3 files changed, 92 insertions, 2 deletions

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 85ef60fdf2c0..5830b2e129ed 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -14,6 +14,7 @@
 #include <linux/swapops.h>
 #include <linux/mmu_notifier.h>
 #include <linux/page_idle.h>
+#include <linux/shmem_fs.h>
 
 #include <asm/elf.h>
 #include <asm/uaccess.h>
@@ -717,8 +718,25 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
 
 #ifdef CONFIG_SHMEM
         if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) {
-                mss.check_shmem_swap = true;
-                smaps_walk.pte_hole = smaps_pte_hole;
+                /*
+                 * For shared or readonly shmem mappings we know that all
+                 * swapped out pages belong to the shmem object, and we can
+                 * obtain the swap value much more efficiently. For private
+                 * writable mappings, we might have COW pages that are
+                 * not affected by the parent swapped out pages of the shmem
+                 * object, so we have to distinguish them during the page walk.
+                 * Unless we know that the shmem object (or the part mapped by
+                 * our VMA) has no swapped out pages at all.
+                 */
+                unsigned long shmem_swapped = shmem_swap_usage(vma);
+
+                if (!shmem_swapped || (vma->vm_flags & VM_SHARED) ||
+                                        !(vma->vm_flags & VM_WRITE)) {
+                        mss.swap = shmem_swapped;
+                } else {
+                        mss.check_shmem_swap = true;
+                        smaps_walk.pte_hole = smaps_pte_hole;
+                }
         }
 #endif
 
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index 50777b5b1e4c..bd58be5e7a2a 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -60,6 +60,8 @@ extern struct page *shmem_read_mapping_page_gfp(struct address_space *mapping,
 extern void shmem_truncate_range(struct inode *inode, loff_t start, loff_t end);
 extern int shmem_unuse(swp_entry_t entry, struct page *page);
 
+extern unsigned long shmem_swap_usage(struct vm_area_struct *vma);
+
 static inline struct page *shmem_read_mapping_page(
                                 struct address_space *mapping, pgoff_t index)
 {
diff --git a/mm/shmem.c b/mm/shmem.c
index 9e60093aca3f..e978621de1ef 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -360,6 +360,76 @@ static int shmem_free_swap(struct address_space *mapping,
 }
 
 /*
+ * Determine (in bytes) how many of the shmem object's pages mapped by the
+ * given vma is swapped out.
+ *
+ * This is safe to call without i_mutex or mapping->tree_lock thanks to RCU,
+ * as long as the inode doesn't go away and racy results are not a problem.
+ */
+unsigned long shmem_swap_usage(struct vm_area_struct *vma)
+{
+        struct inode *inode = file_inode(vma->vm_file);
+        struct shmem_inode_info *info = SHMEM_I(inode);
+        struct address_space *mapping = inode->i_mapping;
+        unsigned long swapped;
+        pgoff_t start, end;
+        struct radix_tree_iter iter;
+        void **slot;
+        struct page *page;
+
+        /* Be careful as we don't hold info->lock */
+        swapped = READ_ONCE(info->swapped);
+
+        /*
+         * The easier cases are when the shmem object has nothing in swap, or
+         * the vma maps it whole. Then we can simply use the stats that we
+         * already track.
+         */
+        if (!swapped)
+                return 0;
+
+        if (!vma->vm_pgoff && vma->vm_end - vma->vm_start >= inode->i_size)
+                return swapped << PAGE_SHIFT;
+
+        swapped = 0;
+
+        /* Here comes the more involved part */
+        start = linear_page_index(vma, vma->vm_start);
+        end = linear_page_index(vma, vma->vm_end);
+
+        rcu_read_lock();
+
+restart:
+        radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
+                if (iter.index >= end)
+                        break;
+
+                page = radix_tree_deref_slot(slot);
+
+                /*
+                 * This should only be possible to happen at index 0, so we
+                 * don't need to reset the counter, nor do we risk infinite
+                 * restarts.
+                 */
+                if (radix_tree_deref_retry(page))
+                        goto restart;
+
+                if (radix_tree_exceptional_entry(page))
+                        swapped++;
+
+                if (need_resched()) {
+                        cond_resched_rcu();
+                        start = iter.index + 1;
+                        goto restart;
+                }
+        }
+
+        rcu_read_unlock();
+
+        return swapped << PAGE_SHIFT;
+}
+
+/*
  * SysV IPC SHM_UNLOCK restore Unevictable pages to their evictable lists.
  */
 void shmem_unlock_mapping(struct address_space *mapping)