2 * SN Platform GRU Driver
4 * FAULT HANDLER FOR GRU DETECTED TLB MISSES
6 * This file contains code that handles TLB misses within the GRU.
7 * These misses are reported either via interrupts or user polling of
10 * Copyright (c) 2008 Silicon Graphics, Inc. All Rights Reserved.
12 * This program is free software; you can redistribute it and/or modify
13 * it under the terms of the GNU General Public License as published by
14 * the Free Software Foundation; either version 2 of the License, or
15 * (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 #include <linux/kernel.h>
28 #include <linux/errno.h>
29 #include <linux/spinlock.h>
31 #include <linux/hugetlb.h>
32 #include <linux/device.h>
34 #include <linux/uaccess.h>
35 #include <linux/security.h>
36 #include <asm/pgtable.h>
38 #include "grutables.h"
40 #include "gru_instructions.h"
41 #include <asm/uv/uv_hub.h>
44 * Test if a physical address is a valid GRU GSEG address
46 static inline int is_gru_paddr(unsigned long paddr
)
48 return paddr
>= gru_start_paddr
&& paddr
< gru_end_paddr
;
52 * Find the vma of a GRU segment. Caller must hold mmap_sem.
54 struct vm_area_struct
*gru_find_vma(unsigned long vaddr
)
56 struct vm_area_struct
*vma
;
58 vma
= find_vma(current
->mm
, vaddr
);
59 if (vma
&& vma
->vm_start
<= vaddr
&& vma
->vm_ops
== &gru_vm_ops
)
65 * Find and lock the gts that contains the specified user vaddr.
68 * - *gts with the mmap_sem locked for read and the GTS locked.
69 * - NULL if vaddr invalid OR is not a valid GSEG vaddr.
72 static struct gru_thread_state
*gru_find_lock_gts(unsigned long vaddr
)
74 struct mm_struct
*mm
= current
->mm
;
75 struct vm_area_struct
*vma
;
76 struct gru_thread_state
*gts
= NULL
;
78 down_read(&mm
->mmap_sem
);
79 vma
= gru_find_vma(vaddr
);
81 gts
= gru_find_thread_state(vma
, TSID(vaddr
, vma
));
83 mutex_lock(>s
->ts_ctxlock
);
85 up_read(&mm
->mmap_sem
);
89 static struct gru_thread_state
*gru_alloc_locked_gts(unsigned long vaddr
)
91 struct mm_struct
*mm
= current
->mm
;
92 struct vm_area_struct
*vma
;
93 struct gru_thread_state
*gts
= NULL
;
95 down_write(&mm
->mmap_sem
);
96 vma
= gru_find_vma(vaddr
);
98 gts
= gru_alloc_thread_state(vma
, TSID(vaddr
, vma
));
100 mutex_lock(>s
->ts_ctxlock
);
101 downgrade_write(&mm
->mmap_sem
);
103 up_write(&mm
->mmap_sem
);
110 * Unlock a GTS that was previously locked with gru_find_lock_gts().
112 static void gru_unlock_gts(struct gru_thread_state
*gts
)
114 mutex_unlock(>s
->ts_ctxlock
);
115 up_read(¤t
->mm
->mmap_sem
);
119 * Set a CB.istatus to active using a user virtual address. This must be done
120 * just prior to a TFH RESTART. The new cb.istatus is an in-cache status ONLY.
121 * If the line is evicted, the status may be lost. The in-cache update
122 * is necessary to prevent the user from seeing a stale cb.istatus that will
123 * change as soon as the TFH restart is complete. Races may cause an
124 * occasional failure to clear the cb.istatus, but that is ok.
126 * If the cb address is not valid (should not happen, but...), nothing
127 * bad will happen.. The get_user()/put_user() will fail but there
128 * are no bad side-effects.
130 static void gru_cb_set_istatus_active(unsigned long __user
*cb
)
133 struct gru_instruction_bits bits
;
139 u
.bits
.istatus
= CBS_ACTIVE
;
145 * Convert a interrupt IRQ to a pointer to the GRU GTS that caused the
146 * interrupt. Interrupts are always sent to a cpu on the blade that contains the
147 * GRU (except for headless blades which are not currently supported). A blade
148 * has N grus; a block of N consecutive IRQs is assigned to the GRUs. The IRQ
149 * number uniquely identifies the GRU chiplet on the local blade that caused the
150 * interrupt. Always called in interrupt context.
152 static inline struct gru_state
*irq_to_gru(int irq
)
154 return &gru_base
[uv_numa_blade_id()]->bs_grus
[irq
- IRQ_GRU
];
160 * The GRU has an array of fault maps. A map is private to a cpu
161 * Only one cpu will be accessing a cpu's fault map.
163 * This function scans the cpu-private fault map & clears all bits that
164 * are set. The function returns a bitmap that indicates the bits that
165 * were cleared. Note that sense the maps may be updated asynchronously by
166 * the GRU, atomic operations must be used to clear bits.
168 static void get_clear_fault_map(struct gru_state
*gru
,
169 struct gru_tlb_fault_map
*imap
,
170 struct gru_tlb_fault_map
*dmap
)
173 struct gru_tlb_fault_map
*tfm
;
175 tfm
= get_tfm_for_cpu(gru
, gru_cpu_fault_map_id());
176 prefetchw(tfm
); /* Helps on hardware, required for emulator */
177 for (i
= 0; i
< BITS_TO_LONGS(GRU_NUM_CBE
); i
++) {
178 k
= tfm
->fault_bits
[i
];
180 k
= xchg(&tfm
->fault_bits
[i
], 0UL);
181 imap
->fault_bits
[i
] = k
;
182 k
= tfm
->done_bits
[i
];
184 k
= xchg(&tfm
->done_bits
[i
], 0UL);
185 dmap
->fault_bits
[i
] = k
;
189 * Not functionally required but helps performance. (Required
192 gru_flush_cache(tfm
);
196 * Atomic (interrupt context) & non-atomic (user context) functions to
197 * convert a vaddr into a physical address. The size of the page
198 * is returned in pageshift.
202 * 1 - (atomic only) try again in non-atomic context
204 static int non_atomic_pte_lookup(struct vm_area_struct
*vma
,
205 unsigned long vaddr
, int write
,
206 unsigned long *paddr
, int *pageshift
)
210 /* ZZZ Need to handle HUGE pages */
211 if (is_vm_hugetlb_page(vma
))
213 *pageshift
= PAGE_SHIFT
;
215 (current
, current
->mm
, vaddr
, 1, write
, 0, &page
, NULL
) <= 0)
217 *paddr
= page_to_phys(page
);
225 * Convert a user virtual address to a physical address
226 * Only supports Intel large pages (2MB only) on x86_64.
227 * ZZZ - hugepage support is incomplete
229 * NOTE: mmap_sem is already held on entry to this function. This
230 * guarantees existence of the page tables.
232 static int atomic_pte_lookup(struct vm_area_struct
*vma
, unsigned long vaddr
,
233 int write
, unsigned long *paddr
, int *pageshift
)
240 pgdp
= pgd_offset(vma
->vm_mm
, vaddr
);
241 if (unlikely(pgd_none(*pgdp
)))
244 pudp
= pud_offset(pgdp
, vaddr
);
245 if (unlikely(pud_none(*pudp
)))
248 pmdp
= pmd_offset(pudp
, vaddr
);
249 if (unlikely(pmd_none(*pmdp
)))
252 if (unlikely(pmd_large(*pmdp
)))
253 pte
= *(pte_t
*) pmdp
;
256 pte
= *pte_offset_kernel(pmdp
, vaddr
);
258 if (unlikely(!pte_present(pte
) ||
259 (write
&& (!pte_write(pte
) || !pte_dirty(pte
)))))
262 *paddr
= pte_pfn(pte
) << PAGE_SHIFT
;
263 #ifdef CONFIG_HUGETLB_PAGE
264 *pageshift
= is_vm_hugetlb_page(vma
) ? HPAGE_SHIFT
: PAGE_SHIFT
;
266 *pageshift
= PAGE_SHIFT
;
275 static int gru_vtop(struct gru_thread_state
*gts
, unsigned long vaddr
,
276 int write
, int atomic
, unsigned long *gpa
, int *pageshift
)
278 struct mm_struct
*mm
= gts
->ts_mm
;
279 struct vm_area_struct
*vma
;
283 vma
= find_vma(mm
, vaddr
);
288 * Atomic lookup is faster & usually works even if called in non-atomic
291 rmb(); /* Must/check ms_range_active before loading PTEs */
292 ret
= atomic_pte_lookup(vma
, vaddr
, write
, &paddr
, &ps
);
296 if (non_atomic_pte_lookup(vma
, vaddr
, write
, &paddr
, &ps
))
299 if (is_gru_paddr(paddr
))
301 paddr
= paddr
& ~((1UL << ps
) - 1);
302 *gpa
= uv_soc_phys_ram_to_gpa(paddr
);
314 * Drop a TLB entry into the GRU. The fault is described by info in an TFH.
316 * cb Address of user CBR. Null if not running in user context
318 * 0 = dropin, exception, or switch to UPM successful
319 * 1 = range invalidate active
323 static int gru_try_dropin(struct gru_thread_state
*gts
,
324 struct gru_tlb_fault_handle
*tfh
,
325 unsigned long __user
*cb
)
327 int pageshift
= 0, asid
, write
, ret
, atomic
= !cb
;
328 unsigned long gpa
= 0, vaddr
= 0;
331 * NOTE: The GRU contains magic hardware that eliminates races between
332 * TLB invalidates and TLB dropins. If an invalidate occurs
333 * in the window between reading the TFH and the subsequent TLB dropin,
334 * the dropin is ignored. This eliminates the need for additional locks.
338 * Error if TFH state is IDLE or FMM mode & the user issuing a UPM call.
339 * Might be a hardware race OR a stupid user. Ignore FMM because FMM
340 * is a transient state.
342 if (tfh
->status
!= TFHSTATUS_EXCEPTION
) {
343 gru_flush_cache(tfh
);
344 if (tfh
->status
!= TFHSTATUS_EXCEPTION
)
345 goto failnoexception
;
346 STAT(tfh_stale_on_fault
);
348 if (tfh
->state
== TFHSTATE_IDLE
)
350 if (tfh
->state
== TFHSTATE_MISS_FMM
&& cb
)
353 write
= (tfh
->cause
& TFHCAUSE_TLB_MOD
) != 0;
354 vaddr
= tfh
->missvaddr
;
355 asid
= tfh
->missasid
;
359 rmb(); /* TFH must be cache resident before reading ms_range_active */
362 * TFH is cache resident - at least briefly. Fail the dropin
363 * if a range invalidate is active.
365 if (atomic_read(>s
->ts_gms
->ms_range_active
))
368 ret
= gru_vtop(gts
, vaddr
, write
, atomic
, &gpa
, &pageshift
);
374 if (!(gts
->ts_sizeavail
& GRU_SIZEAVAIL(pageshift
))) {
375 gts
->ts_sizeavail
|= GRU_SIZEAVAIL(pageshift
);
376 if (atomic
|| !gru_update_cch(gts
, 0)) {
377 gts
->ts_force_cch_reload
= 1;
381 gru_cb_set_istatus_active(cb
);
382 tfh_write_restart(tfh
, gpa
, GAA_RAM
, vaddr
, asid
, write
,
383 GRU_PAGESIZE(pageshift
));
386 "%s: tfh 0x%p, vaddr 0x%lx, asid 0x%x, ps %d, gpa 0x%lx\n",
387 ret
? "non-atomic" : "atomic", tfh
, vaddr
, asid
,
392 /* No asid (delayed unload). */
393 STAT(tlb_dropin_fail_no_asid
);
394 gru_dbg(grudev
, "FAILED no_asid tfh: 0x%p, vaddr 0x%lx\n", tfh
, vaddr
);
396 tfh_user_polling_mode(tfh
);
398 gru_flush_cache(tfh
);
402 /* Atomic failure switch CBR to UPM */
403 tfh_user_polling_mode(tfh
);
404 STAT(tlb_dropin_fail_upm
);
405 gru_dbg(grudev
, "FAILED upm tfh: 0x%p, vaddr 0x%lx\n", tfh
, vaddr
);
409 /* FMM state on UPM call */
410 gru_flush_cache(tfh
);
411 STAT(tlb_dropin_fail_fmm
);
412 gru_dbg(grudev
, "FAILED fmm tfh: 0x%p, state %d\n", tfh
, tfh
->state
);
416 /* TFH status did not show exception pending */
417 gru_flush_cache(tfh
);
420 STAT(tlb_dropin_fail_no_exception
);
421 gru_dbg(grudev
, "FAILED non-exception tfh: 0x%p, status %d, state %d\n", tfh
, tfh
->status
, tfh
->state
);
425 /* TFH state was idle - no miss pending */
426 gru_flush_cache(tfh
);
429 STAT(tlb_dropin_fail_idle
);
430 gru_dbg(grudev
, "FAILED idle tfh: 0x%p, state %d\n", tfh
, tfh
->state
);
434 /* All errors (atomic & non-atomic) switch CBR to EXCEPTION state */
436 STAT(tlb_dropin_fail_invalid
);
437 gru_dbg(grudev
, "FAILED inval tfh: 0x%p, vaddr 0x%lx\n", tfh
, vaddr
);
441 /* Range invalidate active. Switch to UPM iff atomic */
443 tfh_user_polling_mode(tfh
);
445 gru_flush_cache(tfh
);
446 STAT(tlb_dropin_fail_range_active
);
447 gru_dbg(grudev
, "FAILED range active: tfh 0x%p, vaddr 0x%lx\n",
453 * Process an external interrupt from the GRU. This interrupt is
454 * caused by a TLB miss.
455 * Note that this is the interrupt handler that is registered with linux
456 * interrupt handlers.
458 irqreturn_t
gru_intr(int irq
, void *dev_id
)
460 struct gru_state
*gru
;
461 struct gru_tlb_fault_map imap
, dmap
;
462 struct gru_thread_state
*gts
;
463 struct gru_tlb_fault_handle
*tfh
= NULL
;
468 gru
= irq_to_gru(irq
);
470 dev_err(grudev
, "GRU: invalid interrupt: cpu %d, irq %d\n",
471 raw_smp_processor_id(), irq
);
474 get_clear_fault_map(gru
, &imap
, &dmap
);
476 for_each_cbr_in_tfm(cbrnum
, dmap
.fault_bits
) {
477 complete(gru
->gs_blade
->bs_async_wq
);
478 gru_dbg(grudev
, "gid %d, cbr_done %d, done %d\n",
479 gru
->gs_gid
, cbrnum
, gru
->gs_blade
->bs_async_wq
->done
);
482 for_each_cbr_in_tfm(cbrnum
, imap
.fault_bits
) {
483 tfh
= get_tfh_by_index(gru
, cbrnum
);
484 prefetchw(tfh
); /* Helps on hdw, required for emulator */
487 * When hardware sets a bit in the faultmap, it implicitly
488 * locks the GRU context so that it cannot be unloaded.
489 * The gts cannot change until a TFH start/writestart command
492 ctxnum
= tfh
->ctxnum
;
493 gts
= gru
->gs_gts
[ctxnum
];
496 * This is running in interrupt context. Trylock the mmap_sem.
497 * If it fails, retry the fault in user context.
499 if (!gts
->ts_force_cch_reload
&&
500 down_read_trylock(>s
->ts_mm
->mmap_sem
)) {
501 gts
->ustats
.fmm_tlbdropin
++;
502 gru_try_dropin(gts
, tfh
, NULL
);
503 up_read(>s
->ts_mm
->mmap_sem
);
505 tfh_user_polling_mode(tfh
);
506 STAT(intr_mm_lock_failed
);
513 static int gru_user_dropin(struct gru_thread_state
*gts
,
514 struct gru_tlb_fault_handle
*tfh
,
515 unsigned long __user
*cb
)
517 struct gru_mm_struct
*gms
= gts
->ts_gms
;
520 gts
->ustats
.upm_tlbdropin
++;
522 wait_event(gms
->ms_wait_queue
,
523 atomic_read(&gms
->ms_range_active
) == 0);
524 prefetchw(tfh
); /* Helps on hdw, required for emulator */
525 ret
= gru_try_dropin(gts
, tfh
, cb
);
528 STAT(call_os_wait_queue
);
533 * This interface is called as a result of a user detecting a "call OS" bit
534 * in a user CB. Normally means that a TLB fault has occurred.
535 * cb - user virtual address of the CB
537 int gru_handle_user_call_os(unsigned long cb
)
539 struct gru_tlb_fault_handle
*tfh
;
540 struct gru_thread_state
*gts
;
541 unsigned long __user
*cbp
;
542 int ucbnum
, cbrnum
, ret
= -EINVAL
;
545 gru_dbg(grudev
, "address 0x%lx\n", cb
);
547 /* sanity check the cb pointer */
548 ucbnum
= get_cb_number((void *)cb
);
549 if ((cb
& (GRU_HANDLE_STRIDE
- 1)) || ucbnum
>= GRU_NUM_CB
)
551 cbp
= (unsigned long *)cb
;
553 gts
= gru_find_lock_gts(cb
);
557 if (ucbnum
>= gts
->ts_cbr_au_count
* GRU_CBR_AU_SIZE
)
561 * If force_unload is set, the UPM TLB fault is phony. The task
562 * has migrated to another node and the GSEG must be moved. Just
563 * unload the context. The task will page fault and assign a new
566 if (gts
->ts_tgid_owner
== current
->tgid
&& gts
->ts_blade
>= 0 &&
567 gts
->ts_blade
!= uv_numa_blade_id()) {
568 STAT(call_os_offnode_reference
);
569 gts
->ts_force_unload
= 1;
573 * CCH may contain stale data if ts_force_cch_reload is set.
575 if (gts
->ts_gru
&& gts
->ts_force_cch_reload
) {
576 gts
->ts_force_cch_reload
= 0;
577 gru_update_cch(gts
, 0);
581 cbrnum
= thread_cbr_number(gts
, ucbnum
);
582 if (gts
->ts_force_unload
) {
583 gru_unload_context(gts
, 1);
584 } else if (gts
->ts_gru
) {
585 tfh
= get_tfh_by_index(gts
->ts_gru
, cbrnum
);
586 ret
= gru_user_dropin(gts
, tfh
, cbp
);
594 * Fetch the exception detail information for a CB that terminated with
597 int gru_get_exception_detail(unsigned long arg
)
599 struct control_block_extended_exc_detail excdet
;
600 struct gru_control_block_extended
*cbe
;
601 struct gru_thread_state
*gts
;
602 int ucbnum
, cbrnum
, ret
;
604 STAT(user_exception
);
605 if (copy_from_user(&excdet
, (void __user
*)arg
, sizeof(excdet
)))
608 gru_dbg(grudev
, "address 0x%lx\n", excdet
.cb
);
609 gts
= gru_find_lock_gts(excdet
.cb
);
613 ucbnum
= get_cb_number((void *)excdet
.cb
);
614 if (ucbnum
>= gts
->ts_cbr_au_count
* GRU_CBR_AU_SIZE
) {
616 } else if (gts
->ts_gru
) {
617 cbrnum
= thread_cbr_number(gts
, ucbnum
);
618 cbe
= get_cbe_by_index(gts
->ts_gru
, cbrnum
);
619 gru_flush_cache(cbe
); /* CBE not coherent */
620 excdet
.opc
= cbe
->opccpy
;
621 excdet
.exopc
= cbe
->exopccpy
;
622 excdet
.ecause
= cbe
->ecause
;
623 excdet
.exceptdet0
= cbe
->idef1upd
;
624 excdet
.exceptdet1
= cbe
->idef3upd
;
625 excdet
.cbrstate
= cbe
->cbrstate
;
626 excdet
.cbrexecstatus
= cbe
->cbrexecstatus
;
627 gru_flush_cache(cbe
);
635 "cb 0x%lx, op %d, exopc %d, cbrstate %d, cbrexecstatus 0x%x, ecause 0x%x, "
636 "exdet0 0x%lx, exdet1 0x%x\n",
637 excdet
.cb
, excdet
.opc
, excdet
.exopc
, excdet
.cbrstate
, excdet
.cbrexecstatus
,
638 excdet
.ecause
, excdet
.exceptdet0
, excdet
.exceptdet1
);
639 if (!ret
&& copy_to_user((void __user
*)arg
, &excdet
, sizeof(excdet
)))
645 * User request to unload a context. Content is saved for possible reload.
647 static int gru_unload_all_contexts(void)
649 struct gru_thread_state
*gts
;
650 struct gru_state
*gru
;
653 if (!capable(CAP_SYS_ADMIN
))
656 gru
= GID_TO_GRU(gid
);
657 spin_lock(&gru
->gs_lock
);
658 for (ctxnum
= 0; ctxnum
< GRU_NUM_CCH
; ctxnum
++) {
659 gts
= gru
->gs_gts
[ctxnum
];
660 if (gts
&& mutex_trylock(>s
->ts_ctxlock
)) {
661 spin_unlock(&gru
->gs_lock
);
662 gru_unload_context(gts
, 1);
663 mutex_unlock(>s
->ts_ctxlock
);
664 spin_lock(&gru
->gs_lock
);
667 spin_unlock(&gru
->gs_lock
);
672 int gru_user_unload_context(unsigned long arg
)
674 struct gru_thread_state
*gts
;
675 struct gru_unload_context_req req
;
677 STAT(user_unload_context
);
678 if (copy_from_user(&req
, (void __user
*)arg
, sizeof(req
)))
681 gru_dbg(grudev
, "gseg 0x%lx\n", req
.gseg
);
684 return gru_unload_all_contexts();
686 gts
= gru_find_lock_gts(req
.gseg
);
691 gru_unload_context(gts
, 1);
698 * User request to flush a range of virtual addresses from the GRU TLB
699 * (Mainly for testing).
701 int gru_user_flush_tlb(unsigned long arg
)
703 struct gru_thread_state
*gts
;
704 struct gru_flush_tlb_req req
;
705 struct gru_mm_struct
*gms
;
707 STAT(user_flush_tlb
);
708 if (copy_from_user(&req
, (void __user
*)arg
, sizeof(req
)))
711 gru_dbg(grudev
, "gseg 0x%lx, vaddr 0x%lx, len 0x%lx\n", req
.gseg
,
714 gts
= gru_find_lock_gts(req
.gseg
);
720 gru_flush_tlb_range(gms
, req
.vaddr
, req
.len
);
726 * Fetch GSEG statisticss
728 long gru_get_gseg_statistics(unsigned long arg
)
730 struct gru_thread_state
*gts
;
731 struct gru_get_gseg_statistics_req req
;
733 if (copy_from_user(&req
, (void __user
*)arg
, sizeof(req
)))
736 gts
= gru_find_lock_gts(req
.gseg
);
738 memcpy(&req
.stats
, >s
->ustats
, sizeof(gts
->ustats
));
741 memset(&req
.stats
, 0, sizeof(gts
->ustats
));
744 if (copy_to_user((void __user
*)arg
, &req
, sizeof(req
)))
751 * Register the current task as the user of the GSEG slice.
752 * Needed for TLB fault interrupt targeting.
754 int gru_set_context_option(unsigned long arg
)
756 struct gru_thread_state
*gts
;
757 struct gru_set_context_option_req req
;
760 STAT(set_context_option
);
761 if (copy_from_user(&req
, (void __user
*)arg
, sizeof(req
)))
763 gru_dbg(grudev
, "op %d, gseg 0x%lx, value1 0x%lx\n", req
.op
, req
.gseg
, req
.val1
);
765 gts
= gru_alloc_locked_gts(req
.gseg
);
771 /* Register the current task as the GSEG owner */
772 gts
->ts_tgid_owner
= current
->tgid
;
774 case sco_cch_req_slice
:
775 /* Set the CCH slice option */
776 gts
->ts_cch_req_slice
= req
.val1
& 3;