pagewalk.c

   1// SPDX-License-Identifier: GPL-2.0
   2#include <linux/pagewalk.h>
   3#include <linux/highmem.h>
   4#include <linux/sched.h>
   5#include <linux/hugetlb.h>
   6#include <linux/mmu_context.h>
   7#include <linux/swap.h>
   8#include <linux/leafops.h>
   9
  10#include <asm/tlbflush.h>
  11
  12#include "internal.h"
  13
  14/*
  15 * We want to know the real level where a entry is located ignoring any
  16 * folding of levels which may be happening. For example if p4d is folded then
  17 * a missing entry found at level 1 (p4d) is actually at level 0 (pgd).
  18 */
  19static int real_depth(int depth)
  20{
  21	if (depth == 3 && PTRS_PER_PMD == 1)
  22		depth = 2;
  23	if (depth == 2 && PTRS_PER_PUD == 1)
  24		depth = 1;
  25	if (depth == 1 && PTRS_PER_P4D == 1)
  26		depth = 0;
  27	return depth;
  28}
  29
  30static int walk_pte_range_inner(pte_t *pte, unsigned long addr,
  31				unsigned long end, struct mm_walk *walk)
  32{
  33	const struct mm_walk_ops *ops = walk->ops;
  34	int err = 0;
  35
  36	for (;;) {
  37		if (ops->install_pte && pte_none(ptep_get(pte))) {
  38			pte_t new_pte;
  39
  40			err = ops->install_pte(addr, addr + PAGE_SIZE, &new_pte,
  41					       walk);
  42			if (err)
  43				break;
  44
  45			set_pte_at(walk->mm, addr, pte, new_pte);
  46			/* Non-present before, so for arches that need it. */
  47			if (!WARN_ON_ONCE(walk->no_vma))
  48				update_mmu_cache(walk->vma, addr, pte);
  49		} else {
  50			err = ops->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
  51			if (err)
  52				break;
  53		}
  54		if (addr >= end - PAGE_SIZE)
  55			break;
  56		addr += PAGE_SIZE;
  57		pte++;
  58	}
  59	return err;
  60}
  61
  62static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
  63			  struct mm_walk *walk)
  64{
  65	pte_t *pte;
  66	int err = 0;
  67	spinlock_t *ptl;
  68
  69	if (walk->no_vma) {
  70		/*
  71		 * pte_offset_map() might apply user-specific validation.
  72		 * Indeed, on x86_64 the pmd entries set up by init_espfix_ap()
  73		 * fit its pmd_bad() check (_PAGE_NX set and _PAGE_RW clear),
  74		 * and CONFIG_EFI_PGT_DUMP efi_mm goes so far as to walk them.
  75		 */
  76		if (walk->mm == &init_mm || addr >= TASK_SIZE)
  77			pte = pte_offset_kernel(pmd, addr);
  78		else
  79			pte = pte_offset_map(pmd, addr);
  80		if (pte) {
  81			err = walk_pte_range_inner(pte, addr, end, walk);
  82			if (walk->mm != &init_mm && addr < TASK_SIZE)
  83				pte_unmap(pte);
  84		}
  85	} else {
  86		pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
  87		if (pte) {
  88			err = walk_pte_range_inner(pte, addr, end, walk);
  89			pte_unmap_unlock(pte, ptl);
  90		}
  91	}
  92	if (!pte)
  93		walk->action = ACTION_AGAIN;
  94	return err;
  95}
  96
  97static int walk_pmd_range(pud_t *pud, unsigned long addr, unsigned long end,
  98			  struct mm_walk *walk)
  99{
 100	pud_t pudval = pudp_get(pud);
 101	pmd_t *pmd;
 102	unsigned long next;
 103	const struct mm_walk_ops *ops = walk->ops;
 104	bool has_handler = ops->pte_entry;
 105	bool has_install = ops->install_pte;
 106	int err = 0;
 107	int depth = real_depth(3);
 108
 109	/*
 110	 * For PTE handling, pte_offset_map_lock() takes care of checking
 111	 * whether there actually is a page table. But it also has to be
 112	 * very careful about concurrent page table reclaim.
 113	 *
 114	 * Similarly, we have to be careful here - a PUD entry that points
 115	 * to a PMD table cannot go away, so we can just walk it. But if
 116	 * it's something else, we need to ensure we didn't race something,
 117	 * so need to retry.
 118	 *
 119	 * A pertinent example of this is a PUD refault after PUD split -
 120	 * we will need to split again or risk accessing invalid memory.
 121	 */
 122	if (!pud_present(pudval) || pud_leaf(pudval)) {
 123		walk->action = ACTION_AGAIN;
 124		return 0;
 125	}
 126
 127	pmd = pmd_offset(pud, addr);
 128	do {
 129again:
 130		next = pmd_addr_end(addr, end);
 131		if (pmd_none(*pmd)) {
 132			if (has_install)
 133				err = __pte_alloc(walk->mm, pmd);
 134			else if (ops->pte_hole)
 135				err = ops->pte_hole(addr, next, depth, walk);
 136			if (err)
 137				break;
 138			if (!has_install)
 139				continue;
 140		}
 141
 142		walk->action = ACTION_SUBTREE;
 143
 144		/*
 145		 * This implies that each ->pmd_entry() handler
 146		 * needs to know about pmd_trans_huge() pmds
 147		 */
 148		if (ops->pmd_entry)
 149			err = ops->pmd_entry(pmd, addr, next, walk);
 150		if (err)
 151			break;
 152
 153		if (walk->action == ACTION_AGAIN)
 154			goto again;
 155		if (walk->action == ACTION_CONTINUE)
 156			continue;
 157
 158		if (!has_handler) { /* No handlers for lower page tables. */
 159			if (!has_install)
 160				continue; /* Nothing to do. */
 161			/*
 162			 * We are ONLY installing, so avoid unnecessarily
 163			 * splitting a present huge page.
 164			 */
 165			if (pmd_present(*pmd) && pmd_trans_huge(*pmd))
 166				continue;
 167		}
 168
 169		if (walk->vma)
 170			split_huge_pmd(walk->vma, pmd, addr);
 171		else if (pmd_leaf(*pmd) || !pmd_present(*pmd))
 172			continue; /* Nothing to do. */
 173
 174		err = walk_pte_range(pmd, addr, next, walk);
 175		if (err)
 176			break;
 177
 178		if (walk->action == ACTION_AGAIN)
 179			goto again;
 180
 181	} while (pmd++, addr = next, addr != end);
 182
 183	return err;
 184}
 185
 186static int walk_pud_range(p4d_t *p4d, unsigned long addr, unsigned long end,
 187			  struct mm_walk *walk)
 188{
 189	pud_t *pud;
 190	unsigned long next;
 191	const struct mm_walk_ops *ops = walk->ops;
 192	bool has_handler = ops->pmd_entry || ops->pte_entry;
 193	bool has_install = ops->install_pte;
 194	int err = 0;
 195	int depth = real_depth(2);
 196
 197	pud = pud_offset(p4d, addr);
 198	do {
 199 again:
 200		next = pud_addr_end(addr, end);
 201		if (pud_none(*pud)) {
 202			if (has_install)
 203				err = __pmd_alloc(walk->mm, pud, addr);
 204			else if (ops->pte_hole)
 205				err = ops->pte_hole(addr, next, depth, walk);
 206			if (err)
 207				break;
 208			if (!has_install)
 209				continue;
 210		}
 211
 212		walk->action = ACTION_SUBTREE;
 213
 214		if (ops->pud_entry)
 215			err = ops->pud_entry(pud, addr, next, walk);
 216		if (err)
 217			break;
 218
 219		if (walk->action == ACTION_AGAIN)
 220			goto again;
 221		if (walk->action == ACTION_CONTINUE)
 222			continue;
 223
 224		if (!has_handler) { /* No handlers for lower page tables. */
 225			if (!has_install)
 226				continue; /* Nothing to do. */
 227			/*
 228			 * We are ONLY installing, so avoid unnecessarily
 229			 * splitting a present huge page.
 230			 */
 231			if (pud_present(*pud) && pud_trans_huge(*pud))
 232				continue;
 233		}
 234
 235		if (walk->vma)
 236			split_huge_pud(walk->vma, pud, addr);
 237		else if (pud_leaf(*pud) || !pud_present(*pud))
 238			continue; /* Nothing to do. */
 239
 240		err = walk_pmd_range(pud, addr, next, walk);
 241		if (err)
 242			break;
 243
 244		if (walk->action == ACTION_AGAIN)
 245			goto again;
 246	} while (pud++, addr = next, addr != end);
 247
 248	return err;
 249}
 250
 251static int walk_p4d_range(pgd_t *pgd, unsigned long addr, unsigned long end,
 252			  struct mm_walk *walk)
 253{
 254	p4d_t *p4d;
 255	unsigned long next;
 256	const struct mm_walk_ops *ops = walk->ops;
 257	bool has_handler = ops->pud_entry || ops->pmd_entry || ops->pte_entry;
 258	bool has_install = ops->install_pte;
 259	int err = 0;
 260	int depth = real_depth(1);
 261
 262	p4d = p4d_offset(pgd, addr);
 263	do {
 264		next = p4d_addr_end(addr, end);
 265		if (p4d_none_or_clear_bad(p4d)) {
 266			if (has_install)
 267				err = __pud_alloc(walk->mm, p4d, addr);
 268			else if (ops->pte_hole)
 269				err = ops->pte_hole(addr, next, depth, walk);
 270			if (err)
 271				break;
 272			if (!has_install)
 273				continue;
 274		}
 275		if (ops->p4d_entry) {
 276			err = ops->p4d_entry(p4d, addr, next, walk);
 277			if (err)
 278				break;
 279		}
 280		if (has_handler || has_install)
 281			err = walk_pud_range(p4d, addr, next, walk);
 282		if (err)
 283			break;
 284	} while (p4d++, addr = next, addr != end);
 285
 286	return err;
 287}
 288
 289static int walk_pgd_range(unsigned long addr, unsigned long end,
 290			  struct mm_walk *walk)
 291{
 292	pgd_t *pgd;
 293	unsigned long next;
 294	const struct mm_walk_ops *ops = walk->ops;
 295	bool has_handler = ops->p4d_entry || ops->pud_entry || ops->pmd_entry ||
 296		ops->pte_entry;
 297	bool has_install = ops->install_pte;
 298	int err = 0;
 299
 300	if (walk->pgd)
 301		pgd = walk->pgd + pgd_index(addr);
 302	else
 303		pgd = pgd_offset(walk->mm, addr);
 304	do {
 305		next = pgd_addr_end(addr, end);
 306		if (pgd_none_or_clear_bad(pgd)) {
 307			if (has_install)
 308				err = __p4d_alloc(walk->mm, pgd, addr);
 309			else if (ops->pte_hole)
 310				err = ops->pte_hole(addr, next, 0, walk);
 311			if (err)
 312				break;
 313			if (!has_install)
 314				continue;
 315		}
 316		if (ops->pgd_entry) {
 317			err = ops->pgd_entry(pgd, addr, next, walk);
 318			if (err)
 319				break;
 320		}
 321		if (has_handler || has_install)
 322			err = walk_p4d_range(pgd, addr, next, walk);
 323		if (err)
 324			break;
 325	} while (pgd++, addr = next, addr != end);
 326
 327	return err;
 328}
 329
 330#ifdef CONFIG_HUGETLB_PAGE
 331static unsigned long hugetlb_entry_end(struct hstate *h, unsigned long addr,
 332				       unsigned long end)
 333{
 334	unsigned long boundary = (addr & huge_page_mask(h)) + huge_page_size(h);
 335	return boundary < end ? boundary : end;
 336}
 337
 338static int walk_hugetlb_range(unsigned long addr, unsigned long end,
 339			      struct mm_walk *walk)
 340{
 341	struct vm_area_struct *vma = walk->vma;
 342	struct hstate *h = hstate_vma(vma);
 343	unsigned long next;
 344	unsigned long hmask = huge_page_mask(h);
 345	unsigned long sz = huge_page_size(h);
 346	pte_t *pte;
 347	const struct mm_walk_ops *ops = walk->ops;
 348	int err = 0;
 349
 350	hugetlb_vma_lock_read(vma);
 351	do {
 352		next = hugetlb_entry_end(h, addr, end);
 353		pte = hugetlb_walk(vma, addr & hmask, sz);
 354		if (pte)
 355			err = ops->hugetlb_entry(pte, hmask, addr, next, walk);
 356		else if (ops->pte_hole)
 357			err = ops->pte_hole(addr, next, -1, walk);
 358		if (err)
 359			break;
 360	} while (addr = next, addr != end);
 361	hugetlb_vma_unlock_read(vma);
 362
 363	return err;
 364}
 365
 366#else /* CONFIG_HUGETLB_PAGE */
 367static int walk_hugetlb_range(unsigned long addr, unsigned long end,
 368			      struct mm_walk *walk)
 369{
 370	return 0;
 371}
 372
 373#endif /* CONFIG_HUGETLB_PAGE */
 374
 375/*
 376 * Decide whether we really walk over the current vma on [@start, @end)
 377 * or skip it via the returned value. Return 0 if we do walk over the
 378 * current vma, and return 1 if we skip the vma. Negative values means
 379 * error, where we abort the current walk.
 380 */
 381static int walk_page_test(unsigned long start, unsigned long end,
 382			struct mm_walk *walk)
 383{
 384	struct vm_area_struct *vma = walk->vma;
 385	const struct mm_walk_ops *ops = walk->ops;
 386
 387	if (ops->test_walk)
 388		return ops->test_walk(start, end, walk);
 389
 390	/*
 391	 * vma(VM_PFNMAP) doesn't have any valid struct pages behind VM_PFNMAP
 392	 * range, so we don't walk over it as we do for normal vmas. However,
 393	 * Some callers are interested in handling hole range and they don't
 394	 * want to just ignore any single address range. Such users certainly
 395	 * define their ->pte_hole() callbacks, so let's delegate them to handle
 396	 * vma(VM_PFNMAP).
 397	 */
 398	if (vma->vm_flags & VM_PFNMAP) {
 399		int err = 1;
 400		if (ops->pte_hole)
 401			err = ops->pte_hole(start, end, -1, walk);
 402		return err ? err : 1;
 403	}
 404	return 0;
 405}
 406
 407static int __walk_page_range(unsigned long start, unsigned long end,
 408			struct mm_walk *walk)
 409{
 410	int err = 0;
 411	struct vm_area_struct *vma = walk->vma;
 412	const struct mm_walk_ops *ops = walk->ops;
 413	bool is_hugetlb = is_vm_hugetlb_page(vma);
 414
 415	/* We do not support hugetlb PTE installation. */
 416	if (ops->install_pte && is_hugetlb)
 417		return -EINVAL;
 418
 419	if (ops->pre_vma) {
 420		err = ops->pre_vma(start, end, walk);
 421		if (err)
 422			return err;
 423	}
 424
 425	if (is_hugetlb) {
 426		if (ops->hugetlb_entry)
 427			err = walk_hugetlb_range(start, end, walk);
 428	} else
 429		err = walk_pgd_range(start, end, walk);
 430
 431	if (ops->post_vma)
 432		ops->post_vma(walk);
 433
 434	return err;
 435}
 436
 437static inline void process_mm_walk_lock(struct mm_struct *mm,
 438					enum page_walk_lock walk_lock)
 439{
 440	if (walk_lock == PGWALK_RDLOCK)
 441		mmap_assert_locked(mm);
 442	else if (walk_lock != PGWALK_VMA_RDLOCK_VERIFY)
 443		mmap_assert_write_locked(mm);
 444}
 445
 446static inline void process_vma_walk_lock(struct vm_area_struct *vma,
 447					 enum page_walk_lock walk_lock)
 448{
 449#ifdef CONFIG_PER_VMA_LOCK
 450	switch (walk_lock) {
 451	case PGWALK_WRLOCK:
 452		vma_start_write(vma);
 453		break;
 454	case PGWALK_WRLOCK_VERIFY:
 455		vma_assert_write_locked(vma);
 456		break;
 457	case PGWALK_VMA_RDLOCK_VERIFY:
 458		vma_assert_locked(vma);
 459		break;
 460	case PGWALK_RDLOCK:
 461		/* PGWALK_RDLOCK is handled by process_mm_walk_lock */
 462		break;
 463	}
 464#endif
 465}
 466
 467/*
 468 * See the comment for walk_page_range(), this performs the heavy lifting of the
 469 * operation, only sets no restrictions on how the walk proceeds.
 470 *
 471 * We usually restrict the ability to install PTEs, but this functionality is
 472 * available to internal memory management code and provided in mm/internal.h.
 473 */
 474int walk_page_range_mm_unsafe(struct mm_struct *mm, unsigned long start,
 475		unsigned long end, const struct mm_walk_ops *ops,
 476		void *private)
 477{
 478	int err = 0;
 479	unsigned long next;
 480	struct vm_area_struct *vma;
 481	struct mm_walk walk = {
 482		.ops		= ops,
 483		.mm		= mm,
 484		.private	= private,
 485	};
 486
 487	if (start >= end)
 488		return -EINVAL;
 489
 490	if (!walk.mm)
 491		return -EINVAL;
 492
 493	process_mm_walk_lock(walk.mm, ops->walk_lock);
 494
 495	vma = find_vma(walk.mm, start);
 496	do {
 497		if (!vma) { /* after the last vma */
 498			walk.vma = NULL;
 499			next = end;
 500			if (ops->pte_hole)
 501				err = ops->pte_hole(start, next, -1, &walk);
 502		} else if (start < vma->vm_start) { /* outside vma */
 503			walk.vma = NULL;
 504			next = min(end, vma->vm_start);
 505			if (ops->pte_hole)
 506				err = ops->pte_hole(start, next, -1, &walk);
 507		} else { /* inside vma */
 508			process_vma_walk_lock(vma, ops->walk_lock);
 509			walk.vma = vma;
 510			next = min(end, vma->vm_end);
 511			vma = find_vma(mm, vma->vm_end);
 512
 513			err = walk_page_test(start, next, &walk);
 514			if (err > 0) {
 515				/*
 516				 * positive return values are purely for
 517				 * controlling the pagewalk, so should never
 518				 * be passed to the callers.
 519				 */
 520				err = 0;
 521				continue;
 522			}
 523			if (err < 0)
 524				break;
 525			err = __walk_page_range(start, next, &walk);
 526		}
 527		if (err)
 528			break;
 529	} while (start = next, start < end);
 530	return err;
 531}
 532
 533/*
 534 * Determine if the walk operations specified are permitted to be used for a
 535 * page table walk.
 536 *
 537 * This check is performed on all functions which are parameterised by walk
 538 * operations and exposed in include/linux/pagewalk.h.
 539 *
 540 * Internal memory management code can use *_unsafe() functions to be able to
 541 * use all page walking operations.
 542 */
 543static bool check_ops_safe(const struct mm_walk_ops *ops)
 544{
 545	/*
 546	 * The installation of PTEs is solely under the control of memory
 547	 * management logic and subject to many subtle locking, security and
 548	 * cache considerations so we cannot permit other users to do so, and
 549	 * certainly not for exported symbols.
 550	 */
 551	if (ops->install_pte)
 552		return false;
 553
 554	return true;
 555}
 556
 557/**
 558 * walk_page_range - walk page table with caller specific callbacks
 559 * @mm:		mm_struct representing the target process of page table walk
 560 * @start:	start address of the virtual address range
 561 * @end:	end address of the virtual address range
 562 * @ops:	operation to call during the walk
 563 * @private:	private data for callbacks' usage
 564 *
 565 * Recursively walk the page table tree of the process represented by @mm
 566 * within the virtual address range [@start, @end). During walking, we can do
 567 * some caller-specific works for each entry, by setting up pmd_entry(),
 568 * pte_entry(), and/or hugetlb_entry(). If you don't set up for some of these
 569 * callbacks, the associated entries/pages are just ignored.
 570 * The return values of these callbacks are commonly defined like below:
 571 *
 572 *  - 0  : succeeded to handle the current entry, and if you don't reach the
 573 *         end address yet, continue to walk.
 574 *  - >0 : succeeded to handle the current entry, and return to the caller
 575 *         with caller specific value.
 576 *  - <0 : failed to handle the current entry, and return to the caller
 577 *         with error code.
 578 *
 579 * Before starting to walk page table, some callers want to check whether
 580 * they really want to walk over the current vma, typically by checking
 581 * its vm_flags. walk_page_test() and @ops->test_walk() are used for this
 582 * purpose.
 583 *
 584 * If operations need to be staged before and committed after a vma is walked,
 585 * there are two callbacks, pre_vma() and post_vma(). Note that post_vma(),
 586 * since it is intended to handle commit-type operations, can't return any
 587 * errors.
 588 *
 589 * struct mm_walk keeps current values of some common data like vma and pmd,
 590 * which are useful for the access from callbacks. If you want to pass some
 591 * caller-specific data to callbacks, @private should be helpful.
 592 *
 593 * Locking:
 594 *   Callers of walk_page_range() and walk_page_vma() should hold @mm->mmap_lock,
 595 *   because these function traverse vma list and/or access to vma's data.
 596 */
 597int walk_page_range(struct mm_struct *mm, unsigned long start,
 598		unsigned long end, const struct mm_walk_ops *ops,
 599		void *private)
 600{
 601	if (!check_ops_safe(ops))
 602		return -EINVAL;
 603
 604	return walk_page_range_mm_unsafe(mm, start, end, ops, private);
 605}
 606
 607/**
 608 * walk_kernel_page_table_range - walk a range of kernel pagetables.
 609 * @start:	start address of the virtual address range
 610 * @end:	end address of the virtual address range
 611 * @ops:	operation to call during the walk
 612 * @pgd:	pgd to walk if different from mm->pgd
 613 * @private:	private data for callbacks' usage
 614 *
 615 * Similar to walk_page_range() but can walk any page tables even if they are
 616 * not backed by VMAs. Because 'unusual' entries may be walked this function
 617 * will also not lock the PTEs for the pte_entry() callback. This is useful for
 618 * walking kernel pages tables or page tables for firmware.
 619 *
 620 * Note: Be careful to walk the kernel pages tables, the caller may be need to
 621 * take other effective approaches (mmap lock may be insufficient) to prevent
 622 * the intermediate kernel page tables belonging to the specified address range
 623 * from being freed (e.g. memory hot-remove).
 624 */
 625int walk_kernel_page_table_range(unsigned long start, unsigned long end,
 626		const struct mm_walk_ops *ops, pgd_t *pgd, void *private)
 627{
 628	/*
 629	 * Kernel intermediate page tables are usually not freed, so the mmap
 630	 * read lock is sufficient. But there are some exceptions.
 631	 * E.g. memory hot-remove. In which case, the mmap lock is insufficient
 632	 * to prevent the intermediate kernel pages tables belonging to the
 633	 * specified address range from being freed. The caller should take
 634	 * other actions to prevent this race.
 635	 */
 636	mmap_assert_locked(&init_mm);
 637
 638	return walk_kernel_page_table_range_lockless(start, end, ops, pgd,
 639						     private);
 640}
 641
 642/*
 643 * Use this function to walk the kernel page tables locklessly. It should be
 644 * guaranteed that the caller has exclusive access over the range they are
 645 * operating on - that there should be no concurrent access, for example,
 646 * changing permissions for vmalloc objects.
 647 */
 648int walk_kernel_page_table_range_lockless(unsigned long start, unsigned long end,
 649		const struct mm_walk_ops *ops, pgd_t *pgd, void *private)
 650{
 651	struct mm_walk walk = {
 652		.ops		= ops,
 653		.mm		= &init_mm,
 654		.pgd		= pgd,
 655		.private	= private,
 656		.no_vma		= true
 657	};
 658
 659	if (start >= end)
 660		return -EINVAL;
 661	if (!check_ops_safe(ops))
 662		return -EINVAL;
 663
 664	return walk_pgd_range(start, end, &walk);
 665}
 666
 667/**
 668 * walk_page_range_debug - walk a range of pagetables not backed by a vma
 669 * @mm:		mm_struct representing the target process of page table walk
 670 * @start:	start address of the virtual address range
 671 * @end:	end address of the virtual address range
 672 * @ops:	operation to call during the walk
 673 * @pgd:	pgd to walk if different from mm->pgd
 674 * @private:	private data for callbacks' usage
 675 *
 676 * Similar to walk_page_range() but can walk any page tables even if they are
 677 * not backed by VMAs. Because 'unusual' entries may be walked this function
 678 * will also not lock the PTEs for the pte_entry() callback.
 679 *
 680 * This is for debugging purposes ONLY.
 681 */
 682int walk_page_range_debug(struct mm_struct *mm, unsigned long start,
 683			  unsigned long end, const struct mm_walk_ops *ops,
 684			  pgd_t *pgd, void *private)
 685{
 686	struct mm_walk walk = {
 687		.ops		= ops,
 688		.mm		= mm,
 689		.pgd		= pgd,
 690		.private	= private,
 691		.no_vma		= true
 692	};
 693
 694	/* For convenience, we allow traversal of kernel mappings. */
 695	if (mm == &init_mm)
 696		return walk_kernel_page_table_range(start, end, ops,
 697						    pgd, private);
 698	if (start >= end || !walk.mm)
 699		return -EINVAL;
 700	if (!check_ops_safe(ops))
 701		return -EINVAL;
 702
 703	/*
 704	 * The mmap lock protects the page walker from changes to the page
 705	 * tables during the walk.  However a read lock is insufficient to
 706	 * protect those areas which don't have a VMA as munmap() detaches
 707	 * the VMAs before downgrading to a read lock and actually tearing
 708	 * down PTEs/page tables. In which case, the mmap write lock should
 709	 * be held.
 710	 */
 711	mmap_assert_write_locked(mm);
 712
 713	return walk_pgd_range(start, end, &walk);
 714}
 715
 716int walk_page_range_vma_unsafe(struct vm_area_struct *vma, unsigned long start,
 717		unsigned long end, const struct mm_walk_ops *ops, void *private)
 718{
 719	struct mm_walk walk = {
 720		.ops		= ops,
 721		.mm		= vma->vm_mm,
 722		.vma		= vma,
 723		.private	= private,
 724	};
 725
 726	if (start >= end || !walk.mm)
 727		return -EINVAL;
 728	if (start < vma->vm_start || end > vma->vm_end)
 729		return -EINVAL;
 730
 731	process_mm_walk_lock(walk.mm, ops->walk_lock);
 732	process_vma_walk_lock(vma, ops->walk_lock);
 733	return __walk_page_range(start, end, &walk);
 734}
 735
 736int walk_page_range_vma(struct vm_area_struct *vma, unsigned long start,
 737			unsigned long end, const struct mm_walk_ops *ops,
 738			void *private)
 739{
 740	if (!check_ops_safe(ops))
 741		return -EINVAL;
 742
 743	return walk_page_range_vma_unsafe(vma, start, end, ops, private);
 744}
 745
 746int walk_page_vma(struct vm_area_struct *vma, const struct mm_walk_ops *ops,
 747		void *private)
 748{
 749	struct mm_walk walk = {
 750		.ops		= ops,
 751		.mm		= vma->vm_mm,
 752		.vma		= vma,
 753		.private	= private,
 754	};
 755
 756	if (!walk.mm)
 757		return -EINVAL;
 758	if (!check_ops_safe(ops))
 759		return -EINVAL;
 760
 761	process_mm_walk_lock(walk.mm, ops->walk_lock);
 762	process_vma_walk_lock(vma, ops->walk_lock);
 763	return __walk_page_range(vma->vm_start, vma->vm_end, &walk);
 764}
 765
 766/**
 767 * walk_page_mapping - walk all memory areas mapped into a struct address_space.
 768 * @mapping: Pointer to the struct address_space
 769 * @first_index: First page offset in the address_space
 770 * @nr: Number of incremental page offsets to cover
 771 * @ops:	operation to call during the walk
 772 * @private:	private data for callbacks' usage
 773 *
 774 * This function walks all memory areas mapped into a struct address_space.
 775 * The walk is limited to only the given page-size index range, but if
 776 * the index boundaries cross a huge page-table entry, that entry will be
 777 * included.
 778 *
 779 * Also see walk_page_range() for additional information.
 780 *
 781 * Locking:
 782 *   This function can't require that the struct mm_struct::mmap_lock is held,
 783 *   since @mapping may be mapped by multiple processes. Instead
 784 *   @mapping->i_mmap_rwsem must be held. This might have implications in the
 785 *   callbacks, and it's up tho the caller to ensure that the
 786 *   struct mm_struct::mmap_lock is not needed.
 787 *
 788 *   Also this means that a caller can't rely on the struct
 789 *   vm_area_struct::vm_flags to be constant across a call,
 790 *   except for immutable flags. Callers requiring this shouldn't use
 791 *   this function.
 792 *
 793 * Return: 0 on success, negative error code on failure, positive number on
 794 * caller defined premature termination.
 795 */
 796int walk_page_mapping(struct address_space *mapping, pgoff_t first_index,
 797		      pgoff_t nr, const struct mm_walk_ops *ops,
 798		      void *private)
 799{
 800	struct mm_walk walk = {
 801		.ops		= ops,
 802		.private	= private,
 803	};
 804	struct vm_area_struct *vma;
 805	pgoff_t vba, vea, cba, cea;
 806	unsigned long start_addr, end_addr;
 807	int err = 0;
 808
 809	if (!check_ops_safe(ops))
 810		return -EINVAL;
 811
 812	lockdep_assert_held(&mapping->i_mmap_rwsem);
 813	vma_interval_tree_foreach(vma, &mapping->i_mmap, first_index,
 814				  first_index + nr - 1) {
 815		/* Clip to the vma */
 816		vba = vma->vm_pgoff;
 817		vea = vba + vma_pages(vma);
 818		cba = first_index;
 819		cba = max(cba, vba);
 820		cea = first_index + nr;
 821		cea = min(cea, vea);
 822
 823		start_addr = ((cba - vba) << PAGE_SHIFT) + vma->vm_start;
 824		end_addr = ((cea - vba) << PAGE_SHIFT) + vma->vm_start;
 825		if (start_addr >= end_addr)
 826			continue;
 827
 828		walk.vma = vma;
 829		walk.mm = vma->vm_mm;
 830
 831		err = walk_page_test(vma->vm_start, vma->vm_end, &walk);
 832		if (err > 0) {
 833			err = 0;
 834			break;
 835		} else if (err < 0)
 836			break;
 837
 838		err = __walk_page_range(start_addr, end_addr, &walk);
 839		if (err)
 840			break;
 841	}
 842
 843	return err;
 844}
 845
 846/**
 847 * folio_walk_start - walk the page tables to a folio
 848 * @fw: filled with information on success.
 849 * @vma: the VMA.
 850 * @addr: the virtual address to use for the page table walk.
 851 * @flags: flags modifying which folios to walk to.
 852 *
 853 * Walk the page tables using @addr in a given @vma to a mapped folio and
 854 * return the folio, making sure that the page table entry referenced by
 855 * @addr cannot change until folio_walk_end() was called.
 856 *
 857 * As default, this function returns only folios that are not special (e.g., not
 858 * the zeropage) and never returns folios that are supposed to be ignored by the
 859 * VM as documented by vm_normal_page(). If requested, zeropages will be
 860 * returned as well.
 861 *
 862 * As default, this function only considers present page table entries.
 863 * If requested, it will also consider migration entries.
 864 *
 865 * If this function returns NULL it might either indicate "there is nothing" or
 866 * "there is nothing suitable".
 867 *
 868 * On success, @fw is filled and the function returns the folio while the PTL
 869 * is still held and folio_walk_end() must be called to clean up,
 870 * releasing any held locks. The returned folio must *not* be used after the
 871 * call to folio_walk_end(), unless a short-term folio reference is taken before
 872 * that call.
 873 *
 874 * @fw->page will correspond to the page that is effectively referenced by
 875 * @addr. However, for migration entries and shared zeropages @fw->page is
 876 * set to NULL. Note that large folios might be mapped by multiple page table
 877 * entries, and this function will always only lookup a single entry as
 878 * specified by @addr, which might or might not cover more than a single page of
 879 * the returned folio.
 880 *
 881 * This function must *not* be used as a naive replacement for
 882 * get_user_pages() / pin_user_pages(), especially not to perform DMA or
 883 * to carelessly modify page content. This function may *only* be used to grab
 884 * short-term folio references, never to grab long-term folio references.
 885 *
 886 * Using the page table entry pointers in @fw for reading or modifying the
 887 * entry should be avoided where possible: however, there might be valid
 888 * use cases.
 889 *
 890 * WARNING: Modifying page table entries in hugetlb VMAs requires a lot of care.
 891 * For example, PMD page table sharing might require prior unsharing. Also,
 892 * logical hugetlb entries might span multiple physical page table entries,
 893 * which *must* be modified in a single operation (set_huge_pte_at(),
 894 * huge_ptep_set_*, ...). Note that the page table entry stored in @fw might
 895 * not correspond to the first physical entry of a logical hugetlb entry.
 896 *
 897 * The mmap lock must be held in read mode.
 898 *
 899 * Return: folio pointer on success, otherwise NULL.
 900 */
 901struct folio *folio_walk_start(struct folio_walk *fw,
 902		struct vm_area_struct *vma, unsigned long addr,
 903		folio_walk_flags_t flags)
 904{
 905	unsigned long entry_size;
 906	bool expose_page = true;
 907	struct page *page;
 908	pud_t *pudp, pud;
 909	pmd_t *pmdp, pmd;
 910	pte_t *ptep, pte;
 911	spinlock_t *ptl;
 912	pgd_t *pgdp;
 913	p4d_t *p4dp;
 914
 915	mmap_assert_locked(vma->vm_mm);
 916	vma_pgtable_walk_begin(vma);
 917
 918	if (WARN_ON_ONCE(addr < vma->vm_start || addr >= vma->vm_end))
 919		goto not_found;
 920
 921	pgdp = pgd_offset(vma->vm_mm, addr);
 922	if (pgd_none_or_clear_bad(pgdp))
 923		goto not_found;
 924
 925	p4dp = p4d_offset(pgdp, addr);
 926	if (p4d_none_or_clear_bad(p4dp))
 927		goto not_found;
 928
 929	pudp = pud_offset(p4dp, addr);
 930	pud = pudp_get(pudp);
 931	if (pud_none(pud))
 932		goto not_found;
 933	if (IS_ENABLED(CONFIG_PGTABLE_HAS_HUGE_LEAVES) &&
 934	    (!pud_present(pud) || pud_leaf(pud))) {
 935		ptl = pud_lock(vma->vm_mm, pudp);
 936		pud = pudp_get(pudp);
 937
 938		entry_size = PUD_SIZE;
 939		fw->level = FW_LEVEL_PUD;
 940		fw->pudp = pudp;
 941		fw->pud = pud;
 942
 943		if (pud_none(pud)) {
 944			spin_unlock(ptl);
 945			goto not_found;
 946		} else if (pud_present(pud) && !pud_leaf(pud)) {
 947			spin_unlock(ptl);
 948			goto pmd_table;
 949		} else if (pud_present(pud)) {
 950			page = vm_normal_page_pud(vma, addr, pud);
 951			if (page)
 952				goto found;
 953		}
 954		/*
 955		 * TODO: FW_MIGRATION support for PUD migration entries
 956		 * once there are relevant users.
 957		 */
 958		spin_unlock(ptl);
 959		goto not_found;
 960	}
 961
 962pmd_table:
 963	VM_WARN_ON_ONCE(!pud_present(pud) || pud_leaf(pud));
 964	pmdp = pmd_offset(pudp, addr);
 965	pmd = pmdp_get_lockless(pmdp);
 966	if (pmd_none(pmd))
 967		goto not_found;
 968	if (IS_ENABLED(CONFIG_PGTABLE_HAS_HUGE_LEAVES) &&
 969	    (!pmd_present(pmd) || pmd_leaf(pmd))) {
 970		ptl = pmd_lock(vma->vm_mm, pmdp);
 971		pmd = pmdp_get(pmdp);
 972
 973		entry_size = PMD_SIZE;
 974		fw->level = FW_LEVEL_PMD;
 975		fw->pmdp = pmdp;
 976		fw->pmd = pmd;
 977
 978		if (pmd_none(pmd)) {
 979			spin_unlock(ptl);
 980			goto not_found;
 981		} else if (pmd_present(pmd) && !pmd_leaf(pmd)) {
 982			spin_unlock(ptl);
 983			goto pte_table;
 984		} else if (pmd_present(pmd)) {
 985			page = vm_normal_page_pmd(vma, addr, pmd);
 986			if (page) {
 987				goto found;
 988			} else if ((flags & FW_ZEROPAGE) &&
 989				    is_huge_zero_pmd(pmd)) {
 990				page = pfn_to_page(pmd_pfn(pmd));
 991				expose_page = false;
 992				goto found;
 993			}
 994		} else if ((flags & FW_MIGRATION) &&
 995			   pmd_is_migration_entry(pmd)) {
 996			const softleaf_t entry = softleaf_from_pmd(pmd);
 997
 998			page = softleaf_to_page(entry);
 999			expose_page = false;
1000			goto found;
1001		}
1002		spin_unlock(ptl);
1003		goto not_found;
1004	}
1005
1006pte_table:
1007	VM_WARN_ON_ONCE(!pmd_present(pmd) || pmd_leaf(pmd));
1008	ptep = pte_offset_map_lock(vma->vm_mm, pmdp, addr, &ptl);
1009	if (!ptep)
1010		goto not_found;
1011	pte = ptep_get(ptep);
1012
1013	entry_size = PAGE_SIZE;
1014	fw->level = FW_LEVEL_PTE;
1015	fw->ptep = ptep;
1016	fw->pte = pte;
1017
1018	if (pte_present(pte)) {
1019		page = vm_normal_page(vma, addr, pte);
1020		if (page)
1021			goto found;
1022		if ((flags & FW_ZEROPAGE) &&
1023		    is_zero_pfn(pte_pfn(pte))) {
1024			page = pfn_to_page(pte_pfn(pte));
1025			expose_page = false;
1026			goto found;
1027		}
1028	} else if (!pte_none(pte)) {
1029		const softleaf_t entry = softleaf_from_pte(pte);
1030
1031		if ((flags & FW_MIGRATION) && softleaf_is_migration(entry)) {
1032			page = softleaf_to_page(entry);
1033			expose_page = false;
1034			goto found;
1035		}
1036	}
1037	pte_unmap_unlock(ptep, ptl);
1038not_found:
1039	vma_pgtable_walk_end(vma);
1040	return NULL;
1041found:
1042	if (expose_page)
1043		/* Note: Offset from the mapped page, not the folio start. */
1044		fw->page = page + ((addr & (entry_size - 1)) >> PAGE_SHIFT);
1045	else
1046		fw->page = NULL;
1047	fw->ptl = ptl;
1048	return page_folio(page);
1049}