4 * (C) Copyright 1995 Linus Torvalds
5 * (C) Copyright 2002 Christoph Hellwig
8 #include <linux/capability.h>
9 #include <linux/mman.h>
11 #include <linux/swap.h>
12 #include <linux/swapops.h>
13 #include <linux/pagemap.h>
14 #include <linux/pagevec.h>
15 #include <linux/mempolicy.h>
16 #include <linux/syscalls.h>
17 #include <linux/sched.h>
18 #include <linux/export.h>
19 #include <linux/rmap.h>
20 #include <linux/mmzone.h>
21 #include <linux/hugetlb.h>
22 #include <linux/memcontrol.h>
23 #include <linux/mm_inline.h>
27 int can_do_mlock(void)
29 if (capable(CAP_IPC_LOCK
))
31 if (rlimit(RLIMIT_MEMLOCK
) != 0)
35 EXPORT_SYMBOL(can_do_mlock
);
38 * Mlocked pages are marked with PageMlocked() flag for efficient testing
39 * in vmscan and, possibly, the fault path; and to support semi-accurate
42 * An mlocked page [PageMlocked(page)] is unevictable. As such, it will
43 * be placed on the LRU "unevictable" list, rather than the [in]active lists.
44 * The unevictable list is an LRU sibling list to the [in]active lists.
45 * PageUnevictable is set to indicate the unevictable state.
47 * When lazy mlocking via vmscan, it is important to ensure that the
48 * vma's VM_LOCKED status is not concurrently being modified, otherwise we
49 * may have mlocked a page that is being munlocked. So lazy mlock must take
50 * the mmap_sem for read, and verify that the vma really is locked
55 * LRU accounting for clear_page_mlock()
57 void clear_page_mlock(struct page
*page
)
59 if (!TestClearPageMlocked(page
))
62 mod_zone_page_state(page_zone(page
), NR_MLOCK
,
63 -hpage_nr_pages(page
));
64 count_vm_event(UNEVICTABLE_PGCLEARED
);
65 if (!isolate_lru_page(page
)) {
66 putback_lru_page(page
);
69 * We lost the race. the page already moved to evictable list.
71 if (PageUnevictable(page
))
72 count_vm_event(UNEVICTABLE_PGSTRANDED
);
77 * Mark page as mlocked if not already.
78 * If page on LRU, isolate and putback to move to unevictable list.
80 void mlock_vma_page(struct page
*page
)
82 BUG_ON(!PageLocked(page
));
84 if (!TestSetPageMlocked(page
)) {
85 mod_zone_page_state(page_zone(page
), NR_MLOCK
,
86 hpage_nr_pages(page
));
87 count_vm_event(UNEVICTABLE_PGMLOCKED
);
88 if (!isolate_lru_page(page
))
89 putback_lru_page(page
);
94 * Finish munlock after successful page isolation
96 * Page must be locked. This is a wrapper for try_to_munlock()
97 * and putback_lru_page() with munlock accounting.
99 static void __munlock_isolated_page(struct page
*page
)
101 int ret
= SWAP_AGAIN
;
104 * Optimization: if the page was mapped just once, that's our mapping
105 * and we don't need to check all the other vmas.
107 if (page_mapcount(page
) > 1)
108 ret
= try_to_munlock(page
);
110 /* Did try_to_unlock() succeed or punt? */
111 if (ret
!= SWAP_MLOCK
)
112 count_vm_event(UNEVICTABLE_PGMUNLOCKED
);
114 putback_lru_page(page
);
118 * Accounting for page isolation fail during munlock
120 * Performs accounting when page isolation fails in munlock. There is nothing
121 * else to do because it means some other task has already removed the page
122 * from the LRU. putback_lru_page() will take care of removing the page from
123 * the unevictable list, if necessary. vmscan [page_referenced()] will move
124 * the page back to the unevictable list if some other vma has it mlocked.
126 static void __munlock_isolation_failed(struct page
*page
)
128 if (PageUnevictable(page
))
129 count_vm_event(UNEVICTABLE_PGSTRANDED
);
131 count_vm_event(UNEVICTABLE_PGMUNLOCKED
);
135 * munlock_vma_page - munlock a vma page
136 * @page - page to be unlocked
138 * called from munlock()/munmap() path with page supposedly on the LRU.
139 * When we munlock a page, because the vma where we found the page is being
140 * munlock()ed or munmap()ed, we want to check whether other vmas hold the
141 * page locked so that we can leave it on the unevictable lru list and not
142 * bother vmscan with it. However, to walk the page's rmap list in
143 * try_to_munlock() we must isolate the page from the LRU. If some other
144 * task has removed the page from the LRU, we won't be able to do that.
145 * So we clear the PageMlocked as we might not get another chance. If we
146 * can't isolate the page, we leave it for putback_lru_page() and vmscan
147 * [page_referenced()/try_to_unmap()] to deal with.
149 unsigned int munlock_vma_page(struct page
*page
)
151 unsigned int page_mask
= 0;
153 BUG_ON(!PageLocked(page
));
155 if (TestClearPageMlocked(page
)) {
156 unsigned int nr_pages
= hpage_nr_pages(page
);
157 mod_zone_page_state(page_zone(page
), NR_MLOCK
, -nr_pages
);
158 page_mask
= nr_pages
- 1;
159 if (!isolate_lru_page(page
))
160 __munlock_isolated_page(page
);
162 __munlock_isolation_failed(page
);
169 * __mlock_vma_pages_range() - mlock a range of pages in the vma.
171 * @start: start address
174 * This takes care of making the pages present too.
176 * return 0 on success, negative error code on error.
178 * vma->vm_mm->mmap_sem must be held for at least read.
180 long __mlock_vma_pages_range(struct vm_area_struct
*vma
,
181 unsigned long start
, unsigned long end
, int *nonblocking
)
183 struct mm_struct
*mm
= vma
->vm_mm
;
184 unsigned long nr_pages
= (end
- start
) / PAGE_SIZE
;
187 VM_BUG_ON(start
& ~PAGE_MASK
);
188 VM_BUG_ON(end
& ~PAGE_MASK
);
189 VM_BUG_ON(start
< vma
->vm_start
);
190 VM_BUG_ON(end
> vma
->vm_end
);
191 VM_BUG_ON(!rwsem_is_locked(&mm
->mmap_sem
));
193 gup_flags
= FOLL_TOUCH
| FOLL_MLOCK
;
195 * We want to touch writable mappings with a write fault in order
196 * to break COW, except for shared mappings because these don't COW
197 * and we would not want to dirty them for nothing.
199 if ((vma
->vm_flags
& (VM_WRITE
| VM_SHARED
)) == VM_WRITE
)
200 gup_flags
|= FOLL_WRITE
;
203 * We want mlock to succeed for regions that have any permissions
204 * other than PROT_NONE.
206 if (vma
->vm_flags
& (VM_READ
| VM_WRITE
| VM_EXEC
))
207 gup_flags
|= FOLL_FORCE
;
210 * We made sure addr is within a VMA, so the following will
211 * not result in a stack expansion that recurses back here.
213 return __get_user_pages(current
, mm
, start
, nr_pages
, gup_flags
,
214 NULL
, NULL
, nonblocking
);
218 * convert get_user_pages() return value to posix mlock() error
220 static int __mlock_posix_error_return(long retval
)
222 if (retval
== -EFAULT
)
224 else if (retval
== -ENOMEM
)
230 * Prepare page for fast batched LRU putback via putback_lru_evictable_pagevec()
232 * The fast path is available only for evictable pages with single mapping.
233 * Then we can bypass the per-cpu pvec and get better performance.
234 * when mapcount > 1 we need try_to_munlock() which can fail.
235 * when !page_evictable(), we need the full redo logic of putback_lru_page to
236 * avoid leaving evictable page in unevictable list.
238 * In case of success, @page is added to @pvec and @pgrescued is incremented
239 * in case that the page was previously unevictable. @page is also unlocked.
241 static bool __putback_lru_fast_prepare(struct page
*page
, struct pagevec
*pvec
,
244 VM_BUG_ON(PageLRU(page
));
245 VM_BUG_ON(!PageLocked(page
));
247 if (page_mapcount(page
) <= 1 && page_evictable(page
)) {
248 pagevec_add(pvec
, page
);
249 if (TestClearPageUnevictable(page
))
259 * Putback multiple evictable pages to the LRU
261 * Batched putback of evictable pages that bypasses the per-cpu pvec. Some of
262 * the pages might have meanwhile become unevictable but that is OK.
264 static void __putback_lru_fast(struct pagevec
*pvec
, int pgrescued
)
266 count_vm_events(UNEVICTABLE_PGMUNLOCKED
, pagevec_count(pvec
));
268 *__pagevec_lru_add() calls release_pages() so we don't call
269 * put_page() explicitly
271 __pagevec_lru_add(pvec
);
272 count_vm_events(UNEVICTABLE_PGRESCUED
, pgrescued
);
276 * Munlock a batch of pages from the same zone
278 * The work is split to two main phases. First phase clears the Mlocked flag
279 * and attempts to isolate the pages, all under a single zone lru lock.
280 * The second phase finishes the munlock only for pages where isolation
283 * Note that the pagevec may be modified during the process.
285 static void __munlock_pagevec(struct pagevec
*pvec
, struct zone
*zone
)
288 int nr
= pagevec_count(pvec
);
289 int delta_munlocked
= -nr
;
290 struct pagevec pvec_putback
;
293 /* Phase 1: page isolation */
294 spin_lock_irq(&zone
->lru_lock
);
295 for (i
= 0; i
< nr
; i
++) {
296 struct page
*page
= pvec
->pages
[i
];
298 if (TestClearPageMlocked(page
)) {
299 struct lruvec
*lruvec
;
303 lruvec
= mem_cgroup_page_lruvec(page
, zone
);
304 lru
= page_lru(page
);
306 * We already have pin from follow_page_mask()
307 * so we can spare the get_page() here.
310 del_page_from_lru_list(page
, lruvec
, lru
);
312 __munlock_isolation_failed(page
);
319 * We won't be munlocking this page in the next phase
320 * but we still need to release the follow_page_mask()
323 pvec
->pages
[i
] = NULL
;
328 __mod_zone_page_state(zone
, NR_MLOCK
, delta_munlocked
);
329 spin_unlock_irq(&zone
->lru_lock
);
331 /* Phase 2: page munlock */
332 pagevec_init(&pvec_putback
, 0);
333 for (i
= 0; i
< nr
; i
++) {
334 struct page
*page
= pvec
->pages
[i
];
338 if (!__putback_lru_fast_prepare(page
, &pvec_putback
,
341 * Slow path. We don't want to lose the last
342 * pin before unlock_page()
344 get_page(page
); /* for putback_lru_page() */
345 __munlock_isolated_page(page
);
347 put_page(page
); /* from follow_page_mask() */
353 * Phase 3: page putback for pages that qualified for the fast path
354 * This will also call put_page() to return pin from follow_page_mask()
356 if (pagevec_count(&pvec_putback
))
357 __putback_lru_fast(&pvec_putback
, pgrescued
);
361 * Fill up pagevec for __munlock_pagevec using pte walk
363 * The function expects that the struct page corresponding to @start address is
364 * a non-TPH page already pinned and in the @pvec, and that it belongs to @zone.
366 * The rest of @pvec is filled by subsequent pages within the same pmd and same
367 * zone, as long as the pte's are present and vm_normal_page() succeeds. These
368 * pages also get pinned.
370 * Returns the address of the next page that should be scanned. This equals
371 * @start + PAGE_SIZE when no page could be added by the pte walk.
373 static unsigned long __munlock_pagevec_fill(struct pagevec
*pvec
,
374 struct vm_area_struct
*vma
, int zoneid
, unsigned long start
,
381 * Initialize pte walk starting at the already pinned page where we
382 * are sure that there is a pte, as it was pinned under the same
385 pte
= get_locked_pte(vma
->vm_mm
, start
, &ptl
);
386 /* Make sure we do not cross the page table boundary */
387 end
= pgd_addr_end(start
, end
);
388 end
= pud_addr_end(start
, end
);
389 end
= pmd_addr_end(start
, end
);
391 /* The page next to the pinned page is the first we will try to get */
393 while (start
< end
) {
394 struct page
*page
= NULL
;
396 if (pte_present(*pte
))
397 page
= vm_normal_page(vma
, start
, *pte
);
399 * Break if page could not be obtained or the page's node+zone does not
402 if (!page
|| page_zone_id(page
) != zoneid
)
407 * Increase the address that will be returned *before* the
408 * eventual break due to pvec becoming full by adding the page
411 if (pagevec_add(pvec
, page
) == 0)
414 pte_unmap_unlock(pte
, ptl
);
419 * munlock_vma_pages_range() - munlock all pages in the vma range.'
420 * @vma - vma containing range to be munlock()ed.
421 * @start - start address in @vma of the range
422 * @end - end of range in @vma.
424 * For mremap(), munmap() and exit().
426 * Called with @vma VM_LOCKED.
428 * Returns with VM_LOCKED cleared. Callers must be prepared to
431 * We don't save and restore VM_LOCKED here because pages are
432 * still on lru. In unmap path, pages might be scanned by reclaim
433 * and re-mlocked by try_to_{munlock|unmap} before we unmap and
434 * free them. This will result in freeing mlocked pages.
436 void munlock_vma_pages_range(struct vm_area_struct
*vma
,
437 unsigned long start
, unsigned long end
)
439 vma
->vm_flags
&= ~VM_LOCKED
;
441 while (start
< end
) {
442 struct page
*page
= NULL
;
443 unsigned int page_mask
, page_increm
;
448 pagevec_init(&pvec
, 0);
450 * Although FOLL_DUMP is intended for get_dump_page(),
451 * it just so happens that its special treatment of the
452 * ZERO_PAGE (returning an error instead of doing get_page)
453 * suits munlock very well (and if somehow an abnormal page
454 * has sneaked into the range, we won't oops here: great).
456 page
= follow_page_mask(vma
, start
, FOLL_GET
| FOLL_DUMP
,
459 if (page
&& !IS_ERR(page
)) {
460 if (PageTransHuge(page
)) {
463 * Any THP page found by follow_page_mask() may
464 * have gotten split before reaching
465 * munlock_vma_page(), so we need to recompute
466 * the page_mask here.
468 page_mask
= munlock_vma_page(page
);
470 put_page(page
); /* follow_page_mask() */
473 * Non-huge pages are handled in batches via
474 * pagevec. The pin from follow_page_mask()
475 * prevents them from collapsing by THP.
477 pagevec_add(&pvec
, page
);
478 zone
= page_zone(page
);
479 zoneid
= page_zone_id(page
);
482 * Try to fill the rest of pagevec using fast
483 * pte walk. This will also update start to
484 * the next page to process. Then munlock the
487 start
= __munlock_pagevec_fill(&pvec
, vma
,
489 __munlock_pagevec(&pvec
, zone
);
493 page_increm
= 1 + (~(start
>> PAGE_SHIFT
) & page_mask
);
494 start
+= page_increm
* PAGE_SIZE
;
501 * mlock_fixup - handle mlock[all]/munlock[all] requests.
503 * Filters out "special" vmas -- VM_LOCKED never gets set for these, and
504 * munlock is a no-op. However, for some special vmas, we go ahead and
507 * For vmas that pass the filters, merge/split as appropriate.
509 static int mlock_fixup(struct vm_area_struct
*vma
, struct vm_area_struct
**prev
,
510 unsigned long start
, unsigned long end
, vm_flags_t newflags
)
512 struct mm_struct
*mm
= vma
->vm_mm
;
516 int lock
= !!(newflags
& VM_LOCKED
);
518 if (newflags
== vma
->vm_flags
|| (vma
->vm_flags
& VM_SPECIAL
) ||
519 is_vm_hugetlb_page(vma
) || vma
== get_gate_vma(current
->mm
))
520 goto out
; /* don't set VM_LOCKED, don't count */
522 pgoff
= vma
->vm_pgoff
+ ((start
- vma
->vm_start
) >> PAGE_SHIFT
);
523 *prev
= vma_merge(mm
, *prev
, start
, end
, newflags
, vma
->anon_vma
,
524 vma
->vm_file
, pgoff
, vma_policy(vma
));
530 if (start
!= vma
->vm_start
) {
531 ret
= split_vma(mm
, vma
, start
, 1);
536 if (end
!= vma
->vm_end
) {
537 ret
= split_vma(mm
, vma
, end
, 0);
544 * Keep track of amount of locked VM.
546 nr_pages
= (end
- start
) >> PAGE_SHIFT
;
548 nr_pages
= -nr_pages
;
549 mm
->locked_vm
+= nr_pages
;
552 * vm_flags is protected by the mmap_sem held in write mode.
553 * It's okay if try_to_unmap_one unmaps a page just after we
554 * set VM_LOCKED, __mlock_vma_pages_range will bring it back.
558 vma
->vm_flags
= newflags
;
560 munlock_vma_pages_range(vma
, start
, end
);
567 static int do_mlock(unsigned long start
, size_t len
, int on
)
569 unsigned long nstart
, end
, tmp
;
570 struct vm_area_struct
* vma
, * prev
;
573 VM_BUG_ON(start
& ~PAGE_MASK
);
574 VM_BUG_ON(len
!= PAGE_ALIGN(len
));
580 vma
= find_vma(current
->mm
, start
);
581 if (!vma
|| vma
->vm_start
> start
)
585 if (start
> vma
->vm_start
)
588 for (nstart
= start
; ; ) {
591 /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
593 newflags
= vma
->vm_flags
& ~VM_LOCKED
;
595 newflags
|= VM_LOCKED
;
600 error
= mlock_fixup(vma
, &prev
, nstart
, tmp
, newflags
);
604 if (nstart
< prev
->vm_end
)
605 nstart
= prev
->vm_end
;
610 if (!vma
|| vma
->vm_start
!= nstart
) {
619 * __mm_populate - populate and/or mlock pages within a range of address space.
621 * This is used to implement mlock() and the MAP_POPULATE / MAP_LOCKED mmap
622 * flags. VMAs must be already marked with the desired vm_flags, and
623 * mmap_sem must not be held.
625 int __mm_populate(unsigned long start
, unsigned long len
, int ignore_errors
)
627 struct mm_struct
*mm
= current
->mm
;
628 unsigned long end
, nstart
, nend
;
629 struct vm_area_struct
*vma
= NULL
;
633 VM_BUG_ON(start
& ~PAGE_MASK
);
634 VM_BUG_ON(len
!= PAGE_ALIGN(len
));
637 for (nstart
= start
; nstart
< end
; nstart
= nend
) {
639 * We want to fault in pages for [nstart; end) address range.
640 * Find first corresponding VMA.
644 down_read(&mm
->mmap_sem
);
645 vma
= find_vma(mm
, nstart
);
646 } else if (nstart
>= vma
->vm_end
)
648 if (!vma
|| vma
->vm_start
>= end
)
651 * Set [nstart; nend) to intersection of desired address
652 * range with the first VMA. Also, skip undesirable VMA types.
654 nend
= min(end
, vma
->vm_end
);
655 if (vma
->vm_flags
& (VM_IO
| VM_PFNMAP
))
657 if (nstart
< vma
->vm_start
)
658 nstart
= vma
->vm_start
;
660 * Now fault in a range of pages. __mlock_vma_pages_range()
661 * double checks the vma flags, so that it won't mlock pages
662 * if the vma was already munlocked.
664 ret
= __mlock_vma_pages_range(vma
, nstart
, nend
, &locked
);
668 continue; /* continue at next VMA */
670 ret
= __mlock_posix_error_return(ret
);
673 nend
= nstart
+ ret
* PAGE_SIZE
;
677 up_read(&mm
->mmap_sem
);
678 return ret
; /* 0 or negative error code */
681 SYSCALL_DEFINE2(mlock
, unsigned long, start
, size_t, len
)
683 unsigned long locked
;
684 unsigned long lock_limit
;
690 lru_add_drain_all(); /* flush pagevec */
692 down_write(¤t
->mm
->mmap_sem
);
693 len
= PAGE_ALIGN(len
+ (start
& ~PAGE_MASK
));
696 locked
= len
>> PAGE_SHIFT
;
697 locked
+= current
->mm
->locked_vm
;
699 lock_limit
= rlimit(RLIMIT_MEMLOCK
);
700 lock_limit
>>= PAGE_SHIFT
;
702 /* check against resource limits */
703 if ((locked
<= lock_limit
) || capable(CAP_IPC_LOCK
))
704 error
= do_mlock(start
, len
, 1);
705 up_write(¤t
->mm
->mmap_sem
);
707 error
= __mm_populate(start
, len
, 0);
711 SYSCALL_DEFINE2(munlock
, unsigned long, start
, size_t, len
)
715 down_write(¤t
->mm
->mmap_sem
);
716 len
= PAGE_ALIGN(len
+ (start
& ~PAGE_MASK
));
718 ret
= do_mlock(start
, len
, 0);
719 up_write(¤t
->mm
->mmap_sem
);
723 static int do_mlockall(int flags
)
725 struct vm_area_struct
* vma
, * prev
= NULL
;
727 if (flags
& MCL_FUTURE
)
728 current
->mm
->def_flags
|= VM_LOCKED
;
730 current
->mm
->def_flags
&= ~VM_LOCKED
;
731 if (flags
== MCL_FUTURE
)
734 for (vma
= current
->mm
->mmap
; vma
; vma
= prev
->vm_next
) {
737 newflags
= vma
->vm_flags
& ~VM_LOCKED
;
738 if (flags
& MCL_CURRENT
)
739 newflags
|= VM_LOCKED
;
742 mlock_fixup(vma
, &prev
, vma
->vm_start
, vma
->vm_end
, newflags
);
749 SYSCALL_DEFINE1(mlockall
, int, flags
)
751 unsigned long lock_limit
;
754 if (!flags
|| (flags
& ~(MCL_CURRENT
| MCL_FUTURE
)))
761 if (flags
& MCL_CURRENT
)
762 lru_add_drain_all(); /* flush pagevec */
764 down_write(¤t
->mm
->mmap_sem
);
766 lock_limit
= rlimit(RLIMIT_MEMLOCK
);
767 lock_limit
>>= PAGE_SHIFT
;
770 if (!(flags
& MCL_CURRENT
) || (current
->mm
->total_vm
<= lock_limit
) ||
771 capable(CAP_IPC_LOCK
))
772 ret
= do_mlockall(flags
);
773 up_write(¤t
->mm
->mmap_sem
);
774 if (!ret
&& (flags
& MCL_CURRENT
))
775 mm_populate(0, TASK_SIZE
);
780 SYSCALL_DEFINE0(munlockall
)
784 down_write(¤t
->mm
->mmap_sem
);
785 ret
= do_mlockall(0);
786 up_write(¤t
->mm
->mmap_sem
);
791 * Objects with different lifetime than processes (SHM_LOCK and SHM_HUGETLB
792 * shm segments) get accounted against the user_struct instead.
794 static DEFINE_SPINLOCK(shmlock_user_lock
);
796 int user_shm_lock(size_t size
, struct user_struct
*user
)
798 unsigned long lock_limit
, locked
;
801 locked
= (size
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
802 lock_limit
= rlimit(RLIMIT_MEMLOCK
);
803 if (lock_limit
== RLIM_INFINITY
)
805 lock_limit
>>= PAGE_SHIFT
;
806 spin_lock(&shmlock_user_lock
);
808 locked
+ user
->locked_shm
> lock_limit
&& !capable(CAP_IPC_LOCK
))
811 user
->locked_shm
+= locked
;
814 spin_unlock(&shmlock_user_lock
);
818 void user_shm_unlock(size_t size
, struct user_struct
*user
)
820 spin_lock(&shmlock_user_lock
);
821 user
->locked_shm
-= (size
+ PAGE_SIZE
- 1) >> PAGE_SHIFT
;
822 spin_unlock(&shmlock_user_lock
);