1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * This file contains the routines for handling the MMU on those
4 * PowerPC implementations where the MMU is not using the hash
5 * table, such as 8xx, 4xx, BookE's etc...
6 *
7 * Copyright 2008 Ben Herrenschmidt <benh@kernel.crashing.org>
8 * IBM Corp.
9 *
10 * Derived from previous arch/powerpc/mm/mmu_context.c
11 * and arch/powerpc/include/asm/mmu_context.h
12 *
13 * TODO:
14 *
15 * - The global context lock will not scale very well
16 * - The maps should be dynamically allocated to allow for processors
17 * that support more PID bits at runtime
18 * - Implement flush_tlb_mm() by making the context stale and picking
19 * a new one
20 * - More aggressively clear stale map bits and maybe find some way to
21 * also clear mm->cpu_vm_mask bits when processes are migrated
22 */
23
24 #include <linux/kernel.h>
25 #include <linux/mm.h>
26 #include <linux/init.h>
27 #include <linux/spinlock.h>
28 #include <linux/memblock.h>
29 #include <linux/notifier.h>
30 #include <linux/cpu.h>
31 #include <linux/slab.h>
32
33 #include <asm/mmu_context.h>
34 #include <asm/tlbflush.h>
35 #include <asm/smp.h>
36 #include <asm/kup.h>
37
38 #include <mm/mmu_decl.h>
39
40 /*
41 * Room for two PTE table pointers, usually the kernel and current user
42 * pointer to their respective root page table (pgdir).
43 */
44 void *abatron_pteptrs[2];
45
46 /*
47 * The MPC8xx has only 16 contexts. We rotate through them on each task switch.
48 * A better way would be to keep track of tasks that own contexts, and implement
49 * an LRU usage. That way very active tasks don't always have to pay the TLB
50 * reload overhead. The kernel pages are mapped shared, so the kernel can run on
51 * behalf of any task that makes a kernel entry. Shared does not mean they are
52 * not protected, just that the ASID comparison is not performed. -- Dan
53 *
54 * The IBM4xx has 256 contexts, so we can just rotate through these as a way of
55 * "switching" contexts. If the TID of the TLB is zero, the PID/TID comparison
56 * is disabled, so we can use a TID of zero to represent all kernel pages as
57 * shared among all contexts. -- Dan
58 *
59 * The IBM 47x core supports 16-bit PIDs, thus 65535 contexts. We should
60 * normally never have to steal though the facility is present if needed.
61 * -- BenH
62 */
63 #define FIRST_CONTEXT 1
64 #if defined(CONFIG_PPC_8xx)
65 #define LAST_CONTEXT 16
66 #elif defined(CONFIG_PPC_47x)
67 #define LAST_CONTEXT 65535
68 #else
69 #define LAST_CONTEXT 255
70 #endif
71
72 static unsigned int next_context, nr_free_contexts;
73 static unsigned long *context_map;
74 static unsigned long *stale_map[NR_CPUS];
75 static struct mm_struct **context_mm;
76 static DEFINE_RAW_SPINLOCK(context_lock);
77
78 #define CTX_MAP_SIZE \
79 (sizeof(unsigned long) * (LAST_CONTEXT / BITS_PER_LONG + 1))
80
81
82 /* Steal a context from a task that has one at the moment.
83 *
84 * This is used when we are running out of available PID numbers
85 * on the processors.
86 *
87 * This isn't an LRU system, it just frees up each context in
88 * turn (sort-of pseudo-random replacement :). This would be the
89 * place to implement an LRU scheme if anyone was motivated to do it.
90 * -- paulus
91 *
92 * For context stealing, we use a slightly different approach for
93 * SMP and UP. Basically, the UP one is simpler and doesn't use
94 * the stale map as we can just flush the local CPU
95 * -- benh
96 */
steal_context_smp(unsigned int id)97 static unsigned int steal_context_smp(unsigned int id)
98 {
99 struct mm_struct *mm;
100 unsigned int cpu, max, i;
101
102 max = LAST_CONTEXT - FIRST_CONTEXT;
103
104 /* Attempt to free next_context first and then loop until we manage */
105 while (max--) {
106 /* Pick up the victim mm */
107 mm = context_mm[id];
108
109 /* We have a candidate victim, check if it's active, on SMP
110 * we cannot steal active contexts
111 */
112 if (mm->context.active) {
113 id++;
114 if (id > LAST_CONTEXT)
115 id = FIRST_CONTEXT;
116 continue;
117 }
118
119 /* Mark this mm has having no context anymore */
120 mm->context.id = MMU_NO_CONTEXT;
121
122 /* Mark it stale on all CPUs that used this mm. For threaded
123 * implementations, we set it on all threads on each core
124 * represented in the mask. A future implementation will use
125 * a core map instead but this will do for now.
126 */
127 for_each_cpu(cpu, mm_cpumask(mm)) {
128 for (i = cpu_first_thread_sibling(cpu);
129 i <= cpu_last_thread_sibling(cpu); i++) {
130 if (stale_map[i])
131 __set_bit(id, stale_map[i]);
132 }
133 cpu = i - 1;
134 }
135 return id;
136 }
137
138 /* This will happen if you have more CPUs than available contexts,
139 * all we can do here is wait a bit and try again
140 */
141 raw_spin_unlock(&context_lock);
142 cpu_relax();
143 raw_spin_lock(&context_lock);
144
145 /* This will cause the caller to try again */
146 return MMU_NO_CONTEXT;
147 }
148
steal_all_contexts(void)149 static unsigned int steal_all_contexts(void)
150 {
151 struct mm_struct *mm;
152 int cpu = smp_processor_id();
153 unsigned int id;
154
155 for (id = FIRST_CONTEXT; id <= LAST_CONTEXT; id++) {
156 /* Pick up the victim mm */
157 mm = context_mm[id];
158
159 /* Mark this mm as having no context anymore */
160 mm->context.id = MMU_NO_CONTEXT;
161 if (id != FIRST_CONTEXT) {
162 context_mm[id] = NULL;
163 __clear_bit(id, context_map);
164 }
165 if (IS_ENABLED(CONFIG_SMP))
166 __clear_bit(id, stale_map[cpu]);
167 }
168
169 /* Flush the TLB for all contexts (not to be used on SMP) */
170 _tlbil_all();
171
172 nr_free_contexts = LAST_CONTEXT - FIRST_CONTEXT;
173
174 return FIRST_CONTEXT;
175 }
176
177 /* Note that this will also be called on SMP if all other CPUs are
178 * offlined, which means that it may be called for cpu != 0. For
179 * this to work, we somewhat assume that CPUs that are onlined
180 * come up with a fully clean TLB (or are cleaned when offlined)
181 */
steal_context_up(unsigned int id)182 static unsigned int steal_context_up(unsigned int id)
183 {
184 struct mm_struct *mm;
185 int cpu = smp_processor_id();
186
187 /* Pick up the victim mm */
188 mm = context_mm[id];
189
190 /* Flush the TLB for that context */
191 local_flush_tlb_mm(mm);
192
193 /* Mark this mm has having no context anymore */
194 mm->context.id = MMU_NO_CONTEXT;
195
196 /* XXX This clear should ultimately be part of local_flush_tlb_mm */
197 if (IS_ENABLED(CONFIG_SMP))
198 __clear_bit(id, stale_map[cpu]);
199
200 return id;
201 }
202
set_context(unsigned long id,pgd_t * pgd)203 static void set_context(unsigned long id, pgd_t *pgd)
204 {
205 if (IS_ENABLED(CONFIG_PPC_8xx)) {
206 s16 offset = (s16)(__pa(swapper_pg_dir));
207
208 /*
209 * Register M_TWB will contain base address of level 1 table minus the
210 * lower part of the kernel PGDIR base address, so that all accesses to
211 * level 1 table are done relative to lower part of kernel PGDIR base
212 * address.
213 */
214 mtspr(SPRN_M_TWB, __pa(pgd) - offset);
215
216 /* Update context */
217 mtspr(SPRN_M_CASID, id - 1);
218
219 /* sync */
220 mb();
221 } else if (kuap_is_disabled()) {
222 if (IS_ENABLED(CONFIG_40x))
223 mb(); /* sync */
224
225 mtspr(SPRN_PID, id);
226 isync();
227 }
228 }
229
switch_mmu_context(struct mm_struct * prev,struct mm_struct * next,struct task_struct * tsk)230 void switch_mmu_context(struct mm_struct *prev, struct mm_struct *next,
231 struct task_struct *tsk)
232 {
233 unsigned int id;
234 unsigned int i, cpu = smp_processor_id();
235 unsigned long *map;
236
237 /* No lockless fast path .. yet */
238 raw_spin_lock(&context_lock);
239
240 if (IS_ENABLED(CONFIG_SMP)) {
241 /* Mark us active and the previous one not anymore */
242 next->context.active++;
243 if (prev) {
244 WARN_ON(prev->context.active < 1);
245 prev->context.active--;
246 }
247 }
248
249 again:
250
251 /* If we already have a valid assigned context, skip all that */
252 id = next->context.id;
253 if (likely(id != MMU_NO_CONTEXT))
254 goto ctxt_ok;
255
256 /* We really don't have a context, let's try to acquire one */
257 id = next_context;
258 if (id > LAST_CONTEXT)
259 id = FIRST_CONTEXT;
260 map = context_map;
261
262 /* No more free contexts, let's try to steal one */
263 if (nr_free_contexts == 0) {
264 if (num_online_cpus() > 1) {
265 id = steal_context_smp(id);
266 if (id == MMU_NO_CONTEXT)
267 goto again;
268 goto stolen;
269 }
270 if (IS_ENABLED(CONFIG_PPC_8xx))
271 id = steal_all_contexts();
272 else
273 id = steal_context_up(id);
274 goto stolen;
275 }
276 nr_free_contexts--;
277
278 /* We know there's at least one free context, try to find it */
279 while (__test_and_set_bit(id, map)) {
280 id = find_next_zero_bit(map, LAST_CONTEXT+1, id);
281 if (id > LAST_CONTEXT)
282 id = FIRST_CONTEXT;
283 }
284 stolen:
285 next_context = id + 1;
286 context_mm[id] = next;
287 next->context.id = id;
288
289 ctxt_ok:
290
291 /* If that context got marked stale on this CPU, then flush the
292 * local TLB for it and unmark it before we use it
293 */
294 if (IS_ENABLED(CONFIG_SMP) && test_bit(id, stale_map[cpu])) {
295 local_flush_tlb_mm(next);
296
297 /* XXX This clear should ultimately be part of local_flush_tlb_mm */
298 for (i = cpu_first_thread_sibling(cpu);
299 i <= cpu_last_thread_sibling(cpu); i++) {
300 if (stale_map[i])
301 __clear_bit(id, stale_map[i]);
302 }
303 }
304
305 /* Flick the MMU and release lock */
306 if (IS_ENABLED(CONFIG_BDI_SWITCH))
307 abatron_pteptrs[1] = next->pgd;
308 set_context(id, next->pgd);
309 #if defined(CONFIG_BOOKE_OR_40x) && defined(CONFIG_PPC_KUAP)
310 tsk->thread.pid = id;
311 #endif
312 raw_spin_unlock(&context_lock);
313 }
314
315 /*
316 * Set up the context for a new address space.
317 */
init_new_context(struct task_struct * t,struct mm_struct * mm)318 int init_new_context(struct task_struct *t, struct mm_struct *mm)
319 {
320 mm->context.id = MMU_NO_CONTEXT;
321 mm->context.active = 0;
322 pte_frag_set(&mm->context, NULL);
323 return 0;
324 }
325
326 /*
327 * We're finished using the context for an address space.
328 */
destroy_context(struct mm_struct * mm)329 void destroy_context(struct mm_struct *mm)
330 {
331 unsigned long flags;
332 unsigned int id;
333
334 if (mm->context.id == MMU_NO_CONTEXT)
335 return;
336
337 WARN_ON(mm->context.active != 0);
338
339 raw_spin_lock_irqsave(&context_lock, flags);
340 id = mm->context.id;
341 if (id != MMU_NO_CONTEXT) {
342 __clear_bit(id, context_map);
343 mm->context.id = MMU_NO_CONTEXT;
344 context_mm[id] = NULL;
345 nr_free_contexts++;
346 }
347 raw_spin_unlock_irqrestore(&context_lock, flags);
348 }
349
mmu_ctx_cpu_prepare(unsigned int cpu)350 static int mmu_ctx_cpu_prepare(unsigned int cpu)
351 {
352 /* We don't touch CPU 0 map, it's allocated at aboot and kept
353 * around forever
354 */
355 if (cpu == boot_cpuid)
356 return 0;
357
358 stale_map[cpu] = kzalloc(CTX_MAP_SIZE, GFP_KERNEL);
359 return 0;
360 }
361
mmu_ctx_cpu_dead(unsigned int cpu)362 static int mmu_ctx_cpu_dead(unsigned int cpu)
363 {
364 #ifdef CONFIG_HOTPLUG_CPU
365 if (cpu == boot_cpuid)
366 return 0;
367
368 kfree(stale_map[cpu]);
369 stale_map[cpu] = NULL;
370
371 /* We also clear the cpu_vm_mask bits of CPUs going away */
372 clear_tasks_mm_cpumask(cpu);
373 #endif
374 return 0;
375 }
376
377 /*
378 * Initialize the context management stuff.
379 */
mmu_context_init(void)380 void __init mmu_context_init(void)
381 {
382 /* Mark init_mm as being active on all possible CPUs since
383 * we'll get called with prev == init_mm the first time
384 * we schedule on a given CPU
385 */
386 init_mm.context.active = NR_CPUS;
387
388 /*
389 * Allocate the maps used by context management
390 */
391 context_map = memblock_alloc(CTX_MAP_SIZE, SMP_CACHE_BYTES);
392 if (!context_map)
393 panic("%s: Failed to allocate %zu bytes\n", __func__,
394 CTX_MAP_SIZE);
395 context_mm = memblock_alloc(sizeof(void *) * (LAST_CONTEXT + 1),
396 SMP_CACHE_BYTES);
397 if (!context_mm)
398 panic("%s: Failed to allocate %zu bytes\n", __func__,
399 sizeof(void *) * (LAST_CONTEXT + 1));
400 if (IS_ENABLED(CONFIG_SMP)) {
401 stale_map[boot_cpuid] = memblock_alloc(CTX_MAP_SIZE, SMP_CACHE_BYTES);
402 if (!stale_map[boot_cpuid])
403 panic("%s: Failed to allocate %zu bytes\n", __func__,
404 CTX_MAP_SIZE);
405
406 cpuhp_setup_state_nocalls(CPUHP_POWERPC_MMU_CTX_PREPARE,
407 "powerpc/mmu/ctx:prepare",
408 mmu_ctx_cpu_prepare, mmu_ctx_cpu_dead);
409 }
410
411 printk(KERN_INFO
412 "MMU: Allocated %zu bytes of context maps for %d contexts\n",
413 2 * CTX_MAP_SIZE + (sizeof(void *) * (LAST_CONTEXT + 1)),
414 LAST_CONTEXT - FIRST_CONTEXT + 1);
415
416 /*
417 * Some processors have too few contexts to reserve one for
418 * init_mm, and require using context 0 for a normal task.
419 * Other processors reserve the use of context zero for the kernel.
420 * This code assumes FIRST_CONTEXT < 32.
421 */
422 context_map[0] = (1 << FIRST_CONTEXT) - 1;
423 next_context = FIRST_CONTEXT;
424 nr_free_contexts = LAST_CONTEXT - FIRST_CONTEXT + 1;
425 }
426