Loading...
Note: File does not exist in v3.15.
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * This is a module to test the HMM (Heterogeneous Memory Management)
4 * mirror and zone device private memory migration APIs of the kernel.
5 * Userspace programs can register with the driver to mirror their own address
6 * space and can use the device to read/write any valid virtual address.
7 */
8#include <linux/init.h>
9#include <linux/fs.h>
10#include <linux/mm.h>
11#include <linux/module.h>
12#include <linux/kernel.h>
13#include <linux/cdev.h>
14#include <linux/device.h>
15#include <linux/mutex.h>
16#include <linux/rwsem.h>
17#include <linux/sched.h>
18#include <linux/slab.h>
19#include <linux/highmem.h>
20#include <linux/delay.h>
21#include <linux/pagemap.h>
22#include <linux/hmm.h>
23#include <linux/vmalloc.h>
24#include <linux/swap.h>
25#include <linux/swapops.h>
26#include <linux/sched/mm.h>
27#include <linux/platform_device.h>
28
29#include "test_hmm_uapi.h"
30
31#define DMIRROR_NDEVICES 2
32#define DMIRROR_RANGE_FAULT_TIMEOUT 1000
33#define DEVMEM_CHUNK_SIZE (256 * 1024 * 1024U)
34#define DEVMEM_CHUNKS_RESERVE 16
35
36static const struct dev_pagemap_ops dmirror_devmem_ops;
37static const struct mmu_interval_notifier_ops dmirror_min_ops;
38static dev_t dmirror_dev;
39static struct page *dmirror_zero_page;
40
41struct dmirror_device;
42
43struct dmirror_bounce {
44 void *ptr;
45 unsigned long size;
46 unsigned long addr;
47 unsigned long cpages;
48};
49
50#define DPT_XA_TAG_WRITE 3UL
51
52/*
53 * Data structure to track address ranges and register for mmu interval
54 * notifier updates.
55 */
56struct dmirror_interval {
57 struct mmu_interval_notifier notifier;
58 struct dmirror *dmirror;
59};
60
61/*
62 * Data attached to the open device file.
63 * Note that it might be shared after a fork().
64 */
65struct dmirror {
66 struct dmirror_device *mdevice;
67 struct xarray pt;
68 struct mmu_interval_notifier notifier;
69 struct mutex mutex;
70};
71
72/*
73 * ZONE_DEVICE pages for migration and simulating device memory.
74 */
75struct dmirror_chunk {
76 struct dev_pagemap pagemap;
77 struct dmirror_device *mdevice;
78};
79
80/*
81 * Per device data.
82 */
83struct dmirror_device {
84 struct cdev cdevice;
85 struct hmm_devmem *devmem;
86
87 unsigned int devmem_capacity;
88 unsigned int devmem_count;
89 struct dmirror_chunk **devmem_chunks;
90 struct mutex devmem_lock; /* protects the above */
91
92 unsigned long calloc;
93 unsigned long cfree;
94 struct page *free_pages;
95 spinlock_t lock; /* protects the above */
96};
97
98static struct dmirror_device dmirror_devices[DMIRROR_NDEVICES];
99
100static int dmirror_bounce_init(struct dmirror_bounce *bounce,
101 unsigned long addr,
102 unsigned long size)
103{
104 bounce->addr = addr;
105 bounce->size = size;
106 bounce->cpages = 0;
107 bounce->ptr = vmalloc(size);
108 if (!bounce->ptr)
109 return -ENOMEM;
110 return 0;
111}
112
113static void dmirror_bounce_fini(struct dmirror_bounce *bounce)
114{
115 vfree(bounce->ptr);
116}
117
118static int dmirror_fops_open(struct inode *inode, struct file *filp)
119{
120 struct cdev *cdev = inode->i_cdev;
121 struct dmirror *dmirror;
122 int ret;
123
124 /* Mirror this process address space */
125 dmirror = kzalloc(sizeof(*dmirror), GFP_KERNEL);
126 if (dmirror == NULL)
127 return -ENOMEM;
128
129 dmirror->mdevice = container_of(cdev, struct dmirror_device, cdevice);
130 mutex_init(&dmirror->mutex);
131 xa_init(&dmirror->pt);
132
133 ret = mmu_interval_notifier_insert(&dmirror->notifier, current->mm,
134 0, ULONG_MAX & PAGE_MASK, &dmirror_min_ops);
135 if (ret) {
136 kfree(dmirror);
137 return ret;
138 }
139
140 filp->private_data = dmirror;
141 return 0;
142}
143
144static int dmirror_fops_release(struct inode *inode, struct file *filp)
145{
146 struct dmirror *dmirror = filp->private_data;
147
148 mmu_interval_notifier_remove(&dmirror->notifier);
149 xa_destroy(&dmirror->pt);
150 kfree(dmirror);
151 return 0;
152}
153
154static struct dmirror_device *dmirror_page_to_device(struct page *page)
155
156{
157 return container_of(page->pgmap, struct dmirror_chunk,
158 pagemap)->mdevice;
159}
160
161static int dmirror_do_fault(struct dmirror *dmirror, struct hmm_range *range)
162{
163 unsigned long *pfns = range->hmm_pfns;
164 unsigned long pfn;
165
166 for (pfn = (range->start >> PAGE_SHIFT);
167 pfn < (range->end >> PAGE_SHIFT);
168 pfn++, pfns++) {
169 struct page *page;
170 void *entry;
171
172 /*
173 * Since we asked for hmm_range_fault() to populate pages,
174 * it shouldn't return an error entry on success.
175 */
176 WARN_ON(*pfns & HMM_PFN_ERROR);
177 WARN_ON(!(*pfns & HMM_PFN_VALID));
178
179 page = hmm_pfn_to_page(*pfns);
180 WARN_ON(!page);
181
182 entry = page;
183 if (*pfns & HMM_PFN_WRITE)
184 entry = xa_tag_pointer(entry, DPT_XA_TAG_WRITE);
185 else if (WARN_ON(range->default_flags & HMM_PFN_WRITE))
186 return -EFAULT;
187 entry = xa_store(&dmirror->pt, pfn, entry, GFP_ATOMIC);
188 if (xa_is_err(entry))
189 return xa_err(entry);
190 }
191
192 return 0;
193}
194
195static void dmirror_do_update(struct dmirror *dmirror, unsigned long start,
196 unsigned long end)
197{
198 unsigned long pfn;
199 void *entry;
200
201 /*
202 * The XArray doesn't hold references to pages since it relies on
203 * the mmu notifier to clear page pointers when they become stale.
204 * Therefore, it is OK to just clear the entry.
205 */
206 xa_for_each_range(&dmirror->pt, pfn, entry, start >> PAGE_SHIFT,
207 end >> PAGE_SHIFT)
208 xa_erase(&dmirror->pt, pfn);
209}
210
211static bool dmirror_interval_invalidate(struct mmu_interval_notifier *mni,
212 const struct mmu_notifier_range *range,
213 unsigned long cur_seq)
214{
215 struct dmirror *dmirror = container_of(mni, struct dmirror, notifier);
216
217 /*
218 * Ignore invalidation callbacks for device private pages since
219 * the invalidation is handled as part of the migration process.
220 */
221 if (range->event == MMU_NOTIFY_MIGRATE &&
222 range->migrate_pgmap_owner == dmirror->mdevice)
223 return true;
224
225 if (mmu_notifier_range_blockable(range))
226 mutex_lock(&dmirror->mutex);
227 else if (!mutex_trylock(&dmirror->mutex))
228 return false;
229
230 mmu_interval_set_seq(mni, cur_seq);
231 dmirror_do_update(dmirror, range->start, range->end);
232
233 mutex_unlock(&dmirror->mutex);
234 return true;
235}
236
237static const struct mmu_interval_notifier_ops dmirror_min_ops = {
238 .invalidate = dmirror_interval_invalidate,
239};
240
241static int dmirror_range_fault(struct dmirror *dmirror,
242 struct hmm_range *range)
243{
244 struct mm_struct *mm = dmirror->notifier.mm;
245 unsigned long timeout =
246 jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
247 int ret;
248
249 while (true) {
250 if (time_after(jiffies, timeout)) {
251 ret = -EBUSY;
252 goto out;
253 }
254
255 range->notifier_seq = mmu_interval_read_begin(range->notifier);
256 mmap_read_lock(mm);
257 ret = hmm_range_fault(range);
258 mmap_read_unlock(mm);
259 if (ret) {
260 if (ret == -EBUSY)
261 continue;
262 goto out;
263 }
264
265 mutex_lock(&dmirror->mutex);
266 if (mmu_interval_read_retry(range->notifier,
267 range->notifier_seq)) {
268 mutex_unlock(&dmirror->mutex);
269 continue;
270 }
271 break;
272 }
273
274 ret = dmirror_do_fault(dmirror, range);
275
276 mutex_unlock(&dmirror->mutex);
277out:
278 return ret;
279}
280
281static int dmirror_fault(struct dmirror *dmirror, unsigned long start,
282 unsigned long end, bool write)
283{
284 struct mm_struct *mm = dmirror->notifier.mm;
285 unsigned long addr;
286 unsigned long pfns[64];
287 struct hmm_range range = {
288 .notifier = &dmirror->notifier,
289 .hmm_pfns = pfns,
290 .pfn_flags_mask = 0,
291 .default_flags =
292 HMM_PFN_REQ_FAULT | (write ? HMM_PFN_REQ_WRITE : 0),
293 .dev_private_owner = dmirror->mdevice,
294 };
295 int ret = 0;
296
297 /* Since the mm is for the mirrored process, get a reference first. */
298 if (!mmget_not_zero(mm))
299 return 0;
300
301 for (addr = start; addr < end; addr = range.end) {
302 range.start = addr;
303 range.end = min(addr + (ARRAY_SIZE(pfns) << PAGE_SHIFT), end);
304
305 ret = dmirror_range_fault(dmirror, &range);
306 if (ret)
307 break;
308 }
309
310 mmput(mm);
311 return ret;
312}
313
314static int dmirror_do_read(struct dmirror *dmirror, unsigned long start,
315 unsigned long end, struct dmirror_bounce *bounce)
316{
317 unsigned long pfn;
318 void *ptr;
319
320 ptr = bounce->ptr + ((start - bounce->addr) & PAGE_MASK);
321
322 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++) {
323 void *entry;
324 struct page *page;
325 void *tmp;
326
327 entry = xa_load(&dmirror->pt, pfn);
328 page = xa_untag_pointer(entry);
329 if (!page)
330 return -ENOENT;
331
332 tmp = kmap(page);
333 memcpy(ptr, tmp, PAGE_SIZE);
334 kunmap(page);
335
336 ptr += PAGE_SIZE;
337 bounce->cpages++;
338 }
339
340 return 0;
341}
342
343static int dmirror_read(struct dmirror *dmirror, struct hmm_dmirror_cmd *cmd)
344{
345 struct dmirror_bounce bounce;
346 unsigned long start, end;
347 unsigned long size = cmd->npages << PAGE_SHIFT;
348 int ret;
349
350 start = cmd->addr;
351 end = start + size;
352 if (end < start)
353 return -EINVAL;
354
355 ret = dmirror_bounce_init(&bounce, start, size);
356 if (ret)
357 return ret;
358
359 while (1) {
360 mutex_lock(&dmirror->mutex);
361 ret = dmirror_do_read(dmirror, start, end, &bounce);
362 mutex_unlock(&dmirror->mutex);
363 if (ret != -ENOENT)
364 break;
365
366 start = cmd->addr + (bounce.cpages << PAGE_SHIFT);
367 ret = dmirror_fault(dmirror, start, end, false);
368 if (ret)
369 break;
370 cmd->faults++;
371 }
372
373 if (ret == 0) {
374 if (copy_to_user(u64_to_user_ptr(cmd->ptr), bounce.ptr,
375 bounce.size))
376 ret = -EFAULT;
377 }
378 cmd->cpages = bounce.cpages;
379 dmirror_bounce_fini(&bounce);
380 return ret;
381}
382
383static int dmirror_do_write(struct dmirror *dmirror, unsigned long start,
384 unsigned long end, struct dmirror_bounce *bounce)
385{
386 unsigned long pfn;
387 void *ptr;
388
389 ptr = bounce->ptr + ((start - bounce->addr) & PAGE_MASK);
390
391 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++) {
392 void *entry;
393 struct page *page;
394 void *tmp;
395
396 entry = xa_load(&dmirror->pt, pfn);
397 page = xa_untag_pointer(entry);
398 if (!page || xa_pointer_tag(entry) != DPT_XA_TAG_WRITE)
399 return -ENOENT;
400
401 tmp = kmap(page);
402 memcpy(tmp, ptr, PAGE_SIZE);
403 kunmap(page);
404
405 ptr += PAGE_SIZE;
406 bounce->cpages++;
407 }
408
409 return 0;
410}
411
412static int dmirror_write(struct dmirror *dmirror, struct hmm_dmirror_cmd *cmd)
413{
414 struct dmirror_bounce bounce;
415 unsigned long start, end;
416 unsigned long size = cmd->npages << PAGE_SHIFT;
417 int ret;
418
419 start = cmd->addr;
420 end = start + size;
421 if (end < start)
422 return -EINVAL;
423
424 ret = dmirror_bounce_init(&bounce, start, size);
425 if (ret)
426 return ret;
427 if (copy_from_user(bounce.ptr, u64_to_user_ptr(cmd->ptr),
428 bounce.size)) {
429 ret = -EFAULT;
430 goto fini;
431 }
432
433 while (1) {
434 mutex_lock(&dmirror->mutex);
435 ret = dmirror_do_write(dmirror, start, end, &bounce);
436 mutex_unlock(&dmirror->mutex);
437 if (ret != -ENOENT)
438 break;
439
440 start = cmd->addr + (bounce.cpages << PAGE_SHIFT);
441 ret = dmirror_fault(dmirror, start, end, true);
442 if (ret)
443 break;
444 cmd->faults++;
445 }
446
447fini:
448 cmd->cpages = bounce.cpages;
449 dmirror_bounce_fini(&bounce);
450 return ret;
451}
452
453static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
454 struct page **ppage)
455{
456 struct dmirror_chunk *devmem;
457 struct resource *res;
458 unsigned long pfn;
459 unsigned long pfn_first;
460 unsigned long pfn_last;
461 void *ptr;
462
463 mutex_lock(&mdevice->devmem_lock);
464
465 if (mdevice->devmem_count == mdevice->devmem_capacity) {
466 struct dmirror_chunk **new_chunks;
467 unsigned int new_capacity;
468
469 new_capacity = mdevice->devmem_capacity +
470 DEVMEM_CHUNKS_RESERVE;
471 new_chunks = krealloc(mdevice->devmem_chunks,
472 sizeof(new_chunks[0]) * new_capacity,
473 GFP_KERNEL);
474 if (!new_chunks)
475 goto err;
476 mdevice->devmem_capacity = new_capacity;
477 mdevice->devmem_chunks = new_chunks;
478 }
479
480 res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
481 "hmm_dmirror");
482 if (IS_ERR(res))
483 goto err;
484
485 devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
486 if (!devmem)
487 goto err_release;
488
489 devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
490 devmem->pagemap.res = *res;
491 devmem->pagemap.ops = &dmirror_devmem_ops;
492 devmem->pagemap.owner = mdevice;
493
494 ptr = memremap_pages(&devmem->pagemap, numa_node_id());
495 if (IS_ERR(ptr))
496 goto err_free;
497
498 devmem->mdevice = mdevice;
499 pfn_first = devmem->pagemap.res.start >> PAGE_SHIFT;
500 pfn_last = pfn_first +
501 (resource_size(&devmem->pagemap.res) >> PAGE_SHIFT);
502 mdevice->devmem_chunks[mdevice->devmem_count++] = devmem;
503
504 mutex_unlock(&mdevice->devmem_lock);
505
506 pr_info("added new %u MB chunk (total %u chunks, %u MB) PFNs [0x%lx 0x%lx)\n",
507 DEVMEM_CHUNK_SIZE / (1024 * 1024),
508 mdevice->devmem_count,
509 mdevice->devmem_count * (DEVMEM_CHUNK_SIZE / (1024 * 1024)),
510 pfn_first, pfn_last);
511
512 spin_lock(&mdevice->lock);
513 for (pfn = pfn_first; pfn < pfn_last; pfn++) {
514 struct page *page = pfn_to_page(pfn);
515
516 page->zone_device_data = mdevice->free_pages;
517 mdevice->free_pages = page;
518 }
519 if (ppage) {
520 *ppage = mdevice->free_pages;
521 mdevice->free_pages = (*ppage)->zone_device_data;
522 mdevice->calloc++;
523 }
524 spin_unlock(&mdevice->lock);
525
526 return true;
527
528err_free:
529 kfree(devmem);
530err_release:
531 release_mem_region(res->start, resource_size(res));
532err:
533 mutex_unlock(&mdevice->devmem_lock);
534 return false;
535}
536
537static struct page *dmirror_devmem_alloc_page(struct dmirror_device *mdevice)
538{
539 struct page *dpage = NULL;
540 struct page *rpage;
541
542 /*
543 * This is a fake device so we alloc real system memory to store
544 * our device memory.
545 */
546 rpage = alloc_page(GFP_HIGHUSER);
547 if (!rpage)
548 return NULL;
549
550 spin_lock(&mdevice->lock);
551
552 if (mdevice->free_pages) {
553 dpage = mdevice->free_pages;
554 mdevice->free_pages = dpage->zone_device_data;
555 mdevice->calloc++;
556 spin_unlock(&mdevice->lock);
557 } else {
558 spin_unlock(&mdevice->lock);
559 if (!dmirror_allocate_chunk(mdevice, &dpage))
560 goto error;
561 }
562
563 dpage->zone_device_data = rpage;
564 get_page(dpage);
565 lock_page(dpage);
566 return dpage;
567
568error:
569 __free_page(rpage);
570 return NULL;
571}
572
573static void dmirror_migrate_alloc_and_copy(struct migrate_vma *args,
574 struct dmirror *dmirror)
575{
576 struct dmirror_device *mdevice = dmirror->mdevice;
577 const unsigned long *src = args->src;
578 unsigned long *dst = args->dst;
579 unsigned long addr;
580
581 for (addr = args->start; addr < args->end; addr += PAGE_SIZE,
582 src++, dst++) {
583 struct page *spage;
584 struct page *dpage;
585 struct page *rpage;
586
587 if (!(*src & MIGRATE_PFN_MIGRATE))
588 continue;
589
590 /*
591 * Note that spage might be NULL which is OK since it is an
592 * unallocated pte_none() or read-only zero page.
593 */
594 spage = migrate_pfn_to_page(*src);
595
596 dpage = dmirror_devmem_alloc_page(mdevice);
597 if (!dpage)
598 continue;
599
600 rpage = dpage->zone_device_data;
601 if (spage)
602 copy_highpage(rpage, spage);
603 else
604 clear_highpage(rpage);
605
606 /*
607 * Normally, a device would use the page->zone_device_data to
608 * point to the mirror but here we use it to hold the page for
609 * the simulated device memory and that page holds the pointer
610 * to the mirror.
611 */
612 rpage->zone_device_data = dmirror;
613
614 *dst = migrate_pfn(page_to_pfn(dpage)) |
615 MIGRATE_PFN_LOCKED;
616 if ((*src & MIGRATE_PFN_WRITE) ||
617 (!spage && args->vma->vm_flags & VM_WRITE))
618 *dst |= MIGRATE_PFN_WRITE;
619 }
620}
621
622static int dmirror_migrate_finalize_and_map(struct migrate_vma *args,
623 struct dmirror *dmirror)
624{
625 unsigned long start = args->start;
626 unsigned long end = args->end;
627 const unsigned long *src = args->src;
628 const unsigned long *dst = args->dst;
629 unsigned long pfn;
630
631 /* Map the migrated pages into the device's page tables. */
632 mutex_lock(&dmirror->mutex);
633
634 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++,
635 src++, dst++) {
636 struct page *dpage;
637 void *entry;
638
639 if (!(*src & MIGRATE_PFN_MIGRATE))
640 continue;
641
642 dpage = migrate_pfn_to_page(*dst);
643 if (!dpage)
644 continue;
645
646 /*
647 * Store the page that holds the data so the page table
648 * doesn't have to deal with ZONE_DEVICE private pages.
649 */
650 entry = dpage->zone_device_data;
651 if (*dst & MIGRATE_PFN_WRITE)
652 entry = xa_tag_pointer(entry, DPT_XA_TAG_WRITE);
653 entry = xa_store(&dmirror->pt, pfn, entry, GFP_ATOMIC);
654 if (xa_is_err(entry)) {
655 mutex_unlock(&dmirror->mutex);
656 return xa_err(entry);
657 }
658 }
659
660 mutex_unlock(&dmirror->mutex);
661 return 0;
662}
663
664static int dmirror_migrate(struct dmirror *dmirror,
665 struct hmm_dmirror_cmd *cmd)
666{
667 unsigned long start, end, addr;
668 unsigned long size = cmd->npages << PAGE_SHIFT;
669 struct mm_struct *mm = dmirror->notifier.mm;
670 struct vm_area_struct *vma;
671 unsigned long src_pfns[64];
672 unsigned long dst_pfns[64];
673 struct dmirror_bounce bounce;
674 struct migrate_vma args;
675 unsigned long next;
676 int ret;
677
678 start = cmd->addr;
679 end = start + size;
680 if (end < start)
681 return -EINVAL;
682
683 /* Since the mm is for the mirrored process, get a reference first. */
684 if (!mmget_not_zero(mm))
685 return -EINVAL;
686
687 mmap_read_lock(mm);
688 for (addr = start; addr < end; addr = next) {
689 vma = find_vma(mm, addr);
690 if (!vma || addr < vma->vm_start ||
691 !(vma->vm_flags & VM_READ)) {
692 ret = -EINVAL;
693 goto out;
694 }
695 next = min(end, addr + (ARRAY_SIZE(src_pfns) << PAGE_SHIFT));
696 if (next > vma->vm_end)
697 next = vma->vm_end;
698
699 args.vma = vma;
700 args.src = src_pfns;
701 args.dst = dst_pfns;
702 args.start = addr;
703 args.end = next;
704 args.pgmap_owner = dmirror->mdevice;
705 args.flags = MIGRATE_VMA_SELECT_SYSTEM;
706 ret = migrate_vma_setup(&args);
707 if (ret)
708 goto out;
709
710 dmirror_migrate_alloc_and_copy(&args, dmirror);
711 migrate_vma_pages(&args);
712 dmirror_migrate_finalize_and_map(&args, dmirror);
713 migrate_vma_finalize(&args);
714 }
715 mmap_read_unlock(mm);
716 mmput(mm);
717
718 /* Return the migrated data for verification. */
719 ret = dmirror_bounce_init(&bounce, start, size);
720 if (ret)
721 return ret;
722 mutex_lock(&dmirror->mutex);
723 ret = dmirror_do_read(dmirror, start, end, &bounce);
724 mutex_unlock(&dmirror->mutex);
725 if (ret == 0) {
726 if (copy_to_user(u64_to_user_ptr(cmd->ptr), bounce.ptr,
727 bounce.size))
728 ret = -EFAULT;
729 }
730 cmd->cpages = bounce.cpages;
731 dmirror_bounce_fini(&bounce);
732 return ret;
733
734out:
735 mmap_read_unlock(mm);
736 mmput(mm);
737 return ret;
738}
739
740static void dmirror_mkentry(struct dmirror *dmirror, struct hmm_range *range,
741 unsigned char *perm, unsigned long entry)
742{
743 struct page *page;
744
745 if (entry & HMM_PFN_ERROR) {
746 *perm = HMM_DMIRROR_PROT_ERROR;
747 return;
748 }
749 if (!(entry & HMM_PFN_VALID)) {
750 *perm = HMM_DMIRROR_PROT_NONE;
751 return;
752 }
753
754 page = hmm_pfn_to_page(entry);
755 if (is_device_private_page(page)) {
756 /* Is the page migrated to this device or some other? */
757 if (dmirror->mdevice == dmirror_page_to_device(page))
758 *perm = HMM_DMIRROR_PROT_DEV_PRIVATE_LOCAL;
759 else
760 *perm = HMM_DMIRROR_PROT_DEV_PRIVATE_REMOTE;
761 } else if (is_zero_pfn(page_to_pfn(page)))
762 *perm = HMM_DMIRROR_PROT_ZERO;
763 else
764 *perm = HMM_DMIRROR_PROT_NONE;
765 if (entry & HMM_PFN_WRITE)
766 *perm |= HMM_DMIRROR_PROT_WRITE;
767 else
768 *perm |= HMM_DMIRROR_PROT_READ;
769 if (hmm_pfn_to_map_order(entry) + PAGE_SHIFT == PMD_SHIFT)
770 *perm |= HMM_DMIRROR_PROT_PMD;
771 else if (hmm_pfn_to_map_order(entry) + PAGE_SHIFT == PUD_SHIFT)
772 *perm |= HMM_DMIRROR_PROT_PUD;
773}
774
775static bool dmirror_snapshot_invalidate(struct mmu_interval_notifier *mni,
776 const struct mmu_notifier_range *range,
777 unsigned long cur_seq)
778{
779 struct dmirror_interval *dmi =
780 container_of(mni, struct dmirror_interval, notifier);
781 struct dmirror *dmirror = dmi->dmirror;
782
783 if (mmu_notifier_range_blockable(range))
784 mutex_lock(&dmirror->mutex);
785 else if (!mutex_trylock(&dmirror->mutex))
786 return false;
787
788 /*
789 * Snapshots only need to set the sequence number since any
790 * invalidation in the interval invalidates the whole snapshot.
791 */
792 mmu_interval_set_seq(mni, cur_seq);
793
794 mutex_unlock(&dmirror->mutex);
795 return true;
796}
797
798static const struct mmu_interval_notifier_ops dmirror_mrn_ops = {
799 .invalidate = dmirror_snapshot_invalidate,
800};
801
802static int dmirror_range_snapshot(struct dmirror *dmirror,
803 struct hmm_range *range,
804 unsigned char *perm)
805{
806 struct mm_struct *mm = dmirror->notifier.mm;
807 struct dmirror_interval notifier;
808 unsigned long timeout =
809 jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
810 unsigned long i;
811 unsigned long n;
812 int ret = 0;
813
814 notifier.dmirror = dmirror;
815 range->notifier = ¬ifier.notifier;
816
817 ret = mmu_interval_notifier_insert(range->notifier, mm,
818 range->start, range->end - range->start,
819 &dmirror_mrn_ops);
820 if (ret)
821 return ret;
822
823 while (true) {
824 if (time_after(jiffies, timeout)) {
825 ret = -EBUSY;
826 goto out;
827 }
828
829 range->notifier_seq = mmu_interval_read_begin(range->notifier);
830
831 mmap_read_lock(mm);
832 ret = hmm_range_fault(range);
833 mmap_read_unlock(mm);
834 if (ret) {
835 if (ret == -EBUSY)
836 continue;
837 goto out;
838 }
839
840 mutex_lock(&dmirror->mutex);
841 if (mmu_interval_read_retry(range->notifier,
842 range->notifier_seq)) {
843 mutex_unlock(&dmirror->mutex);
844 continue;
845 }
846 break;
847 }
848
849 n = (range->end - range->start) >> PAGE_SHIFT;
850 for (i = 0; i < n; i++)
851 dmirror_mkentry(dmirror, range, perm + i, range->hmm_pfns[i]);
852
853 mutex_unlock(&dmirror->mutex);
854out:
855 mmu_interval_notifier_remove(range->notifier);
856 return ret;
857}
858
859static int dmirror_snapshot(struct dmirror *dmirror,
860 struct hmm_dmirror_cmd *cmd)
861{
862 struct mm_struct *mm = dmirror->notifier.mm;
863 unsigned long start, end;
864 unsigned long size = cmd->npages << PAGE_SHIFT;
865 unsigned long addr;
866 unsigned long next;
867 unsigned long pfns[64];
868 unsigned char perm[64];
869 char __user *uptr;
870 struct hmm_range range = {
871 .hmm_pfns = pfns,
872 .dev_private_owner = dmirror->mdevice,
873 };
874 int ret = 0;
875
876 start = cmd->addr;
877 end = start + size;
878 if (end < start)
879 return -EINVAL;
880
881 /* Since the mm is for the mirrored process, get a reference first. */
882 if (!mmget_not_zero(mm))
883 return -EINVAL;
884
885 /*
886 * Register a temporary notifier to detect invalidations even if it
887 * overlaps with other mmu_interval_notifiers.
888 */
889 uptr = u64_to_user_ptr(cmd->ptr);
890 for (addr = start; addr < end; addr = next) {
891 unsigned long n;
892
893 next = min(addr + (ARRAY_SIZE(pfns) << PAGE_SHIFT), end);
894 range.start = addr;
895 range.end = next;
896
897 ret = dmirror_range_snapshot(dmirror, &range, perm);
898 if (ret)
899 break;
900
901 n = (range.end - range.start) >> PAGE_SHIFT;
902 if (copy_to_user(uptr, perm, n)) {
903 ret = -EFAULT;
904 break;
905 }
906
907 cmd->cpages += n;
908 uptr += n;
909 }
910 mmput(mm);
911
912 return ret;
913}
914
915static long dmirror_fops_unlocked_ioctl(struct file *filp,
916 unsigned int command,
917 unsigned long arg)
918{
919 void __user *uarg = (void __user *)arg;
920 struct hmm_dmirror_cmd cmd;
921 struct dmirror *dmirror;
922 int ret;
923
924 dmirror = filp->private_data;
925 if (!dmirror)
926 return -EINVAL;
927
928 if (copy_from_user(&cmd, uarg, sizeof(cmd)))
929 return -EFAULT;
930
931 if (cmd.addr & ~PAGE_MASK)
932 return -EINVAL;
933 if (cmd.addr >= (cmd.addr + (cmd.npages << PAGE_SHIFT)))
934 return -EINVAL;
935
936 cmd.cpages = 0;
937 cmd.faults = 0;
938
939 switch (command) {
940 case HMM_DMIRROR_READ:
941 ret = dmirror_read(dmirror, &cmd);
942 break;
943
944 case HMM_DMIRROR_WRITE:
945 ret = dmirror_write(dmirror, &cmd);
946 break;
947
948 case HMM_DMIRROR_MIGRATE:
949 ret = dmirror_migrate(dmirror, &cmd);
950 break;
951
952 case HMM_DMIRROR_SNAPSHOT:
953 ret = dmirror_snapshot(dmirror, &cmd);
954 break;
955
956 default:
957 return -EINVAL;
958 }
959 if (ret)
960 return ret;
961
962 if (copy_to_user(uarg, &cmd, sizeof(cmd)))
963 return -EFAULT;
964
965 return 0;
966}
967
968static const struct file_operations dmirror_fops = {
969 .open = dmirror_fops_open,
970 .release = dmirror_fops_release,
971 .unlocked_ioctl = dmirror_fops_unlocked_ioctl,
972 .llseek = default_llseek,
973 .owner = THIS_MODULE,
974};
975
976static void dmirror_devmem_free(struct page *page)
977{
978 struct page *rpage = page->zone_device_data;
979 struct dmirror_device *mdevice;
980
981 if (rpage)
982 __free_page(rpage);
983
984 mdevice = dmirror_page_to_device(page);
985
986 spin_lock(&mdevice->lock);
987 mdevice->cfree++;
988 page->zone_device_data = mdevice->free_pages;
989 mdevice->free_pages = page;
990 spin_unlock(&mdevice->lock);
991}
992
993static vm_fault_t dmirror_devmem_fault_alloc_and_copy(struct migrate_vma *args,
994 struct dmirror *dmirror)
995{
996 const unsigned long *src = args->src;
997 unsigned long *dst = args->dst;
998 unsigned long start = args->start;
999 unsigned long end = args->end;
1000 unsigned long addr;
1001
1002 for (addr = start; addr < end; addr += PAGE_SIZE,
1003 src++, dst++) {
1004 struct page *dpage, *spage;
1005
1006 spage = migrate_pfn_to_page(*src);
1007 if (!spage || !(*src & MIGRATE_PFN_MIGRATE))
1008 continue;
1009 spage = spage->zone_device_data;
1010
1011 dpage = alloc_page_vma(GFP_HIGHUSER_MOVABLE, args->vma, addr);
1012 if (!dpage)
1013 continue;
1014
1015 lock_page(dpage);
1016 xa_erase(&dmirror->pt, addr >> PAGE_SHIFT);
1017 copy_highpage(dpage, spage);
1018 *dst = migrate_pfn(page_to_pfn(dpage)) | MIGRATE_PFN_LOCKED;
1019 if (*src & MIGRATE_PFN_WRITE)
1020 *dst |= MIGRATE_PFN_WRITE;
1021 }
1022 return 0;
1023}
1024
1025static vm_fault_t dmirror_devmem_fault(struct vm_fault *vmf)
1026{
1027 struct migrate_vma args;
1028 unsigned long src_pfns;
1029 unsigned long dst_pfns;
1030 struct page *rpage;
1031 struct dmirror *dmirror;
1032 vm_fault_t ret;
1033
1034 /*
1035 * Normally, a device would use the page->zone_device_data to point to
1036 * the mirror but here we use it to hold the page for the simulated
1037 * device memory and that page holds the pointer to the mirror.
1038 */
1039 rpage = vmf->page->zone_device_data;
1040 dmirror = rpage->zone_device_data;
1041
1042 /* FIXME demonstrate how we can adjust migrate range */
1043 args.vma = vmf->vma;
1044 args.start = vmf->address;
1045 args.end = args.start + PAGE_SIZE;
1046 args.src = &src_pfns;
1047 args.dst = &dst_pfns;
1048 args.pgmap_owner = dmirror->mdevice;
1049 args.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE;
1050
1051 if (migrate_vma_setup(&args))
1052 return VM_FAULT_SIGBUS;
1053
1054 ret = dmirror_devmem_fault_alloc_and_copy(&args, dmirror);
1055 if (ret)
1056 return ret;
1057 migrate_vma_pages(&args);
1058 /*
1059 * No device finalize step is needed since
1060 * dmirror_devmem_fault_alloc_and_copy() will have already
1061 * invalidated the device page table.
1062 */
1063 migrate_vma_finalize(&args);
1064 return 0;
1065}
1066
1067static const struct dev_pagemap_ops dmirror_devmem_ops = {
1068 .page_free = dmirror_devmem_free,
1069 .migrate_to_ram = dmirror_devmem_fault,
1070};
1071
1072static int dmirror_device_init(struct dmirror_device *mdevice, int id)
1073{
1074 dev_t dev;
1075 int ret;
1076
1077 dev = MKDEV(MAJOR(dmirror_dev), id);
1078 mutex_init(&mdevice->devmem_lock);
1079 spin_lock_init(&mdevice->lock);
1080
1081 cdev_init(&mdevice->cdevice, &dmirror_fops);
1082 mdevice->cdevice.owner = THIS_MODULE;
1083 ret = cdev_add(&mdevice->cdevice, dev, 1);
1084 if (ret)
1085 return ret;
1086
1087 /* Build a list of free ZONE_DEVICE private struct pages */
1088 dmirror_allocate_chunk(mdevice, NULL);
1089
1090 return 0;
1091}
1092
1093static void dmirror_device_remove(struct dmirror_device *mdevice)
1094{
1095 unsigned int i;
1096
1097 if (mdevice->devmem_chunks) {
1098 for (i = 0; i < mdevice->devmem_count; i++) {
1099 struct dmirror_chunk *devmem =
1100 mdevice->devmem_chunks[i];
1101
1102 memunmap_pages(&devmem->pagemap);
1103 release_mem_region(devmem->pagemap.res.start,
1104 resource_size(&devmem->pagemap.res));
1105 kfree(devmem);
1106 }
1107 kfree(mdevice->devmem_chunks);
1108 }
1109
1110 cdev_del(&mdevice->cdevice);
1111}
1112
1113static int __init hmm_dmirror_init(void)
1114{
1115 int ret;
1116 int id;
1117
1118 ret = alloc_chrdev_region(&dmirror_dev, 0, DMIRROR_NDEVICES,
1119 "HMM_DMIRROR");
1120 if (ret)
1121 goto err_unreg;
1122
1123 for (id = 0; id < DMIRROR_NDEVICES; id++) {
1124 ret = dmirror_device_init(dmirror_devices + id, id);
1125 if (ret)
1126 goto err_chrdev;
1127 }
1128
1129 /*
1130 * Allocate a zero page to simulate a reserved page of device private
1131 * memory which is always zero. The zero_pfn page isn't used just to
1132 * make the code here simpler (i.e., we need a struct page for it).
1133 */
1134 dmirror_zero_page = alloc_page(GFP_HIGHUSER | __GFP_ZERO);
1135 if (!dmirror_zero_page) {
1136 ret = -ENOMEM;
1137 goto err_chrdev;
1138 }
1139
1140 pr_info("HMM test module loaded. This is only for testing HMM.\n");
1141 return 0;
1142
1143err_chrdev:
1144 while (--id >= 0)
1145 dmirror_device_remove(dmirror_devices + id);
1146 unregister_chrdev_region(dmirror_dev, DMIRROR_NDEVICES);
1147err_unreg:
1148 return ret;
1149}
1150
1151static void __exit hmm_dmirror_exit(void)
1152{
1153 int id;
1154
1155 if (dmirror_zero_page)
1156 __free_page(dmirror_zero_page);
1157 for (id = 0; id < DMIRROR_NDEVICES; id++)
1158 dmirror_device_remove(dmirror_devices + id);
1159 unregister_chrdev_region(dmirror_dev, DMIRROR_NDEVICES);
1160}
1161
1162module_init(hmm_dmirror_init);
1163module_exit(hmm_dmirror_exit);
1164MODULE_LICENSE("GPL");