[PATCH 2/2] mm: track gup-pinned pages

[John Hubbard]

Track GUP-pinned pages.

Signed-off-by: John Hubbard <jhubbard@xxxxxxxxxx>
---
 include/linux/mm.h |  8 ++++---
 mm/gup.c           | 59 +++++++++++++++++++++++++++++++++++++++++++---
 mm/rmap.c          | 23 ++++++++++++++----
 3 files changed, 79 insertions(+), 11 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 809b7397d41e..3221a13b4891 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1004,12 +1004,14 @@ static inline void put_page(struct page *page)
  * particular, interactions with RDMA and filesystems need special
  * handling.
  *
- * put_user_page() and put_page() are not interchangeable, despite this early
- * implementation that makes them look the same. put_user_page() calls must
- * be perfectly matched up with get_user_page() calls.
+ * put_user_page() and put_page() are not interchangeable. put_user_page()
+ * calls must be perfectly matched up with get_user_page() calls.
  */
 static inline void put_user_page(struct page *page)
 {
+	page = compound_head(page);
+
+	atomic_dec(&page->_mapcount);
 	put_page(page);
 }
 
diff --git a/mm/gup.c b/mm/gup.c
index 05acd7e2eb22..af3909814be7 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -615,6 +615,48 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
 	return 0;
 }
 
+/*
+ * Manages the PG_gup_pinned flag.
+ *
+ * Note that page->_mapcount counting part of managing that flag, because the
+ * _mapcount is used to determine if PG_gup_pinned can be cleared, in
+ * page_mkclean().
+ */
+static void track_gup_page(struct page *page)
+{
+	page = compound_head(page);
+
+	lock_page(page);
+
+	wait_on_page_writeback(page);
+
+	atomic_inc(&page->_mapcount);
+	SetPageGupPinned(page);
+
+	unlock_page(page);
+}
+
+/*
+ * A variant of track_gup_page() that returns -EBUSY, instead of waiting.
+ */
+static int track_gup_page_atomic(struct page *page)
+{
+	page = compound_head(page);
+
+	if (PageWriteback(page) || !trylock_page(page))
+		return -EBUSY;
+
+	if (PageWriteback(page)) {
+		unlock_page(page);
+		return -EBUSY;
+	}
+	atomic_inc(&page->_mapcount);
+	SetPageGupPinned(page);
+
+	unlock_page(page);
+	return 0;
+}
+
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:	task_struct of target task
@@ -761,6 +803,9 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 			ret = PTR_ERR(page);
 			goto out;
 		}
+
+		track_gup_page(page);
+
 		if (pages) {
 			pages[i] = page;
 			flush_anon_page(vma, page, start);
@@ -1439,6 +1484,11 @@ static int gup_pte_range(pmd_t pmd, unsigned long addr, unsigned long end,
 
 		VM_BUG_ON_PAGE(compound_head(page) != head, page);
 
+		if (track_gup_page_atomic(page)) {
+			put_page(head);
+			goto pte_unmap;
+		}
+
 		SetPageReferenced(page);
 		pages[*nr] = page;
 		(*nr)++;
@@ -1574,7 +1624,8 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr,
 		return 0;
 	}
 
-	if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) {
+	if (unlikely(pmd_val(orig) != pmd_val(*pmdp)) ||
+	    track_gup_page_atomic(head)) {
 		*nr -= refs;
 		while (refs--)
 			put_page(head);
@@ -1612,7 +1663,8 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr,
 		return 0;
 	}
 
-	if (unlikely(pud_val(orig) != pud_val(*pudp))) {
+	if (unlikely(pud_val(orig) != pud_val(*pudp)) ||
+	    track_gup_page_atomic(head)) {
 		*nr -= refs;
 		while (refs--)
 			put_page(head);
@@ -1649,7 +1701,8 @@ static int gup_huge_pgd(pgd_t orig, pgd_t *pgdp, unsigned long addr,
 		return 0;
 	}
 
-	if (unlikely(pgd_val(orig) != pgd_val(*pgdp))) {
+	if (unlikely(pgd_val(orig) != pgd_val(*pgdp)) ||
+	    track_gup_page_atomic(head)) {
 		*nr -= refs;
 		while (refs--)
 			put_page(head);
diff --git a/mm/rmap.c b/mm/rmap.c
index 0454ecc29537..434283898bb0 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -880,6 +880,11 @@ int page_referenced(struct page *page,
 	return pra.referenced;
 }
 
+struct page_mkclean_args {
+	int cleaned;
+	int mapcount;
+};
+
 static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
 			    unsigned long address, void *arg)
 {
@@ -890,7 +895,7 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
 		.flags = PVMW_SYNC,
 	};
 	struct mmu_notifier_range range;
-	int *cleaned = arg;
+	struct page_mkclean_args *pma = arg;
 
 	/*
 	 * We have to assume the worse case ie pmd for invalidation. Note that
@@ -940,6 +945,8 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
 #endif
 		}
 
+		pma->mapcount++;
+
 		/*
 		 * No need to call mmu_notifier_invalidate_range() as we are
 		 * downgrading page table protection not changing it to point
@@ -948,7 +955,7 @@ static bool page_mkclean_one(struct page *page, struct vm_area_struct *vma,
 		 * See Documentation/vm/mmu_notifier.rst
 		 */
 		if (ret)
-			(*cleaned)++;
+			pma->cleaned++;
 	}
 
 	mmu_notifier_invalidate_range_end(&range);
@@ -966,10 +973,13 @@ static bool invalid_mkclean_vma(struct vm_area_struct *vma, void *arg)
 
 int page_mkclean(struct page *page)
 {
-	int cleaned = 0;
+	struct page_mkclean_args pma = {
+		.cleaned = 0,
+		.mapcount = 0
+	};
 	struct address_space *mapping;
 	struct rmap_walk_control rwc = {
-		.arg = (void *)&cleaned,
+		.arg = (void *)&pma,
 		.rmap_one = page_mkclean_one,
 		.invalid_vma = invalid_mkclean_vma,
 	};
@@ -985,7 +995,10 @@ int page_mkclean(struct page *page)
 
 	rmap_walk(page, &rwc);
 
-	return cleaned;
+	if (pma.mapcount == page_mapcount(page))
+		ClearPageGupPinned(page);
+
+	return pma.cleaned;
 }
 EXPORT_SYMBOL_GPL(page_mkclean);
 
-- 
2.20.1



thanks,
-- 
John Hubbard
NVIDIA