BACKPORT: FROMLIST: mm: enable speculative fault handling for supported file types.

Introduce vma_can_speculate(), which allows speculative handling for
VMAs mapping supported file types.

From do_handle_mm_fault(), speculative handling will follow through
__handle_mm_fault(), handle_pte_fault() and do_fault().

At this point, we expect speculative faults to continue through one of:
- do_read_fault(), fully implemented;
- do_cow_fault(), which might abort if missing anon vmas,
- do_shared_fault(), not implemented yet
  (would require ->page_mkwrite() changes).

vma_can_speculate() provides an early abort for the do_shared_fault() case,
limiting the time spent on trying that unimplemented case.

Signed-off-by: Michel Lespinasse <michel@lespinasse.org>
Link: https://lore.kernel.org/all/20210407014502.24091-31-michel@lespinasse.org/

Conflicts:
    include/linux/vm_event_item.h
    mm/vmstat.c

1. SPF_ATTEMPT_FILE is taken from https://lore.kernel.org/all/20210407014502.24091-36-michel@lespinasse.org/
since the patch posted upstream at the time had a different structure
with stats for anonymouse and file-backed pagefaults introduced in a
separate patch.

Bug: 161210518
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I3a28af63b41b649f02f8b73d53f6494ad114ee5a

arch/arm64/mm/fault.c

@@ -602,7 +602,7 @@ static int __kprobes do_page_fault(unsigned long far, unsigned int esr,
 		count_vm_spf_event(SPF_ABORT_UNMAPPED);
 		goto spf_abort;
 	}
-	if (!vma_is_anonymous(vma)) {
+	if (!vma_can_speculate(vma, mm_flags)) {
 		rcu_read_unlock();
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;

arch/powerpc/mm/fault.c

@@ -475,7 +475,7 @@ static int ___do_page_fault(struct pt_regs *regs, unsigned long address,
 		count_vm_spf_event(SPF_ABORT_UNMAPPED);
 		goto spf_abort;
 	}
-	if (!vma_is_anonymous(vma)) {
+	if (!vma_can_speculate(vma, flags)) {
 		rcu_read_unlock();
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;

arch/x86/mm/fault.c

@@ -1348,7 +1348,7 @@ void do_user_addr_fault(struct pt_regs *regs,
 		count_vm_spf_event(SPF_ABORT_UNMAPPED);
 		goto spf_abort;
 	}
-	if (!vma_is_anonymous(vma)) {
+	if (!vma_can_speculate(vma, flags)) {
 		rcu_read_unlock();
 		count_vm_spf_event(SPF_ABORT_NO_SPECULATE);
 		goto spf_abort;

include/linux/mm.h

@@ -722,6 +722,20 @@ static inline bool vma_is_accessible(struct vm_area_struct *vma)
 	return vma->vm_flags & VM_ACCESS_FLAGS;
 }
 
+static inline bool vma_can_speculate(struct vm_area_struct *vma,
+		unsigned int flags)
+{
+	if (vma_is_anonymous(vma))
+		return true;
+	if (!vma->vm_ops->speculative)
+		return false;
+	if (!(flags & FAULT_FLAG_WRITE))
+		return true;
+	if (!(vma->vm_flags & VM_SHARED))
+		return true;
+	return false;
+}
+
 #ifdef CONFIG_SHMEM
 /*
  * The vma_is_shmem is not inline because it is used only by slow

include/linux/vm_event_item.h

@@ -152,6 +152,7 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
 		SPF_ABORT_FAULT,
 		SPF_ABORT_SWAP,
 		SPF_ATTEMPT_ANON,
+		SPF_ATTEMPT_FILE,
 		SPF_ATTEMPT_NUMA,
 		SPF_ATTEMPT_PTE,
 		SPF_ATTEMPT_WP,

mm/memory.c

@@ -4382,8 +4382,14 @@ static vm_fault_t do_cow_fault(struct vm_fault *vmf)
 	struct vm_area_struct *vma = vmf->vma;
 	vm_fault_t ret;
 
-	if (unlikely(anon_vma_prepare(vma)))
-		return VM_FAULT_OOM;
+	if (unlikely(!vma->anon_vma)) {
+		if (vmf->flags & FAULT_FLAG_SPECULATIVE) {
+			count_vm_spf_event(SPF_ABORT_ANON_VMA);
+			return VM_FAULT_RETRY;
+		}
+		if (__anon_vma_prepare(vma))
+			return VM_FAULT_OOM;
+	}
 
 	vmf->cow_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, vmf->address);
 	if (!vmf->cow_page)
@@ -4420,6 +4426,8 @@ static vm_fault_t do_shared_fault(struct vm_fault *vmf)
 	struct vm_area_struct *vma = vmf->vma;
 	vm_fault_t ret, tmp;
 
+	VM_BUG_ON(vmf->flags & FAULT_FLAG_SPECULATIVE);
+
 	ret = __do_fault(vmf);
 	if (unlikely(ret & (VM_FAULT_ERROR | VM_FAULT_NOPAGE | VM_FAULT_RETRY)))
 		return ret;
@@ -4464,12 +4472,15 @@ static vm_fault_t do_fault(struct vm_fault *vmf)
 	struct mm_struct *vm_mm = vma->vm_mm;
 	vm_fault_t ret;
 
-	VM_BUG_ON(vmf->flags & FAULT_FLAG_SPECULATIVE);
+	if (vmf->flags & FAULT_FLAG_SPECULATIVE)
+		count_vm_spf_event(SPF_ATTEMPT_FILE);
 
 	/*
 	 * The VMA was not fully populated on mmap() or missing VM_DONTEXPAND
 	 */
 	if (!vma->vm_ops->fault) {
+		VM_BUG_ON(vmf->flags & FAULT_FLAG_SPECULATIVE);
+
 		/*
 		 * If we find a migration pmd entry or a none pmd entry, which
 		 * should never happen, return SIGBUS
@@ -5052,7 +5063,8 @@ vm_fault_t do_handle_mm_fault(struct vm_area_struct *vma,
 {
 	vm_fault_t ret;
 
-	VM_BUG_ON((flags & FAULT_FLAG_SPECULATIVE) && !vma_is_anonymous(vma));
+	VM_BUG_ON((flags & FAULT_FLAG_SPECULATIVE) &&
+		  !vma_can_speculate(vma, flags));
 
 	__set_current_state(TASK_RUNNING);
 

mm/vmstat.c

@@ -1400,6 +1400,7 @@ const char * const vmstat_text[] = {
 	"SPF_ABORT_FAULT",
 	"SPF_ABORT_SWAP",
 	"SPF_ATTEMPT_ANON",
+	"SPF_ATTEMPT_FILE",
 	"SPF_ATTEMPT_NUMA",
 	"SPF_ATTEMPT_PTE",
 	"SPF_ATTEMPT_WP",