| // SPDX-License-Identifier: GPL-2.0 | 
 | #include <linux/mm.h> | 
 | #include <linux/rmap.h> | 
 | #include <linux/hugetlb.h> | 
 | #include <linux/swap.h> | 
 | #include <linux/swapops.h> | 
 |  | 
 | #include "internal.h" | 
 |  | 
 | static inline bool not_found(struct page_vma_mapped_walk *pvmw) | 
 | { | 
 | 	page_vma_mapped_walk_done(pvmw); | 
 | 	return false; | 
 | } | 
 |  | 
 | static bool map_pte(struct page_vma_mapped_walk *pvmw, pmd_t *pmdvalp, | 
 | 		    spinlock_t **ptlp) | 
 | { | 
 | 	pte_t ptent; | 
 |  | 
 | 	if (pvmw->flags & PVMW_SYNC) { | 
 | 		/* Use the stricter lookup */ | 
 | 		pvmw->pte = pte_offset_map_lock(pvmw->vma->vm_mm, pvmw->pmd, | 
 | 						pvmw->address, &pvmw->ptl); | 
 | 		*ptlp = pvmw->ptl; | 
 | 		return !!pvmw->pte; | 
 | 	} | 
 |  | 
 | again: | 
 | 	/* | 
 | 	 * It is important to return the ptl corresponding to pte, | 
 | 	 * in case *pvmw->pmd changes underneath us; so we need to | 
 | 	 * return it even when choosing not to lock, in case caller | 
 | 	 * proceeds to loop over next ptes, and finds a match later. | 
 | 	 * Though, in most cases, page lock already protects this. | 
 | 	 */ | 
 | 	pvmw->pte = pte_offset_map_rw_nolock(pvmw->vma->vm_mm, pvmw->pmd, | 
 | 					     pvmw->address, pmdvalp, ptlp); | 
 | 	if (!pvmw->pte) | 
 | 		return false; | 
 |  | 
 | 	ptent = ptep_get(pvmw->pte); | 
 |  | 
 | 	if (pvmw->flags & PVMW_MIGRATION) { | 
 | 		if (!is_swap_pte(ptent)) | 
 | 			return false; | 
 | 	} else if (is_swap_pte(ptent)) { | 
 | 		swp_entry_t entry; | 
 | 		/* | 
 | 		 * Handle un-addressable ZONE_DEVICE memory. | 
 | 		 * | 
 | 		 * We get here when we are trying to unmap a private | 
 | 		 * device page from the process address space. Such | 
 | 		 * page is not CPU accessible and thus is mapped as | 
 | 		 * a special swap entry, nonetheless it still does | 
 | 		 * count as a valid regular mapping for the page | 
 | 		 * (and is accounted as such in page maps count). | 
 | 		 * | 
 | 		 * So handle this special case as if it was a normal | 
 | 		 * page mapping ie lock CPU page table and return true. | 
 | 		 * | 
 | 		 * For more details on device private memory see HMM | 
 | 		 * (include/linux/hmm.h or mm/hmm.c). | 
 | 		 */ | 
 | 		entry = pte_to_swp_entry(ptent); | 
 | 		if (!is_device_private_entry(entry) && | 
 | 		    !is_device_exclusive_entry(entry)) | 
 | 			return false; | 
 | 	} else if (!pte_present(ptent)) { | 
 | 		return false; | 
 | 	} | 
 | 	spin_lock(*ptlp); | 
 | 	if (unlikely(!pmd_same(*pmdvalp, pmdp_get_lockless(pvmw->pmd)))) { | 
 | 		pte_unmap_unlock(pvmw->pte, *ptlp); | 
 | 		goto again; | 
 | 	} | 
 | 	pvmw->ptl = *ptlp; | 
 |  | 
 | 	return true; | 
 | } | 
 |  | 
 | /** | 
 |  * check_pte - check if [pvmw->pfn, @pvmw->pfn + @pvmw->nr_pages) is | 
 |  * mapped at the @pvmw->pte | 
 |  * @pvmw: page_vma_mapped_walk struct, includes a pair pte and pfn range | 
 |  * for checking | 
 |  * @pte_nr: the number of small pages described by @pvmw->pte. | 
 |  * | 
 |  * page_vma_mapped_walk() found a place where pfn range is *potentially* | 
 |  * mapped. check_pte() has to validate this. | 
 |  * | 
 |  * pvmw->pte may point to empty PTE, swap PTE or PTE pointing to | 
 |  * arbitrary page. | 
 |  * | 
 |  * If PVMW_MIGRATION flag is set, returns true if @pvmw->pte contains migration | 
 |  * entry that points to [pvmw->pfn, @pvmw->pfn + @pvmw->nr_pages) | 
 |  * | 
 |  * If PVMW_MIGRATION flag is not set, returns true if pvmw->pte points to | 
 |  * [pvmw->pfn, @pvmw->pfn + @pvmw->nr_pages) | 
 |  * | 
 |  * Otherwise, return false. | 
 |  * | 
 |  */ | 
 | static bool check_pte(struct page_vma_mapped_walk *pvmw, unsigned long pte_nr) | 
 | { | 
 | 	unsigned long pfn; | 
 | 	pte_t ptent = ptep_get(pvmw->pte); | 
 |  | 
 | 	if (pvmw->flags & PVMW_MIGRATION) { | 
 | 		swp_entry_t entry; | 
 | 		if (!is_swap_pte(ptent)) | 
 | 			return false; | 
 | 		entry = pte_to_swp_entry(ptent); | 
 |  | 
 | 		if (!is_migration_entry(entry)) | 
 | 			return false; | 
 |  | 
 | 		pfn = swp_offset_pfn(entry); | 
 | 	} else if (is_swap_pte(ptent)) { | 
 | 		swp_entry_t entry; | 
 |  | 
 | 		/* Handle un-addressable ZONE_DEVICE memory */ | 
 | 		entry = pte_to_swp_entry(ptent); | 
 | 		if (!is_device_private_entry(entry) && | 
 | 		    !is_device_exclusive_entry(entry)) | 
 | 			return false; | 
 |  | 
 | 		pfn = swp_offset_pfn(entry); | 
 | 	} else { | 
 | 		if (!pte_present(ptent)) | 
 | 			return false; | 
 |  | 
 | 		pfn = pte_pfn(ptent); | 
 | 	} | 
 |  | 
 | 	if ((pfn + pte_nr - 1) < pvmw->pfn) | 
 | 		return false; | 
 | 	if (pfn > (pvmw->pfn + pvmw->nr_pages - 1)) | 
 | 		return false; | 
 | 	return true; | 
 | } | 
 |  | 
 | /* Returns true if the two ranges overlap.  Careful to not overflow. */ | 
 | static bool check_pmd(unsigned long pfn, struct page_vma_mapped_walk *pvmw) | 
 | { | 
 | 	if ((pfn + HPAGE_PMD_NR - 1) < pvmw->pfn) | 
 | 		return false; | 
 | 	if (pfn > pvmw->pfn + pvmw->nr_pages - 1) | 
 | 		return false; | 
 | 	return true; | 
 | } | 
 |  | 
 | static void step_forward(struct page_vma_mapped_walk *pvmw, unsigned long size) | 
 | { | 
 | 	pvmw->address = (pvmw->address + size) & ~(size - 1); | 
 | 	if (!pvmw->address) | 
 | 		pvmw->address = ULONG_MAX; | 
 | } | 
 |  | 
 | /** | 
 |  * page_vma_mapped_walk - check if @pvmw->pfn is mapped in @pvmw->vma at | 
 |  * @pvmw->address | 
 |  * @pvmw: pointer to struct page_vma_mapped_walk. page, vma, address and flags | 
 |  * must be set. pmd, pte and ptl must be NULL. | 
 |  * | 
 |  * Returns true if the page is mapped in the vma. @pvmw->pmd and @pvmw->pte point | 
 |  * to relevant page table entries. @pvmw->ptl is locked. @pvmw->address is | 
 |  * adjusted if needed (for PTE-mapped THPs). | 
 |  * | 
 |  * If @pvmw->pmd is set but @pvmw->pte is not, you have found PMD-mapped page | 
 |  * (usually THP). For PTE-mapped THP, you should run page_vma_mapped_walk() in | 
 |  * a loop to find all PTEs that map the THP. | 
 |  * | 
 |  * For HugeTLB pages, @pvmw->pte is set to the relevant page table entry | 
 |  * regardless of which page table level the page is mapped at. @pvmw->pmd is | 
 |  * NULL. | 
 |  * | 
 |  * Returns false if there are no more page table entries for the page in | 
 |  * the vma. @pvmw->ptl is unlocked and @pvmw->pte is unmapped. | 
 |  * | 
 |  * If you need to stop the walk before page_vma_mapped_walk() returned false, | 
 |  * use page_vma_mapped_walk_done(). It will do the housekeeping. | 
 |  */ | 
 | bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw) | 
 | { | 
 | 	struct vm_area_struct *vma = pvmw->vma; | 
 | 	struct mm_struct *mm = vma->vm_mm; | 
 | 	unsigned long end; | 
 | 	spinlock_t *ptl; | 
 | 	pgd_t *pgd; | 
 | 	p4d_t *p4d; | 
 | 	pud_t *pud; | 
 | 	pmd_t pmde; | 
 |  | 
 | 	/* The only possible pmd mapping has been handled on last iteration */ | 
 | 	if (pvmw->pmd && !pvmw->pte) | 
 | 		return not_found(pvmw); | 
 |  | 
 | 	if (unlikely(is_vm_hugetlb_page(vma))) { | 
 | 		struct hstate *hstate = hstate_vma(vma); | 
 | 		unsigned long size = huge_page_size(hstate); | 
 | 		/* The only possible mapping was handled on last iteration */ | 
 | 		if (pvmw->pte) | 
 | 			return not_found(pvmw); | 
 | 		/* | 
 | 		 * All callers that get here will already hold the | 
 | 		 * i_mmap_rwsem.  Therefore, no additional locks need to be | 
 | 		 * taken before calling hugetlb_walk(). | 
 | 		 */ | 
 | 		pvmw->pte = hugetlb_walk(vma, pvmw->address, size); | 
 | 		if (!pvmw->pte) | 
 | 			return false; | 
 |  | 
 | 		pvmw->ptl = huge_pte_lock(hstate, mm, pvmw->pte); | 
 | 		if (!check_pte(pvmw, pages_per_huge_page(hstate))) | 
 | 			return not_found(pvmw); | 
 | 		return true; | 
 | 	} | 
 |  | 
 | 	end = vma_address_end(pvmw); | 
 | 	if (pvmw->pte) | 
 | 		goto next_pte; | 
 | restart: | 
 | 	do { | 
 | 		pgd = pgd_offset(mm, pvmw->address); | 
 | 		if (!pgd_present(*pgd)) { | 
 | 			step_forward(pvmw, PGDIR_SIZE); | 
 | 			continue; | 
 | 		} | 
 | 		p4d = p4d_offset(pgd, pvmw->address); | 
 | 		if (!p4d_present(*p4d)) { | 
 | 			step_forward(pvmw, P4D_SIZE); | 
 | 			continue; | 
 | 		} | 
 | 		pud = pud_offset(p4d, pvmw->address); | 
 | 		if (!pud_present(*pud)) { | 
 | 			step_forward(pvmw, PUD_SIZE); | 
 | 			continue; | 
 | 		} | 
 |  | 
 | 		pvmw->pmd = pmd_offset(pud, pvmw->address); | 
 | 		/* | 
 | 		 * Make sure the pmd value isn't cached in a register by the | 
 | 		 * compiler and used as a stale value after we've observed a | 
 | 		 * subsequent update. | 
 | 		 */ | 
 | 		pmde = pmdp_get_lockless(pvmw->pmd); | 
 |  | 
 | 		if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) { | 
 | 			pvmw->ptl = pmd_lock(mm, pvmw->pmd); | 
 | 			pmde = *pvmw->pmd; | 
 | 			if (!pmd_present(pmde)) { | 
 | 				swp_entry_t entry; | 
 |  | 
 | 				if (!thp_migration_supported() || | 
 | 				    !(pvmw->flags & PVMW_MIGRATION)) | 
 | 					return not_found(pvmw); | 
 | 				entry = pmd_to_swp_entry(pmde); | 
 | 				if (!is_migration_entry(entry) || | 
 | 				    !check_pmd(swp_offset_pfn(entry), pvmw)) | 
 | 					return not_found(pvmw); | 
 | 				return true; | 
 | 			} | 
 | 			if (likely(pmd_trans_huge(pmde))) { | 
 | 				if (pvmw->flags & PVMW_MIGRATION) | 
 | 					return not_found(pvmw); | 
 | 				if (!check_pmd(pmd_pfn(pmde), pvmw)) | 
 | 					return not_found(pvmw); | 
 | 				return true; | 
 | 			} | 
 | 			/* THP pmd was split under us: handle on pte level */ | 
 | 			spin_unlock(pvmw->ptl); | 
 | 			pvmw->ptl = NULL; | 
 | 		} else if (!pmd_present(pmde)) { | 
 | 			/* | 
 | 			 * If PVMW_SYNC, take and drop THP pmd lock so that we | 
 | 			 * cannot return prematurely, while zap_huge_pmd() has | 
 | 			 * cleared *pmd but not decremented compound_mapcount(). | 
 | 			 */ | 
 | 			if ((pvmw->flags & PVMW_SYNC) && | 
 | 			    thp_vma_suitable_order(vma, pvmw->address, | 
 | 						   PMD_ORDER) && | 
 | 			    (pvmw->nr_pages >= HPAGE_PMD_NR)) { | 
 | 				spinlock_t *ptl = pmd_lock(mm, pvmw->pmd); | 
 |  | 
 | 				spin_unlock(ptl); | 
 | 			} | 
 | 			step_forward(pvmw, PMD_SIZE); | 
 | 			continue; | 
 | 		} | 
 | 		if (!map_pte(pvmw, &pmde, &ptl)) { | 
 | 			if (!pvmw->pte) | 
 | 				goto restart; | 
 | 			goto next_pte; | 
 | 		} | 
 | this_pte: | 
 | 		if (check_pte(pvmw, 1)) | 
 | 			return true; | 
 | next_pte: | 
 | 		do { | 
 | 			pvmw->address += PAGE_SIZE; | 
 | 			if (pvmw->address >= end) | 
 | 				return not_found(pvmw); | 
 | 			/* Did we cross page table boundary? */ | 
 | 			if ((pvmw->address & (PMD_SIZE - PAGE_SIZE)) == 0) { | 
 | 				if (pvmw->ptl) { | 
 | 					spin_unlock(pvmw->ptl); | 
 | 					pvmw->ptl = NULL; | 
 | 				} | 
 | 				pte_unmap(pvmw->pte); | 
 | 				pvmw->pte = NULL; | 
 | 				pvmw->flags |= PVMW_PGTABLE_CROSSED; | 
 | 				goto restart; | 
 | 			} | 
 | 			pvmw->pte++; | 
 | 		} while (pte_none(ptep_get(pvmw->pte))); | 
 |  | 
 | 		if (!pvmw->ptl) { | 
 | 			spin_lock(ptl); | 
 | 			if (unlikely(!pmd_same(pmde, pmdp_get_lockless(pvmw->pmd)))) { | 
 | 				pte_unmap_unlock(pvmw->pte, ptl); | 
 | 				pvmw->pte = NULL; | 
 | 				goto restart; | 
 | 			} | 
 | 			pvmw->ptl = ptl; | 
 | 		} | 
 | 		goto this_pte; | 
 | 	} while (pvmw->address < end); | 
 |  | 
 | 	return false; | 
 | } | 
 |  | 
 | #ifdef CONFIG_MEMORY_FAILURE | 
 | /** | 
 |  * page_mapped_in_vma - check whether a page is really mapped in a VMA | 
 |  * @page: the page to test | 
 |  * @vma: the VMA to test | 
 |  * | 
 |  * Return: The address the page is mapped at if the page is in the range | 
 |  * covered by the VMA and present in the page table.  If the page is | 
 |  * outside the VMA or not present, returns -EFAULT. | 
 |  * Only valid for normal file or anonymous VMAs. | 
 |  */ | 
 | unsigned long page_mapped_in_vma(const struct page *page, | 
 | 		struct vm_area_struct *vma) | 
 | { | 
 | 	const struct folio *folio = page_folio(page); | 
 | 	struct page_vma_mapped_walk pvmw = { | 
 | 		.pfn = page_to_pfn(page), | 
 | 		.nr_pages = 1, | 
 | 		.vma = vma, | 
 | 		.flags = PVMW_SYNC, | 
 | 	}; | 
 |  | 
 | 	pvmw.address = vma_address(vma, page_pgoff(folio, page), 1); | 
 | 	if (pvmw.address == -EFAULT) | 
 | 		goto out; | 
 | 	if (!page_vma_mapped_walk(&pvmw)) | 
 | 		return -EFAULT; | 
 | 	page_vma_mapped_walk_done(&pvmw); | 
 | out: | 
 | 	return pvmw.address; | 
 | } | 
 | #endif |