1 // SPDX-License-Identifier: GPL-2.0
3 * This is a module to test the HMM (Heterogeneous Memory Management)
4 * mirror and zone device private memory migration APIs of the kernel.
5 * Userspace programs can register with the driver to mirror their own address
6 * space and can use the device to read/write any valid virtual address.
8 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/kernel.h>
13 #include <linux/cdev.h>
14 #include <linux/device.h>
15 #include <linux/mutex.h>
16 #include <linux/rwsem.h>
17 #include <linux/sched.h>
18 #include <linux/slab.h>
19 #include <linux/highmem.h>
20 #include <linux/delay.h>
21 #include <linux/pagemap.h>
22 #include <linux/hmm.h>
23 #include <linux/vmalloc.h>
24 #include <linux/swap.h>
25 #include <linux/swapops.h>
26 #include <linux/sched/mm.h>
27 #include <linux/platform_device.h>
28 #include <linux/rmap.h>
30 #include "test_hmm_uapi.h"
32 #define DMIRROR_NDEVICES 2
33 #define DMIRROR_RANGE_FAULT_TIMEOUT 1000
34 #define DEVMEM_CHUNK_SIZE (256 * 1024 * 1024U)
35 #define DEVMEM_CHUNKS_RESERVE 16
37 static const struct dev_pagemap_ops dmirror_devmem_ops;
38 static const struct mmu_interval_notifier_ops dmirror_min_ops;
39 static dev_t dmirror_dev;
41 struct dmirror_device;
43 struct dmirror_bounce {
50 #define DPT_XA_TAG_ATOMIC 1UL
51 #define DPT_XA_TAG_WRITE 3UL
54 * Data structure to track address ranges and register for mmu interval
57 struct dmirror_interval {
58 struct mmu_interval_notifier notifier;
59 struct dmirror *dmirror;
63 * Data attached to the open device file.
64 * Note that it might be shared after a fork().
67 struct dmirror_device *mdevice;
69 struct mmu_interval_notifier notifier;
74 * ZONE_DEVICE pages for migration and simulating device memory.
76 struct dmirror_chunk {
77 struct dev_pagemap pagemap;
78 struct dmirror_device *mdevice;
84 struct dmirror_device {
86 struct hmm_devmem *devmem;
88 unsigned int devmem_capacity;
89 unsigned int devmem_count;
90 struct dmirror_chunk **devmem_chunks;
91 struct mutex devmem_lock; /* protects the above */
95 struct page *free_pages;
96 spinlock_t lock; /* protects the above */
99 static struct dmirror_device dmirror_devices[DMIRROR_NDEVICES];
101 static int dmirror_bounce_init(struct dmirror_bounce *bounce,
108 bounce->ptr = vmalloc(size);
114 static void dmirror_bounce_fini(struct dmirror_bounce *bounce)
119 static int dmirror_fops_open(struct inode *inode, struct file *filp)
121 struct cdev *cdev = inode->i_cdev;
122 struct dmirror *dmirror;
125 /* Mirror this process address space */
126 dmirror = kzalloc(sizeof(*dmirror), GFP_KERNEL);
130 dmirror->mdevice = container_of(cdev, struct dmirror_device, cdevice);
131 mutex_init(&dmirror->mutex);
132 xa_init(&dmirror->pt);
134 ret = mmu_interval_notifier_insert(&dmirror->notifier, current->mm,
135 0, ULONG_MAX & PAGE_MASK, &dmirror_min_ops);
141 filp->private_data = dmirror;
145 static int dmirror_fops_release(struct inode *inode, struct file *filp)
147 struct dmirror *dmirror = filp->private_data;
149 mmu_interval_notifier_remove(&dmirror->notifier);
150 xa_destroy(&dmirror->pt);
155 static struct dmirror_device *dmirror_page_to_device(struct page *page)
158 return container_of(page->pgmap, struct dmirror_chunk,
162 static int dmirror_do_fault(struct dmirror *dmirror, struct hmm_range *range)
164 unsigned long *pfns = range->hmm_pfns;
167 for (pfn = (range->start >> PAGE_SHIFT);
168 pfn < (range->end >> PAGE_SHIFT);
174 * Since we asked for hmm_range_fault() to populate pages,
175 * it shouldn't return an error entry on success.
177 WARN_ON(*pfns & HMM_PFN_ERROR);
178 WARN_ON(!(*pfns & HMM_PFN_VALID));
180 page = hmm_pfn_to_page(*pfns);
184 if (*pfns & HMM_PFN_WRITE)
185 entry = xa_tag_pointer(entry, DPT_XA_TAG_WRITE);
186 else if (WARN_ON(range->default_flags & HMM_PFN_WRITE))
188 entry = xa_store(&dmirror->pt, pfn, entry, GFP_ATOMIC);
189 if (xa_is_err(entry))
190 return xa_err(entry);
196 static void dmirror_do_update(struct dmirror *dmirror, unsigned long start,
203 * The XArray doesn't hold references to pages since it relies on
204 * the mmu notifier to clear page pointers when they become stale.
205 * Therefore, it is OK to just clear the entry.
207 xa_for_each_range(&dmirror->pt, pfn, entry, start >> PAGE_SHIFT,
209 xa_erase(&dmirror->pt, pfn);
212 static bool dmirror_interval_invalidate(struct mmu_interval_notifier *mni,
213 const struct mmu_notifier_range *range,
214 unsigned long cur_seq)
216 struct dmirror *dmirror = container_of(mni, struct dmirror, notifier);
219 * Ignore invalidation callbacks for device private pages since
220 * the invalidation is handled as part of the migration process.
222 if (range->event == MMU_NOTIFY_MIGRATE &&
223 range->owner == dmirror->mdevice)
226 if (mmu_notifier_range_blockable(range))
227 mutex_lock(&dmirror->mutex);
228 else if (!mutex_trylock(&dmirror->mutex))
231 mmu_interval_set_seq(mni, cur_seq);
232 dmirror_do_update(dmirror, range->start, range->end);
234 mutex_unlock(&dmirror->mutex);
238 static const struct mmu_interval_notifier_ops dmirror_min_ops = {
239 .invalidate = dmirror_interval_invalidate,
242 static int dmirror_range_fault(struct dmirror *dmirror,
243 struct hmm_range *range)
245 struct mm_struct *mm = dmirror->notifier.mm;
246 unsigned long timeout =
247 jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
251 if (time_after(jiffies, timeout)) {
256 range->notifier_seq = mmu_interval_read_begin(range->notifier);
258 ret = hmm_range_fault(range);
259 mmap_read_unlock(mm);
266 mutex_lock(&dmirror->mutex);
267 if (mmu_interval_read_retry(range->notifier,
268 range->notifier_seq)) {
269 mutex_unlock(&dmirror->mutex);
275 ret = dmirror_do_fault(dmirror, range);
277 mutex_unlock(&dmirror->mutex);
282 static int dmirror_fault(struct dmirror *dmirror, unsigned long start,
283 unsigned long end, bool write)
285 struct mm_struct *mm = dmirror->notifier.mm;
287 unsigned long pfns[64];
288 struct hmm_range range = {
289 .notifier = &dmirror->notifier,
293 HMM_PFN_REQ_FAULT | (write ? HMM_PFN_REQ_WRITE : 0),
294 .dev_private_owner = dmirror->mdevice,
298 /* Since the mm is for the mirrored process, get a reference first. */
299 if (!mmget_not_zero(mm))
302 for (addr = start; addr < end; addr = range.end) {
304 range.end = min(addr + (ARRAY_SIZE(pfns) << PAGE_SHIFT), end);
306 ret = dmirror_range_fault(dmirror, &range);
315 static int dmirror_do_read(struct dmirror *dmirror, unsigned long start,
316 unsigned long end, struct dmirror_bounce *bounce)
321 ptr = bounce->ptr + ((start - bounce->addr) & PAGE_MASK);
323 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++) {
328 entry = xa_load(&dmirror->pt, pfn);
329 page = xa_untag_pointer(entry);
334 memcpy(ptr, tmp, PAGE_SIZE);
344 static int dmirror_read(struct dmirror *dmirror, struct hmm_dmirror_cmd *cmd)
346 struct dmirror_bounce bounce;
347 unsigned long start, end;
348 unsigned long size = cmd->npages << PAGE_SHIFT;
356 ret = dmirror_bounce_init(&bounce, start, size);
361 mutex_lock(&dmirror->mutex);
362 ret = dmirror_do_read(dmirror, start, end, &bounce);
363 mutex_unlock(&dmirror->mutex);
367 start = cmd->addr + (bounce.cpages << PAGE_SHIFT);
368 ret = dmirror_fault(dmirror, start, end, false);
375 if (copy_to_user(u64_to_user_ptr(cmd->ptr), bounce.ptr,
379 cmd->cpages = bounce.cpages;
380 dmirror_bounce_fini(&bounce);
384 static int dmirror_do_write(struct dmirror *dmirror, unsigned long start,
385 unsigned long end, struct dmirror_bounce *bounce)
390 ptr = bounce->ptr + ((start - bounce->addr) & PAGE_MASK);
392 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++) {
397 entry = xa_load(&dmirror->pt, pfn);
398 page = xa_untag_pointer(entry);
399 if (!page || xa_pointer_tag(entry) != DPT_XA_TAG_WRITE)
403 memcpy(tmp, ptr, PAGE_SIZE);
413 static int dmirror_write(struct dmirror *dmirror, struct hmm_dmirror_cmd *cmd)
415 struct dmirror_bounce bounce;
416 unsigned long start, end;
417 unsigned long size = cmd->npages << PAGE_SHIFT;
425 ret = dmirror_bounce_init(&bounce, start, size);
428 if (copy_from_user(bounce.ptr, u64_to_user_ptr(cmd->ptr),
435 mutex_lock(&dmirror->mutex);
436 ret = dmirror_do_write(dmirror, start, end, &bounce);
437 mutex_unlock(&dmirror->mutex);
441 start = cmd->addr + (bounce.cpages << PAGE_SHIFT);
442 ret = dmirror_fault(dmirror, start, end, true);
449 cmd->cpages = bounce.cpages;
450 dmirror_bounce_fini(&bounce);
454 static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
457 struct dmirror_chunk *devmem;
458 struct resource *res;
460 unsigned long pfn_first;
461 unsigned long pfn_last;
464 devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
468 res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
473 devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
474 devmem->pagemap.range.start = res->start;
475 devmem->pagemap.range.end = res->end;
476 devmem->pagemap.nr_range = 1;
477 devmem->pagemap.ops = &dmirror_devmem_ops;
478 devmem->pagemap.owner = mdevice;
480 mutex_lock(&mdevice->devmem_lock);
482 if (mdevice->devmem_count == mdevice->devmem_capacity) {
483 struct dmirror_chunk **new_chunks;
484 unsigned int new_capacity;
486 new_capacity = mdevice->devmem_capacity +
487 DEVMEM_CHUNKS_RESERVE;
488 new_chunks = krealloc(mdevice->devmem_chunks,
489 sizeof(new_chunks[0]) * new_capacity,
493 mdevice->devmem_capacity = new_capacity;
494 mdevice->devmem_chunks = new_chunks;
497 ptr = memremap_pages(&devmem->pagemap, numa_node_id());
501 devmem->mdevice = mdevice;
502 pfn_first = devmem->pagemap.range.start >> PAGE_SHIFT;
503 pfn_last = pfn_first + (range_len(&devmem->pagemap.range) >> PAGE_SHIFT);
504 mdevice->devmem_chunks[mdevice->devmem_count++] = devmem;
506 mutex_unlock(&mdevice->devmem_lock);
508 pr_info("added new %u MB chunk (total %u chunks, %u MB) PFNs [0x%lx 0x%lx)\n",
509 DEVMEM_CHUNK_SIZE / (1024 * 1024),
510 mdevice->devmem_count,
511 mdevice->devmem_count * (DEVMEM_CHUNK_SIZE / (1024 * 1024)),
512 pfn_first, pfn_last);
514 spin_lock(&mdevice->lock);
515 for (pfn = pfn_first; pfn < pfn_last; pfn++) {
516 struct page *page = pfn_to_page(pfn);
518 page->zone_device_data = mdevice->free_pages;
519 mdevice->free_pages = page;
522 *ppage = mdevice->free_pages;
523 mdevice->free_pages = (*ppage)->zone_device_data;
526 spin_unlock(&mdevice->lock);
531 mutex_unlock(&mdevice->devmem_lock);
532 release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
539 static struct page *dmirror_devmem_alloc_page(struct dmirror_device *mdevice)
541 struct page *dpage = NULL;
545 * This is a fake device so we alloc real system memory to store
548 rpage = alloc_page(GFP_HIGHUSER);
552 spin_lock(&mdevice->lock);
554 if (mdevice->free_pages) {
555 dpage = mdevice->free_pages;
556 mdevice->free_pages = dpage->zone_device_data;
558 spin_unlock(&mdevice->lock);
560 spin_unlock(&mdevice->lock);
561 if (!dmirror_allocate_chunk(mdevice, &dpage))
565 dpage->zone_device_data = rpage;
575 static void dmirror_migrate_alloc_and_copy(struct migrate_vma *args,
576 struct dmirror *dmirror)
578 struct dmirror_device *mdevice = dmirror->mdevice;
579 const unsigned long *src = args->src;
580 unsigned long *dst = args->dst;
583 for (addr = args->start; addr < args->end; addr += PAGE_SIZE,
589 if (!(*src & MIGRATE_PFN_MIGRATE))
593 * Note that spage might be NULL which is OK since it is an
594 * unallocated pte_none() or read-only zero page.
596 spage = migrate_pfn_to_page(*src);
598 dpage = dmirror_devmem_alloc_page(mdevice);
602 rpage = dpage->zone_device_data;
604 copy_highpage(rpage, spage);
606 clear_highpage(rpage);
609 * Normally, a device would use the page->zone_device_data to
610 * point to the mirror but here we use it to hold the page for
611 * the simulated device memory and that page holds the pointer
614 rpage->zone_device_data = dmirror;
616 *dst = migrate_pfn(page_to_pfn(dpage));
617 if ((*src & MIGRATE_PFN_WRITE) ||
618 (!spage && args->vma->vm_flags & VM_WRITE))
619 *dst |= MIGRATE_PFN_WRITE;
623 static int dmirror_check_atomic(struct dmirror *dmirror, unsigned long start,
628 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++) {
631 entry = xa_load(&dmirror->pt, pfn);
632 if (xa_pointer_tag(entry) == DPT_XA_TAG_ATOMIC)
639 static int dmirror_atomic_map(unsigned long start, unsigned long end,
640 struct page **pages, struct dmirror *dmirror)
642 unsigned long pfn, mapped = 0;
645 /* Map the migrated pages into the device's page tables. */
646 mutex_lock(&dmirror->mutex);
648 for (i = 0, pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++, i++) {
655 entry = xa_tag_pointer(entry, DPT_XA_TAG_ATOMIC);
656 entry = xa_store(&dmirror->pt, pfn, entry, GFP_ATOMIC);
657 if (xa_is_err(entry)) {
658 mutex_unlock(&dmirror->mutex);
659 return xa_err(entry);
665 mutex_unlock(&dmirror->mutex);
669 static int dmirror_migrate_finalize_and_map(struct migrate_vma *args,
670 struct dmirror *dmirror)
672 unsigned long start = args->start;
673 unsigned long end = args->end;
674 const unsigned long *src = args->src;
675 const unsigned long *dst = args->dst;
678 /* Map the migrated pages into the device's page tables. */
679 mutex_lock(&dmirror->mutex);
681 for (pfn = start >> PAGE_SHIFT; pfn < (end >> PAGE_SHIFT); pfn++,
686 if (!(*src & MIGRATE_PFN_MIGRATE))
689 dpage = migrate_pfn_to_page(*dst);
694 * Store the page that holds the data so the page table
695 * doesn't have to deal with ZONE_DEVICE private pages.
697 entry = dpage->zone_device_data;
698 if (*dst & MIGRATE_PFN_WRITE)
699 entry = xa_tag_pointer(entry, DPT_XA_TAG_WRITE);
700 entry = xa_store(&dmirror->pt, pfn, entry, GFP_ATOMIC);
701 if (xa_is_err(entry)) {
702 mutex_unlock(&dmirror->mutex);
703 return xa_err(entry);
707 mutex_unlock(&dmirror->mutex);
711 static int dmirror_exclusive(struct dmirror *dmirror,
712 struct hmm_dmirror_cmd *cmd)
714 unsigned long start, end, addr;
715 unsigned long size = cmd->npages << PAGE_SHIFT;
716 struct mm_struct *mm = dmirror->notifier.mm;
717 struct page *pages[64];
718 struct dmirror_bounce bounce;
727 /* Since the mm is for the mirrored process, get a reference first. */
728 if (!mmget_not_zero(mm))
732 for (addr = start; addr < end; addr = next) {
733 unsigned long mapped;
736 if (end < addr + (ARRAY_SIZE(pages) << PAGE_SHIFT))
739 next = addr + (ARRAY_SIZE(pages) << PAGE_SHIFT);
741 ret = make_device_exclusive_range(mm, addr, next, pages, NULL);
742 mapped = dmirror_atomic_map(addr, next, pages, dmirror);
743 for (i = 0; i < ret; i++) {
745 unlock_page(pages[i]);
750 if (addr + (mapped << PAGE_SHIFT) < next) {
751 mmap_read_unlock(mm);
756 mmap_read_unlock(mm);
759 /* Return the migrated data for verification. */
760 ret = dmirror_bounce_init(&bounce, start, size);
763 mutex_lock(&dmirror->mutex);
764 ret = dmirror_do_read(dmirror, start, end, &bounce);
765 mutex_unlock(&dmirror->mutex);
767 if (copy_to_user(u64_to_user_ptr(cmd->ptr), bounce.ptr,
772 cmd->cpages = bounce.cpages;
773 dmirror_bounce_fini(&bounce);
777 static int dmirror_migrate(struct dmirror *dmirror,
778 struct hmm_dmirror_cmd *cmd)
780 unsigned long start, end, addr;
781 unsigned long size = cmd->npages << PAGE_SHIFT;
782 struct mm_struct *mm = dmirror->notifier.mm;
783 struct vm_area_struct *vma;
784 unsigned long src_pfns[64];
785 unsigned long dst_pfns[64];
786 struct dmirror_bounce bounce;
787 struct migrate_vma args;
796 /* Since the mm is for the mirrored process, get a reference first. */
797 if (!mmget_not_zero(mm))
801 for (addr = start; addr < end; addr = next) {
802 vma = vma_lookup(mm, addr);
803 if (!vma || !(vma->vm_flags & VM_READ)) {
807 next = min(end, addr + (ARRAY_SIZE(src_pfns) << PAGE_SHIFT));
808 if (next > vma->vm_end)
816 args.pgmap_owner = dmirror->mdevice;
817 args.flags = MIGRATE_VMA_SELECT_SYSTEM;
818 ret = migrate_vma_setup(&args);
822 dmirror_migrate_alloc_and_copy(&args, dmirror);
823 migrate_vma_pages(&args);
824 dmirror_migrate_finalize_and_map(&args, dmirror);
825 migrate_vma_finalize(&args);
827 mmap_read_unlock(mm);
830 /* Return the migrated data for verification. */
831 ret = dmirror_bounce_init(&bounce, start, size);
834 mutex_lock(&dmirror->mutex);
835 ret = dmirror_do_read(dmirror, start, end, &bounce);
836 mutex_unlock(&dmirror->mutex);
838 if (copy_to_user(u64_to_user_ptr(cmd->ptr), bounce.ptr,
842 cmd->cpages = bounce.cpages;
843 dmirror_bounce_fini(&bounce);
847 mmap_read_unlock(mm);
852 static void dmirror_mkentry(struct dmirror *dmirror, struct hmm_range *range,
853 unsigned char *perm, unsigned long entry)
857 if (entry & HMM_PFN_ERROR) {
858 *perm = HMM_DMIRROR_PROT_ERROR;
861 if (!(entry & HMM_PFN_VALID)) {
862 *perm = HMM_DMIRROR_PROT_NONE;
866 page = hmm_pfn_to_page(entry);
867 if (is_device_private_page(page)) {
868 /* Is the page migrated to this device or some other? */
869 if (dmirror->mdevice == dmirror_page_to_device(page))
870 *perm = HMM_DMIRROR_PROT_DEV_PRIVATE_LOCAL;
872 *perm = HMM_DMIRROR_PROT_DEV_PRIVATE_REMOTE;
873 } else if (is_zero_pfn(page_to_pfn(page)))
874 *perm = HMM_DMIRROR_PROT_ZERO;
876 *perm = HMM_DMIRROR_PROT_NONE;
877 if (entry & HMM_PFN_WRITE)
878 *perm |= HMM_DMIRROR_PROT_WRITE;
880 *perm |= HMM_DMIRROR_PROT_READ;
881 if (hmm_pfn_to_map_order(entry) + PAGE_SHIFT == PMD_SHIFT)
882 *perm |= HMM_DMIRROR_PROT_PMD;
883 else if (hmm_pfn_to_map_order(entry) + PAGE_SHIFT == PUD_SHIFT)
884 *perm |= HMM_DMIRROR_PROT_PUD;
887 static bool dmirror_snapshot_invalidate(struct mmu_interval_notifier *mni,
888 const struct mmu_notifier_range *range,
889 unsigned long cur_seq)
891 struct dmirror_interval *dmi =
892 container_of(mni, struct dmirror_interval, notifier);
893 struct dmirror *dmirror = dmi->dmirror;
895 if (mmu_notifier_range_blockable(range))
896 mutex_lock(&dmirror->mutex);
897 else if (!mutex_trylock(&dmirror->mutex))
901 * Snapshots only need to set the sequence number since any
902 * invalidation in the interval invalidates the whole snapshot.
904 mmu_interval_set_seq(mni, cur_seq);
906 mutex_unlock(&dmirror->mutex);
910 static const struct mmu_interval_notifier_ops dmirror_mrn_ops = {
911 .invalidate = dmirror_snapshot_invalidate,
914 static int dmirror_range_snapshot(struct dmirror *dmirror,
915 struct hmm_range *range,
918 struct mm_struct *mm = dmirror->notifier.mm;
919 struct dmirror_interval notifier;
920 unsigned long timeout =
921 jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT);
926 notifier.dmirror = dmirror;
927 range->notifier = ¬ifier.notifier;
929 ret = mmu_interval_notifier_insert(range->notifier, mm,
930 range->start, range->end - range->start,
936 if (time_after(jiffies, timeout)) {
941 range->notifier_seq = mmu_interval_read_begin(range->notifier);
944 ret = hmm_range_fault(range);
945 mmap_read_unlock(mm);
952 mutex_lock(&dmirror->mutex);
953 if (mmu_interval_read_retry(range->notifier,
954 range->notifier_seq)) {
955 mutex_unlock(&dmirror->mutex);
961 n = (range->end - range->start) >> PAGE_SHIFT;
962 for (i = 0; i < n; i++)
963 dmirror_mkentry(dmirror, range, perm + i, range->hmm_pfns[i]);
965 mutex_unlock(&dmirror->mutex);
967 mmu_interval_notifier_remove(range->notifier);
971 static int dmirror_snapshot(struct dmirror *dmirror,
972 struct hmm_dmirror_cmd *cmd)
974 struct mm_struct *mm = dmirror->notifier.mm;
975 unsigned long start, end;
976 unsigned long size = cmd->npages << PAGE_SHIFT;
979 unsigned long pfns[64];
980 unsigned char perm[64];
982 struct hmm_range range = {
984 .dev_private_owner = dmirror->mdevice,
993 /* Since the mm is for the mirrored process, get a reference first. */
994 if (!mmget_not_zero(mm))
998 * Register a temporary notifier to detect invalidations even if it
999 * overlaps with other mmu_interval_notifiers.
1001 uptr = u64_to_user_ptr(cmd->ptr);
1002 for (addr = start; addr < end; addr = next) {
1005 next = min(addr + (ARRAY_SIZE(pfns) << PAGE_SHIFT), end);
1009 ret = dmirror_range_snapshot(dmirror, &range, perm);
1013 n = (range.end - range.start) >> PAGE_SHIFT;
1014 if (copy_to_user(uptr, perm, n)) {
1027 static long dmirror_fops_unlocked_ioctl(struct file *filp,
1028 unsigned int command,
1031 void __user *uarg = (void __user *)arg;
1032 struct hmm_dmirror_cmd cmd;
1033 struct dmirror *dmirror;
1036 dmirror = filp->private_data;
1040 if (copy_from_user(&cmd, uarg, sizeof(cmd)))
1043 if (cmd.addr & ~PAGE_MASK)
1045 if (cmd.addr >= (cmd.addr + (cmd.npages << PAGE_SHIFT)))
1052 case HMM_DMIRROR_READ:
1053 ret = dmirror_read(dmirror, &cmd);
1056 case HMM_DMIRROR_WRITE:
1057 ret = dmirror_write(dmirror, &cmd);
1060 case HMM_DMIRROR_MIGRATE:
1061 ret = dmirror_migrate(dmirror, &cmd);
1064 case HMM_DMIRROR_EXCLUSIVE:
1065 ret = dmirror_exclusive(dmirror, &cmd);
1068 case HMM_DMIRROR_CHECK_EXCLUSIVE:
1069 ret = dmirror_check_atomic(dmirror, cmd.addr,
1070 cmd.addr + (cmd.npages << PAGE_SHIFT));
1073 case HMM_DMIRROR_SNAPSHOT:
1074 ret = dmirror_snapshot(dmirror, &cmd);
1083 if (copy_to_user(uarg, &cmd, sizeof(cmd)))
1089 static int dmirror_fops_mmap(struct file *file, struct vm_area_struct *vma)
1093 for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) {
1097 page = alloc_page(GFP_KERNEL | __GFP_ZERO);
1101 ret = vm_insert_page(vma, addr, page);
1112 static const struct file_operations dmirror_fops = {
1113 .open = dmirror_fops_open,
1114 .release = dmirror_fops_release,
1115 .mmap = dmirror_fops_mmap,
1116 .unlocked_ioctl = dmirror_fops_unlocked_ioctl,
1117 .llseek = default_llseek,
1118 .owner = THIS_MODULE,
1121 static void dmirror_devmem_free(struct page *page)
1123 struct page *rpage = page->zone_device_data;
1124 struct dmirror_device *mdevice;
1129 mdevice = dmirror_page_to_device(page);
1131 spin_lock(&mdevice->lock);
1133 page->zone_device_data = mdevice->free_pages;
1134 mdevice->free_pages = page;
1135 spin_unlock(&mdevice->lock);
1138 static vm_fault_t dmirror_devmem_fault_alloc_and_copy(struct migrate_vma *args,
1139 struct dmirror *dmirror)
1141 const unsigned long *src = args->src;
1142 unsigned long *dst = args->dst;
1143 unsigned long start = args->start;
1144 unsigned long end = args->end;
1147 for (addr = start; addr < end; addr += PAGE_SIZE,
1149 struct page *dpage, *spage;
1151 spage = migrate_pfn_to_page(*src);
1152 if (!spage || !(*src & MIGRATE_PFN_MIGRATE))
1154 spage = spage->zone_device_data;
1156 dpage = alloc_page_vma(GFP_HIGHUSER_MOVABLE, args->vma, addr);
1161 xa_erase(&dmirror->pt, addr >> PAGE_SHIFT);
1162 copy_highpage(dpage, spage);
1163 *dst = migrate_pfn(page_to_pfn(dpage));
1164 if (*src & MIGRATE_PFN_WRITE)
1165 *dst |= MIGRATE_PFN_WRITE;
1170 static vm_fault_t dmirror_devmem_fault(struct vm_fault *vmf)
1172 struct migrate_vma args;
1173 unsigned long src_pfns;
1174 unsigned long dst_pfns;
1176 struct dmirror *dmirror;
1180 * Normally, a device would use the page->zone_device_data to point to
1181 * the mirror but here we use it to hold the page for the simulated
1182 * device memory and that page holds the pointer to the mirror.
1184 rpage = vmf->page->zone_device_data;
1185 dmirror = rpage->zone_device_data;
1187 /* FIXME demonstrate how we can adjust migrate range */
1188 args.vma = vmf->vma;
1189 args.start = vmf->address;
1190 args.end = args.start + PAGE_SIZE;
1191 args.src = &src_pfns;
1192 args.dst = &dst_pfns;
1193 args.pgmap_owner = dmirror->mdevice;
1194 args.flags = MIGRATE_VMA_SELECT_DEVICE_PRIVATE;
1196 if (migrate_vma_setup(&args))
1197 return VM_FAULT_SIGBUS;
1199 ret = dmirror_devmem_fault_alloc_and_copy(&args, dmirror);
1202 migrate_vma_pages(&args);
1204 * No device finalize step is needed since
1205 * dmirror_devmem_fault_alloc_and_copy() will have already
1206 * invalidated the device page table.
1208 migrate_vma_finalize(&args);
1212 static const struct dev_pagemap_ops dmirror_devmem_ops = {
1213 .page_free = dmirror_devmem_free,
1214 .migrate_to_ram = dmirror_devmem_fault,
1217 static int dmirror_device_init(struct dmirror_device *mdevice, int id)
1222 dev = MKDEV(MAJOR(dmirror_dev), id);
1223 mutex_init(&mdevice->devmem_lock);
1224 spin_lock_init(&mdevice->lock);
1226 cdev_init(&mdevice->cdevice, &dmirror_fops);
1227 mdevice->cdevice.owner = THIS_MODULE;
1228 ret = cdev_add(&mdevice->cdevice, dev, 1);
1232 /* Build a list of free ZONE_DEVICE private struct pages */
1233 dmirror_allocate_chunk(mdevice, NULL);
1238 static void dmirror_device_remove(struct dmirror_device *mdevice)
1242 if (mdevice->devmem_chunks) {
1243 for (i = 0; i < mdevice->devmem_count; i++) {
1244 struct dmirror_chunk *devmem =
1245 mdevice->devmem_chunks[i];
1247 memunmap_pages(&devmem->pagemap);
1248 release_mem_region(devmem->pagemap.range.start,
1249 range_len(&devmem->pagemap.range));
1252 kfree(mdevice->devmem_chunks);
1255 cdev_del(&mdevice->cdevice);
1258 static int __init hmm_dmirror_init(void)
1263 ret = alloc_chrdev_region(&dmirror_dev, 0, DMIRROR_NDEVICES,
1268 for (id = 0; id < DMIRROR_NDEVICES; id++) {
1269 ret = dmirror_device_init(dmirror_devices + id, id);
1274 pr_info("HMM test module loaded. This is only for testing HMM.\n");
1279 dmirror_device_remove(dmirror_devices + id);
1280 unregister_chrdev_region(dmirror_dev, DMIRROR_NDEVICES);
1285 static void __exit hmm_dmirror_exit(void)
1289 for (id = 0; id < DMIRROR_NDEVICES; id++)
1290 dmirror_device_remove(dmirror_devices + id);
1291 unregister_chrdev_region(dmirror_dev, DMIRROR_NDEVICES);
1294 module_init(hmm_dmirror_init);
1295 module_exit(hmm_dmirror_exit);
1296 MODULE_LICENSE("GPL");