| 1450 | |
| 1451 | static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, |
| 1452 | unsigned long end, int write, struct page **pages, int *nr) |
| 1453 | { |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1454 | struct page *head, *page; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1455 | int refs; |
| 1456 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1457 | if (!pud_access_permitted(orig, write)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1458 | return 0; |
| 1459 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1460 | if (pud_devmap(orig)) |
| 1461 | return __gup_device_huge_pud(orig, addr, end, pages, nr); |
| 1462 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1463 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1464 | page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1465 | do { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1466 | pages[*nr] = page; |
| 1467 | (*nr)++; |
| 1468 | page++; |
| 1469 | refs++; |
| 1470 | } while (addr += PAGE_SIZE, addr != end); |
| 1471 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1472 | head = compound_head(pud_page(orig)); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1473 | if (!page_cache_add_speculative(head, refs)) { |
| 1474 | *nr -= refs; |
| 1475 | return 0; |
| 1476 | } |
| 1477 | |
| 1478 | if (unlikely(pud_val(orig) != pud_val(*pudp))) { |
| 1479 | *nr -= refs; |
| 1480 | while (refs--) |
| 1481 | put_page(head); |
| 1482 | return 0; |
| 1483 | } |
| 1484 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1485 | SetPageReferenced(head); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1486 | return 1; |
| 1487 | } |
| 1488 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1489 | static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr, |
| 1490 | unsigned long end, int write, |
| 1491 | struct page **pages, int *nr) |
| 1492 | { |
| 1493 | int refs; |
Kirill A. Shutemov | ddc58f2 | 2016-01-15 16:52:56 -0800 | [diff] [blame] | 1494 | struct page *head, *page; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1495 | |
Kirill A. Shutemov | e7884f8 | 2017-03-16 18:26:50 +0300 | [diff] [blame] | 1496 | if (!pgd_access_permitted(orig, write)) |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1497 | return 0; |
| 1498 | |
Kirill A. Shutemov | b59f65f | 2017-03-16 18:26:53 +0300 | [diff] [blame] | 1499 | BUILD_BUG_ON(pgd_devmap(orig)); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1500 | refs = 0; |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1501 | page = pgd_page(orig) + ((addr & ~PGDIR_MASK) >> PAGE_SHIFT); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1502 | do { |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1503 | pages[*nr] = page; |
| 1504 | (*nr)++; |
| 1505 | page++; |
| 1506 | refs++; |
| 1507 | } while (addr += PAGE_SIZE, addr != end); |
| 1508 | |
Punit Agrawal | d63206e | 2017-07-06 15:39:39 -0700 | [diff] [blame] | 1509 | head = compound_head(pgd_page(orig)); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1510 | if (!page_cache_add_speculative(head, refs)) { |
| 1511 | *nr -= refs; |
| 1512 | return 0; |
| 1513 | } |
| 1514 | |
| 1515 | if (unlikely(pgd_val(orig) != pgd_val(*pgdp))) { |
| 1516 | *nr -= refs; |
| 1517 | while (refs--) |
| 1518 | put_page(head); |
| 1519 | return 0; |
| 1520 | } |
| 1521 | |
Kirill A. Shutemov | e934805 | 2017-03-16 18:26:52 +0300 | [diff] [blame] | 1522 | SetPageReferenced(head); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1523 | return 1; |
| 1524 | } |
| 1525 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1526 | static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end, |
| 1527 | int write, struct page **pages, int *nr) |
| 1528 | { |
| 1529 | unsigned long next; |
| 1530 | pmd_t *pmdp; |
| 1531 | |
| 1532 | pmdp = pmd_offset(&pud, addr); |
| 1533 | do { |
Christian Borntraeger | 38c5ce9 | 2015-01-06 22:54:46 +0100 | [diff] [blame] | 1534 | pmd_t pmd = READ_ONCE(*pmdp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1535 | |
| 1536 | next = pmd_addr_end(addr, end); |
Kirill A. Shutemov | 4b471e8 | 2016-01-15 16:53:39 -0800 | [diff] [blame] | 1537 | if (pmd_none(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1538 | return 0; |
| 1539 | |
| 1540 | if (unlikely(pmd_trans_huge(pmd) || pmd_huge(pmd))) { |
| 1541 | /* |
| 1542 | * NUMA hinting faults need to be handled in the GUP |
| 1543 | * slowpath for accounting purposes and so that they |
| 1544 | * can be serialised against THP migration. |
| 1545 | */ |
Mel Gorman | 8a0516e | 2015-02-12 14:58:22 -0800 | [diff] [blame] | 1546 | if (pmd_protnone(pmd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1547 | return 0; |
| 1548 | |
| 1549 | if (!gup_huge_pmd(pmd, pmdp, addr, next, write, |
| 1550 | pages, nr)) |
| 1551 | return 0; |
| 1552 | |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1553 | } else if (unlikely(is_hugepd(__hugepd(pmd_val(pmd))))) { |
| 1554 | /* |
| 1555 | * architecture have different format for hugetlbfs |
| 1556 | * pmd format and THP pmd format |
| 1557 | */ |
| 1558 | if (!gup_huge_pd(__hugepd(pmd_val(pmd)), addr, |
| 1559 | PMD_SHIFT, next, write, pages, nr)) |
| 1560 | return 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1561 | } else if (!gup_pte_range(pmd, addr, next, write, pages, nr)) |
| 1562 | return 0; |
| 1563 | } while (pmdp++, addr = next, addr != end); |
| 1564 | |
| 1565 | return 1; |
| 1566 | } |
| 1567 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1568 | static int gup_pud_range(p4d_t p4d, unsigned long addr, unsigned long end, |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1569 | int write, struct page **pages, int *nr) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1570 | { |
| 1571 | unsigned long next; |
| 1572 | pud_t *pudp; |
| 1573 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1574 | pudp = pud_offset(&p4d, addr); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1575 | do { |
Christian Borntraeger | e37c698 | 2014-12-07 21:41:33 +0100 | [diff] [blame] | 1576 | pud_t pud = READ_ONCE(*pudp); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1577 | |
| 1578 | next = pud_addr_end(addr, end); |
| 1579 | if (pud_none(pud)) |
| 1580 | return 0; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1581 | if (unlikely(pud_huge(pud))) { |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1582 | if (!gup_huge_pud(pud, pudp, addr, next, write, |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1583 | pages, nr)) |
| 1584 | return 0; |
| 1585 | } else if (unlikely(is_hugepd(__hugepd(pud_val(pud))))) { |
| 1586 | if (!gup_huge_pd(__hugepd(pud_val(pud)), addr, |
| 1587 | PUD_SHIFT, next, write, pages, nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1588 | return 0; |
| 1589 | } else if (!gup_pmd_range(pud, addr, next, write, pages, nr)) |
| 1590 | return 0; |
| 1591 | } while (pudp++, addr = next, addr != end); |
| 1592 | |
| 1593 | return 1; |
| 1594 | } |
| 1595 | |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1596 | static int gup_p4d_range(pgd_t pgd, unsigned long addr, unsigned long end, |
| 1597 | int write, struct page **pages, int *nr) |
| 1598 | { |
| 1599 | unsigned long next; |
| 1600 | p4d_t *p4dp; |
| 1601 | |
| 1602 | p4dp = p4d_offset(&pgd, addr); |
| 1603 | do { |
| 1604 | p4d_t p4d = READ_ONCE(*p4dp); |
| 1605 | |
| 1606 | next = p4d_addr_end(addr, end); |
| 1607 | if (p4d_none(p4d)) |
| 1608 | return 0; |
| 1609 | BUILD_BUG_ON(p4d_huge(p4d)); |
| 1610 | if (unlikely(is_hugepd(__hugepd(p4d_val(p4d))))) { |
| 1611 | if (!gup_huge_pd(__hugepd(p4d_val(p4d)), addr, |
| 1612 | P4D_SHIFT, next, write, pages, nr)) |
| 1613 | return 0; |
Kirill A. Shutemov | ce70df0 | 2017-03-13 08:22:13 +0300 | [diff] [blame] | 1614 | } else if (!gup_pud_range(p4d, addr, next, write, pages, nr)) |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1615 | return 0; |
| 1616 | } while (p4dp++, addr = next, addr != end); |
| 1617 | |
| 1618 | return 1; |
| 1619 | } |
| 1620 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1621 | /* |
| 1622 | * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to |
| 1623 | * the regular GUP. It will only return non-negative values. |
| 1624 | */ |
| 1625 | int __get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1626 | struct page **pages) |
| 1627 | { |
| 1628 | struct mm_struct *mm = current->mm; |
| 1629 | unsigned long addr, len, end; |
| 1630 | unsigned long next, flags; |
| 1631 | pgd_t *pgdp; |
| 1632 | int nr = 0; |
| 1633 | |
| 1634 | start &= PAGE_MASK; |
| 1635 | addr = start; |
| 1636 | len = (unsigned long) nr_pages << PAGE_SHIFT; |
| 1637 | end = start + len; |
| 1638 | |
| 1639 | if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, |
Arnd Bergmann | aa2369f | 2017-05-03 14:56:12 -0700 | [diff] [blame] | 1640 | (void __user *)start, len))) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1641 | return 0; |
| 1642 | |
| 1643 | /* |
| 1644 | * Disable interrupts. We use the nested form as we can already have |
| 1645 | * interrupts disabled by get_futex_key. |
| 1646 | * |
| 1647 | * With interrupts disabled, we block page table pages from being |
| 1648 | * freed from under us. See mmu_gather_tlb in asm-generic/tlb.h |
| 1649 | * for more details. |
| 1650 | * |
| 1651 | * We do not adopt an rcu_read_lock(.) here as we also want to |
| 1652 | * block IPIs that come from THPs splitting. |
| 1653 | */ |
| 1654 | |
| 1655 | local_irq_save(flags); |
| 1656 | pgdp = pgd_offset(mm, addr); |
| 1657 | do { |
Jason Low | 9d8c47e | 2015-04-15 16:14:05 -0700 | [diff] [blame] | 1658 | pgd_t pgd = READ_ONCE(*pgdp); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1659 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1660 | next = pgd_addr_end(addr, end); |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1661 | if (pgd_none(pgd)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1662 | break; |
Aneesh Kumar K.V | f30c59e | 2014-11-05 21:57:40 +0530 | [diff] [blame] | 1663 | if (unlikely(pgd_huge(pgd))) { |
| 1664 | if (!gup_huge_pgd(pgd, pgdp, addr, next, write, |
| 1665 | pages, &nr)) |
| 1666 | break; |
| 1667 | } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) { |
| 1668 | if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr, |
| 1669 | PGDIR_SHIFT, next, write, pages, &nr)) |
| 1670 | break; |
Kirill A. Shutemov | c2febaf | 2017-03-09 17:24:07 +0300 | [diff] [blame] | 1671 | } else if (!gup_p4d_range(pgd, addr, next, write, pages, &nr)) |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1672 | break; |
| 1673 | } while (pgdp++, addr = next, addr != end); |
| 1674 | local_irq_restore(flags); |
| 1675 | |
| 1676 | return nr; |
| 1677 | } |
| 1678 | |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1679 | #ifndef gup_fast_permitted |
| 1680 | /* |
| 1681 | * Check if it's allowed to use __get_user_pages_fast() for the range, or |
| 1682 | * we need to fall back to the slow version: |
| 1683 | */ |
| 1684 | bool gup_fast_permitted(unsigned long start, int nr_pages, int write) |
| 1685 | { |
| 1686 | unsigned long len, end; |
| 1687 | |
| 1688 | len = (unsigned long) nr_pages << PAGE_SHIFT; |
| 1689 | end = start + len; |
| 1690 | return end >= start; |
| 1691 | } |
| 1692 | #endif |
| 1693 | |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1694 | /** |
| 1695 | * get_user_pages_fast() - pin user pages in memory |
| 1696 | * @start: starting user address |
| 1697 | * @nr_pages: number of pages from start to pin |
| 1698 | * @write: whether pages will be written to |
| 1699 | * @pages: array that receives pointers to the pages pinned. |
| 1700 | * Should be at least nr_pages long. |
| 1701 | * |
| 1702 | * Attempt to pin user pages in memory without taking mm->mmap_sem. |
| 1703 | * If not successful, it will fall back to taking the lock and |
| 1704 | * calling get_user_pages(). |
| 1705 | * |
| 1706 | * Returns number of pages pinned. This may be fewer than the number |
| 1707 | * requested. If nr_pages is 0 or negative, returns 0. If no pages |
| 1708 | * were pinned, returns -errno. |
| 1709 | */ |
| 1710 | int get_user_pages_fast(unsigned long start, int nr_pages, int write, |
| 1711 | struct page **pages) |
| 1712 | { |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1713 | int nr = 0, ret = 0; |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1714 | |
| 1715 | start &= PAGE_MASK; |
Kirill A. Shutemov | 73e10a6 | 2017-03-16 18:26:54 +0300 | [diff] [blame] | 1716 | |
| 1717 | if (gup_fast_permitted(start, nr_pages, write)) { |
| 1718 | nr = __get_user_pages_fast(start, nr_pages, write, pages); |
| 1719 | ret = nr; |
| 1720 | } |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1721 | |
| 1722 | if (nr < nr_pages) { |
| 1723 | /* Try to get the remaining pages with get_user_pages */ |
| 1724 | start += nr << PAGE_SHIFT; |
| 1725 | pages += nr; |
| 1726 | |
Lorenzo Stoakes | c164154 | 2016-10-13 01:20:13 +0100 | [diff] [blame] | 1727 | ret = get_user_pages_unlocked(start, nr_pages - nr, pages, |
| 1728 | write ? FOLL_WRITE : 0); |
Steve Capper | 2667f50 | 2014-10-09 15:29:14 -0700 | [diff] [blame] | 1729 | |
| 1730 | /* Have to be a bit careful with return values */ |
| 1731 | if (nr > 0) { |
| 1732 | if (ret < 0) |
| 1733 | ret = nr; |
| 1734 | else |
| 1735 | ret += nr; |
| 1736 | } |
| 1737 | } |
| 1738 | |
| 1739 | return ret; |
| 1740 | } |
| 1741 | |
Kirill A. Shutemov | e585513 | 2017-06-06 14:31:20 +0300 | [diff] [blame] | 1742 | #endif /* CONFIG_HAVE_GENERIC_GUP */ |