]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * mm/mremap.c | |
3 | * | |
4 | * (C) Copyright 1996 Linus Torvalds | |
5 | * | |
6 | * Address space accounting code <alan@lxorguk.ukuu.org.uk> | |
7 | * (C) Copyright 2002 Red Hat Inc, All Rights Reserved | |
8 | */ | |
9 | ||
10 | #include <linux/mm.h> | |
11 | #include <linux/hugetlb.h> | |
12 | #include <linux/shm.h> | |
13 | #include <linux/ksm.h> | |
14 | #include <linux/mman.h> | |
15 | #include <linux/swap.h> | |
16 | #include <linux/capability.h> | |
17 | #include <linux/fs.h> | |
18 | #include <linux/highmem.h> | |
19 | #include <linux/security.h> | |
20 | #include <linux/syscalls.h> | |
21 | #include <linux/mmu_notifier.h> | |
22 | #include <linux/sched/sysctl.h> | |
23 | ||
24 | #include <asm/uaccess.h> | |
25 | #include <asm/cacheflush.h> | |
26 | #include <asm/tlbflush.h> | |
27 | ||
28 | #include "internal.h" | |
29 | ||
30 | static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr) | |
31 | { | |
32 | pgd_t *pgd; | |
33 | pud_t *pud; | |
34 | pmd_t *pmd; | |
35 | ||
36 | pgd = pgd_offset(mm, addr); | |
37 | if (pgd_none_or_clear_bad(pgd)) | |
38 | return NULL; | |
39 | ||
40 | pud = pud_offset(pgd, addr); | |
41 | if (pud_none_or_clear_bad(pud)) | |
42 | return NULL; | |
43 | ||
44 | pmd = pmd_offset(pud, addr); | |
45 | if (pmd_none(*pmd)) | |
46 | return NULL; | |
47 | ||
48 | return pmd; | |
49 | } | |
50 | ||
51 | static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma, | |
52 | unsigned long addr) | |
53 | { | |
54 | pgd_t *pgd; | |
55 | pud_t *pud; | |
56 | pmd_t *pmd; | |
57 | ||
58 | pgd = pgd_offset(mm, addr); | |
59 | pud = pud_alloc(mm, pgd, addr); | |
60 | if (!pud) | |
61 | return NULL; | |
62 | ||
63 | pmd = pmd_alloc(mm, pud, addr); | |
64 | if (!pmd) | |
65 | return NULL; | |
66 | ||
67 | VM_BUG_ON(pmd_trans_huge(*pmd)); | |
68 | ||
69 | return pmd; | |
70 | } | |
71 | ||
72 | static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, | |
73 | unsigned long old_addr, unsigned long old_end, | |
74 | struct vm_area_struct *new_vma, pmd_t *new_pmd, | |
75 | unsigned long new_addr, bool need_rmap_locks) | |
76 | { | |
77 | struct address_space *mapping = NULL; | |
78 | struct anon_vma *anon_vma = NULL; | |
79 | struct mm_struct *mm = vma->vm_mm; | |
80 | pte_t *old_pte, *new_pte, pte; | |
81 | spinlock_t *old_ptl, *new_ptl; | |
82 | ||
83 | /* | |
84 | * When need_rmap_locks is true, we take the i_mmap_mutex and anon_vma | |
85 | * locks to ensure that rmap will always observe either the old or the | |
86 | * new ptes. This is the easiest way to avoid races with | |
87 | * truncate_pagecache(), page migration, etc... | |
88 | * | |
89 | * When need_rmap_locks is false, we use other ways to avoid | |
90 | * such races: | |
91 | * | |
92 | * - During exec() shift_arg_pages(), we use a specially tagged vma | |
93 | * which rmap call sites look for using is_vma_temporary_stack(). | |
94 | * | |
95 | * - During mremap(), new_vma is often known to be placed after vma | |
96 | * in rmap traversal order. This ensures rmap will always observe | |
97 | * either the old pte, or the new pte, or both (the page table locks | |
98 | * serialize access to individual ptes, but only rmap traversal | |
99 | * order guarantees that we won't miss both the old and new ptes). | |
100 | */ | |
101 | if (need_rmap_locks) { | |
102 | if (vma->vm_file) { | |
103 | mapping = vma->vm_file->f_mapping; | |
104 | mutex_lock(&mapping->i_mmap_mutex); | |
105 | } | |
106 | if (vma->anon_vma) { | |
107 | anon_vma = vma->anon_vma; | |
108 | anon_vma_lock_write(anon_vma); | |
109 | } | |
110 | } | |
111 | ||
112 | /* | |
113 | * We don't have to worry about the ordering of src and dst | |
114 | * pte locks because exclusive mmap_sem prevents deadlock. | |
115 | */ | |
116 | old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl); | |
117 | new_pte = pte_offset_map(new_pmd, new_addr); | |
118 | new_ptl = pte_lockptr(mm, new_pmd); | |
119 | if (new_ptl != old_ptl) | |
120 | spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); | |
121 | arch_enter_lazy_mmu_mode(); | |
122 | ||
123 | for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE, | |
124 | new_pte++, new_addr += PAGE_SIZE) { | |
125 | if (pte_none(*old_pte)) | |
126 | continue; | |
127 | pte = ptep_get_and_clear(mm, old_addr, old_pte); | |
128 | pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr); | |
129 | set_pte_at(mm, new_addr, new_pte, pte); | |
130 | } | |
131 | ||
132 | arch_leave_lazy_mmu_mode(); | |
133 | if (new_ptl != old_ptl) | |
134 | spin_unlock(new_ptl); | |
135 | pte_unmap(new_pte - 1); | |
136 | pte_unmap_unlock(old_pte - 1, old_ptl); | |
137 | if (anon_vma) | |
138 | anon_vma_unlock_write(anon_vma); | |
139 | if (mapping) | |
140 | mutex_unlock(&mapping->i_mmap_mutex); | |
141 | } | |
142 | ||
143 | #define LATENCY_LIMIT (64 * PAGE_SIZE) | |
144 | ||
145 | unsigned long move_page_tables(struct vm_area_struct *vma, | |
146 | unsigned long old_addr, struct vm_area_struct *new_vma, | |
147 | unsigned long new_addr, unsigned long len, | |
148 | bool need_rmap_locks) | |
149 | { | |
150 | unsigned long extent, next, old_end; | |
151 | pmd_t *old_pmd, *new_pmd; | |
152 | bool need_flush = false; | |
153 | unsigned long mmun_start; /* For mmu_notifiers */ | |
154 | unsigned long mmun_end; /* For mmu_notifiers */ | |
155 | ||
156 | old_end = old_addr + len; | |
157 | flush_cache_range(vma, old_addr, old_end); | |
158 | ||
159 | mmun_start = old_addr; | |
160 | mmun_end = old_end; | |
161 | mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end); | |
162 | ||
163 | for (; old_addr < old_end; old_addr += extent, new_addr += extent) { | |
164 | cond_resched(); | |
165 | next = (old_addr + PMD_SIZE) & PMD_MASK; | |
166 | /* even if next overflowed, extent below will be ok */ | |
167 | extent = next - old_addr; | |
168 | if (extent > old_end - old_addr) | |
169 | extent = old_end - old_addr; | |
170 | old_pmd = get_old_pmd(vma->vm_mm, old_addr); | |
171 | if (!old_pmd) | |
172 | continue; | |
173 | new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr); | |
174 | if (!new_pmd) | |
175 | break; | |
176 | if (pmd_trans_huge(*old_pmd)) { | |
177 | int err = 0; | |
178 | if (extent == HPAGE_PMD_SIZE) | |
179 | err = move_huge_pmd(vma, new_vma, old_addr, | |
180 | new_addr, old_end, | |
181 | old_pmd, new_pmd); | |
182 | if (err > 0) { | |
183 | need_flush = true; | |
184 | continue; | |
185 | } else if (!err) { | |
186 | split_huge_page_pmd(vma, old_addr, old_pmd); | |
187 | } | |
188 | VM_BUG_ON(pmd_trans_huge(*old_pmd)); | |
189 | } | |
190 | if (pmd_none(*new_pmd) && __pte_alloc(new_vma->vm_mm, new_vma, | |
191 | new_pmd, new_addr)) | |
192 | break; | |
193 | next = (new_addr + PMD_SIZE) & PMD_MASK; | |
194 | if (extent > next - new_addr) | |
195 | extent = next - new_addr; | |
196 | if (extent > LATENCY_LIMIT) | |
197 | extent = LATENCY_LIMIT; | |
198 | move_ptes(vma, old_pmd, old_addr, old_addr + extent, | |
199 | new_vma, new_pmd, new_addr, need_rmap_locks); | |
200 | need_flush = true; | |
201 | } | |
202 | if (likely(need_flush)) | |
203 | flush_tlb_range(vma, old_end-len, old_addr); | |
204 | ||
205 | mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end); | |
206 | ||
207 | return len + old_addr - old_end; /* how much done */ | |
208 | } | |
209 | ||
210 | static unsigned long move_vma(struct vm_area_struct *vma, | |
211 | unsigned long old_addr, unsigned long old_len, | |
212 | unsigned long new_len, unsigned long new_addr, bool *locked) | |
213 | { | |
214 | struct mm_struct *mm = vma->vm_mm; | |
215 | struct vm_area_struct *new_vma; | |
216 | unsigned long vm_flags = vma->vm_flags; | |
217 | unsigned long new_pgoff; | |
218 | unsigned long moved_len; | |
219 | unsigned long excess = 0; | |
220 | unsigned long hiwater_vm; | |
221 | int split = 0; | |
222 | int err; | |
223 | bool need_rmap_locks; | |
224 | ||
225 | /* | |
226 | * We'd prefer to avoid failure later on in do_munmap: | |
227 | * which may split one vma into three before unmapping. | |
228 | */ | |
229 | if (mm->map_count >= sysctl_max_map_count - 3) | |
230 | return -ENOMEM; | |
231 | ||
232 | /* | |
233 | * Advise KSM to break any KSM pages in the area to be moved: | |
234 | * it would be confusing if they were to turn up at the new | |
235 | * location, where they happen to coincide with different KSM | |
236 | * pages recently unmapped. But leave vma->vm_flags as it was, | |
237 | * so KSM can come around to merge on vma and new_vma afterwards. | |
238 | */ | |
239 | err = ksm_madvise(vma, old_addr, old_addr + old_len, | |
240 | MADV_UNMERGEABLE, &vm_flags); | |
241 | if (err) | |
242 | return err; | |
243 | ||
244 | new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT); | |
245 | new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff, | |
246 | &need_rmap_locks); | |
247 | if (!new_vma) | |
248 | return -ENOMEM; | |
249 | ||
250 | moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len, | |
251 | need_rmap_locks); | |
252 | if (moved_len < old_len) { | |
253 | /* | |
254 | * On error, move entries back from new area to old, | |
255 | * which will succeed since page tables still there, | |
256 | * and then proceed to unmap new area instead of old. | |
257 | */ | |
258 | move_page_tables(new_vma, new_addr, vma, old_addr, moved_len, | |
259 | true); | |
260 | vma = new_vma; | |
261 | old_len = new_len; | |
262 | old_addr = new_addr; | |
263 | new_addr = -ENOMEM; | |
264 | } | |
265 | ||
266 | /* Conceal VM_ACCOUNT so old reservation is not undone */ | |
267 | if (vm_flags & VM_ACCOUNT) { | |
268 | vma->vm_flags &= ~VM_ACCOUNT; | |
269 | excess = vma->vm_end - vma->vm_start - old_len; | |
270 | if (old_addr > vma->vm_start && | |
271 | old_addr + old_len < vma->vm_end) | |
272 | split = 1; | |
273 | } | |
274 | ||
275 | /* | |
276 | * If we failed to move page tables we still do total_vm increment | |
277 | * since do_munmap() will decrement it by old_len == new_len. | |
278 | * | |
279 | * Since total_vm is about to be raised artificially high for a | |
280 | * moment, we need to restore high watermark afterwards: if stats | |
281 | * are taken meanwhile, total_vm and hiwater_vm appear too high. | |
282 | * If this were a serious issue, we'd add a flag to do_munmap(). | |
283 | */ | |
284 | hiwater_vm = mm->hiwater_vm; | |
285 | vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT); | |
286 | ||
287 | if (do_munmap(mm, old_addr, old_len) < 0) { | |
288 | /* OOM: unable to split vma, just get accounts right */ | |
289 | vm_unacct_memory(excess >> PAGE_SHIFT); | |
290 | excess = 0; | |
291 | } | |
292 | mm->hiwater_vm = hiwater_vm; | |
293 | ||
294 | /* Restore VM_ACCOUNT if one or two pieces of vma left */ | |
295 | if (excess) { | |
296 | vma->vm_flags |= VM_ACCOUNT; | |
297 | if (split) | |
298 | vma->vm_next->vm_flags |= VM_ACCOUNT; | |
299 | } | |
300 | ||
301 | if (vm_flags & VM_LOCKED) { | |
302 | mm->locked_vm += new_len >> PAGE_SHIFT; | |
303 | *locked = true; | |
304 | } | |
305 | ||
306 | return new_addr; | |
307 | } | |
308 | ||
309 | static struct vm_area_struct *vma_to_resize(unsigned long addr, | |
310 | unsigned long old_len, unsigned long new_len, unsigned long *p) | |
311 | { | |
312 | struct mm_struct *mm = current->mm; | |
313 | struct vm_area_struct *vma = find_vma(mm, addr); | |
314 | ||
315 | if (!vma || vma->vm_start > addr) | |
316 | goto Efault; | |
317 | ||
318 | if (is_vm_hugetlb_page(vma)) | |
319 | goto Einval; | |
320 | ||
321 | /* We can't remap across vm area boundaries */ | |
322 | if (old_len > vma->vm_end - addr) | |
323 | goto Efault; | |
324 | ||
325 | /* Need to be careful about a growing mapping */ | |
326 | if (new_len > old_len) { | |
327 | unsigned long pgoff; | |
328 | ||
329 | if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) | |
330 | goto Efault; | |
331 | pgoff = (addr - vma->vm_start) >> PAGE_SHIFT; | |
332 | pgoff += vma->vm_pgoff; | |
333 | if (pgoff + (new_len >> PAGE_SHIFT) < pgoff) | |
334 | goto Einval; | |
335 | } | |
336 | ||
337 | if (vma->vm_flags & VM_LOCKED) { | |
338 | unsigned long locked, lock_limit; | |
339 | locked = mm->locked_vm << PAGE_SHIFT; | |
340 | lock_limit = rlimit(RLIMIT_MEMLOCK); | |
341 | locked += new_len - old_len; | |
342 | if (locked > lock_limit && !capable(CAP_IPC_LOCK)) | |
343 | goto Eagain; | |
344 | } | |
345 | ||
346 | if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT)) | |
347 | goto Enomem; | |
348 | ||
349 | if (vma->vm_flags & VM_ACCOUNT) { | |
350 | unsigned long charged = (new_len - old_len) >> PAGE_SHIFT; | |
351 | if (security_vm_enough_memory_mm(mm, charged)) | |
352 | goto Efault; | |
353 | *p = charged; | |
354 | } | |
355 | ||
356 | return vma; | |
357 | ||
358 | Efault: /* very odd choice for most of the cases, but... */ | |
359 | return ERR_PTR(-EFAULT); | |
360 | Einval: | |
361 | return ERR_PTR(-EINVAL); | |
362 | Enomem: | |
363 | return ERR_PTR(-ENOMEM); | |
364 | Eagain: | |
365 | return ERR_PTR(-EAGAIN); | |
366 | } | |
367 | ||
368 | static unsigned long mremap_to(unsigned long addr, unsigned long old_len, | |
369 | unsigned long new_addr, unsigned long new_len, bool *locked) | |
370 | { | |
371 | struct mm_struct *mm = current->mm; | |
372 | struct vm_area_struct *vma; | |
373 | unsigned long ret = -EINVAL; | |
374 | unsigned long charged = 0; | |
375 | unsigned long map_flags; | |
376 | ||
377 | if (new_addr & ~PAGE_MASK) | |
378 | goto out; | |
379 | ||
380 | if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len) | |
381 | goto out; | |
382 | ||
383 | /* Check if the location we're moving into overlaps the | |
384 | * old location at all, and fail if it does. | |
385 | */ | |
386 | if ((new_addr <= addr) && (new_addr+new_len) > addr) | |
387 | goto out; | |
388 | ||
389 | if ((addr <= new_addr) && (addr+old_len) > new_addr) | |
390 | goto out; | |
391 | ||
392 | ret = do_munmap(mm, new_addr, new_len); | |
393 | if (ret) | |
394 | goto out; | |
395 | ||
396 | if (old_len >= new_len) { | |
397 | ret = do_munmap(mm, addr+new_len, old_len - new_len); | |
398 | if (ret && old_len != new_len) | |
399 | goto out; | |
400 | old_len = new_len; | |
401 | } | |
402 | ||
403 | vma = vma_to_resize(addr, old_len, new_len, &charged); | |
404 | if (IS_ERR(vma)) { | |
405 | ret = PTR_ERR(vma); | |
406 | goto out; | |
407 | } | |
408 | ||
409 | map_flags = MAP_FIXED; | |
410 | if (vma->vm_flags & VM_MAYSHARE) | |
411 | map_flags |= MAP_SHARED; | |
412 | ||
413 | ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff + | |
414 | ((addr - vma->vm_start) >> PAGE_SHIFT), | |
415 | map_flags); | |
416 | if (ret & ~PAGE_MASK) | |
417 | goto out1; | |
418 | ||
419 | ret = move_vma(vma, addr, old_len, new_len, new_addr, locked); | |
420 | if (!(ret & ~PAGE_MASK)) | |
421 | goto out; | |
422 | out1: | |
423 | vm_unacct_memory(charged); | |
424 | ||
425 | out: | |
426 | return ret; | |
427 | } | |
428 | ||
429 | static int vma_expandable(struct vm_area_struct *vma, unsigned long delta) | |
430 | { | |
431 | unsigned long end = vma->vm_end + delta; | |
432 | if (end < vma->vm_end) /* overflow */ | |
433 | return 0; | |
434 | if (vma->vm_next && vma->vm_next->vm_start < end) /* intersection */ | |
435 | return 0; | |
436 | if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start, | |
437 | 0, MAP_FIXED) & ~PAGE_MASK) | |
438 | return 0; | |
439 | return 1; | |
440 | } | |
441 | ||
442 | /* | |
443 | * Expand (or shrink) an existing mapping, potentially moving it at the | |
444 | * same time (controlled by the MREMAP_MAYMOVE flag and available VM space) | |
445 | * | |
446 | * MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise | |
447 | * This option implies MREMAP_MAYMOVE. | |
448 | */ | |
449 | SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, | |
450 | unsigned long, new_len, unsigned long, flags, | |
451 | unsigned long, new_addr) | |
452 | { | |
453 | struct mm_struct *mm = current->mm; | |
454 | struct vm_area_struct *vma; | |
455 | unsigned long ret = -EINVAL; | |
456 | unsigned long charged = 0; | |
457 | bool locked = false; | |
458 | ||
459 | down_write(¤t->mm->mmap_sem); | |
460 | ||
461 | if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE)) | |
462 | goto out; | |
463 | ||
464 | if (addr & ~PAGE_MASK) | |
465 | goto out; | |
466 | ||
467 | old_len = PAGE_ALIGN(old_len); | |
468 | new_len = PAGE_ALIGN(new_len); | |
469 | ||
470 | /* | |
471 | * We allow a zero old-len as a special case | |
472 | * for DOS-emu "duplicate shm area" thing. But | |
473 | * a zero new-len is nonsensical. | |
474 | */ | |
475 | if (!new_len) | |
476 | goto out; | |
477 | ||
478 | if (flags & MREMAP_FIXED) { | |
479 | if (flags & MREMAP_MAYMOVE) | |
480 | ret = mremap_to(addr, old_len, new_addr, new_len, | |
481 | &locked); | |
482 | goto out; | |
483 | } | |
484 | ||
485 | /* | |
486 | * Always allow a shrinking remap: that just unmaps | |
487 | * the unnecessary pages.. | |
488 | * do_munmap does all the needed commit accounting | |
489 | */ | |
490 | if (old_len >= new_len) { | |
491 | ret = do_munmap(mm, addr+new_len, old_len - new_len); | |
492 | if (ret && old_len != new_len) | |
493 | goto out; | |
494 | ret = addr; | |
495 | goto out; | |
496 | } | |
497 | ||
498 | /* | |
499 | * Ok, we need to grow.. | |
500 | */ | |
501 | vma = vma_to_resize(addr, old_len, new_len, &charged); | |
502 | if (IS_ERR(vma)) { | |
503 | ret = PTR_ERR(vma); | |
504 | goto out; | |
505 | } | |
506 | ||
507 | /* old_len exactly to the end of the area.. | |
508 | */ | |
509 | if (old_len == vma->vm_end - addr) { | |
510 | /* can we just expand the current mapping? */ | |
511 | if (vma_expandable(vma, new_len - old_len)) { | |
512 | int pages = (new_len - old_len) >> PAGE_SHIFT; | |
513 | ||
514 | if (vma_adjust(vma, vma->vm_start, addr + new_len, | |
515 | vma->vm_pgoff, NULL)) { | |
516 | ret = -ENOMEM; | |
517 | goto out; | |
518 | } | |
519 | ||
520 | vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages); | |
521 | if (vma->vm_flags & VM_LOCKED) { | |
522 | mm->locked_vm += pages; | |
523 | locked = true; | |
524 | new_addr = addr; | |
525 | } | |
526 | ret = addr; | |
527 | goto out; | |
528 | } | |
529 | } | |
530 | ||
531 | /* | |
532 | * We weren't able to just expand or shrink the area, | |
533 | * we need to create a new one and move it.. | |
534 | */ | |
535 | ret = -ENOMEM; | |
536 | if (flags & MREMAP_MAYMOVE) { | |
537 | unsigned long map_flags = 0; | |
538 | if (vma->vm_flags & VM_MAYSHARE) | |
539 | map_flags |= MAP_SHARED; | |
540 | ||
541 | new_addr = get_unmapped_area(vma->vm_file, 0, new_len, | |
542 | vma->vm_pgoff + | |
543 | ((addr - vma->vm_start) >> PAGE_SHIFT), | |
544 | map_flags); | |
545 | if (new_addr & ~PAGE_MASK) { | |
546 | ret = new_addr; | |
547 | goto out; | |
548 | } | |
549 | ||
550 | ret = move_vma(vma, addr, old_len, new_len, new_addr, &locked); | |
551 | } | |
552 | out: | |
553 | if (ret & ~PAGE_MASK) | |
554 | vm_unacct_memory(charged); | |
555 | up_write(¤t->mm->mmap_sem); | |
556 | if (locked && new_len > old_len) | |
557 | mm_populate(new_addr + old_len, new_len - old_len); | |
558 | return ret; | |
559 | } |