Commit | Line | Data |
---|---|---|
133ff0ea JG |
1 | /* |
2 | * Copyright 2013 Red Hat Inc. | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License as published by | |
6 | * the Free Software Foundation; either version 2 of the License, or | |
7 | * (at your option) any later version. | |
8 | * | |
9 | * This program is distributed in the hope that it will be useful, | |
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
12 | * GNU General Public License for more details. | |
13 | * | |
f813f219 | 14 | * Authors: Jérôme Glisse <jglisse@redhat.com> |
133ff0ea JG |
15 | */ |
16 | /* | |
17 | * Refer to include/linux/hmm.h for information about heterogeneous memory | |
18 | * management or HMM for short. | |
19 | */ | |
20 | #include <linux/mm.h> | |
21 | #include <linux/hmm.h> | |
858b54da | 22 | #include <linux/init.h> |
da4c3c73 JG |
23 | #include <linux/rmap.h> |
24 | #include <linux/swap.h> | |
133ff0ea JG |
25 | #include <linux/slab.h> |
26 | #include <linux/sched.h> | |
4ef589dc JG |
27 | #include <linux/mmzone.h> |
28 | #include <linux/pagemap.h> | |
da4c3c73 JG |
29 | #include <linux/swapops.h> |
30 | #include <linux/hugetlb.h> | |
4ef589dc | 31 | #include <linux/memremap.h> |
7b2d55d2 | 32 | #include <linux/jump_label.h> |
c0b12405 | 33 | #include <linux/mmu_notifier.h> |
4ef589dc JG |
34 | #include <linux/memory_hotplug.h> |
35 | ||
36 | #define PA_SECTION_SIZE (1UL << PA_SECTION_SHIFT) | |
133ff0ea | 37 | |
6b368cd4 | 38 | #if IS_ENABLED(CONFIG_HMM_MIRROR) |
c0b12405 JG |
39 | static const struct mmu_notifier_ops hmm_mmu_notifier_ops; |
40 | ||
133ff0ea JG |
41 | /* |
42 | * struct hmm - HMM per mm struct | |
43 | * | |
44 | * @mm: mm struct this HMM struct is bound to | |
da4c3c73 | 45 | * @lock: lock protecting ranges list |
c0b12405 | 46 | * @sequence: we track updates to the CPU page table with a sequence number |
da4c3c73 | 47 | * @ranges: list of range being snapshotted |
c0b12405 JG |
48 | * @mirrors: list of mirrors for this mm |
49 | * @mmu_notifier: mmu notifier to track updates to CPU page table | |
50 | * @mirrors_sem: read/write semaphore protecting the mirrors list | |
133ff0ea JG |
51 | */ |
52 | struct hmm { | |
53 | struct mm_struct *mm; | |
da4c3c73 | 54 | spinlock_t lock; |
c0b12405 | 55 | atomic_t sequence; |
da4c3c73 | 56 | struct list_head ranges; |
c0b12405 JG |
57 | struct list_head mirrors; |
58 | struct mmu_notifier mmu_notifier; | |
59 | struct rw_semaphore mirrors_sem; | |
133ff0ea JG |
60 | }; |
61 | ||
62 | /* | |
63 | * hmm_register - register HMM against an mm (HMM internal) | |
64 | * | |
65 | * @mm: mm struct to attach to | |
66 | * | |
67 | * This is not intended to be used directly by device drivers. It allocates an | |
68 | * HMM struct if mm does not have one, and initializes it. | |
69 | */ | |
70 | static struct hmm *hmm_register(struct mm_struct *mm) | |
71 | { | |
c0b12405 JG |
72 | struct hmm *hmm = READ_ONCE(mm->hmm); |
73 | bool cleanup = false; | |
133ff0ea JG |
74 | |
75 | /* | |
76 | * The hmm struct can only be freed once the mm_struct goes away, | |
77 | * hence we should always have pre-allocated an new hmm struct | |
78 | * above. | |
79 | */ | |
c0b12405 JG |
80 | if (hmm) |
81 | return hmm; | |
82 | ||
83 | hmm = kmalloc(sizeof(*hmm), GFP_KERNEL); | |
84 | if (!hmm) | |
85 | return NULL; | |
86 | INIT_LIST_HEAD(&hmm->mirrors); | |
87 | init_rwsem(&hmm->mirrors_sem); | |
88 | atomic_set(&hmm->sequence, 0); | |
89 | hmm->mmu_notifier.ops = NULL; | |
da4c3c73 JG |
90 | INIT_LIST_HEAD(&hmm->ranges); |
91 | spin_lock_init(&hmm->lock); | |
c0b12405 JG |
92 | hmm->mm = mm; |
93 | ||
c0b12405 JG |
94 | spin_lock(&mm->page_table_lock); |
95 | if (!mm->hmm) | |
96 | mm->hmm = hmm; | |
97 | else | |
98 | cleanup = true; | |
99 | spin_unlock(&mm->page_table_lock); | |
100 | ||
86a2d598 RC |
101 | if (cleanup) |
102 | goto error; | |
103 | ||
104 | /* | |
105 | * We should only get here if hold the mmap_sem in write mode ie on | |
106 | * registration of first mirror through hmm_mirror_register() | |
107 | */ | |
108 | hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops; | |
109 | if (__mmu_notifier_register(&hmm->mmu_notifier, mm)) | |
110 | goto error_mm; | |
c0b12405 | 111 | |
133ff0ea | 112 | return mm->hmm; |
86a2d598 RC |
113 | |
114 | error_mm: | |
115 | spin_lock(&mm->page_table_lock); | |
116 | if (mm->hmm == hmm) | |
117 | mm->hmm = NULL; | |
118 | spin_unlock(&mm->page_table_lock); | |
119 | error: | |
120 | kfree(hmm); | |
121 | return NULL; | |
133ff0ea JG |
122 | } |
123 | ||
124 | void hmm_mm_destroy(struct mm_struct *mm) | |
125 | { | |
126 | kfree(mm->hmm); | |
127 | } | |
c0b12405 | 128 | |
c0b12405 JG |
129 | static void hmm_invalidate_range(struct hmm *hmm, |
130 | enum hmm_update_type action, | |
131 | unsigned long start, | |
132 | unsigned long end) | |
133 | { | |
134 | struct hmm_mirror *mirror; | |
da4c3c73 JG |
135 | struct hmm_range *range; |
136 | ||
137 | spin_lock(&hmm->lock); | |
138 | list_for_each_entry(range, &hmm->ranges, list) { | |
139 | unsigned long addr, idx, npages; | |
140 | ||
141 | if (end < range->start || start >= range->end) | |
142 | continue; | |
143 | ||
144 | range->valid = false; | |
145 | addr = max(start, range->start); | |
146 | idx = (addr - range->start) >> PAGE_SHIFT; | |
147 | npages = (min(range->end, end) - addr) >> PAGE_SHIFT; | |
148 | memset(&range->pfns[idx], 0, sizeof(*range->pfns) * npages); | |
149 | } | |
150 | spin_unlock(&hmm->lock); | |
c0b12405 JG |
151 | |
152 | down_read(&hmm->mirrors_sem); | |
153 | list_for_each_entry(mirror, &hmm->mirrors, list) | |
154 | mirror->ops->sync_cpu_device_pagetables(mirror, action, | |
155 | start, end); | |
156 | up_read(&hmm->mirrors_sem); | |
157 | } | |
158 | ||
e1401513 RC |
159 | static void hmm_release(struct mmu_notifier *mn, struct mm_struct *mm) |
160 | { | |
161 | struct hmm_mirror *mirror; | |
162 | struct hmm *hmm = mm->hmm; | |
163 | ||
164 | down_write(&hmm->mirrors_sem); | |
165 | mirror = list_first_entry_or_null(&hmm->mirrors, struct hmm_mirror, | |
166 | list); | |
167 | while (mirror) { | |
168 | list_del_init(&mirror->list); | |
169 | if (mirror->ops->release) { | |
170 | /* | |
171 | * Drop mirrors_sem so callback can wait on any pending | |
172 | * work that might itself trigger mmu_notifier callback | |
173 | * and thus would deadlock with us. | |
174 | */ | |
175 | up_write(&hmm->mirrors_sem); | |
176 | mirror->ops->release(mirror); | |
177 | down_write(&hmm->mirrors_sem); | |
178 | } | |
179 | mirror = list_first_entry_or_null(&hmm->mirrors, | |
180 | struct hmm_mirror, list); | |
181 | } | |
182 | up_write(&hmm->mirrors_sem); | |
183 | } | |
184 | ||
93065ac7 | 185 | static int hmm_invalidate_range_start(struct mmu_notifier *mn, |
c0b12405 JG |
186 | struct mm_struct *mm, |
187 | unsigned long start, | |
93065ac7 MH |
188 | unsigned long end, |
189 | bool blockable) | |
c0b12405 JG |
190 | { |
191 | struct hmm *hmm = mm->hmm; | |
192 | ||
193 | VM_BUG_ON(!hmm); | |
194 | ||
195 | atomic_inc(&hmm->sequence); | |
93065ac7 MH |
196 | |
197 | return 0; | |
c0b12405 JG |
198 | } |
199 | ||
200 | static void hmm_invalidate_range_end(struct mmu_notifier *mn, | |
201 | struct mm_struct *mm, | |
202 | unsigned long start, | |
203 | unsigned long end) | |
204 | { | |
205 | struct hmm *hmm = mm->hmm; | |
206 | ||
207 | VM_BUG_ON(!hmm); | |
208 | ||
209 | hmm_invalidate_range(mm->hmm, HMM_UPDATE_INVALIDATE, start, end); | |
210 | } | |
211 | ||
212 | static const struct mmu_notifier_ops hmm_mmu_notifier_ops = { | |
e1401513 | 213 | .release = hmm_release, |
c0b12405 JG |
214 | .invalidate_range_start = hmm_invalidate_range_start, |
215 | .invalidate_range_end = hmm_invalidate_range_end, | |
216 | }; | |
217 | ||
218 | /* | |
219 | * hmm_mirror_register() - register a mirror against an mm | |
220 | * | |
221 | * @mirror: new mirror struct to register | |
222 | * @mm: mm to register against | |
223 | * | |
224 | * To start mirroring a process address space, the device driver must register | |
225 | * an HMM mirror struct. | |
226 | * | |
227 | * THE mm->mmap_sem MUST BE HELD IN WRITE MODE ! | |
228 | */ | |
229 | int hmm_mirror_register(struct hmm_mirror *mirror, struct mm_struct *mm) | |
230 | { | |
231 | /* Sanity check */ | |
232 | if (!mm || !mirror || !mirror->ops) | |
233 | return -EINVAL; | |
234 | ||
c01cbba2 | 235 | again: |
c0b12405 JG |
236 | mirror->hmm = hmm_register(mm); |
237 | if (!mirror->hmm) | |
238 | return -ENOMEM; | |
239 | ||
240 | down_write(&mirror->hmm->mirrors_sem); | |
c01cbba2 JG |
241 | if (mirror->hmm->mm == NULL) { |
242 | /* | |
243 | * A racing hmm_mirror_unregister() is about to destroy the hmm | |
244 | * struct. Try again to allocate a new one. | |
245 | */ | |
246 | up_write(&mirror->hmm->mirrors_sem); | |
247 | mirror->hmm = NULL; | |
248 | goto again; | |
249 | } else { | |
250 | list_add(&mirror->list, &mirror->hmm->mirrors); | |
251 | up_write(&mirror->hmm->mirrors_sem); | |
252 | } | |
c0b12405 JG |
253 | |
254 | return 0; | |
255 | } | |
256 | EXPORT_SYMBOL(hmm_mirror_register); | |
257 | ||
258 | /* | |
259 | * hmm_mirror_unregister() - unregister a mirror | |
260 | * | |
261 | * @mirror: new mirror struct to register | |
262 | * | |
263 | * Stop mirroring a process address space, and cleanup. | |
264 | */ | |
265 | void hmm_mirror_unregister(struct hmm_mirror *mirror) | |
266 | { | |
c01cbba2 JG |
267 | bool should_unregister = false; |
268 | struct mm_struct *mm; | |
269 | struct hmm *hmm; | |
270 | ||
271 | if (mirror->hmm == NULL) | |
272 | return; | |
c0b12405 | 273 | |
c01cbba2 | 274 | hmm = mirror->hmm; |
c0b12405 | 275 | down_write(&hmm->mirrors_sem); |
e1401513 | 276 | list_del_init(&mirror->list); |
c01cbba2 JG |
277 | should_unregister = list_empty(&hmm->mirrors); |
278 | mirror->hmm = NULL; | |
279 | mm = hmm->mm; | |
280 | hmm->mm = NULL; | |
c0b12405 | 281 | up_write(&hmm->mirrors_sem); |
c01cbba2 JG |
282 | |
283 | if (!should_unregister || mm == NULL) | |
284 | return; | |
285 | ||
86a2d598 RC |
286 | mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm); |
287 | ||
c01cbba2 JG |
288 | spin_lock(&mm->page_table_lock); |
289 | if (mm->hmm == hmm) | |
290 | mm->hmm = NULL; | |
291 | spin_unlock(&mm->page_table_lock); | |
292 | ||
c01cbba2 | 293 | kfree(hmm); |
c0b12405 JG |
294 | } |
295 | EXPORT_SYMBOL(hmm_mirror_unregister); | |
da4c3c73 | 296 | |
74eee180 JG |
297 | struct hmm_vma_walk { |
298 | struct hmm_range *range; | |
299 | unsigned long last; | |
300 | bool fault; | |
301 | bool block; | |
74eee180 JG |
302 | }; |
303 | ||
2aee09d8 JG |
304 | static int hmm_vma_do_fault(struct mm_walk *walk, unsigned long addr, |
305 | bool write_fault, uint64_t *pfn) | |
74eee180 JG |
306 | { |
307 | unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_REMOTE; | |
308 | struct hmm_vma_walk *hmm_vma_walk = walk->private; | |
f88a1e90 | 309 | struct hmm_range *range = hmm_vma_walk->range; |
74eee180 | 310 | struct vm_area_struct *vma = walk->vma; |
50a7ca3c | 311 | vm_fault_t ret; |
74eee180 JG |
312 | |
313 | flags |= hmm_vma_walk->block ? 0 : FAULT_FLAG_ALLOW_RETRY; | |
2aee09d8 | 314 | flags |= write_fault ? FAULT_FLAG_WRITE : 0; |
50a7ca3c SJ |
315 | ret = handle_mm_fault(vma, addr, flags); |
316 | if (ret & VM_FAULT_RETRY) | |
74eee180 | 317 | return -EBUSY; |
50a7ca3c | 318 | if (ret & VM_FAULT_ERROR) { |
f88a1e90 | 319 | *pfn = range->values[HMM_PFN_ERROR]; |
74eee180 JG |
320 | return -EFAULT; |
321 | } | |
322 | ||
323 | return -EAGAIN; | |
324 | } | |
325 | ||
da4c3c73 JG |
326 | static int hmm_pfns_bad(unsigned long addr, |
327 | unsigned long end, | |
328 | struct mm_walk *walk) | |
329 | { | |
c719547f JG |
330 | struct hmm_vma_walk *hmm_vma_walk = walk->private; |
331 | struct hmm_range *range = hmm_vma_walk->range; | |
ff05c0c6 | 332 | uint64_t *pfns = range->pfns; |
da4c3c73 JG |
333 | unsigned long i; |
334 | ||
335 | i = (addr - range->start) >> PAGE_SHIFT; | |
336 | for (; addr < end; addr += PAGE_SIZE, i++) | |
f88a1e90 | 337 | pfns[i] = range->values[HMM_PFN_ERROR]; |
da4c3c73 JG |
338 | |
339 | return 0; | |
340 | } | |
341 | ||
5504ed29 JG |
342 | /* |
343 | * hmm_vma_walk_hole() - handle a range lacking valid pmd or pte(s) | |
344 | * @start: range virtual start address (inclusive) | |
345 | * @end: range virtual end address (exclusive) | |
2aee09d8 JG |
346 | * @fault: should we fault or not ? |
347 | * @write_fault: write fault ? | |
5504ed29 JG |
348 | * @walk: mm_walk structure |
349 | * Returns: 0 on success, -EAGAIN after page fault, or page fault error | |
350 | * | |
351 | * This function will be called whenever pmd_none() or pte_none() returns true, | |
352 | * or whenever there is no page directory covering the virtual address range. | |
353 | */ | |
2aee09d8 JG |
354 | static int hmm_vma_walk_hole_(unsigned long addr, unsigned long end, |
355 | bool fault, bool write_fault, | |
356 | struct mm_walk *walk) | |
da4c3c73 | 357 | { |
74eee180 JG |
358 | struct hmm_vma_walk *hmm_vma_walk = walk->private; |
359 | struct hmm_range *range = hmm_vma_walk->range; | |
ff05c0c6 | 360 | uint64_t *pfns = range->pfns; |
da4c3c73 JG |
361 | unsigned long i; |
362 | ||
74eee180 | 363 | hmm_vma_walk->last = addr; |
da4c3c73 | 364 | i = (addr - range->start) >> PAGE_SHIFT; |
74eee180 | 365 | for (; addr < end; addr += PAGE_SIZE, i++) { |
f88a1e90 | 366 | pfns[i] = range->values[HMM_PFN_NONE]; |
2aee09d8 | 367 | if (fault || write_fault) { |
74eee180 | 368 | int ret; |
da4c3c73 | 369 | |
2aee09d8 JG |
370 | ret = hmm_vma_do_fault(walk, addr, write_fault, |
371 | &pfns[i]); | |
74eee180 JG |
372 | if (ret != -EAGAIN) |
373 | return ret; | |
374 | } | |
375 | } | |
376 | ||
2aee09d8 JG |
377 | return (fault || write_fault) ? -EAGAIN : 0; |
378 | } | |
379 | ||
380 | static inline void hmm_pte_need_fault(const struct hmm_vma_walk *hmm_vma_walk, | |
381 | uint64_t pfns, uint64_t cpu_flags, | |
382 | bool *fault, bool *write_fault) | |
383 | { | |
f88a1e90 JG |
384 | struct hmm_range *range = hmm_vma_walk->range; |
385 | ||
2aee09d8 JG |
386 | *fault = *write_fault = false; |
387 | if (!hmm_vma_walk->fault) | |
388 | return; | |
389 | ||
390 | /* We aren't ask to do anything ... */ | |
f88a1e90 | 391 | if (!(pfns & range->flags[HMM_PFN_VALID])) |
2aee09d8 | 392 | return; |
f88a1e90 JG |
393 | /* If this is device memory than only fault if explicitly requested */ |
394 | if ((cpu_flags & range->flags[HMM_PFN_DEVICE_PRIVATE])) { | |
395 | /* Do we fault on device memory ? */ | |
396 | if (pfns & range->flags[HMM_PFN_DEVICE_PRIVATE]) { | |
397 | *write_fault = pfns & range->flags[HMM_PFN_WRITE]; | |
398 | *fault = true; | |
399 | } | |
2aee09d8 JG |
400 | return; |
401 | } | |
f88a1e90 JG |
402 | |
403 | /* If CPU page table is not valid then we need to fault */ | |
404 | *fault = !(cpu_flags & range->flags[HMM_PFN_VALID]); | |
405 | /* Need to write fault ? */ | |
406 | if ((pfns & range->flags[HMM_PFN_WRITE]) && | |
407 | !(cpu_flags & range->flags[HMM_PFN_WRITE])) { | |
408 | *write_fault = true; | |
2aee09d8 JG |
409 | *fault = true; |
410 | } | |
411 | } | |
412 | ||
413 | static void hmm_range_need_fault(const struct hmm_vma_walk *hmm_vma_walk, | |
414 | const uint64_t *pfns, unsigned long npages, | |
415 | uint64_t cpu_flags, bool *fault, | |
416 | bool *write_fault) | |
417 | { | |
418 | unsigned long i; | |
419 | ||
420 | if (!hmm_vma_walk->fault) { | |
421 | *fault = *write_fault = false; | |
422 | return; | |
423 | } | |
424 | ||
425 | for (i = 0; i < npages; ++i) { | |
426 | hmm_pte_need_fault(hmm_vma_walk, pfns[i], cpu_flags, | |
427 | fault, write_fault); | |
428 | if ((*fault) || (*write_fault)) | |
429 | return; | |
430 | } | |
431 | } | |
432 | ||
433 | static int hmm_vma_walk_hole(unsigned long addr, unsigned long end, | |
434 | struct mm_walk *walk) | |
435 | { | |
436 | struct hmm_vma_walk *hmm_vma_walk = walk->private; | |
437 | struct hmm_range *range = hmm_vma_walk->range; | |
438 | bool fault, write_fault; | |
439 | unsigned long i, npages; | |
440 | uint64_t *pfns; | |
441 | ||
442 | i = (addr - range->start) >> PAGE_SHIFT; | |
443 | npages = (end - addr) >> PAGE_SHIFT; | |
444 | pfns = &range->pfns[i]; | |
445 | hmm_range_need_fault(hmm_vma_walk, pfns, npages, | |
446 | 0, &fault, &write_fault); | |
447 | return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk); | |
448 | } | |
449 | ||
f88a1e90 | 450 | static inline uint64_t pmd_to_hmm_pfn_flags(struct hmm_range *range, pmd_t pmd) |
2aee09d8 JG |
451 | { |
452 | if (pmd_protnone(pmd)) | |
453 | return 0; | |
f88a1e90 JG |
454 | return pmd_write(pmd) ? range->flags[HMM_PFN_VALID] | |
455 | range->flags[HMM_PFN_WRITE] : | |
456 | range->flags[HMM_PFN_VALID]; | |
da4c3c73 JG |
457 | } |
458 | ||
53f5c3f4 JG |
459 | static int hmm_vma_handle_pmd(struct mm_walk *walk, |
460 | unsigned long addr, | |
461 | unsigned long end, | |
462 | uint64_t *pfns, | |
463 | pmd_t pmd) | |
464 | { | |
465 | struct hmm_vma_walk *hmm_vma_walk = walk->private; | |
f88a1e90 | 466 | struct hmm_range *range = hmm_vma_walk->range; |
2aee09d8 | 467 | unsigned long pfn, npages, i; |
2aee09d8 | 468 | bool fault, write_fault; |
f88a1e90 | 469 | uint64_t cpu_flags; |
53f5c3f4 | 470 | |
2aee09d8 | 471 | npages = (end - addr) >> PAGE_SHIFT; |
f88a1e90 | 472 | cpu_flags = pmd_to_hmm_pfn_flags(range, pmd); |
2aee09d8 JG |
473 | hmm_range_need_fault(hmm_vma_walk, pfns, npages, cpu_flags, |
474 | &fault, &write_fault); | |
53f5c3f4 | 475 | |
2aee09d8 JG |
476 | if (pmd_protnone(pmd) || fault || write_fault) |
477 | return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk); | |
53f5c3f4 JG |
478 | |
479 | pfn = pmd_pfn(pmd) + pte_index(addr); | |
53f5c3f4 | 480 | for (i = 0; addr < end; addr += PAGE_SIZE, i++, pfn++) |
f88a1e90 | 481 | pfns[i] = hmm_pfn_from_pfn(range, pfn) | cpu_flags; |
53f5c3f4 JG |
482 | hmm_vma_walk->last = end; |
483 | return 0; | |
484 | } | |
485 | ||
f88a1e90 | 486 | static inline uint64_t pte_to_hmm_pfn_flags(struct hmm_range *range, pte_t pte) |
2aee09d8 JG |
487 | { |
488 | if (pte_none(pte) || !pte_present(pte)) | |
489 | return 0; | |
f88a1e90 JG |
490 | return pte_write(pte) ? range->flags[HMM_PFN_VALID] | |
491 | range->flags[HMM_PFN_WRITE] : | |
492 | range->flags[HMM_PFN_VALID]; | |
2aee09d8 JG |
493 | } |
494 | ||
53f5c3f4 JG |
495 | static int hmm_vma_handle_pte(struct mm_walk *walk, unsigned long addr, |
496 | unsigned long end, pmd_t *pmdp, pte_t *ptep, | |
497 | uint64_t *pfn) | |
498 | { | |
499 | struct hmm_vma_walk *hmm_vma_walk = walk->private; | |
f88a1e90 | 500 | struct hmm_range *range = hmm_vma_walk->range; |
53f5c3f4 | 501 | struct vm_area_struct *vma = walk->vma; |
2aee09d8 JG |
502 | bool fault, write_fault; |
503 | uint64_t cpu_flags; | |
53f5c3f4 | 504 | pte_t pte = *ptep; |
f88a1e90 | 505 | uint64_t orig_pfn = *pfn; |
53f5c3f4 | 506 | |
f88a1e90 JG |
507 | *pfn = range->values[HMM_PFN_NONE]; |
508 | cpu_flags = pte_to_hmm_pfn_flags(range, pte); | |
509 | hmm_pte_need_fault(hmm_vma_walk, orig_pfn, cpu_flags, | |
2aee09d8 | 510 | &fault, &write_fault); |
53f5c3f4 JG |
511 | |
512 | if (pte_none(pte)) { | |
2aee09d8 | 513 | if (fault || write_fault) |
53f5c3f4 JG |
514 | goto fault; |
515 | return 0; | |
516 | } | |
517 | ||
518 | if (!pte_present(pte)) { | |
519 | swp_entry_t entry = pte_to_swp_entry(pte); | |
520 | ||
521 | if (!non_swap_entry(entry)) { | |
2aee09d8 | 522 | if (fault || write_fault) |
53f5c3f4 JG |
523 | goto fault; |
524 | return 0; | |
525 | } | |
526 | ||
527 | /* | |
528 | * This is a special swap entry, ignore migration, use | |
529 | * device and report anything else as error. | |
530 | */ | |
531 | if (is_device_private_entry(entry)) { | |
f88a1e90 JG |
532 | cpu_flags = range->flags[HMM_PFN_VALID] | |
533 | range->flags[HMM_PFN_DEVICE_PRIVATE]; | |
2aee09d8 | 534 | cpu_flags |= is_write_device_private_entry(entry) ? |
f88a1e90 JG |
535 | range->flags[HMM_PFN_WRITE] : 0; |
536 | hmm_pte_need_fault(hmm_vma_walk, orig_pfn, cpu_flags, | |
537 | &fault, &write_fault); | |
538 | if (fault || write_fault) | |
539 | goto fault; | |
540 | *pfn = hmm_pfn_from_pfn(range, swp_offset(entry)); | |
541 | *pfn |= cpu_flags; | |
53f5c3f4 JG |
542 | return 0; |
543 | } | |
544 | ||
545 | if (is_migration_entry(entry)) { | |
2aee09d8 | 546 | if (fault || write_fault) { |
53f5c3f4 JG |
547 | pte_unmap(ptep); |
548 | hmm_vma_walk->last = addr; | |
549 | migration_entry_wait(vma->vm_mm, | |
2aee09d8 | 550 | pmdp, addr); |
53f5c3f4 JG |
551 | return -EAGAIN; |
552 | } | |
553 | return 0; | |
554 | } | |
555 | ||
556 | /* Report error for everything else */ | |
f88a1e90 | 557 | *pfn = range->values[HMM_PFN_ERROR]; |
53f5c3f4 JG |
558 | return -EFAULT; |
559 | } | |
560 | ||
2aee09d8 | 561 | if (fault || write_fault) |
53f5c3f4 JG |
562 | goto fault; |
563 | ||
f88a1e90 | 564 | *pfn = hmm_pfn_from_pfn(range, pte_pfn(pte)) | cpu_flags; |
53f5c3f4 JG |
565 | return 0; |
566 | ||
567 | fault: | |
568 | pte_unmap(ptep); | |
569 | /* Fault any virtual address we were asked to fault */ | |
2aee09d8 | 570 | return hmm_vma_walk_hole_(addr, end, fault, write_fault, walk); |
53f5c3f4 JG |
571 | } |
572 | ||
da4c3c73 JG |
573 | static int hmm_vma_walk_pmd(pmd_t *pmdp, |
574 | unsigned long start, | |
575 | unsigned long end, | |
576 | struct mm_walk *walk) | |
577 | { | |
74eee180 JG |
578 | struct hmm_vma_walk *hmm_vma_walk = walk->private; |
579 | struct hmm_range *range = hmm_vma_walk->range; | |
d08faca0 | 580 | struct vm_area_struct *vma = walk->vma; |
ff05c0c6 | 581 | uint64_t *pfns = range->pfns; |
da4c3c73 | 582 | unsigned long addr = start, i; |
da4c3c73 | 583 | pte_t *ptep; |
d08faca0 | 584 | pmd_t pmd; |
da4c3c73 | 585 | |
da4c3c73 JG |
586 | |
587 | again: | |
d08faca0 JG |
588 | pmd = READ_ONCE(*pmdp); |
589 | if (pmd_none(pmd)) | |
da4c3c73 JG |
590 | return hmm_vma_walk_hole(start, end, walk); |
591 | ||
d08faca0 | 592 | if (pmd_huge(pmd) && (range->vma->vm_flags & VM_HUGETLB)) |
da4c3c73 JG |
593 | return hmm_pfns_bad(start, end, walk); |
594 | ||
d08faca0 JG |
595 | if (thp_migration_supported() && is_pmd_migration_entry(pmd)) { |
596 | bool fault, write_fault; | |
597 | unsigned long npages; | |
598 | uint64_t *pfns; | |
599 | ||
600 | i = (addr - range->start) >> PAGE_SHIFT; | |
601 | npages = (end - addr) >> PAGE_SHIFT; | |
602 | pfns = &range->pfns[i]; | |
603 | ||
604 | hmm_range_need_fault(hmm_vma_walk, pfns, npages, | |
605 | 0, &fault, &write_fault); | |
606 | if (fault || write_fault) { | |
607 | hmm_vma_walk->last = addr; | |
608 | pmd_migration_entry_wait(vma->vm_mm, pmdp); | |
609 | return -EAGAIN; | |
610 | } | |
611 | return 0; | |
612 | } else if (!pmd_present(pmd)) | |
613 | return hmm_pfns_bad(start, end, walk); | |
da4c3c73 | 614 | |
d08faca0 | 615 | if (pmd_devmap(pmd) || pmd_trans_huge(pmd)) { |
da4c3c73 JG |
616 | /* |
617 | * No need to take pmd_lock here, even if some other threads | |
618 | * is splitting the huge pmd we will get that event through | |
619 | * mmu_notifier callback. | |
620 | * | |
621 | * So just read pmd value and check again its a transparent | |
622 | * huge or device mapping one and compute corresponding pfn | |
623 | * values. | |
624 | */ | |
625 | pmd = pmd_read_atomic(pmdp); | |
626 | barrier(); | |
627 | if (!pmd_devmap(pmd) && !pmd_trans_huge(pmd)) | |
628 | goto again; | |
74eee180 | 629 | |
d08faca0 | 630 | i = (addr - range->start) >> PAGE_SHIFT; |
53f5c3f4 | 631 | return hmm_vma_handle_pmd(walk, addr, end, &pfns[i], pmd); |
da4c3c73 JG |
632 | } |
633 | ||
d08faca0 JG |
634 | /* |
635 | * We have handled all the valid case above ie either none, migration, | |
636 | * huge or transparent huge. At this point either it is a valid pmd | |
637 | * entry pointing to pte directory or it is a bad pmd that will not | |
638 | * recover. | |
639 | */ | |
640 | if (pmd_bad(pmd)) | |
da4c3c73 JG |
641 | return hmm_pfns_bad(start, end, walk); |
642 | ||
643 | ptep = pte_offset_map(pmdp, addr); | |
d08faca0 | 644 | i = (addr - range->start) >> PAGE_SHIFT; |
da4c3c73 | 645 | for (; addr < end; addr += PAGE_SIZE, ptep++, i++) { |
53f5c3f4 | 646 | int r; |
74eee180 | 647 | |
53f5c3f4 JG |
648 | r = hmm_vma_handle_pte(walk, addr, end, pmdp, ptep, &pfns[i]); |
649 | if (r) { | |
650 | /* hmm_vma_handle_pte() did unmap pte directory */ | |
651 | hmm_vma_walk->last = addr; | |
652 | return r; | |
74eee180 | 653 | } |
da4c3c73 JG |
654 | } |
655 | pte_unmap(ptep - 1); | |
656 | ||
53f5c3f4 | 657 | hmm_vma_walk->last = addr; |
da4c3c73 JG |
658 | return 0; |
659 | } | |
660 | ||
f88a1e90 JG |
661 | static void hmm_pfns_clear(struct hmm_range *range, |
662 | uint64_t *pfns, | |
33cd47dc JG |
663 | unsigned long addr, |
664 | unsigned long end) | |
665 | { | |
666 | for (; addr < end; addr += PAGE_SIZE, pfns++) | |
f88a1e90 | 667 | *pfns = range->values[HMM_PFN_NONE]; |
33cd47dc JG |
668 | } |
669 | ||
855ce7d2 JG |
670 | static void hmm_pfns_special(struct hmm_range *range) |
671 | { | |
672 | unsigned long addr = range->start, i = 0; | |
673 | ||
674 | for (; addr < range->end; addr += PAGE_SIZE, i++) | |
f88a1e90 | 675 | range->pfns[i] = range->values[HMM_PFN_SPECIAL]; |
855ce7d2 JG |
676 | } |
677 | ||
da4c3c73 JG |
678 | /* |
679 | * hmm_vma_get_pfns() - snapshot CPU page table for a range of virtual addresses | |
08232a45 | 680 | * @range: range being snapshotted |
86586a41 JG |
681 | * Returns: -EINVAL if invalid argument, -ENOMEM out of memory, -EPERM invalid |
682 | * vma permission, 0 success | |
da4c3c73 JG |
683 | * |
684 | * This snapshots the CPU page table for a range of virtual addresses. Snapshot | |
685 | * validity is tracked by range struct. See hmm_vma_range_done() for further | |
686 | * information. | |
687 | * | |
688 | * The range struct is initialized here. It tracks the CPU page table, but only | |
689 | * if the function returns success (0), in which case the caller must then call | |
690 | * hmm_vma_range_done() to stop CPU page table update tracking on this range. | |
691 | * | |
692 | * NOT CALLING hmm_vma_range_done() IF FUNCTION RETURNS 0 WILL LEAD TO SERIOUS | |
693 | * MEMORY CORRUPTION ! YOU HAVE BEEN WARNED ! | |
694 | */ | |
08232a45 | 695 | int hmm_vma_get_pfns(struct hmm_range *range) |
da4c3c73 | 696 | { |
08232a45 | 697 | struct vm_area_struct *vma = range->vma; |
74eee180 | 698 | struct hmm_vma_walk hmm_vma_walk; |
da4c3c73 JG |
699 | struct mm_walk mm_walk; |
700 | struct hmm *hmm; | |
701 | ||
da4c3c73 | 702 | /* Sanity check, this really should not happen ! */ |
08232a45 | 703 | if (range->start < vma->vm_start || range->start >= vma->vm_end) |
da4c3c73 | 704 | return -EINVAL; |
08232a45 | 705 | if (range->end < vma->vm_start || range->end > vma->vm_end) |
da4c3c73 JG |
706 | return -EINVAL; |
707 | ||
708 | hmm = hmm_register(vma->vm_mm); | |
709 | if (!hmm) | |
710 | return -ENOMEM; | |
711 | /* Caller must have registered a mirror, via hmm_mirror_register() ! */ | |
712 | if (!hmm->mmu_notifier.ops) | |
713 | return -EINVAL; | |
714 | ||
855ce7d2 | 715 | /* FIXME support hugetlb fs */ |
e1fb4a08 DJ |
716 | if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL) || |
717 | vma_is_dax(vma)) { | |
855ce7d2 JG |
718 | hmm_pfns_special(range); |
719 | return -EINVAL; | |
720 | } | |
721 | ||
86586a41 JG |
722 | if (!(vma->vm_flags & VM_READ)) { |
723 | /* | |
724 | * If vma do not allow read access, then assume that it does | |
725 | * not allow write access, either. Architecture that allow | |
726 | * write without read access are not supported by HMM, because | |
727 | * operations such has atomic access would not work. | |
728 | */ | |
f88a1e90 | 729 | hmm_pfns_clear(range, range->pfns, range->start, range->end); |
86586a41 JG |
730 | return -EPERM; |
731 | } | |
732 | ||
da4c3c73 | 733 | /* Initialize range to track CPU page table update */ |
da4c3c73 JG |
734 | spin_lock(&hmm->lock); |
735 | range->valid = true; | |
736 | list_add_rcu(&range->list, &hmm->ranges); | |
737 | spin_unlock(&hmm->lock); | |
738 | ||
74eee180 JG |
739 | hmm_vma_walk.fault = false; |
740 | hmm_vma_walk.range = range; | |
741 | mm_walk.private = &hmm_vma_walk; | |
742 | ||
da4c3c73 JG |
743 | mm_walk.vma = vma; |
744 | mm_walk.mm = vma->vm_mm; | |
da4c3c73 JG |
745 | mm_walk.pte_entry = NULL; |
746 | mm_walk.test_walk = NULL; | |
747 | mm_walk.hugetlb_entry = NULL; | |
748 | mm_walk.pmd_entry = hmm_vma_walk_pmd; | |
749 | mm_walk.pte_hole = hmm_vma_walk_hole; | |
750 | ||
08232a45 | 751 | walk_page_range(range->start, range->end, &mm_walk); |
da4c3c73 JG |
752 | return 0; |
753 | } | |
754 | EXPORT_SYMBOL(hmm_vma_get_pfns); | |
755 | ||
756 | /* | |
757 | * hmm_vma_range_done() - stop tracking change to CPU page table over a range | |
da4c3c73 JG |
758 | * @range: range being tracked |
759 | * Returns: false if range data has been invalidated, true otherwise | |
760 | * | |
761 | * Range struct is used to track updates to the CPU page table after a call to | |
762 | * either hmm_vma_get_pfns() or hmm_vma_fault(). Once the device driver is done | |
763 | * using the data, or wants to lock updates to the data it got from those | |
764 | * functions, it must call the hmm_vma_range_done() function, which will then | |
765 | * stop tracking CPU page table updates. | |
766 | * | |
767 | * Note that device driver must still implement general CPU page table update | |
768 | * tracking either by using hmm_mirror (see hmm_mirror_register()) or by using | |
769 | * the mmu_notifier API directly. | |
770 | * | |
771 | * CPU page table update tracking done through hmm_range is only temporary and | |
772 | * to be used while trying to duplicate CPU page table contents for a range of | |
773 | * virtual addresses. | |
774 | * | |
775 | * There are two ways to use this : | |
776 | * again: | |
08232a45 | 777 | * hmm_vma_get_pfns(range); or hmm_vma_fault(...); |
da4c3c73 JG |
778 | * trans = device_build_page_table_update_transaction(pfns); |
779 | * device_page_table_lock(); | |
08232a45 | 780 | * if (!hmm_vma_range_done(range)) { |
da4c3c73 JG |
781 | * device_page_table_unlock(); |
782 | * goto again; | |
783 | * } | |
784 | * device_commit_transaction(trans); | |
785 | * device_page_table_unlock(); | |
786 | * | |
787 | * Or: | |
08232a45 | 788 | * hmm_vma_get_pfns(range); or hmm_vma_fault(...); |
da4c3c73 | 789 | * device_page_table_lock(); |
08232a45 JG |
790 | * hmm_vma_range_done(range); |
791 | * device_update_page_table(range->pfns); | |
da4c3c73 JG |
792 | * device_page_table_unlock(); |
793 | */ | |
08232a45 | 794 | bool hmm_vma_range_done(struct hmm_range *range) |
da4c3c73 JG |
795 | { |
796 | unsigned long npages = (range->end - range->start) >> PAGE_SHIFT; | |
797 | struct hmm *hmm; | |
798 | ||
799 | if (range->end <= range->start) { | |
800 | BUG(); | |
801 | return false; | |
802 | } | |
803 | ||
08232a45 | 804 | hmm = hmm_register(range->vma->vm_mm); |
da4c3c73 JG |
805 | if (!hmm) { |
806 | memset(range->pfns, 0, sizeof(*range->pfns) * npages); | |
807 | return false; | |
808 | } | |
809 | ||
810 | spin_lock(&hmm->lock); | |
811 | list_del_rcu(&range->list); | |
812 | spin_unlock(&hmm->lock); | |
813 | ||
814 | return range->valid; | |
815 | } | |
816 | EXPORT_SYMBOL(hmm_vma_range_done); | |
74eee180 JG |
817 | |
818 | /* | |
819 | * hmm_vma_fault() - try to fault some address in a virtual address range | |
08232a45 | 820 | * @range: range being faulted |
74eee180 JG |
821 | * @block: allow blocking on fault (if true it sleeps and do not drop mmap_sem) |
822 | * Returns: 0 success, error otherwise (-EAGAIN means mmap_sem have been drop) | |
823 | * | |
824 | * This is similar to a regular CPU page fault except that it will not trigger | |
825 | * any memory migration if the memory being faulted is not accessible by CPUs. | |
826 | * | |
ff05c0c6 JG |
827 | * On error, for one virtual address in the range, the function will mark the |
828 | * corresponding HMM pfn entry with an error flag. | |
74eee180 JG |
829 | * |
830 | * Expected use pattern: | |
831 | * retry: | |
832 | * down_read(&mm->mmap_sem); | |
833 | * // Find vma and address device wants to fault, initialize hmm_pfn_t | |
834 | * // array accordingly | |
08232a45 | 835 | * ret = hmm_vma_fault(range, write, block); |
74eee180 JG |
836 | * switch (ret) { |
837 | * case -EAGAIN: | |
08232a45 | 838 | * hmm_vma_range_done(range); |
74eee180 JG |
839 | * // You might want to rate limit or yield to play nicely, you may |
840 | * // also commit any valid pfn in the array assuming that you are | |
841 | * // getting true from hmm_vma_range_monitor_end() | |
842 | * goto retry; | |
843 | * case 0: | |
844 | * break; | |
86586a41 JG |
845 | * case -ENOMEM: |
846 | * case -EINVAL: | |
847 | * case -EPERM: | |
74eee180 JG |
848 | * default: |
849 | * // Handle error ! | |
850 | * up_read(&mm->mmap_sem) | |
851 | * return; | |
852 | * } | |
853 | * // Take device driver lock that serialize device page table update | |
854 | * driver_lock_device_page_table_update(); | |
08232a45 | 855 | * hmm_vma_range_done(range); |
74eee180 JG |
856 | * // Commit pfns we got from hmm_vma_fault() |
857 | * driver_unlock_device_page_table_update(); | |
858 | * up_read(&mm->mmap_sem) | |
859 | * | |
860 | * YOU MUST CALL hmm_vma_range_done() AFTER THIS FUNCTION RETURN SUCCESS (0) | |
861 | * BEFORE FREEING THE range struct OR YOU WILL HAVE SERIOUS MEMORY CORRUPTION ! | |
862 | * | |
863 | * YOU HAVE BEEN WARNED ! | |
864 | */ | |
2aee09d8 | 865 | int hmm_vma_fault(struct hmm_range *range, bool block) |
74eee180 | 866 | { |
08232a45 JG |
867 | struct vm_area_struct *vma = range->vma; |
868 | unsigned long start = range->start; | |
74eee180 JG |
869 | struct hmm_vma_walk hmm_vma_walk; |
870 | struct mm_walk mm_walk; | |
871 | struct hmm *hmm; | |
872 | int ret; | |
873 | ||
874 | /* Sanity check, this really should not happen ! */ | |
08232a45 | 875 | if (range->start < vma->vm_start || range->start >= vma->vm_end) |
74eee180 | 876 | return -EINVAL; |
08232a45 | 877 | if (range->end < vma->vm_start || range->end > vma->vm_end) |
74eee180 JG |
878 | return -EINVAL; |
879 | ||
880 | hmm = hmm_register(vma->vm_mm); | |
881 | if (!hmm) { | |
f88a1e90 | 882 | hmm_pfns_clear(range, range->pfns, range->start, range->end); |
74eee180 JG |
883 | return -ENOMEM; |
884 | } | |
885 | /* Caller must have registered a mirror using hmm_mirror_register() */ | |
886 | if (!hmm->mmu_notifier.ops) | |
887 | return -EINVAL; | |
888 | ||
855ce7d2 | 889 | /* FIXME support hugetlb fs */ |
e1fb4a08 DJ |
890 | if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL) || |
891 | vma_is_dax(vma)) { | |
855ce7d2 JG |
892 | hmm_pfns_special(range); |
893 | return -EINVAL; | |
894 | } | |
895 | ||
86586a41 JG |
896 | if (!(vma->vm_flags & VM_READ)) { |
897 | /* | |
898 | * If vma do not allow read access, then assume that it does | |
899 | * not allow write access, either. Architecture that allow | |
900 | * write without read access are not supported by HMM, because | |
901 | * operations such has atomic access would not work. | |
902 | */ | |
f88a1e90 | 903 | hmm_pfns_clear(range, range->pfns, range->start, range->end); |
86586a41 JG |
904 | return -EPERM; |
905 | } | |
74eee180 | 906 | |
86586a41 JG |
907 | /* Initialize range to track CPU page table update */ |
908 | spin_lock(&hmm->lock); | |
909 | range->valid = true; | |
910 | list_add_rcu(&range->list, &hmm->ranges); | |
911 | spin_unlock(&hmm->lock); | |
912 | ||
74eee180 | 913 | hmm_vma_walk.fault = true; |
74eee180 JG |
914 | hmm_vma_walk.block = block; |
915 | hmm_vma_walk.range = range; | |
916 | mm_walk.private = &hmm_vma_walk; | |
917 | hmm_vma_walk.last = range->start; | |
918 | ||
919 | mm_walk.vma = vma; | |
920 | mm_walk.mm = vma->vm_mm; | |
921 | mm_walk.pte_entry = NULL; | |
922 | mm_walk.test_walk = NULL; | |
923 | mm_walk.hugetlb_entry = NULL; | |
924 | mm_walk.pmd_entry = hmm_vma_walk_pmd; | |
925 | mm_walk.pte_hole = hmm_vma_walk_hole; | |
926 | ||
927 | do { | |
08232a45 | 928 | ret = walk_page_range(start, range->end, &mm_walk); |
74eee180 JG |
929 | start = hmm_vma_walk.last; |
930 | } while (ret == -EAGAIN); | |
931 | ||
932 | if (ret) { | |
933 | unsigned long i; | |
934 | ||
935 | i = (hmm_vma_walk.last - range->start) >> PAGE_SHIFT; | |
f88a1e90 JG |
936 | hmm_pfns_clear(range, &range->pfns[i], hmm_vma_walk.last, |
937 | range->end); | |
08232a45 | 938 | hmm_vma_range_done(range); |
74eee180 JG |
939 | } |
940 | return ret; | |
941 | } | |
942 | EXPORT_SYMBOL(hmm_vma_fault); | |
c0b12405 | 943 | #endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */ |
4ef589dc JG |
944 | |
945 | ||
df6ad698 | 946 | #if IS_ENABLED(CONFIG_DEVICE_PRIVATE) || IS_ENABLED(CONFIG_DEVICE_PUBLIC) |
4ef589dc JG |
947 | struct page *hmm_vma_alloc_locked_page(struct vm_area_struct *vma, |
948 | unsigned long addr) | |
949 | { | |
950 | struct page *page; | |
951 | ||
952 | page = alloc_page_vma(GFP_HIGHUSER, vma, addr); | |
953 | if (!page) | |
954 | return NULL; | |
955 | lock_page(page); | |
956 | return page; | |
957 | } | |
958 | EXPORT_SYMBOL(hmm_vma_alloc_locked_page); | |
959 | ||
960 | ||
961 | static void hmm_devmem_ref_release(struct percpu_ref *ref) | |
962 | { | |
963 | struct hmm_devmem *devmem; | |
964 | ||
965 | devmem = container_of(ref, struct hmm_devmem, ref); | |
966 | complete(&devmem->completion); | |
967 | } | |
968 | ||
969 | static void hmm_devmem_ref_exit(void *data) | |
970 | { | |
971 | struct percpu_ref *ref = data; | |
972 | struct hmm_devmem *devmem; | |
973 | ||
974 | devmem = container_of(ref, struct hmm_devmem, ref); | |
975 | percpu_ref_exit(ref); | |
976 | devm_remove_action(devmem->device, &hmm_devmem_ref_exit, data); | |
977 | } | |
978 | ||
979 | static void hmm_devmem_ref_kill(void *data) | |
980 | { | |
981 | struct percpu_ref *ref = data; | |
982 | struct hmm_devmem *devmem; | |
983 | ||
984 | devmem = container_of(ref, struct hmm_devmem, ref); | |
985 | percpu_ref_kill(ref); | |
986 | wait_for_completion(&devmem->completion); | |
987 | devm_remove_action(devmem->device, &hmm_devmem_ref_kill, data); | |
988 | } | |
989 | ||
990 | static int hmm_devmem_fault(struct vm_area_struct *vma, | |
991 | unsigned long addr, | |
992 | const struct page *page, | |
993 | unsigned int flags, | |
994 | pmd_t *pmdp) | |
995 | { | |
996 | struct hmm_devmem *devmem = page->pgmap->data; | |
997 | ||
998 | return devmem->ops->fault(devmem, vma, addr, page, flags, pmdp); | |
999 | } | |
1000 | ||
1001 | static void hmm_devmem_free(struct page *page, void *data) | |
1002 | { | |
1003 | struct hmm_devmem *devmem = data; | |
1004 | ||
2fa147bd DW |
1005 | page->mapping = NULL; |
1006 | ||
4ef589dc JG |
1007 | devmem->ops->free(devmem, page); |
1008 | } | |
1009 | ||
1010 | static DEFINE_MUTEX(hmm_devmem_lock); | |
1011 | static RADIX_TREE(hmm_devmem_radix, GFP_KERNEL); | |
1012 | ||
1013 | static void hmm_devmem_radix_release(struct resource *resource) | |
1014 | { | |
1e926419 | 1015 | resource_size_t key; |
4ef589dc JG |
1016 | |
1017 | mutex_lock(&hmm_devmem_lock); | |
1018 | for (key = resource->start; | |
1019 | key <= resource->end; | |
1020 | key += PA_SECTION_SIZE) | |
1021 | radix_tree_delete(&hmm_devmem_radix, key >> PA_SECTION_SHIFT); | |
1022 | mutex_unlock(&hmm_devmem_lock); | |
1023 | } | |
1024 | ||
1025 | static void hmm_devmem_release(struct device *dev, void *data) | |
1026 | { | |
1027 | struct hmm_devmem *devmem = data; | |
1028 | struct resource *resource = devmem->resource; | |
1029 | unsigned long start_pfn, npages; | |
1030 | struct zone *zone; | |
1031 | struct page *page; | |
1032 | ||
1033 | if (percpu_ref_tryget_live(&devmem->ref)) { | |
1034 | dev_WARN(dev, "%s: page mapping is still live!\n", __func__); | |
1035 | percpu_ref_put(&devmem->ref); | |
1036 | } | |
1037 | ||
1038 | /* pages are dead and unused, undo the arch mapping */ | |
1039 | start_pfn = (resource->start & ~(PA_SECTION_SIZE - 1)) >> PAGE_SHIFT; | |
1040 | npages = ALIGN(resource_size(resource), PA_SECTION_SIZE) >> PAGE_SHIFT; | |
1041 | ||
1042 | page = pfn_to_page(start_pfn); | |
1043 | zone = page_zone(page); | |
1044 | ||
1045 | mem_hotplug_begin(); | |
d3df0a42 | 1046 | if (resource->desc == IORES_DESC_DEVICE_PRIVATE_MEMORY) |
da024512 | 1047 | __remove_pages(zone, start_pfn, npages, NULL); |
d3df0a42 JG |
1048 | else |
1049 | arch_remove_memory(start_pfn << PAGE_SHIFT, | |
da024512 | 1050 | npages << PAGE_SHIFT, NULL); |
4ef589dc JG |
1051 | mem_hotplug_done(); |
1052 | ||
1053 | hmm_devmem_radix_release(resource); | |
1054 | } | |
1055 | ||
4ef589dc JG |
1056 | static int hmm_devmem_pages_create(struct hmm_devmem *devmem) |
1057 | { | |
1058 | resource_size_t key, align_start, align_size, align_end; | |
1059 | struct device *device = devmem->device; | |
1060 | int ret, nid, is_ram; | |
4ef589dc JG |
1061 | |
1062 | align_start = devmem->resource->start & ~(PA_SECTION_SIZE - 1); | |
1063 | align_size = ALIGN(devmem->resource->start + | |
1064 | resource_size(devmem->resource), | |
1065 | PA_SECTION_SIZE) - align_start; | |
1066 | ||
1067 | is_ram = region_intersects(align_start, align_size, | |
1068 | IORESOURCE_SYSTEM_RAM, | |
1069 | IORES_DESC_NONE); | |
1070 | if (is_ram == REGION_MIXED) { | |
1071 | WARN_ONCE(1, "%s attempted on mixed region %pr\n", | |
1072 | __func__, devmem->resource); | |
1073 | return -ENXIO; | |
1074 | } | |
1075 | if (is_ram == REGION_INTERSECTS) | |
1076 | return -ENXIO; | |
1077 | ||
d3df0a42 JG |
1078 | if (devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY) |
1079 | devmem->pagemap.type = MEMORY_DEVICE_PUBLIC; | |
1080 | else | |
1081 | devmem->pagemap.type = MEMORY_DEVICE_PRIVATE; | |
1082 | ||
e7744aa2 | 1083 | devmem->pagemap.res = *devmem->resource; |
4ef589dc JG |
1084 | devmem->pagemap.page_fault = hmm_devmem_fault; |
1085 | devmem->pagemap.page_free = hmm_devmem_free; | |
1086 | devmem->pagemap.dev = devmem->device; | |
1087 | devmem->pagemap.ref = &devmem->ref; | |
1088 | devmem->pagemap.data = devmem; | |
1089 | ||
1090 | mutex_lock(&hmm_devmem_lock); | |
1091 | align_end = align_start + align_size - 1; | |
1092 | for (key = align_start; key <= align_end; key += PA_SECTION_SIZE) { | |
1093 | struct hmm_devmem *dup; | |
1094 | ||
18be460e TH |
1095 | dup = radix_tree_lookup(&hmm_devmem_radix, |
1096 | key >> PA_SECTION_SHIFT); | |
4ef589dc JG |
1097 | if (dup) { |
1098 | dev_err(device, "%s: collides with mapping for %s\n", | |
1099 | __func__, dev_name(dup->device)); | |
1100 | mutex_unlock(&hmm_devmem_lock); | |
1101 | ret = -EBUSY; | |
1102 | goto error; | |
1103 | } | |
1104 | ret = radix_tree_insert(&hmm_devmem_radix, | |
1105 | key >> PA_SECTION_SHIFT, | |
1106 | devmem); | |
1107 | if (ret) { | |
1108 | dev_err(device, "%s: failed: %d\n", __func__, ret); | |
1109 | mutex_unlock(&hmm_devmem_lock); | |
1110 | goto error_radix; | |
1111 | } | |
1112 | } | |
1113 | mutex_unlock(&hmm_devmem_lock); | |
1114 | ||
1115 | nid = dev_to_node(device); | |
1116 | if (nid < 0) | |
1117 | nid = numa_mem_id(); | |
1118 | ||
1119 | mem_hotplug_begin(); | |
1120 | /* | |
1121 | * For device private memory we call add_pages() as we only need to | |
1122 | * allocate and initialize struct page for the device memory. More- | |
1123 | * over the device memory is un-accessible thus we do not want to | |
1124 | * create a linear mapping for the memory like arch_add_memory() | |
1125 | * would do. | |
d3df0a42 JG |
1126 | * |
1127 | * For device public memory, which is accesible by the CPU, we do | |
1128 | * want the linear mapping and thus use arch_add_memory(). | |
4ef589dc | 1129 | */ |
d3df0a42 | 1130 | if (devmem->pagemap.type == MEMORY_DEVICE_PUBLIC) |
24e6d5a5 CH |
1131 | ret = arch_add_memory(nid, align_start, align_size, NULL, |
1132 | false); | |
d3df0a42 JG |
1133 | else |
1134 | ret = add_pages(nid, align_start >> PAGE_SHIFT, | |
24e6d5a5 | 1135 | align_size >> PAGE_SHIFT, NULL, false); |
4ef589dc JG |
1136 | if (ret) { |
1137 | mem_hotplug_done(); | |
1138 | goto error_add_memory; | |
1139 | } | |
1140 | move_pfn_range_to_zone(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], | |
1141 | align_start >> PAGE_SHIFT, | |
a99583e7 | 1142 | align_size >> PAGE_SHIFT, NULL); |
4ef589dc JG |
1143 | mem_hotplug_done(); |
1144 | ||
966cf44f AD |
1145 | /* |
1146 | * Initialization of the pages has been deferred until now in order | |
1147 | * to allow us to do the work while not holding the hotplug lock. | |
1148 | */ | |
1149 | memmap_init_zone_device(&NODE_DATA(nid)->node_zones[ZONE_DEVICE], | |
1150 | align_start >> PAGE_SHIFT, | |
1151 | align_size >> PAGE_SHIFT, &devmem->pagemap); | |
4ef589dc | 1152 | |
4ef589dc JG |
1153 | return 0; |
1154 | ||
1155 | error_add_memory: | |
1156 | untrack_pfn(NULL, PHYS_PFN(align_start), align_size); | |
1157 | error_radix: | |
1158 | hmm_devmem_radix_release(devmem->resource); | |
1159 | error: | |
1160 | return ret; | |
1161 | } | |
1162 | ||
1163 | static int hmm_devmem_match(struct device *dev, void *data, void *match_data) | |
1164 | { | |
1165 | struct hmm_devmem *devmem = data; | |
1166 | ||
1167 | return devmem->resource == match_data; | |
1168 | } | |
1169 | ||
1170 | static void hmm_devmem_pages_remove(struct hmm_devmem *devmem) | |
1171 | { | |
1172 | devres_release(devmem->device, &hmm_devmem_release, | |
1173 | &hmm_devmem_match, devmem->resource); | |
1174 | } | |
1175 | ||
1176 | /* | |
1177 | * hmm_devmem_add() - hotplug ZONE_DEVICE memory for device memory | |
1178 | * | |
1179 | * @ops: memory event device driver callback (see struct hmm_devmem_ops) | |
1180 | * @device: device struct to bind the resource too | |
1181 | * @size: size in bytes of the device memory to add | |
1182 | * Returns: pointer to new hmm_devmem struct ERR_PTR otherwise | |
1183 | * | |
1184 | * This function first finds an empty range of physical address big enough to | |
1185 | * contain the new resource, and then hotplugs it as ZONE_DEVICE memory, which | |
1186 | * in turn allocates struct pages. It does not do anything beyond that; all | |
1187 | * events affecting the memory will go through the various callbacks provided | |
1188 | * by hmm_devmem_ops struct. | |
1189 | * | |
1190 | * Device driver should call this function during device initialization and | |
1191 | * is then responsible of memory management. HMM only provides helpers. | |
1192 | */ | |
1193 | struct hmm_devmem *hmm_devmem_add(const struct hmm_devmem_ops *ops, | |
1194 | struct device *device, | |
1195 | unsigned long size) | |
1196 | { | |
1197 | struct hmm_devmem *devmem; | |
1198 | resource_size_t addr; | |
1199 | int ret; | |
1200 | ||
e7638488 | 1201 | dev_pagemap_get_ops(); |
4ef589dc JG |
1202 | |
1203 | devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem), | |
1204 | GFP_KERNEL, dev_to_node(device)); | |
1205 | if (!devmem) | |
1206 | return ERR_PTR(-ENOMEM); | |
1207 | ||
1208 | init_completion(&devmem->completion); | |
1209 | devmem->pfn_first = -1UL; | |
1210 | devmem->pfn_last = -1UL; | |
1211 | devmem->resource = NULL; | |
1212 | devmem->device = device; | |
1213 | devmem->ops = ops; | |
1214 | ||
1215 | ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release, | |
1216 | 0, GFP_KERNEL); | |
1217 | if (ret) | |
1218 | goto error_percpu_ref; | |
1219 | ||
1220 | ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref); | |
1221 | if (ret) | |
1222 | goto error_devm_add_action; | |
1223 | ||
1224 | size = ALIGN(size, PA_SECTION_SIZE); | |
1225 | addr = min((unsigned long)iomem_resource.end, | |
1226 | (1UL << MAX_PHYSMEM_BITS) - 1); | |
1227 | addr = addr - size + 1UL; | |
1228 | ||
1229 | /* | |
1230 | * FIXME add a new helper to quickly walk resource tree and find free | |
1231 | * range | |
1232 | * | |
1233 | * FIXME what about ioport_resource resource ? | |
1234 | */ | |
1235 | for (; addr > size && addr >= iomem_resource.start; addr -= size) { | |
1236 | ret = region_intersects(addr, size, 0, IORES_DESC_NONE); | |
1237 | if (ret != REGION_DISJOINT) | |
1238 | continue; | |
1239 | ||
1240 | devmem->resource = devm_request_mem_region(device, addr, size, | |
1241 | dev_name(device)); | |
1242 | if (!devmem->resource) { | |
1243 | ret = -ENOMEM; | |
1244 | goto error_no_resource; | |
1245 | } | |
1246 | break; | |
1247 | } | |
1248 | if (!devmem->resource) { | |
1249 | ret = -ERANGE; | |
1250 | goto error_no_resource; | |
1251 | } | |
1252 | ||
1253 | devmem->resource->desc = IORES_DESC_DEVICE_PRIVATE_MEMORY; | |
1254 | devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT; | |
1255 | devmem->pfn_last = devmem->pfn_first + | |
1256 | (resource_size(devmem->resource) >> PAGE_SHIFT); | |
1257 | ||
1258 | ret = hmm_devmem_pages_create(devmem); | |
1259 | if (ret) | |
1260 | goto error_pages; | |
1261 | ||
1262 | devres_add(device, devmem); | |
1263 | ||
1264 | ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref); | |
1265 | if (ret) { | |
1266 | hmm_devmem_remove(devmem); | |
1267 | return ERR_PTR(ret); | |
1268 | } | |
1269 | ||
1270 | return devmem; | |
1271 | ||
1272 | error_pages: | |
1273 | devm_release_mem_region(device, devmem->resource->start, | |
1274 | resource_size(devmem->resource)); | |
1275 | error_no_resource: | |
1276 | error_devm_add_action: | |
1277 | hmm_devmem_ref_kill(&devmem->ref); | |
1278 | hmm_devmem_ref_exit(&devmem->ref); | |
1279 | error_percpu_ref: | |
1280 | devres_free(devmem); | |
1281 | return ERR_PTR(ret); | |
1282 | } | |
1283 | EXPORT_SYMBOL(hmm_devmem_add); | |
1284 | ||
d3df0a42 JG |
1285 | struct hmm_devmem *hmm_devmem_add_resource(const struct hmm_devmem_ops *ops, |
1286 | struct device *device, | |
1287 | struct resource *res) | |
1288 | { | |
1289 | struct hmm_devmem *devmem; | |
1290 | int ret; | |
1291 | ||
1292 | if (res->desc != IORES_DESC_DEVICE_PUBLIC_MEMORY) | |
1293 | return ERR_PTR(-EINVAL); | |
1294 | ||
e7638488 | 1295 | dev_pagemap_get_ops(); |
d3df0a42 JG |
1296 | |
1297 | devmem = devres_alloc_node(&hmm_devmem_release, sizeof(*devmem), | |
1298 | GFP_KERNEL, dev_to_node(device)); | |
1299 | if (!devmem) | |
1300 | return ERR_PTR(-ENOMEM); | |
1301 | ||
1302 | init_completion(&devmem->completion); | |
1303 | devmem->pfn_first = -1UL; | |
1304 | devmem->pfn_last = -1UL; | |
1305 | devmem->resource = res; | |
1306 | devmem->device = device; | |
1307 | devmem->ops = ops; | |
1308 | ||
1309 | ret = percpu_ref_init(&devmem->ref, &hmm_devmem_ref_release, | |
1310 | 0, GFP_KERNEL); | |
1311 | if (ret) | |
1312 | goto error_percpu_ref; | |
1313 | ||
1314 | ret = devm_add_action(device, hmm_devmem_ref_exit, &devmem->ref); | |
1315 | if (ret) | |
1316 | goto error_devm_add_action; | |
1317 | ||
1318 | ||
1319 | devmem->pfn_first = devmem->resource->start >> PAGE_SHIFT; | |
1320 | devmem->pfn_last = devmem->pfn_first + | |
1321 | (resource_size(devmem->resource) >> PAGE_SHIFT); | |
1322 | ||
1323 | ret = hmm_devmem_pages_create(devmem); | |
1324 | if (ret) | |
1325 | goto error_devm_add_action; | |
1326 | ||
1327 | devres_add(device, devmem); | |
1328 | ||
1329 | ret = devm_add_action(device, hmm_devmem_ref_kill, &devmem->ref); | |
1330 | if (ret) { | |
1331 | hmm_devmem_remove(devmem); | |
1332 | return ERR_PTR(ret); | |
1333 | } | |
1334 | ||
1335 | return devmem; | |
1336 | ||
1337 | error_devm_add_action: | |
1338 | hmm_devmem_ref_kill(&devmem->ref); | |
1339 | hmm_devmem_ref_exit(&devmem->ref); | |
1340 | error_percpu_ref: | |
1341 | devres_free(devmem); | |
1342 | return ERR_PTR(ret); | |
1343 | } | |
1344 | EXPORT_SYMBOL(hmm_devmem_add_resource); | |
1345 | ||
4ef589dc JG |
1346 | /* |
1347 | * hmm_devmem_remove() - remove device memory (kill and free ZONE_DEVICE) | |
1348 | * | |
1349 | * @devmem: hmm_devmem struct use to track and manage the ZONE_DEVICE memory | |
1350 | * | |
1351 | * This will hot-unplug memory that was hotplugged by hmm_devmem_add on behalf | |
1352 | * of the device driver. It will free struct page and remove the resource that | |
1353 | * reserved the physical address range for this device memory. | |
1354 | */ | |
1355 | void hmm_devmem_remove(struct hmm_devmem *devmem) | |
1356 | { | |
1357 | resource_size_t start, size; | |
1358 | struct device *device; | |
d3df0a42 | 1359 | bool cdm = false; |
4ef589dc JG |
1360 | |
1361 | if (!devmem) | |
1362 | return; | |
1363 | ||
1364 | device = devmem->device; | |
1365 | start = devmem->resource->start; | |
1366 | size = resource_size(devmem->resource); | |
1367 | ||
d3df0a42 | 1368 | cdm = devmem->resource->desc == IORES_DESC_DEVICE_PUBLIC_MEMORY; |
4ef589dc JG |
1369 | hmm_devmem_ref_kill(&devmem->ref); |
1370 | hmm_devmem_ref_exit(&devmem->ref); | |
1371 | hmm_devmem_pages_remove(devmem); | |
1372 | ||
d3df0a42 JG |
1373 | if (!cdm) |
1374 | devm_release_mem_region(device, start, size); | |
4ef589dc JG |
1375 | } |
1376 | EXPORT_SYMBOL(hmm_devmem_remove); | |
858b54da JG |
1377 | |
1378 | /* | |
1379 | * A device driver that wants to handle multiple devices memory through a | |
1380 | * single fake device can use hmm_device to do so. This is purely a helper | |
1381 | * and it is not needed to make use of any HMM functionality. | |
1382 | */ | |
1383 | #define HMM_DEVICE_MAX 256 | |
1384 | ||
1385 | static DECLARE_BITMAP(hmm_device_mask, HMM_DEVICE_MAX); | |
1386 | static DEFINE_SPINLOCK(hmm_device_lock); | |
1387 | static struct class *hmm_device_class; | |
1388 | static dev_t hmm_device_devt; | |
1389 | ||
1390 | static void hmm_device_release(struct device *device) | |
1391 | { | |
1392 | struct hmm_device *hmm_device; | |
1393 | ||
1394 | hmm_device = container_of(device, struct hmm_device, device); | |
1395 | spin_lock(&hmm_device_lock); | |
1396 | clear_bit(hmm_device->minor, hmm_device_mask); | |
1397 | spin_unlock(&hmm_device_lock); | |
1398 | ||
1399 | kfree(hmm_device); | |
1400 | } | |
1401 | ||
1402 | struct hmm_device *hmm_device_new(void *drvdata) | |
1403 | { | |
1404 | struct hmm_device *hmm_device; | |
1405 | ||
1406 | hmm_device = kzalloc(sizeof(*hmm_device), GFP_KERNEL); | |
1407 | if (!hmm_device) | |
1408 | return ERR_PTR(-ENOMEM); | |
1409 | ||
1410 | spin_lock(&hmm_device_lock); | |
1411 | hmm_device->minor = find_first_zero_bit(hmm_device_mask, HMM_DEVICE_MAX); | |
1412 | if (hmm_device->minor >= HMM_DEVICE_MAX) { | |
1413 | spin_unlock(&hmm_device_lock); | |
1414 | kfree(hmm_device); | |
1415 | return ERR_PTR(-EBUSY); | |
1416 | } | |
1417 | set_bit(hmm_device->minor, hmm_device_mask); | |
1418 | spin_unlock(&hmm_device_lock); | |
1419 | ||
1420 | dev_set_name(&hmm_device->device, "hmm_device%d", hmm_device->minor); | |
1421 | hmm_device->device.devt = MKDEV(MAJOR(hmm_device_devt), | |
1422 | hmm_device->minor); | |
1423 | hmm_device->device.release = hmm_device_release; | |
1424 | dev_set_drvdata(&hmm_device->device, drvdata); | |
1425 | hmm_device->device.class = hmm_device_class; | |
1426 | device_initialize(&hmm_device->device); | |
1427 | ||
1428 | return hmm_device; | |
1429 | } | |
1430 | EXPORT_SYMBOL(hmm_device_new); | |
1431 | ||
1432 | void hmm_device_put(struct hmm_device *hmm_device) | |
1433 | { | |
1434 | put_device(&hmm_device->device); | |
1435 | } | |
1436 | EXPORT_SYMBOL(hmm_device_put); | |
1437 | ||
1438 | static int __init hmm_init(void) | |
1439 | { | |
1440 | int ret; | |
1441 | ||
1442 | ret = alloc_chrdev_region(&hmm_device_devt, 0, | |
1443 | HMM_DEVICE_MAX, | |
1444 | "hmm_device"); | |
1445 | if (ret) | |
1446 | return ret; | |
1447 | ||
1448 | hmm_device_class = class_create(THIS_MODULE, "hmm_device"); | |
1449 | if (IS_ERR(hmm_device_class)) { | |
1450 | unregister_chrdev_region(hmm_device_devt, HMM_DEVICE_MAX); | |
1451 | return PTR_ERR(hmm_device_class); | |
1452 | } | |
1453 | return 0; | |
1454 | } | |
1455 | ||
1456 | device_initcall(hmm_init); | |
df6ad698 | 1457 | #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */ |