mm/huge_memory.c

   1 /*
   2  *  Copyright (C) 2009  Red Hat, Inc.
   3  *
   4  *  This work is licensed under the terms of the GNU GPL, version 2. See
   5  *  the COPYING file in the top-level directory.
   6  */
   7
   8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10 #include <linux/mm.h>
  11 #include <linux/sched.h>
  12 #include <linux/highmem.h>
  13 #include <linux/hugetlb.h>
  14 #include <linux/mmu_notifier.h>
  15 #include <linux/rmap.h>
  16 #include <linux/swap.h>
  17 #include <linux/shrinker.h>
  18 #include <linux/mm_inline.h>
  19 #include <linux/swapops.h>
  20 #include <linux/dax.h>
  21 #include <linux/kthread.h>
  22 #include <linux/khugepaged.h>
  23 #include <linux/freezer.h>
  24 #include <linux/pfn_t.h>
  25 #include <linux/mman.h>
  26 #include <linux/memremap.h>
  27 #include <linux/pagemap.h>
  28 #include <linux/debugfs.h>
  29 #include <linux/migrate.h>
  30 #include <linux/hashtable.h>
  31 #include <linux/userfaultfd_k.h>
  32 #include <linux/page_idle.h>
  33
  34 #include <asm/tlb.h>
  35 #include <asm/pgalloc.h>
  36 #include "internal.h"
  37
  38 enum scan_result {
  39         SCAN_FAIL,
  40         SCAN_SUCCEED,
  41         SCAN_PMD_NULL,
  42         SCAN_EXCEED_NONE_PTE,
  43         SCAN_PTE_NON_PRESENT,
  44         SCAN_PAGE_RO,
  45         SCAN_NO_REFERENCED_PAGE,
  46         SCAN_PAGE_NULL,
  47         SCAN_SCAN_ABORT,
  48         SCAN_PAGE_COUNT,
  49         SCAN_PAGE_LRU,
  50         SCAN_PAGE_LOCK,
  51         SCAN_PAGE_ANON,
  52         SCAN_PAGE_COMPOUND,
  53         SCAN_ANY_PROCESS,
  54         SCAN_VMA_NULL,
  55         SCAN_VMA_CHECK,
  56         SCAN_ADDRESS_RANGE,
  57         SCAN_SWAP_CACHE_PAGE,
  58         SCAN_DEL_PAGE_LRU,
  59         SCAN_ALLOC_HUGE_PAGE_FAIL,
  60         SCAN_CGROUP_CHARGE_FAIL
  61 };
  62
  63 #define CREATE_TRACE_POINTS
  64 #include <trace/events/huge_memory.h>
  65
  66 /*
  67  * By default transparent hugepage support is disabled in order that avoid
  68  * to risk increase the memory footprint of applications without a guaranteed
  69  * benefit. When transparent hugepage support is enabled, is for all mappings,
  70  * and khugepaged scans all mappings.
  71  * Defrag is invoked by khugepaged hugepage allocations and by page faults
  72  * for all hugepage allocations.
  73  */
  74 unsigned long transparent_hugepage_flags __read_mostly =
  75 #ifdef CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS
  76         (1<<TRANSPARENT_HUGEPAGE_FLAG)|
  77 #endif
  78 #ifdef CONFIG_TRANSPARENT_HUGEPAGE_MADVISE
  79         (1<<TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG)|
  80 #endif
  81         (1<<TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG)|
  82         (1<<TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG)|
  83         (1<<TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
  84
  85 /* default scan 8*512 pte (or vmas) every 30 second */
  86 static unsigned int khugepaged_pages_to_scan __read_mostly = HPAGE_PMD_NR*8;
  87 static unsigned int khugepaged_pages_collapsed;
  88 static unsigned int khugepaged_full_scans;
  89 static unsigned int khugepaged_scan_sleep_millisecs __read_mostly = 10000;
  90 /* during fragmentation poll the hugepage allocator once every minute */
  91 static unsigned int khugepaged_alloc_sleep_millisecs __read_mostly = 60000;
  92 static struct task_struct *khugepaged_thread __read_mostly;
  93 static DEFINE_MUTEX(khugepaged_mutex);
  94 static DEFINE_SPINLOCK(khugepaged_mm_lock);
  95 static DECLARE_WAIT_QUEUE_HEAD(khugepaged_wait);
  96 /*
  97  * default collapse hugepages if there is at least one pte mapped like
  98  * it would have happened if the vma was large enough during page
  99  * fault.
 100  */
 101 static unsigned int khugepaged_max_ptes_none __read_mostly = HPAGE_PMD_NR-1;
 102
 103 static int khugepaged(void *none);
 104 static int khugepaged_slab_init(void);
 105 static void khugepaged_slab_exit(void);
 106
 107 #define MM_SLOTS_HASH_BITS 10
 108 static __read_mostly DEFINE_HASHTABLE(mm_slots_hash, MM_SLOTS_HASH_BITS);
 109
 110 static struct kmem_cache *mm_slot_cache __read_mostly;
 111
 112 /**
 113  * struct mm_slot - hash lookup from mm to mm_slot
 114  * @hash: hash collision list
 115  * @mm_node: khugepaged scan list headed in khugepaged_scan.mm_head
 116  * @mm: the mm that this information is valid for
 117  */
 118 struct mm_slot {
 119         struct hlist_node hash;
 120         struct list_head mm_node;
 121         struct mm_struct *mm;
 122 };
 123
 124 /**
 125  * struct khugepaged_scan - cursor for scanning
 126  * @mm_head: the head of the mm list to scan
 127  * @mm_slot: the current mm_slot we are scanning
 128  * @address: the next address inside that to be scanned
 129  *
 130  * There is only the one khugepaged_scan instance of this cursor structure.
 131  */
 132 struct khugepaged_scan {
 133         struct list_head mm_head;
 134         struct mm_slot *mm_slot;
 135         unsigned long address;
 136 };
 137 static struct khugepaged_scan khugepaged_scan = {
 138         .mm_head = LIST_HEAD_INIT(khugepaged_scan.mm_head),
 139 };
 140
 141 static struct shrinker deferred_split_shrinker;
 142
 143 static void set_recommended_min_free_kbytes(void)
 144 {
 145         struct zone *zone;
 146         int nr_zones = 0;
 147         unsigned long recommended_min;
 148
 149         for_each_populated_zone(zone)
 150                 nr_zones++;
 151
 152         /* Ensure 2 pageblocks are free to assist fragmentation avoidance */
 153         recommended_min = pageblock_nr_pages * nr_zones * 2;
 154
 155         /*
 156          * Make sure that on average at least two pageblocks are almost free
 157          * of another type, one for a migratetype to fall back to and a
 158          * second to avoid subsequent fallbacks of other types There are 3
 159          * MIGRATE_TYPES we care about.
 160          */
 161         recommended_min += pageblock_nr_pages * nr_zones *
 162                            MIGRATE_PCPTYPES * MIGRATE_PCPTYPES;
 163
 164         /* don't ever allow to reserve more than 5% of the lowmem */
 165         recommended_min = min(recommended_min,
 166                               (unsigned long) nr_free_buffer_pages() / 20);
 167         recommended_min <<= (PAGE_SHIFT-10);
 168
 169         if (recommended_min > min_free_kbytes) {
 170                 if (user_min_free_kbytes >= 0)
 171                         pr_info("raising min_free_kbytes from %d to %lu to help transparent hugepage allocations\n",
 172                                 min_free_kbytes, recommended_min);
 173
 174                 min_free_kbytes = recommended_min;
 175         }
 176         setup_per_zone_wmarks();
 177 }
 178
 179 static int start_stop_khugepaged(void)
 180 {
 181         int err = 0;
 182         if (khugepaged_enabled()) {
 183                 if (!khugepaged_thread)
 184                         khugepaged_thread = kthread_run(khugepaged, NULL,
 185                                                         "khugepaged");
 186                 if (IS_ERR(khugepaged_thread)) {
 187                         pr_err("khugepaged: kthread_run(khugepaged) failed\n");
 188                         err = PTR_ERR(khugepaged_thread);
 189                         khugepaged_thread = NULL;
 190                         goto fail;
 191                 }
 192
 193                 if (!list_empty(&khugepaged_scan.mm_head))
 194                         wake_up_interruptible(&khugepaged_wait);
 195
 196                 set_recommended_min_free_kbytes();
 197         } else if (khugepaged_thread) {
 198                 kthread_stop(khugepaged_thread);
 199                 khugepaged_thread = NULL;
 200         }
 201 fail:
 202         return err;
 203 }
 204
 205 static atomic_t huge_zero_refcount;
 206 struct page *huge_zero_page __read_mostly;
 207
 208 struct page *get_huge_zero_page(void)
 209 {
 210         struct page *zero_page;
 211 retry:
 212         if (likely(atomic_inc_not_zero(&huge_zero_refcount)))
 213                 return READ_ONCE(huge_zero_page);
 214
 215         zero_page = alloc_pages((GFP_TRANSHUGE | __GFP_ZERO) & ~__GFP_MOVABLE,
 216                         HPAGE_PMD_ORDER);
 217         if (!zero_page) {
 218                 count_vm_event(THP_ZERO_PAGE_ALLOC_FAILED);
 219                 return NULL;
 220         }
 221         count_vm_event(THP_ZERO_PAGE_ALLOC);
 222         preempt_disable();
 223         if (cmpxchg(&huge_zero_page, NULL, zero_page)) {
 224                 preempt_enable();
 225                 __free_pages(zero_page, compound_order(zero_page));
 226                 goto retry;
 227         }
 228
 229         /* We take additional reference here. It will be put back by shrinker */
 230         atomic_set(&huge_zero_refcount, 2);
 231         preempt_enable();
 232         return READ_ONCE(huge_zero_page);
 233 }
 234
 235 static void put_huge_zero_page(void)
 236 {
 237         /*
 238          * Counter should never go to zero here. Only shrinker can put
 239          * last reference.
 240          */
 241         BUG_ON(atomic_dec_and_test(&huge_zero_refcount));
 242 }
 243
 244 static unsigned long shrink_huge_zero_page_count(struct shrinker *shrink,
 245                                         struct shrink_control *sc)
 246 {
 247         /* we can free zero page only if last reference remains */
 248         return atomic_read(&huge_zero_refcount) == 1 ? HPAGE_PMD_NR : 0;
 249 }
 250
 251 static unsigned long shrink_huge_zero_page_scan(struct shrinker *shrink,
 252                                        struct shrink_control *sc)
 253 {
 254         if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) {
 255                 struct page *zero_page = xchg(&huge_zero_page, NULL);
 256                 BUG_ON(zero_page == NULL);
 257                 __free_pages(zero_page, compound_order(zero_page));
 258                 return HPAGE_PMD_NR;
 259         }
 260
 261         return 0;
 262 }
 263
 264 static struct shrinker huge_zero_page_shrinker = {
 265         .count_objects = shrink_huge_zero_page_count,
 266         .scan_objects = shrink_huge_zero_page_scan,
 267         .seeks = DEFAULT_SEEKS,
 268 };
 269
 270 #ifdef CONFIG_SYSFS
 271
 272 static ssize_t triple_flag_store(struct kobject *kobj,
 273                                  struct kobj_attribute *attr,
 274                                  const char *buf, size_t count,
 275                                  enum transparent_hugepage_flag enabled,
 276                                  enum transparent_hugepage_flag deferred,
 277                                  enum transparent_hugepage_flag req_madv)
 278 {
 279         if (!memcmp("defer", buf,
 280                     min(sizeof("defer")-1, count))) {
 281                 if (enabled == deferred)
 282                         return -EINVAL;
 283                 clear_bit(enabled, &transparent_hugepage_flags);
 284                 clear_bit(req_madv, &transparent_hugepage_flags);
 285                 set_bit(deferred, &transparent_hugepage_flags);
 286         } else if (!memcmp("always", buf,
 287                     min(sizeof("always")-1, count))) {
 288                 clear_bit(deferred, &transparent_hugepage_flags);
 289                 clear_bit(req_madv, &transparent_hugepage_flags);
 290                 set_bit(enabled, &transparent_hugepage_flags);
 291         } else if (!memcmp("madvise", buf,
 292                            min(sizeof("madvise")-1, count))) {
 293                 clear_bit(enabled, &transparent_hugepage_flags);
 294                 clear_bit(deferred, &transparent_hugepage_flags);
 295                 set_bit(req_madv, &transparent_hugepage_flags);
 296         } else if (!memcmp("never", buf,
 297                            min(sizeof("never")-1, count))) {
 298                 clear_bit(enabled, &transparent_hugepage_flags);
 299                 clear_bit(req_madv, &transparent_hugepage_flags);
 300                 clear_bit(deferred, &transparent_hugepage_flags);
 301         } else
 302                 return -EINVAL;
 303
 304         return count;
 305 }
 306
 307 static ssize_t enabled_show(struct kobject *kobj,
 308                             struct kobj_attribute *attr, char *buf)
 309 {
 310         if (test_bit(TRANSPARENT_HUGEPAGE_FLAG, &transparent_hugepage_flags))
 311                 return sprintf(buf, "[always] madvise never\n");
 312         else if (test_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG, &transparent_hugepage_flags))
 313                 return sprintf(buf, "always [madvise] never\n");
 314         else
 315                 return sprintf(buf, "always madvise [never]\n");
 316 }
 317
 318 static ssize_t enabled_store(struct kobject *kobj,
 319                              struct kobj_attribute *attr,
 320                              const char *buf, size_t count)
 321 {
 322         ssize_t ret;
 323
 324         ret = triple_flag_store(kobj, attr, buf, count,
 325                                 TRANSPARENT_HUGEPAGE_FLAG,
 326                                 TRANSPARENT_HUGEPAGE_FLAG,
 327                                 TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG);
 328
 329         if (ret > 0) {
 330                 int err;
 331
 332                 mutex_lock(&khugepaged_mutex);
 333                 err = start_stop_khugepaged();
 334                 mutex_unlock(&khugepaged_mutex);
 335
 336                 if (err)
 337                         ret = err;
 338         }
 339
 340         return ret;
 341 }
 342 static struct kobj_attribute enabled_attr =
 343         __ATTR(enabled, 0644, enabled_show, enabled_store);
 344
 345 static ssize_t single_flag_show(struct kobject *kobj,
 346                                 struct kobj_attribute *attr, char *buf,
 347                                 enum transparent_hugepage_flag flag)
 348 {
 349         return sprintf(buf, "%d\n",
 350                        !!test_bit(flag, &transparent_hugepage_flags));
 351 }
 352
 353 static ssize_t single_flag_store(struct kobject *kobj,
 354                                  struct kobj_attribute *attr,
 355                                  const char *buf, size_t count,
 356                                  enum transparent_hugepage_flag flag)
 357 {
 358         unsigned long value;
 359         int ret;
 360
 361         ret = kstrtoul(buf, 10, &value);
 362         if (ret < 0)
 363                 return ret;
 364         if (value > 1)
 365                 return -EINVAL;
 366
 367         if (value)
 368                 set_bit(flag, &transparent_hugepage_flags);
 369         else
 370                 clear_bit(flag, &transparent_hugepage_flags);
 371
 372         return count;
 373 }
 374
 375 /*
 376  * Currently defrag only disables __GFP_NOWAIT for allocation. A blind
 377  * __GFP_REPEAT is too aggressive, it's never worth swapping tons of
 378  * memory just to allocate one more hugepage.
 379  */
 380 static ssize_t defrag_show(struct kobject *kobj,
 381                            struct kobj_attribute *attr, char *buf)
 382 {
 383         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
 384                 return sprintf(buf, "[always] defer madvise never\n");
 385         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
 386                 return sprintf(buf, "always [defer] madvise never\n");
 387         else if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags))
 388                 return sprintf(buf, "always defer [madvise] never\n");
 389         else
 390                 return sprintf(buf, "always defer madvise [never]\n");
 391
 392 }
 393 static ssize_t defrag_store(struct kobject *kobj,
 394                             struct kobj_attribute *attr,
 395                             const char *buf, size_t count)
 396 {
 397         return triple_flag_store(kobj, attr, buf, count,
 398                                  TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG,
 399                                  TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG,
 400                                  TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG);
 401 }
 402 static struct kobj_attribute defrag_attr =
 403         __ATTR(defrag, 0644, defrag_show, defrag_store);
 404
 405 static ssize_t use_zero_page_show(struct kobject *kobj,
 406                 struct kobj_attribute *attr, char *buf)
 407 {
 408         return single_flag_show(kobj, attr, buf,
 409                                 TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
 410 }
 411 static ssize_t use_zero_page_store(struct kobject *kobj,
 412                 struct kobj_attribute *attr, const char *buf, size_t count)
 413 {
 414         return single_flag_store(kobj, attr, buf, count,
 415                                  TRANSPARENT_HUGEPAGE_USE_ZERO_PAGE_FLAG);
 416 }
 417 static struct kobj_attribute use_zero_page_attr =
 418         __ATTR(use_zero_page, 0644, use_zero_page_show, use_zero_page_store);
 419 #ifdef CONFIG_DEBUG_VM
 420 static ssize_t debug_cow_show(struct kobject *kobj,
 421                                 struct kobj_attribute *attr, char *buf)
 422 {
 423         return single_flag_show(kobj, attr, buf,
 424                                 TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
 425 }
 426 static ssize_t debug_cow_store(struct kobject *kobj,
 427                                struct kobj_attribute *attr,
 428                                const char *buf, size_t count)
 429 {
 430         return single_flag_store(kobj, attr, buf, count,
 431                                  TRANSPARENT_HUGEPAGE_DEBUG_COW_FLAG);
 432 }
 433 static struct kobj_attribute debug_cow_attr =
 434         __ATTR(debug_cow, 0644, debug_cow_show, debug_cow_store);
 435 #endif /* CONFIG_DEBUG_VM */
 436
 437 static struct attribute *hugepage_attr[] = {
 438         &enabled_attr.attr,
 439         &defrag_attr.attr,
 440         &use_zero_page_attr.attr,
 441 #ifdef CONFIG_DEBUG_VM
 442         &debug_cow_attr.attr,
 443 #endif
 444         NULL,
 445 };
 446
 447 static struct attribute_group hugepage_attr_group = {
 448         .attrs = hugepage_attr,
 449 };
 450
 451 static ssize_t scan_sleep_millisecs_show(struct kobject *kobj,
 452                                          struct kobj_attribute *attr,
 453                                          char *buf)
 454 {
 455         return sprintf(buf, "%u\n", khugepaged_scan_sleep_millisecs);
 456 }
 457
 458 static ssize_t scan_sleep_millisecs_store(struct kobject *kobj,
 459                                           struct kobj_attribute *attr,
 460                                           const char *buf, size_t count)
 461 {
 462         unsigned long msecs;
 463         int err;
 464
 465         err = kstrtoul(buf, 10, &msecs);
 466         if (err || msecs > UINT_MAX)
 467                 return -EINVAL;
 468
 469         khugepaged_scan_sleep_millisecs = msecs;
 470         wake_up_interruptible(&khugepaged_wait);
 471
 472         return count;
 473 }
 474 static struct kobj_attribute scan_sleep_millisecs_attr =
 475         __ATTR(scan_sleep_millisecs, 0644, scan_sleep_millisecs_show,
 476                scan_sleep_millisecs_store);
 477
 478 static ssize_t alloc_sleep_millisecs_show(struct kobject *kobj,
 479                                           struct kobj_attribute *attr,
 480                                           char *buf)
 481 {
 482         return sprintf(buf, "%u\n", khugepaged_alloc_sleep_millisecs);
 483 }
 484
 485 static ssize_t alloc_sleep_millisecs_store(struct kobject *kobj,
 486                                            struct kobj_attribute *attr,
 487                                            const char *buf, size_t count)
 488 {
 489         unsigned long msecs;
 490         int err;
 491
 492         err = kstrtoul(buf, 10, &msecs);
 493         if (err || msecs > UINT_MAX)
 494                 return -EINVAL;
 495
 496         khugepaged_alloc_sleep_millisecs = msecs;
 497         wake_up_interruptible(&khugepaged_wait);
 498
 499         return count;
 500 }
 501 static struct kobj_attribute alloc_sleep_millisecs_attr =
 502         __ATTR(alloc_sleep_millisecs, 0644, alloc_sleep_millisecs_show,
 503                alloc_sleep_millisecs_store);
 504
 505 static ssize_t pages_to_scan_show(struct kobject *kobj,
 506                                   struct kobj_attribute *attr,
 507                                   char *buf)
 508 {
 509         return sprintf(buf, "%u\n", khugepaged_pages_to_scan);
 510 }
 511 static ssize_t pages_to_scan_store(struct kobject *kobj,
 512                                    struct kobj_attribute *attr,
 513                                    const char *buf, size_t count)
 514 {
 515         int err;
 516         unsigned long pages;
 517
 518         err = kstrtoul(buf, 10, &pages);
 519         if (err || !pages || pages > UINT_MAX)
 520                 return -EINVAL;
 521
 522         khugepaged_pages_to_scan = pages;
 523
 524         return count;
 525 }
 526 static struct kobj_attribute pages_to_scan_attr =
 527         __ATTR(pages_to_scan, 0644, pages_to_scan_show,
 528                pages_to_scan_store);
 529
 530 static ssize_t pages_collapsed_show(struct kobject *kobj,
 531                                     struct kobj_attribute *attr,
 532                                     char *buf)
 533 {
 534         return sprintf(buf, "%u\n", khugepaged_pages_collapsed);
 535 }
 536 static struct kobj_attribute pages_collapsed_attr =
 537         __ATTR_RO(pages_collapsed);
 538
 539 static ssize_t full_scans_show(struct kobject *kobj,
 540                                struct kobj_attribute *attr,
 541                                char *buf)
 542 {
 543         return sprintf(buf, "%u\n", khugepaged_full_scans);
 544 }
 545 static struct kobj_attribute full_scans_attr =
 546         __ATTR_RO(full_scans);
 547
 548 static ssize_t khugepaged_defrag_show(struct kobject *kobj,
 549                                       struct kobj_attribute *attr, char *buf)
 550 {
 551         return single_flag_show(kobj, attr, buf,
 552                                 TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG);
 553 }
 554 static ssize_t khugepaged_defrag_store(struct kobject *kobj,
 555                                        struct kobj_attribute *attr,
 556                                        const char *buf, size_t count)
 557 {
 558         return single_flag_store(kobj, attr, buf, count,
 559                                  TRANSPARENT_HUGEPAGE_DEFRAG_KHUGEPAGED_FLAG);
 560 }
 561 static struct kobj_attribute khugepaged_defrag_attr =
 562         __ATTR(defrag, 0644, khugepaged_defrag_show,
 563                khugepaged_defrag_store);
 564
 565 /*
 566  * max_ptes_none controls if khugepaged should collapse hugepages over
 567  * any unmapped ptes in turn potentially increasing the memory
 568  * footprint of the vmas. When max_ptes_none is 0 khugepaged will not
 569  * reduce the available free memory in the system as it
 570  * runs. Increasing max_ptes_none will instead potentially reduce the
 571  * free memory in the system during the khugepaged scan.
 572  */
 573 static ssize_t khugepaged_max_ptes_none_show(struct kobject *kobj,
 574                                              struct kobj_attribute *attr,
 575                                              char *buf)
 576 {
 577         return sprintf(buf, "%u\n", khugepaged_max_ptes_none);
 578 }
 579 static ssize_t khugepaged_max_ptes_none_store(struct kobject *kobj,
 580                                               struct kobj_attribute *attr,
 581                                               const char *buf, size_t count)
 582 {
 583         int err;
 584         unsigned long max_ptes_none;
 585
 586         err = kstrtoul(buf, 10, &max_ptes_none);
 587         if (err || max_ptes_none > HPAGE_PMD_NR-1)
 588                 return -EINVAL;
 589
 590         khugepaged_max_ptes_none = max_ptes_none;
 591
 592         return count;
 593 }
 594 static struct kobj_attribute khugepaged_max_ptes_none_attr =
 595         __ATTR(max_ptes_none, 0644, khugepaged_max_ptes_none_show,
 596                khugepaged_max_ptes_none_store);
 597
 598 static struct attribute *khugepaged_attr[] = {
 599         &khugepaged_defrag_attr.attr,
 600         &khugepaged_max_ptes_none_attr.attr,
 601         &pages_to_scan_attr.attr,
 602         &pages_collapsed_attr.attr,
 603         &full_scans_attr.attr,
 604         &scan_sleep_millisecs_attr.attr,
 605         &alloc_sleep_millisecs_attr.attr,
 606         NULL,
 607 };
 608
 609 static struct attribute_group khugepaged_attr_group = {
 610         .attrs = khugepaged_attr,
 611         .name = "khugepaged",
 612 };
 613
 614 static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj)
 615 {
 616         int err;
 617
 618         *hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
 619         if (unlikely(!*hugepage_kobj)) {
 620                 pr_err("failed to create transparent hugepage kobject\n");
 621                 return -ENOMEM;
 622         }
 623
 624         err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
 625         if (err) {
 626                 pr_err("failed to register transparent hugepage group\n");
 627                 goto delete_obj;
 628         }
 629
 630         err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
 631         if (err) {
 632                 pr_err("failed to register transparent hugepage group\n");
 633                 goto remove_hp_group;
 634         }
 635
 636         return 0;
 637
 638 remove_hp_group:
 639         sysfs_remove_group(*hugepage_kobj, &hugepage_attr_group);
 640 delete_obj:
 641         kobject_put(*hugepage_kobj);
 642         return err;
 643 }
 644
 645 static void __init hugepage_exit_sysfs(struct kobject *hugepage_kobj)
 646 {
 647         sysfs_remove_group(hugepage_kobj, &khugepaged_attr_group);
 648         sysfs_remove_group(hugepage_kobj, &hugepage_attr_group);
 649         kobject_put(hugepage_kobj);
 650 }
 651 #else
 652 static inline int hugepage_init_sysfs(struct kobject **hugepage_kobj)
 653 {
 654         return 0;
 655 }
 656
 657 static inline void hugepage_exit_sysfs(struct kobject *hugepage_kobj)
 658 {
 659 }
 660 #endif /* CONFIG_SYSFS */
 661
 662 static int __init hugepage_init(void)
 663 {
 664         int err;
 665         struct kobject *hugepage_kobj;
 666
 667         if (!has_transparent_hugepage()) {
 668                 transparent_hugepage_flags = 0;
 669                 return -EINVAL;
 670         }
 671
 672         err = hugepage_init_sysfs(&hugepage_kobj);
 673         if (err)
 674                 goto err_sysfs;
 675
 676         err = khugepaged_slab_init();
 677         if (err)
 678                 goto err_slab;
 679
 680         err = register_shrinker(&huge_zero_page_shrinker);
 681         if (err)
 682                 goto err_hzp_shrinker;
 683         err = register_shrinker(&deferred_split_shrinker);
 684         if (err)
 685                 goto err_split_shrinker;
 686
 687         /*
 688          * By default disable transparent hugepages on smaller systems,
 689          * where the extra memory used could hurt more than TLB overhead
 690          * is likely to save.  The admin can still enable it through /sys.
 691          */
 692         if (totalram_pages < (512 << (20 - PAGE_SHIFT))) {
 693                 transparent_hugepage_flags = 0;
 694                 return 0;
 695         }
 696
 697         err = start_stop_khugepaged();
 698         if (err)
 699                 goto err_khugepaged;
 700
 701         return 0;
 702 err_khugepaged:
 703         unregister_shrinker(&deferred_split_shrinker);
 704 err_split_shrinker:
 705         unregister_shrinker(&huge_zero_page_shrinker);
 706 err_hzp_shrinker:
 707         khugepaged_slab_exit();
 708 err_slab:
 709         hugepage_exit_sysfs(hugepage_kobj);
 710 err_sysfs:
 711         return err;
 712 }
 713 subsys_initcall(hugepage_init);
 714
 715 static int __init setup_transparent_hugepage(char *str)
 716 {
 717         int ret = 0;
 718         if (!str)
 719                 goto out;
 720         if (!strcmp(str, "always")) {
 721                 set_bit(TRANSPARENT_HUGEPAGE_FLAG,
 722                         &transparent_hugepage_flags);
 723                 clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
 724                           &transparent_hugepage_flags);
 725                 ret = 1;
 726         } else if (!strcmp(str, "madvise")) {
 727                 clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
 728                           &transparent_hugepage_flags);
 729                 set_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
 730                         &transparent_hugepage_flags);
 731                 ret = 1;
 732         } else if (!strcmp(str, "never")) {
 733                 clear_bit(TRANSPARENT_HUGEPAGE_FLAG,
 734                           &transparent_hugepage_flags);
 735                 clear_bit(TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG,
 736                           &transparent_hugepage_flags);
 737                 ret = 1;
 738         }
 739 out:
 740         if (!ret)
 741                 pr_warn("transparent_hugepage= cannot parse, ignored\n");
 742         return ret;
 743 }
 744 __setup("transparent_hugepage=", setup_transparent_hugepage);
 745
 746 pmd_t maybe_pmd_mkwrite(pmd_t pmd, struct vm_area_struct *vma)
 747 {
 748         if (likely(vma->vm_flags & VM_WRITE))
 749                 pmd = pmd_mkwrite(pmd);
 750         return pmd;
 751 }
 752
 753 static inline pmd_t mk_huge_pmd(struct page *page, pgprot_t prot)
 754 {
 755         pmd_t entry;
 756         entry = mk_pmd(page, prot);
 757         entry = pmd_mkhuge(entry);
 758         return entry;
 759 }
 760
 761 static inline struct list_head *page_deferred_list(struct page *page)
 762 {
 763         /*
 764          * ->lru in the tail pages is occupied by compound_head.
 765          * Let's use ->mapping + ->index in the second tail page as list_head.
 766          */
 767         return (struct list_head *)&page[2].mapping;
 768 }
 769
 770 void prep_transhuge_page(struct page *page)
 771 {
 772         /*
 773          * we use page->mapping and page->indexlru in second tail page
 774          * as list_head: assuming THP order >= 2
 775          */
 776         BUILD_BUG_ON(HPAGE_PMD_ORDER < 2);
 777
 778         INIT_LIST_HEAD(page_deferred_list(page));
 779         set_compound_page_dtor(page, TRANSHUGE_PAGE_DTOR);
 780 }
 781
 782 static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
 783                                         struct vm_area_struct *vma,
 784                                         unsigned long address, pmd_t *pmd,
 785                                         struct page *page, gfp_t gfp,
 786                                         unsigned int flags)
 787 {
 788         struct mem_cgroup *memcg;
 789         pgtable_t pgtable;
 790         spinlock_t *ptl;
 791         unsigned long haddr = address & HPAGE_PMD_MASK;
 792
 793         VM_BUG_ON_PAGE(!PageCompound(page), page);
 794
 795         if (mem_cgroup_try_charge(page, mm, gfp, &memcg, true)) {
 796                 put_page(page);
 797                 count_vm_event(THP_FAULT_FALLBACK);
 798                 return VM_FAULT_FALLBACK;
 799         }
 800
 801         pgtable = pte_alloc_one(mm, haddr);
 802         if (unlikely(!pgtable)) {
 803                 mem_cgroup_cancel_charge(page, memcg, true);
 804                 put_page(page);
 805                 return VM_FAULT_OOM;
 806         }
 807
 808         clear_huge_page(page, haddr, HPAGE_PMD_NR);
 809         /*
 810          * The memory barrier inside __SetPageUptodate makes sure that
 811          * clear_huge_page writes become visible before the set_pmd_at()
 812          * write.
 813          */
 814         __SetPageUptodate(page);
 815
 816         ptl = pmd_lock(mm, pmd);
 817         if (unlikely(!pmd_none(*pmd))) {
 818                 spin_unlock(ptl);
 819                 mem_cgroup_cancel_charge(page, memcg, true);
 820                 put_page(page);
 821                 pte_free(mm, pgtable);
 822         } else {
 823                 pmd_t entry;
 824
 825                 /* Deliver the page fault to userland */
 826                 if (userfaultfd_missing(vma)) {
 827                         int ret;
 828
 829                         spin_unlock(ptl);
 830                         mem_cgroup_cancel_charge(page, memcg, true);
 831                         put_page(page);
 832                         pte_free(mm, pgtable);
 833                         ret = handle_userfault(vma, address, flags,
 834                                                VM_UFFD_MISSING);
 835                         VM_BUG_ON(ret & VM_FAULT_FALLBACK);
 836                         return ret;
 837                 }
 838
 839                 entry = mk_huge_pmd(page, vma->vm_page_prot);
 840                 entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
 841                 page_add_new_anon_rmap(page, vma, haddr, true);
 842                 mem_cgroup_commit_charge(page, memcg, false, true);
 843                 lru_cache_add_active_or_unevictable(page, vma);
 844                 pgtable_trans_huge_deposit(mm, pmd, pgtable);
 845                 set_pmd_at(mm, haddr, pmd, entry);
 846                 add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
 847                 atomic_long_inc(&mm->nr_ptes);
 848                 spin_unlock(ptl);
 849                 count_vm_event(THP_FAULT_ALLOC);
 850         }
 851
 852         return 0;
 853 }
 854
 855 /*
 856  * If THP is set to always then directly reclaim/compact as necessary
 857  * If set to defer then do no reclaim and defer to khugepaged
 858  * If set to madvise and the VMA is flagged then directly reclaim/compact
 859  */
 860 static inline gfp_t alloc_hugepage_direct_gfpmask(struct vm_area_struct *vma)
 861 {
 862         gfp_t reclaim_flags = 0;
 863
 864         if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags) &&
 865             (vma->vm_flags & VM_HUGEPAGE))
 866                 reclaim_flags = __GFP_DIRECT_RECLAIM;
 867         else if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags))
 868                 reclaim_flags = __GFP_KSWAPD_RECLAIM;
 869         else if (test_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags))
 870                 reclaim_flags = __GFP_DIRECT_RECLAIM;
 871
 872         return GFP_TRANSHUGE | reclaim_flags;
 873 }
 874
 875 /* Defrag for khugepaged will enter direct reclaim/compaction if necessary */
 876 static inline gfp_t alloc_hugepage_khugepaged_gfpmask(void)
 877 {
 878         return GFP_TRANSHUGE | (khugepaged_defrag() ? __GFP_DIRECT_RECLAIM : 0);
 879 }
 880
 881 /* Caller must hold page table lock. */
 882 static bool set_huge_zero_page(pgtable_t pgtable, struct mm_struct *mm,
 883                 struct vm_area_struct *vma, unsigned long haddr, pmd_t *pmd,
 884                 struct page *zero_page)
 885 {
 886         pmd_t entry;
 887         if (!pmd_none(*pmd))
 888                 return false;
 889         entry = mk_pmd(zero_page, vma->vm_page_prot);
 890         entry = pmd_mkhuge(entry);
 891         if (pgtable)
 892                 pgtable_trans_huge_deposit(mm, pmd, pgtable);
 893         set_pmd_at(mm, haddr, pmd, entry);
 894         atomic_long_inc(&mm->nr_ptes);
 895         return true;
 896 }
 897
 898 int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
 899                                unsigned long address, pmd_t *pmd,
 900                                unsigned int flags)
 901 {
 902         gfp_t gfp;
 903         struct page *page;
 904         unsigned long haddr = address & HPAGE_PMD_MASK;
 905
 906         if (haddr < vma->vm_start || haddr + HPAGE_PMD_SIZE > vma->vm_end)
 907                 return VM_FAULT_FALLBACK;
 908         if (unlikely(anon_vma_prepare(vma)))
 909                 return VM_FAULT_OOM;
 910         if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
 911                 return VM_FAULT_OOM;
 912         if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm) &&
 913                         transparent_hugepage_use_zero_page()) {
 914                 spinlock_t *ptl;
 915                 pgtable_t pgtable;
 916                 struct page *zero_page;
 917                 bool set;
 918                 int ret;
 919                 pgtable = pte_alloc_one(mm, haddr);
 920                 if (unlikely(!pgtable))
 921                         return VM_FAULT_OOM;
 922                 zero_page = get_huge_zero_page();
 923                 if (unlikely(!zero_page)) {
 924                         pte_free(mm, pgtable);
 925                         count_vm_event(THP_FAULT_FALLBACK);
 926                         return VM_FAULT_FALLBACK;
 927                 }
 928                 ptl = pmd_lock(mm, pmd);
 929                 ret = 0;
 930                 set = false;
 931                 if (pmd_none(*pmd)) {
 932                         if (userfaultfd_missing(vma)) {
 933                                 spin_unlock(ptl);
 934                                 ret = handle_userfault(vma, address, flags,
 935                                                        VM_UFFD_MISSING);
 936                                 VM_BUG_ON(ret & VM_FAULT_FALLBACK);
 937                         } else {
 938                                 set_huge_zero_page(pgtable, mm, vma,
 939                                                    haddr, pmd,
 940                                                    zero_page);
 941                                 spin_unlock(ptl);
 942                                 set = true;
 943                         }
 944                 } else
 945                         spin_unlock(ptl);
 946                 if (!set) {
 947                         pte_free(mm, pgtable);
 948                         put_huge_zero_page();
 949                 }
 950                 return ret;
 951         }
 952         gfp = alloc_hugepage_direct_gfpmask(vma);
 953         page = alloc_hugepage_vma(gfp, vma, haddr, HPAGE_PMD_ORDER);
 954         if (unlikely(!page)) {
 955                 count_vm_event(THP_FAULT_FALLBACK);
 956                 return VM_FAULT_FALLBACK;
 957         }
 958         prep_transhuge_page(page);
 959         return __do_huge_pmd_anonymous_page(mm, vma, address, pmd, page, gfp,
 960                                             flags);
 961 }
 962
 963 static void insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
 964                 pmd_t *pmd, pfn_t pfn, pgprot_t prot, bool write)
 965 {
 966         struct mm_struct *mm = vma->vm_mm;
 967         pmd_t entry;
 968         spinlock_t *ptl;
 969
 970         ptl = pmd_lock(mm, pmd);
 971         entry = pmd_mkhuge(pfn_t_pmd(pfn, prot));
 972         if (pfn_t_devmap(pfn))
 973                 entry = pmd_mkdevmap(entry);
 974         if (write) {
 975                 entry = pmd_mkyoung(pmd_mkdirty(entry));
 976                 entry = maybe_pmd_mkwrite(entry, vma);
 977         }
 978         set_pmd_at(mm, addr, pmd, entry);
 979         update_mmu_cache_pmd(vma, addr, pmd);
 980         spin_unlock(ptl);
 981 }
 982
 983 int vmf_insert_pfn_pmd(struct vm_area_struct *vma, unsigned long addr,
 984                         pmd_t *pmd, pfn_t pfn, bool write)
 985 {
 986         pgprot_t pgprot = vma->vm_page_prot;
 987         /*
 988          * If we had pmd_special, we could avoid all these restrictions,
 989          * but we need to be consistent with PTEs and architectures that
 990          * can't support a 'special' bit.
 991          */
 992         BUG_ON(!(vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)));
 993         BUG_ON((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) ==
 994                                                 (VM_PFNMAP|VM_MIXEDMAP));
 995         BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags));
 996         BUG_ON(!pfn_t_devmap(pfn));
 997
 998         if (addr < vma->vm_start || addr >= vma->vm_end)
 999                 return VM_FAULT_SIGBUS;
1000         if (track_pfn_insert(vma, &pgprot, pfn))
1001                 return VM_FAULT_SIGBUS;
1002         insert_pfn_pmd(vma, addr, pmd, pfn, pgprot, write);
1003         return VM_FAULT_NOPAGE;
1004 }
1005
1006 static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
1007                 pmd_t *pmd)
1008 {
1009         pmd_t _pmd;
1010
1011         /*
1012          * We should set the dirty bit only for FOLL_WRITE but for now
1013          * the dirty bit in the pmd is meaningless.  And if the dirty
1014          * bit will become meaningful and we'll only set it with
1015          * FOLL_WRITE, an atomic set_bit will be required on the pmd to
1016          * set the young bit, instead of the current set_pmd_at.
1017          */
1018         _pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
1019         if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
1020                                 pmd, _pmd,  1))
1021                 update_mmu_cache_pmd(vma, addr, pmd);
1022 }
1023
1024 struct page *follow_devmap_pmd(struct vm_area_struct *vma, unsigned long addr,
1025                 pmd_t *pmd, int flags)
1026 {
1027         unsigned long pfn = pmd_pfn(*pmd);
1028         struct mm_struct *mm = vma->vm_mm;
1029         struct dev_pagemap *pgmap;
1030         struct page *page;
1031
1032         assert_spin_locked(pmd_lockptr(mm, pmd));
1033
1034         if (flags & FOLL_WRITE && !pmd_write(*pmd))
1035                 return NULL;
1036
1037         if (pmd_present(*pmd) && pmd_devmap(*pmd))
1038                 /* pass */;
1039         else
1040                 return NULL;
1041
1042         if (flags & FOLL_TOUCH)
1043                 touch_pmd(vma, addr, pmd);
1044
1045         /*
1046          * device mapped pages can only be returned if the
1047          * caller will manage the page reference count.
1048          */
1049         if (!(flags & FOLL_GET))
1050                 return ERR_PTR(-EEXIST);
1051
1052         pfn += (addr & ~PMD_MASK) >> PAGE_SHIFT;
1053         pgmap = get_dev_pagemap(pfn, NULL);
1054         if (!pgmap)
1055                 return ERR_PTR(-EFAULT);
1056         page = pfn_to_page(pfn);
1057         get_page(page);
1058         put_dev_pagemap(pgmap);
1059
1060         return page;
1061 }
1062
1063 int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
1064                   pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long addr,
1065                   struct vm_area_struct *vma)
1066 {
1067         spinlock_t *dst_ptl, *src_ptl;
1068         struct page *src_page;
1069         pmd_t pmd;
1070         pgtable_t pgtable = NULL;
1071         int ret;
1072
1073         if (!vma_is_dax(vma)) {
1074                 ret = -ENOMEM;
1075                 pgtable = pte_alloc_one(dst_mm, addr);
1076                 if (unlikely(!pgtable))
1077                         goto out;
1078         }
1079
1080         dst_ptl = pmd_lock(dst_mm, dst_pmd);
1081         src_ptl = pmd_lockptr(src_mm, src_pmd);
1082         spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
1083
1084         ret = -EAGAIN;
1085         pmd = *src_pmd;
1086         if (unlikely(!pmd_trans_huge(pmd) && !pmd_devmap(pmd))) {
1087                 pte_free(dst_mm, pgtable);
1088                 goto out_unlock;
1089         }
1090         /*
1091          * When page table lock is held, the huge zero pmd should not be
1092          * under splitting since we don't split the page itself, only pmd to
1093          * a page table.
1094          */
1095         if (is_huge_zero_pmd(pmd)) {
1096                 struct page *zero_page;
1097                 /*
1098                  * get_huge_zero_page() will never allocate a new page here,
1099                  * since we already have a zero page to copy. It just takes a
1100                  * reference.
1101                  */
1102                 zero_page = get_huge_zero_page();
1103                 set_huge_zero_page(pgtable, dst_mm, vma, addr, dst_pmd,
1104                                 zero_page);
1105                 ret = 0;
1106                 goto out_unlock;
1107         }
1108
1109         if (!vma_is_dax(vma)) {
1110                 /* thp accounting separate from pmd_devmap accounting */
1111                 src_page = pmd_page(pmd);
1112                 VM_BUG_ON_PAGE(!PageHead(src_page), src_page);
1113                 get_page(src_page);
1114                 page_dup_rmap(src_page, true);
1115                 add_mm_counter(dst_mm, MM_ANONPAGES, HPAGE_PMD_NR);
1116                 atomic_long_inc(&dst_mm->nr_ptes);
1117                 pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable);
1118         }
1119
1120         pmdp_set_wrprotect(src_mm, addr, src_pmd);
1121         pmd = pmd_mkold(pmd_wrprotect(pmd));
1122         set_pmd_at(dst_mm, addr, dst_pmd, pmd);
1123
1124         ret = 0;
1125 out_unlock:
1126         spin_unlock(src_ptl);
1127         spin_unlock(dst_ptl);
1128 out:
1129         return ret;
1130 }
1131
1132 void huge_pmd_set_accessed(struct mm_struct *mm,
1133                            struct vm_area_struct *vma,
1134                            unsigned long address,
1135                            pmd_t *pmd, pmd_t orig_pmd,
1136                            int dirty)
1137 {
1138         spinlock_t *ptl;
1139         pmd_t entry;
1140         unsigned long haddr;
1141
1142         ptl = pmd_lock(mm, pmd);
1143         if (unlikely(!pmd_same(*pmd, orig_pmd)))
1144                 goto unlock;
1145
1146         entry = pmd_mkyoung(orig_pmd);
1147         haddr = address & HPAGE_PMD_MASK;
1148         if (pmdp_set_access_flags(vma, haddr, pmd, entry, dirty))
1149                 update_mmu_cache_pmd(vma, address, pmd);
1150
1151 unlock:
1152         spin_unlock(ptl);
1153 }
1154
1155 static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
1156                                         struct vm_area_struct *vma,
1157                                         unsigned long address,
1158                                         pmd_t *pmd, pmd_t orig_pmd,
1159                                         struct page *page,
1160                                         unsigned long haddr)
1161 {
1162         struct mem_cgroup *memcg;
1163         spinlock_t *ptl;
1164         pgtable_t pgtable;
1165         pmd_t _pmd;
1166         int ret = 0, i;
1167         struct page **pages;
1168         unsigned long mmun_start;       /* For mmu_notifiers */
1169         unsigned long mmun_end;         /* For mmu_notifiers */
1170
1171         pages = kmalloc(sizeof(struct page *) * HPAGE_PMD_NR,
1172                         GFP_KERNEL);
1173         if (unlikely(!pages)) {
1174                 ret |= VM_FAULT_OOM;
1175                 goto out;
1176         }
1177
1178         for (i = 0; i < HPAGE_PMD_NR; i++) {
1179                 pages[i] = alloc_page_vma_node(GFP_HIGHUSER_MOVABLE |
1180                                                __GFP_OTHER_NODE,
1181                                                vma, address, page_to_nid(page));
1182                 if (unlikely(!pages[i] ||
1183                              mem_cgroup_try_charge(pages[i], mm, GFP_KERNEL,
1184                                                    &memcg, false))) {
1185                         if (pages[i])
1186                                 put_page(pages[i]);
1187                         while (--i >= 0) {
1188                                 memcg = (void *)page_private(pages[i]);
1189                                 set_page_private(pages[i], 0);
1190                                 mem_cgroup_cancel_charge(pages[i], memcg,
1191                                                 false);
1192                                 put_page(pages[i]);
1193                         }
1194                         kfree(pages);
1195                         ret |= VM_FAULT_OOM;
1196                         goto out;
1197                 }
1198                 set_page_private(pages[i], (unsigned long)memcg);
1199         }
1200
1201         for (i = 0; i < HPAGE_PMD_NR; i++) {
1202                 copy_user_highpage(pages[i], page + i,
1203                                    haddr + PAGE_SIZE * i, vma);
1204                 __SetPageUptodate(pages[i]);
1205                 cond_resched();
1206         }
1207
1208         mmun_start = haddr;
1209         mmun_end   = haddr + HPAGE_PMD_SIZE;
1210         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
1211
1212         ptl = pmd_lock(mm, pmd);
1213         if (unlikely(!pmd_same(*pmd, orig_pmd)))
1214                 goto out_free_pages;
1215         VM_BUG_ON_PAGE(!PageHead(page), page);
1216
1217         pmdp_huge_clear_flush_notify(vma, haddr, pmd);
1218         /* leave pmd empty until pte is filled */
1219
1220         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
1221         pmd_populate(mm, &_pmd, pgtable);
1222
1223         for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
1224                 pte_t *pte, entry;
1225                 entry = mk_pte(pages[i], vma->vm_page_prot);
1226                 entry = maybe_mkwrite(pte_mkdirty(entry), vma);
1227                 memcg = (void *)page_private(pages[i]);
1228                 set_page_private(pages[i], 0);
1229                 page_add_new_anon_rmap(pages[i], vma, haddr, false);
1230                 mem_cgroup_commit_charge(pages[i], memcg, false, false);
1231                 lru_cache_add_active_or_unevictable(pages[i], vma);
1232                 pte = pte_offset_map(&_pmd, haddr);
1233                 VM_BUG_ON(!pte_none(*pte));
1234                 set_pte_at(mm, haddr, pte, entry);
1235                 pte_unmap(pte);
1236         }
1237         kfree(pages);
1238
1239         smp_wmb(); /* make pte visible before pmd */
1240         pmd_populate(mm, pmd, pgtable);
1241         page_remove_rmap(page, true);
1242         spin_unlock(ptl);
1243
1244         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1245
1246         ret |= VM_FAULT_WRITE;
1247         put_page(page);
1248
1249 out:
1250         return ret;
1251
1252 out_free_pages:
1253         spin_unlock(ptl);
1254         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1255         for (i = 0; i < HPAGE_PMD_NR; i++) {
1256                 memcg = (void *)page_private(pages[i]);
1257                 set_page_private(pages[i], 0);
1258                 mem_cgroup_cancel_charge(pages[i], memcg, false);
1259                 put_page(pages[i]);
1260         }
1261         kfree(pages);
1262         goto out;
1263 }
1264
1265 int do_huge_pmd_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
1266                         unsigned long address, pmd_t *pmd, pmd_t orig_pmd)
1267 {
1268         spinlock_t *ptl;
1269         int ret = 0;
1270         struct page *page = NULL, *new_page;
1271         struct mem_cgroup *memcg;
1272         unsigned long haddr;
1273         unsigned long mmun_start;       /* For mmu_notifiers */
1274         unsigned long mmun_end;         /* For mmu_notifiers */
1275         gfp_t huge_gfp;                 /* for allocation and charge */
1276
1277         ptl = pmd_lockptr(mm, pmd);
1278         VM_BUG_ON_VMA(!vma->anon_vma, vma);
1279         haddr = address & HPAGE_PMD_MASK;
1280         if (is_huge_zero_pmd(orig_pmd))
1281                 goto alloc;
1282         spin_lock(ptl);
1283         if (unlikely(!pmd_same(*pmd, orig_pmd)))
1284                 goto out_unlock;
1285
1286         page = pmd_page(orig_pmd);
1287         VM_BUG_ON_PAGE(!PageCompound(page) || !PageHead(page), page);
1288         /*
1289          * We can only reuse the page if nobody else maps the huge page or it's
1290          * part. We can do it by checking page_mapcount() on each sub-page, but
1291          * it's expensive.
1292          * The cheaper way is to check page_count() to be equal 1: every
1293          * mapcount takes page reference reference, so this way we can
1294          * guarantee, that the PMD is the only mapping.
1295          * This can give false negative if somebody pinned the page, but that's
1296          * fine.
1297          */
1298         if (page_mapcount(page) == 1 && page_count(page) == 1) {
1299                 pmd_t entry;
1300                 entry = pmd_mkyoung(orig_pmd);
1301                 entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
1302                 if (pmdp_set_access_flags(vma, haddr, pmd, entry,  1))
1303                         update_mmu_cache_pmd(vma, address, pmd);
1304                 ret |= VM_FAULT_WRITE;
1305                 goto out_unlock;
1306         }
1307         get_page(page);
1308         spin_unlock(ptl);
1309 alloc:
1310         if (transparent_hugepage_enabled(vma) &&
1311             !transparent_hugepage_debug_cow()) {
1312                 huge_gfp = alloc_hugepage_direct_gfpmask(vma);
1313                 new_page = alloc_hugepage_vma(huge_gfp, vma, haddr, HPAGE_PMD_ORDER);
1314         } else
1315                 new_page = NULL;
1316
1317         if (likely(new_page)) {
1318                 prep_transhuge_page(new_page);
1319         } else {
1320                 if (!page) {
1321                         split_huge_pmd(vma, pmd, address);
1322                         ret |= VM_FAULT_FALLBACK;
1323                 } else {
1324                         ret = do_huge_pmd_wp_page_fallback(mm, vma, address,
1325                                         pmd, orig_pmd, page, haddr);
1326                         if (ret & VM_FAULT_OOM) {
1327                                 split_huge_pmd(vma, pmd, address);
1328                                 ret |= VM_FAULT_FALLBACK;
1329                         }
1330                         put_page(page);
1331                 }
1332                 count_vm_event(THP_FAULT_FALLBACK);
1333                 goto out;
1334         }
1335
1336         if (unlikely(mem_cgroup_try_charge(new_page, mm, huge_gfp, &memcg,
1337                                            true))) {
1338                 put_page(new_page);
1339                 if (page) {
1340                         split_huge_pmd(vma, pmd, address);
1341                         put_page(page);
1342                 } else
1343                         split_huge_pmd(vma, pmd, address);
1344                 ret |= VM_FAULT_FALLBACK;
1345                 count_vm_event(THP_FAULT_FALLBACK);
1346                 goto out;
1347         }
1348
1349         count_vm_event(THP_FAULT_ALLOC);
1350
1351         if (!page)
1352                 clear_huge_page(new_page, haddr, HPAGE_PMD_NR);
1353         else
1354                 copy_user_huge_page(new_page, page, haddr, vma, HPAGE_PMD_NR);
1355         __SetPageUptodate(new_page);
1356
1357         mmun_start = haddr;
1358         mmun_end   = haddr + HPAGE_PMD_SIZE;
1359         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
1360
1361         spin_lock(ptl);
1362         if (page)
1363                 put_page(page);
1364         if (unlikely(!pmd_same(*pmd, orig_pmd))) {
1365                 spin_unlock(ptl);
1366                 mem_cgroup_cancel_charge(new_page, memcg, true);
1367                 put_page(new_page);
1368                 goto out_mn;
1369         } else {
1370                 pmd_t entry;
1371                 entry = mk_huge_pmd(new_page, vma->vm_page_prot);
1372                 entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
1373                 pmdp_huge_clear_flush_notify(vma, haddr, pmd);
1374                 page_add_new_anon_rmap(new_page, vma, haddr, true);
1375                 mem_cgroup_commit_charge(new_page, memcg, false, true);
1376                 lru_cache_add_active_or_unevictable(new_page, vma);
1377                 set_pmd_at(mm, haddr, pmd, entry);
1378                 update_mmu_cache_pmd(vma, address, pmd);
1379                 if (!page) {
1380                         add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
1381                         put_huge_zero_page();
1382                 } else {
1383                         VM_BUG_ON_PAGE(!PageHead(page), page);
1384                         page_remove_rmap(page, true);
1385                         put_page(page);
1386                 }
1387                 ret |= VM_FAULT_WRITE;
1388         }
1389         spin_unlock(ptl);
1390 out_mn:
1391         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
1392 out:
1393         return ret;
1394 out_unlock:
1395         spin_unlock(ptl);
1396         return ret;
1397 }
1398
1399 struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
1400                                    unsigned long addr,
1401                                    pmd_t *pmd,
1402                                    unsigned int flags)
1403 {
1404         struct mm_struct *mm = vma->vm_mm;
1405         struct page *page = NULL;
1406
1407         assert_spin_locked(pmd_lockptr(mm, pmd));
1408
1409         if (flags & FOLL_WRITE && !pmd_write(*pmd))
1410                 goto out;
1411
1412         /* Avoid dumping huge zero page */
1413         if ((flags & FOLL_DUMP) && is_huge_zero_pmd(*pmd))
1414                 return ERR_PTR(-EFAULT);
1415
1416         /* Full NUMA hinting faults to serialise migration in fault paths */
1417         if ((flags & FOLL_NUMA) && pmd_protnone(*pmd))
1418                 goto out;
1419
1420         page = pmd_page(*pmd);
1421         VM_BUG_ON_PAGE(!PageHead(page), page);
1422         if (flags & FOLL_TOUCH)
1423                 touch_pmd(vma, addr, pmd);
1424         if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
1425                 /*
1426                  * We don't mlock() pte-mapped THPs. This way we can avoid
1427                  * leaking mlocked pages into non-VM_LOCKED VMAs.
1428                  *
1429                  * In most cases the pmd is the only mapping of the page as we
1430                  * break COW for the mlock() -- see gup_flags |= FOLL_WRITE for
1431                  * writable private mappings in populate_vma_page_range().
1432                  *
1433                  * The only scenario when we have the page shared here is if we
1434                  * mlocking read-only mapping shared over fork(). We skip
1435                  * mlocking such pages.
1436                  */
1437                 if (compound_mapcount(page) == 1 && !PageDoubleMap(page) &&
1438                                 page->mapping && trylock_page(page)) {
1439                         lru_add_drain();
1440                         if (page->mapping)
1441                                 mlock_vma_page(page);
1442                         unlock_page(page);
1443                 }
1444         }
1445         page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
1446         VM_BUG_ON_PAGE(!PageCompound(page), page);
1447         if (flags & FOLL_GET)
1448                 get_page(page);
1449
1450 out:
1451         return page;
1452 }
1453
1454 /* NUMA hinting page fault entry point for trans huge pmds */
1455 int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
1456                                 unsigned long addr, pmd_t pmd, pmd_t *pmdp)
1457 {
1458         spinlock_t *ptl;
1459         struct anon_vma *anon_vma = NULL;
1460         struct page *page;
1461         unsigned long haddr = addr & HPAGE_PMD_MASK;
1462         int page_nid = -1, this_nid = numa_node_id();
1463         int target_nid, last_cpupid = -1;
1464         bool page_locked;
1465         bool migrated = false;
1466         bool was_writable;
1467         int flags = 0;
1468
1469         /* A PROT_NONE fault should not end up here */
1470         BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
1471
1472         ptl = pmd_lock(mm, pmdp);
1473         if (unlikely(!pmd_same(pmd, *pmdp)))
1474                 goto out_unlock;
1475
1476         /*
1477          * If there are potential migrations, wait for completion and retry
1478          * without disrupting NUMA hinting information. Do not relock and
1479          * check_same as the page may no longer be mapped.
1480          */
1481         if (unlikely(pmd_trans_migrating(*pmdp))) {
1482                 page = pmd_page(*pmdp);
1483                 spin_unlock(ptl);
1484                 wait_on_page_locked(page);
1485                 goto out;
1486         }
1487
1488         page = pmd_page(pmd);
1489         BUG_ON(is_huge_zero_page(page));
1490         page_nid = page_to_nid(page);
1491         last_cpupid = page_cpupid_last(page);
1492         count_vm_numa_event(NUMA_HINT_FAULTS);
1493         if (page_nid == this_nid) {
1494                 count_vm_numa_event(NUMA_HINT_FAULTS_LOCAL);
1495                 flags |= TNF_FAULT_LOCAL;
1496         }
1497
1498         /* See similar comment in do_numa_page for explanation */
1499         if (!(vma->vm_flags & VM_WRITE))
1500                 flags |= TNF_NO_GROUP;
1501
1502         /*
1503          * Acquire the page lock to serialise THP migrations but avoid dropping
1504          * page_table_lock if at all possible
1505          */
1506         page_locked = trylock_page(page);
1507         target_nid = mpol_misplaced(page, vma, haddr);
1508         if (target_nid == -1) {
1509                 /* If the page was locked, there are no parallel migrations */
1510                 if (page_locked)
1511                         goto clear_pmdnuma;
1512         }
1513
1514         /* Migration could have started since the pmd_trans_migrating check */
1515         if (!page_locked) {
1516                 spin_unlock(ptl);
1517                 wait_on_page_locked(page);
1518                 page_nid = -1;
1519                 goto out;
1520         }
1521
1522         /*
1523          * Page is misplaced. Page lock serialises migrations. Acquire anon_vma
1524          * to serialises splits
1525          */
1526         get_page(page);
1527         spin_unlock(ptl);
1528         anon_vma = page_lock_anon_vma_read(page);
1529
1530         /* Confirm the PMD did not change while page_table_lock was released */
1531         spin_lock(ptl);
1532         if (unlikely(!pmd_same(pmd, *pmdp))) {
1533                 unlock_page(page);
1534                 put_page(page);
1535                 page_nid = -1;
1536                 goto out_unlock;
1537         }
1538
1539         /* Bail if we fail to protect against THP splits for any reason */
1540         if (unlikely(!anon_vma)) {
1541                 put_page(page);
1542                 page_nid = -1;
1543                 goto clear_pmdnuma;
1544         }
1545
1546         /*
1547          * Migrate the THP to the requested node, returns with page unlocked
1548          * and access rights restored.
1549          */
1550         spin_unlock(ptl);
1551         migrated = migrate_misplaced_transhuge_page(mm, vma,
1552                                 pmdp, pmd, addr, page, target_nid);
1553         if (migrated) {
1554                 flags |= TNF_MIGRATED;
1555                 page_nid = target_nid;
1556         } else
1557                 flags |= TNF_MIGRATE_FAIL;
1558
1559         goto out;
1560 clear_pmdnuma:
1561         BUG_ON(!PageLocked(page));
1562         was_writable = pmd_write(pmd);
1563         pmd = pmd_modify(pmd, vma->vm_page_prot);
1564         pmd = pmd_mkyoung(pmd);
1565         if (was_writable)
1566                 pmd = pmd_mkwrite(pmd);
1567         set_pmd_at(mm, haddr, pmdp, pmd);
1568         update_mmu_cache_pmd(vma, addr, pmdp);
1569         unlock_page(page);
1570 out_unlock:
1571         spin_unlock(ptl);
1572
1573 out:
1574         if (anon_vma)
1575                 page_unlock_anon_vma_read(anon_vma);
1576
1577         if (page_nid != -1)
1578                 task_numa_fault(last_cpupid, page_nid, HPAGE_PMD_NR, flags);
1579
1580         return 0;
1581 }
1582
1583 int madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
1584                 pmd_t *pmd, unsigned long addr, unsigned long next)
1585
1586 {
1587         spinlock_t *ptl;
1588         pmd_t orig_pmd;
1589         struct page *page;
1590         struct mm_struct *mm = tlb->mm;
1591         int ret = 0;
1592
1593         ptl = pmd_trans_huge_lock(pmd, vma);
1594         if (!ptl)
1595                 goto out_unlocked;
1596
1597         orig_pmd = *pmd;
1598         if (is_huge_zero_pmd(orig_pmd)) {
1599                 ret = 1;
1600                 goto out;
1601         }
1602
1603         page = pmd_page(orig_pmd);
1604         /*
1605          * If other processes are mapping this page, we couldn't discard
1606          * the page unless they all do MADV_FREE so let's skip the page.
1607          */
1608         if (page_mapcount(page) != 1)
1609                 goto out;
1610
1611         if (!trylock_page(page))
1612                 goto out;
1613
1614         /*
1615          * If user want to discard part-pages of THP, split it so MADV_FREE
1616          * will deactivate only them.
1617          */
1618         if (next - addr != HPAGE_PMD_SIZE) {
1619                 get_page(page);
1620                 spin_unlock(ptl);
1621                 if (split_huge_page(page)) {
1622                         put_page(page);
1623                         unlock_page(page);
1624                         goto out_unlocked;
1625                 }
1626                 put_page(page);
1627                 unlock_page(page);
1628                 ret = 1;
1629                 goto out_unlocked;
1630         }
1631
1632         if (PageDirty(page))
1633                 ClearPageDirty(page);
1634         unlock_page(page);
1635
1636         if (PageActive(page))
1637                 deactivate_page(page);
1638
1639         if (pmd_young(orig_pmd) || pmd_dirty(orig_pmd)) {
1640                 orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
1641                         tlb->fullmm);
1642                 orig_pmd = pmd_mkold(orig_pmd);
1643                 orig_pmd = pmd_mkclean(orig_pmd);
1644
1645                 set_pmd_at(mm, addr, pmd, orig_pmd);
1646                 tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
1647         }
1648         ret = 1;
1649 out:
1650         spin_unlock(ptl);
1651 out_unlocked:
1652         return ret;
1653 }
1654
1655 int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
1656                  pmd_t *pmd, unsigned long addr)
1657 {
1658         pmd_t orig_pmd;
1659         spinlock_t *ptl;
1660
1661         ptl = __pmd_trans_huge_lock(pmd, vma);
1662         if (!ptl)
1663                 return 0;
1664         /*
1665          * For architectures like ppc64 we look at deposited pgtable
1666          * when calling pmdp_huge_get_and_clear. So do the
1667          * pgtable_trans_huge_withdraw after finishing pmdp related
1668          * operations.
1669          */
1670         orig_pmd = pmdp_huge_get_and_clear_full(tlb->mm, addr, pmd,
1671                         tlb->fullmm);
1672         tlb_remove_pmd_tlb_entry(tlb, pmd, addr);
1673         if (vma_is_dax(vma)) {
1674                 spin_unlock(ptl);
1675                 if (is_huge_zero_pmd(orig_pmd))
1676                         put_huge_zero_page();
1677         } else if (is_huge_zero_pmd(orig_pmd)) {
1678                 pte_free(tlb->mm, pgtable_trans_huge_withdraw(tlb->mm, pmd));
1679                 atomic_long_dec(&tlb->mm->nr_ptes);
1680                 spin_unlock(ptl);
1681                 put_huge_zero_page();
1682         } else {
1683                 struct page *page = pmd_page(orig_pmd);
1684                 page_remove_rmap(page, true);
1685                 VM_BUG_ON_PAGE(page_mapcount(page) < 0, page);
1686                 add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
1687                 VM_BUG_ON_PAGE(!PageHead(page), page);
1688                 pte_free(tlb->mm, pgtable_trans_huge_withdraw(tlb->mm, pmd));
1689                 atomic_long_dec(&tlb->mm->nr_ptes);
1690                 spin_unlock(ptl);
1691                 tlb_remove_page(tlb, page);
1692         }
1693         return 1;
1694 }
1695
1696 bool move_huge_pmd(struct vm_area_struct *vma, struct vm_area_struct *new_vma,
1697                   unsigned long old_addr,
1698                   unsigned long new_addr, unsigned long old_end,
1699                   pmd_t *old_pmd, pmd_t *new_pmd)
1700 {
1701         spinlock_t *old_ptl, *new_ptl;
1702         pmd_t pmd;
1703
1704         struct mm_struct *mm = vma->vm_mm;
1705
1706         if ((old_addr & ~HPAGE_PMD_MASK) ||
1707             (new_addr & ~HPAGE_PMD_MASK) ||
1708             old_end - old_addr < HPAGE_PMD_SIZE ||
1709             (new_vma->vm_flags & VM_NOHUGEPAGE))
1710                 return false;
1711
1712         /*
1713          * The destination pmd shouldn't be established, free_pgtables()
1714          * should have release it.
1715          */
1716         if (WARN_ON(!pmd_none(*new_pmd))) {
1717                 VM_BUG_ON(pmd_trans_huge(*new_pmd));
1718                 return false;
1719         }
1720
1721         /*
1722          * We don't have to worry about the ordering of src and dst
1723          * ptlocks because exclusive mmap_sem prevents deadlock.
1724          */
1725         old_ptl = __pmd_trans_huge_lock(old_pmd, vma);
1726         if (old_ptl) {
1727                 new_ptl = pmd_lockptr(mm, new_pmd);
1728                 if (new_ptl != old_ptl)
1729                         spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
1730                 pmd = pmdp_huge_get_and_clear(mm, old_addr, old_pmd);
1731                 VM_BUG_ON(!pmd_none(*new_pmd));
1732
1733                 if (pmd_move_must_withdraw(new_ptl, old_ptl) &&
1734                                 vma_is_anonymous(vma)) {
1735                         pgtable_t pgtable;
1736                         pgtable = pgtable_trans_huge_withdraw(mm, old_pmd);
1737                         pgtable_trans_huge_deposit(mm, new_pmd, pgtable);
1738                 }
1739                 set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd));
1740                 if (new_ptl != old_ptl)
1741                         spin_unlock(new_ptl);
1742                 spin_unlock(old_ptl);
1743                 return true;
1744         }
1745         return false;
1746 }
1747
1748 /*
1749  * Returns
1750  *  - 0 if PMD could not be locked
1751  *  - 1 if PMD was locked but protections unchange and TLB flush unnecessary
1752  *  - HPAGE_PMD_NR is protections changed and TLB flush necessary
1753  */
1754 int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
1755                 unsigned long addr, pgprot_t newprot, int prot_numa)
1756 {
1757         struct mm_struct *mm = vma->vm_mm;
1758         spinlock_t *ptl;
1759         int ret = 0;
1760
1761         ptl = __pmd_trans_huge_lock(pmd, vma);
1762         if (ptl) {
1763                 pmd_t entry;
1764                 bool preserve_write = prot_numa && pmd_write(*pmd);
1765                 ret = 1;
1766
1767                 /*
1768                  * Avoid trapping faults against the zero page. The read-only
1769                  * data is likely to be read-cached on the local CPU and
1770                  * local/remote hits to the zero page are not interesting.
1771                  */
1772                 if (prot_numa && is_huge_zero_pmd(*pmd)) {
1773                         spin_unlock(ptl);
1774                         return ret;
1775                 }
1776
1777                 if (!prot_numa || !pmd_protnone(*pmd)) {
1778                         entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
1779                         entry = pmd_modify(entry, newprot);
1780                         if (preserve_write)
1781                                 entry = pmd_mkwrite(entry);
1782                         ret = HPAGE_PMD_NR;
1783                         set_pmd_at(mm, addr, pmd, entry);
1784                         BUG_ON(!preserve_write && pmd_write(entry));
1785                 }
1786                 spin_unlock(ptl);
1787         }
1788
1789         return ret;
1790 }
1791
1792 /*
1793  * Returns true if a given pmd maps a thp, false otherwise.
1794  *
1795  * Note that if it returns true, this routine returns without unlocking page
1796  * table lock. So callers must unlock it.
1797  */
1798 spinlock_t *__pmd_trans_huge_lock(pmd_t *pmd, struct vm_area_struct *vma)
1799 {
1800         spinlock_t *ptl;
1801         ptl = pmd_lock(vma->vm_mm, pmd);
1802         if (likely(pmd_trans_huge(*pmd) || pmd_devmap(*pmd)))
1803                 return ptl;
1804         spin_unlock(ptl);
1805         return NULL;
1806 }
1807
1808 #define VM_NO_THP (VM_SPECIAL | VM_HUGETLB | VM_SHARED | VM_MAYSHARE)
1809
1810 int hugepage_madvise(struct vm_area_struct *vma,
1811                      unsigned long *vm_flags, int advice)
1812 {
1813         switch (advice) {
1814         case MADV_HUGEPAGE:
1815 #ifdef CONFIG_S390
1816                 /*
1817                  * qemu blindly sets MADV_HUGEPAGE on all allocations, but s390
1818                  * can't handle this properly after s390_enable_sie, so we simply
1819                  * ignore the madvise to prevent qemu from causing a SIGSEGV.
1820                  */
1821                 if (mm_has_pgste(vma->vm_mm))
1822                         return 0;
1823 #endif
1824                 /*
1825                  * Be somewhat over-protective like KSM for now!
1826                  */
1827                 if (*vm_flags & VM_NO_THP)
1828                         return -EINVAL;
1829                 *vm_flags &= ~VM_NOHUGEPAGE;
1830                 *vm_flags |= VM_HUGEPAGE;
1831                 /*
1832                  * If the vma become good for khugepaged to scan,
1833                  * register it here without waiting a page fault that
1834                  * may not happen any time soon.
1835                  */
1836                 if (unlikely(khugepaged_enter_vma_merge(vma, *vm_flags)))
1837                         return -ENOMEM;
1838                 break;
1839         case MADV_NOHUGEPAGE:
1840                 /*
1841                  * Be somewhat over-protective like KSM for now!
1842                  */
1843                 if (*vm_flags & VM_NO_THP)
1844                         return -EINVAL;
1845                 *vm_flags &= ~VM_HUGEPAGE;
1846                 *vm_flags |= VM_NOHUGEPAGE;
1847                 /*
1848                  * Setting VM_NOHUGEPAGE will prevent khugepaged from scanning
1849                  * this vma even if we leave the mm registered in khugepaged if
1850                  * it got registered before VM_NOHUGEPAGE was set.
1851                  */
1852                 break;
1853         }
1854
1855         return 0;
1856 }
1857
1858 static int __init khugepaged_slab_init(void)
1859 {
1860         mm_slot_cache = kmem_cache_create("khugepaged_mm_slot",
1861                                           sizeof(struct mm_slot),
1862                                           __alignof__(struct mm_slot), 0, NULL);
1863         if (!mm_slot_cache)
1864                 return -ENOMEM;
1865
1866         return 0;
1867 }
1868
1869 static void __init khugepaged_slab_exit(void)
1870 {
1871         kmem_cache_destroy(mm_slot_cache);
1872 }
1873
1874 static inline struct mm_slot *alloc_mm_slot(void)
1875 {
1876         if (!mm_slot_cache)     /* initialization failed */
1877                 return NULL;
1878         return kmem_cache_zalloc(mm_slot_cache, GFP_KERNEL);
1879 }
1880
1881 static inline void free_mm_slot(struct mm_slot *mm_slot)
1882 {
1883         kmem_cache_free(mm_slot_cache, mm_slot);
1884 }
1885
1886 static struct mm_slot *get_mm_slot(struct mm_struct *mm)
1887 {
1888         struct mm_slot *mm_slot;
1889
1890         hash_for_each_possible(mm_slots_hash, mm_slot, hash, (unsigned long)mm)
1891                 if (mm == mm_slot->mm)
1892                         return mm_slot;
1893
1894         return NULL;
1895 }
1896
1897 static void insert_to_mm_slots_hash(struct mm_struct *mm,
1898                                     struct mm_slot *mm_slot)
1899 {
1900         mm_slot->mm = mm;
1901         hash_add(mm_slots_hash, &mm_slot->hash, (long)mm);
1902 }
1903
1904 static inline int khugepaged_test_exit(struct mm_struct *mm)
1905 {
1906         return atomic_read(&mm->mm_users) == 0;
1907 }
1908
1909 int __khugepaged_enter(struct mm_struct *mm)
1910 {
1911         struct mm_slot *mm_slot;
1912         int wakeup;
1913
1914         mm_slot = alloc_mm_slot();
1915         if (!mm_slot)
1916                 return -ENOMEM;
1917
1918         /* __khugepaged_exit() must not run from under us */
1919         VM_BUG_ON_MM(khugepaged_test_exit(mm), mm);
1920         if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) {
1921                 free_mm_slot(mm_slot);
1922                 return 0;
1923         }
1924
1925         spin_lock(&khugepaged_mm_lock);
1926         insert_to_mm_slots_hash(mm, mm_slot);
1927         /*
1928          * Insert just behind the scanning cursor, to let the area settle
1929          * down a little.
1930          */
1931         wakeup = list_empty(&khugepaged_scan.mm_head);
1932         list_add_tail(&mm_slot->mm_node, &khugepaged_scan.mm_head);
1933         spin_unlock(&khugepaged_mm_lock);
1934
1935         atomic_inc(&mm->mm_count);
1936         if (wakeup)
1937                 wake_up_interruptible(&khugepaged_wait);
1938
1939         return 0;
1940 }
1941
1942 int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
1943                                unsigned long vm_flags)
1944 {
1945         unsigned long hstart, hend;
1946         if (!vma->anon_vma)
1947                 /*
1948                  * Not yet faulted in so we will register later in the
1949                  * page fault if needed.
1950                  */
1951                 return 0;
1952         if (vma->vm_ops)
1953                 /* khugepaged not yet working on file or special mappings */
1954                 return 0;
1955         VM_BUG_ON_VMA(vm_flags & VM_NO_THP, vma);
1956         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
1957         hend = vma->vm_end & HPAGE_PMD_MASK;
1958         if (hstart < hend)
1959                 return khugepaged_enter(vma, vm_flags);
1960         return 0;
1961 }
1962
1963 void __khugepaged_exit(struct mm_struct *mm)
1964 {
1965         struct mm_slot *mm_slot;
1966         int free = 0;
1967
1968         spin_lock(&khugepaged_mm_lock);
1969         mm_slot = get_mm_slot(mm);
1970         if (mm_slot && khugepaged_scan.mm_slot != mm_slot) {
1971                 hash_del(&mm_slot->hash);
1972                 list_del(&mm_slot->mm_node);
1973                 free = 1;
1974         }
1975         spin_unlock(&khugepaged_mm_lock);
1976
1977         if (free) {
1978                 clear_bit(MMF_VM_HUGEPAGE, &mm->flags);
1979                 free_mm_slot(mm_slot);
1980                 mmdrop(mm);
1981         } else if (mm_slot) {
1982                 /*
1983                  * This is required to serialize against
1984                  * khugepaged_test_exit() (which is guaranteed to run
1985                  * under mmap sem read mode). Stop here (after we
1986                  * return all pagetables will be destroyed) until
1987                  * khugepaged has finished working on the pagetables
1988                  * under the mmap_sem.
1989                  */
1990                 down_write(&mm->mmap_sem);
1991                 up_write(&mm->mmap_sem);
1992         }
1993 }
1994
1995 static void release_pte_page(struct page *page)
1996 {
1997         /* 0 stands for page_is_file_cache(page) == false */
1998         dec_zone_page_state(page, NR_ISOLATED_ANON + 0);
1999         unlock_page(page);
2000         putback_lru_page(page);
2001 }
2002
2003 static void release_pte_pages(pte_t *pte, pte_t *_pte)
2004 {
2005         while (--_pte >= pte) {
2006                 pte_t pteval = *_pte;
2007                 if (!pte_none(pteval) && !is_zero_pfn(pte_pfn(pteval)))
2008                         release_pte_page(pte_page(pteval));
2009         }
2010 }
2011
2012 static int __collapse_huge_page_isolate(struct vm_area_struct *vma,
2013                                         unsigned long address,
2014                                         pte_t *pte)
2015 {
2016         struct page *page = NULL;
2017         pte_t *_pte;
2018         int none_or_zero = 0, result = 0;
2019         bool referenced = false, writable = false;
2020
2021         for (_pte = pte; _pte < pte+HPAGE_PMD_NR;
2022              _pte++, address += PAGE_SIZE) {
2023                 pte_t pteval = *_pte;
2024                 if (pte_none(pteval) || (pte_present(pteval) &&
2025                                 is_zero_pfn(pte_pfn(pteval)))) {
2026                         if (!userfaultfd_armed(vma) &&
2027                             ++none_or_zero <= khugepaged_max_ptes_none) {
2028                                 continue;
2029                         } else {
2030                                 result = SCAN_EXCEED_NONE_PTE;
2031                                 goto out;
2032                         }
2033                 }
2034                 if (!pte_present(pteval)) {
2035                         result = SCAN_PTE_NON_PRESENT;
2036                         goto out;
2037                 }
2038                 page = vm_normal_page(vma, address, pteval);
2039                 if (unlikely(!page)) {
2040                         result = SCAN_PAGE_NULL;
2041                         goto out;
2042                 }
2043
2044                 VM_BUG_ON_PAGE(PageCompound(page), page);
2045                 VM_BUG_ON_PAGE(!PageAnon(page), page);
2046                 VM_BUG_ON_PAGE(!PageSwapBacked(page), page);
2047
2048                 /*
2049                  * We can do it before isolate_lru_page because the
2050                  * page can't be freed from under us. NOTE: PG_lock
2051                  * is needed to serialize against split_huge_page
2052                  * when invoked from the VM.
2053                  */
2054                 if (!trylock_page(page)) {
2055                         result = SCAN_PAGE_LOCK;
2056                         goto out;
2057                 }
2058
2059                 /*
2060                  * cannot use mapcount: can't collapse if there's a gup pin.
2061                  * The page must only be referenced by the scanned process
2062                  * and page swap cache.
2063                  */
2064                 if (page_count(page) != 1 + !!PageSwapCache(page)) {
2065                         unlock_page(page);
2066                         result = SCAN_PAGE_COUNT;
2067                         goto out;
2068                 }
2069                 if (pte_write(pteval)) {
2070                         writable = true;
2071                 } else {
2072                         if (PageSwapCache(page) && !reuse_swap_page(page)) {
2073                                 unlock_page(page);
2074                                 result = SCAN_SWAP_CACHE_PAGE;
2075                                 goto out;
2076                         }
2077                         /*
2078                          * Page is not in the swap cache. It can be collapsed
2079                          * into a THP.
2080                          */
2081                 }
2082
2083                 /*
2084                  * Isolate the page to avoid collapsing an hugepage
2085                  * currently in use by the VM.
2086                  */
2087                 if (isolate_lru_page(page)) {
2088                         unlock_page(page);
2089                         result = SCAN_DEL_PAGE_LRU;
2090                         goto out;
2091                 }
2092                 /* 0 stands for page_is_file_cache(page) == false */
2093                 inc_zone_page_state(page, NR_ISOLATED_ANON + 0);
2094                 VM_BUG_ON_PAGE(!PageLocked(page), page);
2095                 VM_BUG_ON_PAGE(PageLRU(page), page);
2096
2097                 /* If there is no mapped pte young don't collapse the page */
2098                 if (pte_young(pteval) ||
2099                     page_is_young(page) || PageReferenced(page) ||
2100                     mmu_notifier_test_young(vma->vm_mm, address))
2101                         referenced = true;
2102         }
2103         if (likely(writable)) {
2104                 if (likely(referenced)) {
2105                         result = SCAN_SUCCEED;
2106                         trace_mm_collapse_huge_page_isolate(page, none_or_zero,
2107                                                             referenced, writable, result);
2108                         return 1;
2109                 }
2110         } else {
2111                 result = SCAN_PAGE_RO;
2112         }
2113
2114 out:
2115         release_pte_pages(pte, _pte);
2116         trace_mm_collapse_huge_page_isolate(page, none_or_zero,
2117                                             referenced, writable, result);
2118         return 0;
2119 }
2120
2121 static void __collapse_huge_page_copy(pte_t *pte, struct page *page,
2122                                       struct vm_area_struct *vma,
2123                                       unsigned long address,
2124                                       spinlock_t *ptl)
2125 {
2126         pte_t *_pte;
2127         for (_pte = pte; _pte < pte+HPAGE_PMD_NR; _pte++) {
2128                 pte_t pteval = *_pte;
2129                 struct page *src_page;
2130
2131                 if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {
2132                         clear_user_highpage(page, address);
2133                         add_mm_counter(vma->vm_mm, MM_ANONPAGES, 1);
2134                         if (is_zero_pfn(pte_pfn(pteval))) {
2135                                 /*
2136                                  * ptl mostly unnecessary.
2137                                  */
2138                                 spin_lock(ptl);
2139                                 /*
2140                                  * paravirt calls inside pte_clear here are
2141                                  * superfluous.
2142                                  */
2143                                 pte_clear(vma->vm_mm, address, _pte);
2144                                 spin_unlock(ptl);
2145                         }
2146                 } else {
2147                         src_page = pte_page(pteval);
2148                         copy_user_highpage(page, src_page, address, vma);
2149                         VM_BUG_ON_PAGE(page_mapcount(src_page) != 1, src_page);
2150                         release_pte_page(src_page);
2151                         /*
2152                          * ptl mostly unnecessary, but preempt has to
2153                          * be disabled to update the per-cpu stats
2154                          * inside page_remove_rmap().
2155                          */
2156                         spin_lock(ptl);
2157                         /*
2158                          * paravirt calls inside pte_clear here are
2159                          * superfluous.
2160                          */
2161                         pte_clear(vma->vm_mm, address, _pte);
2162                         page_remove_rmap(src_page, false);
2163                         spin_unlock(ptl);
2164                         free_page_and_swap_cache(src_page);
2165                 }
2166
2167                 address += PAGE_SIZE;
2168                 page++;
2169         }
2170 }
2171
2172 static void khugepaged_alloc_sleep(void)
2173 {
2174         DEFINE_WAIT(wait);
2175
2176         add_wait_queue(&khugepaged_wait, &wait);
2177         freezable_schedule_timeout_interruptible(
2178                 msecs_to_jiffies(khugepaged_alloc_sleep_millisecs));
2179         remove_wait_queue(&khugepaged_wait, &wait);
2180 }
2181
2182 static int khugepaged_node_load[MAX_NUMNODES];
2183
2184 static bool khugepaged_scan_abort(int nid)
2185 {
2186         int i;
2187
2188         /*
2189          * If zone_reclaim_mode is disabled, then no extra effort is made to
2190          * allocate memory locally.
2191          */
2192         if (!zone_reclaim_mode)
2193                 return false;
2194
2195         /* If there is a count for this node already, it must be acceptable */
2196         if (khugepaged_node_load[nid])
2197                 return false;
2198
2199         for (i = 0; i < MAX_NUMNODES; i++) {
2200                 if (!khugepaged_node_load[i])
2201                         continue;
2202                 if (node_distance(nid, i) > RECLAIM_DISTANCE)
2203                         return true;
2204         }
2205         return false;
2206 }
2207
2208 #ifdef CONFIG_NUMA
2209 static int khugepaged_find_target_node(void)
2210 {
2211         static int last_khugepaged_target_node = NUMA_NO_NODE;
2212         int nid, target_node = 0, max_value = 0;
2213
2214         /* find first node with max normal pages hit */
2215         for (nid = 0; nid < MAX_NUMNODES; nid++)
2216                 if (khugepaged_node_load[nid] > max_value) {
2217                         max_value = khugepaged_node_load[nid];
2218                         target_node = nid;
2219                 }
2220
2221         /* do some balance if several nodes have the same hit record */
2222         if (target_node <= last_khugepaged_target_node)
2223                 for (nid = last_khugepaged_target_node + 1; nid < MAX_NUMNODES;
2224                                 nid++)
2225                         if (max_value == khugepaged_node_load[nid]) {
2226                                 target_node = nid;
2227                                 break;
2228                         }
2229
2230         last_khugepaged_target_node = target_node;
2231         return target_node;
2232 }
2233
2234 static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
2235 {
2236         if (IS_ERR(*hpage)) {
2237                 if (!*wait)
2238                         return false;
2239
2240                 *wait = false;
2241                 *hpage = NULL;
2242                 khugepaged_alloc_sleep();
2243         } else if (*hpage) {
2244                 put_page(*hpage);
2245                 *hpage = NULL;
2246         }
2247
2248         return true;
2249 }
2250
2251 static struct page *
2252 khugepaged_alloc_page(struct page **hpage, gfp_t gfp, struct mm_struct *mm,
2253                        unsigned long address, int node)
2254 {
2255         VM_BUG_ON_PAGE(*hpage, *hpage);
2256
2257         /*
2258          * Before allocating the hugepage, release the mmap_sem read lock.
2259          * The allocation can take potentially a long time if it involves
2260          * sync compaction, and we do not need to hold the mmap_sem during
2261          * that. We will recheck the vma after taking it again in write mode.
2262          */
2263         up_read(&mm->mmap_sem);
2264
2265         *hpage = __alloc_pages_node(node, gfp, HPAGE_PMD_ORDER);
2266         if (unlikely(!*hpage)) {
2267                 count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
2268                 *hpage = ERR_PTR(-ENOMEM);
2269                 return NULL;
2270         }
2271
2272         prep_transhuge_page(*hpage);
2273         count_vm_event(THP_COLLAPSE_ALLOC);
2274         return *hpage;
2275 }
2276 #else
2277 static int khugepaged_find_target_node(void)
2278 {
2279         return 0;
2280 }
2281
2282 static inline struct page *alloc_khugepaged_hugepage(void)
2283 {
2284         struct page *page;
2285
2286         page = alloc_pages(alloc_hugepage_khugepaged_gfpmask(),
2287                            HPAGE_PMD_ORDER);
2288         if (page)
2289                 prep_transhuge_page(page);
2290         return page;
2291 }
2292
2293 static struct page *khugepaged_alloc_hugepage(bool *wait)
2294 {
2295         struct page *hpage;
2296
2297         do {
2298                 hpage = alloc_khugepaged_hugepage();
2299                 if (!hpage) {
2300                         count_vm_event(THP_COLLAPSE_ALLOC_FAILED);
2301                         if (!*wait)
2302                                 return NULL;
2303
2304                         *wait = false;
2305                         khugepaged_alloc_sleep();
2306                 } else
2307                         count_vm_event(THP_COLLAPSE_ALLOC);
2308         } while (unlikely(!hpage) && likely(khugepaged_enabled()));
2309
2310         return hpage;
2311 }
2312
2313 static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
2314 {
2315         if (!*hpage)
2316                 *hpage = khugepaged_alloc_hugepage(wait);
2317
2318         if (unlikely(!*hpage))
2319                 return false;
2320
2321         return true;
2322 }
2323
2324 static struct page *
2325 khugepaged_alloc_page(struct page **hpage, gfp_t gfp, struct mm_struct *mm,
2326                        unsigned long address, int node)
2327 {
2328         up_read(&mm->mmap_sem);
2329         VM_BUG_ON(!*hpage);
2330
2331         return  *hpage;
2332 }
2333 #endif
2334
2335 static bool hugepage_vma_check(struct vm_area_struct *vma)
2336 {
2337         if ((!(vma->vm_flags & VM_HUGEPAGE) && !khugepaged_always()) ||
2338             (vma->vm_flags & VM_NOHUGEPAGE))
2339                 return false;
2340         if (!vma->anon_vma || vma->vm_ops)
2341                 return false;
2342         if (is_vma_temporary_stack(vma))
2343                 return false;
2344         VM_BUG_ON_VMA(vma->vm_flags & VM_NO_THP, vma);
2345         return true;
2346 }
2347
2348 static void collapse_huge_page(struct mm_struct *mm,
2349                                    unsigned long address,
2350                                    struct page **hpage,
2351                                    struct vm_area_struct *vma,
2352                                    int node)
2353 {
2354         pmd_t *pmd, _pmd;
2355         pte_t *pte;
2356         pgtable_t pgtable;
2357         struct page *new_page;
2358         spinlock_t *pmd_ptl, *pte_ptl;
2359         int isolated = 0, result = 0;
2360         unsigned long hstart, hend;
2361         struct mem_cgroup *memcg;
2362         unsigned long mmun_start;       /* For mmu_notifiers */
2363         unsigned long mmun_end;         /* For mmu_notifiers */
2364         gfp_t gfp;
2365
2366         VM_BUG_ON(address & ~HPAGE_PMD_MASK);
2367
2368         /* Only allocate from the target node */
2369         gfp = alloc_hugepage_khugepaged_gfpmask() | __GFP_OTHER_NODE | __GFP_THISNODE;
2370
2371         /* release the mmap_sem read lock. */
2372         new_page = khugepaged_alloc_page(hpage, gfp, mm, address, node);
2373         if (!new_page) {
2374                 result = SCAN_ALLOC_HUGE_PAGE_FAIL;
2375                 goto out_nolock;
2376         }
2377
2378         if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) {
2379                 result = SCAN_CGROUP_CHARGE_FAIL;
2380                 goto out_nolock;
2381         }
2382
2383         /*
2384          * Prevent all access to pagetables with the exception of
2385          * gup_fast later hanlded by the ptep_clear_flush and the VM
2386          * handled by the anon_vma lock + PG_lock.
2387          */
2388         down_write(&mm->mmap_sem);
2389         if (unlikely(khugepaged_test_exit(mm))) {
2390                 result = SCAN_ANY_PROCESS;
2391                 goto out;
2392         }
2393
2394         vma = find_vma(mm, address);
2395         if (!vma) {
2396                 result = SCAN_VMA_NULL;
2397                 goto out;
2398         }
2399         hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
2400         hend = vma->vm_end & HPAGE_PMD_MASK;
2401         if (address < hstart || address + HPAGE_PMD_SIZE > hend) {
2402                 result = SCAN_ADDRESS_RANGE;
2403                 goto out;
2404         }
2405         if (!hugepage_vma_check(vma)) {
2406                 result = SCAN_VMA_CHECK;
2407                 goto out;
2408         }
2409         pmd = mm_find_pmd(mm, address);
2410         if (!pmd) {
2411                 result = SCAN_PMD_NULL;
2412                 goto out;
2413         }
2414
2415         anon_vma_lock_write(vma->anon_vma);
2416
2417         pte = pte_offset_map(pmd, address);
2418         pte_ptl = pte_lockptr(mm, pmd);
2419
2420         mmun_start = address;
2421         mmun_end   = address + HPAGE_PMD_SIZE;
2422         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
2423         pmd_ptl = pmd_lock(mm, pmd); /* probably unnecessary */
2424         /*
2425          * After this gup_fast can't run anymore. This also removes
2426          * any huge TLB entry from the CPU so we won't allow
2427          * huge and small TLB entries for the same virtual address
2428          * to avoid the risk of CPU bugs in that area.
2429          */
2430         _pmd = pmdp_collapse_flush(vma, address, pmd);
2431         spin_unlock(pmd_ptl);
2432         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
2433
2434         spin_lock(pte_ptl);
2435         isolated = __collapse_huge_page_isolate(vma, address, pte);
2436         spin_unlock(pte_ptl);
2437
2438         if (unlikely(!isolated)) {
2439                 pte_unmap(pte);
2440                 spin_lock(pmd_ptl);
2441                 BUG_ON(!pmd_none(*pmd));
2442                 /*
2443                  * We can only use set_pmd_at when establishing
2444                  * hugepmds and never for establishing regular pmds that
2445                  * points to regular pagetables. Use pmd_populate for that
2446                  */
2447                 pmd_populate(mm, pmd, pmd_pgtable(_pmd));
2448                 spin_unlock(pmd_ptl);
2449                 anon_vma_unlock_write(vma->anon_vma);
2450                 result = SCAN_FAIL;
2451                 goto out;
2452         }
2453
2454         /*
2455          * All pages are isolated and locked so anon_vma rmap
2456          * can't run anymore.
2457          */
2458         anon_vma_unlock_write(vma->anon_vma);
2459
2460         __collapse_huge_page_copy(pte, new_page, vma, address, pte_ptl);
2461         pte_unmap(pte);
2462         __SetPageUptodate(new_page);
2463         pgtable = pmd_pgtable(_pmd);
2464
2465         _pmd = mk_huge_pmd(new_page, vma->vm_page_prot);
2466         _pmd = maybe_pmd_mkwrite(pmd_mkdirty(_pmd), vma);
2467
2468         /*
2469          * spin_lock() below is not the equivalent of smp_wmb(), so
2470          * this is needed to avoid the copy_huge_page writes to become
2471          * visible after the set_pmd_at() write.
2472          */
2473         smp_wmb();
2474
2475         spin_lock(pmd_ptl);
2476         BUG_ON(!pmd_none(*pmd));
2477         page_add_new_anon_rmap(new_page, vma, address, true);
2478         mem_cgroup_commit_charge(new_page, memcg, false, true);
2479         lru_cache_add_active_or_unevictable(new_page, vma);
2480         pgtable_trans_huge_deposit(mm, pmd, pgtable);
2481         set_pmd_at(mm, address, pmd, _pmd);
2482         update_mmu_cache_pmd(vma, address, pmd);
2483         spin_unlock(pmd_ptl);
2484
2485         *hpage = NULL;
2486
2487         khugepaged_pages_collapsed++;
2488         result = SCAN_SUCCEED;
2489 out_up_write:
2490         up_write(&mm->mmap_sem);
2491         trace_mm_collapse_huge_page(mm, isolated, result);
2492         return;
2493
2494 out_nolock:
2495         trace_mm_collapse_huge_page(mm, isolated, result);
2496         return;
2497 out:
2498         mem_cgroup_cancel_charge(new_page, memcg, true);
2499         goto out_up_write;
2500 }
2501
2502 static int khugepaged_scan_pmd(struct mm_struct *mm,
2503                                struct vm_area_struct *vma,
2504                                unsigned long address,
2505                                struct page **hpage)
2506 {
2507         pmd_t *pmd;
2508         pte_t *pte, *_pte;
2509         int ret = 0, none_or_zero = 0, result = 0;
2510         struct page *page = NULL;
2511         unsigned long _address;
2512         spinlock_t *ptl;
2513         int node = NUMA_NO_NODE;
2514         bool writable = false, referenced = false;
2515
2516         VM_BUG_ON(address & ~HPAGE_PMD_MASK);
2517
2518         pmd = mm_find_pmd(mm, address);
2519         if (!pmd) {
2520                 result = SCAN_PMD_NULL;
2521                 goto out;
2522         }
2523
2524         memset(khugepaged_node_load, 0, sizeof(khugepaged_node_load));
2525         pte = pte_offset_map_lock(mm, pmd, address, &ptl);
2526         for (_address = address, _pte = pte; _pte < pte+HPAGE_PMD_NR;
2527              _pte++, _address += PAGE_SIZE) {
2528                 pte_t pteval = *_pte;
2529                 if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {
2530                         if (!userfaultfd_armed(vma) &&
2531                             ++none_or_zero <= khugepaged_max_ptes_none) {
2532                                 continue;
2533                         } else {
2534                                 result = SCAN_EXCEED_NONE_PTE;
2535                                 goto out_unmap;
2536                         }
2537                 }
2538                 if (!pte_present(pteval)) {
2539                         result = SCAN_PTE_NON_PRESENT;
2540                         goto out_unmap;
2541                 }
2542                 if (pte_write(pteval))
2543                         writable = true;
2544
2545                 page = vm_normal_page(vma, _address, pteval);
2546                 if (unlikely(!page)) {
2547                         result = SCAN_PAGE_NULL;
2548                         goto out_unmap;
2549                 }
2550
2551                 /* TODO: teach khugepaged to collapse THP mapped with pte */
2552                 if (PageCompound(page)) {
2553                         result = SCAN_PAGE_COMPOUND;
2554                         goto out_unmap;
2555                 }
2556
2557                 /*
2558                  * Record which node the original page is from and save this
2559                  * information to khugepaged_node_load[].
2560                  * Khupaged will allocate hugepage from the node has the max
2561                  * hit record.
2562                  */
2563                 node = page_to_nid(page);
2564                 if (khugepaged_scan_abort(node)) {
2565                         result = SCAN_SCAN_ABORT;
2566                         goto out_unmap;
2567                 }
2568                 khugepaged_node_load[node]++;
2569                 if (!PageLRU(page)) {
2570                         result = SCAN_SCAN_ABORT;
2571                         goto out_unmap;
2572                 }
2573                 if (PageLocked(page)) {
2574                         result = SCAN_PAGE_LOCK;
2575                         goto out_unmap;
2576                 }
2577                 if (!PageAnon(page)) {
2578                         result = SCAN_PAGE_ANON;
2579                         goto out_unmap;
2580                 }
2581
2582                 /*
2583                  * cannot use mapcount: can't collapse if there's a gup pin.
2584                  * The page must only be referenced by the scanned process
2585                  * and page swap cache.
2586                  */
2587                 if (page_count(page) != 1 + !!PageSwapCache(page)) {
2588                         result = SCAN_PAGE_COUNT;
2589                         goto out_unmap;
2590                 }
2591                 if (pte_young(pteval) ||
2592                     page_is_young(page) || PageReferenced(page) ||
2593                     mmu_notifier_test_young(vma->vm_mm, address))
2594                         referenced = true;
2595         }
2596         if (writable) {
2597                 if (referenced) {
2598                         result = SCAN_SUCCEED;
2599                         ret = 1;
2600                 } else {
2601                         result = SCAN_NO_REFERENCED_PAGE;
2602                 }
2603         } else {
2604                 result = SCAN_PAGE_RO;
2605         }
2606 out_unmap:
2607         pte_unmap_unlock(pte, ptl);
2608         if (ret) {
2609                 node = khugepaged_find_target_node();
2610                 /* collapse_huge_page will return with the mmap_sem released */
2611                 collapse_huge_page(mm, address, hpage, vma, node);
2612         }
2613 out:
2614         trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,
2615                                      none_or_zero, result);
2616         return ret;
2617 }
2618
2619 static void collect_mm_slot(struct mm_slot *mm_slot)
2620 {
2621         struct mm_struct *mm = mm_slot->mm;
2622
2623         VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
2624
2625         if (khugepaged_test_exit(mm)) {
2626                 /* free mm_slot */
2627                 hash_del(&mm_slot->hash);
2628                 list_del(&mm_slot->mm_node);
2629
2630                 /*
2631                  * Not strictly needed because the mm exited already.
2632                  *
2633                  * clear_bit(MMF_VM_HUGEPAGE, &mm->flags);
2634                  */
2635
2636                 /* khugepaged_mm_lock actually not necessary for the below */
2637                 free_mm_slot(mm_slot);
2638                 mmdrop(mm);
2639         }
2640 }
2641
2642 static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
2643                                             struct page **hpage)
2644         __releases(&khugepaged_mm_lock)
2645         __acquires(&khugepaged_mm_lock)
2646 {
2647         struct mm_slot *mm_slot;
2648         struct mm_struct *mm;
2649         struct vm_area_struct *vma;
2650         int progress = 0;
2651
2652         VM_BUG_ON(!pages);
2653         VM_BUG_ON(NR_CPUS != 1 && !spin_is_locked(&khugepaged_mm_lock));
2654
2655         if (khugepaged_scan.mm_slot)
2656                 mm_slot = khugepaged_scan.mm_slot;
2657         else {
2658                 mm_slot = list_entry(khugepaged_scan.mm_head.next,
2659                                      struct mm_slot, mm_node);
2660                 khugepaged_scan.address = 0;
2661                 khugepaged_scan.mm_slot = mm_slot;
2662         }
2663         spin_unlock(&khugepaged_mm_lock);
2664
2665         mm = mm_slot->mm;
2666         down_read(&mm->mmap_sem);
2667         if (unlikely(khugepaged_test_exit(mm)))
2668                 vma = NULL;
2669         else
2670                 vma = find_vma(mm, khugepaged_scan.address);
2671
2672         progress++;
2673         for (; vma; vma = vma->vm_next) {
2674                 unsigned long hstart, hend;
2675
2676                 cond_resched();
2677                 if (unlikely(khugepaged_test_exit(mm))) {
2678                         progress++;
2679                         break;
2680                 }
2681                 if (!hugepage_vma_check(vma)) {
2682 skip:
2683                         progress++;
2684                         continue;
2685                 }
2686                 hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
2687                 hend = vma->vm_end & HPAGE_PMD_MASK;
2688                 if (hstart >= hend)
2689                         goto skip;
2690                 if (khugepaged_scan.address > hend)
2691                         goto skip;
2692                 if (khugepaged_scan.address < hstart)
2693                         khugepaged_scan.address = hstart;
2694                 VM_BUG_ON(khugepaged_scan.address & ~HPAGE_PMD_MASK);
2695
2696                 while (khugepaged_scan.address < hend) {
2697                         int ret;
2698                         cond_resched();
2699                         if (unlikely(khugepaged_test_exit(mm)))
2700                                 goto breakouterloop;
2701
2702                         VM_BUG_ON(khugepaged_scan.address < hstart ||
2703                                   khugepaged_scan.address + HPAGE_PMD_SIZE >
2704                                   hend);
2705                         ret = khugepaged_scan_pmd(mm, vma,
2706                                                   khugepaged_scan.address,
2707                                                   hpage);
2708                         /* move to next address */
2709                         khugepaged_scan.address += HPAGE_PMD_SIZE;
2710                         progress += HPAGE_PMD_NR;
2711                         if (ret)
2712                                 /* we released mmap_sem so break loop */
2713                                 goto breakouterloop_mmap_sem;
2714                         if (progress >= pages)
2715                                 goto breakouterloop;
2716                 }
2717         }
2718 breakouterloop:
2719         up_read(&mm->mmap_sem); /* exit_mmap will destroy ptes after this */
2720 breakouterloop_mmap_sem:
2721
2722         spin_lock(&khugepaged_mm_lock);
2723         VM_BUG_ON(khugepaged_scan.mm_slot != mm_slot);
2724         /*
2725          * Release the current mm_slot if this mm is about to die, or
2726          * if we scanned all vmas of this mm.
2727          */
2728         if (khugepaged_test_exit(mm) || !vma) {
2729                 /*
2730                  * Make sure that if mm_users is reaching zero while
2731                  * khugepaged runs here, khugepaged_exit will find
2732                  * mm_slot not pointing to the exiting mm.
2733                  */
2734                 if (mm_slot->mm_node.next != &khugepaged_scan.mm_head) {
2735                         khugepaged_scan.mm_slot = list_entry(
2736                                 mm_slot->mm_node.next,
2737                                 struct mm_slot, mm_node);
2738                         khugepaged_scan.address = 0;
2739                 } else {
2740                         khugepaged_scan.mm_slot = NULL;
2741                         khugepaged_full_scans++;
2742                 }
2743
2744                 collect_mm_slot(mm_slot);
2745         }
2746
2747         return progress;
2748 }
2749
2750 static int khugepaged_has_work(void)
2751 {
2752         return !list_empty(&khugepaged_scan.mm_head) &&
2753                 khugepaged_enabled();
2754 }
2755
2756 static int khugepaged_wait_event(void)
2757 {
2758         return !list_empty(&khugepaged_scan.mm_head) ||
2759                 kthread_should_stop();
2760 }
2761
2762 static void khugepaged_do_scan(void)
2763 {
2764         struct page *hpage = NULL;
2765         unsigned int progress = 0, pass_through_head = 0;
2766         unsigned int pages = khugepaged_pages_to_scan;
2767         bool wait = true;
2768
2769         barrier(); /* write khugepaged_pages_to_scan to local stack */
2770
2771         while (progress < pages) {
2772                 if (!khugepaged_prealloc_page(&hpage, &wait))
2773                         break;
2774
2775                 cond_resched();
2776
2777                 if (unlikely(kthread_should_stop() || try_to_freeze()))
2778                         break;
2779
2780                 spin_lock(&khugepaged_mm_lock);
2781                 if (!khugepaged_scan.mm_slot)
2782                         pass_through_head++;
2783                 if (khugepaged_has_work() &&
2784                     pass_through_head < 2)
2785                         progress += khugepaged_scan_mm_slot(pages - progress,
2786                                                             &hpage);
2787                 else
2788                         progress = pages;
2789                 spin_unlock(&khugepaged_mm_lock);
2790         }
2791
2792         if (!IS_ERR_OR_NULL(hpage))
2793                 put_page(hpage);
2794 }
2795
2796 static void khugepaged_wait_work(void)
2797 {
2798         if (khugepaged_has_work()) {
2799                 if (!khugepaged_scan_sleep_millisecs)
2800                         return;
2801
2802                 wait_event_freezable_timeout(khugepaged_wait,
2803                                              kthread_should_stop(),
2804                         msecs_to_jiffies(khugepaged_scan_sleep_millisecs));
2805                 return;
2806         }
2807
2808         if (khugepaged_enabled())
2809                 wait_event_freezable(khugepaged_wait, khugepaged_wait_event());
2810 }
2811
2812 static int khugepaged(void *none)
2813 {
2814         struct mm_slot *mm_slot;
2815
2816         set_freezable();
2817         set_user_nice(current, MAX_NICE);
2818
2819         while (!kthread_should_stop()) {
2820                 khugepaged_do_scan();
2821                 khugepaged_wait_work();
2822         }
2823
2824         spin_lock(&khugepaged_mm_lock);
2825         mm_slot = khugepaged_scan.mm_slot;
2826         khugepaged_scan.mm_slot = NULL;
2827         if (mm_slot)
2828                 collect_mm_slot(mm_slot);
2829         spin_unlock(&khugepaged_mm_lock);
2830         return 0;
2831 }
2832
2833 static void __split_huge_zero_page_pmd(struct vm_area_struct *vma,
2834                 unsigned long haddr, pmd_t *pmd)
2835 {
2836         struct mm_struct *mm = vma->vm_mm;
2837         pgtable_t pgtable;
2838         pmd_t _pmd;
2839         int i;
2840
2841         /* leave pmd empty until pte is filled */
2842         pmdp_huge_clear_flush_notify(vma, haddr, pmd);
2843
2844         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
2845         pmd_populate(mm, &_pmd, pgtable);
2846
2847         for (i = 0; i < HPAGE_PMD_NR; i++, haddr += PAGE_SIZE) {
2848                 pte_t *pte, entry;
2849                 entry = pfn_pte(my_zero_pfn(haddr), vma->vm_page_prot);
2850                 entry = pte_mkspecial(entry);
2851                 pte = pte_offset_map(&_pmd, haddr);
2852                 VM_BUG_ON(!pte_none(*pte));
2853                 set_pte_at(mm, haddr, pte, entry);
2854                 pte_unmap(pte);
2855         }
2856         smp_wmb(); /* make pte visible before pmd */
2857         pmd_populate(mm, pmd, pgtable);
2858         put_huge_zero_page();
2859 }
2860
2861 static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
2862                 unsigned long haddr, bool freeze)
2863 {
2864         struct mm_struct *mm = vma->vm_mm;
2865         struct page *page;
2866         pgtable_t pgtable;
2867         pmd_t _pmd;
2868         bool young, write, dirty;
2869         unsigned long addr;
2870         int i;
2871
2872         VM_BUG_ON(haddr & ~HPAGE_PMD_MASK);
2873         VM_BUG_ON_VMA(vma->vm_start > haddr, vma);
2874         VM_BUG_ON_VMA(vma->vm_end < haddr + HPAGE_PMD_SIZE, vma);
2875         VM_BUG_ON(!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd));
2876
2877         count_vm_event(THP_SPLIT_PMD);
2878
2879         if (vma_is_dax(vma)) {
2880                 pmd_t _pmd = pmdp_huge_clear_flush_notify(vma, haddr, pmd);
2881                 if (is_huge_zero_pmd(_pmd))
2882                         put_huge_zero_page();
2883                 return;
2884         } else if (is_huge_zero_pmd(*pmd)) {
2885                 return __split_huge_zero_page_pmd(vma, haddr, pmd);
2886         }
2887
2888         page = pmd_page(*pmd);
2889         VM_BUG_ON_PAGE(!page_count(page), page);
2890         page_ref_add(page, HPAGE_PMD_NR - 1);
2891         write = pmd_write(*pmd);
2892         young = pmd_young(*pmd);
2893         dirty = pmd_dirty(*pmd);
2894
2895         pmdp_huge_split_prepare(vma, haddr, pmd);
2896         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
2897         pmd_populate(mm, &_pmd, pgtable);
2898
2899         for (i = 0, addr = haddr; i < HPAGE_PMD_NR; i++, addr += PAGE_SIZE) {
2900                 pte_t entry, *pte;
2901                 /*
2902                  * Note that NUMA hinting access restrictions are not
2903                  * transferred to avoid any possibility of altering
2904                  * permissions across VMAs.
2905                  */
2906                 if (freeze) {
2907                         swp_entry_t swp_entry;
2908                         swp_entry = make_migration_entry(page + i, write);
2909                         entry = swp_entry_to_pte(swp_entry);
2910                 } else {
2911                         entry = mk_pte(page + i, vma->vm_page_prot);
2912                         entry = maybe_mkwrite(entry, vma);
2913                         if (!write)
2914                                 entry = pte_wrprotect(entry);
2915                         if (!young)
2916                                 entry = pte_mkold(entry);
2917                 }
2918                 if (dirty)
2919                         SetPageDirty(page + i);
2920                 pte = pte_offset_map(&_pmd, addr);
2921                 BUG_ON(!pte_none(*pte));
2922                 set_pte_at(mm, addr, pte, entry);
2923                 atomic_inc(&page[i]._mapcount);
2924                 pte_unmap(pte);
2925         }
2926
2927         /*
2928          * Set PG_double_map before dropping compound_mapcount to avoid
2929          * false-negative page_mapped().
2930          */
2931         if (compound_mapcount(page) > 1 && !TestSetPageDoubleMap(page)) {
2932                 for (i = 0; i < HPAGE_PMD_NR; i++)
2933                         atomic_inc(&page[i]._mapcount);
2934         }
2935
2936         if (atomic_add_negative(-1, compound_mapcount_ptr(page))) {
2937                 /* Last compound_mapcount is gone. */
2938                 __dec_zone_page_state(page, NR_ANON_TRANSPARENT_HUGEPAGES);
2939                 if (TestClearPageDoubleMap(page)) {
2940                         /* No need in mapcount reference anymore */
2941                         for (i = 0; i < HPAGE_PMD_NR; i++)
2942                                 atomic_dec(&page[i]._mapcount);
2943                 }
2944         }
2945
2946         smp_wmb(); /* make pte visible before pmd */
2947         /*
2948          * Up to this point the pmd is present and huge and userland has the
2949          * whole access to the hugepage during the split (which happens in
2950          * place). If we overwrite the pmd with the not-huge version pointing
2951          * to the pte here (which of course we could if all CPUs were bug
2952          * free), userland could trigger a small page size TLB miss on the
2953          * small sized TLB while the hugepage TLB entry is still established in
2954          * the huge TLB. Some CPU doesn't like that.
2955          * See http://support.amd.com/us/Processor_TechDocs/41322.pdf, Erratum
2956          * 383 on page 93. Intel should be safe but is also warns that it's
2957          * only safe if the permission and cache attributes of the two entries
2958          * loaded in the two TLB is identical (which should be the case here).
2959          * But it is generally safer to never allow small and huge TLB entries
2960          * for the same virtual address to be loaded simultaneously. So instead
2961          * of doing "pmd_populate(); flush_pmd_tlb_range();" we first mark the
2962          * current pmd notpresent (atomically because here the pmd_trans_huge
2963          * and pmd_trans_splitting must remain set at all times on the pmd
2964          * until the split is complete for this pmd), then we flush the SMP TLB
2965          * and finally we write the non-huge version of the pmd entry with
2966          * pmd_populate.
2967          */
2968         pmdp_invalidate(vma, haddr, pmd);
2969         pmd_populate(mm, pmd, pgtable);
2970
2971         if (freeze) {
2972                 for (i = 0; i < HPAGE_PMD_NR; i++) {
2973                         page_remove_rmap(page + i, false);
2974                         put_page(page + i);
2975                 }
2976         }
2977 }
2978
2979 void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
2980                 unsigned long address)
2981 {
2982         spinlock_t *ptl;
2983         struct mm_struct *mm = vma->vm_mm;
2984         struct page *page = NULL;
2985         unsigned long haddr = address & HPAGE_PMD_MASK;
2986
2987         mmu_notifier_invalidate_range_start(mm, haddr, haddr + HPAGE_PMD_SIZE);
2988         ptl = pmd_lock(mm, pmd);
2989         if (pmd_trans_huge(*pmd)) {
2990                 page = pmd_page(*pmd);
2991                 if (PageMlocked(page))
2992                         get_page(page);
2993                 else
2994                         page = NULL;
2995         } else if (!pmd_devmap(*pmd))
2996                 goto out;
2997         __split_huge_pmd_locked(vma, pmd, haddr, false);
2998 out:
2999         spin_unlock(ptl);
3000         mmu_notifier_invalidate_range_end(mm, haddr, haddr + HPAGE_PMD_SIZE);
3001         if (page) {
3002                 lock_page(page);
3003                 munlock_vma_page(page);
3004                 unlock_page(page);
3005                 put_page(page);
3006         }
3007 }
3008
3009 void split_huge_pmd_address(struct vm_area_struct *vma, unsigned long address)
3010 {
3011         pgd_t *pgd;
3012         pud_t *pud;
3013         pmd_t *pmd;
3014
3015         pgd = pgd_offset(vma->vm_mm, address);
3016         if (!pgd_present(*pgd))
3017                 return;
3018
3019         pud = pud_offset(pgd, address);
3020         if (!pud_present(*pud))
3021                 return;
3022
3023         pmd = pmd_offset(pud, address);
3024         if (!pmd_present(*pmd) || (!pmd_trans_huge(*pmd) && !pmd_devmap(*pmd)))
3025                 return;
3026         /*
3027          * Caller holds the mmap_sem write mode, so a huge pmd cannot
3028          * materialize from under us.
3029          */
3030         split_huge_pmd(vma, pmd, address);
3031 }
3032
3033 void vma_adjust_trans_huge(struct vm_area_struct *vma,
3034                              unsigned long start,
3035                              unsigned long end,
3036                              long adjust_next)
3037 {
3038         /*
3039          * If the new start address isn't hpage aligned and it could
3040          * previously contain an hugepage: check if we need to split
3041          * an huge pmd.
3042          */
3043         if (start & ~HPAGE_PMD_MASK &&
3044             (start & HPAGE_PMD_MASK) >= vma->vm_start &&
3045             (start & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
3046                 split_huge_pmd_address(vma, start);
3047
3048         /*
3049          * If the new end address isn't hpage aligned and it could
3050          * previously contain an hugepage: check if we need to split
3051          * an huge pmd.
3052          */
3053         if (end & ~HPAGE_PMD_MASK &&
3054             (end & HPAGE_PMD_MASK) >= vma->vm_start &&
3055             (end & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= vma->vm_end)
3056                 split_huge_pmd_address(vma, end);
3057
3058         /*
3059          * If we're also updating the vma->vm_next->vm_start, if the new
3060          * vm_next->vm_start isn't page aligned and it could previously
3061          * contain an hugepage: check if we need to split an huge pmd.
3062          */
3063         if (adjust_next > 0) {
3064                 struct vm_area_struct *next = vma->vm_next;
3065                 unsigned long nstart = next->vm_start;
3066                 nstart += adjust_next << PAGE_SHIFT;
3067                 if (nstart & ~HPAGE_PMD_MASK &&
3068                     (nstart & HPAGE_PMD_MASK) >= next->vm_start &&
3069                     (nstart & HPAGE_PMD_MASK) + HPAGE_PMD_SIZE <= next->vm_end)
3070                         split_huge_pmd_address(next, nstart);
3071         }
3072 }
3073
3074 static void freeze_page_vma(struct vm_area_struct *vma, struct page *page,
3075                 unsigned long address)
3076 {
3077         unsigned long haddr = address & HPAGE_PMD_MASK;
3078         spinlock_t *ptl;
3079         pgd_t *pgd;
3080         pud_t *pud;
3081         pmd_t *pmd;
3082         pte_t *pte;
3083         int i, nr = HPAGE_PMD_NR;
3084
3085         /* Skip pages which doesn't belong to the VMA */
3086         if (address < vma->vm_start) {
3087                 int off = (vma->vm_start - address) >> PAGE_SHIFT;
3088                 page += off;
3089                 nr -= off;
3090                 address = vma->vm_start;
3091         }
3092
3093         pgd = pgd_offset(vma->vm_mm, address);
3094         if (!pgd_present(*pgd))
3095                 return;
3096         pud = pud_offset(pgd, address);
3097         if (!pud_present(*pud))
3098                 return;
3099         pmd = pmd_offset(pud, address);
3100         ptl = pmd_lock(vma->vm_mm, pmd);
3101         if (!pmd_present(*pmd)) {
3102                 spin_unlock(ptl);
3103                 return;
3104         }
3105         if (pmd_trans_huge(*pmd)) {
3106                 if (page == pmd_page(*pmd))
3107                         __split_huge_pmd_locked(vma, pmd, haddr, true);
3108                 spin_unlock(ptl);
3109                 return;
3110         }
3111         spin_unlock(ptl);
3112
3113         pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
3114         for (i = 0; i < nr; i++, address += PAGE_SIZE, page++, pte++) {
3115                 pte_t entry, swp_pte;
3116                 swp_entry_t swp_entry;
3117
3118                 /*
3119                  * We've just crossed page table boundary: need to map next one.
3120                  * It can happen if THP was mremaped to non PMD-aligned address.
3121                  */
3122                 if (unlikely(address == haddr + HPAGE_PMD_SIZE)) {
3123                         pte_unmap_unlock(pte - 1, ptl);
3124                         pmd = mm_find_pmd(vma->vm_mm, address);
3125                         if (!pmd)
3126                                 return;
3127                         pte = pte_offset_map_lock(vma->vm_mm, pmd,
3128                                         address, &ptl);
3129                 }
3130
3131                 if (!pte_present(*pte))
3132                         continue;
3133                 if (page_to_pfn(page) != pte_pfn(*pte))
3134                         continue;
3135                 flush_cache_page(vma, address, page_to_pfn(page));
3136                 entry = ptep_clear_flush(vma, address, pte);
3137                 if (pte_dirty(entry))
3138                         SetPageDirty(page);
3139                 swp_entry = make_migration_entry(page, pte_write(entry));
3140                 swp_pte = swp_entry_to_pte(swp_entry);
3141                 if (pte_soft_dirty(entry))
3142                         swp_pte = pte_swp_mksoft_dirty(swp_pte);
3143                 set_pte_at(vma->vm_mm, address, pte, swp_pte);
3144                 page_remove_rmap(page, false);
3145                 put_page(page);
3146         }
3147         pte_unmap_unlock(pte - 1, ptl);
3148 }
3149
3150 static void freeze_page(struct anon_vma *anon_vma, struct page *page)
3151 {
3152         struct anon_vma_chain *avc;
3153         pgoff_t pgoff = page_to_pgoff(page);
3154
3155         VM_BUG_ON_PAGE(!PageHead(page), page);
3156
3157         anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root, pgoff,
3158                         pgoff + HPAGE_PMD_NR - 1) {
3159                 unsigned long address = __vma_address(page, avc->vma);
3160
3161                 mmu_notifier_invalidate_range_start(avc->vma->vm_mm,
3162                                 address, address + HPAGE_PMD_SIZE);
3163                 freeze_page_vma(avc->vma, page, address);
3164                 mmu_notifier_invalidate_range_end(avc->vma->vm_mm,
3165                                 address, address + HPAGE_PMD_SIZE);
3166         }
3167 }
3168
3169 static void unfreeze_page_vma(struct vm_area_struct *vma, struct page *page,
3170                 unsigned long address)
3171 {
3172         spinlock_t *ptl;
3173         pmd_t *pmd;
3174         pte_t *pte, entry;
3175         swp_entry_t swp_entry;
3176         unsigned long haddr = address & HPAGE_PMD_MASK;
3177         int i, nr = HPAGE_PMD_NR;
3178
3179         /* Skip pages which doesn't belong to the VMA */
3180         if (address < vma->vm_start) {
3181                 int off = (vma->vm_start - address) >> PAGE_SHIFT;
3182                 page += off;
3183                 nr -= off;
3184                 address = vma->vm_start;
3185         }
3186
3187         pmd = mm_find_pmd(vma->vm_mm, address);
3188         if (!pmd)
3189                 return;
3190
3191         pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
3192         for (i = 0; i < nr; i++, address += PAGE_SIZE, page++, pte++) {
3193                 /*
3194                  * We've just crossed page table boundary: need to map next one.
3195                  * It can happen if THP was mremaped to non-PMD aligned address.
3196                  */
3197                 if (unlikely(address == haddr + HPAGE_PMD_SIZE)) {
3198                         pte_unmap_unlock(pte - 1, ptl);
3199                         pmd = mm_find_pmd(vma->vm_mm, address);
3200                         if (!pmd)
3201                                 return;
3202                         pte = pte_offset_map_lock(vma->vm_mm, pmd,
3203                                         address, &ptl);
3204                 }
3205
3206                 if (!is_swap_pte(*pte))
3207                         continue;
3208
3209                 swp_entry = pte_to_swp_entry(*pte);
3210                 if (!is_migration_entry(swp_entry))
3211                         continue;
3212                 if (migration_entry_to_page(swp_entry) != page)
3213                         continue;
3214
3215                 get_page(page);
3216                 page_add_anon_rmap(page, vma, address, false);
3217
3218                 entry = pte_mkold(mk_pte(page, vma->vm_page_prot));
3219                 if (PageDirty(page))
3220                         entry = pte_mkdirty(entry);
3221                 if (is_write_migration_entry(swp_entry))
3222                         entry = maybe_mkwrite(entry, vma);
3223
3224                 flush_dcache_page(page);
3225                 set_pte_at(vma->vm_mm, address, pte, entry);
3226
3227                 /* No need to invalidate - it was non-present before */
3228                 update_mmu_cache(vma, address, pte);
3229         }
3230         pte_unmap_unlock(pte - 1, ptl);
3231 }
3232
3233 static void unfreeze_page(struct anon_vma *anon_vma, struct page *page)
3234 {
3235         struct anon_vma_chain *avc;
3236         pgoff_t pgoff = page_to_pgoff(page);
3237
3238         anon_vma_interval_tree_foreach(avc, &anon_vma->rb_root,
3239                         pgoff, pgoff + HPAGE_PMD_NR - 1) {
3240                 unsigned long address = __vma_address(page, avc->vma);
3241
3242                 mmu_notifier_invalidate_range_start(avc->vma->vm_mm,
3243                                 address, address + HPAGE_PMD_SIZE);
3244                 unfreeze_page_vma(avc->vma, page, address);
3245                 mmu_notifier_invalidate_range_end(avc->vma->vm_mm,
3246                                 address, address + HPAGE_PMD_SIZE);
3247         }
3248 }
3249
3250 static void __split_huge_page_tail(struct page *head, int tail,
3251                 struct lruvec *lruvec, struct list_head *list)
3252 {
3253         struct page *page_tail = head + tail;
3254
3255         VM_BUG_ON_PAGE(atomic_read(&page_tail->_mapcount) != -1, page_tail);
3256         VM_BUG_ON_PAGE(page_ref_count(page_tail) != 0, page_tail);
3257
3258         /*
3259          * tail_page->_count is zero and not changing from under us. But
3260          * get_page_unless_zero() may be running from under us on the
3261          * tail_page. If we used atomic_set() below instead of atomic_inc(), we
3262          * would then run atomic_set() concurrently with
3263          * get_page_unless_zero(), and atomic_set() is implemented in C not
3264          * using locked ops. spin_unlock on x86 sometime uses locked ops
3265          * because of PPro errata 66, 92, so unless somebody can guarantee
3266          * atomic_set() here would be safe on all archs (and not only on x86),
3267          * it's safer to use atomic_inc().
3268          */
3269         page_ref_inc(page_tail);
3270
3271         page_tail->flags &= ~PAGE_FLAGS_CHECK_AT_PREP;
3272         page_tail->flags |= (head->flags &
3273                         ((1L << PG_referenced) |
3274                          (1L << PG_swapbacked) |
3275                          (1L << PG_mlocked) |
3276                          (1L << PG_uptodate) |
3277                          (1L << PG_active) |
3278                          (1L << PG_locked) |
3279                          (1L << PG_unevictable) |
3280                          (1L << PG_dirty)));
3281
3282         /*
3283          * After clearing PageTail the gup refcount can be released.
3284          * Page flags also must be visible before we make the page non-compound.
3285          */
3286         smp_wmb();
3287
3288         clear_compound_head(page_tail);
3289
3290         if (page_is_young(head))
3291                 set_page_young(page_tail);
3292         if (page_is_idle(head))
3293                 set_page_idle(page_tail);
3294
3295         /* ->mapping in first tail page is compound_mapcount */
3296         VM_BUG_ON_PAGE(tail > 2 && page_tail->mapping != TAIL_MAPPING,
3297                         page_tail);
3298         page_tail->mapping = head->mapping;
3299
3300         page_tail->index = head->index + tail;
3301         page_cpupid_xchg_last(page_tail, page_cpupid_last(head));
3302         lru_add_page_tail(head, page_tail, lruvec, list);
3303 }
3304
3305 static void __split_huge_page(struct page *page, struct list_head *list)
3306 {
3307         struct page *head = compound_head(page);
3308         struct zone *zone = page_zone(head);
3309         struct lruvec *lruvec;
3310         int i;
3311
3312         /* prevent PageLRU to go away from under us, and freeze lru stats */
3313         spin_lock_irq(&zone->lru_lock);
3314         lruvec = mem_cgroup_page_lruvec(head, zone);
3315
3316         /* complete memcg works before add pages to LRU */
3317         mem_cgroup_split_huge_fixup(head);
3318
3319         for (i = HPAGE_PMD_NR - 1; i >= 1; i--)
3320                 __split_huge_page_tail(head, i, lruvec, list);
3321
3322         ClearPageCompound(head);
3323         spin_unlock_irq(&zone->lru_lock);
3324
3325         unfreeze_page(page_anon_vma(head), head);
3326
3327         for (i = 0; i < HPAGE_PMD_NR; i++) {
3328                 struct page *subpage = head + i;
3329                 if (subpage == page)
3330                         continue;
3331                 unlock_page(subpage);
3332
3333                 /*
3334                  * Subpages may be freed if there wasn't any mapping
3335                  * like if add_to_swap() is running on a lru page that
3336                  * had its mapping zapped. And freeing these pages
3337                  * requires taking the lru_lock so we do the put_page
3338                  * of the tail pages after the split is complete.
3339                  */
3340                 put_page(subpage);
3341         }
3342 }
3343
3344 int total_mapcount(struct page *page)
3345 {
3346         int i, ret;
3347
3348         VM_BUG_ON_PAGE(PageTail(page), page);
3349
3350         if (likely(!PageCompound(page)))
3351                 return atomic_read(&page->_mapcount) + 1;
3352
3353         ret = compound_mapcount(page);
3354         if (PageHuge(page))
3355                 return ret;
3356         for (i = 0; i < HPAGE_PMD_NR; i++)
3357                 ret += atomic_read(&page[i]._mapcount) + 1;
3358         if (PageDoubleMap(page))
3359                 ret -= HPAGE_PMD_NR;
3360         return ret;
3361 }
3362
3363 /*
3364  * This function splits huge page into normal pages. @page can point to any
3365  * subpage of huge page to split. Split doesn't change the position of @page.
3366  *
3367  * Only caller must hold pin on the @page, otherwise split fails with -EBUSY.
3368  * The huge page must be locked.
3369  *
3370  * If @list is null, tail pages will be added to LRU list, otherwise, to @list.
3371  *
3372  * Both head page and tail pages will inherit mapping, flags, and so on from
3373  * the hugepage.
3374  *
3375  * GUP pin and PG_locked transferred to @page. Rest subpages can be freed if
3376  * they are not mapped.
3377  *
3378  * Returns 0 if the hugepage is split successfully.
3379  * Returns -EBUSY if the page is pinned or if anon_vma disappeared from under
3380  * us.
3381  */
3382 int split_huge_page_to_list(struct page *page, struct list_head *list)
3383 {
3384         struct page *head = compound_head(page);
3385         struct pglist_data *pgdata = NODE_DATA(page_to_nid(head));
3386         struct anon_vma *anon_vma;
3387         int count, mapcount, ret;
3388         bool mlocked;
3389         unsigned long flags;
3390
3391         VM_BUG_ON_PAGE(is_huge_zero_page(page), page);
3392         VM_BUG_ON_PAGE(!PageAnon(page), page);
3393         VM_BUG_ON_PAGE(!PageLocked(page), page);
3394         VM_BUG_ON_PAGE(!PageSwapBacked(page), page);
3395         VM_BUG_ON_PAGE(!PageCompound(page), page);
3396
3397         /*
3398          * The caller does not necessarily hold an mmap_sem that would prevent
3399          * the anon_vma disappearing so we first we take a reference to it
3400          * and then lock the anon_vma for write. This is similar to
3401          * page_lock_anon_vma_read except the write lock is taken to serialise
3402          * against parallel split or collapse operations.
3403          */
3404         anon_vma = page_get_anon_vma(head);
3405         if (!anon_vma) {
3406                 ret = -EBUSY;
3407                 goto out;
3408         }
3409         anon_vma_lock_write(anon_vma);
3410
3411         /*
3412          * Racy check if we can split the page, before freeze_page() will
3413          * split PMDs
3414          */
3415         if (total_mapcount(head) != page_count(head) - 1) {
3416                 ret = -EBUSY;
3417                 goto out_unlock;
3418         }
3419
3420         mlocked = PageMlocked(page);
3421         freeze_page(anon_vma, head);
3422         VM_BUG_ON_PAGE(compound_mapcount(head), head);
3423
3424         /* Make sure the page is not on per-CPU pagevec as it takes pin */
3425         if (mlocked)
3426                 lru_add_drain();
3427
3428         /* Prevent deferred_split_scan() touching ->_count */
3429         spin_lock_irqsave(&pgdata->split_queue_lock, flags);
3430         count = page_count(head);
3431         mapcount = total_mapcount(head);
3432         if (!mapcount && count == 1) {
3433                 if (!list_empty(page_deferred_list(head))) {
3434                         pgdata->split_queue_len--;
3435                         list_del(page_deferred_list(head));
3436                 }
3437                 spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3438                 __split_huge_page(page, list);
3439                 ret = 0;
3440         } else if (IS_ENABLED(CONFIG_DEBUG_VM) && mapcount) {
3441                 spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3442                 pr_alert("total_mapcount: %u, page_count(): %u\n",
3443                                 mapcount, count);
3444                 if (PageTail(page))
3445                         dump_page(head, NULL);
3446                 dump_page(page, "total_mapcount(head) > 0");
3447                 BUG();
3448         } else {
3449                 spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3450                 unfreeze_page(anon_vma, head);
3451                 ret = -EBUSY;
3452         }
3453
3454 out_unlock:
3455         anon_vma_unlock_write(anon_vma);
3456         put_anon_vma(anon_vma);
3457 out:
3458         count_vm_event(!ret ? THP_SPLIT_PAGE : THP_SPLIT_PAGE_FAILED);
3459         return ret;
3460 }
3461
3462 void free_transhuge_page(struct page *page)
3463 {
3464         struct pglist_data *pgdata = NODE_DATA(page_to_nid(page));
3465         unsigned long flags;
3466
3467         spin_lock_irqsave(&pgdata->split_queue_lock, flags);
3468         if (!list_empty(page_deferred_list(page))) {
3469                 pgdata->split_queue_len--;
3470                 list_del(page_deferred_list(page));
3471         }
3472         spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3473         free_compound_page(page);
3474 }
3475
3476 void deferred_split_huge_page(struct page *page)
3477 {
3478         struct pglist_data *pgdata = NODE_DATA(page_to_nid(page));
3479         unsigned long flags;
3480
3481         VM_BUG_ON_PAGE(!PageTransHuge(page), page);
3482
3483         spin_lock_irqsave(&pgdata->split_queue_lock, flags);
3484         if (list_empty(page_deferred_list(page))) {
3485                 count_vm_event(THP_DEFERRED_SPLIT_PAGE);
3486                 list_add_tail(page_deferred_list(page), &pgdata->split_queue);
3487                 pgdata->split_queue_len++;
3488         }
3489         spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3490 }
3491
3492 static unsigned long deferred_split_count(struct shrinker *shrink,
3493                 struct shrink_control *sc)
3494 {
3495         struct pglist_data *pgdata = NODE_DATA(sc->nid);
3496         return ACCESS_ONCE(pgdata->split_queue_len);
3497 }
3498
3499 static unsigned long deferred_split_scan(struct shrinker *shrink,
3500                 struct shrink_control *sc)
3501 {
3502         struct pglist_data *pgdata = NODE_DATA(sc->nid);
3503         unsigned long flags;
3504         LIST_HEAD(list), *pos, *next;
3505         struct page *page;
3506         int split = 0;
3507
3508         spin_lock_irqsave(&pgdata->split_queue_lock, flags);
3509         /* Take pin on all head pages to avoid freeing them under us */
3510         list_for_each_safe(pos, next, &pgdata->split_queue) {
3511                 page = list_entry((void *)pos, struct page, mapping);
3512                 page = compound_head(page);
3513                 if (get_page_unless_zero(page)) {
3514                         list_move(page_deferred_list(page), &list);
3515                 } else {
3516                         /* We lost race with put_compound_page() */
3517                         list_del_init(page_deferred_list(page));
3518                         pgdata->split_queue_len--;
3519                 }
3520                 if (!--sc->nr_to_scan)
3521                         break;
3522         }
3523         spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3524
3525         list_for_each_safe(pos, next, &list) {
3526                 page = list_entry((void *)pos, struct page, mapping);
3527                 lock_page(page);
3528                 /* split_huge_page() removes page from list on success */
3529                 if (!split_huge_page(page))
3530                         split++;
3531                 unlock_page(page);
3532                 put_page(page);
3533         }
3534
3535         spin_lock_irqsave(&pgdata->split_queue_lock, flags);
3536         list_splice_tail(&list, &pgdata->split_queue);
3537         spin_unlock_irqrestore(&pgdata->split_queue_lock, flags);
3538
3539         /*
3540          * Stop shrinker if we didn't split any page, but the queue is empty.
3541          * This can happen if pages were freed under us.
3542          */
3543         if (!split && list_empty(&pgdata->split_queue))
3544                 return SHRINK_STOP;
3545         return split;
3546 }
3547
3548 static struct shrinker deferred_split_shrinker = {
3549         .count_objects = deferred_split_count,
3550         .scan_objects = deferred_split_scan,
3551         .seeks = DEFAULT_SEEKS,
3552         .flags = SHRINKER_NUMA_AWARE,
3553 };
3554
3555 #ifdef CONFIG_DEBUG_FS
3556 static int split_huge_pages_set(void *data, u64 val)
3557 {
3558         struct zone *zone;
3559         struct page *page;
3560         unsigned long pfn, max_zone_pfn;
3561         unsigned long total = 0, split = 0;
3562
3563         if (val != 1)
3564                 return -EINVAL;
3565
3566         for_each_populated_zone(zone) {
3567                 max_zone_pfn = zone_end_pfn(zone);
3568                 for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) {
3569                         if (!pfn_valid(pfn))
3570                                 continue;
3571
3572                         page = pfn_to_page(pfn);
3573                         if (!get_page_unless_zero(page))
3574                                 continue;
3575
3576                         if (zone != page_zone(page))
3577                                 goto next;
3578
3579                         if (!PageHead(page) || !PageAnon(page) ||
3580                                         PageHuge(page))
3581                                 goto next;
3582
3583                         total++;
3584                         lock_page(page);
3585                         if (!split_huge_page(page))
3586                                 split++;
3587                         unlock_page(page);
3588 next:
3589                         put_page(page);
3590                 }
3591         }
3592
3593         pr_info("%lu of %lu THP split", split, total);
3594
3595         return 0;
3596 }
3597 DEFINE_SIMPLE_ATTRIBUTE(split_huge_pages_fops, NULL, split_huge_pages_set,
3598                 "%llu\n");
3599
3600 static int __init split_huge_pages_debugfs(void)
3601 {
3602         void *ret;
3603
3604         ret = debugfs_create_file("split_huge_pages", 0644, NULL, NULL,
3605                         &split_huge_pages_fops);
3606         if (!ret)
3607                 pr_warn("Failed to create split_huge_pages in debugfs");
3608         return 0;
3609 }
3610 late_initcall(split_huge_pages_debugfs);
3611 #endif