![Linus Torvalds](/assets/img/avatar_default.png)
It's really not right to use 'access_ok()', since that is meant for the normal "get_user()" and "copy_from/to_user()" accesses, which are done through the TLB, rather than through the page tables. Why? access_ok() does both too few, and too many checks. Too many, because it is meant for regular kernel accesses that will not honor the 'user' bit in the page tables, and because it honors the USER_DS vs KERNEL_DS distinction that we shouldn't care about in GUP. And too few, because it doesn't do the 'canonical' check on the address on x86-64, since the TLB will do that for us. So instead of using a function that isn't meant for this, and does something else and much more complicated, just do the real rules: we don't want the range to overflow, and on x86-64, we want it to be a canonical low address (on 32-bit, all addresses are canonical). Acked-by: Ingo Molnar <mingo@elte.hu> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
320 lines
7.9 KiB
C
320 lines
7.9 KiB
C
/*
|
|
* Lockless get_user_pages_fast for x86
|
|
*
|
|
* Copyright (C) 2008 Nick Piggin
|
|
* Copyright (C) 2008 Novell Inc.
|
|
*/
|
|
#include <linux/sched.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/vmstat.h>
|
|
#include <linux/highmem.h>
|
|
|
|
#include <asm/pgtable.h>
|
|
|
|
static inline pte_t gup_get_pte(pte_t *ptep)
|
|
{
|
|
#ifndef CONFIG_X86_PAE
|
|
return *ptep;
|
|
#else
|
|
/*
|
|
* With get_user_pages_fast, we walk down the pagetables without taking
|
|
* any locks. For this we would like to load the pointers atoimcally,
|
|
* but that is not possible (without expensive cmpxchg8b) on PAE. What
|
|
* we do have is the guarantee that a pte will only either go from not
|
|
* present to present, or present to not present or both -- it will not
|
|
* switch to a completely different present page without a TLB flush in
|
|
* between; something that we are blocking by holding interrupts off.
|
|
*
|
|
* Setting ptes from not present to present goes:
|
|
* ptep->pte_high = h;
|
|
* smp_wmb();
|
|
* ptep->pte_low = l;
|
|
*
|
|
* And present to not present goes:
|
|
* ptep->pte_low = 0;
|
|
* smp_wmb();
|
|
* ptep->pte_high = 0;
|
|
*
|
|
* We must ensure here that the load of pte_low sees l iff pte_high
|
|
* sees h. We load pte_high *after* loading pte_low, which ensures we
|
|
* don't see an older value of pte_high. *Then* we recheck pte_low,
|
|
* which ensures that we haven't picked up a changed pte high. We might
|
|
* have got rubbish values from pte_low and pte_high, but we are
|
|
* guaranteed that pte_low will not have the present bit set *unless*
|
|
* it is 'l'. And get_user_pages_fast only operates on present ptes, so
|
|
* we're safe.
|
|
*
|
|
* gup_get_pte should not be used or copied outside gup.c without being
|
|
* very careful -- it does not atomically load the pte or anything that
|
|
* is likely to be useful for you.
|
|
*/
|
|
pte_t pte;
|
|
|
|
retry:
|
|
pte.pte_low = ptep->pte_low;
|
|
smp_rmb();
|
|
pte.pte_high = ptep->pte_high;
|
|
smp_rmb();
|
|
if (unlikely(pte.pte_low != ptep->pte_low))
|
|
goto retry;
|
|
|
|
return pte;
|
|
#endif
|
|
}
|
|
|
|
/*
|
|
* The performance critical leaf functions are made noinline otherwise gcc
|
|
* inlines everything into a single function which results in too much
|
|
* register pressure.
|
|
*/
|
|
static noinline int gup_pte_range(pmd_t pmd, unsigned long addr,
|
|
unsigned long end, int write, struct page **pages, int *nr)
|
|
{
|
|
unsigned long mask;
|
|
pte_t *ptep;
|
|
|
|
mask = _PAGE_PRESENT|_PAGE_USER;
|
|
if (write)
|
|
mask |= _PAGE_RW;
|
|
|
|
ptep = pte_offset_map(&pmd, addr);
|
|
do {
|
|
pte_t pte = gup_get_pte(ptep);
|
|
struct page *page;
|
|
|
|
if ((pte_flags(pte) & (mask | _PAGE_SPECIAL)) != mask) {
|
|
pte_unmap(ptep);
|
|
return 0;
|
|
}
|
|
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
|
|
page = pte_page(pte);
|
|
get_page(page);
|
|
pages[*nr] = page;
|
|
(*nr)++;
|
|
|
|
} while (ptep++, addr += PAGE_SIZE, addr != end);
|
|
pte_unmap(ptep - 1);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static inline void get_head_page_multiple(struct page *page, int nr)
|
|
{
|
|
VM_BUG_ON(page != compound_head(page));
|
|
VM_BUG_ON(page_count(page) == 0);
|
|
atomic_add(nr, &page->_count);
|
|
}
|
|
|
|
static noinline int gup_huge_pmd(pmd_t pmd, unsigned long addr,
|
|
unsigned long end, int write, struct page **pages, int *nr)
|
|
{
|
|
unsigned long mask;
|
|
pte_t pte = *(pte_t *)&pmd;
|
|
struct page *head, *page;
|
|
int refs;
|
|
|
|
mask = _PAGE_PRESENT|_PAGE_USER;
|
|
if (write)
|
|
mask |= _PAGE_RW;
|
|
if ((pte_flags(pte) & mask) != mask)
|
|
return 0;
|
|
/* hugepages are never "special" */
|
|
VM_BUG_ON(pte_flags(pte) & _PAGE_SPECIAL);
|
|
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
|
|
|
|
refs = 0;
|
|
head = pte_page(pte);
|
|
page = head + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
|
|
do {
|
|
VM_BUG_ON(compound_head(page) != head);
|
|
pages[*nr] = page;
|
|
(*nr)++;
|
|
page++;
|
|
refs++;
|
|
} while (addr += PAGE_SIZE, addr != end);
|
|
get_head_page_multiple(head, refs);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int gup_pmd_range(pud_t pud, unsigned long addr, unsigned long end,
|
|
int write, struct page **pages, int *nr)
|
|
{
|
|
unsigned long next;
|
|
pmd_t *pmdp;
|
|
|
|
pmdp = pmd_offset(&pud, addr);
|
|
do {
|
|
pmd_t pmd = *pmdp;
|
|
|
|
next = pmd_addr_end(addr, end);
|
|
if (pmd_none(pmd))
|
|
return 0;
|
|
if (unlikely(pmd_large(pmd))) {
|
|
if (!gup_huge_pmd(pmd, addr, next, write, pages, nr))
|
|
return 0;
|
|
} else {
|
|
if (!gup_pte_range(pmd, addr, next, write, pages, nr))
|
|
return 0;
|
|
}
|
|
} while (pmdp++, addr = next, addr != end);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static noinline int gup_huge_pud(pud_t pud, unsigned long addr,
|
|
unsigned long end, int write, struct page **pages, int *nr)
|
|
{
|
|
unsigned long mask;
|
|
pte_t pte = *(pte_t *)&pud;
|
|
struct page *head, *page;
|
|
int refs;
|
|
|
|
mask = _PAGE_PRESENT|_PAGE_USER;
|
|
if (write)
|
|
mask |= _PAGE_RW;
|
|
if ((pte_flags(pte) & mask) != mask)
|
|
return 0;
|
|
/* hugepages are never "special" */
|
|
VM_BUG_ON(pte_flags(pte) & _PAGE_SPECIAL);
|
|
VM_BUG_ON(!pfn_valid(pte_pfn(pte)));
|
|
|
|
refs = 0;
|
|
head = pte_page(pte);
|
|
page = head + ((addr & ~PUD_MASK) >> PAGE_SHIFT);
|
|
do {
|
|
VM_BUG_ON(compound_head(page) != head);
|
|
pages[*nr] = page;
|
|
(*nr)++;
|
|
page++;
|
|
refs++;
|
|
} while (addr += PAGE_SIZE, addr != end);
|
|
get_head_page_multiple(head, refs);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
|
|
int write, struct page **pages, int *nr)
|
|
{
|
|
unsigned long next;
|
|
pud_t *pudp;
|
|
|
|
pudp = pud_offset(&pgd, addr);
|
|
do {
|
|
pud_t pud = *pudp;
|
|
|
|
next = pud_addr_end(addr, end);
|
|
if (pud_none(pud))
|
|
return 0;
|
|
if (unlikely(pud_large(pud))) {
|
|
if (!gup_huge_pud(pud, addr, next, write, pages, nr))
|
|
return 0;
|
|
} else {
|
|
if (!gup_pmd_range(pud, addr, next, write, pages, nr))
|
|
return 0;
|
|
}
|
|
} while (pudp++, addr = next, addr != end);
|
|
|
|
return 1;
|
|
}
|
|
|
|
/**
|
|
* get_user_pages_fast() - pin user pages in memory
|
|
* @start: starting user address
|
|
* @nr_pages: number of pages from start to pin
|
|
* @write: whether pages will be written to
|
|
* @pages: array that receives pointers to the pages pinned.
|
|
* Should be at least nr_pages long.
|
|
*
|
|
* Attempt to pin user pages in memory without taking mm->mmap_sem.
|
|
* If not successful, it will fall back to taking the lock and
|
|
* calling get_user_pages().
|
|
*
|
|
* Returns number of pages pinned. This may be fewer than the number
|
|
* requested. If nr_pages is 0 or negative, returns 0. If no pages
|
|
* were pinned, returns -errno.
|
|
*/
|
|
int get_user_pages_fast(unsigned long start, int nr_pages, int write,
|
|
struct page **pages)
|
|
{
|
|
struct mm_struct *mm = current->mm;
|
|
unsigned long addr, len, end;
|
|
unsigned long next;
|
|
pgd_t *pgdp;
|
|
int nr = 0;
|
|
|
|
start &= PAGE_MASK;
|
|
addr = start;
|
|
len = (unsigned long) nr_pages << PAGE_SHIFT;
|
|
|
|
end = start + len;
|
|
if (end < start)
|
|
goto slow_irqon;
|
|
|
|
#ifdef CONFIG_X86_64
|
|
if (end >> __VIRTUAL_MASK_SHIFT)
|
|
goto slow_irqon;
|
|
#endif
|
|
|
|
/*
|
|
* XXX: batch / limit 'nr', to avoid large irq off latency
|
|
* needs some instrumenting to determine the common sizes used by
|
|
* important workloads (eg. DB2), and whether limiting the batch size
|
|
* will decrease performance.
|
|
*
|
|
* It seems like we're in the clear for the moment. Direct-IO is
|
|
* the main guy that batches up lots of get_user_pages, and even
|
|
* they are limited to 64-at-a-time which is not so many.
|
|
*/
|
|
/*
|
|
* This doesn't prevent pagetable teardown, but does prevent
|
|
* the pagetables and pages from being freed on x86.
|
|
*
|
|
* So long as we atomically load page table pointers versus teardown
|
|
* (which we do on x86, with the above PAE exception), we can follow the
|
|
* address down to the the page and take a ref on it.
|
|
*/
|
|
local_irq_disable();
|
|
pgdp = pgd_offset(mm, addr);
|
|
do {
|
|
pgd_t pgd = *pgdp;
|
|
|
|
next = pgd_addr_end(addr, end);
|
|
if (pgd_none(pgd))
|
|
goto slow;
|
|
if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
|
|
goto slow;
|
|
} while (pgdp++, addr = next, addr != end);
|
|
local_irq_enable();
|
|
|
|
VM_BUG_ON(nr != (end - start) >> PAGE_SHIFT);
|
|
return nr;
|
|
|
|
{
|
|
int ret;
|
|
|
|
slow:
|
|
local_irq_enable();
|
|
slow_irqon:
|
|
/* Try to get the remaining pages with get_user_pages */
|
|
start += nr << PAGE_SHIFT;
|
|
pages += nr;
|
|
|
|
down_read(&mm->mmap_sem);
|
|
ret = get_user_pages(current, mm, start,
|
|
(end - start) >> PAGE_SHIFT, write, 0, pages, NULL);
|
|
up_read(&mm->mmap_sem);
|
|
|
|
/* Have to be a bit careful with return values */
|
|
if (nr > 0) {
|
|
if (ret < 0)
|
|
ret = nr;
|
|
else
|
|
ret += nr;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
}
|