Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'akpm' (fixes from Andrew)
Merge patches from Andrew Morton:
"13 fixes"
* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
mm: place page->pmd_huge_pte to right union
MAINTAINERS: add keyboard driver to Hyper-V file list
x86, mm: do not leak page->ptl for pmd page tables
ipc,shm: correct error return value in shmctl (SHM_UNLOCK)
mm, mempolicy: silence gcc warning
block/partitions/efi.c: fix bound check
ARM: drivers/rtc/rtc-at91rm9200.c: disable interrupts at shutdown
mm: hugetlbfs: fix hugetlbfs optimization
kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS cleanly
ipc,shm: fix shm_file deletion races
mm: thp: give transparent hugepage code a separate copy_page
checkpatch: fix "Use of uninitialized value" warnings
configfs: fix race between dentry put and lookup
+227
-124
+3
-3
Documentation/vm/split_page_table_lock
+3
-3
Documentation/vm/split_page_table_lock
···
63
63
PMD split lock enabling requires pgtable_pmd_page_ctor() call on PMD table
64
64
allocation and pgtable_pmd_page_dtor() on freeing.
65
65
66
-
Allocation usually happens in pmd_alloc_one(), freeing in pmd_free(), but
67
-
make sure you cover all PMD table allocation / freeing paths: i.e X86_PAE
68
-
preallocate few PMDs on pgd_alloc().
66
+
Allocation usually happens in pmd_alloc_one(), freeing in pmd_free() and
67
+
pmd_free_tlb(), but make sure you cover all PMD table allocation / freeing
68
+
paths: i.e X86_PAE preallocate few PMDs on pgd_alloc().
69
69
70
70
With everything in place you can set CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK.
71
71
+1
MAINTAINERS
+1
MAINTAINERS
+3
-1
arch/x86/mm/pgtable.c
+3
-1
arch/x86/mm/pgtable.c
···
61
61
#if PAGETABLE_LEVELS > 2
62
62
void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
63
63
{
64
+
struct page *page = virt_to_page(pmd);
64
65
paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
65
66
/*
66
67
* NOTE! For PAE, any changes to the top page-directory-pointer-table
···
70
69
#ifdef CONFIG_X86_PAE
71
70
tlb->need_flush_all = 1;
72
71
#endif
73
-
tlb_remove_page(tlb, virt_to_page(pmd));
72
+
pgtable_pmd_page_dtor(page);
73
+
tlb_remove_page(tlb, page);
74
74
}
75
75
76
76
#if PAGETABLE_LEVELS > 3
+3
-2
block/partitions/efi.c
+3
-2
block/partitions/efi.c
···
96
96
* - Code works, detects all the partitions.
97
97
*
98
98
************************************************************/
99
+
#include <linux/kernel.h>
99
100
#include <linux/crc32.h>
100
101
#include <linux/ctype.h>
101
102
#include <linux/math64.h>
···
716
715
efi_guid_unparse(&ptes[i].unique_partition_guid, info->uuid);
717
716
718
717
/* Naively convert UTF16-LE to 7 bits. */
719
-
label_max = min(sizeof(info->volname) - 1,
720
-
sizeof(ptes[i].partition_name));
718
+
label_max = min(ARRAY_SIZE(info->volname) - 1,
719
+
ARRAY_SIZE(ptes[i].partition_name));
721
720
info->volname[label_max] = 0;
722
721
while (label_count < label_max) {
723
722
u8 c = ptes[i].partition_name[label_count] & 0xff;
+4
-4
drivers/block/null_blk.c
+4
-4
drivers/block/null_blk.c
···
223
223
blk_end_request_all(rq, 0);
224
224
}
225
225
226
-
#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
226
+
#ifdef CONFIG_SMP
227
227
228
228
static void null_ipi_cmd_end_io(void *data)
229
229
{
···
260
260
put_cpu();
261
261
}
262
262
263
-
#endif /* CONFIG_SMP && CONFIG_USE_GENERIC_SMP_HELPERS */
263
+
#endif /* CONFIG_SMP */
264
264
265
265
static inline void null_handle_cmd(struct nullb_cmd *cmd)
266
266
{
···
270
270
end_cmd(cmd);
271
271
break;
272
272
case NULL_IRQ_SOFTIRQ:
273
-
#if defined(CONFIG_SMP) && defined(CONFIG_USE_GENERIC_SMP_HELPERS)
273
+
#ifdef CONFIG_SMP
274
274
null_cmd_end_ipi(cmd);
275
275
#else
276
276
end_cmd(cmd);
···
571
571
{
572
572
unsigned int i;
573
573
574
-
#if !defined(CONFIG_SMP) || !defined(CONFIG_USE_GENERIC_SMP_HELPERS)
574
+
#if !defined(CONFIG_SMP)
575
575
if (irqmode == NULL_IRQ_SOFTIRQ) {
576
576
pr_warn("null_blk: softirq completions not available.\n");
577
577
pr_warn("null_blk: using direct completions.\n");
+9
drivers/rtc/rtc-at91rm9200.c
+9
drivers/rtc/rtc-at91rm9200.c
···
428
428
return 0;
429
429
}
430
430
431
+
static void at91_rtc_shutdown(struct platform_device *pdev)
432
+
{
433
+
/* Disable all interrupts */
434
+
at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
435
+
AT91_RTC_SECEV | AT91_RTC_TIMEV |
436
+
AT91_RTC_CALEV);
437
+
}
438
+
431
439
#ifdef CONFIG_PM_SLEEP
432
440
433
441
/* AT91RM9200 RTC Power management control */
···
474
466
475
467
static struct platform_driver at91_rtc_driver = {
476
468
.remove = __exit_p(at91_rtc_remove),
469
+
.shutdown = at91_rtc_shutdown,
477
470
.driver = {
478
471
.name = "at91_rtc",
479
472
.owner = THIS_MODULE,
+14
-2
fs/configfs/dir.c
+14
-2
fs/configfs/dir.c
···
56
56
struct configfs_dirent *sd = dentry->d_fsdata;
57
57
58
58
if (sd) {
59
-
BUG_ON(sd->s_dentry != dentry);
60
59
/* Coordinate with configfs_readdir */
61
60
spin_lock(&configfs_dirent_lock);
62
-
sd->s_dentry = NULL;
61
+
/* Coordinate with configfs_attach_attr where will increase
62
+
* sd->s_count and update sd->s_dentry to new allocated one.
63
+
* Only set sd->dentry to null when this dentry is the only
64
+
* sd owner.
65
+
* If not do so, configfs_d_iput may run just after
66
+
* configfs_attach_attr and set sd->s_dentry to null
67
+
* even it's still in use.
68
+
*/
69
+
if (atomic_read(&sd->s_count) <= 2)
70
+
sd->s_dentry = NULL;
71
+
63
72
spin_unlock(&configfs_dirent_lock);
64
73
configfs_put(sd);
65
74
}
···
425
416
struct configfs_attribute * attr = sd->s_element;
426
417
int error;
427
418
419
+
spin_lock(&configfs_dirent_lock);
428
420
dentry->d_fsdata = configfs_get(sd);
429
421
sd->s_dentry = dentry;
422
+
spin_unlock(&configfs_dirent_lock);
423
+
430
424
error = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG,
431
425
configfs_init_file);
432
426
if (error) {
+6
-4
include/linux/hugetlb.h
+6
-4
include/linux/hugetlb.h
···
31
31
void hugepage_put_subpool(struct hugepage_subpool *spool);
32
32
33
33
int PageHuge(struct page *page);
34
+
int PageHeadHuge(struct page *page_head);
34
35
35
36
void reset_vma_resv_huge_pages(struct vm_area_struct *vma);
36
37
int hugetlb_sysctl_handler(struct ctl_table *, int, void __user *, size_t *, loff_t *);
···
70
69
bool isolate_huge_page(struct page *page, struct list_head *list);
71
70
void putback_active_hugepage(struct page *page);
72
71
bool is_hugepage_active(struct page *page);
73
-
void copy_huge_page(struct page *dst, struct page *src);
74
72
75
73
#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE
76
74
pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
···
100
100
#else /* !CONFIG_HUGETLB_PAGE */
101
101
102
102
static inline int PageHuge(struct page *page)
103
+
{
104
+
return 0;
105
+
}
106
+
107
+
static inline int PageHeadHuge(struct page *page_head)
103
108
{
104
109
return 0;
105
110
}
···
145
140
#define isolate_huge_page(p, l) false
146
141
#define putback_active_hugepage(p) do {} while (0)
147
142
#define is_hugepage_active(x) false
148
-
static inline void copy_huge_page(struct page *dst, struct page *src)
149
-
{
150
-
}
151
143
152
144
static inline unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
153
145
unsigned long address, unsigned long end, pgprot_t newprot)
+3
-3
include/linux/mm_types.h
+3
-3
include/linux/mm_types.h
···
65
65
* this page is only used to
66
66
* free other pages.
67
67
*/
68
-
#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
69
-
pgtable_t pmd_huge_pte; /* protected by page->ptl */
70
-
#endif
71
68
};
72
69
73
70
union {
···
132
135
133
136
struct list_head list; /* slobs list of pages */
134
137
struct slab *slab_page; /* slab fields */
138
+
#if defined(CONFIG_TRANSPARENT_HUGEPAGE) && USE_SPLIT_PMD_PTLOCKS
139
+
pgtable_t pmd_huge_pte; /* protected by page->ptl */
140
+
#endif
135
141
};
136
142
137
143
/* Remainder is not double word aligned */
+29
-8
ipc/shm.c
+29
-8
ipc/shm.c
···
208
208
*/
209
209
static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
210
210
{
211
+
struct file *shm_file;
212
+
213
+
shm_file = shp->shm_file;
214
+
shp->shm_file = NULL;
211
215
ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
212
216
shm_rmid(ns, shp);
213
217
shm_unlock(shp);
214
-
if (!is_file_hugepages(shp->shm_file))
215
-
shmem_lock(shp->shm_file, 0, shp->mlock_user);
218
+
if (!is_file_hugepages(shm_file))
219
+
shmem_lock(shm_file, 0, shp->mlock_user);
216
220
else if (shp->mlock_user)
217
-
user_shm_unlock(file_inode(shp->shm_file)->i_size,
218
-
shp->mlock_user);
219
-
fput (shp->shm_file);
221
+
user_shm_unlock(file_inode(shm_file)->i_size, shp->mlock_user);
222
+
fput(shm_file);
220
223
ipc_rcu_putref(shp, shm_rcu_free);
221
224
}
222
225
···
977
974
ipc_lock_object(&shp->shm_perm);
978
975
if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {
979
976
kuid_t euid = current_euid();
980
-
err = -EPERM;
981
977
if (!uid_eq(euid, shp->shm_perm.uid) &&
982
-
!uid_eq(euid, shp->shm_perm.cuid))
978
+
!uid_eq(euid, shp->shm_perm.cuid)) {
979
+
err = -EPERM;
983
980
goto out_unlock0;
984
-
if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))
981
+
}
982
+
if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK)) {
983
+
err = -EPERM;
985
984
goto out_unlock0;
985
+
}
986
986
}
987
987
988
988
shm_file = shp->shm_file;
989
+
990
+
/* check if shm_destroy() is tearing down shp */
991
+
if (shm_file == NULL) {
992
+
err = -EIDRM;
993
+
goto out_unlock0;
994
+
}
995
+
989
996
if (is_file_hugepages(shm_file))
990
997
goto out_unlock0;
991
998
···
1114
1101
goto out_unlock;
1115
1102
1116
1103
ipc_lock_object(&shp->shm_perm);
1104
+
1105
+
/* check if shm_destroy() is tearing down shp */
1106
+
if (shp->shm_file == NULL) {
1107
+
ipc_unlock_object(&shp->shm_perm);
1108
+
err = -EIDRM;
1109
+
goto out_unlock;
1110
+
}
1111
+
1117
1112
path = shp->shm_file->f_path;
1118
1113
path_get(&path);
1119
1114
shp->shm_nattch++;
+17
-34
mm/hugetlb.c
+17
-34
mm/hugetlb.c
···
476
476
return 0;
477
477
}
478
478
479
-
static void copy_gigantic_page(struct page *dst, struct page *src)
480
-
{
481
-
int i;
482
-
struct hstate *h = page_hstate(src);
483
-
struct page *dst_base = dst;
484
-
struct page *src_base = src;
485
-
486
-
for (i = 0; i < pages_per_huge_page(h); ) {
487
-
cond_resched();
488
-
copy_highpage(dst, src);
489
-
490
-
i++;
491
-
dst = mem_map_next(dst, dst_base, i);
492
-
src = mem_map_next(src, src_base, i);
493
-
}
494
-
}
495
-
496
-
void copy_huge_page(struct page *dst, struct page *src)
497
-
{
498
-
int i;
499
-
struct hstate *h = page_hstate(src);
500
-
501
-
if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) {
502
-
copy_gigantic_page(dst, src);
503
-
return;
504
-
}
505
-
506
-
might_sleep();
507
-
for (i = 0; i < pages_per_huge_page(h); i++) {
508
-
cond_resched();
509
-
copy_highpage(dst + i, src + i);
510
-
}
511
-
}
512
-
513
479
static void enqueue_huge_page(struct hstate *h, struct page *page)
514
480
{
515
481
int nid = page_to_nid(page);
···
701
735
return dtor == free_huge_page;
702
736
}
703
737
EXPORT_SYMBOL_GPL(PageHuge);
738
+
739
+
/*
740
+
* PageHeadHuge() only returns true for hugetlbfs head page, but not for
741
+
* normal or transparent huge pages.
742
+
*/
743
+
int PageHeadHuge(struct page *page_head)
744
+
{
745
+
compound_page_dtor *dtor;
746
+
747
+
if (!PageHead(page_head))
748
+
return 0;
749
+
750
+
dtor = get_compound_page_dtor(page_head);
751
+
752
+
return dtor == free_huge_page;
753
+
}
754
+
EXPORT_SYMBOL_GPL(PageHeadHuge);
704
755
705
756
pgoff_t __basepage_index(struct page *page)
706
757
{
+1
-1
mm/mempolicy.c
+1
-1
mm/mempolicy.c
+48
mm/migrate.c
+48
mm/migrate.c
···
442
442
}
443
443
444
444
/*
445
+
* Gigantic pages are so large that we do not guarantee that page++ pointer
446
+
* arithmetic will work across the entire page. We need something more
447
+
* specialized.
448
+
*/
449
+
static void __copy_gigantic_page(struct page *dst, struct page *src,
450
+
int nr_pages)
451
+
{
452
+
int i;
453
+
struct page *dst_base = dst;
454
+
struct page *src_base = src;
455
+
456
+
for (i = 0; i < nr_pages; ) {
457
+
cond_resched();
458
+
copy_highpage(dst, src);
459
+
460
+
i++;
461
+
dst = mem_map_next(dst, dst_base, i);
462
+
src = mem_map_next(src, src_base, i);
463
+
}
464
+
}
465
+
466
+
static void copy_huge_page(struct page *dst, struct page *src)
467
+
{
468
+
int i;
469
+
int nr_pages;
470
+
471
+
if (PageHuge(src)) {
472
+
/* hugetlbfs page */
473
+
struct hstate *h = page_hstate(src);
474
+
nr_pages = pages_per_huge_page(h);
475
+
476
+
if (unlikely(nr_pages > MAX_ORDER_NR_PAGES)) {
477
+
__copy_gigantic_page(dst, src, nr_pages);
478
+
return;
479
+
}
480
+
} else {
481
+
/* thp page */
482
+
BUG_ON(!PageTransHuge(src));
483
+
nr_pages = hpage_nr_pages(src);
484
+
}
485
+
486
+
for (i = 0; i < nr_pages; i++) {
487
+
cond_resched();
488
+
copy_highpage(dst + i, src + i);
489
+
}
490
+
}
491
+
492
+
/*
445
493
* Copy the page to its new location
446
494
*/
447
495
void migrate_page_copy(struct page *newpage, struct page *page)
+83
-60
mm/swap.c
+83
-60
mm/swap.c
···
82
82
83
83
static void put_compound_page(struct page *page)
84
84
{
85
-
/*
86
-
* hugetlbfs pages cannot be split from under us. If this is a
87
-
* hugetlbfs page, check refcount on head page and release the page if
88
-
* the refcount becomes zero.
89
-
*/
90
-
if (PageHuge(page)) {
91
-
page = compound_head(page);
92
-
if (put_page_testzero(page))
93
-
__put_compound_page(page);
94
-
95
-
return;
96
-
}
97
-
98
85
if (unlikely(PageTail(page))) {
99
86
/* __split_huge_page_refcount can run under us */
100
87
struct page *page_head = compound_trans_head(page);
···
98
111
* still hot on arches that do not support
99
112
* this_cpu_cmpxchg_double().
100
113
*/
101
-
if (PageSlab(page_head)) {
102
-
if (PageTail(page)) {
114
+
if (PageSlab(page_head) || PageHeadHuge(page_head)) {
115
+
if (likely(PageTail(page))) {
116
+
/*
117
+
* __split_huge_page_refcount
118
+
* cannot race here.
119
+
*/
120
+
VM_BUG_ON(!PageHead(page_head));
121
+
atomic_dec(&page->_mapcount);
103
122
if (put_page_testzero(page_head))
104
123
VM_BUG_ON(1);
105
-
106
-
atomic_dec(&page->_mapcount);
107
-
goto skip_lock_tail;
124
+
if (put_page_testzero(page_head))
125
+
__put_compound_page(page_head);
126
+
return;
108
127
} else
128
+
/*
129
+
* __split_huge_page_refcount
130
+
* run before us, "page" was a
131
+
* THP tail. The split
132
+
* page_head has been freed
133
+
* and reallocated as slab or
134
+
* hugetlbfs page of smaller
135
+
* order (only possible if
136
+
* reallocated as slab on
137
+
* x86).
138
+
*/
109
139
goto skip_lock;
110
140
}
111
141
/*
···
136
132
/* __split_huge_page_refcount run before us */
137
133
compound_unlock_irqrestore(page_head, flags);
138
134
skip_lock:
139
-
if (put_page_testzero(page_head))
140
-
__put_single_page(page_head);
135
+
if (put_page_testzero(page_head)) {
136
+
/*
137
+
* The head page may have been
138
+
* freed and reallocated as a
139
+
* compound page of smaller
140
+
* order and then freed again.
141
+
* All we know is that it
142
+
* cannot have become: a THP
143
+
* page, a compound page of
144
+
* higher order, a tail page.
145
+
* That is because we still
146
+
* hold the refcount of the
147
+
* split THP tail and
148
+
* page_head was the THP head
149
+
* before the split.
150
+
*/
151
+
if (PageHead(page_head))
152
+
__put_compound_page(page_head);
153
+
else
154
+
__put_single_page(page_head);
155
+
}
141
156
out_put_single:
142
157
if (put_page_testzero(page))
143
158
__put_single_page(page);
···
178
155
VM_BUG_ON(atomic_read(&page->_count) != 0);
179
156
compound_unlock_irqrestore(page_head, flags);
180
157
181
-
skip_lock_tail:
182
158
if (put_page_testzero(page_head)) {
183
159
if (PageHead(page_head))
184
160
__put_compound_page(page_head);
···
220
198
* proper PT lock that already serializes against
221
199
* split_huge_page().
222
200
*/
201
+
unsigned long flags;
223
202
bool got = false;
224
-
struct page *page_head;
203
+
struct page *page_head = compound_trans_head(page);
225
204
226
-
/*
227
-
* If this is a hugetlbfs page it cannot be split under us. Simply
228
-
* increment refcount for the head page.
229
-
*/
230
-
if (PageHuge(page)) {
231
-
page_head = compound_head(page);
232
-
atomic_inc(&page_head->_count);
233
-
got = true;
234
-
} else {
235
-
unsigned long flags;
236
-
237
-
page_head = compound_trans_head(page);
238
-
if (likely(page != page_head &&
239
-
get_page_unless_zero(page_head))) {
240
-
241
-
/* Ref to put_compound_page() comment. */
242
-
if (PageSlab(page_head)) {
243
-
if (likely(PageTail(page))) {
244
-
__get_page_tail_foll(page, false);
245
-
return true;
246
-
} else {
247
-
put_page(page_head);
248
-
return false;
249
-
}
250
-
}
251
-
252
-
/*
253
-
* page_head wasn't a dangling pointer but it
254
-
* may not be a head page anymore by the time
255
-
* we obtain the lock. That is ok as long as it
256
-
* can't be freed from under us.
257
-
*/
258
-
flags = compound_lock_irqsave(page_head);
259
-
/* here __split_huge_page_refcount won't run anymore */
205
+
if (likely(page != page_head && get_page_unless_zero(page_head))) {
206
+
/* Ref to put_compound_page() comment. */
207
+
if (PageSlab(page_head) || PageHeadHuge(page_head)) {
260
208
if (likely(PageTail(page))) {
209
+
/*
210
+
* This is a hugetlbfs page or a slab
211
+
* page. __split_huge_page_refcount
212
+
* cannot race here.
213
+
*/
214
+
VM_BUG_ON(!PageHead(page_head));
261
215
__get_page_tail_foll(page, false);
262
-
got = true;
263
-
}
264
-
compound_unlock_irqrestore(page_head, flags);
265
-
if (unlikely(!got))
216
+
return true;
217
+
} else {
218
+
/*
219
+
* __split_huge_page_refcount run
220
+
* before us, "page" was a THP
221
+
* tail. The split page_head has been
222
+
* freed and reallocated as slab or
223
+
* hugetlbfs page of smaller order
224
+
* (only possible if reallocated as
225
+
* slab on x86).
226
+
*/
266
227
put_page(page_head);
228
+
return false;
229
+
}
267
230
}
231
+
232
+
/*
233
+
* page_head wasn't a dangling pointer but it
234
+
* may not be a head page anymore by the time
235
+
* we obtain the lock. That is ok as long as it
236
+
* can't be freed from under us.
237
+
*/
238
+
flags = compound_lock_irqsave(page_head);
239
+
/* here __split_huge_page_refcount won't run anymore */
240
+
if (likely(PageTail(page))) {
241
+
__get_page_tail_foll(page, false);
242
+
got = true;
243
+
}
244
+
compound_unlock_irqrestore(page_head, flags);
245
+
if (unlikely(!got))
246
+
put_page(page_head);
268
247
}
269
248
return got;
270
249
}
+2
-2
net/Kconfig
+2
-2
net/Kconfig
···
224
224
225
225
config RPS
226
226
boolean
227
-
depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
227
+
depends on SMP && SYSFS
228
228
default y
229
229
230
230
config RFS_ACCEL
···
235
235
236
236
config XPS
237
237
boolean
238
-
depends on SMP && USE_GENERIC_SMP_HELPERS
238
+
depends on SMP
239
239
default y
240
240
241
241
config NETPRIO_CGROUP