[PATCH v3 5/6] mm: gup: introduce gup_unshared_pages()

From: Yeoreum Yun

Date: Mon Nov 09 2026 - 07:43:01 EST


This is preparatory patch to make gup_fast_pte_range() batchable.

Introduce gup_unshared_pages() to count consecutive pages within a folio
that do not require unsharing, and use it to implement gup_must_unshare().

Also add a folio argument to gup_must_unshare() so callers can reuse an
existing folio and avoid the compound_head() call implicit in PageAnon().

There is no functional change.

Signed-off-by: Yeoreum Yun <yeoreum.yun@xxxxxxx>
---
mm/gup.c | 111 +++++++++++++++++++++++++++++++++++++--------------------------
1 file changed, 66 insertions(+), 45 deletions(-)

diff --git a/mm/gup.c b/mm/gup.c
index bfe83ce1411d5..c863bae33e2f1 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -633,58 +633,39 @@ static struct page *no_page_table(struct vm_area_struct *vma,
return NULL;
}

-/*
- * Indicates for which pages that are write-protected in the page table,
- * whether GUP has to trigger unsharing via FAULT_FLAG_UNSHARE such that the
- * GUP pin will remain consistent with the pages mapped into the page tables
- * of the MM.
- *
- * Temporary unmapping of PageAnonExclusive() pages or clearing of
- * PageAnonExclusive() has to protect against concurrent GUP:
- * * Ordinary GUP: Using the PT lock
- * * GUP-fast and fork(): mm->write_protect_seq
- * * GUP-fast and KSM or temporary unmapping (swap, migration): see
- * folio_try_share_anon_rmap_*()
- *
- * Must be called with the (sub)page that's actually referenced via the
- * page table entry, which might not necessarily be the head page for a
- * PTE-mapped THP.
- *
- * If the vma is NULL, we're coming from the GUP-fast path and might have
- * to fallback to the slow path just to lookup the vma.
- */
-static inline bool gup_must_unshare(struct vm_area_struct *vma,
- unsigned int flags, struct page *page)
+static unsigned long gup_unshared_pages(struct vm_area_struct *vma,
+ unsigned int flags, struct folio *folio,
+ struct page *page, unsigned long nr_pages)
{
+ unsigned int i;
+
/*
* FOLL_WRITE is implicitly handled correctly as the page table entry
* has to be writable -- and if it references (part of) an anonymous
* folio, that part is required to be marked exclusive.
*/
if ((flags & (FOLL_WRITE | FOLL_PIN)) != FOLL_PIN)
- return false;
- /*
- * Note: PageAnon(page) is stable until the page is actually getting
- * freed.
- */
- if (!PageAnon(page)) {
+ return nr_pages;
+
+ /* folio_test_anon(folio) is stable until folio gets freed. */
+ if (!folio_test_anon(folio)) {
/*
* We only care about R/O long-term pining: R/O short-term
* pinning does not have the semantics to observe successive
* changes through the process page tables.
*/
if (!(flags & FOLL_LONGTERM))
- return false;
+ return nr_pages;

/* We really need the vma ... */
- if (!vma)
- return true;
+ if (!vma || vma_is_cow_mapping(vma))
+ return 0;

/*
* ... because we only care about writable private ("COW")
* mappings where we have to break COW early.
*/
- return vma_is_cow_mapping(vma);
+ return nr_pages;
}

/* Paired with a memory barrier in folio_try_share_anon_rmap_*(). */
@@ -695,7 +676,38 @@ static inline bool gup_must_unshare(struct vm_area_struct *vma,
* Note that KSM pages cannot be exclusive, and consequently,
* cannot get pinned.
*/
- return !PageAnonExclusive(page);
+ for (i = 0; i < nr_pages; i++) {
+ if (!PageAnonExclusive(page + i))
+ return i;
+ }
+
+ return nr_pages;
+}
+
+/*
+ * Indicates for which pages that are write-protected in the page table,
+ * whether GUP has to trigger unsharing via FAULT_FLAG_UNSHARE such that the
+ * GUP pin will remain consistent with the pages mapped into the page tables
+ * of the MM.
+ *
+ * Temporary unmapping of PageAnonExclusive() pages or clearing of
+ * PageAnonExclusive() has to protect against concurrent GUP:
+ * * Ordinary GUP: Using the PT lock
+ * * GUP-fast and fork(): mm->write_protect_seq
+ * * GUP-fast and KSM or temporary unmapping (swap, migration): see
+ * folio_try_share_anon_rmap_*()
+ *
+ * Must be called with the (sub)page that's actually referenced via the
+ * page table entry, which might not necessarily be the head page for a
+ * PTE-mapped THP.
+ *
+ * If the vma is NULL, we're coming from the GUP-fast path and might have
+ * to fallback to the slow path just to lookup the vma.
+ */
+static inline bool gup_must_unshare(struct vm_area_struct *vma,
+ unsigned int flags, struct folio *folio, struct page *page)
+{
+ return gup_unshared_pages(vma, flags, folio, page, 1) != 1;
}

#ifdef CONFIG_PGTABLE_HAS_HUGE_LEAVES
@@ -717,6 +729,7 @@ static struct page *follow_huge_pud(struct vm_area_struct *vma,
{
struct mm_struct *mm = vma->vm_mm;
struct page *page;
+ struct folio *folio;
pud_t pud = *pudp;
unsigned long pfn = pud_pfn(pud);
int ret;
@@ -732,11 +745,12 @@ static struct page *follow_huge_pud(struct vm_area_struct *vma,

pfn += (addr & ~PUD_MASK) >> PAGE_SHIFT;
page = pfn_to_page(pfn);
+ folio = page_folio(page);

- if (!pud_write(pud) && gup_must_unshare(vma, flags, page))
+ if (!pud_write(pud) && gup_must_unshare(vma, flags, folio, page))
return ERR_PTR(-EMLINK);

- ret = try_grab_folio(page_folio(page), 1, flags);
+ ret = try_grab_folio(folio, 1, flags);
if (ret)
page = ERR_PTR(ret);
else
@@ -771,11 +785,14 @@ static struct page *follow_huge_pmd(struct vm_area_struct *vma,
struct mm_struct *mm = vma->vm_mm;
pmd_t pmdval = *pmd;
struct page *page;
+ struct folio *folio;
int ret;

assert_spin_locked(pmd_lockptr(mm, pmd));

page = pmd_page(pmdval);
+ folio = page_folio(page);
+
if ((flags & FOLL_WRITE) &&
!can_follow_write_pmd(pmdval, page, vma, flags))
return NULL;
@@ -787,13 +804,13 @@ static struct page *follow_huge_pmd(struct vm_area_struct *vma,
if (pmd_protnone(*pmd) && !gup_can_follow_protnone(vma, flags))
return NULL;

- if (!pmd_write(pmdval) && gup_must_unshare(vma, flags, page))
+ if (!pmd_write(pmdval) && gup_must_unshare(vma, flags, folio, page))
return ERR_PTR(-EMLINK);

VM_WARN_ON_ONCE_PAGE((flags & FOLL_PIN) && PageAnon(page) &&
!PageAnonExclusive(page), page);

- ret = try_grab_folio(page_folio(page), 1, flags);
+ ret = try_grab_folio(folio, 1, flags);
if (ret)
return ERR_PTR(ret);

@@ -911,7 +928,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
}
folio = page_folio(page);

- if (!pte_write(pte) && gup_must_unshare(vma, flags, page)) {
+ if (!pte_write(pte) && gup_must_unshare(vma, flags, folio, page)) {
page = ERR_PTR(-EMLINK);
goto out;
}
@@ -2969,7 +2986,7 @@ static unsigned long gup_fast_pte_range(pmd_t pmd, pmd_t *pmdp,
goto pte_unmap;
}

- if (!pte_write(pte) && gup_must_unshare(NULL, flags, page)) {
+ if (!pte_write(pte) && gup_must_unshare(NULL, flags, folio, page)) {
gup_put_folio(folio, 1, flags);
goto pte_unmap;
}
@@ -3016,7 +3033,7 @@ static unsigned long gup_fast_pmd_leaf(pmd_t orig, pmd_t *pmdp,
unsigned long addr, unsigned long end,
unsigned int flags, struct page **pages)
{
- struct page *page;
+ struct page *mapped_page, *page;
struct folio *folio;
unsigned long nr_pages, i;

@@ -3031,7 +3048,8 @@ static unsigned long gup_fast_pmd_leaf(pmd_t orig, pmd_t *pmdp,
return 0;

nr_pages = (end - addr) >> PAGE_SHIFT;
- page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
+ mapped_page = pmd_page(orig);
+ page = mapped_page + ((addr & ~PMD_MASK) >> PAGE_SHIFT);

folio = try_grab_folio_fast(page, nr_pages, flags);
if (!folio)
@@ -3046,7 +3064,8 @@ static unsigned long gup_fast_pmd_leaf(pmd_t orig, pmd_t *pmdp,
gup_put_folio(folio, nr_pages, flags);
return 0;
}
- if (!pmd_write(orig) && gup_must_unshare(NULL, flags, &folio->page)) {
+ if (!pmd_write(orig) &&
+ gup_must_unshare(NULL, flags, folio, mapped_page)) {
gup_put_folio(folio, nr_pages, flags);
return 0;
}
@@ -3061,7 +3080,7 @@ static unsigned long gup_fast_pud_leaf(pud_t orig, pud_t *pudp,
unsigned long addr, unsigned long end,
unsigned int flags, struct page **pages)
{
- struct page *page;
+ struct page *mapped_page, *page;
struct folio *folio;
unsigned long nr_pages, i;

@@ -3072,7 +3091,8 @@ static unsigned long gup_fast_pud_leaf(pud_t orig, pud_t *pudp,
return 0;

nr_pages = (end - addr) >> PAGE_SHIFT;
- page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT);
+ mapped_page = pud_page(orig);
+ page = mapped_page + ((addr & ~PUD_MASK) >> PAGE_SHIFT);

folio = try_grab_folio_fast(page, nr_pages, flags);
if (!folio)
@@ -3088,7 +3108,8 @@ static unsigned long gup_fast_pud_leaf(pud_t orig, pud_t *pudp,
return 0;
}

- if (!pud_write(orig) && gup_must_unshare(NULL, flags, &folio->page)) {
+ if (!pud_write(orig) &&
+ gup_must_unshare(NULL, flags, folio, mapped_page)) {
gup_put_folio(folio, nr_pages, flags);
return 0;
}

--
2.43.0