[linux.git] / mm / mremap.c

/*
 *	mm/mremap.c
 *
 *	(C) Copyright 1996 Linus Torvalds
 *
 *	Address space accounting code	<[email protected]>
 *	(C) Copyright 2002 Red Hat Inc, All Rights Reserved
 */

#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/shm.h>
#include <linux/ksm.h>
#include <linux/mman.h>
#include <linux/swap.h>
#include <linux/capability.h>
#include <linux/fs.h>
#include <linux/swapops.h>
#include <linux/highmem.h>
#include <linux/security.h>
#include <linux/syscalls.h>
#include <linux/mmu_notifier.h>
#include <linux/sched/sysctl.h>
#include <linux/uaccess.h>
#include <linux/mm-arch-hooks.h>

#include <asm/cacheflush.h>
#include <asm/tlbflush.h>

#include "internal.h"

static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
{
	pgd_t *pgd;
	pud_t *pud;
	pmd_t *pmd;

	pgd = pgd_offset(mm, addr);
	if (pgd_none_or_clear_bad(pgd))
		return NULL;

	pud = pud_offset(pgd, addr);
	if (pud_none_or_clear_bad(pud))
		return NULL;

	pmd = pmd_offset(pud, addr);
	if (pmd_none(*pmd))
		return NULL;

	return pmd;
}

static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
			    unsigned long addr)
{
	pgd_t *pgd;
	pud_t *pud;
	pmd_t *pmd;

	pgd = pgd_offset(mm, addr);
	pud = pud_alloc(mm, pgd, addr);
	if (!pud)
		return NULL;

	pmd = pmd_alloc(mm, pud, addr);
	if (!pmd)
		return NULL;

	VM_BUG_ON(pmd_trans_huge(*pmd));

	return pmd;
}

static pte_t move_soft_dirty_pte(pte_t pte)
{
	/*
	 * Set soft dirty bit so we can notice
	 * in userspace the ptes were moved.
	 */
#ifdef CONFIG_MEM_SOFT_DIRTY
	if (pte_present(pte))
		pte = pte_mksoft_dirty(pte);
	else if (is_swap_pte(pte))
		pte = pte_swp_mksoft_dirty(pte);
#endif
	return pte;
}

static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
		unsigned long old_addr, unsigned long old_end,
		struct vm_area_struct *new_vma, pmd_t *new_pmd,
		unsigned long new_addr, bool need_rmap_locks)
{
	struct address_space *mapping = NULL;
	struct anon_vma *anon_vma = NULL;
	struct mm_struct *mm = vma->vm_mm;
	pte_t *old_pte, *new_pte, pte;
	spinlock_t *old_ptl, *new_ptl;

	/*
	 * When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma
	 * locks to ensure that rmap will always observe either the old or the
	 * new ptes. This is the easiest way to avoid races with
	 * truncate_pagecache(), page migration, etc...
	 *
	 * When need_rmap_locks is false, we use other ways to avoid
	 * such races:
	 *
	 * - During exec() shift_arg_pages(), we use a specially tagged vma
	 *   which rmap call sites look for using is_vma_temporary_stack().
	 *
	 * - During mremap(), new_vma is often known to be placed after vma
	 *   in rmap traversal order. This ensures rmap will always observe
	 *   either the old pte, or the new pte, or both (the page table locks
	 *   serialize access to individual ptes, but only rmap traversal
	 *   order guarantees that we won't miss both the old and new ptes).
	 */
	if (need_rmap_locks) {
		if (vma->vm_file) {
			mapping = vma->vm_file->f_mapping;
			i_mmap_lock_write(mapping);
		}
		if (vma->anon_vma) {
			anon_vma = vma->anon_vma;
			anon_vma_lock_write(anon_vma);
		}
	}

	/*
	 * We don't have to worry about the ordering of src and dst
	 * pte locks because exclusive mmap_sem prevents deadlock.
	 */
	old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl);
	new_pte = pte_offset_map(new_pmd, new_addr);
	new_ptl = pte_lockptr(mm, new_pmd);
	if (new_ptl != old_ptl)
		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
	arch_enter_lazy_mmu_mode();

	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
				   new_pte++, new_addr += PAGE_SIZE) {
		if (pte_none(*old_pte))
			continue;
		pte = ptep_get_and_clear(mm, old_addr, old_pte);
		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
		pte = move_soft_dirty_pte(pte);
		set_pte_at(mm, new_addr, new_pte, pte);
	}

	arch_leave_lazy_mmu_mode();
	if (new_ptl != old_ptl)
		spin_unlock(new_ptl);
	pte_unmap(new_pte - 1);
	pte_unmap_unlock(old_pte - 1, old_ptl);
	if (anon_vma)
		anon_vma_unlock_write(anon_vma);
	if (mapping)
		i_mmap_unlock_write(mapping);
}

#define LATENCY_LIMIT	(64 * PAGE_SIZE)

unsigned long move_page_tables(struct vm_area_struct *vma,
		unsigned long old_addr, struct vm_area_struct *new_vma,
		unsigned long new_addr, unsigned long len,
		bool need_rmap_locks)
{
	unsigned long extent, next, old_end;
	pmd_t *old_pmd, *new_pmd;
	bool need_flush = false;
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */

	old_end = old_addr + len;
	flush_cache_range(vma, old_addr, old_end);

	mmun_start = old_addr;
	mmun_end   = old_end;
	mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end);

	for (; old_addr < old_end; old_addr += extent, new_addr += extent) {
		cond_resched();
		next = (old_addr + PMD_SIZE) & PMD_MASK;
		/* even if next overflowed, extent below will be ok */
		extent = next - old_addr;
		if (extent > old_end - old_addr)
			extent = old_end - old_addr;
		old_pmd = get_old_pmd(vma->vm_mm, old_addr);
		if (!old_pmd)
			continue;
		new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
		if (!new_pmd)
			break;
		if (pmd_trans_huge(*old_pmd)) {
			int err = 0;
			if (extent == HPAGE_PMD_SIZE) {
				VM_BUG_ON_VMA(vma->vm_file || !vma->anon_vma,
					      vma);
				/* See comment in move_ptes() */
				if (need_rmap_locks)
					anon_vma_lock_write(vma->anon_vma);
				err = move_huge_pmd(vma, new_vma, old_addr,
						    new_addr, old_end,
						    old_pmd, new_pmd);
				if (need_rmap_locks)
					anon_vma_unlock_write(vma->anon_vma);
			}
			if (err > 0) {
				need_flush = true;
				continue;
			} else if (!err) {
				split_huge_page_pmd(vma, old_addr, old_pmd);
			}
			VM_BUG_ON(pmd_trans_huge(*old_pmd));
		}
		if (pmd_none(*new_pmd) && __pte_alloc(new_vma->vm_mm, new_vma,
						      new_pmd, new_addr))
			break;
		next = (new_addr + PMD_SIZE) & PMD_MASK;
		if (extent > next - new_addr)
			extent = next - new_addr;
		if (extent > LATENCY_LIMIT)
			extent = LATENCY_LIMIT;
		move_ptes(vma, old_pmd, old_addr, old_addr + extent,
			  new_vma, new_pmd, new_addr, need_rmap_locks);
		need_flush = true;
	}
	if (likely(need_flush))
		flush_tlb_range(vma, old_end-len, old_addr);

	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);

	return len + old_addr - old_end;	/* how much done */
}

static unsigned long move_vma(struct vm_area_struct *vma,
		unsigned long old_addr, unsigned long old_len,
		unsigned long new_len, unsigned long new_addr, bool *locked)
{
	struct mm_struct *mm = vma->vm_mm;
	struct vm_area_struct *new_vma;
	unsigned long vm_flags = vma->vm_flags;
	unsigned long new_pgoff;
	unsigned long moved_len;
	unsigned long excess = 0;
	unsigned long hiwater_vm;
	int split = 0;
	int err;
	bool need_rmap_locks;

	/*
	 * We'd prefer to avoid failure later on in do_munmap:
	 * which may split one vma into three before unmapping.
	 */
	if (mm->map_count >= sysctl_max_map_count - 3)
		return -ENOMEM;

	/*
	 * Advise KSM to break any KSM pages in the area to be moved:
	 * it would be confusing if they were to turn up at the new
	 * location, where they happen to coincide with different KSM
	 * pages recently unmapped.  But leave vma->vm_flags as it was,
	 * so KSM can come around to merge on vma and new_vma afterwards.
	 */
	err = ksm_madvise(vma, old_addr, old_addr + old_len,
						MADV_UNMERGEABLE, &vm_flags);
	if (err)
		return err;

	new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT);
	new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff,
			   &need_rmap_locks);
	if (!new_vma)
		return -ENOMEM;

	moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len,
				     need_rmap_locks);
	if (moved_len < old_len) {
		/*
		 * On error, move entries back from new area to old,
		 * which will succeed since page tables still there,
		 * and then proceed to unmap new area instead of old.
		 */
		move_page_tables(new_vma, new_addr, vma, old_addr, moved_len,
				 true);
		vma = new_vma;
		old_len = new_len;
		old_addr = new_addr;
		new_addr = -ENOMEM;
	} else {
		if (vma->vm_file && vma->vm_file->f_op->mremap) {
			err = vma->vm_file->f_op->mremap(vma->vm_file, new_vma);
			if (err < 0) {
				move_page_tables(new_vma, new_addr, vma,
						 old_addr, moved_len, true);
				return err;
			}
		}
		arch_remap(mm, old_addr, old_addr + old_len,
			   new_addr, new_addr + new_len);
	}

	/* Conceal VM_ACCOUNT so old reservation is not undone */
	if (vm_flags & VM_ACCOUNT) {
		vma->vm_flags &= ~VM_ACCOUNT;
		excess = vma->vm_end - vma->vm_start - old_len;
		if (old_addr > vma->vm_start &&
		    old_addr + old_len < vma->vm_end)
			split = 1;
	}

	/*
	 * If we failed to move page tables we still do total_vm increment
	 * since do_munmap() will decrement it by old_len == new_len.
	 *
	 * Since total_vm is about to be raised artificially high for a
	 * moment, we need to restore high watermark afterwards: if stats
	 * are taken meanwhile, total_vm and hiwater_vm appear too high.
	 * If this were a serious issue, we'd add a flag to do_munmap().
	 */
	hiwater_vm = mm->hiwater_vm;
	vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);

	if (do_munmap(mm, old_addr, old_len) < 0) {
		/* OOM: unable to split vma, just get accounts right */
		vm_unacct_memory(excess >> PAGE_SHIFT);
		excess = 0;
	}
	mm->hiwater_vm = hiwater_vm;

	/* Restore VM_ACCOUNT if one or two pieces of vma left */
	if (excess) {
		vma->vm_flags |= VM_ACCOUNT;
		if (split)
			vma->vm_next->vm_flags |= VM_ACCOUNT;
	}

	if (vm_flags & VM_LOCKED) {
		mm->locked_vm += new_len >> PAGE_SHIFT;
		*locked = true;
	}

	return new_addr;
}

static struct vm_area_struct *vma_to_resize(unsigned long addr,
	unsigned long old_len, unsigned long new_len, unsigned long *p)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma = find_vma(mm, addr);

	if (!vma || vma->vm_start > addr)
		return ERR_PTR(-EFAULT);

	if (is_vm_hugetlb_page(vma))
		return ERR_PTR(-EINVAL);

	/* We can't remap across vm area boundaries */
	if (old_len > vma->vm_end - addr)
		return ERR_PTR(-EFAULT);

	/* Need to be careful about a growing mapping */
	if (new_len > old_len) {
		unsigned long pgoff;

		if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
			return ERR_PTR(-EFAULT);
		pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
		pgoff += vma->vm_pgoff;
		if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
			return ERR_PTR(-EINVAL);
	}

	if (vma->vm_flags & VM_LOCKED) {
		unsigned long locked, lock_limit;
		locked = mm->locked_vm << PAGE_SHIFT;
		lock_limit = rlimit(RLIMIT_MEMLOCK);
		locked += new_len - old_len;
		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
			return ERR_PTR(-EAGAIN);
	}

	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
		return ERR_PTR(-ENOMEM);

	if (vma->vm_flags & VM_ACCOUNT) {
		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
		if (security_vm_enough_memory_mm(mm, charged))
			return ERR_PTR(-ENOMEM);
		*p = charged;
	}

	return vma;
}

static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
		unsigned long new_addr, unsigned long new_len, bool *locked)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma;
	unsigned long ret = -EINVAL;
	unsigned long charged = 0;
	unsigned long map_flags;

	if (new_addr & ~PAGE_MASK)
		goto out;

	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
		goto out;

	/* Check if the location we're moving into overlaps the
	 * old location at all, and fail if it does.
	 */
	if ((new_addr <= addr) && (new_addr+new_len) > addr)
		goto out;

	if ((addr <= new_addr) && (addr+old_len) > new_addr)
		goto out;

	ret = do_munmap(mm, new_addr, new_len);
	if (ret)
		goto out;

	if (old_len >= new_len) {
		ret = do_munmap(mm, addr+new_len, old_len - new_len);
		if (ret && old_len != new_len)
			goto out;
		old_len = new_len;
	}

	vma = vma_to_resize(addr, old_len, new_len, &charged);
	if (IS_ERR(vma)) {
		ret = PTR_ERR(vma);
		goto out;
	}

	map_flags = MAP_FIXED;
	if (vma->vm_flags & VM_MAYSHARE)
		map_flags |= MAP_SHARED;

	ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff +
				((addr - vma->vm_start) >> PAGE_SHIFT),
				map_flags);
	if (ret & ~PAGE_MASK)
		goto out1;

	ret = move_vma(vma, addr, old_len, new_len, new_addr, locked);
	if (!(ret & ~PAGE_MASK))
		goto out;
out1:
	vm_unacct_memory(charged);

out:
	return ret;
}

static int vma_expandable(struct vm_area_struct *vma, unsigned long delta)
{
	unsigned long end = vma->vm_end + delta;
	if (end < vma->vm_end) /* overflow */
		return 0;
	if (vma->vm_next && vma->vm_next->vm_start < end) /* intersection */
		return 0;
	if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start,
			      0, MAP_FIXED) & ~PAGE_MASK)
		return 0;
	return 1;
}

/*
 * Expand (or shrink) an existing mapping, potentially moving it at the
 * same time (controlled by the MREMAP_MAYMOVE flag and available VM space)
 *
 * MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise
 * This option implies MREMAP_MAYMOVE.
 */
SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
		unsigned long, new_len, unsigned long, flags,
		unsigned long, new_addr)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma;
	unsigned long ret = -EINVAL;
	unsigned long charged = 0;
	bool locked = false;

	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
		return ret;

	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
		return ret;

	if (addr & ~PAGE_MASK)
		return ret;

	old_len = PAGE_ALIGN(old_len);
	new_len = PAGE_ALIGN(new_len);

	/*
	 * We allow a zero old-len as a special case
	 * for DOS-emu "duplicate shm area" thing. But
	 * a zero new-len is nonsensical.
	 */
	if (!new_len)
		return ret;

	down_write(&current->mm->mmap_sem);

	if (flags & MREMAP_FIXED) {
		ret = mremap_to(addr, old_len, new_addr, new_len,
				&locked);
		goto out;
	}

	/*
	 * Always allow a shrinking remap: that just unmaps
	 * the unnecessary pages..
	 * do_munmap does all the needed commit accounting
	 */
	if (old_len >= new_len) {
		ret = do_munmap(mm, addr+new_len, old_len - new_len);
		if (ret && old_len != new_len)
			goto out;
		ret = addr;
		goto out;
	}

	/*
	 * Ok, we need to grow..
	 */
	vma = vma_to_resize(addr, old_len, new_len, &charged);
	if (IS_ERR(vma)) {
		ret = PTR_ERR(vma);
		goto out;
	}

	/* old_len exactly to the end of the area..
	 */
	if (old_len == vma->vm_end - addr) {
		/* can we just expand the current mapping? */
		if (vma_expandable(vma, new_len - old_len)) {
			int pages = (new_len - old_len) >> PAGE_SHIFT;

			if (vma_adjust(vma, vma->vm_start, addr + new_len,
				       vma->vm_pgoff, NULL)) {
				ret = -ENOMEM;
				goto out;
			}

			vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages);
			if (vma->vm_flags & VM_LOCKED) {
				mm->locked_vm += pages;
				locked = true;
				new_addr = addr;
			}
			ret = addr;
			goto out;
		}
	}

	/*
	 * We weren't able to just expand or shrink the area,
	 * we need to create a new one and move it..
	 */
	ret = -ENOMEM;
	if (flags & MREMAP_MAYMOVE) {
		unsigned long map_flags = 0;
		if (vma->vm_flags & VM_MAYSHARE)
			map_flags |= MAP_SHARED;

		new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
					vma->vm_pgoff +
					((addr - vma->vm_start) >> PAGE_SHIFT),
					map_flags);
		if (new_addr & ~PAGE_MASK) {
			ret = new_addr;
			goto out;
		}

		ret = move_vma(vma, addr, old_len, new_len, new_addr, &locked);
	}
out:
	if (ret & ~PAGE_MASK)
		vm_unacct_memory(charged);
	up_write(&current->mm->mmap_sem);
	if (locked && new_len > old_len)
		mm_populate(new_addr + old_len, new_len - old_len);
	return ret;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* mm/mremap.c
	3	*
	4	* (C) Copyright 1996 Linus Torvalds
	5	*
046c6884	6	* Address space accounting code <[email protected]>
1da177e4 LT	7	* (C) Copyright 2002 Red Hat Inc, All Rights Reserved
	8	*/
	9
	10	#include <linux/mm.h>
	11	#include <linux/hugetlb.h>
1da177e4	12	#include <linux/shm.h>
1ff82995	13	#include <linux/ksm.h>
1da177e4 LT	14	#include <linux/mman.h>
1da177e4 LT	15	#include <linux/swap.h>
c59ede7b	16	#include <linux/capability.h>
1da177e4	17	#include <linux/fs.h>
6dec97dc	18	#include <linux/swapops.h>
1da177e4 LT	19	#include <linux/highmem.h>
	20	#include <linux/security.h>
	21	#include <linux/syscalls.h>
cddb8a5c	22	#include <linux/mmu_notifier.h>
cf4aebc2	23	#include <linux/sched/sysctl.h>
2581d202	24	#include <linux/uaccess.h>
4abad2ca	25	#include <linux/mm-arch-hooks.h>
1da177e4	26
1da177e4 LT	27	#include <asm/cacheflush.h>
	28	#include <asm/tlbflush.h>
	29
ba470de4 RR	30	#include "internal.h"
ba470de4 RR	31
7be7a546	32	static pmd_t get_old_pmd(struct mm_struct mm, unsigned long addr)
1da177e4 LT	33	{
	34	pgd_t *pgd;
	35	pud_t *pud;
	36	pmd_t *pmd;
	37
	38	pgd = pgd_offset(mm, addr);
	39	if (pgd_none_or_clear_bad(pgd))
	40	return NULL;
	41
	42	pud = pud_offset(pgd, addr);
	43	if (pud_none_or_clear_bad(pud))
	44	return NULL;
	45
	46	pmd = pmd_offset(pud, addr);
37a1c49a	47	if (pmd_none(*pmd))
1da177e4 LT	48	return NULL;
1da177e4 LT	49
7be7a546	50	return pmd;
1da177e4 LT	51	}
1da177e4 LT	52
8ac1f832 AA	53	static pmd_t alloc_new_pmd(struct mm_struct mm, struct vm_area_struct *vma,
8ac1f832 AA	54	unsigned long addr)
1da177e4 LT	55	{
	56	pgd_t *pgd;
	57	pud_t *pud;
c74df32c	58	pmd_t *pmd;
1da177e4 LT	59
1da177e4 LT	60	pgd = pgd_offset(mm, addr);
1da177e4 LT	61	pud = pud_alloc(mm, pgd, addr);
1da177e4 LT	62	if (!pud)
c74df32c	63	return NULL;
7be7a546	64
1da177e4	65	pmd = pmd_alloc(mm, pud, addr);
57a8f0cd	66	if (!pmd)
c74df32c	67	return NULL;
7be7a546	68
8ac1f832	69	VM_BUG_ON(pmd_trans_huge(*pmd));
c74df32c	70
7be7a546	71	return pmd;
1da177e4 LT	72	}
1da177e4 LT	73
6dec97dc CG	74	static pte_t move_soft_dirty_pte(pte_t pte)
	75	{
	76	/*
	77	* Set soft dirty bit so we can notice
	78	* in userspace the ptes were moved.
	79	*/
	80	#ifdef CONFIG_MEM_SOFT_DIRTY
	81	if (pte_present(pte))
	82	pte = pte_mksoft_dirty(pte);
	83	else if (is_swap_pte(pte))
	84	pte = pte_swp_mksoft_dirty(pte);
6dec97dc CG	85	#endif
	86	return pte;
	87	}
	88
7be7a546 HD	89	static void move_ptes(struct vm_area_struct vma, pmd_t old_pmd,
	90	unsigned long old_addr, unsigned long old_end,
	91	struct vm_area_struct new_vma, pmd_t new_pmd,
38a76013	92	unsigned long new_addr, bool need_rmap_locks)
1da177e4 LT	93	{
1da177e4 LT	94	struct address_space *mapping = NULL;
38a76013	95	struct anon_vma *anon_vma = NULL;
1da177e4	96	struct mm_struct *mm = vma->vm_mm;
7be7a546	97	pte_t old_pte, new_pte, pte;
4c21e2f2	98	spinlock_t old_ptl, new_ptl;
1da177e4	99
38a76013	100	/*
c8c06efa	101	* When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma
38a76013 ML	102	* locks to ensure that rmap will always observe either the old or the
	103	* new ptes. This is the easiest way to avoid races with
	104	* truncate_pagecache(), page migration, etc...
	105	*
	106	* When need_rmap_locks is false, we use other ways to avoid
	107	* such races:
	108	*
	109	* - During exec() shift_arg_pages(), we use a specially tagged vma
	110	* which rmap call sites look for using is_vma_temporary_stack().
	111	*
	112	* - During mremap(), new_vma is often known to be placed after vma
	113	* in rmap traversal order. This ensures rmap will always observe
	114	* either the old pte, or the new pte, or both (the page table locks
	115	* serialize access to individual ptes, but only rmap traversal
	116	* order guarantees that we won't miss both the old and new ptes).
	117	*/
	118	if (need_rmap_locks) {
	119	if (vma->vm_file) {
	120	mapping = vma->vm_file->f_mapping;
83cde9e8	121	i_mmap_lock_write(mapping);
38a76013 ML	122	}
	123	if (vma->anon_vma) {
	124	anon_vma = vma->anon_vma;
4fc3f1d6	125	anon_vma_lock_write(anon_vma);
38a76013	126	}
1da177e4	127	}
1da177e4	128
4c21e2f2 HD	129	/*
	130	* We don't have to worry about the ordering of src and dst
	131	* pte locks because exclusive mmap_sem prevents deadlock.
	132	*/
c74df32c	133	old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl);
ece0e2b6	134	new_pte = pte_offset_map(new_pmd, new_addr);
4c21e2f2 HD	135	new_ptl = pte_lockptr(mm, new_pmd);
4c21e2f2 HD	136	if (new_ptl != old_ptl)
f20dc5f7	137	spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
6606c3e0	138	arch_enter_lazy_mmu_mode();
7be7a546 HD	139
	140	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
	141	new_pte++, new_addr += PAGE_SIZE) {
	142	if (pte_none(*old_pte))
	143	continue;
7b6efc2b	144	pte = ptep_get_and_clear(mm, old_addr, old_pte);
7be7a546	145	pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
6dec97dc CG	146	pte = move_soft_dirty_pte(pte);
6dec97dc CG	147	set_pte_at(mm, new_addr, new_pte, pte);
1da177e4	148	}
7be7a546	149
6606c3e0	150	arch_leave_lazy_mmu_mode();
4c21e2f2 HD	151	if (new_ptl != old_ptl)
4c21e2f2 HD	152	spin_unlock(new_ptl);
ece0e2b6	153	pte_unmap(new_pte - 1);
c74df32c	154	pte_unmap_unlock(old_pte - 1, old_ptl);
108d6642	155	if (anon_vma)
08b52706	156	anon_vma_unlock_write(anon_vma);
1da177e4	157	if (mapping)
83cde9e8	158	i_mmap_unlock_write(mapping);
1da177e4 LT	159	}
1da177e4 LT	160
7be7a546 HD	161	#define LATENCY_LIMIT (64 * PAGE_SIZE)
7be7a546 HD	162
b6a2fea3	163	unsigned long move_page_tables(struct vm_area_struct *vma,
1da177e4	164	unsigned long old_addr, struct vm_area_struct *new_vma,
38a76013 ML	165	unsigned long new_addr, unsigned long len,
38a76013 ML	166	bool need_rmap_locks)
1da177e4	167	{
7be7a546 HD	168	unsigned long extent, next, old_end;
7be7a546 HD	169	pmd_t old_pmd, new_pmd;
7b6efc2b	170	bool need_flush = false;
2ec74c3e SG	171	unsigned long mmun_start; /* For mmu_notifiers */
2ec74c3e SG	172	unsigned long mmun_end; /* For mmu_notifiers */
1da177e4	173
7be7a546 HD	174	old_end = old_addr + len;
7be7a546 HD	175	flush_cache_range(vma, old_addr, old_end);
1da177e4	176
2ec74c3e SG	177	mmun_start = old_addr;
	178	mmun_end = old_end;
	179	mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end);
7b6efc2b	180
7be7a546	181	for (; old_addr < old_end; old_addr += extent, new_addr += extent) {
1da177e4	182	cond_resched();
7be7a546	183	next = (old_addr + PMD_SIZE) & PMD_MASK;
ebed4846	184	/* even if next overflowed, extent below will be ok */
7be7a546	185	extent = next - old_addr;
ebed4846 AA	186	if (extent > old_end - old_addr)
ebed4846 AA	187	extent = old_end - old_addr;
7be7a546 HD	188	old_pmd = get_old_pmd(vma->vm_mm, old_addr);
	189	if (!old_pmd)
	190	continue;
8ac1f832	191	new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
7be7a546 HD	192	if (!new_pmd)
7be7a546 HD	193	break;
37a1c49a AA	194	if (pmd_trans_huge(*old_pmd)) {
37a1c49a AA	195	int err = 0;
dd18dbc2	196	if (extent == HPAGE_PMD_SIZE) {
81d1b09c SL	197	VM_BUG_ON_VMA(vma->vm_file \|\| !vma->anon_vma,
81d1b09c SL	198	vma);
dd18dbc2 KS	199	/* See comment in move_ptes() */
	200	if (need_rmap_locks)
	201	anon_vma_lock_write(vma->anon_vma);
37a1c49a AA	202	err = move_huge_pmd(vma, new_vma, old_addr,
	203	new_addr, old_end,
	204	old_pmd, new_pmd);
dd18dbc2 KS	205	if (need_rmap_locks)
	206	anon_vma_unlock_write(vma->anon_vma);
	207	}
37a1c49a AA	208	if (err > 0) {
	209	need_flush = true;
	210	continue;
	211	} else if (!err) {
e180377f	212	split_huge_page_pmd(vma, old_addr, old_pmd);
37a1c49a AA	213	}
	214	VM_BUG_ON(pmd_trans_huge(*old_pmd));
	215	}
	216	if (pmd_none(*new_pmd) && __pte_alloc(new_vma->vm_mm, new_vma,
	217	new_pmd, new_addr))
	218	break;
7be7a546 HD	219	next = (new_addr + PMD_SIZE) & PMD_MASK;
	220	if (extent > next - new_addr)
	221	extent = next - new_addr;
	222	if (extent > LATENCY_LIMIT)
	223	extent = LATENCY_LIMIT;
	224	move_ptes(vma, old_pmd, old_addr, old_addr + extent,
38a76013	225	new_vma, new_pmd, new_addr, need_rmap_locks);
7b6efc2b	226	need_flush = true;
1da177e4	227	}
7b6efc2b AA	228	if (likely(need_flush))
	229	flush_tlb_range(vma, old_end-len, old_addr);
	230
2ec74c3e	231	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
7be7a546 HD	232
7be7a546 HD	233	return len + old_addr - old_end; /* how much done */
1da177e4 LT	234	}
	235
	236	static unsigned long move_vma(struct vm_area_struct *vma,
	237	unsigned long old_addr, unsigned long old_len,
81909b84	238	unsigned long new_len, unsigned long new_addr, bool *locked)
1da177e4 LT	239	{
	240	struct mm_struct *mm = vma->vm_mm;
	241	struct vm_area_struct *new_vma;
	242	unsigned long vm_flags = vma->vm_flags;
	243	unsigned long new_pgoff;
	244	unsigned long moved_len;
	245	unsigned long excess = 0;
365e9c87	246	unsigned long hiwater_vm;
1da177e4	247	int split = 0;
7103ad32	248	int err;
38a76013	249	bool need_rmap_locks;
1da177e4 LT	250
	251	/*
	252	* We'd prefer to avoid failure later on in do_munmap:
	253	* which may split one vma into three before unmapping.
	254	*/
	255	if (mm->map_count >= sysctl_max_map_count - 3)
	256	return -ENOMEM;
	257
1ff82995 HD	258	/*
	259	* Advise KSM to break any KSM pages in the area to be moved:
	260	* it would be confusing if they were to turn up at the new
	261	* location, where they happen to coincide with different KSM
	262	* pages recently unmapped. But leave vma->vm_flags as it was,
	263	* so KSM can come around to merge on vma and new_vma afterwards.
	264	*/
7103ad32 HD	265	err = ksm_madvise(vma, old_addr, old_addr + old_len,
	266	MADV_UNMERGEABLE, &vm_flags);
	267	if (err)
	268	return err;
1ff82995	269
1da177e4	270	new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT);
38a76013 ML	271	new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff,
38a76013 ML	272	&need_rmap_locks);
1da177e4 LT	273	if (!new_vma)
	274	return -ENOMEM;
	275
38a76013 ML	276	moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len,
38a76013 ML	277	need_rmap_locks);
1da177e4 LT	278	if (moved_len < old_len) {
	279	/*
	280	* On error, move entries back from new area to old,
	281	* which will succeed since page tables still there,
	282	* and then proceed to unmap new area instead of old.
	283	*/
38a76013 ML	284	move_page_tables(new_vma, new_addr, vma, old_addr, moved_len,
38a76013 ML	285	true);
1da177e4 LT	286	vma = new_vma;
	287	old_len = new_len;
	288	old_addr = new_addr;
	289	new_addr = -ENOMEM;
4abad2ca LD	290	} else {
	291	if (vma->vm_file && vma->vm_file->f_op->mremap) {
	292	err = vma->vm_file->f_op->mremap(vma->vm_file, new_vma);
	293	if (err < 0) {
	294	move_page_tables(new_vma, new_addr, vma,
	295	old_addr, moved_len, true);
	296	return err;
	297	}
b2edffdd	298	}
4abad2ca LD	299	arch_remap(mm, old_addr, old_addr + old_len,
4abad2ca LD	300	new_addr, new_addr + new_len);
b2edffdd	301	}
1da177e4 LT	302
	303	/* Conceal VM_ACCOUNT so old reservation is not undone */
	304	if (vm_flags & VM_ACCOUNT) {
	305	vma->vm_flags &= ~VM_ACCOUNT;
	306	excess = vma->vm_end - vma->vm_start - old_len;
	307	if (old_addr > vma->vm_start &&
	308	old_addr + old_len < vma->vm_end)
	309	split = 1;
	310	}
	311
71799062	312	/*
365e9c87 HD	313	* If we failed to move page tables we still do total_vm increment
	314	* since do_munmap() will decrement it by old_len == new_len.
	315	*
	316	* Since total_vm is about to be raised artificially high for a
	317	* moment, we need to restore high watermark afterwards: if stats
	318	* are taken meanwhile, total_vm and hiwater_vm appear too high.
	319	* If this were a serious issue, we'd add a flag to do_munmap().
71799062	320	*/
365e9c87	321	hiwater_vm = mm->hiwater_vm;
ab50b8ed	322	vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
71799062	323
1da177e4 LT	324	if (do_munmap(mm, old_addr, old_len) < 0) {
	325	/* OOM: unable to split vma, just get accounts right */
	326	vm_unacct_memory(excess >> PAGE_SHIFT);
	327	excess = 0;
	328	}
365e9c87	329	mm->hiwater_vm = hiwater_vm;
1da177e4 LT	330
	331	/* Restore VM_ACCOUNT if one or two pieces of vma left */
	332	if (excess) {
	333	vma->vm_flags \|= VM_ACCOUNT;
	334	if (split)
	335	vma->vm_next->vm_flags \|= VM_ACCOUNT;
	336	}
	337
1da177e4 LT	338	if (vm_flags & VM_LOCKED) {
1da177e4 LT	339	mm->locked_vm += new_len >> PAGE_SHIFT;
81909b84	340	*locked = true;
1da177e4 LT	341	}
	342
	343	return new_addr;
	344	}
	345
54f5de70 AV	346	static struct vm_area_struct *vma_to_resize(unsigned long addr,
	347	unsigned long old_len, unsigned long new_len, unsigned long *p)
	348	{
	349	struct mm_struct *mm = current->mm;
	350	struct vm_area_struct *vma = find_vma(mm, addr);
	351
	352	if (!vma \|\| vma->vm_start > addr)
6cd57613	353	return ERR_PTR(-EFAULT);
54f5de70 AV	354
54f5de70 AV	355	if (is_vm_hugetlb_page(vma))
6cd57613	356	return ERR_PTR(-EINVAL);
54f5de70 AV	357
	358	/* We can't remap across vm area boundaries */
	359	if (old_len > vma->vm_end - addr)
6cd57613	360	return ERR_PTR(-EFAULT);
54f5de70	361
982134ba LT	362	/* Need to be careful about a growing mapping */
	363	if (new_len > old_len) {
	364	unsigned long pgoff;
	365
	366	if (vma->vm_flags & (VM_DONTEXPAND \| VM_PFNMAP))
6cd57613	367	return ERR_PTR(-EFAULT);
982134ba LT	368	pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
	369	pgoff += vma->vm_pgoff;
	370	if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
6cd57613	371	return ERR_PTR(-EINVAL);
54f5de70 AV	372	}
	373
	374	if (vma->vm_flags & VM_LOCKED) {
	375	unsigned long locked, lock_limit;
	376	locked = mm->locked_vm << PAGE_SHIFT;
59e99e5b	377	lock_limit = rlimit(RLIMIT_MEMLOCK);
54f5de70 AV	378	locked += new_len - old_len;
54f5de70 AV	379	if (locked > lock_limit && !capable(CAP_IPC_LOCK))
6cd57613	380	return ERR_PTR(-EAGAIN);
54f5de70 AV	381	}
	382
	383	if (!may_expand_vm(mm, (new_len - old_len) >> PAGE_SHIFT))
6cd57613	384	return ERR_PTR(-ENOMEM);
54f5de70 AV	385
	386	if (vma->vm_flags & VM_ACCOUNT) {
	387	unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
191c5424	388	if (security_vm_enough_memory_mm(mm, charged))
6cd57613	389	return ERR_PTR(-ENOMEM);
54f5de70 AV	390	*p = charged;
	391	}
	392
	393	return vma;
54f5de70 AV	394	}
54f5de70 AV	395
81909b84 ML	396	static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
81909b84 ML	397	unsigned long new_addr, unsigned long new_len, bool *locked)
ecc1a899 AV	398	{
	399	struct mm_struct *mm = current->mm;
	400	struct vm_area_struct *vma;
	401	unsigned long ret = -EINVAL;
	402	unsigned long charged = 0;
097eed10	403	unsigned long map_flags;
ecc1a899 AV	404
	405	if (new_addr & ~PAGE_MASK)
	406	goto out;
	407
	408	if (new_len > TASK_SIZE \|\| new_addr > TASK_SIZE - new_len)
	409	goto out;
	410
	411	/* Check if the location we're moving into overlaps the
	412	* old location at all, and fail if it does.
	413	*/
	414	if ((new_addr <= addr) && (new_addr+new_len) > addr)
	415	goto out;
	416
	417	if ((addr <= new_addr) && (addr+old_len) > new_addr)
	418	goto out;
	419
ecc1a899 AV	420	ret = do_munmap(mm, new_addr, new_len);
	421	if (ret)
	422	goto out;
	423
	424	if (old_len >= new_len) {
	425	ret = do_munmap(mm, addr+new_len, old_len - new_len);
	426	if (ret && old_len != new_len)
	427	goto out;
	428	old_len = new_len;
	429	}
	430
	431	vma = vma_to_resize(addr, old_len, new_len, &charged);
	432	if (IS_ERR(vma)) {
	433	ret = PTR_ERR(vma);
	434	goto out;
	435	}
	436
097eed10 AV	437	map_flags = MAP_FIXED;
	438	if (vma->vm_flags & VM_MAYSHARE)
	439	map_flags \|= MAP_SHARED;
9206de95	440
097eed10 AV	441	ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff +
	442	((addr - vma->vm_start) >> PAGE_SHIFT),
	443	map_flags);
ecc1a899	444	if (ret & ~PAGE_MASK)
097eed10 AV	445	goto out1;
097eed10 AV	446
81909b84	447	ret = move_vma(vma, addr, old_len, new_len, new_addr, locked);
097eed10 AV	448	if (!(ret & ~PAGE_MASK))
	449	goto out;
	450	out1:
	451	vm_unacct_memory(charged);
ecc1a899 AV	452
	453	out:
	454	return ret;
	455	}
	456
1a0ef85f AV	457	static int vma_expandable(struct vm_area_struct *vma, unsigned long delta)
1a0ef85f AV	458	{
f106af4e	459	unsigned long end = vma->vm_end + delta;
9206de95	460	if (end < vma->vm_end) /* overflow */
f106af4e	461	return 0;
9206de95	462	if (vma->vm_next && vma->vm_next->vm_start < end) /* intersection */
f106af4e AV	463	return 0;
	464	if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start,
	465	0, MAP_FIXED) & ~PAGE_MASK)
1a0ef85f	466	return 0;
1a0ef85f AV	467	return 1;
	468	}
	469
1da177e4 LT	470	/*
	471	* Expand (or shrink) an existing mapping, potentially moving it at the
	472	* same time (controlled by the MREMAP_MAYMOVE flag and available VM space)
	473	*
	474	* MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise
	475	* This option implies MREMAP_MAYMOVE.
	476	*/
63a81db1 AV	477	SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
	478	unsigned long, new_len, unsigned long, flags,
	479	unsigned long, new_addr)
1da177e4	480	{
d0de32d9	481	struct mm_struct *mm = current->mm;
1da177e4 LT	482	struct vm_area_struct *vma;
	483	unsigned long ret = -EINVAL;
	484	unsigned long charged = 0;
81909b84	485	bool locked = false;
1da177e4 LT	486
1da177e4 LT	487	if (flags & ~(MREMAP_FIXED \| MREMAP_MAYMOVE))
9a2458a6 RV	488	return ret;
	489
	490	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
	491	return ret;
1da177e4 LT	492
1da177e4 LT	493	if (addr & ~PAGE_MASK)
9a2458a6	494	return ret;
1da177e4 LT	495
	496	old_len = PAGE_ALIGN(old_len);
	497	new_len = PAGE_ALIGN(new_len);
	498
	499	/*
	500	* We allow a zero old-len as a special case
	501	* for DOS-emu "duplicate shm area" thing. But
	502	* a zero new-len is nonsensical.
	503	*/
	504	if (!new_len)
9a2458a6 RV	505	return ret;
	506
	507	down_write(&current->mm->mmap_sem);
1da177e4	508
1da177e4	509	if (flags & MREMAP_FIXED) {
9a2458a6 RV	510	ret = mremap_to(addr, old_len, new_addr, new_len,
9a2458a6 RV	511	&locked);
ecc1a899	512	goto out;
1da177e4 LT	513	}
	514
	515	/*
	516	* Always allow a shrinking remap: that just unmaps
	517	* the unnecessary pages..
	518	* do_munmap does all the needed commit accounting
	519	*/
	520	if (old_len >= new_len) {
d0de32d9	521	ret = do_munmap(mm, addr+new_len, old_len - new_len);
1da177e4 LT	522	if (ret && old_len != new_len)
	523	goto out;
	524	ret = addr;
ecc1a899	525	goto out;
1da177e4 LT	526	}
	527
	528	/*
ecc1a899	529	* Ok, we need to grow..
1da177e4	530	*/
54f5de70 AV	531	vma = vma_to_resize(addr, old_len, new_len, &charged);
	532	if (IS_ERR(vma)) {
	533	ret = PTR_ERR(vma);
1da177e4	534	goto out;
119f657c	535	}
1da177e4	536
1da177e4	537	/* old_len exactly to the end of the area..
1da177e4	538	*/
ecc1a899	539	if (old_len == vma->vm_end - addr) {
1da177e4	540	/* can we just expand the current mapping? */
1a0ef85f	541	if (vma_expandable(vma, new_len - old_len)) {
1da177e4 LT	542	int pages = (new_len - old_len) >> PAGE_SHIFT;
1da177e4 LT	543
5beb4930 RR	544	if (vma_adjust(vma, vma->vm_start, addr + new_len,
	545	vma->vm_pgoff, NULL)) {
	546	ret = -ENOMEM;
	547	goto out;
	548	}
1da177e4	549
d0de32d9	550	vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages);
1da177e4	551	if (vma->vm_flags & VM_LOCKED) {
d0de32d9	552	mm->locked_vm += pages;
81909b84 ML	553	locked = true;
81909b84 ML	554	new_addr = addr;
1da177e4 LT	555	}
	556	ret = addr;
	557	goto out;
	558	}
	559	}
	560
	561	/*
	562	* We weren't able to just expand or shrink the area,
	563	* we need to create a new one and move it..
	564	*/
	565	ret = -ENOMEM;
	566	if (flags & MREMAP_MAYMOVE) {
ecc1a899 AV	567	unsigned long map_flags = 0;
	568	if (vma->vm_flags & VM_MAYSHARE)
	569	map_flags \|= MAP_SHARED;
	570
	571	new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
93587414 AV	572	vma->vm_pgoff +
	573	((addr - vma->vm_start) >> PAGE_SHIFT),
	574	map_flags);
ecc1a899 AV	575	if (new_addr & ~PAGE_MASK) {
	576	ret = new_addr;
	577	goto out;
1da177e4	578	}
ecc1a899	579
81909b84	580	ret = move_vma(vma, addr, old_len, new_len, new_addr, &locked);
1da177e4 LT	581	}
	582	out:
	583	if (ret & ~PAGE_MASK)
	584	vm_unacct_memory(charged);
1da177e4	585	up_write(&current->mm->mmap_sem);
81909b84 ML	586	if (locked && new_len > old_len)
81909b84 ML	587	mm_populate(new_addr + old_len, new_len - old_len);
1da177e4 LT	588	return ret;
1da177e4 LT	589	}