hugetlbfs: fix races and page leaks during migration
[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / mm / migrate.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Memory Migration functionality - linux/mm/migrate.c
4 *
5 * Copyright (C) 2006 Silicon Graphics, Inc., Christoph Lameter
6 *
7 * Page migration was first developed in the context of the memory hotplug
8 * project. The main authors of the migration code are:
9 *
10 * IWAMOTO Toshihiro <iwamoto@valinux.co.jp>
11 * Hirokazu Takahashi <taka@valinux.co.jp>
12 * Dave Hansen <haveblue@us.ibm.com>
13 * Christoph Lameter
14 */
15
16 #include <linux/migrate.h>
17 #include <linux/export.h>
18 #include <linux/swap.h>
19 #include <linux/swapops.h>
20 #include <linux/pagemap.h>
21 #include <linux/buffer_head.h>
22 #include <linux/mm_inline.h>
23 #include <linux/nsproxy.h>
24 #include <linux/pagevec.h>
25 #include <linux/ksm.h>
26 #include <linux/rmap.h>
27 #include <linux/topology.h>
28 #include <linux/cpu.h>
29 #include <linux/cpuset.h>
30 #include <linux/writeback.h>
31 #include <linux/mempolicy.h>
32 #include <linux/vmalloc.h>
33 #include <linux/security.h>
34 #include <linux/backing-dev.h>
35 #include <linux/compaction.h>
36 #include <linux/syscalls.h>
37 #include <linux/hugetlb.h>
38 #include <linux/hugetlb_cgroup.h>
39 #include <linux/gfp.h>
40 #include <linux/pfn_t.h>
41 #include <linux/memremap.h>
42 #include <linux/userfaultfd_k.h>
43 #include <linux/balloon_compaction.h>
44 #include <linux/mmu_notifier.h>
45 #include <linux/page_idle.h>
46 #include <linux/page_owner.h>
47 #include <linux/sched/mm.h>
48 #include <linux/ptrace.h>
49
50 #include <asm/tlbflush.h>
51
52 #define CREATE_TRACE_POINTS
53 #include <trace/events/migrate.h>
54
55 #include "internal.h"
56
57 /*
58 * migrate_prep() needs to be called before we start compiling a list of pages
59 * to be migrated using isolate_lru_page(). If scheduling work on other CPUs is
60 * undesirable, use migrate_prep_local()
61 */
62 int migrate_prep(void)
63 {
64 /*
65 * Clear the LRU lists so pages can be isolated.
66 * Note that pages may be moved off the LRU after we have
67 * drained them. Those pages will fail to migrate like other
68 * pages that may be busy.
69 */
70 lru_add_drain_all();
71
72 return 0;
73 }
74
75 /* Do the necessary work of migrate_prep but not if it involves other CPUs */
76 int migrate_prep_local(void)
77 {
78 lru_add_drain();
79
80 return 0;
81 }
82
83 int isolate_movable_page(struct page *page, isolate_mode_t mode)
84 {
85 struct address_space *mapping;
86
87 /*
88 * Avoid burning cycles with pages that are yet under __free_pages(),
89 * or just got freed under us.
90 *
91 * In case we 'win' a race for a movable page being freed under us and
92 * raise its refcount preventing __free_pages() from doing its job
93 * the put_page() at the end of this block will take care of
94 * release this page, thus avoiding a nasty leakage.
95 */
96 if (unlikely(!get_page_unless_zero(page)))
97 goto out;
98
99 /*
100 * Check PageMovable before holding a PG_lock because page's owner
101 * assumes anybody doesn't touch PG_lock of newly allocated page
102 * so unconditionally grapping the lock ruins page's owner side.
103 */
104 if (unlikely(!__PageMovable(page)))
105 goto out_putpage;
106 /*
107 * As movable pages are not isolated from LRU lists, concurrent
108 * compaction threads can race against page migration functions
109 * as well as race against the releasing a page.
110 *
111 * In order to avoid having an already isolated movable page
112 * being (wrongly) re-isolated while it is under migration,
113 * or to avoid attempting to isolate pages being released,
114 * lets be sure we have the page lock
115 * before proceeding with the movable page isolation steps.
116 */
117 if (unlikely(!trylock_page(page)))
118 goto out_putpage;
119
120 if (!PageMovable(page) || PageIsolated(page))
121 goto out_no_isolated;
122
123 mapping = page_mapping(page);
124 VM_BUG_ON_PAGE(!mapping, page);
125
126 if (!mapping->a_ops->isolate_page(page, mode))
127 goto out_no_isolated;
128
129 /* Driver shouldn't use PG_isolated bit of page->flags */
130 WARN_ON_ONCE(PageIsolated(page));
131 __SetPageIsolated(page);
132 unlock_page(page);
133
134 return 0;
135
136 out_no_isolated:
137 unlock_page(page);
138 out_putpage:
139 put_page(page);
140 out:
141 return -EBUSY;
142 }
143
144 /* It should be called on page which is PG_movable */
145 void putback_movable_page(struct page *page)
146 {
147 struct address_space *mapping;
148
149 VM_BUG_ON_PAGE(!PageLocked(page), page);
150 VM_BUG_ON_PAGE(!PageMovable(page), page);
151 VM_BUG_ON_PAGE(!PageIsolated(page), page);
152
153 mapping = page_mapping(page);
154 mapping->a_ops->putback_page(page);
155 __ClearPageIsolated(page);
156 }
157
158 /*
159 * Put previously isolated pages back onto the appropriate lists
160 * from where they were once taken off for compaction/migration.
161 *
162 * This function shall be used whenever the isolated pageset has been
163 * built from lru, balloon, hugetlbfs page. See isolate_migratepages_range()
164 * and isolate_huge_page().
165 */
166 void putback_movable_pages(struct list_head *l)
167 {
168 struct page *page;
169 struct page *page2;
170
171 list_for_each_entry_safe(page, page2, l, lru) {
172 if (unlikely(PageHuge(page))) {
173 putback_active_hugepage(page);
174 continue;
175 }
176 list_del(&page->lru);
177 /*
178 * We isolated non-lru movable page so here we can use
179 * __PageMovable because LRU page's mapping cannot have
180 * PAGE_MAPPING_MOVABLE.
181 */
182 if (unlikely(__PageMovable(page))) {
183 VM_BUG_ON_PAGE(!PageIsolated(page), page);
184 lock_page(page);
185 if (PageMovable(page))
186 putback_movable_page(page);
187 else
188 __ClearPageIsolated(page);
189 unlock_page(page);
190 put_page(page);
191 } else {
192 mod_node_page_state(page_pgdat(page), NR_ISOLATED_ANON +
193 page_is_file_cache(page), -hpage_nr_pages(page));
194 putback_lru_page(page);
195 }
196 }
197 }
198
199 /*
200 * Restore a potential migration pte to a working pte entry
201 */
202 static bool remove_migration_pte(struct page *page, struct vm_area_struct *vma,
203 unsigned long addr, void *old)
204 {
205 struct page_vma_mapped_walk pvmw = {
206 .page = old,
207 .vma = vma,
208 .address = addr,
209 .flags = PVMW_SYNC | PVMW_MIGRATION,
210 };
211 struct page *new;
212 pte_t pte;
213 swp_entry_t entry;
214
215 VM_BUG_ON_PAGE(PageTail(page), page);
216 while (page_vma_mapped_walk(&pvmw)) {
217 if (PageKsm(page))
218 new = page;
219 else
220 new = page - pvmw.page->index +
221 linear_page_index(vma, pvmw.address);
222
223 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
224 /* PMD-mapped THP migration entry */
225 if (!pvmw.pte) {
226 VM_BUG_ON_PAGE(PageHuge(page) || !PageTransCompound(page), page);
227 remove_migration_pmd(&pvmw, new);
228 continue;
229 }
230 #endif
231
232 get_page(new);
233 pte = pte_mkold(mk_pte(new, READ_ONCE(vma->vm_page_prot)));
234 if (pte_swp_soft_dirty(*pvmw.pte))
235 pte = pte_mksoft_dirty(pte);
236
237 /*
238 * Recheck VMA as permissions can change since migration started
239 */
240 entry = pte_to_swp_entry(*pvmw.pte);
241 if (is_write_migration_entry(entry))
242 pte = maybe_mkwrite(pte, vma);
243
244 if (unlikely(is_zone_device_page(new))) {
245 if (is_device_private_page(new)) {
246 entry = make_device_private_entry(new, pte_write(pte));
247 pte = swp_entry_to_pte(entry);
248 } else if (is_device_public_page(new)) {
249 pte = pte_mkdevmap(pte);
250 flush_dcache_page(new);
251 }
252 } else
253 flush_dcache_page(new);
254
255 #ifdef CONFIG_HUGETLB_PAGE
256 if (PageHuge(new)) {
257 pte = pte_mkhuge(pte);
258 pte = arch_make_huge_pte(pte, vma, new, 0);
259 set_huge_pte_at(vma->vm_mm, pvmw.address, pvmw.pte, pte);
260 if (PageAnon(new))
261 hugepage_add_anon_rmap(new, vma, pvmw.address);
262 else
263 page_dup_rmap(new, true);
264 } else
265 #endif
266 {
267 set_pte_at(vma->vm_mm, pvmw.address, pvmw.pte, pte);
268
269 if (PageAnon(new))
270 page_add_anon_rmap(new, vma, pvmw.address, false);
271 else
272 page_add_file_rmap(new, false);
273 }
274 if (vma->vm_flags & VM_LOCKED && !PageTransCompound(new))
275 mlock_vma_page(new);
276
277 if (PageTransHuge(page) && PageMlocked(page))
278 clear_page_mlock(page);
279
280 /* No need to invalidate - it was non-present before */
281 update_mmu_cache(vma, pvmw.address, pvmw.pte);
282 }
283
284 return true;
285 }
286
287 /*
288 * Get rid of all migration entries and replace them by
289 * references to the indicated page.
290 */
291 void remove_migration_ptes(struct page *old, struct page *new, bool locked)
292 {
293 struct rmap_walk_control rwc = {
294 .rmap_one = remove_migration_pte,
295 .arg = old,
296 };
297
298 if (locked)
299 rmap_walk_locked(new, &rwc);
300 else
301 rmap_walk(new, &rwc);
302 }
303
304 /*
305 * Something used the pte of a page under migration. We need to
306 * get to the page and wait until migration is finished.
307 * When we return from this function the fault will be retried.
308 */
309 void __migration_entry_wait(struct mm_struct *mm, pte_t *ptep,
310 spinlock_t *ptl)
311 {
312 pte_t pte;
313 swp_entry_t entry;
314 struct page *page;
315
316 spin_lock(ptl);
317 pte = *ptep;
318 if (!is_swap_pte(pte))
319 goto out;
320
321 entry = pte_to_swp_entry(pte);
322 if (!is_migration_entry(entry))
323 goto out;
324
325 page = migration_entry_to_page(entry);
326
327 /*
328 * Once radix-tree replacement of page migration started, page_count
329 * *must* be zero. And, we don't want to call wait_on_page_locked()
330 * against a page without get_page().
331 * So, we use get_page_unless_zero(), here. Even failed, page fault
332 * will occur again.
333 */
334 if (!get_page_unless_zero(page))
335 goto out;
336 pte_unmap_unlock(ptep, ptl);
337 wait_on_page_locked(page);
338 put_page(page);
339 return;
340 out:
341 pte_unmap_unlock(ptep, ptl);
342 }
343
344 void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
345 unsigned long address)
346 {
347 spinlock_t *ptl = pte_lockptr(mm, pmd);
348 pte_t *ptep = pte_offset_map(pmd, address);
349 __migration_entry_wait(mm, ptep, ptl);
350 }
351
352 void migration_entry_wait_huge(struct vm_area_struct *vma,
353 struct mm_struct *mm, pte_t *pte)
354 {
355 spinlock_t *ptl = huge_pte_lockptr(hstate_vma(vma), mm, pte);
356 __migration_entry_wait(mm, pte, ptl);
357 }
358
359 #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION
360 void pmd_migration_entry_wait(struct mm_struct *mm, pmd_t *pmd)
361 {
362 spinlock_t *ptl;
363 struct page *page;
364
365 ptl = pmd_lock(mm, pmd);
366 if (!is_pmd_migration_entry(*pmd))
367 goto unlock;
368 page = migration_entry_to_page(pmd_to_swp_entry(*pmd));
369 if (!get_page_unless_zero(page))
370 goto unlock;
371 spin_unlock(ptl);
372 wait_on_page_locked(page);
373 put_page(page);
374 return;
375 unlock:
376 spin_unlock(ptl);
377 }
378 #endif
379
380 #ifdef CONFIG_BLOCK
381 /* Returns true if all buffers are successfully locked */
382 static bool buffer_migrate_lock_buffers(struct buffer_head *head,
383 enum migrate_mode mode)
384 {
385 struct buffer_head *bh = head;
386
387 /* Simple case, sync compaction */
388 if (mode != MIGRATE_ASYNC) {
389 do {
390 get_bh(bh);
391 lock_buffer(bh);
392 bh = bh->b_this_page;
393
394 } while (bh != head);
395
396 return true;
397 }
398
399 /* async case, we cannot block on lock_buffer so use trylock_buffer */
400 do {
401 get_bh(bh);
402 if (!trylock_buffer(bh)) {
403 /*
404 * We failed to lock the buffer and cannot stall in
405 * async migration. Release the taken locks
406 */
407 struct buffer_head *failed_bh = bh;
408 put_bh(failed_bh);
409 bh = head;
410 while (bh != failed_bh) {
411 unlock_buffer(bh);
412 put_bh(bh);
413 bh = bh->b_this_page;
414 }
415 return false;
416 }
417
418 bh = bh->b_this_page;
419 } while (bh != head);
420 return true;
421 }
422 #else
423 static inline bool buffer_migrate_lock_buffers(struct buffer_head *head,
424 enum migrate_mode mode)
425 {
426 return true;
427 }
428 #endif /* CONFIG_BLOCK */
429
430 /*
431 * Replace the page in the mapping.
432 *
433 * The number of remaining references must be:
434 * 1 for anonymous pages without a mapping
435 * 2 for pages with a mapping
436 * 3 for pages with a mapping and PagePrivate/PagePrivate2 set.
437 */
438 int migrate_page_move_mapping(struct address_space *mapping,
439 struct page *newpage, struct page *page,
440 struct buffer_head *head, enum migrate_mode mode,
441 int extra_count)
442 {
443 struct zone *oldzone, *newzone;
444 int dirty;
445 int expected_count = 1 + extra_count;
446 void **pslot;
447
448 /*
449 * Device public or private pages have an extra refcount as they are
450 * ZONE_DEVICE pages.
451 */
452 expected_count += is_device_private_page(page);
453 expected_count += is_device_public_page(page);
454
455 if (!mapping) {
456 /* Anonymous page without mapping */
457 if (page_count(page) != expected_count)
458 return -EAGAIN;
459
460 /* No turning back from here */
461 newpage->index = page->index;
462 newpage->mapping = page->mapping;
463 if (PageSwapBacked(page))
464 __SetPageSwapBacked(newpage);
465
466 return MIGRATEPAGE_SUCCESS;
467 }
468
469 oldzone = page_zone(page);
470 newzone = page_zone(newpage);
471
472 spin_lock_irq(&mapping->tree_lock);
473
474 pslot = radix_tree_lookup_slot(&mapping->page_tree,
475 page_index(page));
476
477 expected_count += 1 + page_has_private(page);
478 if (page_count(page) != expected_count ||
479 radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
480 spin_unlock_irq(&mapping->tree_lock);
481 return -EAGAIN;
482 }
483
484 if (!page_ref_freeze(page, expected_count)) {
485 spin_unlock_irq(&mapping->tree_lock);
486 return -EAGAIN;
487 }
488
489 /*
490 * In the async migration case of moving a page with buffers, lock the
491 * buffers using trylock before the mapping is moved. If the mapping
492 * was moved, we later failed to lock the buffers and could not move
493 * the mapping back due to an elevated page count, we would have to
494 * block waiting on other references to be dropped.
495 */
496 if (mode == MIGRATE_ASYNC && head &&
497 !buffer_migrate_lock_buffers(head, mode)) {
498 page_ref_unfreeze(page, expected_count);
499 spin_unlock_irq(&mapping->tree_lock);
500 return -EAGAIN;
501 }
502
503 /*
504 * Now we know that no one else is looking at the page:
505 * no turning back from here.
506 */
507 newpage->index = page->index;
508 newpage->mapping = page->mapping;
509 get_page(newpage); /* add cache reference */
510 if (PageSwapBacked(page)) {
511 __SetPageSwapBacked(newpage);
512 if (PageSwapCache(page)) {
513 SetPageSwapCache(newpage);
514 set_page_private(newpage, page_private(page));
515 }
516 } else {
517 VM_BUG_ON_PAGE(PageSwapCache(page), page);
518 }
519
520 /* Move dirty while page refs frozen and newpage not yet exposed */
521 dirty = PageDirty(page);
522 if (dirty) {
523 ClearPageDirty(page);
524 SetPageDirty(newpage);
525 }
526
527 radix_tree_replace_slot(&mapping->page_tree, pslot, newpage);
528
529 /*
530 * Drop cache reference from old page by unfreezing
531 * to one less reference.
532 * We know this isn't the last reference.
533 */
534 page_ref_unfreeze(page, expected_count - 1);
535
536 spin_unlock(&mapping->tree_lock);
537 /* Leave irq disabled to prevent preemption while updating stats */
538
539 /*
540 * If moved to a different zone then also account
541 * the page for that zone. Other VM counters will be
542 * taken care of when we establish references to the
543 * new page and drop references to the old page.
544 *
545 * Note that anonymous pages are accounted for
546 * via NR_FILE_PAGES and NR_ANON_MAPPED if they
547 * are mapped to swap space.
548 */
549 if (newzone != oldzone) {
550 __dec_node_state(oldzone->zone_pgdat, NR_FILE_PAGES);
551 __inc_node_state(newzone->zone_pgdat, NR_FILE_PAGES);
552 if (PageSwapBacked(page) && !PageSwapCache(page)) {
553 __dec_node_state(oldzone->zone_pgdat, NR_SHMEM);
554 __inc_node_state(newzone->zone_pgdat, NR_SHMEM);
555 }
556 if (dirty && mapping_cap_account_dirty(mapping)) {
557 __dec_node_state(oldzone->zone_pgdat, NR_FILE_DIRTY);
558 __dec_zone_state(oldzone, NR_ZONE_WRITE_PENDING);
559 __inc_node_state(newzone->zone_pgdat, NR_FILE_DIRTY);
560 __inc_zone_state(newzone, NR_ZONE_WRITE_PENDING);
561 }
562 }
563 local_irq_enable();
564
565 return MIGRATEPAGE_SUCCESS;
566 }
567 EXPORT_SYMBOL(migrate_page_move_mapping);
568
569 /*
570 * The expected number of remaining references is the same as that
571 * of migrate_page_move_mapping().
572 */
573 int migrate_huge_page_move_mapping(struct address_space *mapping,
574 struct page *newpage, struct page *page)
575 {
576 int expected_count;
577 void **pslot;
578
579 spin_lock_irq(&mapping->tree_lock);
580
581 pslot = radix_tree_lookup_slot(&mapping->page_tree,
582 page_index(page));
583
584 expected_count = 2 + page_has_private(page);
585 if (page_count(page) != expected_count ||
586 radix_tree_deref_slot_protected(pslot, &mapping->tree_lock) != page) {
587 spin_unlock_irq(&mapping->tree_lock);
588 return -EAGAIN;
589 }
590
591 if (!page_ref_freeze(page, expected_count)) {
592 spin_unlock_irq(&mapping->tree_lock);
593 return -EAGAIN;
594 }
595
596 newpage->index = page->index;
597 newpage->mapping = page->mapping;
598
599 get_page(newpage);
600
601 radix_tree_replace_slot(&mapping->page_tree, pslot, newpage);
602
603 page_ref_unfreeze(page, expected_count - 1);
604
605 spin_unlock_irq(&mapping->tree_lock);
606
607 return MIGRATEPAGE_SUCCESS;
608 }
609
610 /*
611 * Gigantic pages are so large that we do not guarantee that page++ pointer
612 * arithmetic will work across the entire page. We need something more
613 * specialized.
614 */
615 static void __copy_gigantic_page(struct page *dst, struct page *src,
616 int nr_pages)
617 {
618 int i;
619 struct page *dst_base = dst;
620 struct page *src_base = src;
621
622 for (i = 0; i < nr_pages; ) {
623 cond_resched();
624 copy_highpage(dst, src);
625
626 i++;
627 dst = mem_map_next(dst, dst_base, i);
628 src = mem_map_next(src, src_base, i);
629 }
630 }
631
632 static void copy_huge_page(struct page *dst, struct page *src)
633 {
634 int i;
635 int nr_pages;
636
637 if (PageHuge(src)) {
638 /* hugetlbfs page */
639 struct hstate *h = page_hstate(src);
640 nr_pages = pages_per_huge_page(h);
641
642 if (unlikely(nr_pages > MAX_ORDER_NR_PAGES)) {
643 __copy_gigantic_page(dst, src, nr_pages);
644 return;
645 }
646 } else {
647 /* thp page */
648 BUG_ON(!PageTransHuge(src));
649 nr_pages = hpage_nr_pages(src);
650 }
651
652 for (i = 0; i < nr_pages; i++) {
653 cond_resched();
654 copy_highpage(dst + i, src + i);
655 }
656 }
657
658 /*
659 * Copy the page to its new location
660 */
661 void migrate_page_states(struct page *newpage, struct page *page)
662 {
663 int cpupid;
664
665 if (PageError(page))
666 SetPageError(newpage);
667 if (PageReferenced(page))
668 SetPageReferenced(newpage);
669 if (PageUptodate(page))
670 SetPageUptodate(newpage);
671 if (TestClearPageActive(page)) {
672 VM_BUG_ON_PAGE(PageUnevictable(page), page);
673 SetPageActive(newpage);
674 } else if (TestClearPageUnevictable(page))
675 SetPageUnevictable(newpage);
676 if (PageChecked(page))
677 SetPageChecked(newpage);
678 if (PageMappedToDisk(page))
679 SetPageMappedToDisk(newpage);
680
681 /* Move dirty on pages not done by migrate_page_move_mapping() */
682 if (PageDirty(page))
683 SetPageDirty(newpage);
684
685 if (page_is_young(page))
686 set_page_young(newpage);
687 if (page_is_idle(page))
688 set_page_idle(newpage);
689
690 /*
691 * Copy NUMA information to the new page, to prevent over-eager
692 * future migrations of this same page.
693 */
694 cpupid = page_cpupid_xchg_last(page, -1);
695 page_cpupid_xchg_last(newpage, cpupid);
696
697 ksm_migrate_page(newpage, page);
698 /*
699 * Please do not reorder this without considering how mm/ksm.c's
700 * get_ksm_page() depends upon ksm_migrate_page() and PageSwapCache().
701 */
702 if (PageSwapCache(page))
703 ClearPageSwapCache(page);
704 ClearPagePrivate(page);
705 set_page_private(page, 0);
706
707 /*
708 * If any waiters have accumulated on the new page then
709 * wake them up.
710 */
711 if (PageWriteback(newpage))
712 end_page_writeback(newpage);
713
714 copy_page_owner(page, newpage);
715
716 mem_cgroup_migrate(page, newpage);
717 }
718 EXPORT_SYMBOL(migrate_page_states);
719
720 void migrate_page_copy(struct page *newpage, struct page *page)
721 {
722 if (PageHuge(page) || PageTransHuge(page))
723 copy_huge_page(newpage, page);
724 else
725 copy_highpage(newpage, page);
726
727 migrate_page_states(newpage, page);
728 }
729 EXPORT_SYMBOL(migrate_page_copy);
730
731 /************************************************************
732 * Migration functions
733 ***********************************************************/
734
735 /*
736 * Common logic to directly migrate a single LRU page suitable for
737 * pages that do not use PagePrivate/PagePrivate2.
738 *
739 * Pages are locked upon entry and exit.
740 */
741 int migrate_page(struct address_space *mapping,
742 struct page *newpage, struct page *page,
743 enum migrate_mode mode)
744 {
745 int rc;
746
747 BUG_ON(PageWriteback(page)); /* Writeback must be complete */
748
749 rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
750
751 if (rc != MIGRATEPAGE_SUCCESS)
752 return rc;
753
754 if (mode != MIGRATE_SYNC_NO_COPY)
755 migrate_page_copy(newpage, page);
756 else
757 migrate_page_states(newpage, page);
758 return MIGRATEPAGE_SUCCESS;
759 }
760 EXPORT_SYMBOL(migrate_page);
761
762 #ifdef CONFIG_BLOCK
763 /*
764 * Migration function for pages with buffers. This function can only be used
765 * if the underlying filesystem guarantees that no other references to "page"
766 * exist.
767 */
768 int buffer_migrate_page(struct address_space *mapping,
769 struct page *newpage, struct page *page, enum migrate_mode mode)
770 {
771 struct buffer_head *bh, *head;
772 int rc;
773
774 if (!page_has_buffers(page))
775 return migrate_page(mapping, newpage, page, mode);
776
777 head = page_buffers(page);
778
779 rc = migrate_page_move_mapping(mapping, newpage, page, head, mode, 0);
780
781 if (rc != MIGRATEPAGE_SUCCESS)
782 return rc;
783
784 /*
785 * In the async case, migrate_page_move_mapping locked the buffers
786 * with an IRQ-safe spinlock held. In the sync case, the buffers
787 * need to be locked now
788 */
789 if (mode != MIGRATE_ASYNC)
790 BUG_ON(!buffer_migrate_lock_buffers(head, mode));
791
792 ClearPagePrivate(page);
793 set_page_private(newpage, page_private(page));
794 set_page_private(page, 0);
795 put_page(page);
796 get_page(newpage);
797
798 bh = head;
799 do {
800 set_bh_page(bh, newpage, bh_offset(bh));
801 bh = bh->b_this_page;
802
803 } while (bh != head);
804
805 SetPagePrivate(newpage);
806
807 if (mode != MIGRATE_SYNC_NO_COPY)
808 migrate_page_copy(newpage, page);
809 else
810 migrate_page_states(newpage, page);
811
812 bh = head;
813 do {
814 unlock_buffer(bh);
815 put_bh(bh);
816 bh = bh->b_this_page;
817
818 } while (bh != head);
819
820 return MIGRATEPAGE_SUCCESS;
821 }
822 EXPORT_SYMBOL(buffer_migrate_page);
823 #endif
824
825 /*
826 * Writeback a page to clean the dirty state
827 */
828 static int writeout(struct address_space *mapping, struct page *page)
829 {
830 struct writeback_control wbc = {
831 .sync_mode = WB_SYNC_NONE,
832 .nr_to_write = 1,
833 .range_start = 0,
834 .range_end = LLONG_MAX,
835 .for_reclaim = 1
836 };
837 int rc;
838
839 if (!mapping->a_ops->writepage)
840 /* No write method for the address space */
841 return -EINVAL;
842
843 if (!clear_page_dirty_for_io(page))
844 /* Someone else already triggered a write */
845 return -EAGAIN;
846
847 /*
848 * A dirty page may imply that the underlying filesystem has
849 * the page on some queue. So the page must be clean for
850 * migration. Writeout may mean we loose the lock and the
851 * page state is no longer what we checked for earlier.
852 * At this point we know that the migration attempt cannot
853 * be successful.
854 */
855 remove_migration_ptes(page, page, false);
856
857 rc = mapping->a_ops->writepage(page, &wbc);
858
859 if (rc != AOP_WRITEPAGE_ACTIVATE)
860 /* unlocked. Relock */
861 lock_page(page);
862
863 return (rc < 0) ? -EIO : -EAGAIN;
864 }
865
866 /*
867 * Default handling if a filesystem does not provide a migration function.
868 */
869 static int fallback_migrate_page(struct address_space *mapping,
870 struct page *newpage, struct page *page, enum migrate_mode mode)
871 {
872 if (PageDirty(page)) {
873 /* Only writeback pages in full synchronous migration */
874 switch (mode) {
875 case MIGRATE_SYNC:
876 case MIGRATE_SYNC_NO_COPY:
877 break;
878 default:
879 return -EBUSY;
880 }
881 return writeout(mapping, page);
882 }
883
884 /*
885 * Buffers may be managed in a filesystem specific way.
886 * We must have no buffers or drop them.
887 */
888 if (page_has_private(page) &&
889 !try_to_release_page(page, GFP_KERNEL))
890 return -EAGAIN;
891
892 return migrate_page(mapping, newpage, page, mode);
893 }
894
895 /*
896 * Move a page to a newly allocated page
897 * The page is locked and all ptes have been successfully removed.
898 *
899 * The new page will have replaced the old page if this function
900 * is successful.
901 *
902 * Return value:
903 * < 0 - error code
904 * MIGRATEPAGE_SUCCESS - success
905 */
906 static int move_to_new_page(struct page *newpage, struct page *page,
907 enum migrate_mode mode)
908 {
909 struct address_space *mapping;
910 int rc = -EAGAIN;
911 bool is_lru = !__PageMovable(page);
912
913 VM_BUG_ON_PAGE(!PageLocked(page), page);
914 VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
915
916 mapping = page_mapping(page);
917
918 if (likely(is_lru)) {
919 if (!mapping)
920 rc = migrate_page(mapping, newpage, page, mode);
921 else if (mapping->a_ops->migratepage)
922 /*
923 * Most pages have a mapping and most filesystems
924 * provide a migratepage callback. Anonymous pages
925 * are part of swap space which also has its own
926 * migratepage callback. This is the most common path
927 * for page migration.
928 */
929 rc = mapping->a_ops->migratepage(mapping, newpage,
930 page, mode);
931 else
932 rc = fallback_migrate_page(mapping, newpage,
933 page, mode);
934 } else {
935 /*
936 * In case of non-lru page, it could be released after
937 * isolation step. In that case, we shouldn't try migration.
938 */
939 VM_BUG_ON_PAGE(!PageIsolated(page), page);
940 if (!PageMovable(page)) {
941 rc = MIGRATEPAGE_SUCCESS;
942 __ClearPageIsolated(page);
943 goto out;
944 }
945
946 rc = mapping->a_ops->migratepage(mapping, newpage,
947 page, mode);
948 WARN_ON_ONCE(rc == MIGRATEPAGE_SUCCESS &&
949 !PageIsolated(page));
950 }
951
952 /*
953 * When successful, old pagecache page->mapping must be cleared before
954 * page is freed; but stats require that PageAnon be left as PageAnon.
955 */
956 if (rc == MIGRATEPAGE_SUCCESS) {
957 if (__PageMovable(page)) {
958 VM_BUG_ON_PAGE(!PageIsolated(page), page);
959
960 /*
961 * We clear PG_movable under page_lock so any compactor
962 * cannot try to migrate this page.
963 */
964 __ClearPageIsolated(page);
965 }
966
967 /*
968 * Anonymous and movable page->mapping will be cleard by
969 * free_pages_prepare so don't reset it here for keeping
970 * the type to work PageAnon, for example.
971 */
972 if (!PageMappingFlags(page))
973 page->mapping = NULL;
974 }
975 out:
976 return rc;
977 }
978
979 static int __unmap_and_move(struct page *page, struct page *newpage,
980 int force, enum migrate_mode mode)
981 {
982 int rc = -EAGAIN;
983 int page_was_mapped = 0;
984 struct anon_vma *anon_vma = NULL;
985 bool is_lru = !__PageMovable(page);
986
987 if (!trylock_page(page)) {
988 if (!force || mode == MIGRATE_ASYNC)
989 goto out;
990
991 /*
992 * It's not safe for direct compaction to call lock_page.
993 * For example, during page readahead pages are added locked
994 * to the LRU. Later, when the IO completes the pages are
995 * marked uptodate and unlocked. However, the queueing
996 * could be merging multiple pages for one bio (e.g.
997 * mpage_readpages). If an allocation happens for the
998 * second or third page, the process can end up locking
999 * the same page twice and deadlocking. Rather than
1000 * trying to be clever about what pages can be locked,
1001 * avoid the use of lock_page for direct compaction
1002 * altogether.
1003 */
1004 if (current->flags & PF_MEMALLOC)
1005 goto out;
1006
1007 lock_page(page);
1008 }
1009
1010 if (PageWriteback(page)) {
1011 /*
1012 * Only in the case of a full synchronous migration is it
1013 * necessary to wait for PageWriteback. In the async case,
1014 * the retry loop is too short and in the sync-light case,
1015 * the overhead of stalling is too much
1016 */
1017 switch (mode) {
1018 case MIGRATE_SYNC:
1019 case MIGRATE_SYNC_NO_COPY:
1020 break;
1021 default:
1022 rc = -EBUSY;
1023 goto out_unlock;
1024 }
1025 if (!force)
1026 goto out_unlock;
1027 wait_on_page_writeback(page);
1028 }
1029
1030 /*
1031 * By try_to_unmap(), page->mapcount goes down to 0 here. In this case,
1032 * we cannot notice that anon_vma is freed while we migrates a page.
1033 * This get_anon_vma() delays freeing anon_vma pointer until the end
1034 * of migration. File cache pages are no problem because of page_lock()
1035 * File Caches may use write_page() or lock_page() in migration, then,
1036 * just care Anon page here.
1037 *
1038 * Only page_get_anon_vma() understands the subtleties of
1039 * getting a hold on an anon_vma from outside one of its mms.
1040 * But if we cannot get anon_vma, then we won't need it anyway,
1041 * because that implies that the anon page is no longer mapped
1042 * (and cannot be remapped so long as we hold the page lock).
1043 */
1044 if (PageAnon(page) && !PageKsm(page))
1045 anon_vma = page_get_anon_vma(page);
1046
1047 /*
1048 * Block others from accessing the new page when we get around to
1049 * establishing additional references. We are usually the only one
1050 * holding a reference to newpage at this point. We used to have a BUG
1051 * here if trylock_page(newpage) fails, but would like to allow for
1052 * cases where there might be a race with the previous use of newpage.
1053 * This is much like races on refcount of oldpage: just don't BUG().
1054 */
1055 if (unlikely(!trylock_page(newpage)))
1056 goto out_unlock;
1057
1058 if (unlikely(!is_lru)) {
1059 rc = move_to_new_page(newpage, page, mode);
1060 goto out_unlock_both;
1061 }
1062
1063 /*
1064 * Corner case handling:
1065 * 1. When a new swap-cache page is read into, it is added to the LRU
1066 * and treated as swapcache but it has no rmap yet.
1067 * Calling try_to_unmap() against a page->mapping==NULL page will
1068 * trigger a BUG. So handle it here.
1069 * 2. An orphaned page (see truncate_complete_page) might have
1070 * fs-private metadata. The page can be picked up due to memory
1071 * offlining. Everywhere else except page reclaim, the page is
1072 * invisible to the vm, so the page can not be migrated. So try to
1073 * free the metadata, so the page can be freed.
1074 */
1075 if (!page->mapping) {
1076 VM_BUG_ON_PAGE(PageAnon(page), page);
1077 if (page_has_private(page)) {
1078 try_to_free_buffers(page);
1079 goto out_unlock_both;
1080 }
1081 } else if (page_mapped(page)) {
1082 /* Establish migration ptes */
1083 VM_BUG_ON_PAGE(PageAnon(page) && !PageKsm(page) && !anon_vma,
1084 page);
1085 try_to_unmap(page,
1086 TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
1087 page_was_mapped = 1;
1088 }
1089
1090 if (!page_mapped(page))
1091 rc = move_to_new_page(newpage, page, mode);
1092
1093 if (page_was_mapped)
1094 remove_migration_ptes(page,
1095 rc == MIGRATEPAGE_SUCCESS ? newpage : page, false);
1096
1097 out_unlock_both:
1098 unlock_page(newpage);
1099 out_unlock:
1100 /* Drop an anon_vma reference if we took one */
1101 if (anon_vma)
1102 put_anon_vma(anon_vma);
1103 unlock_page(page);
1104 out:
1105 /*
1106 * If migration is successful, decrease refcount of the newpage
1107 * which will not free the page because new page owner increased
1108 * refcounter. As well, if it is LRU page, add the page to LRU
1109 * list in here. Use the old state of the isolated source page to
1110 * determine if we migrated a LRU page. newpage was already unlocked
1111 * and possibly modified by its owner - don't rely on the page
1112 * state.
1113 */
1114 if (rc == MIGRATEPAGE_SUCCESS) {
1115 if (unlikely(!is_lru))
1116 put_page(newpage);
1117 else
1118 putback_lru_page(newpage);
1119 }
1120
1121 return rc;
1122 }
1123
1124 /*
1125 * gcc 4.7 and 4.8 on arm get an ICEs when inlining unmap_and_move(). Work
1126 * around it.
1127 */
1128 #if (GCC_VERSION >= 40700 && GCC_VERSION < 40900) && defined(CONFIG_ARM)
1129 #define ICE_noinline noinline
1130 #else
1131 #define ICE_noinline
1132 #endif
1133
1134 /*
1135 * Obtain the lock on page, remove all ptes and migrate the page
1136 * to the newly allocated page in newpage.
1137 */
1138 static ICE_noinline int unmap_and_move(new_page_t get_new_page,
1139 free_page_t put_new_page,
1140 unsigned long private, struct page *page,
1141 int force, enum migrate_mode mode,
1142 enum migrate_reason reason)
1143 {
1144 int rc = MIGRATEPAGE_SUCCESS;
1145 int *result = NULL;
1146 struct page *newpage;
1147
1148 newpage = get_new_page(page, private, &result);
1149 if (!newpage)
1150 return -ENOMEM;
1151
1152 if (page_count(page) == 1) {
1153 /* page was freed from under us. So we are done. */
1154 ClearPageActive(page);
1155 ClearPageUnevictable(page);
1156 if (unlikely(__PageMovable(page))) {
1157 lock_page(page);
1158 if (!PageMovable(page))
1159 __ClearPageIsolated(page);
1160 unlock_page(page);
1161 }
1162 if (put_new_page)
1163 put_new_page(newpage, private);
1164 else
1165 put_page(newpage);
1166 goto out;
1167 }
1168
1169 if (unlikely(PageTransHuge(page) && !PageTransHuge(newpage))) {
1170 lock_page(page);
1171 rc = split_huge_page(page);
1172 unlock_page(page);
1173 if (rc)
1174 goto out;
1175 }
1176
1177 rc = __unmap_and_move(page, newpage, force, mode);
1178 if (rc == MIGRATEPAGE_SUCCESS)
1179 set_page_owner_migrate_reason(newpage, reason);
1180
1181 out:
1182 if (rc != -EAGAIN) {
1183 /*
1184 * A page that has been migrated has all references
1185 * removed and will be freed. A page that has not been
1186 * migrated will have kepts its references and be
1187 * restored.
1188 */
1189 list_del(&page->lru);
1190
1191 /*
1192 * Compaction can migrate also non-LRU pages which are
1193 * not accounted to NR_ISOLATED_*. They can be recognized
1194 * as __PageMovable
1195 */
1196 if (likely(!__PageMovable(page)))
1197 mod_node_page_state(page_pgdat(page), NR_ISOLATED_ANON +
1198 page_is_file_cache(page), -hpage_nr_pages(page));
1199 }
1200
1201 /*
1202 * If migration is successful, releases reference grabbed during
1203 * isolation. Otherwise, restore the page to right list unless
1204 * we want to retry.
1205 */
1206 if (rc == MIGRATEPAGE_SUCCESS) {
1207 put_page(page);
1208 if (reason == MR_MEMORY_FAILURE) {
1209 /*
1210 * Set PG_HWPoison on just freed page
1211 * intentionally. Although it's rather weird,
1212 * it's how HWPoison flag works at the moment.
1213 */
1214 if (!test_set_page_hwpoison(page))
1215 num_poisoned_pages_inc();
1216 }
1217 } else {
1218 if (rc != -EAGAIN) {
1219 if (likely(!__PageMovable(page))) {
1220 putback_lru_page(page);
1221 goto put_new;
1222 }
1223
1224 lock_page(page);
1225 if (PageMovable(page))
1226 putback_movable_page(page);
1227 else
1228 __ClearPageIsolated(page);
1229 unlock_page(page);
1230 put_page(page);
1231 }
1232 put_new:
1233 if (put_new_page)
1234 put_new_page(newpage, private);
1235 else
1236 put_page(newpage);
1237 }
1238
1239 if (result) {
1240 if (rc)
1241 *result = rc;
1242 else
1243 *result = page_to_nid(newpage);
1244 }
1245 return rc;
1246 }
1247
1248 /*
1249 * Counterpart of unmap_and_move_page() for hugepage migration.
1250 *
1251 * This function doesn't wait the completion of hugepage I/O
1252 * because there is no race between I/O and migration for hugepage.
1253 * Note that currently hugepage I/O occurs only in direct I/O
1254 * where no lock is held and PG_writeback is irrelevant,
1255 * and writeback status of all subpages are counted in the reference
1256 * count of the head page (i.e. if all subpages of a 2MB hugepage are
1257 * under direct I/O, the reference of the head page is 512 and a bit more.)
1258 * This means that when we try to migrate hugepage whose subpages are
1259 * doing direct I/O, some references remain after try_to_unmap() and
1260 * hugepage migration fails without data corruption.
1261 *
1262 * There is also no race when direct I/O is issued on the page under migration,
1263 * because then pte is replaced with migration swap entry and direct I/O code
1264 * will wait in the page fault for migration to complete.
1265 */
1266 static int unmap_and_move_huge_page(new_page_t get_new_page,
1267 free_page_t put_new_page, unsigned long private,
1268 struct page *hpage, int force,
1269 enum migrate_mode mode, int reason)
1270 {
1271 int rc = -EAGAIN;
1272 int *result = NULL;
1273 int page_was_mapped = 0;
1274 struct page *new_hpage;
1275 struct anon_vma *anon_vma = NULL;
1276
1277 /*
1278 * Movability of hugepages depends on architectures and hugepage size.
1279 * This check is necessary because some callers of hugepage migration
1280 * like soft offline and memory hotremove don't walk through page
1281 * tables or check whether the hugepage is pmd-based or not before
1282 * kicking migration.
1283 */
1284 if (!hugepage_migration_supported(page_hstate(hpage))) {
1285 putback_active_hugepage(hpage);
1286 return -ENOSYS;
1287 }
1288
1289 new_hpage = get_new_page(hpage, private, &result);
1290 if (!new_hpage)
1291 return -ENOMEM;
1292
1293 if (!trylock_page(hpage)) {
1294 if (!force)
1295 goto out;
1296 switch (mode) {
1297 case MIGRATE_SYNC:
1298 case MIGRATE_SYNC_NO_COPY:
1299 break;
1300 default:
1301 goto out;
1302 }
1303 lock_page(hpage);
1304 }
1305
1306 /*
1307 * Check for pages which are in the process of being freed. Without
1308 * page_mapping() set, hugetlbfs specific move page routine will not
1309 * be called and we could leak usage counts for subpools.
1310 */
1311 if (page_private(hpage) && !page_mapping(hpage)) {
1312 rc = -EBUSY;
1313 goto out_unlock;
1314 }
1315
1316 if (PageAnon(hpage))
1317 anon_vma = page_get_anon_vma(hpage);
1318
1319 if (unlikely(!trylock_page(new_hpage)))
1320 goto put_anon;
1321
1322 if (page_mapped(hpage)) {
1323 try_to_unmap(hpage,
1324 TTU_MIGRATION|TTU_IGNORE_MLOCK|TTU_IGNORE_ACCESS);
1325 page_was_mapped = 1;
1326 }
1327
1328 if (!page_mapped(hpage))
1329 rc = move_to_new_page(new_hpage, hpage, mode);
1330
1331 if (page_was_mapped)
1332 remove_migration_ptes(hpage,
1333 rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage, false);
1334
1335 unlock_page(new_hpage);
1336
1337 put_anon:
1338 if (anon_vma)
1339 put_anon_vma(anon_vma);
1340
1341 if (rc == MIGRATEPAGE_SUCCESS) {
1342 hugetlb_cgroup_migrate(hpage, new_hpage);
1343 put_new_page = NULL;
1344 set_page_owner_migrate_reason(new_hpage, reason);
1345 }
1346
1347 out_unlock:
1348 unlock_page(hpage);
1349 out:
1350 if (rc != -EAGAIN)
1351 putback_active_hugepage(hpage);
1352 if (reason == MR_MEMORY_FAILURE && !test_set_page_hwpoison(hpage))
1353 num_poisoned_pages_inc();
1354
1355 /*
1356 * If migration was not successful and there's a freeing callback, use
1357 * it. Otherwise, put_page() will drop the reference grabbed during
1358 * isolation.
1359 */
1360 if (put_new_page)
1361 put_new_page(new_hpage, private);
1362 else
1363 putback_active_hugepage(new_hpage);
1364
1365 if (result) {
1366 if (rc)
1367 *result = rc;
1368 else
1369 *result = page_to_nid(new_hpage);
1370 }
1371 return rc;
1372 }
1373
1374 /*
1375 * migrate_pages - migrate the pages specified in a list, to the free pages
1376 * supplied as the target for the page migration
1377 *
1378 * @from: The list of pages to be migrated.
1379 * @get_new_page: The function used to allocate free pages to be used
1380 * as the target of the page migration.
1381 * @put_new_page: The function used to free target pages if migration
1382 * fails, or NULL if no special handling is necessary.
1383 * @private: Private data to be passed on to get_new_page()
1384 * @mode: The migration mode that specifies the constraints for
1385 * page migration, if any.
1386 * @reason: The reason for page migration.
1387 *
1388 * The function returns after 10 attempts or if no pages are movable any more
1389 * because the list has become empty or no retryable pages exist any more.
1390 * The caller should call putback_movable_pages() to return pages to the LRU
1391 * or free list only if ret != 0.
1392 *
1393 * Returns the number of pages that were not migrated, or an error code.
1394 */
1395 int migrate_pages(struct list_head *from, new_page_t get_new_page,
1396 free_page_t put_new_page, unsigned long private,
1397 enum migrate_mode mode, int reason)
1398 {
1399 int retry = 1;
1400 int nr_failed = 0;
1401 int nr_succeeded = 0;
1402 int pass = 0;
1403 struct page *page;
1404 struct page *page2;
1405 int swapwrite = current->flags & PF_SWAPWRITE;
1406 int rc;
1407
1408 if (!swapwrite)
1409 current->flags |= PF_SWAPWRITE;
1410
1411 for(pass = 0; pass < 10 && retry; pass++) {
1412 retry = 0;
1413
1414 list_for_each_entry_safe(page, page2, from, lru) {
1415 cond_resched();
1416
1417 if (PageHuge(page))
1418 rc = unmap_and_move_huge_page(get_new_page,
1419 put_new_page, private, page,
1420 pass > 2, mode, reason);
1421 else
1422 rc = unmap_and_move(get_new_page, put_new_page,
1423 private, page, pass > 2, mode,
1424 reason);
1425
1426 switch(rc) {
1427 case -ENOMEM:
1428 nr_failed++;
1429 goto out;
1430 case -EAGAIN:
1431 retry++;
1432 break;
1433 case MIGRATEPAGE_SUCCESS:
1434 nr_succeeded++;
1435 break;
1436 default:
1437 /*
1438 * Permanent failure (-EBUSY, -ENOSYS, etc.):
1439 * unlike -EAGAIN case, the failed page is
1440 * removed from migration page list and not
1441 * retried in the next outer loop.
1442 */
1443 nr_failed++;
1444 break;
1445 }
1446 }
1447 }
1448 nr_failed += retry;
1449 rc = nr_failed;
1450 out:
1451 if (nr_succeeded)
1452 count_vm_events(PGMIGRATE_SUCCESS, nr_succeeded);
1453 if (nr_failed)
1454 count_vm_events(PGMIGRATE_FAIL, nr_failed);
1455 trace_mm_migrate_pages(nr_succeeded, nr_failed, mode, reason);
1456
1457 if (!swapwrite)
1458 current->flags &= ~PF_SWAPWRITE;
1459
1460 return rc;
1461 }
1462
1463 #ifdef CONFIG_NUMA
1464 /*
1465 * Move a list of individual pages
1466 */
1467 struct page_to_node {
1468 unsigned long addr;
1469 struct page *page;
1470 int node;
1471 int status;
1472 };
1473
1474 static struct page *new_page_node(struct page *p, unsigned long private,
1475 int **result)
1476 {
1477 struct page_to_node *pm = (struct page_to_node *)private;
1478
1479 while (pm->node != MAX_NUMNODES && pm->page != p)
1480 pm++;
1481
1482 if (pm->node == MAX_NUMNODES)
1483 return NULL;
1484
1485 *result = &pm->status;
1486
1487 if (PageHuge(p))
1488 return alloc_huge_page_node(page_hstate(compound_head(p)),
1489 pm->node);
1490 else if (thp_migration_supported() && PageTransHuge(p)) {
1491 struct page *thp;
1492
1493 thp = alloc_pages_node(pm->node,
1494 (GFP_TRANSHUGE | __GFP_THISNODE) & ~__GFP_RECLAIM,
1495 HPAGE_PMD_ORDER);
1496 if (!thp)
1497 return NULL;
1498 prep_transhuge_page(thp);
1499 return thp;
1500 } else
1501 return __alloc_pages_node(pm->node,
1502 GFP_HIGHUSER_MOVABLE | __GFP_THISNODE, 0);
1503 }
1504
1505 /*
1506 * Move a set of pages as indicated in the pm array. The addr
1507 * field must be set to the virtual address of the page to be moved
1508 * and the node number must contain a valid target node.
1509 * The pm array ends with node = MAX_NUMNODES.
1510 */
1511 static int do_move_page_to_node_array(struct mm_struct *mm,
1512 struct page_to_node *pm,
1513 int migrate_all)
1514 {
1515 int err;
1516 struct page_to_node *pp;
1517 LIST_HEAD(pagelist);
1518
1519 down_read(&mm->mmap_sem);
1520
1521 /*
1522 * Build a list of pages to migrate
1523 */
1524 for (pp = pm; pp->node != MAX_NUMNODES; pp++) {
1525 struct vm_area_struct *vma;
1526 struct page *page;
1527 struct page *head;
1528 unsigned int follflags;
1529
1530 err = -EFAULT;
1531 vma = find_vma(mm, pp->addr);
1532 if (!vma || pp->addr < vma->vm_start || !vma_migratable(vma))
1533 goto set_status;
1534
1535 /* FOLL_DUMP to ignore special (like zero) pages */
1536 follflags = FOLL_GET | FOLL_DUMP;
1537 if (!thp_migration_supported())
1538 follflags |= FOLL_SPLIT;
1539 page = follow_page(vma, pp->addr, follflags);
1540
1541 err = PTR_ERR(page);
1542 if (IS_ERR(page))
1543 goto set_status;
1544
1545 err = -ENOENT;
1546 if (!page)
1547 goto set_status;
1548
1549 err = page_to_nid(page);
1550
1551 if (err == pp->node)
1552 /*
1553 * Node already in the right place
1554 */
1555 goto put_and_set;
1556
1557 err = -EACCES;
1558 if (page_mapcount(page) > 1 &&
1559 !migrate_all)
1560 goto put_and_set;
1561
1562 if (PageHuge(page)) {
1563 if (PageHead(page)) {
1564 isolate_huge_page(page, &pagelist);
1565 err = 0;
1566 pp->page = page;
1567 }
1568 goto put_and_set;
1569 }
1570
1571 pp->page = compound_head(page);
1572 head = compound_head(page);
1573 err = isolate_lru_page(head);
1574 if (!err) {
1575 list_add_tail(&head->lru, &pagelist);
1576 mod_node_page_state(page_pgdat(head),
1577 NR_ISOLATED_ANON + page_is_file_cache(head),
1578 hpage_nr_pages(head));
1579 }
1580 put_and_set:
1581 /*
1582 * Either remove the duplicate refcount from
1583 * isolate_lru_page() or drop the page ref if it was
1584 * not isolated.
1585 */
1586 put_page(page);
1587 set_status:
1588 pp->status = err;
1589 }
1590
1591 err = 0;
1592 if (!list_empty(&pagelist)) {
1593 err = migrate_pages(&pagelist, new_page_node, NULL,
1594 (unsigned long)pm, MIGRATE_SYNC, MR_SYSCALL);
1595 if (err)
1596 putback_movable_pages(&pagelist);
1597 }
1598
1599 up_read(&mm->mmap_sem);
1600 return err;
1601 }
1602
1603 /*
1604 * Migrate an array of page address onto an array of nodes and fill
1605 * the corresponding array of status.
1606 */
1607 static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
1608 unsigned long nr_pages,
1609 const void __user * __user *pages,
1610 const int __user *nodes,
1611 int __user *status, int flags)
1612 {
1613 struct page_to_node *pm;
1614 unsigned long chunk_nr_pages;
1615 unsigned long chunk_start;
1616 int err;
1617
1618 err = -ENOMEM;
1619 pm = (struct page_to_node *)__get_free_page(GFP_KERNEL);
1620 if (!pm)
1621 goto out;
1622
1623 migrate_prep();
1624
1625 /*
1626 * Store a chunk of page_to_node array in a page,
1627 * but keep the last one as a marker
1628 */
1629 chunk_nr_pages = (PAGE_SIZE / sizeof(struct page_to_node)) - 1;
1630
1631 for (chunk_start = 0;
1632 chunk_start < nr_pages;
1633 chunk_start += chunk_nr_pages) {
1634 int j;
1635
1636 if (chunk_start + chunk_nr_pages > nr_pages)
1637 chunk_nr_pages = nr_pages - chunk_start;
1638
1639 /* fill the chunk pm with addrs and nodes from user-space */
1640 for (j = 0; j < chunk_nr_pages; j++) {
1641 const void __user *p;
1642 int node;
1643
1644 err = -EFAULT;
1645 if (get_user(p, pages + j + chunk_start))
1646 goto out_pm;
1647 pm[j].addr = (unsigned long) p;
1648
1649 if (get_user(node, nodes + j + chunk_start))
1650 goto out_pm;
1651
1652 err = -ENODEV;
1653 if (node < 0 || node >= MAX_NUMNODES)
1654 goto out_pm;
1655
1656 if (!node_state(node, N_MEMORY))
1657 goto out_pm;
1658
1659 err = -EACCES;
1660 if (!node_isset(node, task_nodes))
1661 goto out_pm;
1662
1663 pm[j].node = node;
1664 }
1665
1666 /* End marker for this chunk */
1667 pm[chunk_nr_pages].node = MAX_NUMNODES;
1668
1669 /* Migrate this chunk */
1670 err = do_move_page_to_node_array(mm, pm,
1671 flags & MPOL_MF_MOVE_ALL);
1672 if (err < 0)
1673 goto out_pm;
1674
1675 /* Return status information */
1676 for (j = 0; j < chunk_nr_pages; j++)
1677 if (put_user(pm[j].status, status + j + chunk_start)) {
1678 err = -EFAULT;
1679 goto out_pm;
1680 }
1681 }
1682 err = 0;
1683
1684 out_pm:
1685 free_page((unsigned long)pm);
1686 out:
1687 return err;
1688 }
1689
1690 /*
1691 * Determine the nodes of an array of pages and store it in an array of status.
1692 */
1693 static void do_pages_stat_array(struct mm_struct *mm, unsigned long nr_pages,
1694 const void __user **pages, int *status)
1695 {
1696 unsigned long i;
1697
1698 down_read(&mm->mmap_sem);
1699
1700 for (i = 0; i < nr_pages; i++) {
1701 unsigned long addr = (unsigned long)(*pages);
1702 struct vm_area_struct *vma;
1703 struct page *page;
1704 int err = -EFAULT;
1705
1706 vma = find_vma(mm, addr);
1707 if (!vma || addr < vma->vm_start)
1708 goto set_status;
1709
1710 /* FOLL_DUMP to ignore special (like zero) pages */
1711 page = follow_page(vma, addr, FOLL_DUMP);
1712
1713 err = PTR_ERR(page);
1714 if (IS_ERR(page))
1715 goto set_status;
1716
1717 err = page ? page_to_nid(page) : -ENOENT;
1718 set_status:
1719 *status = err;
1720
1721 pages++;
1722 status++;
1723 }
1724
1725 up_read(&mm->mmap_sem);
1726 }
1727
1728 /*
1729 * Determine the nodes of a user array of pages and store it in
1730 * a user array of status.
1731 */
1732 static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
1733 const void __user * __user *pages,
1734 int __user *status)
1735 {
1736 #define DO_PAGES_STAT_CHUNK_NR 16
1737 const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
1738 int chunk_status[DO_PAGES_STAT_CHUNK_NR];
1739
1740 while (nr_pages) {
1741 unsigned long chunk_nr;
1742
1743 chunk_nr = nr_pages;
1744 if (chunk_nr > DO_PAGES_STAT_CHUNK_NR)
1745 chunk_nr = DO_PAGES_STAT_CHUNK_NR;
1746
1747 if (copy_from_user(chunk_pages, pages, chunk_nr * sizeof(*chunk_pages)))
1748 break;
1749
1750 do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);
1751
1752 if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status)))
1753 break;
1754
1755 pages += chunk_nr;
1756 status += chunk_nr;
1757 nr_pages -= chunk_nr;
1758 }
1759 return nr_pages ? -EFAULT : 0;
1760 }
1761
1762 /*
1763 * Move a list of pages in the address space of the currently executing
1764 * process.
1765 */
1766 SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
1767 const void __user * __user *, pages,
1768 const int __user *, nodes,
1769 int __user *, status, int, flags)
1770 {
1771 struct task_struct *task;
1772 struct mm_struct *mm;
1773 int err;
1774 nodemask_t task_nodes;
1775
1776 /* Check flags */
1777 if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
1778 return -EINVAL;
1779
1780 if ((flags & MPOL_MF_MOVE_ALL) && !capable(CAP_SYS_NICE))
1781 return -EPERM;
1782
1783 /* Find the mm_struct */
1784 rcu_read_lock();
1785 task = pid ? find_task_by_vpid(pid) : current;
1786 if (!task) {
1787 rcu_read_unlock();
1788 return -ESRCH;
1789 }
1790 get_task_struct(task);
1791
1792 /*
1793 * Check if this process has the right to modify the specified
1794 * process. Use the regular "ptrace_may_access()" checks.
1795 */
1796 if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
1797 rcu_read_unlock();
1798 err = -EPERM;
1799 goto out;
1800 }
1801 rcu_read_unlock();
1802
1803 err = security_task_movememory(task);
1804 if (err)
1805 goto out;
1806
1807 task_nodes = cpuset_mems_allowed(task);
1808 mm = get_task_mm(task);
1809 put_task_struct(task);
1810
1811 if (!mm)
1812 return -EINVAL;
1813
1814 if (nodes)
1815 err = do_pages_move(mm, task_nodes, nr_pages, pages,
1816 nodes, status, flags);
1817 else
1818 err = do_pages_stat(mm, nr_pages, pages, status);
1819
1820 mmput(mm);
1821 return err;
1822
1823 out:
1824 put_task_struct(task);
1825 return err;
1826 }
1827
1828 #ifdef CONFIG_NUMA_BALANCING
1829 /*
1830 * Returns true if this is a safe migration target node for misplaced NUMA
1831 * pages. Currently it only checks the watermarks which crude
1832 */
1833 static bool migrate_balanced_pgdat(struct pglist_data *pgdat,
1834 unsigned long nr_migrate_pages)
1835 {
1836 int z;
1837
1838 for (z = pgdat->nr_zones - 1; z >= 0; z--) {
1839 struct zone *zone = pgdat->node_zones + z;
1840
1841 if (!populated_zone(zone))
1842 continue;
1843
1844 /* Avoid waking kswapd by allocating pages_to_migrate pages. */
1845 if (!zone_watermark_ok(zone, 0,
1846 high_wmark_pages(zone) +
1847 nr_migrate_pages,
1848 0, 0))
1849 continue;
1850 return true;
1851 }
1852 return false;
1853 }
1854
1855 static struct page *alloc_misplaced_dst_page(struct page *page,
1856 unsigned long data,
1857 int **result)
1858 {
1859 int nid = (int) data;
1860 struct page *newpage;
1861
1862 newpage = __alloc_pages_node(nid,
1863 (GFP_HIGHUSER_MOVABLE |
1864 __GFP_THISNODE | __GFP_NOMEMALLOC |
1865 __GFP_NORETRY | __GFP_NOWARN) &
1866 ~__GFP_RECLAIM, 0);
1867
1868 return newpage;
1869 }
1870
1871 /*
1872 * page migration rate limiting control.
1873 * Do not migrate more than @pages_to_migrate in a @migrate_interval_millisecs
1874 * window of time. Default here says do not migrate more than 1280M per second.
1875 */
1876 static unsigned int migrate_interval_millisecs __read_mostly = 100;
1877 static unsigned int ratelimit_pages __read_mostly = 128 << (20 - PAGE_SHIFT);
1878
1879 /* Returns true if the node is migrate rate-limited after the update */
1880 static bool numamigrate_update_ratelimit(pg_data_t *pgdat,
1881 unsigned long nr_pages)
1882 {
1883 /*
1884 * Rate-limit the amount of data that is being migrated to a node.
1885 * Optimal placement is no good if the memory bus is saturated and
1886 * all the time is being spent migrating!
1887 */
1888 if (time_after(jiffies, pgdat->numabalancing_migrate_next_window)) {
1889 spin_lock(&pgdat->numabalancing_migrate_lock);
1890 pgdat->numabalancing_migrate_nr_pages = 0;
1891 pgdat->numabalancing_migrate_next_window = jiffies +
1892 msecs_to_jiffies(migrate_interval_millisecs);
1893 spin_unlock(&pgdat->numabalancing_migrate_lock);
1894 }
1895 if (pgdat->numabalancing_migrate_nr_pages > ratelimit_pages) {
1896 trace_mm_numa_migrate_ratelimit(current, pgdat->node_id,
1897 nr_pages);
1898 return true;
1899 }
1900
1901 /*
1902 * This is an unlocked non-atomic update so errors are possible.
1903 * The consequences are failing to migrate when we potentiall should
1904 * have which is not severe enough to warrant locking. If it is ever
1905 * a problem, it can be converted to a per-cpu counter.
1906 */
1907 pgdat->numabalancing_migrate_nr_pages += nr_pages;
1908 return false;
1909 }
1910
1911 static int numamigrate_isolate_page(pg_data_t *pgdat, struct page *page)
1912 {
1913 int page_lru;
1914
1915 VM_BUG_ON_PAGE(compound_order(page) && !PageTransHuge(page), page);
1916
1917 /* Avoid migrating to a node that is nearly full */
1918 if (!migrate_balanced_pgdat(pgdat, 1UL << compound_order(page)))
1919 return 0;
1920
1921 if (isolate_lru_page(page))
1922 return 0;
1923
1924 /*
1925 * migrate_misplaced_transhuge_page() skips page migration's usual
1926 * check on page_count(), so we must do it here, now that the page
1927 * has been isolated: a GUP pin, or any other pin, prevents migration.
1928 * The expected page count is 3: 1 for page's mapcount and 1 for the
1929 * caller's pin and 1 for the reference taken by isolate_lru_page().
1930 */
1931 if (PageTransHuge(page) && page_count(page) != 3) {
1932 putback_lru_page(page);
1933 return 0;
1934 }
1935
1936 page_lru = page_is_file_cache(page);
1937 mod_node_page_state(page_pgdat(page), NR_ISOLATED_ANON + page_lru,
1938 hpage_nr_pages(page));
1939
1940 /*
1941 * Isolating the page has taken another reference, so the
1942 * caller's reference can be safely dropped without the page
1943 * disappearing underneath us during migration.
1944 */
1945 put_page(page);
1946 return 1;
1947 }
1948
1949 bool pmd_trans_migrating(pmd_t pmd)
1950 {
1951 struct page *page = pmd_page(pmd);
1952 return PageLocked(page);
1953 }
1954
1955 /*
1956 * Attempt to migrate a misplaced page to the specified destination
1957 * node. Caller is expected to have an elevated reference count on
1958 * the page that will be dropped by this function before returning.
1959 */
1960 int migrate_misplaced_page(struct page *page, struct vm_area_struct *vma,
1961 int node)
1962 {
1963 pg_data_t *pgdat = NODE_DATA(node);
1964 int isolated;
1965 int nr_remaining;
1966 LIST_HEAD(migratepages);
1967
1968 /*
1969 * Don't migrate file pages that are mapped in multiple processes
1970 * with execute permissions as they are probably shared libraries.
1971 */
1972 if (page_mapcount(page) != 1 && page_is_file_cache(page) &&
1973 (vma->vm_flags & VM_EXEC))
1974 goto out;
1975
1976 /*
1977 * Rate-limit the amount of data that is being migrated to a node.
1978 * Optimal placement is no good if the memory bus is saturated and
1979 * all the time is being spent migrating!
1980 */
1981 if (numamigrate_update_ratelimit(pgdat, 1))
1982 goto out;
1983
1984 isolated = numamigrate_isolate_page(pgdat, page);
1985 if (!isolated)
1986 goto out;
1987
1988 list_add(&page->lru, &migratepages);
1989 nr_remaining = migrate_pages(&migratepages, alloc_misplaced_dst_page,
1990 NULL, node, MIGRATE_ASYNC,
1991 MR_NUMA_MISPLACED);
1992 if (nr_remaining) {
1993 if (!list_empty(&migratepages)) {
1994 list_del(&page->lru);
1995 dec_node_page_state(page, NR_ISOLATED_ANON +
1996 page_is_file_cache(page));
1997 putback_lru_page(page);
1998 }
1999 isolated = 0;
2000 } else
2001 count_vm_numa_event(NUMA_PAGE_MIGRATE);
2002 BUG_ON(!list_empty(&migratepages));
2003 return isolated;
2004
2005 out:
2006 put_page(page);
2007 return 0;
2008 }
2009 #endif /* CONFIG_NUMA_BALANCING */
2010
2011 #if defined(CONFIG_NUMA_BALANCING) && defined(CONFIG_TRANSPARENT_HUGEPAGE)
2012 /*
2013 * Migrates a THP to a given target node. page must be locked and is unlocked
2014 * before returning.
2015 */
2016 int migrate_misplaced_transhuge_page(struct mm_struct *mm,
2017 struct vm_area_struct *vma,
2018 pmd_t *pmd, pmd_t entry,
2019 unsigned long address,
2020 struct page *page, int node)
2021 {
2022 spinlock_t *ptl;
2023 pg_data_t *pgdat = NODE_DATA(node);
2024 int isolated = 0;
2025 struct page *new_page = NULL;
2026 int page_lru = page_is_file_cache(page);
2027 unsigned long mmun_start = address & HPAGE_PMD_MASK;
2028 unsigned long mmun_end = mmun_start + HPAGE_PMD_SIZE;
2029
2030 /*
2031 * Rate-limit the amount of data that is being migrated to a node.
2032 * Optimal placement is no good if the memory bus is saturated and
2033 * all the time is being spent migrating!
2034 */
2035 if (numamigrate_update_ratelimit(pgdat, HPAGE_PMD_NR))
2036 goto out_dropref;
2037
2038 new_page = alloc_pages_node(node,
2039 (GFP_TRANSHUGE_LIGHT | __GFP_THISNODE),
2040 HPAGE_PMD_ORDER);
2041 if (!new_page)
2042 goto out_fail;
2043 prep_transhuge_page(new_page);
2044
2045 isolated = numamigrate_isolate_page(pgdat, page);
2046 if (!isolated) {
2047 put_page(new_page);
2048 goto out_fail;
2049 }
2050
2051 /* Prepare a page as a migration target */
2052 __SetPageLocked(new_page);
2053 if (PageSwapBacked(page))
2054 __SetPageSwapBacked(new_page);
2055
2056 /* anon mapping, we can simply copy page->mapping to the new page: */
2057 new_page->mapping = page->mapping;
2058 new_page->index = page->index;
2059 migrate_page_copy(new_page, page);
2060 WARN_ON(PageLRU(new_page));
2061
2062 /* Recheck the target PMD */
2063 mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
2064 ptl = pmd_lock(mm, pmd);
2065 if (unlikely(!pmd_same(*pmd, entry) || !page_ref_freeze(page, 2))) {
2066 spin_unlock(ptl);
2067 mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
2068
2069 /* Reverse changes made by migrate_page_copy() */
2070 if (TestClearPageActive(new_page))
2071 SetPageActive(page);
2072 if (TestClearPageUnevictable(new_page))
2073 SetPageUnevictable(page);
2074
2075 unlock_page(new_page);
2076 put_page(new_page); /* Free it */
2077
2078 /* Retake the callers reference and putback on LRU */
2079 get_page(page);
2080 putback_lru_page(page);
2081 mod_node_page_state(page_pgdat(page),
2082 NR_ISOLATED_ANON + page_lru, -HPAGE_PMD_NR);
2083
2084 goto out_unlock;
2085 }
2086
2087 entry = mk_huge_pmd(new_page, vma->vm_page_prot);
2088 entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
2089
2090 /*
2091 * Clear the old entry under pagetable lock and establish the new PTE.
2092 * Any parallel GUP will either observe the old page blocking on the
2093 * page lock, block on the page table lock or observe the new page.
2094 * The SetPageUptodate on the new page and page_add_new_anon_rmap
2095 * guarantee the copy is visible before the pagetable update.
2096 */
2097 flush_cache_range(vma, mmun_start, mmun_end);
2098 page_add_anon_rmap(new_page, vma, mmun_start, true);
2099 pmdp_huge_clear_flush_notify(vma, mmun_start, pmd);
2100 set_pmd_at(mm, mmun_start, pmd, entry);
2101 update_mmu_cache_pmd(vma, address, &entry);
2102
2103 page_ref_unfreeze(page, 2);
2104 mlock_migrate_page(new_page, page);
2105 page_remove_rmap(page, true);
2106 set_page_owner_migrate_reason(new_page, MR_NUMA_MISPLACED);
2107
2108 spin_unlock(ptl);
2109 mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
2110
2111 /* Take an "isolate" reference and put new page on the LRU. */
2112 get_page(new_page);
2113 putback_lru_page(new_page);
2114
2115 unlock_page(new_page);
2116 unlock_page(page);
2117 put_page(page); /* Drop the rmap reference */
2118 put_page(page); /* Drop the LRU isolation reference */
2119
2120 count_vm_events(PGMIGRATE_SUCCESS, HPAGE_PMD_NR);
2121 count_vm_numa_events(NUMA_PAGE_MIGRATE, HPAGE_PMD_NR);
2122
2123 mod_node_page_state(page_pgdat(page),
2124 NR_ISOLATED_ANON + page_lru,
2125 -HPAGE_PMD_NR);
2126 return isolated;
2127
2128 out_fail:
2129 count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
2130 out_dropref:
2131 ptl = pmd_lock(mm, pmd);
2132 if (pmd_same(*pmd, entry)) {
2133 entry = pmd_modify(entry, vma->vm_page_prot);
2134 set_pmd_at(mm, mmun_start, pmd, entry);
2135 update_mmu_cache_pmd(vma, address, &entry);
2136 }
2137 spin_unlock(ptl);
2138
2139 out_unlock:
2140 unlock_page(page);
2141 put_page(page);
2142 return 0;
2143 }
2144 #endif /* CONFIG_NUMA_BALANCING */
2145
2146 #endif /* CONFIG_NUMA */
2147
2148 #if defined(CONFIG_MIGRATE_VMA_HELPER)
2149 struct migrate_vma {
2150 struct vm_area_struct *vma;
2151 unsigned long *dst;
2152 unsigned long *src;
2153 unsigned long cpages;
2154 unsigned long npages;
2155 unsigned long start;
2156 unsigned long end;
2157 };
2158
2159 static int migrate_vma_collect_hole(unsigned long start,
2160 unsigned long end,
2161 struct mm_walk *walk)
2162 {
2163 struct migrate_vma *migrate = walk->private;
2164 unsigned long addr;
2165
2166 for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
2167 migrate->src[migrate->npages] = MIGRATE_PFN_MIGRATE;
2168 migrate->dst[migrate->npages] = 0;
2169 migrate->npages++;
2170 migrate->cpages++;
2171 }
2172
2173 return 0;
2174 }
2175
2176 static int migrate_vma_collect_skip(unsigned long start,
2177 unsigned long end,
2178 struct mm_walk *walk)
2179 {
2180 struct migrate_vma *migrate = walk->private;
2181 unsigned long addr;
2182
2183 for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
2184 migrate->dst[migrate->npages] = 0;
2185 migrate->src[migrate->npages++] = 0;
2186 }
2187
2188 return 0;
2189 }
2190
2191 static int migrate_vma_collect_pmd(pmd_t *pmdp,
2192 unsigned long start,
2193 unsigned long end,
2194 struct mm_walk *walk)
2195 {
2196 struct migrate_vma *migrate = walk->private;
2197 struct vm_area_struct *vma = walk->vma;
2198 struct mm_struct *mm = vma->vm_mm;
2199 unsigned long addr = start, unmapped = 0;
2200 spinlock_t *ptl;
2201 pte_t *ptep;
2202
2203 again:
2204 if (pmd_none(*pmdp))
2205 return migrate_vma_collect_hole(start, end, walk);
2206
2207 if (pmd_trans_huge(*pmdp)) {
2208 struct page *page;
2209
2210 ptl = pmd_lock(mm, pmdp);
2211 if (unlikely(!pmd_trans_huge(*pmdp))) {
2212 spin_unlock(ptl);
2213 goto again;
2214 }
2215
2216 page = pmd_page(*pmdp);
2217 if (is_huge_zero_page(page)) {
2218 spin_unlock(ptl);
2219 split_huge_pmd(vma, pmdp, addr);
2220 if (pmd_trans_unstable(pmdp))
2221 return migrate_vma_collect_skip(start, end,
2222 walk);
2223 } else {
2224 int ret;
2225
2226 get_page(page);
2227 spin_unlock(ptl);
2228 if (unlikely(!trylock_page(page)))
2229 return migrate_vma_collect_skip(start, end,
2230 walk);
2231 ret = split_huge_page(page);
2232 unlock_page(page);
2233 put_page(page);
2234 if (ret)
2235 return migrate_vma_collect_skip(start, end,
2236 walk);
2237 if (pmd_none(*pmdp))
2238 return migrate_vma_collect_hole(start, end,
2239 walk);
2240 }
2241 }
2242
2243 if (unlikely(pmd_bad(*pmdp)))
2244 return migrate_vma_collect_skip(start, end, walk);
2245
2246 ptep = pte_offset_map_lock(mm, pmdp, addr, &ptl);
2247 arch_enter_lazy_mmu_mode();
2248
2249 for (; addr < end; addr += PAGE_SIZE, ptep++) {
2250 unsigned long mpfn, pfn;
2251 struct page *page;
2252 swp_entry_t entry;
2253 pte_t pte;
2254
2255 pte = *ptep;
2256 pfn = pte_pfn(pte);
2257
2258 if (pte_none(pte)) {
2259 mpfn = MIGRATE_PFN_MIGRATE;
2260 migrate->cpages++;
2261 pfn = 0;
2262 goto next;
2263 }
2264
2265 if (!pte_present(pte)) {
2266 mpfn = pfn = 0;
2267
2268 /*
2269 * Only care about unaddressable device page special
2270 * page table entry. Other special swap entries are not
2271 * migratable, and we ignore regular swapped page.
2272 */
2273 entry = pte_to_swp_entry(pte);
2274 if (!is_device_private_entry(entry))
2275 goto next;
2276
2277 page = device_private_entry_to_page(entry);
2278 mpfn = migrate_pfn(page_to_pfn(page))|
2279 MIGRATE_PFN_DEVICE | MIGRATE_PFN_MIGRATE;
2280 if (is_write_device_private_entry(entry))
2281 mpfn |= MIGRATE_PFN_WRITE;
2282 } else {
2283 if (is_zero_pfn(pfn)) {
2284 mpfn = MIGRATE_PFN_MIGRATE;
2285 migrate->cpages++;
2286 pfn = 0;
2287 goto next;
2288 }
2289 page = _vm_normal_page(migrate->vma, addr, pte, true);
2290 mpfn = migrate_pfn(pfn) | MIGRATE_PFN_MIGRATE;
2291 mpfn |= pte_write(pte) ? MIGRATE_PFN_WRITE : 0;
2292 }
2293
2294 /* FIXME support THP */
2295 if (!page || !page->mapping || PageTransCompound(page)) {
2296 mpfn = pfn = 0;
2297 goto next;
2298 }
2299 pfn = page_to_pfn(page);
2300
2301 /*
2302 * By getting a reference on the page we pin it and that blocks
2303 * any kind of migration. Side effect is that it "freezes" the
2304 * pte.
2305 *
2306 * We drop this reference after isolating the page from the lru
2307 * for non device page (device page are not on the lru and thus
2308 * can't be dropped from it).
2309 */
2310 get_page(page);
2311 migrate->cpages++;
2312
2313 /*
2314 * Optimize for the common case where page is only mapped once
2315 * in one process. If we can lock the page, then we can safely
2316 * set up a special migration page table entry now.
2317 */
2318 if (trylock_page(page)) {
2319 pte_t swp_pte;
2320
2321 mpfn |= MIGRATE_PFN_LOCKED;
2322 ptep_get_and_clear(mm, addr, ptep);
2323
2324 /* Setup special migration page table entry */
2325 entry = make_migration_entry(page, pte_write(pte));
2326 swp_pte = swp_entry_to_pte(entry);
2327 if (pte_soft_dirty(pte))
2328 swp_pte = pte_swp_mksoft_dirty(swp_pte);
2329 set_pte_at(mm, addr, ptep, swp_pte);
2330
2331 /*
2332 * This is like regular unmap: we remove the rmap and
2333 * drop page refcount. Page won't be freed, as we took
2334 * a reference just above.
2335 */
2336 page_remove_rmap(page, false);
2337 put_page(page);
2338
2339 if (pte_present(pte))
2340 unmapped++;
2341 }
2342
2343 next:
2344 migrate->dst[migrate->npages] = 0;
2345 migrate->src[migrate->npages++] = mpfn;
2346 }
2347 arch_leave_lazy_mmu_mode();
2348 pte_unmap_unlock(ptep - 1, ptl);
2349
2350 /* Only flush the TLB if we actually modified any entries */
2351 if (unmapped)
2352 flush_tlb_range(walk->vma, start, end);
2353
2354 return 0;
2355 }
2356
2357 /*
2358 * migrate_vma_collect() - collect pages over a range of virtual addresses
2359 * @migrate: migrate struct containing all migration information
2360 *
2361 * This will walk the CPU page table. For each virtual address backed by a
2362 * valid page, it updates the src array and takes a reference on the page, in
2363 * order to pin the page until we lock it and unmap it.
2364 */
2365 static void migrate_vma_collect(struct migrate_vma *migrate)
2366 {
2367 struct mm_walk mm_walk;
2368
2369 mm_walk.pmd_entry = migrate_vma_collect_pmd;
2370 mm_walk.pte_entry = NULL;
2371 mm_walk.pte_hole = migrate_vma_collect_hole;
2372 mm_walk.hugetlb_entry = NULL;
2373 mm_walk.test_walk = NULL;
2374 mm_walk.vma = migrate->vma;
2375 mm_walk.mm = migrate->vma->vm_mm;
2376 mm_walk.private = migrate;
2377
2378 mmu_notifier_invalidate_range_start(mm_walk.mm,
2379 migrate->start,
2380 migrate->end);
2381 walk_page_range(migrate->start, migrate->end, &mm_walk);
2382 mmu_notifier_invalidate_range_end(mm_walk.mm,
2383 migrate->start,
2384 migrate->end);
2385
2386 migrate->end = migrate->start + (migrate->npages << PAGE_SHIFT);
2387 }
2388
2389 /*
2390 * migrate_vma_check_page() - check if page is pinned or not
2391 * @page: struct page to check
2392 *
2393 * Pinned pages cannot be migrated. This is the same test as in
2394 * migrate_page_move_mapping(), except that here we allow migration of a
2395 * ZONE_DEVICE page.
2396 */
2397 static bool migrate_vma_check_page(struct page *page)
2398 {
2399 /*
2400 * One extra ref because caller holds an extra reference, either from
2401 * isolate_lru_page() for a regular page, or migrate_vma_collect() for
2402 * a device page.
2403 */
2404 int extra = 1;
2405
2406 /*
2407 * FIXME support THP (transparent huge page), it is bit more complex to
2408 * check them than regular pages, because they can be mapped with a pmd
2409 * or with a pte (split pte mapping).
2410 */
2411 if (PageCompound(page))
2412 return false;
2413
2414 /* Page from ZONE_DEVICE have one extra reference */
2415 if (is_zone_device_page(page)) {
2416 /*
2417 * Private page can never be pin as they have no valid pte and
2418 * GUP will fail for those. Yet if there is a pending migration
2419 * a thread might try to wait on the pte migration entry and
2420 * will bump the page reference count. Sadly there is no way to
2421 * differentiate a regular pin from migration wait. Hence to
2422 * avoid 2 racing thread trying to migrate back to CPU to enter
2423 * infinite loop (one stoping migration because the other is
2424 * waiting on pte migration entry). We always return true here.
2425 *
2426 * FIXME proper solution is to rework migration_entry_wait() so
2427 * it does not need to take a reference on page.
2428 */
2429 if (is_device_private_page(page))
2430 return true;
2431
2432 /*
2433 * Only allow device public page to be migrated and account for
2434 * the extra reference count imply by ZONE_DEVICE pages.
2435 */
2436 if (!is_device_public_page(page))
2437 return false;
2438 extra++;
2439 }
2440
2441 /* For file back page */
2442 if (page_mapping(page))
2443 extra += 1 + page_has_private(page);
2444
2445 if ((page_count(page) - extra) > page_mapcount(page))
2446 return false;
2447
2448 return true;
2449 }
2450
2451 /*
2452 * migrate_vma_prepare() - lock pages and isolate them from the lru
2453 * @migrate: migrate struct containing all migration information
2454 *
2455 * This locks pages that have been collected by migrate_vma_collect(). Once each
2456 * page is locked it is isolated from the lru (for non-device pages). Finally,
2457 * the ref taken by migrate_vma_collect() is dropped, as locked pages cannot be
2458 * migrated by concurrent kernel threads.
2459 */
2460 static void migrate_vma_prepare(struct migrate_vma *migrate)
2461 {
2462 const unsigned long npages = migrate->npages;
2463 const unsigned long start = migrate->start;
2464 unsigned long addr, i, restore = 0;
2465 bool allow_drain = true;
2466
2467 lru_add_drain();
2468
2469 for (i = 0; (i < npages) && migrate->cpages; i++) {
2470 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2471 bool remap = true;
2472
2473 if (!page)
2474 continue;
2475
2476 if (!(migrate->src[i] & MIGRATE_PFN_LOCKED)) {
2477 /*
2478 * Because we are migrating several pages there can be
2479 * a deadlock between 2 concurrent migration where each
2480 * are waiting on each other page lock.
2481 *
2482 * Make migrate_vma() a best effort thing and backoff
2483 * for any page we can not lock right away.
2484 */
2485 if (!trylock_page(page)) {
2486 migrate->src[i] = 0;
2487 migrate->cpages--;
2488 put_page(page);
2489 continue;
2490 }
2491 remap = false;
2492 migrate->src[i] |= MIGRATE_PFN_LOCKED;
2493 }
2494
2495 /* ZONE_DEVICE pages are not on LRU */
2496 if (!is_zone_device_page(page)) {
2497 if (!PageLRU(page) && allow_drain) {
2498 /* Drain CPU's pagevec */
2499 lru_add_drain_all();
2500 allow_drain = false;
2501 }
2502
2503 if (isolate_lru_page(page)) {
2504 if (remap) {
2505 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2506 migrate->cpages--;
2507 restore++;
2508 } else {
2509 migrate->src[i] = 0;
2510 unlock_page(page);
2511 migrate->cpages--;
2512 put_page(page);
2513 }
2514 continue;
2515 }
2516
2517 /* Drop the reference we took in collect */
2518 put_page(page);
2519 }
2520
2521 if (!migrate_vma_check_page(page)) {
2522 if (remap) {
2523 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2524 migrate->cpages--;
2525 restore++;
2526
2527 if (!is_zone_device_page(page)) {
2528 get_page(page);
2529 putback_lru_page(page);
2530 }
2531 } else {
2532 migrate->src[i] = 0;
2533 unlock_page(page);
2534 migrate->cpages--;
2535
2536 if (!is_zone_device_page(page))
2537 putback_lru_page(page);
2538 else
2539 put_page(page);
2540 }
2541 }
2542 }
2543
2544 for (i = 0, addr = start; i < npages && restore; i++, addr += PAGE_SIZE) {
2545 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2546
2547 if (!page || (migrate->src[i] & MIGRATE_PFN_MIGRATE))
2548 continue;
2549
2550 remove_migration_pte(page, migrate->vma, addr, page);
2551
2552 migrate->src[i] = 0;
2553 unlock_page(page);
2554 put_page(page);
2555 restore--;
2556 }
2557 }
2558
2559 /*
2560 * migrate_vma_unmap() - replace page mapping with special migration pte entry
2561 * @migrate: migrate struct containing all migration information
2562 *
2563 * Replace page mapping (CPU page table pte) with a special migration pte entry
2564 * and check again if it has been pinned. Pinned pages are restored because we
2565 * cannot migrate them.
2566 *
2567 * This is the last step before we call the device driver callback to allocate
2568 * destination memory and copy contents of original page over to new page.
2569 */
2570 static void migrate_vma_unmap(struct migrate_vma *migrate)
2571 {
2572 int flags = TTU_MIGRATION | TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS;
2573 const unsigned long npages = migrate->npages;
2574 const unsigned long start = migrate->start;
2575 unsigned long addr, i, restore = 0;
2576
2577 for (i = 0; i < npages; i++) {
2578 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2579
2580 if (!page || !(migrate->src[i] & MIGRATE_PFN_MIGRATE))
2581 continue;
2582
2583 if (page_mapped(page)) {
2584 try_to_unmap(page, flags);
2585 if (page_mapped(page))
2586 goto restore;
2587 }
2588
2589 if (migrate_vma_check_page(page))
2590 continue;
2591
2592 restore:
2593 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2594 migrate->cpages--;
2595 restore++;
2596 }
2597
2598 for (addr = start, i = 0; i < npages && restore; addr += PAGE_SIZE, i++) {
2599 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2600
2601 if (!page || (migrate->src[i] & MIGRATE_PFN_MIGRATE))
2602 continue;
2603
2604 remove_migration_ptes(page, page, false);
2605
2606 migrate->src[i] = 0;
2607 unlock_page(page);
2608 restore--;
2609
2610 if (is_zone_device_page(page))
2611 put_page(page);
2612 else
2613 putback_lru_page(page);
2614 }
2615 }
2616
2617 static void migrate_vma_insert_page(struct migrate_vma *migrate,
2618 unsigned long addr,
2619 struct page *page,
2620 unsigned long *src,
2621 unsigned long *dst)
2622 {
2623 struct vm_area_struct *vma = migrate->vma;
2624 struct mm_struct *mm = vma->vm_mm;
2625 struct mem_cgroup *memcg;
2626 bool flush = false;
2627 spinlock_t *ptl;
2628 pte_t entry;
2629 pgd_t *pgdp;
2630 p4d_t *p4dp;
2631 pud_t *pudp;
2632 pmd_t *pmdp;
2633 pte_t *ptep;
2634
2635 /* Only allow populating anonymous memory */
2636 if (!vma_is_anonymous(vma))
2637 goto abort;
2638
2639 pgdp = pgd_offset(mm, addr);
2640 p4dp = p4d_alloc(mm, pgdp, addr);
2641 if (!p4dp)
2642 goto abort;
2643 pudp = pud_alloc(mm, p4dp, addr);
2644 if (!pudp)
2645 goto abort;
2646 pmdp = pmd_alloc(mm, pudp, addr);
2647 if (!pmdp)
2648 goto abort;
2649
2650 if (pmd_trans_huge(*pmdp) || pmd_devmap(*pmdp))
2651 goto abort;
2652
2653 /*
2654 * Use pte_alloc() instead of pte_alloc_map(). We can't run
2655 * pte_offset_map() on pmds where a huge pmd might be created
2656 * from a different thread.
2657 *
2658 * pte_alloc_map() is safe to use under down_write(mmap_sem) or when
2659 * parallel threads are excluded by other means.
2660 *
2661 * Here we only have down_read(mmap_sem).
2662 */
2663 if (pte_alloc(mm, pmdp, addr))
2664 goto abort;
2665
2666 /* See the comment in pte_alloc_one_map() */
2667 if (unlikely(pmd_trans_unstable(pmdp)))
2668 goto abort;
2669
2670 if (unlikely(anon_vma_prepare(vma)))
2671 goto abort;
2672 if (mem_cgroup_try_charge(page, vma->vm_mm, GFP_KERNEL, &memcg, false))
2673 goto abort;
2674
2675 /*
2676 * The memory barrier inside __SetPageUptodate makes sure that
2677 * preceding stores to the page contents become visible before
2678 * the set_pte_at() write.
2679 */
2680 __SetPageUptodate(page);
2681
2682 if (is_zone_device_page(page)) {
2683 if (is_device_private_page(page)) {
2684 swp_entry_t swp_entry;
2685
2686 swp_entry = make_device_private_entry(page, vma->vm_flags & VM_WRITE);
2687 entry = swp_entry_to_pte(swp_entry);
2688 } else if (is_device_public_page(page)) {
2689 entry = pte_mkold(mk_pte(page, READ_ONCE(vma->vm_page_prot)));
2690 if (vma->vm_flags & VM_WRITE)
2691 entry = pte_mkwrite(pte_mkdirty(entry));
2692 entry = pte_mkdevmap(entry);
2693 }
2694 } else {
2695 entry = mk_pte(page, vma->vm_page_prot);
2696 if (vma->vm_flags & VM_WRITE)
2697 entry = pte_mkwrite(pte_mkdirty(entry));
2698 }
2699
2700 ptep = pte_offset_map_lock(mm, pmdp, addr, &ptl);
2701
2702 if (pte_present(*ptep)) {
2703 unsigned long pfn = pte_pfn(*ptep);
2704
2705 if (!is_zero_pfn(pfn)) {
2706 pte_unmap_unlock(ptep, ptl);
2707 mem_cgroup_cancel_charge(page, memcg, false);
2708 goto abort;
2709 }
2710 flush = true;
2711 } else if (!pte_none(*ptep)) {
2712 pte_unmap_unlock(ptep, ptl);
2713 mem_cgroup_cancel_charge(page, memcg, false);
2714 goto abort;
2715 }
2716
2717 /*
2718 * Check for usefaultfd but do not deliver the fault. Instead,
2719 * just back off.
2720 */
2721 if (userfaultfd_missing(vma)) {
2722 pte_unmap_unlock(ptep, ptl);
2723 mem_cgroup_cancel_charge(page, memcg, false);
2724 goto abort;
2725 }
2726
2727 inc_mm_counter(mm, MM_ANONPAGES);
2728 page_add_new_anon_rmap(page, vma, addr, false);
2729 mem_cgroup_commit_charge(page, memcg, false, false);
2730 if (!is_zone_device_page(page))
2731 lru_cache_add_active_or_unevictable(page, vma);
2732 get_page(page);
2733
2734 if (flush) {
2735 flush_cache_page(vma, addr, pte_pfn(*ptep));
2736 ptep_clear_flush_notify(vma, addr, ptep);
2737 set_pte_at_notify(mm, addr, ptep, entry);
2738 update_mmu_cache(vma, addr, ptep);
2739 } else {
2740 /* No need to invalidate - it was non-present before */
2741 set_pte_at(mm, addr, ptep, entry);
2742 update_mmu_cache(vma, addr, ptep);
2743 }
2744
2745 pte_unmap_unlock(ptep, ptl);
2746 *src = MIGRATE_PFN_MIGRATE;
2747 return;
2748
2749 abort:
2750 *src &= ~MIGRATE_PFN_MIGRATE;
2751 }
2752
2753 /*
2754 * migrate_vma_pages() - migrate meta-data from src page to dst page
2755 * @migrate: migrate struct containing all migration information
2756 *
2757 * This migrates struct page meta-data from source struct page to destination
2758 * struct page. This effectively finishes the migration from source page to the
2759 * destination page.
2760 */
2761 static void migrate_vma_pages(struct migrate_vma *migrate)
2762 {
2763 const unsigned long npages = migrate->npages;
2764 const unsigned long start = migrate->start;
2765 struct vm_area_struct *vma = migrate->vma;
2766 struct mm_struct *mm = vma->vm_mm;
2767 unsigned long addr, i, mmu_start;
2768 bool notified = false;
2769
2770 for (i = 0, addr = start; i < npages; addr += PAGE_SIZE, i++) {
2771 struct page *newpage = migrate_pfn_to_page(migrate->dst[i]);
2772 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2773 struct address_space *mapping;
2774 int r;
2775
2776 if (!newpage) {
2777 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2778 continue;
2779 }
2780
2781 if (!page) {
2782 if (!(migrate->src[i] & MIGRATE_PFN_MIGRATE)) {
2783 continue;
2784 }
2785 if (!notified) {
2786 mmu_start = addr;
2787 notified = true;
2788 mmu_notifier_invalidate_range_start(mm,
2789 mmu_start,
2790 migrate->end);
2791 }
2792 migrate_vma_insert_page(migrate, addr, newpage,
2793 &migrate->src[i],
2794 &migrate->dst[i]);
2795 continue;
2796 }
2797
2798 mapping = page_mapping(page);
2799
2800 if (is_zone_device_page(newpage)) {
2801 if (is_device_private_page(newpage)) {
2802 /*
2803 * For now only support private anonymous when
2804 * migrating to un-addressable device memory.
2805 */
2806 if (mapping) {
2807 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2808 continue;
2809 }
2810 } else if (!is_device_public_page(newpage)) {
2811 /*
2812 * Other types of ZONE_DEVICE page are not
2813 * supported.
2814 */
2815 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2816 continue;
2817 }
2818 }
2819
2820 r = migrate_page(mapping, newpage, page, MIGRATE_SYNC_NO_COPY);
2821 if (r != MIGRATEPAGE_SUCCESS)
2822 migrate->src[i] &= ~MIGRATE_PFN_MIGRATE;
2823 }
2824
2825 if (notified)
2826 mmu_notifier_invalidate_range_end(mm, mmu_start,
2827 migrate->end);
2828 }
2829
2830 /*
2831 * migrate_vma_finalize() - restore CPU page table entry
2832 * @migrate: migrate struct containing all migration information
2833 *
2834 * This replaces the special migration pte entry with either a mapping to the
2835 * new page if migration was successful for that page, or to the original page
2836 * otherwise.
2837 *
2838 * This also unlocks the pages and puts them back on the lru, or drops the extra
2839 * refcount, for device pages.
2840 */
2841 static void migrate_vma_finalize(struct migrate_vma *migrate)
2842 {
2843 const unsigned long npages = migrate->npages;
2844 unsigned long i;
2845
2846 for (i = 0; i < npages; i++) {
2847 struct page *newpage = migrate_pfn_to_page(migrate->dst[i]);
2848 struct page *page = migrate_pfn_to_page(migrate->src[i]);
2849
2850 if (!page) {
2851 if (newpage) {
2852 unlock_page(newpage);
2853 put_page(newpage);
2854 }
2855 continue;
2856 }
2857
2858 if (!(migrate->src[i] & MIGRATE_PFN_MIGRATE) || !newpage) {
2859 if (newpage) {
2860 unlock_page(newpage);
2861 put_page(newpage);
2862 }
2863 newpage = page;
2864 }
2865
2866 remove_migration_ptes(page, newpage, false);
2867 unlock_page(page);
2868 migrate->cpages--;
2869
2870 if (is_zone_device_page(page))
2871 put_page(page);
2872 else
2873 putback_lru_page(page);
2874
2875 if (newpage != page) {
2876 unlock_page(newpage);
2877 if (is_zone_device_page(newpage))
2878 put_page(newpage);
2879 else
2880 putback_lru_page(newpage);
2881 }
2882 }
2883 }
2884
2885 /*
2886 * migrate_vma() - migrate a range of memory inside vma
2887 *
2888 * @ops: migration callback for allocating destination memory and copying
2889 * @vma: virtual memory area containing the range to be migrated
2890 * @start: start address of the range to migrate (inclusive)
2891 * @end: end address of the range to migrate (exclusive)
2892 * @src: array of hmm_pfn_t containing source pfns
2893 * @dst: array of hmm_pfn_t containing destination pfns
2894 * @private: pointer passed back to each of the callback
2895 * Returns: 0 on success, error code otherwise
2896 *
2897 * This function tries to migrate a range of memory virtual address range, using
2898 * callbacks to allocate and copy memory from source to destination. First it
2899 * collects all the pages backing each virtual address in the range, saving this
2900 * inside the src array. Then it locks those pages and unmaps them. Once the pages
2901 * are locked and unmapped, it checks whether each page is pinned or not. Pages
2902 * that aren't pinned have the MIGRATE_PFN_MIGRATE flag set (by this function)
2903 * in the corresponding src array entry. It then restores any pages that are
2904 * pinned, by remapping and unlocking those pages.
2905 *
2906 * At this point it calls the alloc_and_copy() callback. For documentation on
2907 * what is expected from that callback, see struct migrate_vma_ops comments in
2908 * include/linux/migrate.h
2909 *
2910 * After the alloc_and_copy() callback, this function goes over each entry in
2911 * the src array that has the MIGRATE_PFN_VALID and MIGRATE_PFN_MIGRATE flag
2912 * set. If the corresponding entry in dst array has MIGRATE_PFN_VALID flag set,
2913 * then the function tries to migrate struct page information from the source
2914 * struct page to the destination struct page. If it fails to migrate the struct
2915 * page information, then it clears the MIGRATE_PFN_MIGRATE flag in the src
2916 * array.
2917 *
2918 * At this point all successfully migrated pages have an entry in the src
2919 * array with MIGRATE_PFN_VALID and MIGRATE_PFN_MIGRATE flag set and the dst
2920 * array entry with MIGRATE_PFN_VALID flag set.
2921 *
2922 * It then calls the finalize_and_map() callback. See comments for "struct
2923 * migrate_vma_ops", in include/linux/migrate.h for details about
2924 * finalize_and_map() behavior.
2925 *
2926 * After the finalize_and_map() callback, for successfully migrated pages, this
2927 * function updates the CPU page table to point to new pages, otherwise it
2928 * restores the CPU page table to point to the original source pages.
2929 *
2930 * Function returns 0 after the above steps, even if no pages were migrated
2931 * (The function only returns an error if any of the arguments are invalid.)
2932 *
2933 * Both src and dst array must be big enough for (end - start) >> PAGE_SHIFT
2934 * unsigned long entries.
2935 */
2936 int migrate_vma(const struct migrate_vma_ops *ops,
2937 struct vm_area_struct *vma,
2938 unsigned long start,
2939 unsigned long end,
2940 unsigned long *src,
2941 unsigned long *dst,
2942 void *private)
2943 {
2944 struct migrate_vma migrate;
2945
2946 /* Sanity check the arguments */
2947 start &= PAGE_MASK;
2948 end &= PAGE_MASK;
2949 if (!vma || is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL))
2950 return -EINVAL;
2951 if (start < vma->vm_start || start >= vma->vm_end)
2952 return -EINVAL;
2953 if (end <= vma->vm_start || end > vma->vm_end)
2954 return -EINVAL;
2955 if (!ops || !src || !dst || start >= end)
2956 return -EINVAL;
2957
2958 memset(src, 0, sizeof(*src) * ((end - start) >> PAGE_SHIFT));
2959 migrate.src = src;
2960 migrate.dst = dst;
2961 migrate.start = start;
2962 migrate.npages = 0;
2963 migrate.cpages = 0;
2964 migrate.end = end;
2965 migrate.vma = vma;
2966
2967 /* Collect, and try to unmap source pages */
2968 migrate_vma_collect(&migrate);
2969 if (!migrate.cpages)
2970 return 0;
2971
2972 /* Lock and isolate page */
2973 migrate_vma_prepare(&migrate);
2974 if (!migrate.cpages)
2975 return 0;
2976
2977 /* Unmap pages */
2978 migrate_vma_unmap(&migrate);
2979 if (!migrate.cpages)
2980 return 0;
2981
2982 /*
2983 * At this point pages are locked and unmapped, and thus they have
2984 * stable content and can safely be copied to destination memory that
2985 * is allocated by the callback.
2986 *
2987 * Note that migration can fail in migrate_vma_struct_page() for each
2988 * individual page.
2989 */
2990 ops->alloc_and_copy(vma, src, dst, start, end, private);
2991
2992 /* This does the real migration of struct page */
2993 migrate_vma_pages(&migrate);
2994
2995 ops->finalize_and_map(vma, src, dst, start, end, private);
2996
2997 /* Unlock and remap pages */
2998 migrate_vma_finalize(&migrate);
2999
3000 return 0;
3001 }
3002 EXPORT_SYMBOL(migrate_vma);
3003 #endif /* defined(MIGRATE_VMA_HELPER) */