1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 /* 25 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 26 * Copyright 2016 Gary Mills 27 * Copyright 2019 Joyent, Inc. 28 */ 29 30 /* 31 * VM - Hardware Address Translation management for Spitfire MMU. 32 * 33 * This file implements the machine specific hardware translation 34 * needed by the VM system. The machine independent interface is 35 * described in <vm/hat.h> while the machine dependent interface 36 * and data structures are described in <vm/hat_sfmmu.h>. 37 * 38 * The hat layer manages the address translation hardware as a cache 39 * driven by calls from the higher levels in the VM system. 40 */ 41 42 #include <sys/types.h> 43 #include <sys/kstat.h> 44 #include <vm/hat.h> 45 #include <vm/hat_sfmmu.h> 46 #include <vm/page.h> 47 #include <sys/pte.h> 48 #include <sys/systm.h> 49 #include <sys/mman.h> 50 #include <sys/sysmacros.h> 51 #include <sys/machparam.h> 52 #include <sys/vtrace.h> 53 #include <sys/kmem.h> 54 #include <sys/mmu.h> 55 #include <sys/cmn_err.h> 56 #include <sys/cpu.h> 57 #include <sys/cpuvar.h> 58 #include <sys/debug.h> 59 #include <sys/lgrp.h> 60 #include <sys/archsystm.h> 61 #include <sys/machsystm.h> 62 #include <sys/vmsystm.h> 63 #include <vm/as.h> 64 #include <vm/seg.h> 65 #include <vm/seg_kp.h> 66 #include <vm/seg_kmem.h> 67 #include <vm/seg_kpm.h> 68 #include <vm/rm.h> 69 #include <sys/t_lock.h> 70 #include <sys/obpdefs.h> 71 #include <sys/vm_machparam.h> 72 #include <sys/var.h> 73 #include <sys/trap.h> 74 #include <sys/machtrap.h> 75 #include <sys/scb.h> 76 #include <sys/bitmap.h> 77 #include <sys/machlock.h> 78 #include <sys/membar.h> 79 #include <sys/atomic.h> 80 #include <sys/cpu_module.h> 81 #include <sys/prom_debug.h> 82 #include <sys/ksynch.h> 83 #include <sys/mem_config.h> 84 #include <sys/mem_cage.h> 85 #include <vm/vm_dep.h> 86 #include <sys/fpu/fpusystm.h> 87 #include <vm/mach_kpm.h> 88 #include <sys/callb.h> 89 90 #ifdef DEBUG 91 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len) \ 92 if (SFMMU_IS_SHMERID_VALID(rid)) { \ 93 caddr_t _eaddr = (saddr) + (len); \ 94 sf_srd_t *_srdp; \ 95 sf_region_t *_rgnp; \ 96 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \ 97 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid)); \ 98 ASSERT((hat) != ksfmmup); \ 99 _srdp = (hat)->sfmmu_srdp; \ 100 ASSERT(_srdp != NULL); \ 101 ASSERT(_srdp->srd_refcnt != 0); \ 102 _rgnp = _srdp->srd_hmergnp[(rid)]; \ 103 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid); \ 104 ASSERT(_rgnp->rgn_refcnt != 0); \ 105 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \ 106 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == \ 107 SFMMU_REGION_HME); \ 108 ASSERT((saddr) >= _rgnp->rgn_saddr); \ 109 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size); \ 110 ASSERT(_eaddr > _rgnp->rgn_saddr); \ 111 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size); \ 112 } 113 114 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) \ 115 { \ 116 caddr_t _hsva; \ 117 caddr_t _heva; \ 118 caddr_t _rsva; \ 119 caddr_t _reva; \ 120 int _ttesz = get_hblk_ttesz(hmeblkp); \ 121 int _flagtte; \ 122 ASSERT((srdp)->srd_refcnt != 0); \ 123 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \ 124 ASSERT((rgnp)->rgn_id == rid); \ 125 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE)); \ 126 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) == \ 127 SFMMU_REGION_HME); \ 128 ASSERT(_ttesz <= (rgnp)->rgn_pgszc); \ 129 _hsva = (caddr_t)get_hblk_base(hmeblkp); \ 130 _heva = get_hblk_endaddr(hmeblkp); \ 131 _rsva = (caddr_t)P2ALIGN( \ 132 (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES); \ 133 _reva = (caddr_t)P2ROUNDUP( \ 134 (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size), \ 135 HBLK_MIN_BYTES); \ 136 ASSERT(_hsva >= _rsva); \ 137 ASSERT(_hsva < _reva); \ 138 ASSERT(_heva > _rsva); \ 139 ASSERT(_heva <= _reva); \ 140 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : \ 141 _ttesz; \ 142 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte)); \ 143 } 144 145 #else /* DEBUG */ 146 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len) 147 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) 148 #endif /* DEBUG */ 149 150 #if defined(SF_ERRATA_57) 151 extern caddr_t errata57_limit; 152 #endif 153 154 #define HME8BLK_SZ_RND ((roundup(HME8BLK_SZ, sizeof (int64_t))) / \ 155 (sizeof (int64_t))) 156 #define HBLK_RESERVE ((struct hme_blk *)hblk_reserve) 157 158 #define HBLK_RESERVE_CNT 128 159 #define HBLK_RESERVE_MIN 20 160 161 static struct hme_blk *freehblkp; 162 static kmutex_t freehblkp_lock; 163 static int freehblkcnt; 164 165 static int64_t hblk_reserve[HME8BLK_SZ_RND]; 166 static kmutex_t hblk_reserve_lock; 167 static kthread_t *hblk_reserve_thread; 168 169 static nucleus_hblk8_info_t nucleus_hblk8; 170 static nucleus_hblk1_info_t nucleus_hblk1; 171 172 /* 173 * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here 174 * after the initial phase of removing an hmeblk from the hash chain, see 175 * the detailed comment in sfmmu_hblk_hash_rm() for further details. 176 */ 177 static cpu_hme_pend_t *cpu_hme_pend; 178 static uint_t cpu_hme_pend_thresh; 179 /* 180 * SFMMU specific hat functions 181 */ 182 void hat_pagecachectl(struct page *, int); 183 184 /* flags for hat_pagecachectl */ 185 #define HAT_CACHE 0x1 186 #define HAT_UNCACHE 0x2 187 #define HAT_TMPNC 0x4 188 189 /* 190 * Flag to allow the creation of non-cacheable translations 191 * to system memory. It is off by default. At the moment this 192 * flag is used by the ecache error injector. The error injector 193 * will turn it on when creating such a translation then shut it 194 * off when it's finished. 195 */ 196 197 int sfmmu_allow_nc_trans = 0; 198 199 /* 200 * Flag to disable large page support. 201 * value of 1 => disable all large pages. 202 * bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively. 203 * 204 * For example, use the value 0x4 to disable 512K pages. 205 * 206 */ 207 #define LARGE_PAGES_OFF 0x1 208 209 /* 210 * The disable_large_pages and disable_ism_large_pages variables control 211 * hat_memload_array and the page sizes to be used by ISM and the kernel. 212 * 213 * The disable_auto_data_large_pages and disable_auto_text_large_pages variables 214 * are only used to control which OOB pages to use at upper VM segment creation 215 * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines. 216 * Their values may come from platform or CPU specific code to disable page 217 * sizes that should not be used. 218 * 219 * WARNING: 512K pages are currently not supported for ISM/DISM. 220 */ 221 uint_t disable_large_pages = 0; 222 uint_t disable_ism_large_pages = (1 << TTE512K); 223 uint_t disable_auto_data_large_pages = 0; 224 uint_t disable_auto_text_large_pages = 0; 225 226 /* 227 * Private sfmmu data structures for hat management 228 */ 229 static struct kmem_cache *sfmmuid_cache; 230 static struct kmem_cache *mmuctxdom_cache; 231 232 /* 233 * Private sfmmu data structures for tsb management 234 */ 235 static struct kmem_cache *sfmmu_tsbinfo_cache; 236 static struct kmem_cache *sfmmu_tsb8k_cache; 237 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX]; 238 static vmem_t *kmem_bigtsb_arena; 239 static vmem_t *kmem_tsb_arena; 240 241 /* 242 * sfmmu static variables for hmeblk resource management. 243 */ 244 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */ 245 static struct kmem_cache *sfmmu8_cache; 246 static struct kmem_cache *sfmmu1_cache; 247 static struct kmem_cache *pa_hment_cache; 248 249 static kmutex_t ism_mlist_lock; /* mutex for ism mapping list */ 250 /* 251 * private data for ism 252 */ 253 static struct kmem_cache *ism_blk_cache; 254 static struct kmem_cache *ism_ment_cache; 255 #define ISMID_STARTADDR NULL 256 257 /* 258 * Region management data structures and function declarations. 259 */ 260 261 static void sfmmu_leave_srd(sfmmu_t *); 262 static int sfmmu_srdcache_constructor(void *, void *, int); 263 static void sfmmu_srdcache_destructor(void *, void *); 264 static int sfmmu_rgncache_constructor(void *, void *, int); 265 static void sfmmu_rgncache_destructor(void *, void *); 266 static int sfrgnmap_isnull(sf_region_map_t *); 267 static int sfhmergnmap_isnull(sf_hmeregion_map_t *); 268 static int sfmmu_scdcache_constructor(void *, void *, int); 269 static void sfmmu_scdcache_destructor(void *, void *); 270 static void sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t, 271 size_t, void *, u_offset_t); 272 273 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1; 274 static sf_srd_bucket_t *srd_buckets; 275 static struct kmem_cache *srd_cache; 276 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1; 277 static struct kmem_cache *region_cache; 278 static struct kmem_cache *scd_cache; 279 280 #ifdef sun4v 281 int use_bigtsb_arena = 1; 282 #else 283 int use_bigtsb_arena = 0; 284 #endif 285 286 /* External /etc/system tunable, for turning on&off the shctx support */ 287 int disable_shctx = 0; 288 /* Internal variable, set by MD if the HW supports shctx feature */ 289 int shctx_on = 0; 290 291 #ifdef DEBUG 292 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int); 293 #endif 294 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *); 295 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *); 296 297 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *); 298 static void sfmmu_find_scd(sfmmu_t *); 299 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *); 300 static void sfmmu_finish_join_scd(sfmmu_t *); 301 static void sfmmu_leave_scd(sfmmu_t *, uchar_t); 302 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *); 303 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *); 304 static void sfmmu_free_scd_tsbs(sfmmu_t *); 305 static void sfmmu_tsb_inv_ctx(sfmmu_t *); 306 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *); 307 static void sfmmu_ism_hatflags(sfmmu_t *, int); 308 static int sfmmu_srd_lock_held(sf_srd_t *); 309 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *); 310 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *); 311 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *); 312 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *); 313 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *); 314 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *); 315 316 /* 317 * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists, 318 * HAT flags, synchronizing TLB/TSB coherency, and context management. 319 * The lock is hashed on the sfmmup since the case where we need to lock 320 * all processes is rare but does occur (e.g. we need to unload a shared 321 * mapping from all processes using the mapping). We have a lot of buckets, 322 * and each slab of sfmmu_t's can use about a quarter of them, giving us 323 * a fairly good distribution without wasting too much space and overhead 324 * when we have to grab them all. 325 */ 326 #define SFMMU_NUM_LOCK 128 /* must be power of two */ 327 hatlock_t hat_lock[SFMMU_NUM_LOCK]; 328 329 /* 330 * Hash algorithm optimized for a small number of slabs. 331 * 7 is (highbit((sizeof sfmmu_t)) - 1) 332 * This hash algorithm is based upon the knowledge that sfmmu_t's come from a 333 * kmem_cache, and thus they will be sequential within that cache. In 334 * addition, each new slab will have a different "color" up to cache_maxcolor 335 * which will skew the hashing for each successive slab which is allocated. 336 * If the size of sfmmu_t changed to a larger size, this algorithm may need 337 * to be revisited. 338 */ 339 #define TSB_HASH_SHIFT_BITS (7) 340 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS) 341 342 #ifdef DEBUG 343 int tsb_hash_debug = 0; 344 #define TSB_HASH(sfmmup) \ 345 (tsb_hash_debug ? &hat_lock[0] : \ 346 &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]) 347 #else /* DEBUG */ 348 #define TSB_HASH(sfmmup) &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)] 349 #endif /* DEBUG */ 350 351 352 /* sfmmu_replace_tsb() return codes. */ 353 typedef enum tsb_replace_rc { 354 TSB_SUCCESS, 355 TSB_ALLOCFAIL, 356 TSB_LOSTRACE, 357 TSB_ALREADY_SWAPPED, 358 TSB_CANTGROW 359 } tsb_replace_rc_t; 360 361 /* 362 * Flags for TSB allocation routines. 363 */ 364 #define TSB_ALLOC 0x01 365 #define TSB_FORCEALLOC 0x02 366 #define TSB_GROW 0x04 367 #define TSB_SHRINK 0x08 368 #define TSB_SWAPIN 0x10 369 370 /* 371 * Support for HAT callbacks. 372 */ 373 #define SFMMU_MAX_RELOC_CALLBACKS 10 374 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS; 375 static id_t sfmmu_cb_nextid = 0; 376 static id_t sfmmu_tsb_cb_id; 377 struct sfmmu_callback *sfmmu_cb_table; 378 379 kmutex_t kpr_mutex; 380 kmutex_t kpr_suspendlock; 381 kthread_t *kreloc_thread; 382 383 /* 384 * Enable VA->PA translation sanity checking on DEBUG kernels. 385 * Disabled by default. This is incompatible with some 386 * drivers (error injector, RSM) so if it breaks you get 387 * to keep both pieces. 388 */ 389 int hat_check_vtop = 0; 390 391 /* 392 * Private sfmmu routines (prototypes) 393 */ 394 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t); 395 static struct hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t, 396 struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t, 397 uint_t); 398 static caddr_t sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t, 399 caddr_t, demap_range_t *, uint_t); 400 static caddr_t sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t, 401 caddr_t, int); 402 static void sfmmu_hblk_free(struct hme_blk **); 403 static void sfmmu_hblks_list_purge(struct hme_blk **, int); 404 static uint_t sfmmu_get_free_hblk(struct hme_blk **, uint_t); 405 static uint_t sfmmu_put_free_hblk(struct hme_blk *, uint_t); 406 static struct hme_blk *sfmmu_hblk_steal(int); 407 static int sfmmu_steal_this_hblk(struct hmehash_bucket *, 408 struct hme_blk *, uint64_t, struct hme_blk *); 409 static caddr_t sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t); 410 411 static void hat_do_memload_array(struct hat *, caddr_t, size_t, 412 struct page **, uint_t, uint_t, uint_t); 413 static void hat_do_memload(struct hat *, caddr_t, struct page *, 414 uint_t, uint_t, uint_t); 415 static void sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **, 416 uint_t, uint_t, pgcnt_t, uint_t); 417 void sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *, 418 uint_t); 419 static int sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **, 420 uint_t, uint_t); 421 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *, 422 caddr_t, int, uint_t); 423 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *, 424 struct hmehash_bucket *, caddr_t, uint_t, uint_t, 425 uint_t); 426 static int sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *, 427 caddr_t, page_t **, uint_t, uint_t); 428 static void sfmmu_tteload_release_hashbucket(struct hmehash_bucket *); 429 430 static int sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int); 431 static pfn_t sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *); 432 void sfmmu_memtte(tte_t *, pfn_t, uint_t, int); 433 #ifdef VAC 434 static void sfmmu_vac_conflict(struct hat *, caddr_t, page_t *); 435 static int sfmmu_vacconflict_array(caddr_t, page_t *, int *); 436 int tst_tnc(page_t *pp, pgcnt_t); 437 void conv_tnc(page_t *pp, int); 438 #endif 439 440 static void sfmmu_get_ctx(sfmmu_t *); 441 static void sfmmu_free_sfmmu(sfmmu_t *); 442 443 static void sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *); 444 static void sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int); 445 446 cpuset_t sfmmu_pageunload(page_t *, struct sf_hment *, int); 447 static void hat_pagereload(struct page *, struct page *); 448 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t); 449 #ifdef VAC 450 void sfmmu_page_cache_array(page_t *, int, int, pgcnt_t); 451 static void sfmmu_page_cache(page_t *, int, int, int); 452 #endif 453 454 cpuset_t sfmmu_rgntlb_demap(caddr_t, sf_region_t *, 455 struct hme_blk *, int); 456 static void sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *, 457 pfn_t, int, int, int, int); 458 static void sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *, 459 pfn_t, int); 460 static void sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int); 461 static void sfmmu_tlb_range_demap(demap_range_t *); 462 static void sfmmu_invalidate_ctx(sfmmu_t *); 463 static void sfmmu_sync_mmustate(sfmmu_t *); 464 465 static void sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t); 466 static int sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t, 467 sfmmu_t *); 468 static void sfmmu_tsb_free(struct tsb_info *); 469 static void sfmmu_tsbinfo_free(struct tsb_info *); 470 static int sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t, 471 sfmmu_t *); 472 static void sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *); 473 static void sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *); 474 static int sfmmu_select_tsb_szc(pgcnt_t); 475 static void sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int); 476 #define sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \ 477 sfmmu_mod_tsb(sfmmup, vaddr, tte, szc) 478 #define sfmmu_unload_tsb(sfmmup, vaddr, szc) \ 479 sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc) 480 static void sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *); 481 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t, 482 hatlock_t *, uint_t); 483 static void sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int); 484 485 #ifdef VAC 486 void sfmmu_cache_flush(pfn_t, int); 487 void sfmmu_cache_flushcolor(int, pfn_t); 488 #endif 489 static caddr_t sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t, 490 caddr_t, demap_range_t *, uint_t, int); 491 492 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *); 493 static uint_t sfmmu_ptov_attr(tte_t *); 494 static caddr_t sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t, 495 caddr_t, demap_range_t *, uint_t); 496 static uint_t sfmmu_vtop_prot(uint_t, uint_t *); 497 static int sfmmu_idcache_constructor(void *, void *, int); 498 static void sfmmu_idcache_destructor(void *, void *); 499 static int sfmmu_hblkcache_constructor(void *, void *, int); 500 static void sfmmu_hblkcache_destructor(void *, void *); 501 static void sfmmu_hblkcache_reclaim(void *); 502 static void sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *, 503 struct hmehash_bucket *); 504 static void sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *, 505 struct hme_blk *, struct hme_blk **, int); 506 static void sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *, 507 uint64_t); 508 static struct hme_blk *sfmmu_check_pending_hblks(int); 509 static void sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int); 510 static void sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int); 511 static void sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t, 512 int, caddr_t *); 513 static void sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *); 514 515 static void sfmmu_rm_large_mappings(page_t *, int); 516 517 static void hat_lock_init(void); 518 static void hat_kstat_init(void); 519 static int sfmmu_kstat_percpu_update(kstat_t *ksp, int rw); 520 static void sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *); 521 static int sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t); 522 static void sfmmu_check_page_sizes(sfmmu_t *, int); 523 int fnd_mapping_sz(page_t *); 524 static void iment_add(struct ism_ment *, struct hat *); 525 static void iment_sub(struct ism_ment *, struct hat *); 526 static pgcnt_t ism_tsb_entries(sfmmu_t *, int szc); 527 extern void sfmmu_setup_tsbinfo(sfmmu_t *); 528 extern void sfmmu_clear_utsbinfo(void); 529 530 static void sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t); 531 532 extern int vpm_enable; 533 534 /* kpm globals */ 535 #ifdef DEBUG 536 /* 537 * Enable trap level tsbmiss handling 538 */ 539 int kpm_tsbmtl = 1; 540 541 /* 542 * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the 543 * required TLB shootdowns in this case, so handle w/ care. Off by default. 544 */ 545 int kpm_tlb_flush; 546 #endif /* DEBUG */ 547 548 static void *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int); 549 550 #ifdef DEBUG 551 static void sfmmu_check_hblk_flist(); 552 #endif 553 554 /* 555 * Semi-private sfmmu data structures. Some of them are initialize in 556 * startup or in hat_init. Some of them are private but accessed by 557 * assembly code or mach_sfmmu.c 558 */ 559 struct hmehash_bucket *uhme_hash; /* user hmeblk hash table */ 560 struct hmehash_bucket *khme_hash; /* kernel hmeblk hash table */ 561 uint64_t uhme_hash_pa; /* PA of uhme_hash */ 562 uint64_t khme_hash_pa; /* PA of khme_hash */ 563 int uhmehash_num; /* # of buckets in user hash table */ 564 int khmehash_num; /* # of buckets in kernel hash table */ 565 566 uint_t max_mmu_ctxdoms = 0; /* max context domains in the system */ 567 mmu_ctx_t **mmu_ctxs_tbl; /* global array of context domains */ 568 uint64_t mmu_saved_gnum = 0; /* to init incoming MMUs' gnums */ 569 570 #define DEFAULT_NUM_CTXS_PER_MMU 8192 571 static uint_t nctxs = DEFAULT_NUM_CTXS_PER_MMU; 572 573 int cache; /* describes system cache */ 574 575 caddr_t ktsb_base; /* kernel 8k-indexed tsb base address */ 576 uint64_t ktsb_pbase; /* kernel 8k-indexed tsb phys address */ 577 int ktsb_szcode; /* kernel 8k-indexed tsb size code */ 578 int ktsb_sz; /* kernel 8k-indexed tsb size */ 579 580 caddr_t ktsb4m_base; /* kernel 4m-indexed tsb base address */ 581 uint64_t ktsb4m_pbase; /* kernel 4m-indexed tsb phys address */ 582 int ktsb4m_szcode; /* kernel 4m-indexed tsb size code */ 583 int ktsb4m_sz; /* kernel 4m-indexed tsb size */ 584 585 uint64_t kpm_tsbbase; /* kernel seg_kpm 4M TSB base address */ 586 int kpm_tsbsz; /* kernel seg_kpm 4M TSB size code */ 587 uint64_t kpmsm_tsbbase; /* kernel seg_kpm 8K TSB base address */ 588 int kpmsm_tsbsz; /* kernel seg_kpm 8K TSB size code */ 589 590 #ifndef sun4v 591 int utsb_dtlb_ttenum = -1; /* index in TLB for utsb locked TTE */ 592 int utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */ 593 int dtlb_resv_ttenum; /* index in TLB of first reserved TTE */ 594 caddr_t utsb_vabase; /* reserved kernel virtual memory */ 595 caddr_t utsb4m_vabase; /* for trap handler TSB accesses */ 596 #endif /* sun4v */ 597 uint64_t tsb_alloc_bytes = 0; /* bytes allocated to TSBs */ 598 vmem_t *kmem_tsb_default_arena[NLGRPS_MAX]; /* For dynamic TSBs */ 599 vmem_t *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */ 600 601 /* 602 * Size to use for TSB slabs. Future platforms that support page sizes 603 * larger than 4M may wish to change these values, and provide their own 604 * assembly macros for building and decoding the TSB base register contents. 605 * Note disable_large_pages will override the value set here. 606 */ 607 static uint_t tsb_slab_ttesz = TTE4M; 608 size_t tsb_slab_size = MMU_PAGESIZE4M; 609 uint_t tsb_slab_shift = MMU_PAGESHIFT4M; 610 /* PFN mask for TTE */ 611 size_t tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT; 612 613 /* 614 * Size to use for TSB slabs. These are used only when 256M tsb arenas 615 * exist. 616 */ 617 static uint_t bigtsb_slab_ttesz = TTE256M; 618 static size_t bigtsb_slab_size = MMU_PAGESIZE256M; 619 static uint_t bigtsb_slab_shift = MMU_PAGESHIFT256M; 620 /* 256M page alignment for 8K pfn */ 621 static size_t bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT; 622 623 /* largest TSB size to grow to, will be smaller on smaller memory systems */ 624 static int tsb_max_growsize = 0; 625 626 /* 627 * Tunable parameters dealing with TSB policies. 628 */ 629 630 /* 631 * This undocumented tunable forces all 8K TSBs to be allocated from 632 * the kernel heap rather than from the kmem_tsb_default_arena arenas. 633 */ 634 #ifdef DEBUG 635 int tsb_forceheap = 0; 636 #endif /* DEBUG */ 637 638 /* 639 * Decide whether to use per-lgroup arenas, or one global set of 640 * TSB arenas. The default is not to break up per-lgroup, since 641 * most platforms don't recognize any tangible benefit from it. 642 */ 643 int tsb_lgrp_affinity = 0; 644 645 /* 646 * Used for growing the TSB based on the process RSS. 647 * tsb_rss_factor is based on the smallest TSB, and is 648 * shifted by the TSB size to determine if we need to grow. 649 * The default will grow the TSB if the number of TTEs for 650 * this page size exceeds 75% of the number of TSB entries, 651 * which should _almost_ eliminate all conflict misses 652 * (at the expense of using up lots and lots of memory). 653 */ 654 #define TSB_RSS_FACTOR (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75) 655 #define SFMMU_RSS_TSBSIZE(tsbszc) (tsb_rss_factor << tsbszc) 656 #define SELECT_TSB_SIZECODE(pgcnt) ( \ 657 (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \ 658 default_tsb_size) 659 #define TSB_OK_SHRINK() \ 660 (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree) 661 #define TSB_OK_GROW() \ 662 (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree) 663 664 int enable_tsb_rss_sizing = 1; 665 int tsb_rss_factor = (int)TSB_RSS_FACTOR; 666 667 /* which TSB size code to use for new address spaces or if rss sizing off */ 668 int default_tsb_size = TSB_8K_SZCODE; 669 670 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */ 671 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */ 672 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT 32 673 674 #ifdef DEBUG 675 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */ 676 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */ 677 static int tsb_alloc_mtbf = 0; /* fail allocation every n attempts */ 678 static int tsb_alloc_fail_mtbf = 0; 679 static int tsb_alloc_count = 0; 680 #endif /* DEBUG */ 681 682 /* if set to 1, will remap valid TTEs when growing TSB. */ 683 int tsb_remap_ttes = 1; 684 685 /* 686 * If we have more than this many mappings, allocate a second TSB. 687 * This default is chosen because the I/D fully associative TLBs are 688 * assumed to have at least 8 available entries. Platforms with a 689 * larger fully-associative TLB could probably override the default. 690 */ 691 692 #ifdef sun4v 693 int tsb_sectsb_threshold = 0; 694 #else 695 int tsb_sectsb_threshold = 8; 696 #endif 697 698 /* 699 * kstat data 700 */ 701 struct sfmmu_global_stat sfmmu_global_stat; 702 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat; 703 704 /* 705 * Global data 706 */ 707 sfmmu_t *ksfmmup; /* kernel's hat id */ 708 709 #ifdef DEBUG 710 static void chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *); 711 #endif 712 713 /* sfmmu locking operations */ 714 static kmutex_t *sfmmu_mlspl_enter(struct page *, int); 715 static int sfmmu_mlspl_held(struct page *, int); 716 717 kmutex_t *sfmmu_page_enter(page_t *); 718 void sfmmu_page_exit(kmutex_t *); 719 int sfmmu_page_spl_held(struct page *); 720 721 /* sfmmu internal locking operations - accessed directly */ 722 static void sfmmu_mlist_reloc_enter(page_t *, page_t *, 723 kmutex_t **, kmutex_t **); 724 static void sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *); 725 static hatlock_t * 726 sfmmu_hat_enter(sfmmu_t *); 727 static hatlock_t * 728 sfmmu_hat_tryenter(sfmmu_t *); 729 static void sfmmu_hat_exit(hatlock_t *); 730 static void sfmmu_hat_lock_all(void); 731 static void sfmmu_hat_unlock_all(void); 732 static void sfmmu_ismhat_enter(sfmmu_t *, int); 733 static void sfmmu_ismhat_exit(sfmmu_t *, int); 734 735 kpm_hlk_t *kpmp_table; 736 uint_t kpmp_table_sz; /* must be a power of 2 */ 737 uchar_t kpmp_shift; 738 739 kpm_shlk_t *kpmp_stable; 740 uint_t kpmp_stable_sz; /* must be a power of 2 */ 741 742 /* 743 * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128. 744 * SPL_SHIFT is log2(SPL_TABLE_SIZE). 745 */ 746 #if ((2*NCPU_P2) > 128) 747 #define SPL_SHIFT ((unsigned)(NCPU_LOG2 + 1)) 748 #else 749 #define SPL_SHIFT 7U 750 #endif 751 #define SPL_TABLE_SIZE (1U << SPL_SHIFT) 752 #define SPL_MASK (SPL_TABLE_SIZE - 1) 753 754 /* 755 * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t 756 * and by multiples of SPL_SHIFT to get as many varied bits as we can. 757 */ 758 #define SPL_INDEX(pp) \ 759 ((((uintptr_t)(pp) >> PP_SHIFT) ^ \ 760 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \ 761 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \ 762 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \ 763 SPL_MASK) 764 765 #define SPL_HASH(pp) \ 766 (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex) 767 768 static pad_mutex_t sfmmu_page_lock[SPL_TABLE_SIZE]; 769 770 /* Array of mutexes protecting a page's mapping list and p_nrm field. */ 771 772 #define MML_TABLE_SIZE SPL_TABLE_SIZE 773 #define MLIST_HASH(pp) (&mml_table[SPL_INDEX(pp)].pad_mutex) 774 775 static pad_mutex_t mml_table[MML_TABLE_SIZE]; 776 777 /* 778 * hat_unload_callback() will group together callbacks in order 779 * to avoid xt_sync() calls. This is the maximum size of the group. 780 */ 781 #define MAX_CB_ADDR 32 782 783 tte_t hw_tte; 784 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT; 785 786 static char *mmu_ctx_kstat_names[] = { 787 "mmu_ctx_tsb_exceptions", 788 "mmu_ctx_tsb_raise_exception", 789 "mmu_ctx_wrap_around", 790 }; 791 792 /* 793 * Wrapper for vmem_xalloc since vmem_create only allows limited 794 * parameters for vm_source_alloc functions. This function allows us 795 * to specify alignment consistent with the size of the object being 796 * allocated. 797 */ 798 static void * 799 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag) 800 { 801 return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag)); 802 } 803 804 /* Common code for setting tsb_alloc_hiwater. */ 805 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages) tsb_alloc_hiwater = \ 806 ptob(pages) / tsb_alloc_hiwater_factor 807 808 /* 809 * Set tsb_max_growsize to allow at most all of physical memory to be mapped by 810 * a single TSB. physmem is the number of physical pages so we need physmem 8K 811 * TTEs to represent all those physical pages. We round this up by using 812 * 1<<highbit(). To figure out which size code to use, remember that the size 813 * code is just an amount to shift the smallest TSB size to get the size of 814 * this TSB. So we subtract that size, TSB_START_SIZE, from highbit() (or 815 * highbit() - 1) to get the size code for the smallest TSB that can represent 816 * all of physical memory, while erring on the side of too much. 817 * 818 * Restrict tsb_max_growsize to make sure that: 819 * 1) TSBs can't grow larger than the TSB slab size 820 * 2) TSBs can't grow larger than UTSB_MAX_SZCODE. 821 */ 822 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) { \ 823 int _i, _szc, _slabszc, _tsbszc; \ 824 \ 825 _i = highbit(pages); \ 826 if ((1 << (_i - 1)) == (pages)) \ 827 _i--; /* 2^n case, round down */ \ 828 _szc = _i - TSB_START_SIZE; \ 829 _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \ 830 _tsbszc = MIN(_szc, _slabszc); \ 831 tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE); \ 832 } 833 834 /* 835 * Given a pointer to an sfmmu and a TTE size code, return a pointer to the 836 * tsb_info which handles that TTE size. 837 */ 838 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) { \ 839 (tsbinfop) = (sfmmup)->sfmmu_tsb; \ 840 ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) || \ 841 sfmmu_hat_lock_held(sfmmup)); \ 842 if ((tte_szc) >= TTE4M) { \ 843 ASSERT((tsbinfop) != NULL); \ 844 (tsbinfop) = (tsbinfop)->tsb_next; \ 845 } \ 846 } 847 848 /* 849 * Macro to use to unload entries from the TSB. 850 * It has knowledge of which page sizes get replicated in the TSB 851 * and will call the appropriate unload routine for the appropriate size. 852 */ 853 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat) \ 854 { \ 855 int ttesz = get_hblk_ttesz(hmeblkp); \ 856 if (ttesz == TTE8K || ttesz == TTE4M) { \ 857 sfmmu_unload_tsb(sfmmup, addr, ttesz); \ 858 } else { \ 859 caddr_t sva = ismhat ? addr : \ 860 (caddr_t)get_hblk_base(hmeblkp); \ 861 caddr_t eva = sva + get_hblk_span(hmeblkp); \ 862 ASSERT(addr >= sva && addr < eva); \ 863 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz); \ 864 } \ 865 } 866 867 868 /* Update tsb_alloc_hiwater after memory is configured. */ 869 /*ARGSUSED*/ 870 static void 871 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages) 872 { 873 /* Assumes physmem has already been updated. */ 874 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 875 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 876 } 877 878 /* 879 * Update tsb_alloc_hiwater before memory is deleted. We'll do nothing here 880 * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is 881 * deleted. 882 */ 883 /*ARGSUSED*/ 884 static int 885 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages) 886 { 887 return (0); 888 } 889 890 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */ 891 /*ARGSUSED*/ 892 static void 893 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled) 894 { 895 /* 896 * Whether the delete was cancelled or not, just go ahead and update 897 * tsb_alloc_hiwater and tsb_max_growsize. 898 */ 899 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 900 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 901 } 902 903 static kphysm_setup_vector_t sfmmu_update_vec = { 904 KPHYSM_SETUP_VECTOR_VERSION, /* version */ 905 sfmmu_update_post_add, /* post_add */ 906 sfmmu_update_pre_del, /* pre_del */ 907 sfmmu_update_post_del /* post_del */ 908 }; 909 910 911 /* 912 * HME_BLK HASH PRIMITIVES 913 */ 914 915 /* 916 * Enter a hme on the mapping list for page pp. 917 * When large pages are more prevalent in the system we might want to 918 * keep the mapping list in ascending order by the hment size. For now, 919 * small pages are more frequent, so don't slow it down. 920 */ 921 #define HME_ADD(hme, pp) \ 922 { \ 923 ASSERT(sfmmu_mlist_held(pp)); \ 924 \ 925 hme->hme_prev = NULL; \ 926 hme->hme_next = pp->p_mapping; \ 927 hme->hme_page = pp; \ 928 if (pp->p_mapping) { \ 929 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\ 930 ASSERT(pp->p_share > 0); \ 931 } else { \ 932 /* EMPTY */ \ 933 ASSERT(pp->p_share == 0); \ 934 } \ 935 pp->p_mapping = hme; \ 936 pp->p_share++; \ 937 } 938 939 /* 940 * Enter a hme on the mapping list for page pp. 941 * If we are unmapping a large translation, we need to make sure that the 942 * change is reflect in the corresponding bit of the p_index field. 943 */ 944 #define HME_SUB(hme, pp) \ 945 { \ 946 ASSERT(sfmmu_mlist_held(pp)); \ 947 ASSERT(hme->hme_page == pp || IS_PAHME(hme)); \ 948 \ 949 if (pp->p_mapping == NULL) { \ 950 panic("hme_remove - no mappings"); \ 951 } \ 952 \ 953 membar_stst(); /* ensure previous stores finish */ \ 954 \ 955 ASSERT(pp->p_share > 0); \ 956 pp->p_share--; \ 957 \ 958 if (hme->hme_prev) { \ 959 ASSERT(pp->p_mapping != hme); \ 960 ASSERT(hme->hme_prev->hme_page == pp || \ 961 IS_PAHME(hme->hme_prev)); \ 962 hme->hme_prev->hme_next = hme->hme_next; \ 963 } else { \ 964 ASSERT(pp->p_mapping == hme); \ 965 pp->p_mapping = hme->hme_next; \ 966 ASSERT((pp->p_mapping == NULL) ? \ 967 (pp->p_share == 0) : 1); \ 968 } \ 969 \ 970 if (hme->hme_next) { \ 971 ASSERT(hme->hme_next->hme_page == pp || \ 972 IS_PAHME(hme->hme_next)); \ 973 hme->hme_next->hme_prev = hme->hme_prev; \ 974 } \ 975 \ 976 /* zero out the entry */ \ 977 hme->hme_next = NULL; \ 978 hme->hme_prev = NULL; \ 979 hme->hme_page = NULL; \ 980 \ 981 if (hme_size(hme) > TTE8K) { \ 982 /* remove mappings for remainder of large pg */ \ 983 sfmmu_rm_large_mappings(pp, hme_size(hme)); \ 984 } \ 985 } 986 987 /* 988 * This function returns the hment given the hme_blk and a vaddr. 989 * It assumes addr has already been checked to belong to hme_blk's 990 * range. 991 */ 992 #define HBLKTOHME(hment, hmeblkp, addr) \ 993 { \ 994 int index; \ 995 HBLKTOHME_IDX(hment, hmeblkp, addr, index) \ 996 } 997 998 /* 999 * Version of HBLKTOHME that also returns the index in hmeblkp 1000 * of the hment. 1001 */ 1002 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx) \ 1003 { \ 1004 ASSERT(in_hblk_range((hmeblkp), (addr))); \ 1005 \ 1006 if (get_hblk_ttesz(hmeblkp) == TTE8K) { \ 1007 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \ 1008 } else \ 1009 idx = 0; \ 1010 \ 1011 (hment) = &(hmeblkp)->hblk_hme[idx]; \ 1012 } 1013 1014 /* 1015 * Disable any page sizes not supported by the CPU 1016 */ 1017 void 1018 hat_init_pagesizes() 1019 { 1020 int i; 1021 1022 mmu_exported_page_sizes = 0; 1023 for (i = TTE8K; i < max_mmu_page_sizes; i++) { 1024 1025 szc_2_userszc[i] = (uint_t)-1; 1026 userszc_2_szc[i] = (uint_t)-1; 1027 1028 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) { 1029 disable_large_pages |= (1 << i); 1030 } else { 1031 szc_2_userszc[i] = mmu_exported_page_sizes; 1032 userszc_2_szc[mmu_exported_page_sizes] = i; 1033 mmu_exported_page_sizes++; 1034 } 1035 } 1036 1037 disable_ism_large_pages |= disable_large_pages; 1038 disable_auto_data_large_pages = disable_large_pages; 1039 disable_auto_text_large_pages = disable_large_pages; 1040 1041 /* 1042 * Initialize mmu-specific large page sizes. 1043 */ 1044 if (&mmu_large_pages_disabled) { 1045 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD); 1046 disable_ism_large_pages |= 1047 mmu_large_pages_disabled(HAT_LOAD_SHARE); 1048 disable_auto_data_large_pages |= 1049 mmu_large_pages_disabled(HAT_AUTO_DATA); 1050 disable_auto_text_large_pages |= 1051 mmu_large_pages_disabled(HAT_AUTO_TEXT); 1052 } 1053 } 1054 1055 /* 1056 * Initialize the hardware address translation structures. 1057 */ 1058 void 1059 hat_init(void) 1060 { 1061 int i; 1062 uint_t sz; 1063 size_t size; 1064 1065 hat_lock_init(); 1066 hat_kstat_init(); 1067 1068 /* 1069 * Hardware-only bits in a TTE 1070 */ 1071 MAKE_TTE_MASK(&hw_tte); 1072 1073 hat_init_pagesizes(); 1074 1075 /* Initialize the hash locks */ 1076 for (i = 0; i < khmehash_num; i++) { 1077 mutex_init(&khme_hash[i].hmehash_mutex, NULL, 1078 MUTEX_DEFAULT, NULL); 1079 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA; 1080 } 1081 for (i = 0; i < uhmehash_num; i++) { 1082 mutex_init(&uhme_hash[i].hmehash_mutex, NULL, 1083 MUTEX_DEFAULT, NULL); 1084 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA; 1085 } 1086 khmehash_num--; /* make sure counter starts from 0 */ 1087 uhmehash_num--; /* make sure counter starts from 0 */ 1088 1089 /* 1090 * Allocate context domain structures. 1091 * 1092 * A platform may choose to modify max_mmu_ctxdoms in 1093 * set_platform_defaults(). If a platform does not define 1094 * a set_platform_defaults() or does not choose to modify 1095 * max_mmu_ctxdoms, it gets one MMU context domain for every CPU. 1096 * 1097 * For all platforms that have CPUs sharing MMUs, this 1098 * value must be defined. 1099 */ 1100 if (max_mmu_ctxdoms == 0) 1101 max_mmu_ctxdoms = max_ncpus; 1102 1103 size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *); 1104 mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP); 1105 1106 /* mmu_ctx_t is 64 bytes aligned */ 1107 mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache", 1108 sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0); 1109 /* 1110 * MMU context domain initialization for the Boot CPU. 1111 * This needs the context domains array allocated above. 1112 */ 1113 mutex_enter(&cpu_lock); 1114 sfmmu_cpu_init(CPU); 1115 mutex_exit(&cpu_lock); 1116 1117 /* 1118 * Intialize ism mapping list lock. 1119 */ 1120 1121 mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL); 1122 1123 /* 1124 * Each sfmmu structure carries an array of MMU context info 1125 * structures, one per context domain. The size of this array depends 1126 * on the maximum number of context domains. So, the size of the 1127 * sfmmu structure varies per platform. 1128 * 1129 * sfmmu is allocated from static arena, because trap 1130 * handler at TL > 0 is not allowed to touch kernel relocatable 1131 * memory. sfmmu's alignment is changed to 64 bytes from 1132 * default 8 bytes, as the lower 6 bits will be used to pass 1133 * pgcnt to vtag_flush_pgcnt_tl1. 1134 */ 1135 size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1); 1136 1137 sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size, 1138 64, sfmmu_idcache_constructor, sfmmu_idcache_destructor, 1139 NULL, NULL, static_arena, 0); 1140 1141 sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache", 1142 sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0); 1143 1144 /* 1145 * Since we only use the tsb8k cache to "borrow" pages for TSBs 1146 * from the heap when low on memory or when TSB_FORCEALLOC is 1147 * specified, don't use magazines to cache them--we want to return 1148 * them to the system as quickly as possible. 1149 */ 1150 sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache", 1151 MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL, 1152 static_arena, KMC_NOMAGAZINE); 1153 1154 /* 1155 * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical 1156 * memory, which corresponds to the old static reserve for TSBs. 1157 * tsb_alloc_hiwater_factor defaults to 32. This caps the amount of 1158 * memory we'll allocate for TSB slabs; beyond this point TSB 1159 * allocations will be taken from the kernel heap (via 1160 * sfmmu_tsb8k_cache) and will be throttled as would any other kmem 1161 * consumer. 1162 */ 1163 if (tsb_alloc_hiwater_factor == 0) { 1164 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT; 1165 } 1166 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 1167 1168 for (sz = tsb_slab_ttesz; sz > 0; sz--) { 1169 if (!(disable_large_pages & (1 << sz))) 1170 break; 1171 } 1172 1173 if (sz < tsb_slab_ttesz) { 1174 tsb_slab_ttesz = sz; 1175 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz; 1176 tsb_slab_size = 1 << tsb_slab_shift; 1177 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1; 1178 use_bigtsb_arena = 0; 1179 } else if (use_bigtsb_arena && 1180 (disable_large_pages & (1 << bigtsb_slab_ttesz))) { 1181 use_bigtsb_arena = 0; 1182 } 1183 1184 if (!use_bigtsb_arena) { 1185 bigtsb_slab_shift = tsb_slab_shift; 1186 } 1187 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 1188 1189 /* 1190 * On smaller memory systems, allocate TSB memory in smaller chunks 1191 * than the default 4M slab size. We also honor disable_large_pages 1192 * here. 1193 * 1194 * The trap handlers need to be patched with the final slab shift, 1195 * since they need to be able to construct the TSB pointer at runtime. 1196 */ 1197 if ((tsb_max_growsize <= TSB_512K_SZCODE) && 1198 !(disable_large_pages & (1 << TTE512K))) { 1199 tsb_slab_ttesz = TTE512K; 1200 tsb_slab_shift = MMU_PAGESHIFT512K; 1201 tsb_slab_size = MMU_PAGESIZE512K; 1202 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT; 1203 use_bigtsb_arena = 0; 1204 } 1205 1206 if (!use_bigtsb_arena) { 1207 bigtsb_slab_ttesz = tsb_slab_ttesz; 1208 bigtsb_slab_shift = tsb_slab_shift; 1209 bigtsb_slab_size = tsb_slab_size; 1210 bigtsb_slab_mask = tsb_slab_mask; 1211 } 1212 1213 1214 /* 1215 * Set up memory callback to update tsb_alloc_hiwater and 1216 * tsb_max_growsize. 1217 */ 1218 i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0); 1219 ASSERT(i == 0); 1220 1221 /* 1222 * kmem_tsb_arena is the source from which large TSB slabs are 1223 * drawn. The quantum of this arena corresponds to the largest 1224 * TSB size we can dynamically allocate for user processes. 1225 * Currently it must also be a supported page size since we 1226 * use exactly one translation entry to map each slab page. 1227 * 1228 * The per-lgroup kmem_tsb_default_arena arenas are the arenas from 1229 * which most TSBs are allocated. Since most TSB allocations are 1230 * typically 8K we have a kmem cache we stack on top of each 1231 * kmem_tsb_default_arena to speed up those allocations. 1232 * 1233 * Note the two-level scheme of arenas is required only 1234 * because vmem_create doesn't allow us to specify alignment 1235 * requirements. If this ever changes the code could be 1236 * simplified to use only one level of arenas. 1237 * 1238 * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena 1239 * will be provided in addition to the 4M kmem_tsb_arena. 1240 */ 1241 if (use_bigtsb_arena) { 1242 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0, 1243 bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper, 1244 vmem_xfree, heap_arena, 0, VM_SLEEP); 1245 } 1246 1247 kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size, 1248 sfmmu_vmem_xalloc_aligned_wrapper, 1249 vmem_xfree, heap_arena, 0, VM_SLEEP); 1250 1251 if (tsb_lgrp_affinity) { 1252 char s[50]; 1253 for (i = 0; i < NLGRPS_MAX; i++) { 1254 if (use_bigtsb_arena) { 1255 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i); 1256 kmem_bigtsb_default_arena[i] = vmem_create(s, 1257 NULL, 0, 2 * tsb_slab_size, 1258 sfmmu_tsb_segkmem_alloc, 1259 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 1260 0, VM_SLEEP | VM_BESTFIT); 1261 } 1262 1263 (void) sprintf(s, "kmem_tsb_lgrp%d", i); 1264 kmem_tsb_default_arena[i] = vmem_create(s, 1265 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc, 1266 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0, 1267 VM_SLEEP | VM_BESTFIT); 1268 1269 (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i); 1270 sfmmu_tsb_cache[i] = kmem_cache_create(s, 1271 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL, 1272 kmem_tsb_default_arena[i], 0); 1273 } 1274 } else { 1275 if (use_bigtsb_arena) { 1276 kmem_bigtsb_default_arena[0] = 1277 vmem_create("kmem_bigtsb_default", NULL, 0, 1278 2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc, 1279 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0, 1280 VM_SLEEP | VM_BESTFIT); 1281 } 1282 1283 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default", 1284 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc, 1285 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0, 1286 VM_SLEEP | VM_BESTFIT); 1287 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache", 1288 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL, 1289 kmem_tsb_default_arena[0], 0); 1290 } 1291 1292 sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ, 1293 HMEBLK_ALIGN, sfmmu_hblkcache_constructor, 1294 sfmmu_hblkcache_destructor, 1295 sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ, 1296 hat_memload_arena, KMC_NOHASH); 1297 1298 hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE, 1299 segkmem_alloc_permanent, segkmem_free, heap_arena, 0, 1300 VMC_DUMPSAFE | VM_SLEEP); 1301 1302 sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ, 1303 HMEBLK_ALIGN, sfmmu_hblkcache_constructor, 1304 sfmmu_hblkcache_destructor, 1305 NULL, (void *)HME1BLK_SZ, 1306 hat_memload1_arena, KMC_NOHASH); 1307 1308 pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ, 1309 0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH); 1310 1311 ism_blk_cache = kmem_cache_create("ism_blk_cache", 1312 sizeof (ism_blk_t), ecache_alignsize, NULL, NULL, 1313 NULL, NULL, static_arena, KMC_NOHASH); 1314 1315 ism_ment_cache = kmem_cache_create("ism_ment_cache", 1316 sizeof (ism_ment_t), 0, NULL, NULL, 1317 NULL, NULL, NULL, 0); 1318 1319 /* 1320 * We grab the first hat for the kernel, 1321 */ 1322 AS_LOCK_ENTER(&kas, RW_WRITER); 1323 kas.a_hat = hat_alloc(&kas); 1324 AS_LOCK_EXIT(&kas); 1325 1326 /* 1327 * Initialize hblk_reserve. 1328 */ 1329 ((struct hme_blk *)hblk_reserve)->hblk_nextpa = 1330 va_to_pa((caddr_t)hblk_reserve); 1331 1332 #ifndef UTSB_PHYS 1333 /* 1334 * Reserve some kernel virtual address space for the locked TTEs 1335 * that allow us to probe the TSB from TL>0. 1336 */ 1337 utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size, 1338 0, 0, NULL, NULL, VM_SLEEP); 1339 utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size, 1340 0, 0, NULL, NULL, VM_SLEEP); 1341 #endif 1342 1343 #ifdef VAC 1344 /* 1345 * The big page VAC handling code assumes VAC 1346 * will not be bigger than the smallest big 1347 * page- which is 64K. 1348 */ 1349 if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) { 1350 cmn_err(CE_PANIC, "VAC too big!"); 1351 } 1352 #endif 1353 1354 uhme_hash_pa = va_to_pa(uhme_hash); 1355 khme_hash_pa = va_to_pa(khme_hash); 1356 1357 /* 1358 * Initialize relocation locks. kpr_suspendlock is held 1359 * at PIL_MAX to prevent interrupts from pinning the holder 1360 * of a suspended TTE which may access it leading to a 1361 * deadlock condition. 1362 */ 1363 mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL); 1364 mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX); 1365 1366 /* 1367 * If Shared context support is disabled via /etc/system 1368 * set shctx_on to 0 here if it was set to 1 earlier in boot 1369 * sequence by cpu module initialization code. 1370 */ 1371 if (shctx_on && disable_shctx) { 1372 shctx_on = 0; 1373 } 1374 1375 if (shctx_on) { 1376 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS * 1377 sizeof (srd_buckets[0]), KM_SLEEP); 1378 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) { 1379 mutex_init(&srd_buckets[i].srdb_lock, NULL, 1380 MUTEX_DEFAULT, NULL); 1381 } 1382 1383 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t), 1384 0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor, 1385 NULL, NULL, NULL, 0); 1386 region_cache = kmem_cache_create("region_cache", 1387 sizeof (sf_region_t), 0, sfmmu_rgncache_constructor, 1388 sfmmu_rgncache_destructor, NULL, NULL, NULL, 0); 1389 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t), 1390 0, sfmmu_scdcache_constructor, sfmmu_scdcache_destructor, 1391 NULL, NULL, NULL, 0); 1392 } 1393 1394 /* 1395 * Pre-allocate hrm_hashtab before enabling the collection of 1396 * refmod statistics. Allocating on the fly would mean us 1397 * running the risk of suffering recursive mutex enters or 1398 * deadlocks. 1399 */ 1400 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *), 1401 KM_SLEEP); 1402 1403 /* Allocate per-cpu pending freelist of hmeblks */ 1404 cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64, 1405 KM_SLEEP); 1406 cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP( 1407 (uintptr_t)cpu_hme_pend, 64); 1408 1409 for (i = 0; i < NCPU; i++) { 1410 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT, 1411 NULL); 1412 } 1413 1414 if (cpu_hme_pend_thresh == 0) { 1415 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH; 1416 } 1417 } 1418 1419 /* 1420 * Initialize locking for the hat layer, called early during boot. 1421 */ 1422 static void 1423 hat_lock_init() 1424 { 1425 int i; 1426 1427 /* 1428 * initialize the array of mutexes protecting a page's mapping 1429 * list and p_nrm field. 1430 */ 1431 for (i = 0; i < MML_TABLE_SIZE; i++) 1432 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL); 1433 1434 if (kpm_enable) { 1435 for (i = 0; i < kpmp_table_sz; i++) { 1436 mutex_init(&kpmp_table[i].khl_mutex, NULL, 1437 MUTEX_DEFAULT, NULL); 1438 } 1439 } 1440 1441 /* 1442 * Initialize array of mutex locks that protects sfmmu fields and 1443 * TSB lists. 1444 */ 1445 for (i = 0; i < SFMMU_NUM_LOCK; i++) 1446 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT, 1447 NULL); 1448 } 1449 1450 #define SFMMU_KERNEL_MAXVA \ 1451 (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT)) 1452 1453 /* 1454 * Allocate a hat structure. 1455 * Called when an address space first uses a hat. 1456 */ 1457 struct hat * 1458 hat_alloc(struct as *as) 1459 { 1460 sfmmu_t *sfmmup; 1461 int i; 1462 uint64_t cnum; 1463 extern uint_t get_color_start(struct as *); 1464 1465 ASSERT(AS_WRITE_HELD(as)); 1466 sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP); 1467 sfmmup->sfmmu_as = as; 1468 sfmmup->sfmmu_flags = 0; 1469 sfmmup->sfmmu_tteflags = 0; 1470 sfmmup->sfmmu_rtteflags = 0; 1471 LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock); 1472 1473 if (as == &kas) { 1474 ksfmmup = sfmmup; 1475 sfmmup->sfmmu_cext = 0; 1476 cnum = KCONTEXT; 1477 1478 sfmmup->sfmmu_clrstart = 0; 1479 sfmmup->sfmmu_tsb = NULL; 1480 /* 1481 * hat_kern_setup() will call sfmmu_init_ktsbinfo() 1482 * to setup tsb_info for ksfmmup. 1483 */ 1484 } else { 1485 1486 /* 1487 * Just set to invalid ctx. When it faults, it will 1488 * get a valid ctx. This would avoid the situation 1489 * where we get a ctx, but it gets stolen and then 1490 * we fault when we try to run and so have to get 1491 * another ctx. 1492 */ 1493 sfmmup->sfmmu_cext = 0; 1494 cnum = INVALID_CONTEXT; 1495 1496 /* initialize original physical page coloring bin */ 1497 sfmmup->sfmmu_clrstart = get_color_start(as); 1498 #ifdef DEBUG 1499 if (tsb_random_size) { 1500 uint32_t randval = (uint32_t)gettick() >> 4; 1501 int size = randval % (tsb_max_growsize + 1); 1502 1503 /* chose a random tsb size for stress testing */ 1504 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size, 1505 TSB8K|TSB64K|TSB512K, 0, sfmmup); 1506 } else 1507 #endif /* DEBUG */ 1508 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, 1509 default_tsb_size, 1510 TSB8K|TSB64K|TSB512K, 0, sfmmup); 1511 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID; 1512 ASSERT(sfmmup->sfmmu_tsb != NULL); 1513 } 1514 1515 ASSERT(max_mmu_ctxdoms > 0); 1516 for (i = 0; i < max_mmu_ctxdoms; i++) { 1517 sfmmup->sfmmu_ctxs[i].cnum = cnum; 1518 sfmmup->sfmmu_ctxs[i].gnum = 0; 1519 } 1520 1521 for (i = 0; i < max_mmu_page_sizes; i++) { 1522 sfmmup->sfmmu_ttecnt[i] = 0; 1523 sfmmup->sfmmu_scdrttecnt[i] = 0; 1524 sfmmup->sfmmu_ismttecnt[i] = 0; 1525 sfmmup->sfmmu_scdismttecnt[i] = 0; 1526 sfmmup->sfmmu_pgsz[i] = TTE8K; 1527 } 1528 sfmmup->sfmmu_tsb0_4minflcnt = 0; 1529 sfmmup->sfmmu_iblk = NULL; 1530 sfmmup->sfmmu_ismhat = 0; 1531 sfmmup->sfmmu_scdhat = 0; 1532 sfmmup->sfmmu_ismblkpa = (uint64_t)-1; 1533 if (sfmmup == ksfmmup) { 1534 CPUSET_ALL(sfmmup->sfmmu_cpusran); 1535 } else { 1536 CPUSET_ZERO(sfmmup->sfmmu_cpusran); 1537 } 1538 sfmmup->sfmmu_free = 0; 1539 sfmmup->sfmmu_rmstat = 0; 1540 sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart; 1541 cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL); 1542 sfmmup->sfmmu_srdp = NULL; 1543 SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map); 1544 bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE); 1545 sfmmup->sfmmu_scdp = NULL; 1546 sfmmup->sfmmu_scd_link.next = NULL; 1547 sfmmup->sfmmu_scd_link.prev = NULL; 1548 return (sfmmup); 1549 } 1550 1551 /* 1552 * Create per-MMU context domain kstats for a given MMU ctx. 1553 */ 1554 static void 1555 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp) 1556 { 1557 mmu_ctx_stat_t stat; 1558 kstat_t *mmu_kstat; 1559 1560 ASSERT(MUTEX_HELD(&cpu_lock)); 1561 ASSERT(mmu_ctxp->mmu_kstat == NULL); 1562 1563 mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx", 1564 "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL); 1565 1566 if (mmu_kstat == NULL) { 1567 cmn_err(CE_WARN, "kstat_create for MMU %d failed", 1568 mmu_ctxp->mmu_idx); 1569 } else { 1570 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data; 1571 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++) 1572 kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat], 1573 mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64); 1574 mmu_ctxp->mmu_kstat = mmu_kstat; 1575 kstat_install(mmu_kstat); 1576 } 1577 } 1578 1579 /* 1580 * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU 1581 * context domain information for a given CPU. If a platform does not 1582 * specify that interface, then the function below is used instead to return 1583 * default information. The defaults are as follows: 1584 * 1585 * - The number of MMU context IDs supported on any CPU in the 1586 * system is 8K. 1587 * - There is one MMU context domain per CPU. 1588 */ 1589 /*ARGSUSED*/ 1590 static void 1591 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop) 1592 { 1593 infop->mmu_nctxs = nctxs; 1594 infop->mmu_idx = cpu[cpuid]->cpu_seqid; 1595 } 1596 1597 /* 1598 * Called during CPU initialization to set the MMU context-related information 1599 * for a CPU. 1600 * 1601 * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum. 1602 */ 1603 void 1604 sfmmu_cpu_init(cpu_t *cp) 1605 { 1606 mmu_ctx_info_t info; 1607 mmu_ctx_t *mmu_ctxp; 1608 1609 ASSERT(MUTEX_HELD(&cpu_lock)); 1610 1611 if (&plat_cpuid_to_mmu_ctx_info == NULL) 1612 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info); 1613 else 1614 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info); 1615 1616 ASSERT(info.mmu_idx < max_mmu_ctxdoms); 1617 1618 if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) { 1619 /* Each mmu_ctx is cacheline aligned. */ 1620 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP); 1621 bzero(mmu_ctxp, sizeof (mmu_ctx_t)); 1622 1623 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN, 1624 (void *)ipltospl(DISP_LEVEL)); 1625 mmu_ctxp->mmu_idx = info.mmu_idx; 1626 mmu_ctxp->mmu_nctxs = info.mmu_nctxs; 1627 /* 1628 * Globally for lifetime of a system, 1629 * gnum must always increase. 1630 * mmu_saved_gnum is protected by the cpu_lock. 1631 */ 1632 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1; 1633 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS; 1634 1635 sfmmu_mmu_kstat_create(mmu_ctxp); 1636 1637 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp; 1638 } else { 1639 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx); 1640 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs); 1641 } 1642 1643 /* 1644 * The mmu_lock is acquired here to prevent races with 1645 * the wrap-around code. 1646 */ 1647 mutex_enter(&mmu_ctxp->mmu_lock); 1648 1649 1650 mmu_ctxp->mmu_ncpus++; 1651 CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id); 1652 CPU_MMU_IDX(cp) = info.mmu_idx; 1653 CPU_MMU_CTXP(cp) = mmu_ctxp; 1654 1655 mutex_exit(&mmu_ctxp->mmu_lock); 1656 } 1657 1658 static void 1659 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp) 1660 { 1661 ASSERT(MUTEX_HELD(&cpu_lock)); 1662 ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock)); 1663 1664 mutex_destroy(&mmu_ctxp->mmu_lock); 1665 1666 if (mmu_ctxp->mmu_kstat) 1667 kstat_delete(mmu_ctxp->mmu_kstat); 1668 1669 /* mmu_saved_gnum is protected by the cpu_lock. */ 1670 if (mmu_saved_gnum < mmu_ctxp->mmu_gnum) 1671 mmu_saved_gnum = mmu_ctxp->mmu_gnum; 1672 1673 kmem_cache_free(mmuctxdom_cache, mmu_ctxp); 1674 } 1675 1676 /* 1677 * Called to perform MMU context-related cleanup for a CPU. 1678 */ 1679 void 1680 sfmmu_cpu_cleanup(cpu_t *cp) 1681 { 1682 mmu_ctx_t *mmu_ctxp; 1683 1684 ASSERT(MUTEX_HELD(&cpu_lock)); 1685 1686 mmu_ctxp = CPU_MMU_CTXP(cp); 1687 ASSERT(mmu_ctxp != NULL); 1688 1689 /* 1690 * The mmu_lock is acquired here to prevent races with 1691 * the wrap-around code. 1692 */ 1693 mutex_enter(&mmu_ctxp->mmu_lock); 1694 1695 CPU_MMU_CTXP(cp) = NULL; 1696 1697 CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id); 1698 if (--mmu_ctxp->mmu_ncpus == 0) { 1699 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL; 1700 mutex_exit(&mmu_ctxp->mmu_lock); 1701 sfmmu_ctxdom_free(mmu_ctxp); 1702 return; 1703 } 1704 1705 mutex_exit(&mmu_ctxp->mmu_lock); 1706 } 1707 1708 uint_t 1709 sfmmu_ctxdom_nctxs(int idx) 1710 { 1711 return (mmu_ctxs_tbl[idx]->mmu_nctxs); 1712 } 1713 1714 #ifdef sun4v 1715 /* 1716 * sfmmu_ctxdoms_* is an interface provided to help keep context domains 1717 * consistant after suspend/resume on system that can resume on a different 1718 * hardware than it was suspended. 1719 * 1720 * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts 1721 * from being allocated. It acquires all hat_locks, which blocks most access to 1722 * context data, except for a few cases that are handled separately or are 1723 * harmless. It wraps each domain to increment gnum and invalidate on-CPU 1724 * contexts, and forces cnum to its max. As a result of this call all user 1725 * threads that are running on CPUs trap and try to perform wrap around but 1726 * can't because hat_locks are taken. Threads that were not on CPUs but started 1727 * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking 1728 * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block 1729 * on hat_lock trying to wrap. sfmmu_ctxdom_lock() must be called before CPUs 1730 * are paused, else it could deadlock acquiring locks held by paused CPUs. 1731 * 1732 * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records 1733 * the CPUs that had them. It must be called after CPUs have been paused. This 1734 * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data, 1735 * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx 1736 * runs with interrupts disabled. When CPUs are later resumed, they may enter 1737 * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately 1738 * return failure. Or, they will be blocked trying to acquire hat_lock. Thus 1739 * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is 1740 * accessing the old context domains. 1741 * 1742 * sfmmu_ctxdoms_update(void) frees space used by old context domains and 1743 * allocates new context domains based on hardware layout. It initializes 1744 * every CPU that had context domain before migration to have one again. 1745 * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it 1746 * could deadlock acquiring locks held by paused CPUs. 1747 * 1748 * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads 1749 * acquire new context ids and continue execution. 1750 * 1751 * Therefore functions should be called in the following order: 1752 * suspend_routine() 1753 * sfmmu_ctxdom_lock() 1754 * pause_cpus() 1755 * suspend() 1756 * if (suspend failed) 1757 * sfmmu_ctxdom_unlock() 1758 * ... 1759 * sfmmu_ctxdom_remove() 1760 * resume_cpus() 1761 * sfmmu_ctxdom_update() 1762 * sfmmu_ctxdom_unlock() 1763 */ 1764 static cpuset_t sfmmu_ctxdoms_pset; 1765 1766 void 1767 sfmmu_ctxdoms_remove() 1768 { 1769 processorid_t id; 1770 cpu_t *cp; 1771 1772 /* 1773 * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can 1774 * be restored post-migration. A CPU may be powered off and not have a 1775 * domain, for example. 1776 */ 1777 CPUSET_ZERO(sfmmu_ctxdoms_pset); 1778 1779 for (id = 0; id < NCPU; id++) { 1780 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) { 1781 CPUSET_ADD(sfmmu_ctxdoms_pset, id); 1782 CPU_MMU_CTXP(cp) = NULL; 1783 } 1784 } 1785 } 1786 1787 void 1788 sfmmu_ctxdoms_lock(void) 1789 { 1790 int idx; 1791 mmu_ctx_t *mmu_ctxp; 1792 1793 sfmmu_hat_lock_all(); 1794 1795 /* 1796 * At this point, no thread can be in sfmmu_ctx_wrap_around, because 1797 * hat_lock is always taken before calling it. 1798 * 1799 * For each domain, set mmu_cnum to max so no more contexts can be 1800 * allocated, and wrap to flush on-CPU contexts and force threads to 1801 * acquire a new context when we later drop hat_lock after migration. 1802 * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum, 1803 * but the latter uses CAS and will miscompare and not overwrite it. 1804 */ 1805 kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */ 1806 for (idx = 0; idx < max_mmu_ctxdoms; idx++) { 1807 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) { 1808 mutex_enter(&mmu_ctxp->mmu_lock); 1809 mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs; 1810 /* make sure updated cnum visible */ 1811 membar_enter(); 1812 mutex_exit(&mmu_ctxp->mmu_lock); 1813 sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE); 1814 } 1815 } 1816 kpreempt_enable(); 1817 } 1818 1819 void 1820 sfmmu_ctxdoms_unlock(void) 1821 { 1822 sfmmu_hat_unlock_all(); 1823 } 1824 1825 void 1826 sfmmu_ctxdoms_update(void) 1827 { 1828 processorid_t id; 1829 cpu_t *cp; 1830 uint_t idx; 1831 mmu_ctx_t *mmu_ctxp; 1832 1833 /* 1834 * Free all context domains. As side effect, this increases 1835 * mmu_saved_gnum to the maximum gnum over all domains, which is used to 1836 * init gnum in the new domains, which therefore will be larger than the 1837 * sfmmu gnum for any process, guaranteeing that every process will see 1838 * a new generation and allocate a new context regardless of what new 1839 * domain it runs in. 1840 */ 1841 mutex_enter(&cpu_lock); 1842 1843 for (idx = 0; idx < max_mmu_ctxdoms; idx++) { 1844 if (mmu_ctxs_tbl[idx] != NULL) { 1845 mmu_ctxp = mmu_ctxs_tbl[idx]; 1846 mmu_ctxs_tbl[idx] = NULL; 1847 sfmmu_ctxdom_free(mmu_ctxp); 1848 } 1849 } 1850 1851 for (id = 0; id < NCPU; id++) { 1852 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) && 1853 (cp = cpu[id]) != NULL) 1854 sfmmu_cpu_init(cp); 1855 } 1856 mutex_exit(&cpu_lock); 1857 } 1858 #endif 1859 1860 /* 1861 * Hat_setup, makes an address space context the current active one. 1862 * In sfmmu this translates to setting the secondary context with the 1863 * corresponding context. 1864 */ 1865 void 1866 hat_setup(struct hat *sfmmup, int allocflag) 1867 { 1868 hatlock_t *hatlockp; 1869 1870 /* Init needs some special treatment. */ 1871 if (allocflag == HAT_INIT) { 1872 /* 1873 * Make sure that we have 1874 * 1. a TSB 1875 * 2. a valid ctx that doesn't get stolen after this point. 1876 */ 1877 hatlockp = sfmmu_hat_enter(sfmmup); 1878 1879 /* 1880 * Swap in the TSB. hat_init() allocates tsbinfos without 1881 * TSBs, but we need one for init, since the kernel does some 1882 * special things to set up its stack and needs the TSB to 1883 * resolve page faults. 1884 */ 1885 sfmmu_tsb_swapin(sfmmup, hatlockp); 1886 1887 sfmmu_get_ctx(sfmmup); 1888 1889 sfmmu_hat_exit(hatlockp); 1890 } else { 1891 ASSERT(allocflag == HAT_ALLOC); 1892 1893 hatlockp = sfmmu_hat_enter(sfmmup); 1894 kpreempt_disable(); 1895 1896 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id); 1897 /* 1898 * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter, 1899 * pagesize bits don't matter in this case since we are passing 1900 * INVALID_CONTEXT to it. 1901 * Compatibility Note: hw takes care of MMU_SCONTEXT1 1902 */ 1903 sfmmu_setctx_sec(INVALID_CONTEXT); 1904 sfmmu_clear_utsbinfo(); 1905 1906 kpreempt_enable(); 1907 sfmmu_hat_exit(hatlockp); 1908 } 1909 } 1910 1911 /* 1912 * Free all the translation resources for the specified address space. 1913 * Called from as_free when an address space is being destroyed. 1914 */ 1915 void 1916 hat_free_start(struct hat *sfmmup) 1917 { 1918 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 1919 ASSERT(sfmmup != ksfmmup); 1920 1921 sfmmup->sfmmu_free = 1; 1922 if (sfmmup->sfmmu_scdp != NULL) { 1923 sfmmu_leave_scd(sfmmup, 0); 1924 } 1925 1926 ASSERT(sfmmup->sfmmu_scdp == NULL); 1927 } 1928 1929 void 1930 hat_free_end(struct hat *sfmmup) 1931 { 1932 int i; 1933 1934 ASSERT(sfmmup->sfmmu_free == 1); 1935 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0); 1936 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0); 1937 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0); 1938 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0); 1939 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 1940 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 1941 1942 if (sfmmup->sfmmu_rmstat) { 1943 hat_freestat(sfmmup->sfmmu_as, NULL); 1944 } 1945 1946 while (sfmmup->sfmmu_tsb != NULL) { 1947 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next; 1948 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb); 1949 sfmmup->sfmmu_tsb = next; 1950 } 1951 1952 if (sfmmup->sfmmu_srdp != NULL) { 1953 sfmmu_leave_srd(sfmmup); 1954 ASSERT(sfmmup->sfmmu_srdp == NULL); 1955 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 1956 if (sfmmup->sfmmu_hmeregion_links[i] != NULL) { 1957 kmem_free(sfmmup->sfmmu_hmeregion_links[i], 1958 SFMMU_L2_HMERLINKS_SIZE); 1959 sfmmup->sfmmu_hmeregion_links[i] = NULL; 1960 } 1961 } 1962 } 1963 sfmmu_free_sfmmu(sfmmup); 1964 1965 #ifdef DEBUG 1966 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 1967 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL); 1968 } 1969 #endif 1970 1971 kmem_cache_free(sfmmuid_cache, sfmmup); 1972 } 1973 1974 /* 1975 * Set up any translation structures, for the specified address space, 1976 * that are needed or preferred when the process is being swapped in. 1977 */ 1978 /* ARGSUSED */ 1979 void 1980 hat_swapin(struct hat *hat) 1981 { 1982 } 1983 1984 /* 1985 * Free all of the translation resources, for the specified address space, 1986 * that can be freed while the process is swapped out. Called from as_swapout. 1987 * Also, free up the ctx that this process was using. 1988 */ 1989 void 1990 hat_swapout(struct hat *sfmmup) 1991 { 1992 struct hmehash_bucket *hmebp; 1993 struct hme_blk *hmeblkp; 1994 struct hme_blk *pr_hblk = NULL; 1995 struct hme_blk *nx_hblk; 1996 int i; 1997 struct hme_blk *list = NULL; 1998 hatlock_t *hatlockp; 1999 struct tsb_info *tsbinfop; 2000 struct free_tsb { 2001 struct free_tsb *next; 2002 struct tsb_info *tsbinfop; 2003 }; /* free list of TSBs */ 2004 struct free_tsb *freelist, *last, *next; 2005 2006 SFMMU_STAT(sf_swapout); 2007 2008 /* 2009 * There is no way to go from an as to all its translations in sfmmu. 2010 * Here is one of the times when we take the big hit and traverse 2011 * the hash looking for hme_blks to free up. Not only do we free up 2012 * this as hme_blks but all those that are free. We are obviously 2013 * swapping because we need memory so let's free up as much 2014 * as we can. 2015 * 2016 * Note that we don't flush TLB/TSB here -- it's not necessary 2017 * because: 2018 * 1) we free the ctx we're using and throw away the TSB(s); 2019 * 2) processes aren't runnable while being swapped out. 2020 */ 2021 ASSERT(sfmmup != KHATID); 2022 for (i = 0; i <= UHMEHASH_SZ; i++) { 2023 hmebp = &uhme_hash[i]; 2024 SFMMU_HASH_LOCK(hmebp); 2025 hmeblkp = hmebp->hmeblkp; 2026 pr_hblk = NULL; 2027 while (hmeblkp) { 2028 2029 if ((hmeblkp->hblk_tag.htag_id == sfmmup) && 2030 !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) { 2031 ASSERT(!hmeblkp->hblk_shared); 2032 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 2033 (caddr_t)get_hblk_base(hmeblkp), 2034 get_hblk_endaddr(hmeblkp), 2035 NULL, HAT_UNLOAD); 2036 } 2037 nx_hblk = hmeblkp->hblk_next; 2038 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 2039 ASSERT(!hmeblkp->hblk_lckcnt); 2040 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 2041 &list, 0); 2042 } else { 2043 pr_hblk = hmeblkp; 2044 } 2045 hmeblkp = nx_hblk; 2046 } 2047 SFMMU_HASH_UNLOCK(hmebp); 2048 } 2049 2050 sfmmu_hblks_list_purge(&list, 0); 2051 2052 /* 2053 * Now free up the ctx so that others can reuse it. 2054 */ 2055 hatlockp = sfmmu_hat_enter(sfmmup); 2056 2057 sfmmu_invalidate_ctx(sfmmup); 2058 2059 /* 2060 * Free TSBs, but not tsbinfos, and set SWAPPED flag. 2061 * If TSBs were never swapped in, just return. 2062 * This implies that we don't support partial swapping 2063 * of TSBs -- either all are swapped out, or none are. 2064 * 2065 * We must hold the HAT lock here to prevent racing with another 2066 * thread trying to unmap TTEs from the TSB or running the post- 2067 * relocator after relocating the TSB's memory. Unfortunately, we 2068 * can't free memory while holding the HAT lock or we could 2069 * deadlock, so we build a list of TSBs to be freed after marking 2070 * the tsbinfos as swapped out and free them after dropping the 2071 * lock. 2072 */ 2073 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 2074 sfmmu_hat_exit(hatlockp); 2075 return; 2076 } 2077 2078 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED); 2079 last = freelist = NULL; 2080 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 2081 tsbinfop = tsbinfop->tsb_next) { 2082 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0); 2083 2084 /* 2085 * Cast the TSB into a struct free_tsb and put it on the free 2086 * list. 2087 */ 2088 if (freelist == NULL) { 2089 last = freelist = (struct free_tsb *)tsbinfop->tsb_va; 2090 } else { 2091 last->next = (struct free_tsb *)tsbinfop->tsb_va; 2092 last = last->next; 2093 } 2094 last->next = NULL; 2095 last->tsbinfop = tsbinfop; 2096 tsbinfop->tsb_flags |= TSB_SWAPPED; 2097 /* 2098 * Zero out the TTE to clear the valid bit. 2099 * Note we can't use a value like 0xbad because we want to 2100 * ensure diagnostic bits are NEVER set on TTEs that might 2101 * be loaded. The intent is to catch any invalid access 2102 * to the swapped TSB, such as a thread running with a valid 2103 * context without first calling sfmmu_tsb_swapin() to 2104 * allocate TSB memory. 2105 */ 2106 tsbinfop->tsb_tte.ll = 0; 2107 } 2108 2109 /* Now we can drop the lock and free the TSB memory. */ 2110 sfmmu_hat_exit(hatlockp); 2111 for (; freelist != NULL; freelist = next) { 2112 next = freelist->next; 2113 sfmmu_tsb_free(freelist->tsbinfop); 2114 } 2115 } 2116 2117 /* 2118 * Duplicate the translations of an as into another newas 2119 */ 2120 /* ARGSUSED */ 2121 int 2122 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len, 2123 uint_t flag) 2124 { 2125 sf_srd_t *srdp; 2126 sf_scd_t *scdp; 2127 int i; 2128 extern uint_t get_color_start(struct as *); 2129 2130 ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) || 2131 (flag == HAT_DUP_SRD)); 2132 ASSERT(hat != ksfmmup); 2133 ASSERT(newhat != ksfmmup); 2134 ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp); 2135 2136 if (flag == HAT_DUP_COW) { 2137 panic("hat_dup: HAT_DUP_COW not supported"); 2138 } 2139 2140 if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) { 2141 ASSERT(srdp->srd_evp != NULL); 2142 VN_HOLD(srdp->srd_evp); 2143 ASSERT(srdp->srd_refcnt > 0); 2144 newhat->sfmmu_srdp = srdp; 2145 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt); 2146 } 2147 2148 /* 2149 * HAT_DUP_ALL flag is used after as duplication is done. 2150 */ 2151 if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) { 2152 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2); 2153 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags; 2154 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) { 2155 newhat->sfmmu_flags |= HAT_4MTEXT_FLAG; 2156 } 2157 2158 /* check if need to join scd */ 2159 if ((scdp = hat->sfmmu_scdp) != NULL && 2160 newhat->sfmmu_scdp != scdp) { 2161 int ret; 2162 SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map, 2163 &scdp->scd_region_map, ret); 2164 ASSERT(ret); 2165 sfmmu_join_scd(scdp, newhat); 2166 ASSERT(newhat->sfmmu_scdp == scdp && 2167 scdp->scd_refcnt >= 2); 2168 for (i = 0; i < max_mmu_page_sizes; i++) { 2169 newhat->sfmmu_ismttecnt[i] = 2170 hat->sfmmu_ismttecnt[i]; 2171 newhat->sfmmu_scdismttecnt[i] = 2172 hat->sfmmu_scdismttecnt[i]; 2173 } 2174 } 2175 2176 sfmmu_check_page_sizes(newhat, 1); 2177 } 2178 2179 if (flag == HAT_DUP_ALL && consistent_coloring == 0 && 2180 update_proc_pgcolorbase_after_fork != 0) { 2181 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as); 2182 } 2183 return (0); 2184 } 2185 2186 void 2187 hat_memload(struct hat *hat, caddr_t addr, struct page *pp, 2188 uint_t attr, uint_t flags) 2189 { 2190 hat_do_memload(hat, addr, pp, attr, flags, 2191 SFMMU_INVALID_SHMERID); 2192 } 2193 2194 void 2195 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp, 2196 uint_t attr, uint_t flags, hat_region_cookie_t rcookie) 2197 { 2198 uint_t rid; 2199 if (rcookie == HAT_INVALID_REGION_COOKIE) { 2200 hat_do_memload(hat, addr, pp, attr, flags, 2201 SFMMU_INVALID_SHMERID); 2202 return; 2203 } 2204 rid = (uint_t)((uint64_t)rcookie); 2205 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 2206 hat_do_memload(hat, addr, pp, attr, flags, rid); 2207 } 2208 2209 /* 2210 * Set up addr to map to page pp with protection prot. 2211 * As an optimization we also load the TSB with the 2212 * corresponding tte but it is no big deal if the tte gets kicked out. 2213 */ 2214 static void 2215 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp, 2216 uint_t attr, uint_t flags, uint_t rid) 2217 { 2218 tte_t tte; 2219 2220 2221 ASSERT(hat != NULL); 2222 ASSERT(PAGE_LOCKED(pp)); 2223 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 2224 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG)); 2225 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2226 SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE); 2227 2228 if (PP_ISFREE(pp)) { 2229 panic("hat_memload: loading a mapping to free page %p", 2230 (void *)pp); 2231 } 2232 2233 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as)); 2234 2235 if (flags & ~SFMMU_LOAD_ALLFLAG) 2236 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d", 2237 flags & ~SFMMU_LOAD_ALLFLAG); 2238 2239 if (hat->sfmmu_rmstat) 2240 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr); 2241 2242 #if defined(SF_ERRATA_57) 2243 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2244 (addr < errata57_limit) && (attr & PROT_EXEC) && 2245 !(flags & HAT_LOAD_SHARE)) { 2246 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user " 2247 " page executable"); 2248 attr &= ~PROT_EXEC; 2249 } 2250 #endif 2251 2252 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K); 2253 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid); 2254 2255 /* 2256 * Check TSB and TLB page sizes. 2257 */ 2258 if ((flags & HAT_LOAD_SHARE) == 0) { 2259 sfmmu_check_page_sizes(hat, 1); 2260 } 2261 } 2262 2263 /* 2264 * hat_devload can be called to map real memory (e.g. 2265 * /dev/kmem) and even though hat_devload will determine pf is 2266 * for memory, it will be unable to get a shared lock on the 2267 * page (because someone else has it exclusively) and will 2268 * pass dp = NULL. If tteload doesn't get a non-NULL 2269 * page pointer it can't cache memory. 2270 */ 2271 void 2272 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn, 2273 uint_t attr, int flags) 2274 { 2275 tte_t tte; 2276 struct page *pp = NULL; 2277 int use_lgpg = 0; 2278 2279 ASSERT(hat != NULL); 2280 2281 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG)); 2282 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2283 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as)); 2284 if (len == 0) 2285 panic("hat_devload: zero len"); 2286 if (flags & ~SFMMU_LOAD_ALLFLAG) 2287 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d", 2288 flags & ~SFMMU_LOAD_ALLFLAG); 2289 2290 #if defined(SF_ERRATA_57) 2291 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2292 (addr < errata57_limit) && (attr & PROT_EXEC) && 2293 !(flags & HAT_LOAD_SHARE)) { 2294 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user " 2295 " page executable"); 2296 attr &= ~PROT_EXEC; 2297 } 2298 #endif 2299 2300 /* 2301 * If it's a memory page find its pp 2302 */ 2303 if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) { 2304 pp = page_numtopp_nolock(pfn); 2305 if (pp == NULL) { 2306 flags |= HAT_LOAD_NOCONSIST; 2307 } else { 2308 if (PP_ISFREE(pp)) { 2309 panic("hat_memload: loading " 2310 "a mapping to free page %p", 2311 (void *)pp); 2312 } 2313 if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) { 2314 panic("hat_memload: loading a mapping " 2315 "to unlocked relocatable page %p", 2316 (void *)pp); 2317 } 2318 ASSERT(len == MMU_PAGESIZE); 2319 } 2320 } 2321 2322 if (hat->sfmmu_rmstat) 2323 hat_resvstat(len, hat->sfmmu_as, addr); 2324 2325 if (flags & HAT_LOAD_NOCONSIST) { 2326 attr |= SFMMU_UNCACHEVTTE; 2327 use_lgpg = 1; 2328 } 2329 if (!pf_is_memory(pfn)) { 2330 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC; 2331 use_lgpg = 1; 2332 switch (attr & HAT_ORDER_MASK) { 2333 case HAT_STRICTORDER: 2334 case HAT_UNORDERED_OK: 2335 /* 2336 * we set the side effect bit for all non 2337 * memory mappings unless merging is ok 2338 */ 2339 attr |= SFMMU_SIDEFFECT; 2340 break; 2341 case HAT_MERGING_OK: 2342 case HAT_LOADCACHING_OK: 2343 case HAT_STORECACHING_OK: 2344 break; 2345 default: 2346 panic("hat_devload: bad attr"); 2347 break; 2348 } 2349 } 2350 while (len) { 2351 if (!use_lgpg) { 2352 sfmmu_memtte(&tte, pfn, attr, TTE8K); 2353 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2354 flags, SFMMU_INVALID_SHMERID); 2355 len -= MMU_PAGESIZE; 2356 addr += MMU_PAGESIZE; 2357 pfn++; 2358 continue; 2359 } 2360 /* 2361 * try to use large pages, check va/pa alignments 2362 * Note that 32M/256M page sizes are not (yet) supported. 2363 */ 2364 if ((len >= MMU_PAGESIZE4M) && 2365 !((uintptr_t)addr & MMU_PAGEOFFSET4M) && 2366 !(disable_large_pages & (1 << TTE4M)) && 2367 !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) { 2368 sfmmu_memtte(&tte, pfn, attr, TTE4M); 2369 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2370 flags, SFMMU_INVALID_SHMERID); 2371 len -= MMU_PAGESIZE4M; 2372 addr += MMU_PAGESIZE4M; 2373 pfn += MMU_PAGESIZE4M / MMU_PAGESIZE; 2374 } else if ((len >= MMU_PAGESIZE512K) && 2375 !((uintptr_t)addr & MMU_PAGEOFFSET512K) && 2376 !(disable_large_pages & (1 << TTE512K)) && 2377 !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) { 2378 sfmmu_memtte(&tte, pfn, attr, TTE512K); 2379 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2380 flags, SFMMU_INVALID_SHMERID); 2381 len -= MMU_PAGESIZE512K; 2382 addr += MMU_PAGESIZE512K; 2383 pfn += MMU_PAGESIZE512K / MMU_PAGESIZE; 2384 } else if ((len >= MMU_PAGESIZE64K) && 2385 !((uintptr_t)addr & MMU_PAGEOFFSET64K) && 2386 !(disable_large_pages & (1 << TTE64K)) && 2387 !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) { 2388 sfmmu_memtte(&tte, pfn, attr, TTE64K); 2389 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2390 flags, SFMMU_INVALID_SHMERID); 2391 len -= MMU_PAGESIZE64K; 2392 addr += MMU_PAGESIZE64K; 2393 pfn += MMU_PAGESIZE64K / MMU_PAGESIZE; 2394 } else { 2395 sfmmu_memtte(&tte, pfn, attr, TTE8K); 2396 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2397 flags, SFMMU_INVALID_SHMERID); 2398 len -= MMU_PAGESIZE; 2399 addr += MMU_PAGESIZE; 2400 pfn++; 2401 } 2402 } 2403 2404 /* 2405 * Check TSB and TLB page sizes. 2406 */ 2407 if ((flags & HAT_LOAD_SHARE) == 0) { 2408 sfmmu_check_page_sizes(hat, 1); 2409 } 2410 } 2411 2412 void 2413 hat_memload_array(struct hat *hat, caddr_t addr, size_t len, 2414 struct page **pps, uint_t attr, uint_t flags) 2415 { 2416 hat_do_memload_array(hat, addr, len, pps, attr, flags, 2417 SFMMU_INVALID_SHMERID); 2418 } 2419 2420 void 2421 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len, 2422 struct page **pps, uint_t attr, uint_t flags, 2423 hat_region_cookie_t rcookie) 2424 { 2425 uint_t rid; 2426 if (rcookie == HAT_INVALID_REGION_COOKIE) { 2427 hat_do_memload_array(hat, addr, len, pps, attr, flags, 2428 SFMMU_INVALID_SHMERID); 2429 return; 2430 } 2431 rid = (uint_t)((uint64_t)rcookie); 2432 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 2433 hat_do_memload_array(hat, addr, len, pps, attr, flags, rid); 2434 } 2435 2436 /* 2437 * Map the largest extend possible out of the page array. The array may NOT 2438 * be in order. The largest possible mapping a page can have 2439 * is specified in the p_szc field. The p_szc field 2440 * cannot change as long as there any mappings (large or small) 2441 * to any of the pages that make up the large page. (ie. any 2442 * promotion/demotion of page size is not up to the hat but up to 2443 * the page free list manager). The array 2444 * should consist of properly aligned contigous pages that are 2445 * part of a big page for a large mapping to be created. 2446 */ 2447 static void 2448 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len, 2449 struct page **pps, uint_t attr, uint_t flags, uint_t rid) 2450 { 2451 int ttesz; 2452 size_t mapsz; 2453 pgcnt_t numpg, npgs; 2454 tte_t tte; 2455 page_t *pp; 2456 uint_t large_pages_disable; 2457 2458 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 2459 SFMMU_VALIDATE_HMERID(hat, rid, addr, len); 2460 2461 if (hat->sfmmu_rmstat) 2462 hat_resvstat(len, hat->sfmmu_as, addr); 2463 2464 #if defined(SF_ERRATA_57) 2465 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2466 (addr < errata57_limit) && (attr & PROT_EXEC) && 2467 !(flags & HAT_LOAD_SHARE)) { 2468 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make " 2469 "user page executable"); 2470 attr &= ~PROT_EXEC; 2471 } 2472 #endif 2473 2474 /* Get number of pages */ 2475 npgs = len >> MMU_PAGESHIFT; 2476 2477 if (flags & HAT_LOAD_SHARE) { 2478 large_pages_disable = disable_ism_large_pages; 2479 } else { 2480 large_pages_disable = disable_large_pages; 2481 } 2482 2483 if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) { 2484 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs, 2485 rid); 2486 return; 2487 } 2488 2489 while (npgs >= NHMENTS) { 2490 pp = *pps; 2491 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) { 2492 /* 2493 * Check if this page size is disabled. 2494 */ 2495 if (large_pages_disable & (1 << ttesz)) 2496 continue; 2497 2498 numpg = TTEPAGES(ttesz); 2499 mapsz = numpg << MMU_PAGESHIFT; 2500 if ((npgs >= numpg) && 2501 IS_P2ALIGNED(addr, mapsz) && 2502 IS_P2ALIGNED(pp->p_pagenum, numpg)) { 2503 /* 2504 * At this point we have enough pages and 2505 * we know the virtual address and the pfn 2506 * are properly aligned. We still need 2507 * to check for physical contiguity but since 2508 * it is very likely that this is the case 2509 * we will assume they are so and undo 2510 * the request if necessary. It would 2511 * be great if we could get a hint flag 2512 * like HAT_CONTIG which would tell us 2513 * the pages are contigous for sure. 2514 */ 2515 sfmmu_memtte(&tte, (*pps)->p_pagenum, 2516 attr, ttesz); 2517 if (!sfmmu_tteload_array(hat, &tte, addr, 2518 pps, flags, rid)) { 2519 break; 2520 } 2521 } 2522 } 2523 if (ttesz == TTE8K) { 2524 /* 2525 * We were not able to map array using a large page 2526 * batch a hmeblk or fraction at a time. 2527 */ 2528 numpg = ((uintptr_t)addr >> MMU_PAGESHIFT) 2529 & (NHMENTS-1); 2530 numpg = NHMENTS - numpg; 2531 ASSERT(numpg <= npgs); 2532 mapsz = numpg * MMU_PAGESIZE; 2533 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, 2534 numpg, rid); 2535 } 2536 addr += mapsz; 2537 npgs -= numpg; 2538 pps += numpg; 2539 } 2540 2541 if (npgs) { 2542 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs, 2543 rid); 2544 } 2545 2546 /* 2547 * Check TSB and TLB page sizes. 2548 */ 2549 if ((flags & HAT_LOAD_SHARE) == 0) { 2550 sfmmu_check_page_sizes(hat, 1); 2551 } 2552 } 2553 2554 /* 2555 * Function tries to batch 8K pages into the same hme blk. 2556 */ 2557 static void 2558 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps, 2559 uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid) 2560 { 2561 tte_t tte; 2562 page_t *pp; 2563 struct hmehash_bucket *hmebp; 2564 struct hme_blk *hmeblkp; 2565 int index; 2566 2567 while (npgs) { 2568 /* 2569 * Acquire the hash bucket. 2570 */ 2571 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K, 2572 rid); 2573 ASSERT(hmebp); 2574 2575 /* 2576 * Find the hment block. 2577 */ 2578 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr, 2579 TTE8K, flags, rid); 2580 ASSERT(hmeblkp); 2581 2582 do { 2583 /* 2584 * Make the tte. 2585 */ 2586 pp = *pps; 2587 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K); 2588 2589 /* 2590 * Add the translation. 2591 */ 2592 (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte, 2593 vaddr, pps, flags, rid); 2594 2595 /* 2596 * Goto next page. 2597 */ 2598 pps++; 2599 npgs--; 2600 2601 /* 2602 * Goto next address. 2603 */ 2604 vaddr += MMU_PAGESIZE; 2605 2606 /* 2607 * Don't crossover into a different hmentblk. 2608 */ 2609 index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) & 2610 (NHMENTS-1)); 2611 2612 } while (index != 0 && npgs != 0); 2613 2614 /* 2615 * Release the hash bucket. 2616 */ 2617 2618 sfmmu_tteload_release_hashbucket(hmebp); 2619 } 2620 } 2621 2622 /* 2623 * Construct a tte for a page: 2624 * 2625 * tte_valid = 1 2626 * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only) 2627 * tte_size = size 2628 * tte_nfo = attr & HAT_NOFAULT 2629 * tte_ie = attr & HAT_STRUCTURE_LE 2630 * tte_hmenum = hmenum 2631 * tte_pahi = pp->p_pagenum >> TTE_PASHIFT; 2632 * tte_palo = pp->p_pagenum & TTE_PALOMASK; 2633 * tte_ref = 1 (optimization) 2634 * tte_wr_perm = attr & PROT_WRITE; 2635 * tte_no_sync = attr & HAT_NOSYNC 2636 * tte_lock = attr & SFMMU_LOCKTTE 2637 * tte_cp = !(attr & SFMMU_UNCACHEPTTE) 2638 * tte_cv = !(attr & SFMMU_UNCACHEVTTE) 2639 * tte_e = attr & SFMMU_SIDEFFECT 2640 * tte_priv = !(attr & PROT_USER) 2641 * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt) 2642 * tte_glb = 0 2643 */ 2644 void 2645 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz) 2646 { 2647 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2648 2649 ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */); 2650 ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */); 2651 2652 if (TTE_IS_NOSYNC(ttep)) { 2653 TTE_SET_REF(ttep); 2654 if (TTE_IS_WRITABLE(ttep)) { 2655 TTE_SET_MOD(ttep); 2656 } 2657 } 2658 if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) { 2659 panic("sfmmu_memtte: can't set both NFO and EXEC bits"); 2660 } 2661 } 2662 2663 /* 2664 * This function will add a translation to the hme_blk and allocate the 2665 * hme_blk if one does not exist. 2666 * If a page structure is specified then it will add the 2667 * corresponding hment to the mapping list. 2668 * It will also update the hmenum field for the tte. 2669 * 2670 * Currently this function is only used for kernel mappings. 2671 * So pass invalid region to sfmmu_tteload_array(). 2672 */ 2673 void 2674 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp, 2675 uint_t flags) 2676 { 2677 ASSERT(sfmmup == ksfmmup); 2678 (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags, 2679 SFMMU_INVALID_SHMERID); 2680 } 2681 2682 /* 2683 * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB. 2684 * Assumes that a particular page size may only be resident in one TSB. 2685 */ 2686 static void 2687 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz) 2688 { 2689 struct tsb_info *tsbinfop = NULL; 2690 uint64_t tag; 2691 struct tsbe *tsbe_addr; 2692 uint64_t tsb_base; 2693 uint_t tsb_size; 2694 int vpshift = MMU_PAGESHIFT; 2695 int phys = 0; 2696 2697 if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */ 2698 phys = ktsb_phys; 2699 if (ttesz >= TTE4M) { 2700 #ifndef sun4v 2701 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M)); 2702 #endif 2703 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base; 2704 tsb_size = ktsb4m_szcode; 2705 } else { 2706 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base; 2707 tsb_size = ktsb_szcode; 2708 } 2709 } else { 2710 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz); 2711 2712 /* 2713 * If there isn't a TSB for this page size, or the TSB is 2714 * swapped out, there is nothing to do. Note that the latter 2715 * case seems impossible but can occur if hat_pageunload() 2716 * is called on an ISM mapping while the process is swapped 2717 * out. 2718 */ 2719 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED)) 2720 return; 2721 2722 /* 2723 * If another thread is in the middle of relocating a TSB 2724 * we can't unload the entry so set a flag so that the 2725 * TSB will be flushed before it can be accessed by the 2726 * process. 2727 */ 2728 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) { 2729 if (ttep == NULL) 2730 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED; 2731 return; 2732 } 2733 #if defined(UTSB_PHYS) 2734 phys = 1; 2735 tsb_base = (uint64_t)tsbinfop->tsb_pa; 2736 #else 2737 tsb_base = (uint64_t)tsbinfop->tsb_va; 2738 #endif 2739 tsb_size = tsbinfop->tsb_szc; 2740 } 2741 if (ttesz >= TTE4M) 2742 vpshift = MMU_PAGESHIFT4M; 2743 2744 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size); 2745 tag = sfmmu_make_tsbtag(vaddr); 2746 2747 if (ttep == NULL) { 2748 sfmmu_unload_tsbe(tsbe_addr, tag, phys); 2749 } else { 2750 if (ttesz >= TTE4M) { 2751 SFMMU_STAT(sf_tsb_load4m); 2752 } else { 2753 SFMMU_STAT(sf_tsb_load8k); 2754 } 2755 2756 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys); 2757 } 2758 } 2759 2760 /* 2761 * Unmap all entries from [start, end) matching the given page size. 2762 * 2763 * This function is used primarily to unmap replicated 64K or 512K entries 2764 * from the TSB that are inserted using the base page size TSB pointer, but 2765 * it may also be called to unmap a range of addresses from the TSB. 2766 */ 2767 void 2768 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz) 2769 { 2770 struct tsb_info *tsbinfop; 2771 uint64_t tag; 2772 struct tsbe *tsbe_addr; 2773 caddr_t vaddr; 2774 uint64_t tsb_base; 2775 int vpshift, vpgsz; 2776 uint_t tsb_size; 2777 int phys = 0; 2778 2779 /* 2780 * Assumptions: 2781 * If ttesz == 8K, 64K or 512K, we walk through the range 8K 2782 * at a time shooting down any valid entries we encounter. 2783 * 2784 * If ttesz >= 4M we walk the range 4M at a time shooting 2785 * down any valid mappings we find. 2786 */ 2787 if (sfmmup == ksfmmup) { 2788 phys = ktsb_phys; 2789 if (ttesz >= TTE4M) { 2790 #ifndef sun4v 2791 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M)); 2792 #endif 2793 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base; 2794 tsb_size = ktsb4m_szcode; 2795 } else { 2796 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base; 2797 tsb_size = ktsb_szcode; 2798 } 2799 } else { 2800 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz); 2801 2802 /* 2803 * If there isn't a TSB for this page size, or the TSB is 2804 * swapped out, there is nothing to do. Note that the latter 2805 * case seems impossible but can occur if hat_pageunload() 2806 * is called on an ISM mapping while the process is swapped 2807 * out. 2808 */ 2809 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED)) 2810 return; 2811 2812 /* 2813 * If another thread is in the middle of relocating a TSB 2814 * we can't unload the entry so set a flag so that the 2815 * TSB will be flushed before it can be accessed by the 2816 * process. 2817 */ 2818 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) { 2819 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED; 2820 return; 2821 } 2822 #if defined(UTSB_PHYS) 2823 phys = 1; 2824 tsb_base = (uint64_t)tsbinfop->tsb_pa; 2825 #else 2826 tsb_base = (uint64_t)tsbinfop->tsb_va; 2827 #endif 2828 tsb_size = tsbinfop->tsb_szc; 2829 } 2830 if (ttesz >= TTE4M) { 2831 vpshift = MMU_PAGESHIFT4M; 2832 vpgsz = MMU_PAGESIZE4M; 2833 } else { 2834 vpshift = MMU_PAGESHIFT; 2835 vpgsz = MMU_PAGESIZE; 2836 } 2837 2838 for (vaddr = start; vaddr < end; vaddr += vpgsz) { 2839 tag = sfmmu_make_tsbtag(vaddr); 2840 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size); 2841 sfmmu_unload_tsbe(tsbe_addr, tag, phys); 2842 } 2843 } 2844 2845 /* 2846 * Select the optimum TSB size given the number of mappings 2847 * that need to be cached. 2848 */ 2849 static int 2850 sfmmu_select_tsb_szc(pgcnt_t pgcnt) 2851 { 2852 int szc = 0; 2853 2854 #ifdef DEBUG 2855 if (tsb_grow_stress) { 2856 uint32_t randval = (uint32_t)gettick() >> 4; 2857 return (randval % (tsb_max_growsize + 1)); 2858 } 2859 #endif /* DEBUG */ 2860 2861 while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc))) 2862 szc++; 2863 return (szc); 2864 } 2865 2866 /* 2867 * This function will add a translation to the hme_blk and allocate the 2868 * hme_blk if one does not exist. 2869 * If a page structure is specified then it will add the 2870 * corresponding hment to the mapping list. 2871 * It will also update the hmenum field for the tte. 2872 * Furthermore, it attempts to create a large page translation 2873 * for <addr,hat> at page array pps. It assumes addr and first 2874 * pp is correctly aligned. It returns 0 if successful and 1 otherwise. 2875 */ 2876 static int 2877 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr, 2878 page_t **pps, uint_t flags, uint_t rid) 2879 { 2880 struct hmehash_bucket *hmebp; 2881 struct hme_blk *hmeblkp; 2882 int ret; 2883 uint_t size; 2884 2885 /* 2886 * Get mapping size. 2887 */ 2888 size = TTE_CSZ(ttep); 2889 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size))); 2890 2891 /* 2892 * Acquire the hash bucket. 2893 */ 2894 hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid); 2895 ASSERT(hmebp); 2896 2897 /* 2898 * Find the hment block. 2899 */ 2900 hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags, 2901 rid); 2902 ASSERT(hmeblkp); 2903 2904 /* 2905 * Add the translation. 2906 */ 2907 ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags, 2908 rid); 2909 2910 /* 2911 * Release the hash bucket. 2912 */ 2913 sfmmu_tteload_release_hashbucket(hmebp); 2914 2915 return (ret); 2916 } 2917 2918 /* 2919 * Function locks and returns a pointer to the hash bucket for vaddr and size. 2920 */ 2921 static struct hmehash_bucket * 2922 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size, 2923 uint_t rid) 2924 { 2925 struct hmehash_bucket *hmebp; 2926 int hmeshift; 2927 void *htagid = sfmmutohtagid(sfmmup, rid); 2928 2929 ASSERT(htagid != NULL); 2930 2931 hmeshift = HME_HASH_SHIFT(size); 2932 2933 hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift); 2934 2935 SFMMU_HASH_LOCK(hmebp); 2936 2937 return (hmebp); 2938 } 2939 2940 /* 2941 * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the 2942 * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is 2943 * allocated. 2944 */ 2945 static struct hme_blk * 2946 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp, 2947 caddr_t vaddr, uint_t size, uint_t flags, uint_t rid) 2948 { 2949 hmeblk_tag hblktag; 2950 int hmeshift; 2951 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL; 2952 2953 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 2954 2955 hblktag.htag_id = sfmmutohtagid(sfmmup, rid); 2956 ASSERT(hblktag.htag_id != NULL); 2957 hmeshift = HME_HASH_SHIFT(size); 2958 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 2959 hblktag.htag_rehash = HME_HASH_REHASH(size); 2960 hblktag.htag_rid = rid; 2961 2962 ttearray_realloc: 2963 2964 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 2965 2966 /* 2967 * We block until hblk_reserve_lock is released; it's held by 2968 * the thread, temporarily using hblk_reserve, until hblk_reserve is 2969 * replaced by a hblk from sfmmu8_cache. 2970 */ 2971 if (hmeblkp == (struct hme_blk *)hblk_reserve && 2972 hblk_reserve_thread != curthread) { 2973 SFMMU_HASH_UNLOCK(hmebp); 2974 mutex_enter(&hblk_reserve_lock); 2975 mutex_exit(&hblk_reserve_lock); 2976 SFMMU_STAT(sf_hblk_reserve_hit); 2977 SFMMU_HASH_LOCK(hmebp); 2978 goto ttearray_realloc; 2979 } 2980 2981 if (hmeblkp == NULL) { 2982 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size, 2983 hblktag, flags, rid); 2984 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 2985 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 2986 } else { 2987 /* 2988 * It is possible for 8k and 64k hblks to collide since they 2989 * have the same rehash value. This is because we 2990 * lazily free hblks and 8K/64K blks could be lingering. 2991 * If we find size mismatch we free the block and & try again. 2992 */ 2993 if (get_hblk_ttesz(hmeblkp) != size) { 2994 ASSERT(!hmeblkp->hblk_vcnt); 2995 ASSERT(!hmeblkp->hblk_hmecnt); 2996 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 2997 &list, 0); 2998 goto ttearray_realloc; 2999 } 3000 if (hmeblkp->hblk_shw_bit) { 3001 /* 3002 * if the hblk was previously used as a shadow hblk then 3003 * we will change it to a normal hblk 3004 */ 3005 ASSERT(!hmeblkp->hblk_shared); 3006 if (hmeblkp->hblk_shw_mask) { 3007 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp); 3008 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3009 goto ttearray_realloc; 3010 } else { 3011 hmeblkp->hblk_shw_bit = 0; 3012 } 3013 } 3014 SFMMU_STAT(sf_hblk_hit); 3015 } 3016 3017 /* 3018 * hat_memload() should never call kmem_cache_free() for kernel hmeblks; 3019 * see block comment showing the stacktrace in sfmmu_hblk_alloc(); 3020 * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will 3021 * just add these hmeblks to the per-cpu pending queue. 3022 */ 3023 sfmmu_hblks_list_purge(&list, 1); 3024 3025 ASSERT(get_hblk_ttesz(hmeblkp) == size); 3026 ASSERT(!hmeblkp->hblk_shw_bit); 3027 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 3028 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 3029 ASSERT(hmeblkp->hblk_tag.htag_rid == rid); 3030 3031 return (hmeblkp); 3032 } 3033 3034 /* 3035 * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1 3036 * otherwise. 3037 */ 3038 static int 3039 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep, 3040 caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid) 3041 { 3042 page_t *pp = *pps; 3043 int hmenum, size, remap; 3044 tte_t tteold, flush_tte; 3045 #ifdef DEBUG 3046 tte_t orig_old; 3047 #endif /* DEBUG */ 3048 struct sf_hment *sfhme; 3049 kmutex_t *pml, *pmtx; 3050 hatlock_t *hatlockp; 3051 int myflt; 3052 3053 /* 3054 * remove this panic when we decide to let user virtual address 3055 * space be >= USERLIMIT. 3056 */ 3057 if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT) 3058 panic("user addr %p in kernel space", (void *)vaddr); 3059 #if defined(TTE_IS_GLOBAL) 3060 if (TTE_IS_GLOBAL(ttep)) 3061 panic("sfmmu_tteload: creating global tte"); 3062 #endif 3063 3064 #ifdef DEBUG 3065 if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) && 3066 !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans) 3067 panic("sfmmu_tteload: non cacheable memory tte"); 3068 #endif /* DEBUG */ 3069 3070 /* don't simulate dirty bit for writeable ISM/DISM mappings */ 3071 if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) { 3072 TTE_SET_REF(ttep); 3073 TTE_SET_MOD(ttep); 3074 } 3075 3076 if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) || 3077 !TTE_IS_MOD(ttep)) { 3078 /* 3079 * Don't load TSB for dummy as in ISM. Also don't preload 3080 * the TSB if the TTE isn't writable since we're likely to 3081 * fault on it again -- preloading can be fairly expensive. 3082 */ 3083 flags |= SFMMU_NO_TSBLOAD; 3084 } 3085 3086 size = TTE_CSZ(ttep); 3087 switch (size) { 3088 case TTE8K: 3089 SFMMU_STAT(sf_tteload8k); 3090 break; 3091 case TTE64K: 3092 SFMMU_STAT(sf_tteload64k); 3093 break; 3094 case TTE512K: 3095 SFMMU_STAT(sf_tteload512k); 3096 break; 3097 case TTE4M: 3098 SFMMU_STAT(sf_tteload4m); 3099 break; 3100 case (TTE32M): 3101 SFMMU_STAT(sf_tteload32m); 3102 ASSERT(mmu_page_sizes == max_mmu_page_sizes); 3103 break; 3104 case (TTE256M): 3105 SFMMU_STAT(sf_tteload256m); 3106 ASSERT(mmu_page_sizes == max_mmu_page_sizes); 3107 break; 3108 } 3109 3110 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size))); 3111 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 3112 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 3113 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 3114 3115 HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum); 3116 3117 /* 3118 * Need to grab mlist lock here so that pageunload 3119 * will not change tte behind us. 3120 */ 3121 if (pp) { 3122 pml = sfmmu_mlist_enter(pp); 3123 } 3124 3125 sfmmu_copytte(&sfhme->hme_tte, &tteold); 3126 /* 3127 * Look for corresponding hment and if valid verify 3128 * pfns are equal. 3129 */ 3130 remap = TTE_IS_VALID(&tteold); 3131 if (remap) { 3132 pfn_t new_pfn, old_pfn; 3133 3134 old_pfn = TTE_TO_PFN(vaddr, &tteold); 3135 new_pfn = TTE_TO_PFN(vaddr, ttep); 3136 3137 if (flags & HAT_LOAD_REMAP) { 3138 /* make sure we are remapping same type of pages */ 3139 if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) { 3140 panic("sfmmu_tteload - tte remap io<->memory"); 3141 } 3142 if (old_pfn != new_pfn && 3143 (pp != NULL || sfhme->hme_page != NULL)) { 3144 panic("sfmmu_tteload - tte remap pp != NULL"); 3145 } 3146 } else if (old_pfn != new_pfn) { 3147 panic("sfmmu_tteload - tte remap, hmeblkp 0x%p", 3148 (void *)hmeblkp); 3149 } 3150 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep)); 3151 } 3152 3153 if (pp) { 3154 if (size == TTE8K) { 3155 #ifdef VAC 3156 /* 3157 * Handle VAC consistency 3158 */ 3159 if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) { 3160 sfmmu_vac_conflict(sfmmup, vaddr, pp); 3161 } 3162 #endif 3163 3164 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) { 3165 pmtx = sfmmu_page_enter(pp); 3166 PP_CLRRO(pp); 3167 sfmmu_page_exit(pmtx); 3168 } else if (!PP_ISMAPPED(pp) && 3169 (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) { 3170 pmtx = sfmmu_page_enter(pp); 3171 if (!(PP_ISMOD(pp))) { 3172 PP_SETRO(pp); 3173 } 3174 sfmmu_page_exit(pmtx); 3175 } 3176 3177 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) { 3178 /* 3179 * sfmmu_pagearray_setup failed so return 3180 */ 3181 sfmmu_mlist_exit(pml); 3182 return (1); 3183 } 3184 } 3185 3186 /* 3187 * Make sure hment is not on a mapping list. 3188 */ 3189 ASSERT(remap || (sfhme->hme_page == NULL)); 3190 3191 /* if it is not a remap then hme->next better be NULL */ 3192 ASSERT((!remap) ? sfhme->hme_next == NULL : 1); 3193 3194 if (flags & HAT_LOAD_LOCK) { 3195 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) { 3196 panic("too high lckcnt-hmeblk %p", 3197 (void *)hmeblkp); 3198 } 3199 atomic_inc_32(&hmeblkp->hblk_lckcnt); 3200 3201 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK); 3202 } 3203 3204 #ifdef VAC 3205 if (pp && PP_ISNC(pp)) { 3206 /* 3207 * If the physical page is marked to be uncacheable, like 3208 * by a vac conflict, make sure the new mapping is also 3209 * uncacheable. 3210 */ 3211 TTE_CLR_VCACHEABLE(ttep); 3212 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR); 3213 } 3214 #endif 3215 ttep->tte_hmenum = hmenum; 3216 3217 #ifdef DEBUG 3218 orig_old = tteold; 3219 #endif /* DEBUG */ 3220 3221 while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) { 3222 if ((sfmmup == KHATID) && 3223 (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) { 3224 sfmmu_copytte(&sfhme->hme_tte, &tteold); 3225 } 3226 #ifdef DEBUG 3227 chk_tte(&orig_old, &tteold, ttep, hmeblkp); 3228 #endif /* DEBUG */ 3229 } 3230 ASSERT(TTE_IS_VALID(&sfhme->hme_tte)); 3231 3232 if (!TTE_IS_VALID(&tteold)) { 3233 3234 atomic_inc_16(&hmeblkp->hblk_vcnt); 3235 if (rid == SFMMU_INVALID_SHMERID) { 3236 atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]); 3237 } else { 3238 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 3239 sf_region_t *rgnp = srdp->srd_hmergnp[rid]; 3240 /* 3241 * We already accounted for region ttecnt's in sfmmu 3242 * during hat_join_region() processing. Here we 3243 * only update ttecnt's in region struture. 3244 */ 3245 atomic_inc_ulong(&rgnp->rgn_ttecnt[size]); 3246 } 3247 } 3248 3249 myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup); 3250 if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 && 3251 sfmmup != ksfmmup) { 3252 uchar_t tteflag = 1 << size; 3253 if (rid == SFMMU_INVALID_SHMERID) { 3254 if (!(sfmmup->sfmmu_tteflags & tteflag)) { 3255 hatlockp = sfmmu_hat_enter(sfmmup); 3256 sfmmup->sfmmu_tteflags |= tteflag; 3257 sfmmu_hat_exit(hatlockp); 3258 } 3259 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) { 3260 hatlockp = sfmmu_hat_enter(sfmmup); 3261 sfmmup->sfmmu_rtteflags |= tteflag; 3262 sfmmu_hat_exit(hatlockp); 3263 } 3264 /* 3265 * Update the current CPU tsbmiss area, so the current thread 3266 * won't need to take the tsbmiss for the new pagesize. 3267 * The other threads in the process will update their tsb 3268 * miss area lazily in sfmmu_tsbmiss_exception() when they 3269 * fail to find the translation for a newly added pagesize. 3270 */ 3271 if (size > TTE64K && myflt) { 3272 struct tsbmiss *tsbmp; 3273 kpreempt_disable(); 3274 tsbmp = &tsbmiss_area[CPU->cpu_id]; 3275 if (rid == SFMMU_INVALID_SHMERID) { 3276 if (!(tsbmp->uhat_tteflags & tteflag)) { 3277 tsbmp->uhat_tteflags |= tteflag; 3278 } 3279 } else { 3280 if (!(tsbmp->uhat_rtteflags & tteflag)) { 3281 tsbmp->uhat_rtteflags |= tteflag; 3282 } 3283 } 3284 kpreempt_enable(); 3285 } 3286 } 3287 3288 if (size >= TTE4M && (flags & HAT_LOAD_TEXT) && 3289 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) { 3290 hatlockp = sfmmu_hat_enter(sfmmup); 3291 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG); 3292 sfmmu_hat_exit(hatlockp); 3293 } 3294 3295 flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) & 3296 hw_tte.tte_intlo; 3297 flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) & 3298 hw_tte.tte_inthi; 3299 3300 if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) { 3301 /* 3302 * If remap and new tte differs from old tte we need 3303 * to sync the mod bit and flush TLB/TSB. We don't 3304 * need to sync ref bit because we currently always set 3305 * ref bit in tteload. 3306 */ 3307 ASSERT(TTE_IS_REF(ttep)); 3308 if (TTE_IS_MOD(&tteold)) { 3309 sfmmu_ttesync(sfmmup, vaddr, &tteold, pp); 3310 } 3311 /* 3312 * hwtte bits shouldn't change for SRD hmeblks as long as SRD 3313 * hmes are only used for read only text. Adding this code for 3314 * completeness and future use of shared hmeblks with writable 3315 * mappings of VMODSORT vnodes. 3316 */ 3317 if (hmeblkp->hblk_shared) { 3318 cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr, 3319 sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1); 3320 xt_sync(cpuset); 3321 SFMMU_STAT_ADD(sf_region_remap_demap, 1); 3322 } else { 3323 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0); 3324 xt_sync(sfmmup->sfmmu_cpusran); 3325 } 3326 } 3327 3328 if ((flags & SFMMU_NO_TSBLOAD) == 0) { 3329 /* 3330 * We only preload 8K and 4M mappings into the TSB, since 3331 * 64K and 512K mappings are replicated and hence don't 3332 * have a single, unique TSB entry. Ditto for 32M/256M. 3333 */ 3334 if (size == TTE8K || size == TTE4M) { 3335 sf_scd_t *scdp; 3336 hatlockp = sfmmu_hat_enter(sfmmup); 3337 /* 3338 * Don't preload private TSB if the mapping is used 3339 * by the shctx in the SCD. 3340 */ 3341 scdp = sfmmup->sfmmu_scdp; 3342 if (rid == SFMMU_INVALID_SHMERID || scdp == NULL || 3343 !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 3344 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte, 3345 size); 3346 } 3347 sfmmu_hat_exit(hatlockp); 3348 } 3349 } 3350 if (pp) { 3351 if (!remap) { 3352 HME_ADD(sfhme, pp); 3353 atomic_inc_16(&hmeblkp->hblk_hmecnt); 3354 ASSERT(hmeblkp->hblk_hmecnt > 0); 3355 3356 /* 3357 * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS) 3358 * see pageunload() for comment. 3359 */ 3360 } 3361 sfmmu_mlist_exit(pml); 3362 } 3363 3364 return (0); 3365 } 3366 /* 3367 * Function unlocks hash bucket. 3368 */ 3369 static void 3370 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp) 3371 { 3372 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3373 SFMMU_HASH_UNLOCK(hmebp); 3374 } 3375 3376 /* 3377 * function which checks and sets up page array for a large 3378 * translation. Will set p_vcolor, p_index, p_ro fields. 3379 * Assumes addr and pfnum of first page are properly aligned. 3380 * Will check for physical contiguity. If check fails it return 3381 * non null. 3382 */ 3383 static int 3384 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap) 3385 { 3386 int i, index, ttesz; 3387 pfn_t pfnum; 3388 pgcnt_t npgs; 3389 page_t *pp, *pp1; 3390 kmutex_t *pmtx; 3391 #ifdef VAC 3392 int osz; 3393 int cflags = 0; 3394 int vac_err = 0; 3395 #endif 3396 int newidx = 0; 3397 3398 ttesz = TTE_CSZ(ttep); 3399 3400 ASSERT(ttesz > TTE8K); 3401 3402 npgs = TTEPAGES(ttesz); 3403 index = PAGESZ_TO_INDEX(ttesz); 3404 3405 pfnum = (*pps)->p_pagenum; 3406 ASSERT(IS_P2ALIGNED(pfnum, npgs)); 3407 3408 /* 3409 * Save the first pp so we can do HAT_TMPNC at the end. 3410 */ 3411 pp1 = *pps; 3412 #ifdef VAC 3413 osz = fnd_mapping_sz(pp1); 3414 #endif 3415 3416 for (i = 0; i < npgs; i++, pps++) { 3417 pp = *pps; 3418 ASSERT(PAGE_LOCKED(pp)); 3419 ASSERT(pp->p_szc >= ttesz); 3420 ASSERT(pp->p_szc == pp1->p_szc); 3421 ASSERT(sfmmu_mlist_held(pp)); 3422 3423 /* 3424 * XXX is it possible to maintain P_RO on the root only? 3425 */ 3426 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) { 3427 pmtx = sfmmu_page_enter(pp); 3428 PP_CLRRO(pp); 3429 sfmmu_page_exit(pmtx); 3430 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) && 3431 !PP_ISMOD(pp)) { 3432 pmtx = sfmmu_page_enter(pp); 3433 if (!(PP_ISMOD(pp))) { 3434 PP_SETRO(pp); 3435 } 3436 sfmmu_page_exit(pmtx); 3437 } 3438 3439 /* 3440 * If this is a remap we skip vac & contiguity checks. 3441 */ 3442 if (remap) 3443 continue; 3444 3445 /* 3446 * set p_vcolor and detect any vac conflicts. 3447 */ 3448 #ifdef VAC 3449 if (vac_err == 0) { 3450 vac_err = sfmmu_vacconflict_array(addr, pp, &cflags); 3451 3452 } 3453 #endif 3454 3455 /* 3456 * Save current index in case we need to undo it. 3457 * Note: "PAGESZ_TO_INDEX(sz) (1 << (sz))" 3458 * "SFMMU_INDEX_SHIFT 6" 3459 * "SFMMU_INDEX_MASK ((1 << SFMMU_INDEX_SHIFT) - 1)" 3460 * "PP_MAPINDEX(p_index) (p_index & SFMMU_INDEX_MASK)" 3461 * 3462 * So: index = PAGESZ_TO_INDEX(ttesz); 3463 * if ttesz == 1 then index = 0x2 3464 * 2 then index = 0x4 3465 * 3 then index = 0x8 3466 * 4 then index = 0x10 3467 * 5 then index = 0x20 3468 * The code below checks if it's a new pagesize (ie, newidx) 3469 * in case we need to take it back out of p_index, 3470 * and then or's the new index into the existing index. 3471 */ 3472 if ((PP_MAPINDEX(pp) & index) == 0) 3473 newidx = 1; 3474 pp->p_index = (PP_MAPINDEX(pp) | index); 3475 3476 /* 3477 * contiguity check 3478 */ 3479 if (pp->p_pagenum != pfnum) { 3480 /* 3481 * If we fail the contiguity test then 3482 * the only thing we need to fix is the p_index field. 3483 * We might get a few extra flushes but since this 3484 * path is rare that is ok. The p_ro field will 3485 * get automatically fixed on the next tteload to 3486 * the page. NO TNC bit is set yet. 3487 */ 3488 while (i >= 0) { 3489 pp = *pps; 3490 if (newidx) 3491 pp->p_index = (PP_MAPINDEX(pp) & 3492 ~index); 3493 pps--; 3494 i--; 3495 } 3496 return (1); 3497 } 3498 pfnum++; 3499 addr += MMU_PAGESIZE; 3500 } 3501 3502 #ifdef VAC 3503 if (vac_err) { 3504 if (ttesz > osz) { 3505 /* 3506 * There are some smaller mappings that causes vac 3507 * conflicts. Convert all existing small mappings to 3508 * TNC. 3509 */ 3510 SFMMU_STAT_ADD(sf_uncache_conflict, npgs); 3511 sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH, 3512 npgs); 3513 } else { 3514 /* EMPTY */ 3515 /* 3516 * If there exists an big page mapping, 3517 * that means the whole existing big page 3518 * has TNC setting already. No need to covert to 3519 * TNC again. 3520 */ 3521 ASSERT(PP_ISTNC(pp1)); 3522 } 3523 } 3524 #endif /* VAC */ 3525 3526 return (0); 3527 } 3528 3529 #ifdef VAC 3530 /* 3531 * Routine that detects vac consistency for a large page. It also 3532 * sets virtual color for all pp's for this big mapping. 3533 */ 3534 static int 3535 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags) 3536 { 3537 int vcolor, ocolor; 3538 3539 ASSERT(sfmmu_mlist_held(pp)); 3540 3541 if (PP_ISNC(pp)) { 3542 return (HAT_TMPNC); 3543 } 3544 3545 vcolor = addr_to_vcolor(addr); 3546 if (PP_NEWPAGE(pp)) { 3547 PP_SET_VCOLOR(pp, vcolor); 3548 return (0); 3549 } 3550 3551 ocolor = PP_GET_VCOLOR(pp); 3552 if (ocolor == vcolor) { 3553 return (0); 3554 } 3555 3556 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) { 3557 /* 3558 * Previous user of page had a differnet color 3559 * but since there are no current users 3560 * we just flush the cache and change the color. 3561 * As an optimization for large pages we flush the 3562 * entire cache of that color and set a flag. 3563 */ 3564 SFMMU_STAT(sf_pgcolor_conflict); 3565 if (!CacheColor_IsFlushed(*cflags, ocolor)) { 3566 CacheColor_SetFlushed(*cflags, ocolor); 3567 sfmmu_cache_flushcolor(ocolor, pp->p_pagenum); 3568 } 3569 PP_SET_VCOLOR(pp, vcolor); 3570 return (0); 3571 } 3572 3573 /* 3574 * We got a real conflict with a current mapping. 3575 * set flags to start unencaching all mappings 3576 * and return failure so we restart looping 3577 * the pp array from the beginning. 3578 */ 3579 return (HAT_TMPNC); 3580 } 3581 #endif /* VAC */ 3582 3583 /* 3584 * creates a large page shadow hmeblk for a tte. 3585 * The purpose of this routine is to allow us to do quick unloads because 3586 * the vm layer can easily pass a very large but sparsely populated range. 3587 */ 3588 static struct hme_blk * 3589 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags) 3590 { 3591 struct hmehash_bucket *hmebp; 3592 hmeblk_tag hblktag; 3593 int hmeshift, size, vshift; 3594 uint_t shw_mask, newshw_mask; 3595 struct hme_blk *hmeblkp; 3596 3597 ASSERT(sfmmup != KHATID); 3598 if (mmu_page_sizes == max_mmu_page_sizes) { 3599 ASSERT(ttesz < TTE256M); 3600 } else { 3601 ASSERT(ttesz < TTE4M); 3602 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 3603 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 3604 } 3605 3606 if (ttesz == TTE8K) { 3607 size = TTE512K; 3608 } else { 3609 size = ++ttesz; 3610 } 3611 3612 hblktag.htag_id = sfmmup; 3613 hmeshift = HME_HASH_SHIFT(size); 3614 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 3615 hblktag.htag_rehash = HME_HASH_REHASH(size); 3616 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3617 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift); 3618 3619 SFMMU_HASH_LOCK(hmebp); 3620 3621 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 3622 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve); 3623 if (hmeblkp == NULL) { 3624 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size, 3625 hblktag, flags, SFMMU_INVALID_SHMERID); 3626 } 3627 ASSERT(hmeblkp); 3628 if (!hmeblkp->hblk_shw_mask) { 3629 /* 3630 * if this is a unused hblk it was just allocated or could 3631 * potentially be a previous large page hblk so we need to 3632 * set the shadow bit. 3633 */ 3634 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt); 3635 hmeblkp->hblk_shw_bit = 1; 3636 } else if (hmeblkp->hblk_shw_bit == 0) { 3637 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p", 3638 (void *)hmeblkp); 3639 } 3640 ASSERT(hmeblkp->hblk_shw_bit == 1); 3641 ASSERT(!hmeblkp->hblk_shared); 3642 vshift = vaddr_to_vshift(hblktag, vaddr, size); 3643 ASSERT(vshift < 8); 3644 /* 3645 * Atomically set shw mask bit 3646 */ 3647 do { 3648 shw_mask = hmeblkp->hblk_shw_mask; 3649 newshw_mask = shw_mask | (1 << vshift); 3650 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask, 3651 newshw_mask); 3652 } while (newshw_mask != shw_mask); 3653 3654 SFMMU_HASH_UNLOCK(hmebp); 3655 3656 return (hmeblkp); 3657 } 3658 3659 /* 3660 * This routine cleanup a previous shadow hmeblk and changes it to 3661 * a regular hblk. This happens rarely but it is possible 3662 * when a process wants to use large pages and there are hblks still 3663 * lying around from the previous as that used these hmeblks. 3664 * The alternative was to cleanup the shadow hblks at unload time 3665 * but since so few user processes actually use large pages, it is 3666 * better to be lazy and cleanup at this time. 3667 */ 3668 static void 3669 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 3670 struct hmehash_bucket *hmebp) 3671 { 3672 caddr_t addr, endaddr; 3673 int hashno, size; 3674 3675 ASSERT(hmeblkp->hblk_shw_bit); 3676 ASSERT(!hmeblkp->hblk_shared); 3677 3678 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3679 3680 if (!hmeblkp->hblk_shw_mask) { 3681 hmeblkp->hblk_shw_bit = 0; 3682 return; 3683 } 3684 addr = (caddr_t)get_hblk_base(hmeblkp); 3685 endaddr = get_hblk_endaddr(hmeblkp); 3686 size = get_hblk_ttesz(hmeblkp); 3687 hashno = size - 1; 3688 ASSERT(hashno > 0); 3689 SFMMU_HASH_UNLOCK(hmebp); 3690 3691 sfmmu_free_hblks(sfmmup, addr, endaddr, hashno); 3692 3693 SFMMU_HASH_LOCK(hmebp); 3694 } 3695 3696 static void 3697 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr, 3698 int hashno) 3699 { 3700 int hmeshift, shadow = 0; 3701 hmeblk_tag hblktag; 3702 struct hmehash_bucket *hmebp; 3703 struct hme_blk *hmeblkp; 3704 struct hme_blk *nx_hblk, *pr_hblk, *list = NULL; 3705 3706 ASSERT(hashno > 0); 3707 hblktag.htag_id = sfmmup; 3708 hblktag.htag_rehash = hashno; 3709 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3710 3711 hmeshift = HME_HASH_SHIFT(hashno); 3712 3713 while (addr < endaddr) { 3714 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3715 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 3716 SFMMU_HASH_LOCK(hmebp); 3717 /* inline HME_HASH_SEARCH */ 3718 hmeblkp = hmebp->hmeblkp; 3719 pr_hblk = NULL; 3720 while (hmeblkp) { 3721 if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) { 3722 /* found hme_blk */ 3723 ASSERT(!hmeblkp->hblk_shared); 3724 if (hmeblkp->hblk_shw_bit) { 3725 if (hmeblkp->hblk_shw_mask) { 3726 shadow = 1; 3727 sfmmu_shadow_hcleanup(sfmmup, 3728 hmeblkp, hmebp); 3729 break; 3730 } else { 3731 hmeblkp->hblk_shw_bit = 0; 3732 } 3733 } 3734 3735 /* 3736 * Hblk_hmecnt and hblk_vcnt could be non zero 3737 * since hblk_unload() does not gurantee that. 3738 * 3739 * XXX - this could cause tteload() to spin 3740 * where sfmmu_shadow_hcleanup() is called. 3741 */ 3742 } 3743 3744 nx_hblk = hmeblkp->hblk_next; 3745 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 3746 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3747 &list, 0); 3748 } else { 3749 pr_hblk = hmeblkp; 3750 } 3751 hmeblkp = nx_hblk; 3752 } 3753 3754 SFMMU_HASH_UNLOCK(hmebp); 3755 3756 if (shadow) { 3757 /* 3758 * We found another shadow hblk so cleaned its 3759 * children. We need to go back and cleanup 3760 * the original hblk so we don't change the 3761 * addr. 3762 */ 3763 shadow = 0; 3764 } else { 3765 addr = (caddr_t)roundup((uintptr_t)addr + 1, 3766 (1 << hmeshift)); 3767 } 3768 } 3769 sfmmu_hblks_list_purge(&list, 0); 3770 } 3771 3772 /* 3773 * This routine's job is to delete stale invalid shared hmeregions hmeblks that 3774 * may still linger on after pageunload. 3775 */ 3776 static void 3777 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz) 3778 { 3779 int hmeshift; 3780 hmeblk_tag hblktag; 3781 struct hmehash_bucket *hmebp; 3782 struct hme_blk *hmeblkp; 3783 struct hme_blk *pr_hblk; 3784 struct hme_blk *list = NULL; 3785 3786 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3787 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3788 3789 hmeshift = HME_HASH_SHIFT(ttesz); 3790 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3791 hblktag.htag_rehash = ttesz; 3792 hblktag.htag_rid = rid; 3793 hblktag.htag_id = srdp; 3794 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift); 3795 3796 SFMMU_HASH_LOCK(hmebp); 3797 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 3798 if (hmeblkp != NULL) { 3799 ASSERT(hmeblkp->hblk_shared); 3800 ASSERT(!hmeblkp->hblk_shw_bit); 3801 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 3802 panic("sfmmu_cleanup_rhblk: valid hmeblk"); 3803 } 3804 ASSERT(!hmeblkp->hblk_lckcnt); 3805 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3806 &list, 0); 3807 } 3808 SFMMU_HASH_UNLOCK(hmebp); 3809 sfmmu_hblks_list_purge(&list, 0); 3810 } 3811 3812 /* ARGSUSED */ 3813 static void 3814 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr, 3815 size_t r_size, void *r_obj, u_offset_t r_objoff) 3816 { 3817 } 3818 3819 /* 3820 * Searches for an hmeblk which maps addr, then unloads this mapping 3821 * and updates *eaddrp, if the hmeblk is found. 3822 */ 3823 static void 3824 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr, 3825 caddr_t eaddr, int ttesz, caddr_t *eaddrp) 3826 { 3827 int hmeshift; 3828 hmeblk_tag hblktag; 3829 struct hmehash_bucket *hmebp; 3830 struct hme_blk *hmeblkp; 3831 struct hme_blk *pr_hblk; 3832 struct hme_blk *list = NULL; 3833 3834 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3835 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3836 ASSERT(ttesz >= HBLK_MIN_TTESZ); 3837 3838 hmeshift = HME_HASH_SHIFT(ttesz); 3839 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3840 hblktag.htag_rehash = ttesz; 3841 hblktag.htag_rid = rid; 3842 hblktag.htag_id = srdp; 3843 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift); 3844 3845 SFMMU_HASH_LOCK(hmebp); 3846 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 3847 if (hmeblkp != NULL) { 3848 ASSERT(hmeblkp->hblk_shared); 3849 ASSERT(!hmeblkp->hblk_lckcnt); 3850 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 3851 *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr, 3852 eaddr, NULL, HAT_UNLOAD); 3853 ASSERT(*eaddrp > addr); 3854 } 3855 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt); 3856 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3857 &list, 0); 3858 } 3859 SFMMU_HASH_UNLOCK(hmebp); 3860 sfmmu_hblks_list_purge(&list, 0); 3861 } 3862 3863 static void 3864 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp) 3865 { 3866 int ttesz = rgnp->rgn_pgszc; 3867 size_t rsz = rgnp->rgn_size; 3868 caddr_t rsaddr = rgnp->rgn_saddr; 3869 caddr_t readdr = rsaddr + rsz; 3870 caddr_t rhsaddr; 3871 caddr_t va; 3872 uint_t rid = rgnp->rgn_id; 3873 caddr_t cbsaddr; 3874 caddr_t cbeaddr; 3875 hat_rgn_cb_func_t rcbfunc; 3876 ulong_t cnt; 3877 3878 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3879 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3880 3881 ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz))); 3882 ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz))); 3883 if (ttesz < HBLK_MIN_TTESZ) { 3884 ttesz = HBLK_MIN_TTESZ; 3885 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES); 3886 } else { 3887 rhsaddr = rsaddr; 3888 } 3889 3890 if ((rcbfunc = rgnp->rgn_cb_function) == NULL) { 3891 rcbfunc = sfmmu_rgn_cb_noop; 3892 } 3893 3894 while (ttesz >= HBLK_MIN_TTESZ) { 3895 cbsaddr = rsaddr; 3896 cbeaddr = rsaddr; 3897 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) { 3898 ttesz--; 3899 continue; 3900 } 3901 cnt = 0; 3902 va = rsaddr; 3903 while (va < readdr) { 3904 ASSERT(va >= rhsaddr); 3905 if (va != cbeaddr) { 3906 if (cbeaddr != cbsaddr) { 3907 ASSERT(cbeaddr > cbsaddr); 3908 (*rcbfunc)(cbsaddr, cbeaddr, 3909 rsaddr, rsz, rgnp->rgn_obj, 3910 rgnp->rgn_objoff); 3911 } 3912 cbsaddr = va; 3913 cbeaddr = va; 3914 } 3915 sfmmu_unload_hmeregion_va(srdp, rid, va, readdr, 3916 ttesz, &cbeaddr); 3917 cnt++; 3918 va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz)); 3919 } 3920 if (cbeaddr != cbsaddr) { 3921 ASSERT(cbeaddr > cbsaddr); 3922 (*rcbfunc)(cbsaddr, cbeaddr, rsaddr, 3923 rsz, rgnp->rgn_obj, 3924 rgnp->rgn_objoff); 3925 } 3926 ttesz--; 3927 } 3928 } 3929 3930 /* 3931 * Release one hardware address translation lock on the given address range. 3932 */ 3933 void 3934 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len) 3935 { 3936 struct hmehash_bucket *hmebp; 3937 hmeblk_tag hblktag; 3938 int hmeshift, hashno = 1; 3939 struct hme_blk *hmeblkp, *list = NULL; 3940 caddr_t endaddr; 3941 3942 ASSERT(sfmmup != NULL); 3943 3944 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 3945 ASSERT((len & MMU_PAGEOFFSET) == 0); 3946 endaddr = addr + len; 3947 hblktag.htag_id = sfmmup; 3948 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3949 3950 /* 3951 * Spitfire supports 4 page sizes. 3952 * Most pages are expected to be of the smallest page size (8K) and 3953 * these will not need to be rehashed. 64K pages also don't need to be 3954 * rehashed because an hmeblk spans 64K of address space. 512K pages 3955 * might need 1 rehash and and 4M pages might need 2 rehashes. 3956 */ 3957 while (addr < endaddr) { 3958 hmeshift = HME_HASH_SHIFT(hashno); 3959 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3960 hblktag.htag_rehash = hashno; 3961 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 3962 3963 SFMMU_HASH_LOCK(hmebp); 3964 3965 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 3966 if (hmeblkp != NULL) { 3967 ASSERT(!hmeblkp->hblk_shared); 3968 /* 3969 * If we encounter a shadow hmeblk then 3970 * we know there are no valid hmeblks mapping 3971 * this address at this size or larger. 3972 * Just increment address by the smallest 3973 * page size. 3974 */ 3975 if (hmeblkp->hblk_shw_bit) { 3976 addr += MMU_PAGESIZE; 3977 } else { 3978 addr = sfmmu_hblk_unlock(hmeblkp, addr, 3979 endaddr); 3980 } 3981 SFMMU_HASH_UNLOCK(hmebp); 3982 hashno = 1; 3983 continue; 3984 } 3985 SFMMU_HASH_UNLOCK(hmebp); 3986 3987 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 3988 /* 3989 * We have traversed the whole list and rehashed 3990 * if necessary without finding the address to unlock 3991 * which should never happen. 3992 */ 3993 panic("sfmmu_unlock: addr not found. " 3994 "addr %p hat %p", (void *)addr, (void *)sfmmup); 3995 } else { 3996 hashno++; 3997 } 3998 } 3999 4000 sfmmu_hblks_list_purge(&list, 0); 4001 } 4002 4003 void 4004 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len, 4005 hat_region_cookie_t rcookie) 4006 { 4007 sf_srd_t *srdp; 4008 sf_region_t *rgnp; 4009 int ttesz; 4010 uint_t rid; 4011 caddr_t eaddr; 4012 caddr_t va; 4013 int hmeshift; 4014 hmeblk_tag hblktag; 4015 struct hmehash_bucket *hmebp; 4016 struct hme_blk *hmeblkp; 4017 struct hme_blk *pr_hblk; 4018 struct hme_blk *list; 4019 4020 if (rcookie == HAT_INVALID_REGION_COOKIE) { 4021 hat_unlock(sfmmup, addr, len); 4022 return; 4023 } 4024 4025 ASSERT(sfmmup != NULL); 4026 ASSERT(sfmmup != ksfmmup); 4027 4028 srdp = sfmmup->sfmmu_srdp; 4029 rid = (uint_t)((uint64_t)rcookie); 4030 VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS); 4031 eaddr = addr + len; 4032 va = addr; 4033 list = NULL; 4034 rgnp = srdp->srd_hmergnp[rid]; 4035 SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len); 4036 4037 ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc))); 4038 ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc))); 4039 if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) { 4040 ttesz = HBLK_MIN_TTESZ; 4041 } else { 4042 ttesz = rgnp->rgn_pgszc; 4043 } 4044 while (va < eaddr) { 4045 while (ttesz < rgnp->rgn_pgszc && 4046 IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) { 4047 ttesz++; 4048 } 4049 while (ttesz >= HBLK_MIN_TTESZ) { 4050 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) { 4051 ttesz--; 4052 continue; 4053 } 4054 hmeshift = HME_HASH_SHIFT(ttesz); 4055 hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift); 4056 hblktag.htag_rehash = ttesz; 4057 hblktag.htag_rid = rid; 4058 hblktag.htag_id = srdp; 4059 hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift); 4060 SFMMU_HASH_LOCK(hmebp); 4061 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, 4062 &list); 4063 if (hmeblkp == NULL) { 4064 SFMMU_HASH_UNLOCK(hmebp); 4065 ttesz--; 4066 continue; 4067 } 4068 ASSERT(hmeblkp->hblk_shared); 4069 va = sfmmu_hblk_unlock(hmeblkp, va, eaddr); 4070 ASSERT(va >= eaddr || 4071 IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz))); 4072 SFMMU_HASH_UNLOCK(hmebp); 4073 break; 4074 } 4075 if (ttesz < HBLK_MIN_TTESZ) { 4076 panic("hat_unlock_region: addr not found " 4077 "addr %p hat %p", (void *)va, (void *)sfmmup); 4078 } 4079 } 4080 sfmmu_hblks_list_purge(&list, 0); 4081 } 4082 4083 /* 4084 * Function to unlock a range of addresses in an hmeblk. It returns the 4085 * next address that needs to be unlocked. 4086 * Should be called with the hash lock held. 4087 */ 4088 static caddr_t 4089 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr) 4090 { 4091 struct sf_hment *sfhme; 4092 tte_t tteold, ttemod; 4093 int ttesz, ret; 4094 4095 ASSERT(in_hblk_range(hmeblkp, addr)); 4096 ASSERT(hmeblkp->hblk_shw_bit == 0); 4097 4098 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 4099 ttesz = get_hblk_ttesz(hmeblkp); 4100 4101 HBLKTOHME(sfhme, hmeblkp, addr); 4102 while (addr < endaddr) { 4103 readtte: 4104 sfmmu_copytte(&sfhme->hme_tte, &tteold); 4105 if (TTE_IS_VALID(&tteold)) { 4106 4107 ttemod = tteold; 4108 4109 ret = sfmmu_modifytte_try(&tteold, &ttemod, 4110 &sfhme->hme_tte); 4111 4112 if (ret < 0) 4113 goto readtte; 4114 4115 if (hmeblkp->hblk_lckcnt == 0) 4116 panic("zero hblk lckcnt"); 4117 4118 if (((uintptr_t)addr + TTEBYTES(ttesz)) > 4119 (uintptr_t)endaddr) 4120 panic("can't unlock large tte"); 4121 4122 ASSERT(hmeblkp->hblk_lckcnt > 0); 4123 atomic_dec_32(&hmeblkp->hblk_lckcnt); 4124 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK); 4125 } else { 4126 panic("sfmmu_hblk_unlock: invalid tte"); 4127 } 4128 addr += TTEBYTES(ttesz); 4129 sfhme++; 4130 } 4131 return (addr); 4132 } 4133 4134 /* 4135 * Physical Address Mapping Framework 4136 * 4137 * General rules: 4138 * 4139 * (1) Applies only to seg_kmem memory pages. To make things easier, 4140 * seg_kpm addresses are also accepted by the routines, but nothing 4141 * is done with them since by definition their PA mappings are static. 4142 * (2) hat_add_callback() may only be called while holding the page lock 4143 * SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()), 4144 * or passing HAC_PAGELOCK flag. 4145 * (3) prehandler() and posthandler() may not call hat_add_callback() or 4146 * hat_delete_callback(), nor should they allocate memory. Post quiesce 4147 * callbacks may not sleep or acquire adaptive mutex locks. 4148 * (4) Either prehandler() or posthandler() (but not both) may be specified 4149 * as being NULL. Specifying an errhandler() is optional. 4150 * 4151 * Details of using the framework: 4152 * 4153 * registering a callback (hat_register_callback()) 4154 * 4155 * Pass prehandler, posthandler, errhandler addresses 4156 * as described below. If capture_cpus argument is nonzero, 4157 * suspend callback to the prehandler will occur with CPUs 4158 * captured and executing xc_loop() and CPUs will remain 4159 * captured until after the posthandler suspend callback 4160 * occurs. 4161 * 4162 * adding a callback (hat_add_callback()) 4163 * 4164 * as_pagelock(); 4165 * hat_add_callback(); 4166 * save returned pfn in private data structures or program registers; 4167 * as_pageunlock(); 4168 * 4169 * prehandler() 4170 * 4171 * Stop all accesses by physical address to this memory page. 4172 * Called twice: the first, PRESUSPEND, is a context safe to acquire 4173 * adaptive locks. The second, SUSPEND, is called at high PIL with 4174 * CPUs captured so adaptive locks may NOT be acquired (and all spin 4175 * locks must be XCALL_PIL or higher locks). 4176 * 4177 * May return the following errors: 4178 * EIO: A fatal error has occurred. This will result in panic. 4179 * EAGAIN: The page cannot be suspended. This will fail the 4180 * relocation. 4181 * 0: Success. 4182 * 4183 * posthandler() 4184 * 4185 * Save new pfn in private data structures or program registers; 4186 * not allowed to fail (non-zero return values will result in panic). 4187 * 4188 * errhandler() 4189 * 4190 * called when an error occurs related to the callback. Currently 4191 * the only such error is HAT_CB_ERR_LEAKED which indicates that 4192 * a page is being freed, but there are still outstanding callback(s) 4193 * registered on the page. 4194 * 4195 * removing a callback (hat_delete_callback(); e.g., prior to freeing memory) 4196 * 4197 * stop using physical address 4198 * hat_delete_callback(); 4199 * 4200 */ 4201 4202 /* 4203 * Register a callback class. Each subsystem should do this once and 4204 * cache the id_t returned for use in setting up and tearing down callbacks. 4205 * 4206 * There is no facility for removing callback IDs once they are created; 4207 * the "key" should be unique for each module, so in case a module is unloaded 4208 * and subsequently re-loaded, we can recycle the module's previous entry. 4209 */ 4210 id_t 4211 hat_register_callback(int key, 4212 int (*prehandler)(caddr_t, uint_t, uint_t, void *), 4213 int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t), 4214 int (*errhandler)(caddr_t, uint_t, uint_t, void *), 4215 int capture_cpus) 4216 { 4217 id_t id; 4218 4219 /* 4220 * Search the table for a pre-existing callback associated with 4221 * the identifier "key". If one exists, we re-use that entry in 4222 * the table for this instance, otherwise we assign the next 4223 * available table slot. 4224 */ 4225 for (id = 0; id < sfmmu_max_cb_id; id++) { 4226 if (sfmmu_cb_table[id].key == key) 4227 break; 4228 } 4229 4230 if (id == sfmmu_max_cb_id) { 4231 id = sfmmu_cb_nextid++; 4232 if (id >= sfmmu_max_cb_id) 4233 panic("hat_register_callback: out of callback IDs"); 4234 } 4235 4236 ASSERT(prehandler != NULL || posthandler != NULL); 4237 4238 sfmmu_cb_table[id].key = key; 4239 sfmmu_cb_table[id].prehandler = prehandler; 4240 sfmmu_cb_table[id].posthandler = posthandler; 4241 sfmmu_cb_table[id].errhandler = errhandler; 4242 sfmmu_cb_table[id].capture_cpus = capture_cpus; 4243 4244 return (id); 4245 } 4246 4247 #define HAC_COOKIE_NONE (void *)-1 4248 4249 /* 4250 * Add relocation callbacks to the specified addr/len which will be called 4251 * when relocating the associated page. See the description of pre and 4252 * posthandler above for more details. 4253 * 4254 * If HAC_PAGELOCK is included in flags, the underlying memory page is 4255 * locked internally so the caller must be able to deal with the callback 4256 * running even before this function has returned. If HAC_PAGELOCK is not 4257 * set, it is assumed that the underlying memory pages are locked. 4258 * 4259 * Since the caller must track the individual page boundaries anyway, 4260 * we only allow a callback to be added to a single page (large 4261 * or small). Thus [addr, addr + len) MUST be contained within a single 4262 * page. 4263 * 4264 * Registering multiple callbacks on the same [addr, addr+len) is supported, 4265 * _provided_that_ a unique parameter is specified for each callback. 4266 * If multiple callbacks are registered on the same range the callback will 4267 * be invoked with each unique parameter. Registering the same callback with 4268 * the same argument more than once will result in corrupted kernel state. 4269 * 4270 * Returns the pfn of the underlying kernel page in *rpfn 4271 * on success, or PFN_INVALID on failure. 4272 * 4273 * cookiep (if passed) provides storage space for an opaque cookie 4274 * to return later to hat_delete_callback(). This cookie makes the callback 4275 * deletion significantly quicker by avoiding a potentially lengthy hash 4276 * search. 4277 * 4278 * Returns values: 4279 * 0: success 4280 * ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP) 4281 * EINVAL: callback ID is not valid 4282 * ENXIO: ["vaddr", "vaddr" + len) is not mapped in the kernel's address 4283 * space 4284 * ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary 4285 */ 4286 int 4287 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags, 4288 void *pvt, pfn_t *rpfn, void **cookiep) 4289 { 4290 struct hmehash_bucket *hmebp; 4291 hmeblk_tag hblktag; 4292 struct hme_blk *hmeblkp; 4293 int hmeshift, hashno; 4294 caddr_t saddr, eaddr, baseaddr; 4295 struct pa_hment *pahmep; 4296 struct sf_hment *sfhmep, *osfhmep; 4297 kmutex_t *pml; 4298 tte_t tte; 4299 page_t *pp; 4300 vnode_t *vp; 4301 u_offset_t off; 4302 pfn_t pfn; 4303 int kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP; 4304 int locked = 0; 4305 4306 /* 4307 * For KPM mappings, just return the physical address since we 4308 * don't need to register any callbacks. 4309 */ 4310 if (IS_KPM_ADDR(vaddr)) { 4311 uint64_t paddr; 4312 SFMMU_KPM_VTOP(vaddr, paddr); 4313 *rpfn = btop(paddr); 4314 if (cookiep != NULL) 4315 *cookiep = HAC_COOKIE_NONE; 4316 return (0); 4317 } 4318 4319 if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) { 4320 *rpfn = PFN_INVALID; 4321 return (EINVAL); 4322 } 4323 4324 if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) { 4325 *rpfn = PFN_INVALID; 4326 return (ENOMEM); 4327 } 4328 4329 sfhmep = &pahmep->sfment; 4330 4331 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK); 4332 eaddr = saddr + len; 4333 4334 rehash: 4335 /* Find the mapping(s) for this page */ 4336 for (hashno = TTE64K, hmeblkp = NULL; 4337 hmeblkp == NULL && hashno <= mmu_hashcnt; 4338 hashno++) { 4339 hmeshift = HME_HASH_SHIFT(hashno); 4340 hblktag.htag_id = ksfmmup; 4341 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4342 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift); 4343 hblktag.htag_rehash = hashno; 4344 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift); 4345 4346 SFMMU_HASH_LOCK(hmebp); 4347 4348 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 4349 4350 if (hmeblkp == NULL) 4351 SFMMU_HASH_UNLOCK(hmebp); 4352 } 4353 4354 if (hmeblkp == NULL) { 4355 kmem_cache_free(pa_hment_cache, pahmep); 4356 *rpfn = PFN_INVALID; 4357 return (ENXIO); 4358 } 4359 4360 ASSERT(!hmeblkp->hblk_shared); 4361 4362 HBLKTOHME(osfhmep, hmeblkp, saddr); 4363 sfmmu_copytte(&osfhmep->hme_tte, &tte); 4364 4365 if (!TTE_IS_VALID(&tte)) { 4366 SFMMU_HASH_UNLOCK(hmebp); 4367 kmem_cache_free(pa_hment_cache, pahmep); 4368 *rpfn = PFN_INVALID; 4369 return (ENXIO); 4370 } 4371 4372 /* 4373 * Make sure the boundaries for the callback fall within this 4374 * single mapping. 4375 */ 4376 baseaddr = (caddr_t)get_hblk_base(hmeblkp); 4377 ASSERT(saddr >= baseaddr); 4378 if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) { 4379 SFMMU_HASH_UNLOCK(hmebp); 4380 kmem_cache_free(pa_hment_cache, pahmep); 4381 *rpfn = PFN_INVALID; 4382 return (ERANGE); 4383 } 4384 4385 pfn = sfmmu_ttetopfn(&tte, vaddr); 4386 4387 /* 4388 * The pfn may not have a page_t underneath in which case we 4389 * just return it. This can happen if we are doing I/O to a 4390 * static portion of the kernel's address space, for instance. 4391 */ 4392 pp = osfhmep->hme_page; 4393 if (pp == NULL) { 4394 SFMMU_HASH_UNLOCK(hmebp); 4395 kmem_cache_free(pa_hment_cache, pahmep); 4396 *rpfn = pfn; 4397 if (cookiep) 4398 *cookiep = HAC_COOKIE_NONE; 4399 return (0); 4400 } 4401 ASSERT(pp == PP_PAGEROOT(pp)); 4402 4403 vp = pp->p_vnode; 4404 off = pp->p_offset; 4405 4406 pml = sfmmu_mlist_enter(pp); 4407 4408 if (flags & HAC_PAGELOCK) { 4409 if (!page_trylock(pp, SE_SHARED)) { 4410 /* 4411 * Somebody is holding SE_EXCL lock. Might 4412 * even be hat_page_relocate(). Drop all 4413 * our locks, lookup the page in &kvp, and 4414 * retry. If it doesn't exist in &kvp and &zvp, 4415 * then we must be dealing with a kernel mapped 4416 * page which doesn't actually belong to 4417 * segkmem so we punt. 4418 */ 4419 sfmmu_mlist_exit(pml); 4420 SFMMU_HASH_UNLOCK(hmebp); 4421 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED); 4422 4423 /* check zvp before giving up */ 4424 if (pp == NULL) 4425 pp = page_lookup(&zvp, (u_offset_t)saddr, 4426 SE_SHARED); 4427 4428 /* Okay, we didn't find it, give up */ 4429 if (pp == NULL) { 4430 kmem_cache_free(pa_hment_cache, pahmep); 4431 *rpfn = pfn; 4432 if (cookiep) 4433 *cookiep = HAC_COOKIE_NONE; 4434 return (0); 4435 } 4436 page_unlock(pp); 4437 goto rehash; 4438 } 4439 locked = 1; 4440 } 4441 4442 if (!PAGE_LOCKED(pp) && !panicstr) 4443 panic("hat_add_callback: page 0x%p not locked", (void *)pp); 4444 4445 if (osfhmep->hme_page != pp || pp->p_vnode != vp || 4446 pp->p_offset != off) { 4447 /* 4448 * The page moved before we got our hands on it. Drop 4449 * all the locks and try again. 4450 */ 4451 ASSERT((flags & HAC_PAGELOCK) != 0); 4452 sfmmu_mlist_exit(pml); 4453 SFMMU_HASH_UNLOCK(hmebp); 4454 page_unlock(pp); 4455 locked = 0; 4456 goto rehash; 4457 } 4458 4459 if (!VN_ISKAS(vp)) { 4460 /* 4461 * This is not a segkmem page but another page which 4462 * has been kernel mapped. It had better have at least 4463 * a share lock on it. Return the pfn. 4464 */ 4465 sfmmu_mlist_exit(pml); 4466 SFMMU_HASH_UNLOCK(hmebp); 4467 if (locked) 4468 page_unlock(pp); 4469 kmem_cache_free(pa_hment_cache, pahmep); 4470 ASSERT(PAGE_LOCKED(pp)); 4471 *rpfn = pfn; 4472 if (cookiep) 4473 *cookiep = HAC_COOKIE_NONE; 4474 return (0); 4475 } 4476 4477 /* 4478 * Setup this pa_hment and link its embedded dummy sf_hment into 4479 * the mapping list. 4480 */ 4481 pp->p_share++; 4482 pahmep->cb_id = callback_id; 4483 pahmep->addr = vaddr; 4484 pahmep->len = len; 4485 pahmep->refcnt = 1; 4486 pahmep->flags = 0; 4487 pahmep->pvt = pvt; 4488 4489 sfhmep->hme_tte.ll = 0; 4490 sfhmep->hme_data = pahmep; 4491 sfhmep->hme_prev = osfhmep; 4492 sfhmep->hme_next = osfhmep->hme_next; 4493 4494 if (osfhmep->hme_next) 4495 osfhmep->hme_next->hme_prev = sfhmep; 4496 4497 osfhmep->hme_next = sfhmep; 4498 4499 sfmmu_mlist_exit(pml); 4500 SFMMU_HASH_UNLOCK(hmebp); 4501 4502 if (locked) 4503 page_unlock(pp); 4504 4505 *rpfn = pfn; 4506 if (cookiep) 4507 *cookiep = (void *)pahmep; 4508 4509 return (0); 4510 } 4511 4512 /* 4513 * Remove the relocation callbacks from the specified addr/len. 4514 */ 4515 void 4516 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags, 4517 void *cookie) 4518 { 4519 struct hmehash_bucket *hmebp; 4520 hmeblk_tag hblktag; 4521 struct hme_blk *hmeblkp; 4522 int hmeshift, hashno; 4523 caddr_t saddr; 4524 struct pa_hment *pahmep; 4525 struct sf_hment *sfhmep, *osfhmep; 4526 kmutex_t *pml; 4527 tte_t tte; 4528 page_t *pp; 4529 vnode_t *vp; 4530 u_offset_t off; 4531 int locked = 0; 4532 4533 /* 4534 * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to 4535 * remove so just return. 4536 */ 4537 if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr)) 4538 return; 4539 4540 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK); 4541 4542 rehash: 4543 /* Find the mapping(s) for this page */ 4544 for (hashno = TTE64K, hmeblkp = NULL; 4545 hmeblkp == NULL && hashno <= mmu_hashcnt; 4546 hashno++) { 4547 hmeshift = HME_HASH_SHIFT(hashno); 4548 hblktag.htag_id = ksfmmup; 4549 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4550 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift); 4551 hblktag.htag_rehash = hashno; 4552 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift); 4553 4554 SFMMU_HASH_LOCK(hmebp); 4555 4556 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 4557 4558 if (hmeblkp == NULL) 4559 SFMMU_HASH_UNLOCK(hmebp); 4560 } 4561 4562 if (hmeblkp == NULL) 4563 return; 4564 4565 ASSERT(!hmeblkp->hblk_shared); 4566 4567 HBLKTOHME(osfhmep, hmeblkp, saddr); 4568 4569 sfmmu_copytte(&osfhmep->hme_tte, &tte); 4570 if (!TTE_IS_VALID(&tte)) { 4571 SFMMU_HASH_UNLOCK(hmebp); 4572 return; 4573 } 4574 4575 pp = osfhmep->hme_page; 4576 if (pp == NULL) { 4577 SFMMU_HASH_UNLOCK(hmebp); 4578 ASSERT(cookie == NULL); 4579 return; 4580 } 4581 4582 vp = pp->p_vnode; 4583 off = pp->p_offset; 4584 4585 pml = sfmmu_mlist_enter(pp); 4586 4587 if (flags & HAC_PAGELOCK) { 4588 if (!page_trylock(pp, SE_SHARED)) { 4589 /* 4590 * Somebody is holding SE_EXCL lock. Might 4591 * even be hat_page_relocate(). Drop all 4592 * our locks, lookup the page in &kvp, and 4593 * retry. If it doesn't exist in &kvp and &zvp, 4594 * then we must be dealing with a kernel mapped 4595 * page which doesn't actually belong to 4596 * segkmem so we punt. 4597 */ 4598 sfmmu_mlist_exit(pml); 4599 SFMMU_HASH_UNLOCK(hmebp); 4600 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED); 4601 /* check zvp before giving up */ 4602 if (pp == NULL) 4603 pp = page_lookup(&zvp, (u_offset_t)saddr, 4604 SE_SHARED); 4605 4606 if (pp == NULL) { 4607 ASSERT(cookie == NULL); 4608 return; 4609 } 4610 page_unlock(pp); 4611 goto rehash; 4612 } 4613 locked = 1; 4614 } 4615 4616 ASSERT(PAGE_LOCKED(pp)); 4617 4618 if (osfhmep->hme_page != pp || pp->p_vnode != vp || 4619 pp->p_offset != off) { 4620 /* 4621 * The page moved before we got our hands on it. Drop 4622 * all the locks and try again. 4623 */ 4624 ASSERT((flags & HAC_PAGELOCK) != 0); 4625 sfmmu_mlist_exit(pml); 4626 SFMMU_HASH_UNLOCK(hmebp); 4627 page_unlock(pp); 4628 locked = 0; 4629 goto rehash; 4630 } 4631 4632 if (!VN_ISKAS(vp)) { 4633 /* 4634 * This is not a segkmem page but another page which 4635 * has been kernel mapped. 4636 */ 4637 sfmmu_mlist_exit(pml); 4638 SFMMU_HASH_UNLOCK(hmebp); 4639 if (locked) 4640 page_unlock(pp); 4641 ASSERT(cookie == NULL); 4642 return; 4643 } 4644 4645 if (cookie != NULL) { 4646 pahmep = (struct pa_hment *)cookie; 4647 sfhmep = &pahmep->sfment; 4648 } else { 4649 for (sfhmep = pp->p_mapping; sfhmep != NULL; 4650 sfhmep = sfhmep->hme_next) { 4651 4652 /* 4653 * skip va<->pa mappings 4654 */ 4655 if (!IS_PAHME(sfhmep)) 4656 continue; 4657 4658 pahmep = sfhmep->hme_data; 4659 ASSERT(pahmep != NULL); 4660 4661 /* 4662 * if pa_hment matches, remove it 4663 */ 4664 if ((pahmep->pvt == pvt) && 4665 (pahmep->addr == vaddr) && 4666 (pahmep->len == len)) { 4667 break; 4668 } 4669 } 4670 } 4671 4672 if (sfhmep == NULL) { 4673 if (!panicstr) { 4674 panic("hat_delete_callback: pa_hment not found, pp %p", 4675 (void *)pp); 4676 } 4677 return; 4678 } 4679 4680 /* 4681 * Note: at this point a valid kernel mapping must still be 4682 * present on this page. 4683 */ 4684 pp->p_share--; 4685 if (pp->p_share <= 0) 4686 panic("hat_delete_callback: zero p_share"); 4687 4688 if (--pahmep->refcnt == 0) { 4689 if (pahmep->flags != 0) 4690 panic("hat_delete_callback: pa_hment is busy"); 4691 4692 /* 4693 * Remove sfhmep from the mapping list for the page. 4694 */ 4695 if (sfhmep->hme_prev) { 4696 sfhmep->hme_prev->hme_next = sfhmep->hme_next; 4697 } else { 4698 pp->p_mapping = sfhmep->hme_next; 4699 } 4700 4701 if (sfhmep->hme_next) 4702 sfhmep->hme_next->hme_prev = sfhmep->hme_prev; 4703 4704 sfmmu_mlist_exit(pml); 4705 SFMMU_HASH_UNLOCK(hmebp); 4706 4707 if (locked) 4708 page_unlock(pp); 4709 4710 kmem_cache_free(pa_hment_cache, pahmep); 4711 return; 4712 } 4713 4714 sfmmu_mlist_exit(pml); 4715 SFMMU_HASH_UNLOCK(hmebp); 4716 if (locked) 4717 page_unlock(pp); 4718 } 4719 4720 /* 4721 * hat_probe returns 1 if the translation for the address 'addr' is 4722 * loaded, zero otherwise. 4723 * 4724 * hat_probe should be used only for advisorary purposes because it may 4725 * occasionally return the wrong value. The implementation must guarantee that 4726 * returning the wrong value is a very rare event. hat_probe is used 4727 * to implement optimizations in the segment drivers. 4728 * 4729 */ 4730 int 4731 hat_probe(struct hat *sfmmup, caddr_t addr) 4732 { 4733 pfn_t pfn; 4734 tte_t tte; 4735 4736 ASSERT(sfmmup != NULL); 4737 4738 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 4739 4740 if (sfmmup == ksfmmup) { 4741 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte)) 4742 == PFN_SUSPENDED) { 4743 sfmmu_vatopfn_suspended(addr, sfmmup, &tte); 4744 } 4745 } else { 4746 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL); 4747 } 4748 4749 if (pfn != PFN_INVALID) 4750 return (1); 4751 else 4752 return (0); 4753 } 4754 4755 ssize_t 4756 hat_getpagesize(struct hat *sfmmup, caddr_t addr) 4757 { 4758 tte_t tte; 4759 4760 if (sfmmup == ksfmmup) { 4761 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4762 return (-1); 4763 } 4764 } else { 4765 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4766 return (-1); 4767 } 4768 } 4769 4770 ASSERT(TTE_IS_VALID(&tte)); 4771 return (TTEBYTES(TTE_CSZ(&tte))); 4772 } 4773 4774 uint_t 4775 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr) 4776 { 4777 tte_t tte; 4778 4779 if (sfmmup == ksfmmup) { 4780 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4781 tte.ll = 0; 4782 } 4783 } else { 4784 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4785 tte.ll = 0; 4786 } 4787 } 4788 if (TTE_IS_VALID(&tte)) { 4789 *attr = sfmmu_ptov_attr(&tte); 4790 return (0); 4791 } 4792 *attr = 0; 4793 return ((uint_t)0xffffffff); 4794 } 4795 4796 /* 4797 * Enables more attributes on specified address range (ie. logical OR) 4798 */ 4799 void 4800 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4801 { 4802 ASSERT(hat->sfmmu_as != NULL); 4803 4804 sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR); 4805 } 4806 4807 /* 4808 * Assigns attributes to the specified address range. All the attributes 4809 * are specified. 4810 */ 4811 void 4812 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4813 { 4814 ASSERT(hat->sfmmu_as != NULL); 4815 4816 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR); 4817 } 4818 4819 /* 4820 * Remove attributes on the specified address range (ie. loginal NAND) 4821 */ 4822 void 4823 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4824 { 4825 ASSERT(hat->sfmmu_as != NULL); 4826 4827 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR); 4828 } 4829 4830 /* 4831 * Change attributes on an address range to that specified by attr and mode. 4832 */ 4833 static void 4834 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr, 4835 int mode) 4836 { 4837 struct hmehash_bucket *hmebp; 4838 hmeblk_tag hblktag; 4839 int hmeshift, hashno = 1; 4840 struct hme_blk *hmeblkp, *list = NULL; 4841 caddr_t endaddr; 4842 cpuset_t cpuset; 4843 demap_range_t dmr; 4844 4845 CPUSET_ZERO(cpuset); 4846 4847 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 4848 ASSERT((len & MMU_PAGEOFFSET) == 0); 4849 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0); 4850 4851 if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) && 4852 ((addr + len) > (caddr_t)USERLIMIT)) { 4853 panic("user addr %p in kernel space", 4854 (void *)addr); 4855 } 4856 4857 endaddr = addr + len; 4858 hblktag.htag_id = sfmmup; 4859 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4860 DEMAP_RANGE_INIT(sfmmup, &dmr); 4861 4862 while (addr < endaddr) { 4863 hmeshift = HME_HASH_SHIFT(hashno); 4864 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 4865 hblktag.htag_rehash = hashno; 4866 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 4867 4868 SFMMU_HASH_LOCK(hmebp); 4869 4870 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 4871 if (hmeblkp != NULL) { 4872 ASSERT(!hmeblkp->hblk_shared); 4873 /* 4874 * We've encountered a shadow hmeblk so skip the range 4875 * of the next smaller mapping size. 4876 */ 4877 if (hmeblkp->hblk_shw_bit) { 4878 ASSERT(sfmmup != ksfmmup); 4879 ASSERT(hashno > 1); 4880 addr = (caddr_t)P2END((uintptr_t)addr, 4881 TTEBYTES(hashno - 1)); 4882 } else { 4883 addr = sfmmu_hblk_chgattr(sfmmup, 4884 hmeblkp, addr, endaddr, &dmr, attr, mode); 4885 } 4886 SFMMU_HASH_UNLOCK(hmebp); 4887 hashno = 1; 4888 continue; 4889 } 4890 SFMMU_HASH_UNLOCK(hmebp); 4891 4892 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 4893 /* 4894 * We have traversed the whole list and rehashed 4895 * if necessary without finding the address to chgattr. 4896 * This is ok, so we increment the address by the 4897 * smallest hmeblk range for kernel mappings or for 4898 * user mappings with no large pages, and the largest 4899 * hmeblk range, to account for shadow hmeblks, for 4900 * user mappings with large pages and continue. 4901 */ 4902 if (sfmmup == ksfmmup) 4903 addr = (caddr_t)P2END((uintptr_t)addr, 4904 TTEBYTES(1)); 4905 else 4906 addr = (caddr_t)P2END((uintptr_t)addr, 4907 TTEBYTES(hashno)); 4908 hashno = 1; 4909 } else { 4910 hashno++; 4911 } 4912 } 4913 4914 sfmmu_hblks_list_purge(&list, 0); 4915 DEMAP_RANGE_FLUSH(&dmr); 4916 cpuset = sfmmup->sfmmu_cpusran; 4917 xt_sync(cpuset); 4918 } 4919 4920 /* 4921 * This function chgattr on a range of addresses in an hmeblk. It returns the 4922 * next addres that needs to be chgattr. 4923 * It should be called with the hash lock held. 4924 * XXX It should be possible to optimize chgattr by not flushing every time but 4925 * on the other hand: 4926 * 1. do one flush crosscall. 4927 * 2. only flush if we are increasing permissions (make sure this will work) 4928 */ 4929 static caddr_t 4930 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 4931 caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode) 4932 { 4933 tte_t tte, tteattr, tteflags, ttemod; 4934 struct sf_hment *sfhmep; 4935 int ttesz; 4936 struct page *pp = NULL; 4937 kmutex_t *pml, *pmtx; 4938 int ret; 4939 int use_demap_range; 4940 #if defined(SF_ERRATA_57) 4941 int check_exec; 4942 #endif 4943 4944 ASSERT(in_hblk_range(hmeblkp, addr)); 4945 ASSERT(hmeblkp->hblk_shw_bit == 0); 4946 ASSERT(!hmeblkp->hblk_shared); 4947 4948 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 4949 ttesz = get_hblk_ttesz(hmeblkp); 4950 4951 /* 4952 * Flush the current demap region if addresses have been 4953 * skipped or the page size doesn't match. 4954 */ 4955 use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)); 4956 if (use_demap_range) { 4957 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 4958 } else if (dmrp != NULL) { 4959 DEMAP_RANGE_FLUSH(dmrp); 4960 } 4961 4962 tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags); 4963 #if defined(SF_ERRATA_57) 4964 check_exec = (sfmmup != ksfmmup) && 4965 AS_TYPE_64BIT(sfmmup->sfmmu_as) && 4966 TTE_IS_EXECUTABLE(&tteattr); 4967 #endif 4968 HBLKTOHME(sfhmep, hmeblkp, addr); 4969 while (addr < endaddr) { 4970 sfmmu_copytte(&sfhmep->hme_tte, &tte); 4971 if (TTE_IS_VALID(&tte)) { 4972 if ((tte.ll & tteflags.ll) == tteattr.ll) { 4973 /* 4974 * if the new attr is the same as old 4975 * continue 4976 */ 4977 goto next_addr; 4978 } 4979 if (!TTE_IS_WRITABLE(&tteattr)) { 4980 /* 4981 * make sure we clear hw modify bit if we 4982 * removing write protections 4983 */ 4984 tteflags.tte_intlo |= TTE_HWWR_INT; 4985 } 4986 4987 pml = NULL; 4988 pp = sfhmep->hme_page; 4989 if (pp) { 4990 pml = sfmmu_mlist_enter(pp); 4991 } 4992 4993 if (pp != sfhmep->hme_page) { 4994 /* 4995 * tte must have been unloaded. 4996 */ 4997 ASSERT(pml); 4998 sfmmu_mlist_exit(pml); 4999 continue; 5000 } 5001 5002 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5003 5004 ttemod = tte; 5005 ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll; 5006 ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte)); 5007 5008 #if defined(SF_ERRATA_57) 5009 if (check_exec && addr < errata57_limit) 5010 ttemod.tte_exec_perm = 0; 5011 #endif 5012 ret = sfmmu_modifytte_try(&tte, &ttemod, 5013 &sfhmep->hme_tte); 5014 5015 if (ret < 0) { 5016 /* tte changed underneath us */ 5017 if (pml) { 5018 sfmmu_mlist_exit(pml); 5019 } 5020 continue; 5021 } 5022 5023 if (tteflags.tte_intlo & TTE_HWWR_INT) { 5024 /* 5025 * need to sync if we are clearing modify bit. 5026 */ 5027 sfmmu_ttesync(sfmmup, addr, &tte, pp); 5028 } 5029 5030 if (pp && PP_ISRO(pp)) { 5031 if (tteattr.tte_intlo & TTE_WRPRM_INT) { 5032 pmtx = sfmmu_page_enter(pp); 5033 PP_CLRRO(pp); 5034 sfmmu_page_exit(pmtx); 5035 } 5036 } 5037 5038 if (ret > 0 && use_demap_range) { 5039 DEMAP_RANGE_MARKPG(dmrp, addr); 5040 } else if (ret > 0) { 5041 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 5042 } 5043 5044 if (pml) { 5045 sfmmu_mlist_exit(pml); 5046 } 5047 } 5048 next_addr: 5049 addr += TTEBYTES(ttesz); 5050 sfhmep++; 5051 DEMAP_RANGE_NEXTPG(dmrp); 5052 } 5053 return (addr); 5054 } 5055 5056 /* 5057 * This routine converts virtual attributes to physical ones. It will 5058 * update the tteflags field with the tte mask corresponding to the attributes 5059 * affected and it returns the new attributes. It will also clear the modify 5060 * bit if we are taking away write permission. This is necessary since the 5061 * modify bit is the hardware permission bit and we need to clear it in order 5062 * to detect write faults. 5063 */ 5064 static uint64_t 5065 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp) 5066 { 5067 tte_t ttevalue; 5068 5069 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 5070 5071 switch (mode) { 5072 case SFMMU_CHGATTR: 5073 /* all attributes specified */ 5074 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr); 5075 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr); 5076 ttemaskp->tte_inthi = TTEINTHI_ATTR; 5077 ttemaskp->tte_intlo = TTEINTLO_ATTR; 5078 break; 5079 case SFMMU_SETATTR: 5080 ASSERT(!(attr & ~HAT_PROT_MASK)); 5081 ttemaskp->ll = 0; 5082 ttevalue.ll = 0; 5083 /* 5084 * a valid tte implies exec and read for sfmmu 5085 * so no need to do anything about them. 5086 * since priviledged access implies user access 5087 * PROT_USER doesn't make sense either. 5088 */ 5089 if (attr & PROT_WRITE) { 5090 ttemaskp->tte_intlo |= TTE_WRPRM_INT; 5091 ttevalue.tte_intlo |= TTE_WRPRM_INT; 5092 } 5093 break; 5094 case SFMMU_CLRATTR: 5095 /* attributes will be nand with current ones */ 5096 if (attr & ~(PROT_WRITE | PROT_USER)) { 5097 panic("sfmmu: attr %x not supported", attr); 5098 } 5099 ttemaskp->ll = 0; 5100 ttevalue.ll = 0; 5101 if (attr & PROT_WRITE) { 5102 /* clear both writable and modify bit */ 5103 ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT; 5104 } 5105 if (attr & PROT_USER) { 5106 ttemaskp->tte_intlo |= TTE_PRIV_INT; 5107 ttevalue.tte_intlo |= TTE_PRIV_INT; 5108 } 5109 break; 5110 default: 5111 panic("sfmmu_vtop_attr: bad mode %x", mode); 5112 } 5113 ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0); 5114 return (ttevalue.ll); 5115 } 5116 5117 static uint_t 5118 sfmmu_ptov_attr(tte_t *ttep) 5119 { 5120 uint_t attr; 5121 5122 ASSERT(TTE_IS_VALID(ttep)); 5123 5124 attr = PROT_READ; 5125 5126 if (TTE_IS_WRITABLE(ttep)) { 5127 attr |= PROT_WRITE; 5128 } 5129 if (TTE_IS_EXECUTABLE(ttep)) { 5130 attr |= PROT_EXEC; 5131 } 5132 if (!TTE_IS_PRIVILEGED(ttep)) { 5133 attr |= PROT_USER; 5134 } 5135 if (TTE_IS_NFO(ttep)) { 5136 attr |= HAT_NOFAULT; 5137 } 5138 if (TTE_IS_NOSYNC(ttep)) { 5139 attr |= HAT_NOSYNC; 5140 } 5141 if (TTE_IS_SIDEFFECT(ttep)) { 5142 attr |= SFMMU_SIDEFFECT; 5143 } 5144 if (!TTE_IS_VCACHEABLE(ttep)) { 5145 attr |= SFMMU_UNCACHEVTTE; 5146 } 5147 if (!TTE_IS_PCACHEABLE(ttep)) { 5148 attr |= SFMMU_UNCACHEPTTE; 5149 } 5150 return (attr); 5151 } 5152 5153 /* 5154 * hat_chgprot is a deprecated hat call. New segment drivers 5155 * should store all attributes and use hat_*attr calls. 5156 * 5157 * Change the protections in the virtual address range 5158 * given to the specified virtual protection. If vprot is ~PROT_WRITE, 5159 * then remove write permission, leaving the other 5160 * permissions unchanged. If vprot is ~PROT_USER, remove user permissions. 5161 * 5162 */ 5163 void 5164 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot) 5165 { 5166 struct hmehash_bucket *hmebp; 5167 hmeblk_tag hblktag; 5168 int hmeshift, hashno = 1; 5169 struct hme_blk *hmeblkp, *list = NULL; 5170 caddr_t endaddr; 5171 cpuset_t cpuset; 5172 demap_range_t dmr; 5173 5174 ASSERT((len & MMU_PAGEOFFSET) == 0); 5175 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0); 5176 5177 ASSERT(sfmmup->sfmmu_as != NULL); 5178 5179 CPUSET_ZERO(cpuset); 5180 5181 if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) && 5182 ((addr + len) > (caddr_t)USERLIMIT)) { 5183 panic("user addr %p vprot %x in kernel space", 5184 (void *)addr, vprot); 5185 } 5186 endaddr = addr + len; 5187 hblktag.htag_id = sfmmup; 5188 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 5189 DEMAP_RANGE_INIT(sfmmup, &dmr); 5190 5191 while (addr < endaddr) { 5192 hmeshift = HME_HASH_SHIFT(hashno); 5193 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 5194 hblktag.htag_rehash = hashno; 5195 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 5196 5197 SFMMU_HASH_LOCK(hmebp); 5198 5199 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 5200 if (hmeblkp != NULL) { 5201 ASSERT(!hmeblkp->hblk_shared); 5202 /* 5203 * We've encountered a shadow hmeblk so skip the range 5204 * of the next smaller mapping size. 5205 */ 5206 if (hmeblkp->hblk_shw_bit) { 5207 ASSERT(sfmmup != ksfmmup); 5208 ASSERT(hashno > 1); 5209 addr = (caddr_t)P2END((uintptr_t)addr, 5210 TTEBYTES(hashno - 1)); 5211 } else { 5212 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp, 5213 addr, endaddr, &dmr, vprot); 5214 } 5215 SFMMU_HASH_UNLOCK(hmebp); 5216 hashno = 1; 5217 continue; 5218 } 5219 SFMMU_HASH_UNLOCK(hmebp); 5220 5221 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 5222 /* 5223 * We have traversed the whole list and rehashed 5224 * if necessary without finding the address to chgprot. 5225 * This is ok so we increment the address by the 5226 * smallest hmeblk range for kernel mappings and the 5227 * largest hmeblk range, to account for shadow hmeblks, 5228 * for user mappings and continue. 5229 */ 5230 if (sfmmup == ksfmmup) 5231 addr = (caddr_t)P2END((uintptr_t)addr, 5232 TTEBYTES(1)); 5233 else 5234 addr = (caddr_t)P2END((uintptr_t)addr, 5235 TTEBYTES(hashno)); 5236 hashno = 1; 5237 } else { 5238 hashno++; 5239 } 5240 } 5241 5242 sfmmu_hblks_list_purge(&list, 0); 5243 DEMAP_RANGE_FLUSH(&dmr); 5244 cpuset = sfmmup->sfmmu_cpusran; 5245 xt_sync(cpuset); 5246 } 5247 5248 /* 5249 * This function chgprots a range of addresses in an hmeblk. It returns the 5250 * next addres that needs to be chgprot. 5251 * It should be called with the hash lock held. 5252 * XXX It shold be possible to optimize chgprot by not flushing every time but 5253 * on the other hand: 5254 * 1. do one flush crosscall. 5255 * 2. only flush if we are increasing permissions (make sure this will work) 5256 */ 5257 static caddr_t 5258 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 5259 caddr_t endaddr, demap_range_t *dmrp, uint_t vprot) 5260 { 5261 uint_t pprot; 5262 tte_t tte, ttemod; 5263 struct sf_hment *sfhmep; 5264 uint_t tteflags; 5265 int ttesz; 5266 struct page *pp = NULL; 5267 kmutex_t *pml, *pmtx; 5268 int ret; 5269 int use_demap_range; 5270 #if defined(SF_ERRATA_57) 5271 int check_exec; 5272 #endif 5273 5274 ASSERT(in_hblk_range(hmeblkp, addr)); 5275 ASSERT(hmeblkp->hblk_shw_bit == 0); 5276 ASSERT(!hmeblkp->hblk_shared); 5277 5278 #ifdef DEBUG 5279 if (get_hblk_ttesz(hmeblkp) != TTE8K && 5280 (endaddr < get_hblk_endaddr(hmeblkp))) { 5281 panic("sfmmu_hblk_chgprot: partial chgprot of large page"); 5282 } 5283 #endif /* DEBUG */ 5284 5285 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 5286 ttesz = get_hblk_ttesz(hmeblkp); 5287 5288 pprot = sfmmu_vtop_prot(vprot, &tteflags); 5289 #if defined(SF_ERRATA_57) 5290 check_exec = (sfmmup != ksfmmup) && 5291 AS_TYPE_64BIT(sfmmup->sfmmu_as) && 5292 ((vprot & PROT_EXEC) == PROT_EXEC); 5293 #endif 5294 HBLKTOHME(sfhmep, hmeblkp, addr); 5295 5296 /* 5297 * Flush the current demap region if addresses have been 5298 * skipped or the page size doesn't match. 5299 */ 5300 use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE); 5301 if (use_demap_range) { 5302 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 5303 } else if (dmrp != NULL) { 5304 DEMAP_RANGE_FLUSH(dmrp); 5305 } 5306 5307 while (addr < endaddr) { 5308 sfmmu_copytte(&sfhmep->hme_tte, &tte); 5309 if (TTE_IS_VALID(&tte)) { 5310 if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) { 5311 /* 5312 * if the new protection is the same as old 5313 * continue 5314 */ 5315 goto next_addr; 5316 } 5317 pml = NULL; 5318 pp = sfhmep->hme_page; 5319 if (pp) { 5320 pml = sfmmu_mlist_enter(pp); 5321 } 5322 if (pp != sfhmep->hme_page) { 5323 /* 5324 * tte most have been unloaded 5325 * underneath us. Recheck 5326 */ 5327 ASSERT(pml); 5328 sfmmu_mlist_exit(pml); 5329 continue; 5330 } 5331 5332 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5333 5334 ttemod = tte; 5335 TTE_SET_LOFLAGS(&ttemod, tteflags, pprot); 5336 #if defined(SF_ERRATA_57) 5337 if (check_exec && addr < errata57_limit) 5338 ttemod.tte_exec_perm = 0; 5339 #endif 5340 ret = sfmmu_modifytte_try(&tte, &ttemod, 5341 &sfhmep->hme_tte); 5342 5343 if (ret < 0) { 5344 /* tte changed underneath us */ 5345 if (pml) { 5346 sfmmu_mlist_exit(pml); 5347 } 5348 continue; 5349 } 5350 5351 if (tteflags & TTE_HWWR_INT) { 5352 /* 5353 * need to sync if we are clearing modify bit. 5354 */ 5355 sfmmu_ttesync(sfmmup, addr, &tte, pp); 5356 } 5357 5358 if (pp && PP_ISRO(pp)) { 5359 if (pprot & TTE_WRPRM_INT) { 5360 pmtx = sfmmu_page_enter(pp); 5361 PP_CLRRO(pp); 5362 sfmmu_page_exit(pmtx); 5363 } 5364 } 5365 5366 if (ret > 0 && use_demap_range) { 5367 DEMAP_RANGE_MARKPG(dmrp, addr); 5368 } else if (ret > 0) { 5369 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 5370 } 5371 5372 if (pml) { 5373 sfmmu_mlist_exit(pml); 5374 } 5375 } 5376 next_addr: 5377 addr += TTEBYTES(ttesz); 5378 sfhmep++; 5379 DEMAP_RANGE_NEXTPG(dmrp); 5380 } 5381 return (addr); 5382 } 5383 5384 /* 5385 * This routine is deprecated and should only be used by hat_chgprot. 5386 * The correct routine is sfmmu_vtop_attr. 5387 * This routine converts virtual page protections to physical ones. It will 5388 * update the tteflags field with the tte mask corresponding to the protections 5389 * affected and it returns the new protections. It will also clear the modify 5390 * bit if we are taking away write permission. This is necessary since the 5391 * modify bit is the hardware permission bit and we need to clear it in order 5392 * to detect write faults. 5393 * It accepts the following special protections: 5394 * ~PROT_WRITE = remove write permissions. 5395 * ~PROT_USER = remove user permissions. 5396 */ 5397 static uint_t 5398 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp) 5399 { 5400 if (vprot == (uint_t)~PROT_WRITE) { 5401 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT; 5402 return (0); /* will cause wrprm to be cleared */ 5403 } 5404 if (vprot == (uint_t)~PROT_USER) { 5405 *tteflagsp = TTE_PRIV_INT; 5406 return (0); /* will cause privprm to be cleared */ 5407 } 5408 if ((vprot == 0) || (vprot == PROT_USER) || 5409 ((vprot & PROT_ALL) != vprot)) { 5410 panic("sfmmu_vtop_prot -- bad prot %x", vprot); 5411 } 5412 5413 switch (vprot) { 5414 case (PROT_READ): 5415 case (PROT_EXEC): 5416 case (PROT_EXEC | PROT_READ): 5417 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT; 5418 return (TTE_PRIV_INT); /* set prv and clr wrt */ 5419 case (PROT_WRITE): 5420 case (PROT_WRITE | PROT_READ): 5421 case (PROT_EXEC | PROT_WRITE): 5422 case (PROT_EXEC | PROT_WRITE | PROT_READ): 5423 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT; 5424 return (TTE_PRIV_INT | TTE_WRPRM_INT); /* set prv and wrt */ 5425 case (PROT_USER | PROT_READ): 5426 case (PROT_USER | PROT_EXEC): 5427 case (PROT_USER | PROT_EXEC | PROT_READ): 5428 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT; 5429 return (0); /* clr prv and wrt */ 5430 case (PROT_USER | PROT_WRITE): 5431 case (PROT_USER | PROT_WRITE | PROT_READ): 5432 case (PROT_USER | PROT_EXEC | PROT_WRITE): 5433 case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ): 5434 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT; 5435 return (TTE_WRPRM_INT); /* clr prv and set wrt */ 5436 default: 5437 panic("sfmmu_vtop_prot -- bad prot %x", vprot); 5438 } 5439 return (0); 5440 } 5441 5442 /* 5443 * Alternate unload for very large virtual ranges. With a true 64 bit VA, 5444 * the normal algorithm would take too long for a very large VA range with 5445 * few real mappings. This routine just walks thru all HMEs in the global 5446 * hash table to find and remove mappings. 5447 */ 5448 static void 5449 hat_unload_large_virtual(struct hat *sfmmup, caddr_t startaddr, size_t len, 5450 uint_t flags, hat_callback_t *callback) 5451 { 5452 struct hmehash_bucket *hmebp; 5453 struct hme_blk *hmeblkp; 5454 struct hme_blk *pr_hblk = NULL; 5455 struct hme_blk *nx_hblk; 5456 struct hme_blk *list = NULL; 5457 int i; 5458 demap_range_t dmr, *dmrp; 5459 cpuset_t cpuset; 5460 caddr_t endaddr = startaddr + len; 5461 caddr_t sa; 5462 caddr_t ea; 5463 caddr_t cb_sa[MAX_CB_ADDR]; 5464 caddr_t cb_ea[MAX_CB_ADDR]; 5465 int addr_cnt = 0; 5466 int a = 0; 5467 5468 if (sfmmup->sfmmu_free) { 5469 dmrp = NULL; 5470 } else { 5471 dmrp = &dmr; 5472 DEMAP_RANGE_INIT(sfmmup, dmrp); 5473 } 5474 5475 /* 5476 * Loop through all the hash buckets of HME blocks looking for matches. 5477 */ 5478 for (i = 0; i <= UHMEHASH_SZ; i++) { 5479 hmebp = &uhme_hash[i]; 5480 SFMMU_HASH_LOCK(hmebp); 5481 hmeblkp = hmebp->hmeblkp; 5482 pr_hblk = NULL; 5483 while (hmeblkp) { 5484 nx_hblk = hmeblkp->hblk_next; 5485 5486 /* 5487 * skip if not this context, if a shadow block or 5488 * if the mapping is not in the requested range 5489 */ 5490 if (hmeblkp->hblk_tag.htag_id != sfmmup || 5491 hmeblkp->hblk_shw_bit || 5492 (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr || 5493 (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) { 5494 pr_hblk = hmeblkp; 5495 goto next_block; 5496 } 5497 5498 ASSERT(!hmeblkp->hblk_shared); 5499 /* 5500 * unload if there are any current valid mappings 5501 */ 5502 if (hmeblkp->hblk_vcnt != 0 || 5503 hmeblkp->hblk_hmecnt != 0) 5504 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 5505 sa, ea, dmrp, flags); 5506 5507 /* 5508 * on unmap we also release the HME block itself, once 5509 * all mappings are gone. 5510 */ 5511 if ((flags & HAT_UNLOAD_UNMAP) != 0 && 5512 !hmeblkp->hblk_vcnt && 5513 !hmeblkp->hblk_hmecnt) { 5514 ASSERT(!hmeblkp->hblk_lckcnt); 5515 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 5516 &list, 0); 5517 } else { 5518 pr_hblk = hmeblkp; 5519 } 5520 5521 if (callback == NULL) 5522 goto next_block; 5523 5524 /* 5525 * HME blocks may span more than one page, but we may be 5526 * unmapping only one page, so check for a smaller range 5527 * for the callback 5528 */ 5529 if (sa < startaddr) 5530 sa = startaddr; 5531 if (--ea > endaddr) 5532 ea = endaddr - 1; 5533 5534 cb_sa[addr_cnt] = sa; 5535 cb_ea[addr_cnt] = ea; 5536 if (++addr_cnt == MAX_CB_ADDR) { 5537 if (dmrp != NULL) { 5538 DEMAP_RANGE_FLUSH(dmrp); 5539 cpuset = sfmmup->sfmmu_cpusran; 5540 xt_sync(cpuset); 5541 } 5542 5543 for (a = 0; a < MAX_CB_ADDR; ++a) { 5544 callback->hcb_start_addr = cb_sa[a]; 5545 callback->hcb_end_addr = cb_ea[a]; 5546 callback->hcb_function(callback); 5547 } 5548 addr_cnt = 0; 5549 } 5550 5551 next_block: 5552 hmeblkp = nx_hblk; 5553 } 5554 SFMMU_HASH_UNLOCK(hmebp); 5555 } 5556 5557 sfmmu_hblks_list_purge(&list, 0); 5558 if (dmrp != NULL) { 5559 DEMAP_RANGE_FLUSH(dmrp); 5560 cpuset = sfmmup->sfmmu_cpusran; 5561 xt_sync(cpuset); 5562 } 5563 5564 for (a = 0; a < addr_cnt; ++a) { 5565 callback->hcb_start_addr = cb_sa[a]; 5566 callback->hcb_end_addr = cb_ea[a]; 5567 callback->hcb_function(callback); 5568 } 5569 5570 /* 5571 * Check TSB and TLB page sizes if the process isn't exiting. 5572 */ 5573 if (!sfmmup->sfmmu_free) 5574 sfmmu_check_page_sizes(sfmmup, 0); 5575 } 5576 5577 /* 5578 * Unload all the mappings in the range [addr..addr+len). addr and len must 5579 * be MMU_PAGESIZE aligned. 5580 */ 5581 5582 extern struct seg *segkmap; 5583 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \ 5584 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size)) 5585 5586 5587 void 5588 hat_unload_callback(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags, 5589 hat_callback_t *callback) 5590 { 5591 struct hmehash_bucket *hmebp; 5592 hmeblk_tag hblktag; 5593 int hmeshift, hashno, iskernel; 5594 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL; 5595 caddr_t endaddr; 5596 cpuset_t cpuset; 5597 int addr_count = 0; 5598 int a; 5599 caddr_t cb_start_addr[MAX_CB_ADDR]; 5600 caddr_t cb_end_addr[MAX_CB_ADDR]; 5601 int issegkmap = ISSEGKMAP(sfmmup, addr); 5602 demap_range_t dmr, *dmrp; 5603 5604 ASSERT(sfmmup->sfmmu_as != NULL); 5605 5606 ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \ 5607 AS_LOCK_HELD(sfmmup->sfmmu_as)); 5608 5609 ASSERT(sfmmup != NULL); 5610 ASSERT((len & MMU_PAGEOFFSET) == 0); 5611 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 5612 5613 /* 5614 * Probing through a large VA range (say 63 bits) will be slow, even 5615 * at 4 Meg steps between the probes. So, when the virtual address range 5616 * is very large, search the HME entries for what to unload. 5617 * 5618 * len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need 5619 * 5620 * UHMEHASH_SZ is number of hash buckets to examine 5621 * 5622 */ 5623 if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) { 5624 hat_unload_large_virtual(sfmmup, addr, len, flags, callback); 5625 return; 5626 } 5627 5628 CPUSET_ZERO(cpuset); 5629 5630 /* 5631 * If the process is exiting, we can save a lot of fuss since 5632 * we'll flush the TLB when we free the ctx anyway. 5633 */ 5634 if (sfmmup->sfmmu_free) { 5635 dmrp = NULL; 5636 } else { 5637 dmrp = &dmr; 5638 DEMAP_RANGE_INIT(sfmmup, dmrp); 5639 } 5640 5641 endaddr = addr + len; 5642 hblktag.htag_id = sfmmup; 5643 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 5644 5645 /* 5646 * It is likely for the vm to call unload over a wide range of 5647 * addresses that are actually very sparsely populated by 5648 * translations. In order to speed this up the sfmmu hat supports 5649 * the concept of shadow hmeblks. Dummy large page hmeblks that 5650 * correspond to actual small translations are allocated at tteload 5651 * time and are referred to as shadow hmeblks. Now, during unload 5652 * time, we first check if we have a shadow hmeblk for that 5653 * translation. The absence of one means the corresponding address 5654 * range is empty and can be skipped. 5655 * 5656 * The kernel is an exception to above statement and that is why 5657 * we don't use shadow hmeblks and hash starting from the smallest 5658 * page size. 5659 */ 5660 if (sfmmup == KHATID) { 5661 iskernel = 1; 5662 hashno = TTE64K; 5663 } else { 5664 iskernel = 0; 5665 if (mmu_page_sizes == max_mmu_page_sizes) { 5666 hashno = TTE256M; 5667 } else { 5668 hashno = TTE4M; 5669 } 5670 } 5671 while (addr < endaddr) { 5672 hmeshift = HME_HASH_SHIFT(hashno); 5673 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 5674 hblktag.htag_rehash = hashno; 5675 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 5676 5677 SFMMU_HASH_LOCK(hmebp); 5678 5679 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 5680 if (hmeblkp == NULL) { 5681 /* 5682 * didn't find an hmeblk. skip the appropiate 5683 * address range. 5684 */ 5685 SFMMU_HASH_UNLOCK(hmebp); 5686 if (iskernel) { 5687 if (hashno < mmu_hashcnt) { 5688 hashno++; 5689 continue; 5690 } else { 5691 hashno = TTE64K; 5692 addr = (caddr_t)roundup((uintptr_t)addr 5693 + 1, MMU_PAGESIZE64K); 5694 continue; 5695 } 5696 } 5697 addr = (caddr_t)roundup((uintptr_t)addr + 1, 5698 (1 << hmeshift)); 5699 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5700 ASSERT(hashno == TTE64K); 5701 continue; 5702 } 5703 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5704 hashno = TTE512K; 5705 continue; 5706 } 5707 if (mmu_page_sizes == max_mmu_page_sizes) { 5708 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5709 hashno = TTE4M; 5710 continue; 5711 } 5712 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5713 hashno = TTE32M; 5714 continue; 5715 } 5716 hashno = TTE256M; 5717 continue; 5718 } else { 5719 hashno = TTE4M; 5720 continue; 5721 } 5722 } 5723 ASSERT(hmeblkp); 5724 ASSERT(!hmeblkp->hblk_shared); 5725 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 5726 /* 5727 * If the valid count is zero we can skip the range 5728 * mapped by this hmeblk. 5729 * We free hblks in the case of HAT_UNMAP. HAT_UNMAP 5730 * is used by segment drivers as a hint 5731 * that the mapping resource won't be used any longer. 5732 * The best example of this is during exit(). 5733 */ 5734 addr = (caddr_t)roundup((uintptr_t)addr + 1, 5735 get_hblk_span(hmeblkp)); 5736 if ((flags & HAT_UNLOAD_UNMAP) || 5737 (iskernel && !issegkmap)) { 5738 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 5739 &list, 0); 5740 } 5741 SFMMU_HASH_UNLOCK(hmebp); 5742 5743 if (iskernel) { 5744 hashno = TTE64K; 5745 continue; 5746 } 5747 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5748 ASSERT(hashno == TTE64K); 5749 continue; 5750 } 5751 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5752 hashno = TTE512K; 5753 continue; 5754 } 5755 if (mmu_page_sizes == max_mmu_page_sizes) { 5756 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5757 hashno = TTE4M; 5758 continue; 5759 } 5760 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5761 hashno = TTE32M; 5762 continue; 5763 } 5764 hashno = TTE256M; 5765 continue; 5766 } else { 5767 hashno = TTE4M; 5768 continue; 5769 } 5770 } 5771 if (hmeblkp->hblk_shw_bit) { 5772 /* 5773 * If we encounter a shadow hmeblk we know there is 5774 * smaller sized hmeblks mapping the same address space. 5775 * Decrement the hash size and rehash. 5776 */ 5777 ASSERT(sfmmup != KHATID); 5778 hashno--; 5779 SFMMU_HASH_UNLOCK(hmebp); 5780 continue; 5781 } 5782 5783 /* 5784 * track callback address ranges. 5785 * only start a new range when it's not contiguous 5786 */ 5787 if (callback != NULL) { 5788 if (addr_count > 0 && 5789 addr == cb_end_addr[addr_count - 1]) 5790 --addr_count; 5791 else 5792 cb_start_addr[addr_count] = addr; 5793 } 5794 5795 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr, 5796 dmrp, flags); 5797 5798 if (callback != NULL) 5799 cb_end_addr[addr_count++] = addr; 5800 5801 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) && 5802 !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 5803 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0); 5804 } 5805 SFMMU_HASH_UNLOCK(hmebp); 5806 5807 /* 5808 * Notify our caller as to exactly which pages 5809 * have been unloaded. We do these in clumps, 5810 * to minimize the number of xt_sync()s that need to occur. 5811 */ 5812 if (callback != NULL && addr_count == MAX_CB_ADDR) { 5813 if (dmrp != NULL) { 5814 DEMAP_RANGE_FLUSH(dmrp); 5815 cpuset = sfmmup->sfmmu_cpusran; 5816 xt_sync(cpuset); 5817 } 5818 5819 for (a = 0; a < MAX_CB_ADDR; ++a) { 5820 callback->hcb_start_addr = cb_start_addr[a]; 5821 callback->hcb_end_addr = cb_end_addr[a]; 5822 callback->hcb_function(callback); 5823 } 5824 addr_count = 0; 5825 } 5826 if (iskernel) { 5827 hashno = TTE64K; 5828 continue; 5829 } 5830 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5831 ASSERT(hashno == TTE64K); 5832 continue; 5833 } 5834 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5835 hashno = TTE512K; 5836 continue; 5837 } 5838 if (mmu_page_sizes == max_mmu_page_sizes) { 5839 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5840 hashno = TTE4M; 5841 continue; 5842 } 5843 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5844 hashno = TTE32M; 5845 continue; 5846 } 5847 hashno = TTE256M; 5848 } else { 5849 hashno = TTE4M; 5850 } 5851 } 5852 5853 sfmmu_hblks_list_purge(&list, 0); 5854 if (dmrp != NULL) { 5855 DEMAP_RANGE_FLUSH(dmrp); 5856 cpuset = sfmmup->sfmmu_cpusran; 5857 xt_sync(cpuset); 5858 } 5859 if (callback && addr_count != 0) { 5860 for (a = 0; a < addr_count; ++a) { 5861 callback->hcb_start_addr = cb_start_addr[a]; 5862 callback->hcb_end_addr = cb_end_addr[a]; 5863 callback->hcb_function(callback); 5864 } 5865 } 5866 5867 /* 5868 * Check TSB and TLB page sizes if the process isn't exiting. 5869 */ 5870 if (!sfmmup->sfmmu_free) 5871 sfmmu_check_page_sizes(sfmmup, 0); 5872 } 5873 5874 /* 5875 * Unload all the mappings in the range [addr..addr+len). addr and len must 5876 * be MMU_PAGESIZE aligned. 5877 */ 5878 void 5879 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags) 5880 { 5881 hat_unload_callback(sfmmup, addr, len, flags, NULL); 5882 } 5883 5884 5885 /* 5886 * Find the largest mapping size for this page. 5887 */ 5888 int 5889 fnd_mapping_sz(page_t *pp) 5890 { 5891 int sz; 5892 int p_index; 5893 5894 p_index = PP_MAPINDEX(pp); 5895 5896 sz = 0; 5897 p_index >>= 1; /* don't care about 8K bit */ 5898 for (; p_index; p_index >>= 1) { 5899 sz++; 5900 } 5901 5902 return (sz); 5903 } 5904 5905 /* 5906 * This function unloads a range of addresses for an hmeblk. 5907 * It returns the next address to be unloaded. 5908 * It should be called with the hash lock held. 5909 */ 5910 static caddr_t 5911 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 5912 caddr_t endaddr, demap_range_t *dmrp, uint_t flags) 5913 { 5914 tte_t tte, ttemod; 5915 struct sf_hment *sfhmep; 5916 int ttesz; 5917 long ttecnt; 5918 page_t *pp; 5919 kmutex_t *pml; 5920 int ret; 5921 int use_demap_range; 5922 5923 ASSERT(in_hblk_range(hmeblkp, addr)); 5924 ASSERT(!hmeblkp->hblk_shw_bit); 5925 ASSERT(sfmmup != NULL || hmeblkp->hblk_shared); 5926 ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared); 5927 ASSERT(dmrp == NULL || !hmeblkp->hblk_shared); 5928 5929 #ifdef DEBUG 5930 if (get_hblk_ttesz(hmeblkp) != TTE8K && 5931 (endaddr < get_hblk_endaddr(hmeblkp))) { 5932 panic("sfmmu_hblk_unload: partial unload of large page"); 5933 } 5934 #endif /* DEBUG */ 5935 5936 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 5937 ttesz = get_hblk_ttesz(hmeblkp); 5938 5939 use_demap_range = ((dmrp == NULL) || 5940 (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp))); 5941 5942 if (use_demap_range) { 5943 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 5944 } else if (dmrp != NULL) { 5945 DEMAP_RANGE_FLUSH(dmrp); 5946 } 5947 ttecnt = 0; 5948 HBLKTOHME(sfhmep, hmeblkp, addr); 5949 5950 while (addr < endaddr) { 5951 pml = NULL; 5952 sfmmu_copytte(&sfhmep->hme_tte, &tte); 5953 if (TTE_IS_VALID(&tte)) { 5954 pp = sfhmep->hme_page; 5955 if (pp != NULL) { 5956 pml = sfmmu_mlist_enter(pp); 5957 } 5958 5959 /* 5960 * Verify if hme still points to 'pp' now that 5961 * we have p_mapping lock. 5962 */ 5963 if (sfhmep->hme_page != pp) { 5964 if (pp != NULL && sfhmep->hme_page != NULL) { 5965 ASSERT(pml != NULL); 5966 sfmmu_mlist_exit(pml); 5967 /* Re-start this iteration. */ 5968 continue; 5969 } 5970 ASSERT((pp != NULL) && 5971 (sfhmep->hme_page == NULL)); 5972 goto tte_unloaded; 5973 } 5974 5975 /* 5976 * This point on we have both HASH and p_mapping 5977 * lock. 5978 */ 5979 ASSERT(pp == sfhmep->hme_page); 5980 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5981 5982 /* 5983 * We need to loop on modify tte because it is 5984 * possible for pagesync to come along and 5985 * change the software bits beneath us. 5986 * 5987 * Page_unload can also invalidate the tte after 5988 * we read tte outside of p_mapping lock. 5989 */ 5990 again: 5991 ttemod = tte; 5992 5993 TTE_SET_INVALID(&ttemod); 5994 ret = sfmmu_modifytte_try(&tte, &ttemod, 5995 &sfhmep->hme_tte); 5996 5997 if (ret <= 0) { 5998 if (TTE_IS_VALID(&tte)) { 5999 ASSERT(ret < 0); 6000 goto again; 6001 } 6002 if (pp != NULL) { 6003 panic("sfmmu_hblk_unload: pp = 0x%p " 6004 "tte became invalid under mlist" 6005 " lock = 0x%p", (void *)pp, 6006 (void *)pml); 6007 } 6008 continue; 6009 } 6010 6011 if (!(flags & HAT_UNLOAD_NOSYNC)) { 6012 sfmmu_ttesync(sfmmup, addr, &tte, pp); 6013 } 6014 6015 /* 6016 * Ok- we invalidated the tte. Do the rest of the job. 6017 */ 6018 ttecnt++; 6019 6020 if (flags & HAT_UNLOAD_UNLOCK) { 6021 ASSERT(hmeblkp->hblk_lckcnt > 0); 6022 atomic_dec_32(&hmeblkp->hblk_lckcnt); 6023 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK); 6024 } 6025 6026 /* 6027 * Normally we would need to flush the page 6028 * from the virtual cache at this point in 6029 * order to prevent a potential cache alias 6030 * inconsistency. 6031 * The particular scenario we need to worry 6032 * about is: 6033 * Given: va1 and va2 are two virtual address 6034 * that alias and map the same physical 6035 * address. 6036 * 1. mapping exists from va1 to pa and data 6037 * has been read into the cache. 6038 * 2. unload va1. 6039 * 3. load va2 and modify data using va2. 6040 * 4 unload va2. 6041 * 5. load va1 and reference data. Unless we 6042 * flush the data cache when we unload we will 6043 * get stale data. 6044 * Fortunately, page coloring eliminates the 6045 * above scenario by remembering the color a 6046 * physical page was last or is currently 6047 * mapped to. Now, we delay the flush until 6048 * the loading of translations. Only when the 6049 * new translation is of a different color 6050 * are we forced to flush. 6051 */ 6052 if (use_demap_range) { 6053 /* 6054 * Mark this page as needing a demap. 6055 */ 6056 DEMAP_RANGE_MARKPG(dmrp, addr); 6057 } else { 6058 ASSERT(sfmmup != NULL); 6059 ASSERT(!hmeblkp->hblk_shared); 6060 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 6061 sfmmup->sfmmu_free, 0); 6062 } 6063 6064 if (pp) { 6065 /* 6066 * Remove the hment from the mapping list 6067 */ 6068 ASSERT(hmeblkp->hblk_hmecnt > 0); 6069 6070 /* 6071 * Again, we cannot 6072 * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS); 6073 */ 6074 HME_SUB(sfhmep, pp); 6075 membar_stst(); 6076 atomic_dec_16(&hmeblkp->hblk_hmecnt); 6077 } 6078 6079 ASSERT(hmeblkp->hblk_vcnt > 0); 6080 atomic_dec_16(&hmeblkp->hblk_vcnt); 6081 6082 ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt || 6083 !hmeblkp->hblk_lckcnt); 6084 6085 #ifdef VAC 6086 if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) { 6087 if (PP_ISTNC(pp)) { 6088 /* 6089 * If page was temporary 6090 * uncached, try to recache 6091 * it. Note that HME_SUB() was 6092 * called above so p_index and 6093 * mlist had been updated. 6094 */ 6095 conv_tnc(pp, ttesz); 6096 } else if (pp->p_mapping == NULL) { 6097 ASSERT(kpm_enable); 6098 /* 6099 * Page is marked to be in VAC conflict 6100 * to an existing kpm mapping and/or is 6101 * kpm mapped using only the regular 6102 * pagesize. 6103 */ 6104 sfmmu_kpm_hme_unload(pp); 6105 } 6106 } 6107 #endif /* VAC */ 6108 } else if ((pp = sfhmep->hme_page) != NULL) { 6109 /* 6110 * TTE is invalid but the hme 6111 * still exists. let pageunload 6112 * complete its job. 6113 */ 6114 ASSERT(pml == NULL); 6115 pml = sfmmu_mlist_enter(pp); 6116 if (sfhmep->hme_page != NULL) { 6117 sfmmu_mlist_exit(pml); 6118 continue; 6119 } 6120 ASSERT(sfhmep->hme_page == NULL); 6121 } else if (hmeblkp->hblk_hmecnt != 0) { 6122 /* 6123 * pageunload may have not finished decrementing 6124 * hblk_vcnt and hblk_hmecnt. Find page_t if any and 6125 * wait for pageunload to finish. Rely on pageunload 6126 * to decrement hblk_hmecnt after hblk_vcnt. 6127 */ 6128 pfn_t pfn = TTE_TO_TTEPFN(&tte); 6129 ASSERT(pml == NULL); 6130 if (pf_is_memory(pfn)) { 6131 pp = page_numtopp_nolock(pfn); 6132 if (pp != NULL) { 6133 pml = sfmmu_mlist_enter(pp); 6134 sfmmu_mlist_exit(pml); 6135 pml = NULL; 6136 } 6137 } 6138 } 6139 6140 tte_unloaded: 6141 /* 6142 * At this point, the tte we are looking at 6143 * should be unloaded, and hme has been unlinked 6144 * from page too. This is important because in 6145 * pageunload, it does ttesync() then HME_SUB. 6146 * We need to make sure HME_SUB has been completed 6147 * so we know ttesync() has been completed. Otherwise, 6148 * at exit time, after return from hat layer, VM will 6149 * release as structure which hat_setstat() (called 6150 * by ttesync()) needs. 6151 */ 6152 #ifdef DEBUG 6153 { 6154 tte_t dtte; 6155 6156 ASSERT(sfhmep->hme_page == NULL); 6157 6158 sfmmu_copytte(&sfhmep->hme_tte, &dtte); 6159 ASSERT(!TTE_IS_VALID(&dtte)); 6160 } 6161 #endif 6162 6163 if (pml) { 6164 sfmmu_mlist_exit(pml); 6165 } 6166 6167 addr += TTEBYTES(ttesz); 6168 sfhmep++; 6169 DEMAP_RANGE_NEXTPG(dmrp); 6170 } 6171 /* 6172 * For shared hmeblks this routine is only called when region is freed 6173 * and no longer referenced. So no need to decrement ttecnt 6174 * in the region structure here. 6175 */ 6176 if (ttecnt > 0 && sfmmup != NULL) { 6177 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt); 6178 } 6179 return (addr); 6180 } 6181 6182 /* 6183 * Invalidate a virtual address range for the local CPU. 6184 * For best performance ensure that the va range is completely 6185 * mapped, otherwise the entire TLB will be flushed. 6186 */ 6187 void 6188 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size) 6189 { 6190 ssize_t sz; 6191 caddr_t endva = va + size; 6192 6193 while (va < endva) { 6194 sz = hat_getpagesize(sfmmup, va); 6195 if (sz < 0) { 6196 vtag_flushall(); 6197 break; 6198 } 6199 vtag_flushpage(va, (uint64_t)sfmmup); 6200 va += sz; 6201 } 6202 } 6203 6204 /* 6205 * Synchronize all the mappings in the range [addr..addr+len). 6206 * Can be called with clearflag having two states: 6207 * HAT_SYNC_DONTZERO means just return the rm stats 6208 * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats 6209 */ 6210 void 6211 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag) 6212 { 6213 struct hmehash_bucket *hmebp; 6214 hmeblk_tag hblktag; 6215 int hmeshift, hashno = 1; 6216 struct hme_blk *hmeblkp, *list = NULL; 6217 caddr_t endaddr; 6218 cpuset_t cpuset; 6219 6220 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 6221 ASSERT((len & MMU_PAGEOFFSET) == 0); 6222 ASSERT((clearflag == HAT_SYNC_DONTZERO) || 6223 (clearflag == HAT_SYNC_ZERORM)); 6224 6225 CPUSET_ZERO(cpuset); 6226 6227 endaddr = addr + len; 6228 hblktag.htag_id = sfmmup; 6229 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 6230 6231 /* 6232 * Spitfire supports 4 page sizes. 6233 * Most pages are expected to be of the smallest page 6234 * size (8K) and these will not need to be rehashed. 64K 6235 * pages also don't need to be rehashed because the an hmeblk 6236 * spans 64K of address space. 512K pages might need 1 rehash and 6237 * and 4M pages 2 rehashes. 6238 */ 6239 while (addr < endaddr) { 6240 hmeshift = HME_HASH_SHIFT(hashno); 6241 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 6242 hblktag.htag_rehash = hashno; 6243 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 6244 6245 SFMMU_HASH_LOCK(hmebp); 6246 6247 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 6248 if (hmeblkp != NULL) { 6249 ASSERT(!hmeblkp->hblk_shared); 6250 /* 6251 * We've encountered a shadow hmeblk so skip the range 6252 * of the next smaller mapping size. 6253 */ 6254 if (hmeblkp->hblk_shw_bit) { 6255 ASSERT(sfmmup != ksfmmup); 6256 ASSERT(hashno > 1); 6257 addr = (caddr_t)P2END((uintptr_t)addr, 6258 TTEBYTES(hashno - 1)); 6259 } else { 6260 addr = sfmmu_hblk_sync(sfmmup, hmeblkp, 6261 addr, endaddr, clearflag); 6262 } 6263 SFMMU_HASH_UNLOCK(hmebp); 6264 hashno = 1; 6265 continue; 6266 } 6267 SFMMU_HASH_UNLOCK(hmebp); 6268 6269 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 6270 /* 6271 * We have traversed the whole list and rehashed 6272 * if necessary without finding the address to sync. 6273 * This is ok so we increment the address by the 6274 * smallest hmeblk range for kernel mappings and the 6275 * largest hmeblk range, to account for shadow hmeblks, 6276 * for user mappings and continue. 6277 */ 6278 if (sfmmup == ksfmmup) 6279 addr = (caddr_t)P2END((uintptr_t)addr, 6280 TTEBYTES(1)); 6281 else 6282 addr = (caddr_t)P2END((uintptr_t)addr, 6283 TTEBYTES(hashno)); 6284 hashno = 1; 6285 } else { 6286 hashno++; 6287 } 6288 } 6289 sfmmu_hblks_list_purge(&list, 0); 6290 cpuset = sfmmup->sfmmu_cpusran; 6291 xt_sync(cpuset); 6292 } 6293 6294 static caddr_t 6295 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 6296 caddr_t endaddr, int clearflag) 6297 { 6298 tte_t tte, ttemod; 6299 struct sf_hment *sfhmep; 6300 int ttesz; 6301 struct page *pp; 6302 kmutex_t *pml; 6303 int ret; 6304 6305 ASSERT(hmeblkp->hblk_shw_bit == 0); 6306 ASSERT(!hmeblkp->hblk_shared); 6307 6308 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 6309 6310 ttesz = get_hblk_ttesz(hmeblkp); 6311 HBLKTOHME(sfhmep, hmeblkp, addr); 6312 6313 while (addr < endaddr) { 6314 sfmmu_copytte(&sfhmep->hme_tte, &tte); 6315 if (TTE_IS_VALID(&tte)) { 6316 pml = NULL; 6317 pp = sfhmep->hme_page; 6318 if (pp) { 6319 pml = sfmmu_mlist_enter(pp); 6320 } 6321 if (pp != sfhmep->hme_page) { 6322 /* 6323 * tte most have been unloaded 6324 * underneath us. Recheck 6325 */ 6326 ASSERT(pml); 6327 sfmmu_mlist_exit(pml); 6328 continue; 6329 } 6330 6331 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 6332 6333 if (clearflag == HAT_SYNC_ZERORM) { 6334 ttemod = tte; 6335 TTE_CLR_RM(&ttemod); 6336 ret = sfmmu_modifytte_try(&tte, &ttemod, 6337 &sfhmep->hme_tte); 6338 if (ret < 0) { 6339 if (pml) { 6340 sfmmu_mlist_exit(pml); 6341 } 6342 continue; 6343 } 6344 6345 if (ret > 0) { 6346 sfmmu_tlb_demap(addr, sfmmup, 6347 hmeblkp, 0, 0); 6348 } 6349 } 6350 sfmmu_ttesync(sfmmup, addr, &tte, pp); 6351 if (pml) { 6352 sfmmu_mlist_exit(pml); 6353 } 6354 } 6355 addr += TTEBYTES(ttesz); 6356 sfhmep++; 6357 } 6358 return (addr); 6359 } 6360 6361 /* 6362 * This function will sync a tte to the page struct and it will 6363 * update the hat stats. Currently it allows us to pass a NULL pp 6364 * and we will simply update the stats. We may want to change this 6365 * so we only keep stats for pages backed by pp's. 6366 */ 6367 static void 6368 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp) 6369 { 6370 uint_t rm = 0; 6371 int sz; 6372 pgcnt_t npgs; 6373 6374 ASSERT(TTE_IS_VALID(ttep)); 6375 6376 if (TTE_IS_NOSYNC(ttep)) { 6377 return; 6378 } 6379 6380 if (TTE_IS_REF(ttep)) { 6381 rm = P_REF; 6382 } 6383 if (TTE_IS_MOD(ttep)) { 6384 rm |= P_MOD; 6385 } 6386 6387 if (rm == 0) { 6388 return; 6389 } 6390 6391 sz = TTE_CSZ(ttep); 6392 if (sfmmup != NULL && sfmmup->sfmmu_rmstat) { 6393 int i; 6394 caddr_t vaddr = addr; 6395 6396 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) { 6397 hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm); 6398 } 6399 6400 } 6401 6402 /* 6403 * XXX I want to use cas to update nrm bits but they 6404 * currently belong in common/vm and not in hat where 6405 * they should be. 6406 * The nrm bits are protected by the same mutex as 6407 * the one that protects the page's mapping list. 6408 */ 6409 if (!pp) 6410 return; 6411 ASSERT(sfmmu_mlist_held(pp)); 6412 /* 6413 * If the tte is for a large page, we need to sync all the 6414 * pages covered by the tte. 6415 */ 6416 if (sz != TTE8K) { 6417 ASSERT(pp->p_szc != 0); 6418 pp = PP_GROUPLEADER(pp, sz); 6419 ASSERT(sfmmu_mlist_held(pp)); 6420 } 6421 6422 /* Get number of pages from tte size. */ 6423 npgs = TTEPAGES(sz); 6424 6425 do { 6426 ASSERT(pp); 6427 ASSERT(sfmmu_mlist_held(pp)); 6428 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) || 6429 ((rm & P_MOD) != 0 && !PP_ISMOD(pp))) 6430 hat_page_setattr(pp, rm); 6431 6432 /* 6433 * Are we done? If not, we must have a large mapping. 6434 * For large mappings we need to sync the rest of the pages 6435 * covered by this tte; goto the next page. 6436 */ 6437 } while (--npgs > 0 && (pp = PP_PAGENEXT(pp))); 6438 } 6439 6440 /* 6441 * Execute pre-callback handler of each pa_hment linked to pp 6442 * 6443 * Inputs: 6444 * flag: either HAT_PRESUSPEND or HAT_SUSPEND. 6445 * capture_cpus: pointer to return value (below) 6446 * 6447 * Returns: 6448 * Propagates the subsystem callback return values back to the caller; 6449 * returns 0 on success. If capture_cpus is non-NULL, the value returned 6450 * is zero if all of the pa_hments are of a type that do not require 6451 * capturing CPUs prior to suspending the mapping, else it is 1. 6452 */ 6453 static int 6454 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus) 6455 { 6456 struct sf_hment *sfhmep; 6457 struct pa_hment *pahmep; 6458 int (*f)(caddr_t, uint_t, uint_t, void *); 6459 int ret; 6460 id_t id; 6461 int locked = 0; 6462 kmutex_t *pml; 6463 6464 ASSERT(PAGE_EXCL(pp)); 6465 if (!sfmmu_mlist_held(pp)) { 6466 pml = sfmmu_mlist_enter(pp); 6467 locked = 1; 6468 } 6469 6470 if (capture_cpus) 6471 *capture_cpus = 0; 6472 6473 top: 6474 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6475 /* 6476 * skip sf_hments corresponding to VA<->PA mappings; 6477 * for pa_hment's, hme_tte.ll is zero 6478 */ 6479 if (!IS_PAHME(sfhmep)) 6480 continue; 6481 6482 pahmep = sfhmep->hme_data; 6483 ASSERT(pahmep != NULL); 6484 6485 /* 6486 * skip if pre-handler has been called earlier in this loop 6487 */ 6488 if (pahmep->flags & flag) 6489 continue; 6490 6491 id = pahmep->cb_id; 6492 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid); 6493 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0) 6494 *capture_cpus = 1; 6495 if ((f = sfmmu_cb_table[id].prehandler) == NULL) { 6496 pahmep->flags |= flag; 6497 continue; 6498 } 6499 6500 /* 6501 * Drop the mapping list lock to avoid locking order issues. 6502 */ 6503 if (locked) 6504 sfmmu_mlist_exit(pml); 6505 6506 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt); 6507 if (ret != 0) 6508 return (ret); /* caller must do the cleanup */ 6509 6510 if (locked) { 6511 pml = sfmmu_mlist_enter(pp); 6512 pahmep->flags |= flag; 6513 goto top; 6514 } 6515 6516 pahmep->flags |= flag; 6517 } 6518 6519 if (locked) 6520 sfmmu_mlist_exit(pml); 6521 6522 return (0); 6523 } 6524 6525 /* 6526 * Execute post-callback handler of each pa_hment linked to pp 6527 * 6528 * Same overall assumptions and restrictions apply as for 6529 * hat_pageprocess_precallbacks(). 6530 */ 6531 static void 6532 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag) 6533 { 6534 pfn_t pgpfn = pp->p_pagenum; 6535 pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1; 6536 pfn_t newpfn; 6537 struct sf_hment *sfhmep; 6538 struct pa_hment *pahmep; 6539 int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t); 6540 id_t id; 6541 int locked = 0; 6542 kmutex_t *pml; 6543 6544 ASSERT(PAGE_EXCL(pp)); 6545 if (!sfmmu_mlist_held(pp)) { 6546 pml = sfmmu_mlist_enter(pp); 6547 locked = 1; 6548 } 6549 6550 top: 6551 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6552 /* 6553 * skip sf_hments corresponding to VA<->PA mappings; 6554 * for pa_hment's, hme_tte.ll is zero 6555 */ 6556 if (!IS_PAHME(sfhmep)) 6557 continue; 6558 6559 pahmep = sfhmep->hme_data; 6560 ASSERT(pahmep != NULL); 6561 6562 if ((pahmep->flags & flag) == 0) 6563 continue; 6564 6565 pahmep->flags &= ~flag; 6566 6567 id = pahmep->cb_id; 6568 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid); 6569 if ((f = sfmmu_cb_table[id].posthandler) == NULL) 6570 continue; 6571 6572 /* 6573 * Convert the base page PFN into the constituent PFN 6574 * which is needed by the callback handler. 6575 */ 6576 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask); 6577 6578 /* 6579 * Drop the mapping list lock to avoid locking order issues. 6580 */ 6581 if (locked) 6582 sfmmu_mlist_exit(pml); 6583 6584 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn) 6585 != 0) 6586 panic("sfmmu: posthandler failed"); 6587 6588 if (locked) { 6589 pml = sfmmu_mlist_enter(pp); 6590 goto top; 6591 } 6592 } 6593 6594 if (locked) 6595 sfmmu_mlist_exit(pml); 6596 } 6597 6598 /* 6599 * Suspend locked kernel mapping 6600 */ 6601 void 6602 hat_pagesuspend(struct page *pp) 6603 { 6604 struct sf_hment *sfhmep; 6605 sfmmu_t *sfmmup; 6606 tte_t tte, ttemod; 6607 struct hme_blk *hmeblkp; 6608 caddr_t addr; 6609 int index, cons; 6610 cpuset_t cpuset; 6611 6612 ASSERT(PAGE_EXCL(pp)); 6613 ASSERT(sfmmu_mlist_held(pp)); 6614 6615 mutex_enter(&kpr_suspendlock); 6616 6617 /* 6618 * We're about to suspend a kernel mapping so mark this thread as 6619 * non-traceable by DTrace. This prevents us from running into issues 6620 * with probe context trying to touch a suspended page 6621 * in the relocation codepath itself. 6622 */ 6623 curthread->t_flag |= T_DONTDTRACE; 6624 6625 index = PP_MAPINDEX(pp); 6626 cons = TTE8K; 6627 6628 retry: 6629 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6630 6631 if (IS_PAHME(sfhmep)) 6632 continue; 6633 6634 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons) 6635 continue; 6636 6637 /* 6638 * Loop until we successfully set the suspend bit in 6639 * the TTE. 6640 */ 6641 again: 6642 sfmmu_copytte(&sfhmep->hme_tte, &tte); 6643 ASSERT(TTE_IS_VALID(&tte)); 6644 6645 ttemod = tte; 6646 TTE_SET_SUSPEND(&ttemod); 6647 if (sfmmu_modifytte_try(&tte, &ttemod, 6648 &sfhmep->hme_tte) < 0) 6649 goto again; 6650 6651 /* 6652 * Invalidate TSB entry 6653 */ 6654 hmeblkp = sfmmu_hmetohblk(sfhmep); 6655 6656 sfmmup = hblktosfmmu(hmeblkp); 6657 ASSERT(sfmmup == ksfmmup); 6658 ASSERT(!hmeblkp->hblk_shared); 6659 6660 addr = tte_to_vaddr(hmeblkp, tte); 6661 6662 /* 6663 * No need to make sure that the TSB for this sfmmu is 6664 * not being relocated since it is ksfmmup and thus it 6665 * will never be relocated. 6666 */ 6667 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 6668 6669 /* 6670 * Update xcall stats 6671 */ 6672 cpuset = cpu_ready_set; 6673 CPUSET_DEL(cpuset, CPU->cpu_id); 6674 6675 /* LINTED: constant in conditional context */ 6676 SFMMU_XCALL_STATS(ksfmmup); 6677 6678 /* 6679 * Flush TLB entry on remote CPU's 6680 */ 6681 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, 6682 (uint64_t)ksfmmup); 6683 xt_sync(cpuset); 6684 6685 /* 6686 * Flush TLB entry on local CPU 6687 */ 6688 vtag_flushpage(addr, (uint64_t)ksfmmup); 6689 } 6690 6691 while (index != 0) { 6692 index = index >> 1; 6693 if (index != 0) 6694 cons++; 6695 if (index & 0x1) { 6696 pp = PP_GROUPLEADER(pp, cons); 6697 goto retry; 6698 } 6699 } 6700 } 6701 6702 #ifdef DEBUG 6703 6704 #define N_PRLE 1024 6705 struct prle { 6706 page_t *targ; 6707 page_t *repl; 6708 int status; 6709 int pausecpus; 6710 hrtime_t whence; 6711 }; 6712 6713 static struct prle page_relocate_log[N_PRLE]; 6714 static int prl_entry; 6715 static kmutex_t prl_mutex; 6716 6717 #define PAGE_RELOCATE_LOG(t, r, s, p) \ 6718 mutex_enter(&prl_mutex); \ 6719 page_relocate_log[prl_entry].targ = *(t); \ 6720 page_relocate_log[prl_entry].repl = *(r); \ 6721 page_relocate_log[prl_entry].status = (s); \ 6722 page_relocate_log[prl_entry].pausecpus = (p); \ 6723 page_relocate_log[prl_entry].whence = gethrtime(); \ 6724 prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1; \ 6725 mutex_exit(&prl_mutex); 6726 6727 #else /* !DEBUG */ 6728 #define PAGE_RELOCATE_LOG(t, r, s, p) 6729 #endif 6730 6731 /* 6732 * Core Kernel Page Relocation Algorithm 6733 * 6734 * Input: 6735 * 6736 * target : constituent pages are SE_EXCL locked. 6737 * replacement: constituent pages are SE_EXCL locked. 6738 * 6739 * Output: 6740 * 6741 * nrelocp: number of pages relocated 6742 */ 6743 int 6744 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp) 6745 { 6746 page_t *targ, *repl; 6747 page_t *tpp, *rpp; 6748 kmutex_t *low, *high; 6749 spgcnt_t npages, i; 6750 page_t *pl = NULL; 6751 int old_pil; 6752 cpuset_t cpuset; 6753 int cap_cpus; 6754 int ret; 6755 #ifdef VAC 6756 int cflags = 0; 6757 #endif 6758 6759 if (!kcage_on || PP_ISNORELOC(*target)) { 6760 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1); 6761 return (EAGAIN); 6762 } 6763 6764 mutex_enter(&kpr_mutex); 6765 kreloc_thread = curthread; 6766 6767 targ = *target; 6768 repl = *replacement; 6769 ASSERT(repl != NULL); 6770 ASSERT(targ->p_szc == repl->p_szc); 6771 6772 npages = page_get_pagecnt(targ->p_szc); 6773 6774 /* 6775 * unload VA<->PA mappings that are not locked 6776 */ 6777 tpp = targ; 6778 for (i = 0; i < npages; i++) { 6779 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC); 6780 tpp++; 6781 } 6782 6783 /* 6784 * Do "presuspend" callbacks, in a context from which we can still 6785 * block as needed. Note that we don't hold the mapping list lock 6786 * of "targ" at this point due to potential locking order issues; 6787 * we assume that between the hat_pageunload() above and holding 6788 * the SE_EXCL lock that the mapping list *cannot* change at this 6789 * point. 6790 */ 6791 ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus); 6792 if (ret != 0) { 6793 /* 6794 * EIO translates to fatal error, for all others cleanup 6795 * and return EAGAIN. 6796 */ 6797 ASSERT(ret != EIO); 6798 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND); 6799 PAGE_RELOCATE_LOG(target, replacement, ret, -1); 6800 kreloc_thread = NULL; 6801 mutex_exit(&kpr_mutex); 6802 return (EAGAIN); 6803 } 6804 6805 /* 6806 * acquire p_mapping list lock for both the target and replacement 6807 * root pages. 6808 * 6809 * low and high refer to the need to grab the mlist locks in a 6810 * specific order in order to prevent race conditions. Thus the 6811 * lower lock must be grabbed before the higher lock. 6812 * 6813 * This will block hat_unload's accessing p_mapping list. Since 6814 * we have SE_EXCL lock, hat_memload and hat_pageunload will be 6815 * blocked. Thus, no one else will be accessing the p_mapping list 6816 * while we suspend and reload the locked mapping below. 6817 */ 6818 tpp = targ; 6819 rpp = repl; 6820 sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high); 6821 6822 kpreempt_disable(); 6823 6824 /* 6825 * We raise our PIL to 13 so that we don't get captured by 6826 * another CPU or pinned by an interrupt thread. We can't go to 6827 * PIL 14 since the nexus driver(s) may need to interrupt at 6828 * that level in the case of IOMMU pseudo mappings. 6829 */ 6830 cpuset = cpu_ready_set; 6831 CPUSET_DEL(cpuset, CPU->cpu_id); 6832 if (!cap_cpus || CPUSET_ISNULL(cpuset)) { 6833 old_pil = splr(XCALL_PIL); 6834 } else { 6835 old_pil = -1; 6836 xc_attention(cpuset); 6837 } 6838 ASSERT(getpil() == XCALL_PIL); 6839 6840 /* 6841 * Now do suspend callbacks. In the case of an IOMMU mapping 6842 * this will suspend all DMA activity to the page while it is 6843 * being relocated. Since we are well above LOCK_LEVEL and CPUs 6844 * may be captured at this point we should have acquired any needed 6845 * locks in the presuspend callback. 6846 */ 6847 ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL); 6848 if (ret != 0) { 6849 repl = targ; 6850 goto suspend_fail; 6851 } 6852 6853 /* 6854 * Raise the PIL yet again, this time to block all high-level 6855 * interrupts on this CPU. This is necessary to prevent an 6856 * interrupt routine from pinning the thread which holds the 6857 * mapping suspended and then touching the suspended page. 6858 * 6859 * Once the page is suspended we also need to be careful to 6860 * avoid calling any functions which touch any seg_kmem memory 6861 * since that memory may be backed by the very page we are 6862 * relocating in here! 6863 */ 6864 hat_pagesuspend(targ); 6865 6866 /* 6867 * Now that we are confident everybody has stopped using this page, 6868 * copy the page contents. Note we use a physical copy to prevent 6869 * locking issues and to avoid fpRAS because we can't handle it in 6870 * this context. 6871 */ 6872 for (i = 0; i < npages; i++, tpp++, rpp++) { 6873 #ifdef VAC 6874 /* 6875 * If the replacement has a different vcolor than 6876 * the one being replacd, we need to handle VAC 6877 * consistency for it just as we were setting up 6878 * a new mapping to it. 6879 */ 6880 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) && 6881 (tpp->p_vcolor != rpp->p_vcolor) && 6882 !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) { 6883 CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp)); 6884 sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp), 6885 rpp->p_pagenum); 6886 } 6887 #endif 6888 /* 6889 * Copy the contents of the page. 6890 */ 6891 ppcopy_kernel(tpp, rpp); 6892 } 6893 6894 tpp = targ; 6895 rpp = repl; 6896 for (i = 0; i < npages; i++, tpp++, rpp++) { 6897 /* 6898 * Copy attributes. VAC consistency was handled above, 6899 * if required. 6900 */ 6901 rpp->p_nrm = tpp->p_nrm; 6902 tpp->p_nrm = 0; 6903 rpp->p_index = tpp->p_index; 6904 tpp->p_index = 0; 6905 #ifdef VAC 6906 rpp->p_vcolor = tpp->p_vcolor; 6907 #endif 6908 } 6909 6910 /* 6911 * First, unsuspend the page, if we set the suspend bit, and transfer 6912 * the mapping list from the target page to the replacement page. 6913 * Next process postcallbacks; since pa_hment's are linked only to the 6914 * p_mapping list of root page, we don't iterate over the constituent 6915 * pages. 6916 */ 6917 hat_pagereload(targ, repl); 6918 6919 suspend_fail: 6920 hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND); 6921 6922 /* 6923 * Now lower our PIL and release any captured CPUs since we 6924 * are out of the "danger zone". After this it will again be 6925 * safe to acquire adaptive mutex locks, or to drop them... 6926 */ 6927 if (old_pil != -1) { 6928 splx(old_pil); 6929 } else { 6930 xc_dismissed(cpuset); 6931 } 6932 6933 kpreempt_enable(); 6934 6935 sfmmu_mlist_reloc_exit(low, high); 6936 6937 /* 6938 * Postsuspend callbacks should drop any locks held across 6939 * the suspend callbacks. As before, we don't hold the mapping 6940 * list lock at this point.. our assumption is that the mapping 6941 * list still can't change due to our holding SE_EXCL lock and 6942 * there being no unlocked mappings left. Hence the restriction 6943 * on calling context to hat_delete_callback() 6944 */ 6945 hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND); 6946 if (ret != 0) { 6947 /* 6948 * The second presuspend call failed: we got here through 6949 * the suspend_fail label above. 6950 */ 6951 ASSERT(ret != EIO); 6952 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus); 6953 kreloc_thread = NULL; 6954 mutex_exit(&kpr_mutex); 6955 return (EAGAIN); 6956 } 6957 6958 /* 6959 * Now that we're out of the performance critical section we can 6960 * take care of updating the hash table, since we still 6961 * hold all the pages locked SE_EXCL at this point we 6962 * needn't worry about things changing out from under us. 6963 */ 6964 tpp = targ; 6965 rpp = repl; 6966 for (i = 0; i < npages; i++, tpp++, rpp++) { 6967 6968 /* 6969 * replace targ with replacement in page_hash table 6970 */ 6971 targ = tpp; 6972 page_relocate_hash(rpp, targ); 6973 6974 /* 6975 * concatenate target; caller of platform_page_relocate() 6976 * expects target to be concatenated after returning. 6977 */ 6978 ASSERT(targ->p_next == targ); 6979 ASSERT(targ->p_prev == targ); 6980 page_list_concat(&pl, &targ); 6981 } 6982 6983 ASSERT(*target == pl); 6984 *nrelocp = npages; 6985 PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus); 6986 kreloc_thread = NULL; 6987 mutex_exit(&kpr_mutex); 6988 return (0); 6989 } 6990 6991 /* 6992 * Called when stray pa_hments are found attached to a page which is 6993 * being freed. Notify the subsystem which attached the pa_hment of 6994 * the error if it registered a suitable handler, else panic. 6995 */ 6996 static void 6997 sfmmu_pahment_leaked(struct pa_hment *pahmep) 6998 { 6999 id_t cb_id = pahmep->cb_id; 7000 7001 ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid); 7002 if (sfmmu_cb_table[cb_id].errhandler != NULL) { 7003 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len, 7004 HAT_CB_ERR_LEAKED, pahmep->pvt) == 0) 7005 return; /* non-fatal */ 7006 } 7007 panic("pa_hment leaked: 0x%p", (void *)pahmep); 7008 } 7009 7010 /* 7011 * Remove all mappings to page 'pp'. 7012 */ 7013 int 7014 hat_pageunload(struct page *pp, uint_t forceflag) 7015 { 7016 struct page *origpp = pp; 7017 struct sf_hment *sfhme, *tmphme; 7018 struct hme_blk *hmeblkp; 7019 kmutex_t *pml; 7020 #ifdef VAC 7021 kmutex_t *pmtx; 7022 #endif 7023 cpuset_t cpuset, tset; 7024 int index, cons; 7025 int pa_hments; 7026 7027 ASSERT(PAGE_EXCL(pp)); 7028 7029 tmphme = NULL; 7030 pa_hments = 0; 7031 CPUSET_ZERO(cpuset); 7032 7033 pml = sfmmu_mlist_enter(pp); 7034 7035 #ifdef VAC 7036 if (pp->p_kpmref) 7037 sfmmu_kpm_pageunload(pp); 7038 ASSERT(!PP_ISMAPPED_KPM(pp)); 7039 #endif 7040 /* 7041 * Clear vpm reference. Since the page is exclusively locked 7042 * vpm cannot be referencing it. 7043 */ 7044 if (vpm_enable) { 7045 pp->p_vpmref = 0; 7046 } 7047 7048 index = PP_MAPINDEX(pp); 7049 cons = TTE8K; 7050 retry: 7051 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7052 tmphme = sfhme->hme_next; 7053 7054 if (IS_PAHME(sfhme)) { 7055 ASSERT(sfhme->hme_data != NULL); 7056 pa_hments++; 7057 continue; 7058 } 7059 7060 hmeblkp = sfmmu_hmetohblk(sfhme); 7061 7062 /* 7063 * If there are kernel mappings don't unload them, they will 7064 * be suspended. 7065 */ 7066 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt && 7067 hmeblkp->hblk_tag.htag_id == ksfmmup) 7068 continue; 7069 7070 tset = sfmmu_pageunload(pp, sfhme, cons); 7071 CPUSET_OR(cpuset, tset); 7072 } 7073 7074 while (index != 0) { 7075 index = index >> 1; 7076 if (index != 0) 7077 cons++; 7078 if (index & 0x1) { 7079 /* Go to leading page */ 7080 pp = PP_GROUPLEADER(pp, cons); 7081 ASSERT(sfmmu_mlist_held(pp)); 7082 goto retry; 7083 } 7084 } 7085 7086 /* 7087 * cpuset may be empty if the page was only mapped by segkpm, 7088 * in which case we won't actually cross-trap. 7089 */ 7090 xt_sync(cpuset); 7091 7092 /* 7093 * The page should have no mappings at this point, unless 7094 * we were called from hat_page_relocate() in which case we 7095 * leave the locked mappings which will be suspended later. 7096 */ 7097 ASSERT(!PP_ISMAPPED(origpp) || pa_hments || 7098 (forceflag == SFMMU_KERNEL_RELOC)); 7099 7100 #ifdef VAC 7101 if (PP_ISTNC(pp)) { 7102 if (cons == TTE8K) { 7103 pmtx = sfmmu_page_enter(pp); 7104 PP_CLRTNC(pp); 7105 sfmmu_page_exit(pmtx); 7106 } else { 7107 conv_tnc(pp, cons); 7108 } 7109 } 7110 #endif /* VAC */ 7111 7112 if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) { 7113 /* 7114 * Unlink any pa_hments and free them, calling back 7115 * the responsible subsystem to notify it of the error. 7116 * This can occur in situations such as drivers leaking 7117 * DMA handles: naughty, but common enough that we'd like 7118 * to keep the system running rather than bringing it 7119 * down with an obscure error like "pa_hment leaked" 7120 * which doesn't aid the user in debugging their driver. 7121 */ 7122 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7123 tmphme = sfhme->hme_next; 7124 if (IS_PAHME(sfhme)) { 7125 struct pa_hment *pahmep = sfhme->hme_data; 7126 sfmmu_pahment_leaked(pahmep); 7127 HME_SUB(sfhme, pp); 7128 kmem_cache_free(pa_hment_cache, pahmep); 7129 } 7130 } 7131 7132 ASSERT(!PP_ISMAPPED(origpp)); 7133 } 7134 7135 sfmmu_mlist_exit(pml); 7136 7137 return (0); 7138 } 7139 7140 cpuset_t 7141 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons) 7142 { 7143 struct hme_blk *hmeblkp; 7144 sfmmu_t *sfmmup; 7145 tte_t tte, ttemod; 7146 #ifdef DEBUG 7147 tte_t orig_old; 7148 #endif /* DEBUG */ 7149 caddr_t addr; 7150 int ttesz; 7151 int ret; 7152 cpuset_t cpuset; 7153 7154 ASSERT(pp != NULL); 7155 ASSERT(sfmmu_mlist_held(pp)); 7156 ASSERT(!PP_ISKAS(pp)); 7157 7158 CPUSET_ZERO(cpuset); 7159 7160 hmeblkp = sfmmu_hmetohblk(sfhme); 7161 7162 readtte: 7163 sfmmu_copytte(&sfhme->hme_tte, &tte); 7164 if (TTE_IS_VALID(&tte)) { 7165 sfmmup = hblktosfmmu(hmeblkp); 7166 ttesz = get_hblk_ttesz(hmeblkp); 7167 /* 7168 * Only unload mappings of 'cons' size. 7169 */ 7170 if (ttesz != cons) 7171 return (cpuset); 7172 7173 /* 7174 * Note that we have p_mapping lock, but no hash lock here. 7175 * hblk_unload() has to have both hash lock AND p_mapping 7176 * lock before it tries to modify tte. So, the tte could 7177 * not become invalid in the sfmmu_modifytte_try() below. 7178 */ 7179 ttemod = tte; 7180 #ifdef DEBUG 7181 orig_old = tte; 7182 #endif /* DEBUG */ 7183 7184 TTE_SET_INVALID(&ttemod); 7185 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 7186 if (ret < 0) { 7187 #ifdef DEBUG 7188 /* only R/M bits can change. */ 7189 chk_tte(&orig_old, &tte, &ttemod, hmeblkp); 7190 #endif /* DEBUG */ 7191 goto readtte; 7192 } 7193 7194 if (ret == 0) { 7195 panic("pageunload: cas failed?"); 7196 } 7197 7198 addr = tte_to_vaddr(hmeblkp, tte); 7199 7200 if (hmeblkp->hblk_shared) { 7201 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7202 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7203 sf_region_t *rgnp; 7204 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7205 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7206 ASSERT(srdp != NULL); 7207 rgnp = srdp->srd_hmergnp[rid]; 7208 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 7209 cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1); 7210 sfmmu_ttesync(NULL, addr, &tte, pp); 7211 ASSERT(rgnp->rgn_ttecnt[ttesz] > 0); 7212 atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]); 7213 } else { 7214 sfmmu_ttesync(sfmmup, addr, &tte, pp); 7215 atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]); 7216 7217 /* 7218 * We need to flush the page from the virtual cache 7219 * in order to prevent a virtual cache alias 7220 * inconsistency. The particular scenario we need 7221 * to worry about is: 7222 * Given: va1 and va2 are two virtual address that 7223 * alias and will map the same physical address. 7224 * 1. mapping exists from va1 to pa and data has 7225 * been read into the cache. 7226 * 2. unload va1. 7227 * 3. load va2 and modify data using va2. 7228 * 4 unload va2. 7229 * 5. load va1 and reference data. Unless we flush 7230 * the data cache when we unload we will get 7231 * stale data. 7232 * This scenario is taken care of by using virtual 7233 * page coloring. 7234 */ 7235 if (sfmmup->sfmmu_ismhat) { 7236 /* 7237 * Flush TSBs, TLBs and caches 7238 * of every process 7239 * sharing this ism segment. 7240 */ 7241 sfmmu_hat_lock_all(); 7242 mutex_enter(&ism_mlist_lock); 7243 kpreempt_disable(); 7244 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp, 7245 pp->p_pagenum, CACHE_NO_FLUSH); 7246 kpreempt_enable(); 7247 mutex_exit(&ism_mlist_lock); 7248 sfmmu_hat_unlock_all(); 7249 cpuset = cpu_ready_set; 7250 } else { 7251 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 7252 cpuset = sfmmup->sfmmu_cpusran; 7253 } 7254 } 7255 7256 /* 7257 * Hme_sub has to run after ttesync() and a_rss update. 7258 * See hblk_unload(). 7259 */ 7260 HME_SUB(sfhme, pp); 7261 membar_stst(); 7262 7263 /* 7264 * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS) 7265 * since pteload may have done a HME_ADD() right after 7266 * we did the HME_SUB() above. Hmecnt is now maintained 7267 * by cas only. no lock guranteed its value. The only 7268 * gurantee we have is the hmecnt should not be less than 7269 * what it should be so the hblk will not be taken away. 7270 * It's also important that we decremented the hmecnt after 7271 * we are done with hmeblkp so that this hmeblk won't be 7272 * stolen. 7273 */ 7274 ASSERT(hmeblkp->hblk_hmecnt > 0); 7275 ASSERT(hmeblkp->hblk_vcnt > 0); 7276 atomic_dec_16(&hmeblkp->hblk_vcnt); 7277 atomic_dec_16(&hmeblkp->hblk_hmecnt); 7278 /* 7279 * This is bug 4063182. 7280 * XXX: fixme 7281 * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt || 7282 * !hmeblkp->hblk_lckcnt); 7283 */ 7284 } else { 7285 panic("invalid tte? pp %p &tte %p", 7286 (void *)pp, (void *)&tte); 7287 } 7288 7289 return (cpuset); 7290 } 7291 7292 /* 7293 * While relocating a kernel page, this function will move the mappings 7294 * from tpp to dpp and modify any associated data with these mappings. 7295 * It also unsuspends the suspended kernel mapping. 7296 */ 7297 static void 7298 hat_pagereload(struct page *tpp, struct page *dpp) 7299 { 7300 struct sf_hment *sfhme; 7301 tte_t tte, ttemod; 7302 int index, cons; 7303 7304 ASSERT(getpil() == PIL_MAX); 7305 ASSERT(sfmmu_mlist_held(tpp)); 7306 ASSERT(sfmmu_mlist_held(dpp)); 7307 7308 index = PP_MAPINDEX(tpp); 7309 cons = TTE8K; 7310 7311 /* Update real mappings to the page */ 7312 retry: 7313 for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) { 7314 if (IS_PAHME(sfhme)) 7315 continue; 7316 sfmmu_copytte(&sfhme->hme_tte, &tte); 7317 ttemod = tte; 7318 7319 /* 7320 * replace old pfn with new pfn in TTE 7321 */ 7322 PFN_TO_TTE(ttemod, dpp->p_pagenum); 7323 7324 /* 7325 * clear suspend bit 7326 */ 7327 ASSERT(TTE_IS_SUSPEND(&ttemod)); 7328 TTE_CLR_SUSPEND(&ttemod); 7329 7330 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0) 7331 panic("hat_pagereload(): sfmmu_modifytte_try() failed"); 7332 7333 /* 7334 * set hme_page point to new page 7335 */ 7336 sfhme->hme_page = dpp; 7337 } 7338 7339 /* 7340 * move p_mapping list from old page to new page 7341 */ 7342 dpp->p_mapping = tpp->p_mapping; 7343 tpp->p_mapping = NULL; 7344 dpp->p_share = tpp->p_share; 7345 tpp->p_share = 0; 7346 7347 while (index != 0) { 7348 index = index >> 1; 7349 if (index != 0) 7350 cons++; 7351 if (index & 0x1) { 7352 tpp = PP_GROUPLEADER(tpp, cons); 7353 dpp = PP_GROUPLEADER(dpp, cons); 7354 goto retry; 7355 } 7356 } 7357 7358 curthread->t_flag &= ~T_DONTDTRACE; 7359 mutex_exit(&kpr_suspendlock); 7360 } 7361 7362 uint_t 7363 hat_pagesync(struct page *pp, uint_t clearflag) 7364 { 7365 struct sf_hment *sfhme, *tmphme = NULL; 7366 struct hme_blk *hmeblkp; 7367 kmutex_t *pml; 7368 cpuset_t cpuset, tset; 7369 int index, cons; 7370 extern ulong_t po_share; 7371 page_t *save_pp = pp; 7372 int stop_on_sh = 0; 7373 uint_t shcnt; 7374 7375 CPUSET_ZERO(cpuset); 7376 7377 if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) { 7378 return (PP_GENERIC_ATTR(pp)); 7379 } 7380 7381 if ((clearflag & HAT_SYNC_ZERORM) == 0) { 7382 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) { 7383 return (PP_GENERIC_ATTR(pp)); 7384 } 7385 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) { 7386 return (PP_GENERIC_ATTR(pp)); 7387 } 7388 if (clearflag & HAT_SYNC_STOPON_SHARED) { 7389 if (pp->p_share > po_share) { 7390 hat_page_setattr(pp, P_REF); 7391 return (PP_GENERIC_ATTR(pp)); 7392 } 7393 stop_on_sh = 1; 7394 shcnt = 0; 7395 } 7396 } 7397 7398 clearflag &= ~HAT_SYNC_STOPON_SHARED; 7399 pml = sfmmu_mlist_enter(pp); 7400 index = PP_MAPINDEX(pp); 7401 cons = TTE8K; 7402 retry: 7403 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7404 /* 7405 * We need to save the next hment on the list since 7406 * it is possible for pagesync to remove an invalid hment 7407 * from the list. 7408 */ 7409 tmphme = sfhme->hme_next; 7410 if (IS_PAHME(sfhme)) 7411 continue; 7412 /* 7413 * If we are looking for large mappings and this hme doesn't 7414 * reach the range we are seeking, just ignore it. 7415 */ 7416 hmeblkp = sfmmu_hmetohblk(sfhme); 7417 7418 if (hme_size(sfhme) < cons) 7419 continue; 7420 7421 if (stop_on_sh) { 7422 if (hmeblkp->hblk_shared) { 7423 sf_srd_t *srdp = hblktosrd(hmeblkp); 7424 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7425 sf_region_t *rgnp; 7426 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7427 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7428 ASSERT(srdp != NULL); 7429 rgnp = srdp->srd_hmergnp[rid]; 7430 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, 7431 rgnp, rid); 7432 shcnt += rgnp->rgn_refcnt; 7433 } else { 7434 shcnt++; 7435 } 7436 if (shcnt > po_share) { 7437 /* 7438 * tell the pager to spare the page this time 7439 * around. 7440 */ 7441 hat_page_setattr(save_pp, P_REF); 7442 index = 0; 7443 break; 7444 } 7445 } 7446 tset = sfmmu_pagesync(pp, sfhme, 7447 clearflag & ~HAT_SYNC_STOPON_RM); 7448 CPUSET_OR(cpuset, tset); 7449 7450 /* 7451 * If clearflag is HAT_SYNC_DONTZERO, break out as soon 7452 * as the "ref" or "mod" is set or share cnt exceeds po_share. 7453 */ 7454 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO && 7455 (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) || 7456 ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) { 7457 index = 0; 7458 break; 7459 } 7460 } 7461 7462 while (index) { 7463 index = index >> 1; 7464 cons++; 7465 if (index & 0x1) { 7466 /* Go to leading page */ 7467 pp = PP_GROUPLEADER(pp, cons); 7468 goto retry; 7469 } 7470 } 7471 7472 xt_sync(cpuset); 7473 sfmmu_mlist_exit(pml); 7474 return (PP_GENERIC_ATTR(save_pp)); 7475 } 7476 7477 /* 7478 * Get all the hardware dependent attributes for a page struct 7479 */ 7480 static cpuset_t 7481 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme, 7482 uint_t clearflag) 7483 { 7484 caddr_t addr; 7485 tte_t tte, ttemod; 7486 struct hme_blk *hmeblkp; 7487 int ret; 7488 sfmmu_t *sfmmup; 7489 cpuset_t cpuset; 7490 7491 ASSERT(pp != NULL); 7492 ASSERT(sfmmu_mlist_held(pp)); 7493 ASSERT((clearflag == HAT_SYNC_DONTZERO) || 7494 (clearflag == HAT_SYNC_ZERORM)); 7495 7496 SFMMU_STAT(sf_pagesync); 7497 7498 CPUSET_ZERO(cpuset); 7499 7500 sfmmu_pagesync_retry: 7501 7502 sfmmu_copytte(&sfhme->hme_tte, &tte); 7503 if (TTE_IS_VALID(&tte)) { 7504 hmeblkp = sfmmu_hmetohblk(sfhme); 7505 sfmmup = hblktosfmmu(hmeblkp); 7506 addr = tte_to_vaddr(hmeblkp, tte); 7507 if (clearflag == HAT_SYNC_ZERORM) { 7508 ttemod = tte; 7509 TTE_CLR_RM(&ttemod); 7510 ret = sfmmu_modifytte_try(&tte, &ttemod, 7511 &sfhme->hme_tte); 7512 if (ret < 0) { 7513 /* 7514 * cas failed and the new value is not what 7515 * we want. 7516 */ 7517 goto sfmmu_pagesync_retry; 7518 } 7519 7520 if (ret > 0) { 7521 /* we win the cas */ 7522 if (hmeblkp->hblk_shared) { 7523 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7524 uint_t rid = 7525 hmeblkp->hblk_tag.htag_rid; 7526 sf_region_t *rgnp; 7527 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7528 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7529 ASSERT(srdp != NULL); 7530 rgnp = srdp->srd_hmergnp[rid]; 7531 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 7532 srdp, rgnp, rid); 7533 cpuset = sfmmu_rgntlb_demap(addr, 7534 rgnp, hmeblkp, 1); 7535 } else { 7536 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 7537 0, 0); 7538 cpuset = sfmmup->sfmmu_cpusran; 7539 } 7540 } 7541 } 7542 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr, 7543 &tte, pp); 7544 } 7545 return (cpuset); 7546 } 7547 7548 /* 7549 * Remove write permission from a mappings to a page, so that 7550 * we can detect the next modification of it. This requires modifying 7551 * the TTE then invalidating (demap) any TLB entry using that TTE. 7552 * This code is similar to sfmmu_pagesync(). 7553 */ 7554 static cpuset_t 7555 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme) 7556 { 7557 caddr_t addr; 7558 tte_t tte; 7559 tte_t ttemod; 7560 struct hme_blk *hmeblkp; 7561 int ret; 7562 sfmmu_t *sfmmup; 7563 cpuset_t cpuset; 7564 7565 ASSERT(pp != NULL); 7566 ASSERT(sfmmu_mlist_held(pp)); 7567 7568 CPUSET_ZERO(cpuset); 7569 SFMMU_STAT(sf_clrwrt); 7570 7571 retry: 7572 7573 sfmmu_copytte(&sfhme->hme_tte, &tte); 7574 if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) { 7575 hmeblkp = sfmmu_hmetohblk(sfhme); 7576 sfmmup = hblktosfmmu(hmeblkp); 7577 addr = tte_to_vaddr(hmeblkp, tte); 7578 7579 ttemod = tte; 7580 TTE_CLR_WRT(&ttemod); 7581 TTE_CLR_MOD(&ttemod); 7582 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 7583 7584 /* 7585 * if cas failed and the new value is not what 7586 * we want retry 7587 */ 7588 if (ret < 0) 7589 goto retry; 7590 7591 /* we win the cas */ 7592 if (ret > 0) { 7593 if (hmeblkp->hblk_shared) { 7594 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7595 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7596 sf_region_t *rgnp; 7597 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7598 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7599 ASSERT(srdp != NULL); 7600 rgnp = srdp->srd_hmergnp[rid]; 7601 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 7602 srdp, rgnp, rid); 7603 cpuset = sfmmu_rgntlb_demap(addr, 7604 rgnp, hmeblkp, 1); 7605 } else { 7606 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 7607 cpuset = sfmmup->sfmmu_cpusran; 7608 } 7609 } 7610 } 7611 7612 return (cpuset); 7613 } 7614 7615 /* 7616 * Walk all mappings of a page, removing write permission and clearing the 7617 * ref/mod bits. This code is similar to hat_pagesync() 7618 */ 7619 static void 7620 hat_page_clrwrt(page_t *pp) 7621 { 7622 struct sf_hment *sfhme; 7623 struct sf_hment *tmphme = NULL; 7624 kmutex_t *pml; 7625 cpuset_t cpuset; 7626 cpuset_t tset; 7627 int index; 7628 int cons; 7629 7630 CPUSET_ZERO(cpuset); 7631 7632 pml = sfmmu_mlist_enter(pp); 7633 index = PP_MAPINDEX(pp); 7634 cons = TTE8K; 7635 retry: 7636 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7637 tmphme = sfhme->hme_next; 7638 7639 /* 7640 * If we are looking for large mappings and this hme doesn't 7641 * reach the range we are seeking, just ignore its. 7642 */ 7643 7644 if (hme_size(sfhme) < cons) 7645 continue; 7646 7647 tset = sfmmu_pageclrwrt(pp, sfhme); 7648 CPUSET_OR(cpuset, tset); 7649 } 7650 7651 while (index) { 7652 index = index >> 1; 7653 cons++; 7654 if (index & 0x1) { 7655 /* Go to leading page */ 7656 pp = PP_GROUPLEADER(pp, cons); 7657 goto retry; 7658 } 7659 } 7660 7661 xt_sync(cpuset); 7662 sfmmu_mlist_exit(pml); 7663 } 7664 7665 /* 7666 * Set the given REF/MOD/RO bits for the given page. 7667 * For a vnode with a sorted v_pages list, we need to change 7668 * the attributes and the v_pages list together under page_vnode_mutex. 7669 */ 7670 void 7671 hat_page_setattr(page_t *pp, uint_t flag) 7672 { 7673 vnode_t *vp = pp->p_vnode; 7674 page_t **listp; 7675 kmutex_t *pmtx; 7676 kmutex_t *vphm = NULL; 7677 int noshuffle; 7678 7679 noshuffle = flag & P_NSH; 7680 flag &= ~P_NSH; 7681 7682 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7683 7684 /* 7685 * nothing to do if attribute already set 7686 */ 7687 if ((pp->p_nrm & flag) == flag) 7688 return; 7689 7690 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) && 7691 !noshuffle) { 7692 vphm = page_vnode_mutex(vp); 7693 mutex_enter(vphm); 7694 } 7695 7696 pmtx = sfmmu_page_enter(pp); 7697 pp->p_nrm |= flag; 7698 sfmmu_page_exit(pmtx); 7699 7700 if (vphm != NULL) { 7701 /* 7702 * Some File Systems examine v_pages for NULL w/o 7703 * grabbing the vphm mutex. Must not let it become NULL when 7704 * pp is the only page on the list. 7705 */ 7706 if (pp->p_vpnext != pp) { 7707 page_vpsub(&vp->v_pages, pp); 7708 if (vp->v_pages != NULL) 7709 listp = &vp->v_pages->p_vpprev->p_vpnext; 7710 else 7711 listp = &vp->v_pages; 7712 page_vpadd(listp, pp); 7713 } 7714 mutex_exit(vphm); 7715 } 7716 } 7717 7718 void 7719 hat_page_clrattr(page_t *pp, uint_t flag) 7720 { 7721 vnode_t *vp = pp->p_vnode; 7722 kmutex_t *pmtx; 7723 7724 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7725 7726 pmtx = sfmmu_page_enter(pp); 7727 7728 /* 7729 * Caller is expected to hold page's io lock for VMODSORT to work 7730 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod 7731 * bit is cleared. 7732 * We don't have assert to avoid tripping some existing third party 7733 * code. The dirty page is moved back to top of the v_page list 7734 * after IO is done in pvn_write_done(). 7735 */ 7736 pp->p_nrm &= ~flag; 7737 sfmmu_page_exit(pmtx); 7738 7739 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 7740 7741 /* 7742 * VMODSORT works by removing write permissions and getting 7743 * a fault when a page is made dirty. At this point 7744 * we need to remove write permission from all mappings 7745 * to this page. 7746 */ 7747 hat_page_clrwrt(pp); 7748 } 7749 } 7750 7751 uint_t 7752 hat_page_getattr(page_t *pp, uint_t flag) 7753 { 7754 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7755 return ((uint_t)(pp->p_nrm & flag)); 7756 } 7757 7758 /* 7759 * DEBUG kernels: verify that a kernel va<->pa translation 7760 * is safe by checking the underlying page_t is in a page 7761 * relocation-safe state. 7762 */ 7763 #ifdef DEBUG 7764 void 7765 sfmmu_check_kpfn(pfn_t pfn) 7766 { 7767 page_t *pp; 7768 int index, cons; 7769 7770 if (hat_check_vtop == 0) 7771 return; 7772 7773 if (kvseg.s_base == NULL || panicstr) 7774 return; 7775 7776 pp = page_numtopp_nolock(pfn); 7777 if (!pp) 7778 return; 7779 7780 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp)) 7781 return; 7782 7783 /* 7784 * Handed a large kernel page, we dig up the root page since we 7785 * know the root page might have the lock also. 7786 */ 7787 if (pp->p_szc != 0) { 7788 index = PP_MAPINDEX(pp); 7789 cons = TTE8K; 7790 again: 7791 while (index != 0) { 7792 index >>= 1; 7793 if (index != 0) 7794 cons++; 7795 if (index & 0x1) { 7796 pp = PP_GROUPLEADER(pp, cons); 7797 goto again; 7798 } 7799 } 7800 } 7801 7802 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp)) 7803 return; 7804 7805 /* 7806 * Pages need to be locked or allocated "permanent" (either from 7807 * static_arena arena or explicitly setting PG_NORELOC when calling 7808 * page_create_va()) for VA->PA translations to be valid. 7809 */ 7810 if (!PP_ISNORELOC(pp)) 7811 panic("Illegal VA->PA translation, pp 0x%p not permanent", 7812 (void *)pp); 7813 else 7814 panic("Illegal VA->PA translation, pp 0x%p not locked", 7815 (void *)pp); 7816 } 7817 #endif /* DEBUG */ 7818 7819 /* 7820 * Returns a page frame number for a given virtual address. 7821 * Returns PFN_INVALID to indicate an invalid mapping 7822 */ 7823 pfn_t 7824 hat_getpfnum(struct hat *hat, caddr_t addr) 7825 { 7826 pfn_t pfn; 7827 tte_t tte; 7828 7829 /* 7830 * We would like to 7831 * ASSERT(AS_LOCK_HELD(as)); 7832 * but we can't because the iommu driver will call this 7833 * routine at interrupt time and it can't grab the as lock 7834 * or it will deadlock: A thread could have the as lock 7835 * and be waiting for io. The io can't complete 7836 * because the interrupt thread is blocked trying to grab 7837 * the as lock. 7838 */ 7839 7840 if (hat == ksfmmup) { 7841 if (IS_KMEM_VA_LARGEPAGE(addr)) { 7842 ASSERT(segkmem_lpszc > 0); 7843 pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc); 7844 if (pfn != PFN_INVALID) { 7845 sfmmu_check_kpfn(pfn); 7846 return (pfn); 7847 } 7848 } else if (segkpm && IS_KPM_ADDR(addr)) { 7849 return (sfmmu_kpm_vatopfn(addr)); 7850 } 7851 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte)) 7852 == PFN_SUSPENDED) { 7853 sfmmu_vatopfn_suspended(addr, ksfmmup, &tte); 7854 } 7855 sfmmu_check_kpfn(pfn); 7856 return (pfn); 7857 } else { 7858 return (sfmmu_uvatopfn(addr, hat, NULL)); 7859 } 7860 } 7861 7862 /* 7863 * This routine will return both pfn and tte for the vaddr. 7864 */ 7865 static pfn_t 7866 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep) 7867 { 7868 struct hmehash_bucket *hmebp; 7869 hmeblk_tag hblktag; 7870 int hmeshift, hashno = 1; 7871 struct hme_blk *hmeblkp = NULL; 7872 tte_t tte; 7873 7874 struct sf_hment *sfhmep; 7875 pfn_t pfn; 7876 7877 /* support for ISM */ 7878 ism_map_t *ism_map; 7879 ism_blk_t *ism_blkp; 7880 int i; 7881 sfmmu_t *ism_hatid = NULL; 7882 sfmmu_t *locked_hatid = NULL; 7883 sfmmu_t *sv_sfmmup = sfmmup; 7884 caddr_t sv_vaddr = vaddr; 7885 sf_srd_t *srdp; 7886 7887 if (ttep == NULL) { 7888 ttep = &tte; 7889 } else { 7890 ttep->ll = 0; 7891 } 7892 7893 ASSERT(sfmmup != ksfmmup); 7894 SFMMU_STAT(sf_user_vtop); 7895 /* 7896 * Set ism_hatid if vaddr falls in a ISM segment. 7897 */ 7898 ism_blkp = sfmmup->sfmmu_iblk; 7899 if (ism_blkp != NULL) { 7900 sfmmu_ismhat_enter(sfmmup, 0); 7901 locked_hatid = sfmmup; 7902 } 7903 while (ism_blkp != NULL && ism_hatid == NULL) { 7904 ism_map = ism_blkp->iblk_maps; 7905 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) { 7906 if (vaddr >= ism_start(ism_map[i]) && 7907 vaddr < ism_end(ism_map[i])) { 7908 sfmmup = ism_hatid = ism_map[i].imap_ismhat; 7909 vaddr = (caddr_t)(vaddr - 7910 ism_start(ism_map[i])); 7911 break; 7912 } 7913 } 7914 ism_blkp = ism_blkp->iblk_next; 7915 } 7916 if (locked_hatid) { 7917 sfmmu_ismhat_exit(locked_hatid, 0); 7918 } 7919 7920 hblktag.htag_id = sfmmup; 7921 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 7922 do { 7923 hmeshift = HME_HASH_SHIFT(hashno); 7924 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 7925 hblktag.htag_rehash = hashno; 7926 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift); 7927 7928 SFMMU_HASH_LOCK(hmebp); 7929 7930 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 7931 if (hmeblkp != NULL) { 7932 ASSERT(!hmeblkp->hblk_shared); 7933 HBLKTOHME(sfhmep, hmeblkp, vaddr); 7934 sfmmu_copytte(&sfhmep->hme_tte, ttep); 7935 SFMMU_HASH_UNLOCK(hmebp); 7936 if (TTE_IS_VALID(ttep)) { 7937 pfn = TTE_TO_PFN(vaddr, ttep); 7938 return (pfn); 7939 } 7940 break; 7941 } 7942 SFMMU_HASH_UNLOCK(hmebp); 7943 hashno++; 7944 } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt)); 7945 7946 if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) { 7947 return (PFN_INVALID); 7948 } 7949 srdp = sv_sfmmup->sfmmu_srdp; 7950 ASSERT(srdp != NULL); 7951 ASSERT(srdp->srd_refcnt != 0); 7952 hblktag.htag_id = srdp; 7953 hashno = 1; 7954 do { 7955 hmeshift = HME_HASH_SHIFT(hashno); 7956 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift); 7957 hblktag.htag_rehash = hashno; 7958 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift); 7959 7960 SFMMU_HASH_LOCK(hmebp); 7961 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL; 7962 hmeblkp = hmeblkp->hblk_next) { 7963 uint_t rid; 7964 sf_region_t *rgnp; 7965 caddr_t rsaddr; 7966 caddr_t readdr; 7967 7968 if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag, 7969 sv_sfmmup->sfmmu_hmeregion_map)) { 7970 continue; 7971 } 7972 ASSERT(hmeblkp->hblk_shared); 7973 rid = hmeblkp->hblk_tag.htag_rid; 7974 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7975 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7976 rgnp = srdp->srd_hmergnp[rid]; 7977 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 7978 HBLKTOHME(sfhmep, hmeblkp, sv_vaddr); 7979 sfmmu_copytte(&sfhmep->hme_tte, ttep); 7980 rsaddr = rgnp->rgn_saddr; 7981 readdr = rsaddr + rgnp->rgn_size; 7982 #ifdef DEBUG 7983 if (TTE_IS_VALID(ttep) || 7984 get_hblk_ttesz(hmeblkp) > TTE8K) { 7985 caddr_t eva = tte_to_evaddr(hmeblkp, ttep); 7986 ASSERT(eva > sv_vaddr); 7987 ASSERT(sv_vaddr >= rsaddr); 7988 ASSERT(sv_vaddr < readdr); 7989 ASSERT(eva <= readdr); 7990 } 7991 #endif /* DEBUG */ 7992 /* 7993 * Continue the search if we 7994 * found an invalid 8K tte outside of the area 7995 * covered by this hmeblk's region. 7996 */ 7997 if (TTE_IS_VALID(ttep)) { 7998 SFMMU_HASH_UNLOCK(hmebp); 7999 pfn = TTE_TO_PFN(sv_vaddr, ttep); 8000 return (pfn); 8001 } else if (get_hblk_ttesz(hmeblkp) > TTE8K || 8002 (sv_vaddr >= rsaddr && sv_vaddr < readdr)) { 8003 SFMMU_HASH_UNLOCK(hmebp); 8004 pfn = PFN_INVALID; 8005 return (pfn); 8006 } 8007 } 8008 SFMMU_HASH_UNLOCK(hmebp); 8009 hashno++; 8010 } while (hashno <= mmu_hashcnt); 8011 return (PFN_INVALID); 8012 } 8013 8014 8015 /* 8016 * For compatability with AT&T and later optimizations 8017 */ 8018 /* ARGSUSED */ 8019 void 8020 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags) 8021 { 8022 ASSERT(hat != NULL); 8023 } 8024 8025 /* 8026 * Return the number of mappings to a particular page. This number is an 8027 * approximation of the number of people sharing the page. 8028 * 8029 * shared hmeblks or ism hmeblks are counted as 1 mapping here. 8030 * hat_page_checkshare() can be used to compare threshold to share 8031 * count that reflects the number of region sharers albeit at higher cost. 8032 */ 8033 ulong_t 8034 hat_page_getshare(page_t *pp) 8035 { 8036 page_t *spp = pp; /* start page */ 8037 kmutex_t *pml; 8038 ulong_t cnt; 8039 int index, sz = TTE64K; 8040 8041 /* 8042 * We need to grab the mlist lock to make sure any outstanding 8043 * load/unloads complete. Otherwise we could return zero 8044 * even though the unload(s) hasn't finished yet. 8045 */ 8046 pml = sfmmu_mlist_enter(spp); 8047 cnt = spp->p_share; 8048 8049 #ifdef VAC 8050 if (kpm_enable) 8051 cnt += spp->p_kpmref; 8052 #endif 8053 if (vpm_enable && pp->p_vpmref) { 8054 cnt += 1; 8055 } 8056 8057 /* 8058 * If we have any large mappings, we count the number of 8059 * mappings that this large page is part of. 8060 */ 8061 index = PP_MAPINDEX(spp); 8062 index >>= 1; 8063 while (index) { 8064 pp = PP_GROUPLEADER(spp, sz); 8065 if ((index & 0x1) && pp != spp) { 8066 cnt += pp->p_share; 8067 spp = pp; 8068 } 8069 index >>= 1; 8070 sz++; 8071 } 8072 sfmmu_mlist_exit(pml); 8073 return (cnt); 8074 } 8075 8076 /* 8077 * Return 1 if the number of mappings exceeds sh_thresh. Return 0 8078 * otherwise. Count shared hmeblks by region's refcnt. 8079 */ 8080 int 8081 hat_page_checkshare(page_t *pp, ulong_t sh_thresh) 8082 { 8083 kmutex_t *pml; 8084 ulong_t cnt = 0; 8085 int index, sz = TTE8K; 8086 struct sf_hment *sfhme, *tmphme = NULL; 8087 struct hme_blk *hmeblkp; 8088 8089 pml = sfmmu_mlist_enter(pp); 8090 8091 #ifdef VAC 8092 if (kpm_enable) 8093 cnt = pp->p_kpmref; 8094 #endif 8095 8096 if (vpm_enable && pp->p_vpmref) { 8097 cnt += 1; 8098 } 8099 8100 if (pp->p_share + cnt > sh_thresh) { 8101 sfmmu_mlist_exit(pml); 8102 return (1); 8103 } 8104 8105 index = PP_MAPINDEX(pp); 8106 8107 again: 8108 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 8109 tmphme = sfhme->hme_next; 8110 if (IS_PAHME(sfhme)) { 8111 continue; 8112 } 8113 8114 hmeblkp = sfmmu_hmetohblk(sfhme); 8115 if (hme_size(sfhme) != sz) { 8116 continue; 8117 } 8118 8119 if (hmeblkp->hblk_shared) { 8120 sf_srd_t *srdp = hblktosrd(hmeblkp); 8121 uint_t rid = hmeblkp->hblk_tag.htag_rid; 8122 sf_region_t *rgnp; 8123 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 8124 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 8125 ASSERT(srdp != NULL); 8126 rgnp = srdp->srd_hmergnp[rid]; 8127 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, 8128 rgnp, rid); 8129 cnt += rgnp->rgn_refcnt; 8130 } else { 8131 cnt++; 8132 } 8133 if (cnt > sh_thresh) { 8134 sfmmu_mlist_exit(pml); 8135 return (1); 8136 } 8137 } 8138 8139 index >>= 1; 8140 sz++; 8141 while (index) { 8142 pp = PP_GROUPLEADER(pp, sz); 8143 ASSERT(sfmmu_mlist_held(pp)); 8144 if (index & 0x1) { 8145 goto again; 8146 } 8147 index >>= 1; 8148 sz++; 8149 } 8150 sfmmu_mlist_exit(pml); 8151 return (0); 8152 } 8153 8154 /* 8155 * Unload all large mappings to the pp and reset the p_szc field of every 8156 * constituent page according to the remaining mappings. 8157 * 8158 * pp must be locked SE_EXCL. Even though no other constituent pages are 8159 * locked it's legal to unload the large mappings to the pp because all 8160 * constituent pages of large locked mappings have to be locked SE_SHARED. 8161 * This means if we have SE_EXCL lock on one of constituent pages none of the 8162 * large mappings to pp are locked. 8163 * 8164 * Decrease p_szc field starting from the last constituent page and ending 8165 * with the root page. This method is used because other threads rely on the 8166 * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc 8167 * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This 8168 * ensures that p_szc changes of the constituent pages appears atomic for all 8169 * threads that use sfmmu_mlspl_enter() to examine p_szc field. 8170 * 8171 * This mechanism is only used for file system pages where it's not always 8172 * possible to get SE_EXCL locks on all constituent pages to demote the size 8173 * code (as is done for anonymous or kernel large pages). 8174 * 8175 * See more comments in front of sfmmu_mlspl_enter(). 8176 */ 8177 void 8178 hat_page_demote(page_t *pp) 8179 { 8180 int index; 8181 int sz; 8182 cpuset_t cpuset; 8183 int sync = 0; 8184 page_t *rootpp; 8185 struct sf_hment *sfhme; 8186 struct sf_hment *tmphme = NULL; 8187 uint_t pszc; 8188 page_t *lastpp; 8189 cpuset_t tset; 8190 pgcnt_t npgs; 8191 kmutex_t *pml; 8192 kmutex_t *pmtx = NULL; 8193 8194 ASSERT(PAGE_EXCL(pp)); 8195 ASSERT(!PP_ISFREE(pp)); 8196 ASSERT(!PP_ISKAS(pp)); 8197 ASSERT(page_szc_lock_assert(pp)); 8198 pml = sfmmu_mlist_enter(pp); 8199 8200 pszc = pp->p_szc; 8201 if (pszc == 0) { 8202 goto out; 8203 } 8204 8205 index = PP_MAPINDEX(pp) >> 1; 8206 8207 if (index) { 8208 CPUSET_ZERO(cpuset); 8209 sz = TTE64K; 8210 sync = 1; 8211 } 8212 8213 while (index) { 8214 if (!(index & 0x1)) { 8215 index >>= 1; 8216 sz++; 8217 continue; 8218 } 8219 ASSERT(sz <= pszc); 8220 rootpp = PP_GROUPLEADER(pp, sz); 8221 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) { 8222 tmphme = sfhme->hme_next; 8223 ASSERT(!IS_PAHME(sfhme)); 8224 if (hme_size(sfhme) != sz) { 8225 continue; 8226 } 8227 tset = sfmmu_pageunload(rootpp, sfhme, sz); 8228 CPUSET_OR(cpuset, tset); 8229 } 8230 if (index >>= 1) { 8231 sz++; 8232 } 8233 } 8234 8235 ASSERT(!PP_ISMAPPED_LARGE(pp)); 8236 8237 if (sync) { 8238 xt_sync(cpuset); 8239 #ifdef VAC 8240 if (PP_ISTNC(pp)) { 8241 conv_tnc(rootpp, sz); 8242 } 8243 #endif /* VAC */ 8244 } 8245 8246 pmtx = sfmmu_page_enter(pp); 8247 8248 ASSERT(pp->p_szc == pszc); 8249 rootpp = PP_PAGEROOT(pp); 8250 ASSERT(rootpp->p_szc == pszc); 8251 lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1); 8252 8253 while (lastpp != rootpp) { 8254 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0; 8255 ASSERT(sz < pszc); 8256 npgs = (sz == 0) ? 1 : TTEPAGES(sz); 8257 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1); 8258 while (--npgs > 0) { 8259 lastpp->p_szc = (uchar_t)sz; 8260 lastpp = PP_PAGEPREV(lastpp); 8261 } 8262 if (sz) { 8263 /* 8264 * make sure before current root's pszc 8265 * is updated all updates to constituent pages pszc 8266 * fields are globally visible. 8267 */ 8268 membar_producer(); 8269 } 8270 lastpp->p_szc = sz; 8271 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz))); 8272 if (lastpp != rootpp) { 8273 lastpp = PP_PAGEPREV(lastpp); 8274 } 8275 } 8276 if (sz == 0) { 8277 /* the loop above doesn't cover this case */ 8278 rootpp->p_szc = 0; 8279 } 8280 out: 8281 ASSERT(pp->p_szc == 0); 8282 if (pmtx != NULL) { 8283 sfmmu_page_exit(pmtx); 8284 } 8285 sfmmu_mlist_exit(pml); 8286 } 8287 8288 /* 8289 * Refresh the HAT ismttecnt[] element for size szc. 8290 * Caller must have set ISM busy flag to prevent mapping 8291 * lists from changing while we're traversing them. 8292 */ 8293 pgcnt_t 8294 ism_tsb_entries(sfmmu_t *sfmmup, int szc) 8295 { 8296 ism_blk_t *ism_blkp = sfmmup->sfmmu_iblk; 8297 ism_map_t *ism_map; 8298 pgcnt_t npgs = 0; 8299 pgcnt_t npgs_scd = 0; 8300 int j; 8301 sf_scd_t *scdp; 8302 uchar_t rid; 8303 8304 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 8305 scdp = sfmmup->sfmmu_scdp; 8306 8307 for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) { 8308 ism_map = ism_blkp->iblk_maps; 8309 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) { 8310 rid = ism_map[j].imap_rid; 8311 ASSERT(rid == SFMMU_INVALID_ISMRID || 8312 rid < sfmmup->sfmmu_srdp->srd_next_ismrid); 8313 8314 if (scdp != NULL && rid != SFMMU_INVALID_ISMRID && 8315 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) { 8316 /* ISM is in sfmmup's SCD */ 8317 npgs_scd += 8318 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc]; 8319 } else { 8320 /* ISMs is not in SCD */ 8321 npgs += 8322 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc]; 8323 } 8324 } 8325 } 8326 sfmmup->sfmmu_ismttecnt[szc] = npgs; 8327 sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd; 8328 return (npgs); 8329 } 8330 8331 /* 8332 * Yield the memory claim requirement for an address space. 8333 * 8334 * This is currently implemented as the number of bytes that have active 8335 * hardware translations that have page structures. Therefore, it can 8336 * underestimate the traditional resident set size, eg, if the 8337 * physical page is present and the hardware translation is missing; 8338 * and it can overestimate the rss, eg, if there are active 8339 * translations to a frame buffer with page structs. 8340 * Also, it does not take sharing into account. 8341 * 8342 * Note that we don't acquire locks here since this function is most often 8343 * called from the clock thread. 8344 */ 8345 size_t 8346 hat_get_mapped_size(struct hat *hat) 8347 { 8348 size_t assize = 0; 8349 int i; 8350 8351 if (hat == NULL) 8352 return (0); 8353 8354 for (i = 0; i < mmu_page_sizes; i++) 8355 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] + 8356 (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i); 8357 8358 if (hat->sfmmu_iblk == NULL) 8359 return (assize); 8360 8361 for (i = 0; i < mmu_page_sizes; i++) 8362 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] + 8363 (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i); 8364 8365 return (assize); 8366 } 8367 8368 int 8369 hat_stats_enable(struct hat *hat) 8370 { 8371 hatlock_t *hatlockp; 8372 8373 hatlockp = sfmmu_hat_enter(hat); 8374 hat->sfmmu_rmstat++; 8375 sfmmu_hat_exit(hatlockp); 8376 return (1); 8377 } 8378 8379 void 8380 hat_stats_disable(struct hat *hat) 8381 { 8382 hatlock_t *hatlockp; 8383 8384 hatlockp = sfmmu_hat_enter(hat); 8385 hat->sfmmu_rmstat--; 8386 sfmmu_hat_exit(hatlockp); 8387 } 8388 8389 /* 8390 * Routines for entering or removing ourselves from the 8391 * ism_hat's mapping list. This is used for both private and 8392 * SCD hats. 8393 */ 8394 static void 8395 iment_add(struct ism_ment *iment, struct hat *ism_hat) 8396 { 8397 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 8398 8399 iment->iment_prev = NULL; 8400 iment->iment_next = ism_hat->sfmmu_iment; 8401 if (ism_hat->sfmmu_iment) { 8402 ism_hat->sfmmu_iment->iment_prev = iment; 8403 } 8404 ism_hat->sfmmu_iment = iment; 8405 } 8406 8407 static void 8408 iment_sub(struct ism_ment *iment, struct hat *ism_hat) 8409 { 8410 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 8411 8412 if (ism_hat->sfmmu_iment == NULL) { 8413 panic("ism map entry remove - no entries"); 8414 } 8415 8416 if (iment->iment_prev) { 8417 ASSERT(ism_hat->sfmmu_iment != iment); 8418 iment->iment_prev->iment_next = iment->iment_next; 8419 } else { 8420 ASSERT(ism_hat->sfmmu_iment == iment); 8421 ism_hat->sfmmu_iment = iment->iment_next; 8422 } 8423 8424 if (iment->iment_next) { 8425 iment->iment_next->iment_prev = iment->iment_prev; 8426 } 8427 8428 /* 8429 * zero out the entry 8430 */ 8431 iment->iment_next = NULL; 8432 iment->iment_prev = NULL; 8433 iment->iment_hat = NULL; 8434 iment->iment_base_va = 0; 8435 } 8436 8437 /* 8438 * Hat_share()/unshare() return an (non-zero) error 8439 * when saddr and daddr are not properly aligned. 8440 * 8441 * The top level mapping element determines the alignment 8442 * requirement for saddr and daddr, depending on different 8443 * architectures. 8444 * 8445 * When hat_share()/unshare() are not supported, 8446 * HATOP_SHARE()/UNSHARE() return 0 8447 */ 8448 int 8449 hat_share(struct hat *sfmmup, caddr_t addr, struct hat *ism_hatid, 8450 caddr_t sptaddr, size_t len, uint_t ismszc) 8451 { 8452 ism_blk_t *ism_blkp; 8453 ism_blk_t *new_iblk; 8454 ism_map_t *ism_map; 8455 ism_ment_t *ism_ment; 8456 int i, added; 8457 hatlock_t *hatlockp; 8458 int reload_mmu = 0; 8459 uint_t ismshift = page_get_shift(ismszc); 8460 size_t ismpgsz = page_get_pagesize(ismszc); 8461 uint_t ismmask = (uint_t)ismpgsz - 1; 8462 size_t sh_size = ISM_SHIFT(ismshift, len); 8463 ushort_t ismhatflag; 8464 hat_region_cookie_t rcookie; 8465 sf_scd_t *old_scdp; 8466 8467 #ifdef DEBUG 8468 caddr_t eaddr = addr + len; 8469 #endif /* DEBUG */ 8470 8471 ASSERT(ism_hatid != NULL && sfmmup != NULL); 8472 ASSERT(sptaddr == ISMID_STARTADDR); 8473 /* 8474 * Check the alignment. 8475 */ 8476 if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr)) 8477 return (EINVAL); 8478 8479 /* 8480 * Check size alignment. 8481 */ 8482 if (!ISM_ALIGNED(ismshift, len)) 8483 return (EINVAL); 8484 8485 /* 8486 * Allocate ism_ment for the ism_hat's mapping list, and an 8487 * ism map blk in case we need one. We must do our 8488 * allocations before acquiring locks to prevent a deadlock 8489 * in the kmem allocator on the mapping list lock. 8490 */ 8491 new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP); 8492 ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP); 8493 8494 /* 8495 * Serialize ISM mappings with the ISM busy flag, and also the 8496 * trap handlers. 8497 */ 8498 sfmmu_ismhat_enter(sfmmup, 0); 8499 8500 /* 8501 * Allocate an ism map blk if necessary. 8502 */ 8503 if (sfmmup->sfmmu_iblk == NULL) { 8504 sfmmup->sfmmu_iblk = new_iblk; 8505 bzero(new_iblk, sizeof (*new_iblk)); 8506 new_iblk->iblk_nextpa = (uint64_t)-1; 8507 membar_stst(); /* make sure next ptr visible to all CPUs */ 8508 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk); 8509 reload_mmu = 1; 8510 new_iblk = NULL; 8511 } 8512 8513 #ifdef DEBUG 8514 /* 8515 * Make sure mapping does not already exist. 8516 */ 8517 ism_blkp = sfmmup->sfmmu_iblk; 8518 while (ism_blkp != NULL) { 8519 ism_map = ism_blkp->iblk_maps; 8520 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) { 8521 if ((addr >= ism_start(ism_map[i]) && 8522 addr < ism_end(ism_map[i])) || 8523 eaddr > ism_start(ism_map[i]) && 8524 eaddr <= ism_end(ism_map[i])) { 8525 panic("sfmmu_share: Already mapped!"); 8526 } 8527 } 8528 ism_blkp = ism_blkp->iblk_next; 8529 } 8530 #endif /* DEBUG */ 8531 8532 ASSERT(ismszc >= TTE4M); 8533 if (ismszc == TTE4M) { 8534 ismhatflag = HAT_4M_FLAG; 8535 } else if (ismszc == TTE32M) { 8536 ismhatflag = HAT_32M_FLAG; 8537 } else if (ismszc == TTE256M) { 8538 ismhatflag = HAT_256M_FLAG; 8539 } 8540 /* 8541 * Add mapping to first available mapping slot. 8542 */ 8543 ism_blkp = sfmmup->sfmmu_iblk; 8544 added = 0; 8545 while (!added) { 8546 ism_map = ism_blkp->iblk_maps; 8547 for (i = 0; i < ISM_MAP_SLOTS; i++) { 8548 if (ism_map[i].imap_ismhat == NULL) { 8549 8550 ism_map[i].imap_ismhat = ism_hatid; 8551 ism_map[i].imap_vb_shift = (uchar_t)ismshift; 8552 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID; 8553 ism_map[i].imap_hatflags = ismhatflag; 8554 ism_map[i].imap_sz_mask = ismmask; 8555 /* 8556 * imap_seg is checked in ISM_CHECK to see if 8557 * non-NULL, then other info assumed valid. 8558 */ 8559 membar_stst(); 8560 ism_map[i].imap_seg = (uintptr_t)addr | sh_size; 8561 ism_map[i].imap_ment = ism_ment; 8562 8563 /* 8564 * Now add ourselves to the ism_hat's 8565 * mapping list. 8566 */ 8567 ism_ment->iment_hat = sfmmup; 8568 ism_ment->iment_base_va = addr; 8569 ism_hatid->sfmmu_ismhat = 1; 8570 mutex_enter(&ism_mlist_lock); 8571 iment_add(ism_ment, ism_hatid); 8572 mutex_exit(&ism_mlist_lock); 8573 added = 1; 8574 break; 8575 } 8576 } 8577 if (!added && ism_blkp->iblk_next == NULL) { 8578 ism_blkp->iblk_next = new_iblk; 8579 new_iblk = NULL; 8580 bzero(ism_blkp->iblk_next, 8581 sizeof (*ism_blkp->iblk_next)); 8582 ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1; 8583 membar_stst(); 8584 ism_blkp->iblk_nextpa = 8585 va_to_pa((caddr_t)ism_blkp->iblk_next); 8586 } 8587 ism_blkp = ism_blkp->iblk_next; 8588 } 8589 8590 /* 8591 * After calling hat_join_region, sfmmup may join a new SCD or 8592 * move from the old scd to a new scd, in which case, we want to 8593 * shrink the sfmmup's private tsb size, i.e., pass shrink to 8594 * sfmmu_check_page_sizes at the end of this routine. 8595 */ 8596 old_scdp = sfmmup->sfmmu_scdp; 8597 8598 rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0, 8599 PROT_ALL, ismszc, NULL, HAT_REGION_ISM); 8600 if (rcookie != HAT_INVALID_REGION_COOKIE) { 8601 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie); 8602 } 8603 /* 8604 * Update our counters for this sfmmup's ism mappings. 8605 */ 8606 for (i = 0; i <= ismszc; i++) { 8607 if (!(disable_ism_large_pages & (1 << i))) 8608 (void) ism_tsb_entries(sfmmup, i); 8609 } 8610 8611 /* 8612 * For ISM and DISM we do not support 512K pages, so we only only 8613 * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the 8614 * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus. 8615 * 8616 * Need to set 32M/256M ISM flags to make sure 8617 * sfmmu_check_page_sizes() enables them on Panther. 8618 */ 8619 ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0); 8620 8621 switch (ismszc) { 8622 case TTE256M: 8623 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) { 8624 hatlockp = sfmmu_hat_enter(sfmmup); 8625 SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM); 8626 sfmmu_hat_exit(hatlockp); 8627 } 8628 break; 8629 case TTE32M: 8630 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) { 8631 hatlockp = sfmmu_hat_enter(sfmmup); 8632 SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM); 8633 sfmmu_hat_exit(hatlockp); 8634 } 8635 break; 8636 default: 8637 break; 8638 } 8639 8640 /* 8641 * If we updated the ismblkpa for this HAT we must make 8642 * sure all CPUs running this process reload their tsbmiss area. 8643 * Otherwise they will fail to load the mappings in the tsbmiss 8644 * handler and will loop calling pagefault(). 8645 */ 8646 if (reload_mmu) { 8647 hatlockp = sfmmu_hat_enter(sfmmup); 8648 sfmmu_sync_mmustate(sfmmup); 8649 sfmmu_hat_exit(hatlockp); 8650 } 8651 8652 sfmmu_ismhat_exit(sfmmup, 0); 8653 8654 /* 8655 * Free up ismblk if we didn't use it. 8656 */ 8657 if (new_iblk != NULL) 8658 kmem_cache_free(ism_blk_cache, new_iblk); 8659 8660 /* 8661 * Check TSB and TLB page sizes. 8662 */ 8663 if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) { 8664 sfmmu_check_page_sizes(sfmmup, 0); 8665 } else { 8666 sfmmu_check_page_sizes(sfmmup, 1); 8667 } 8668 return (0); 8669 } 8670 8671 /* 8672 * hat_unshare removes exactly one ism_map from 8673 * this process's as. It expects multiple calls 8674 * to hat_unshare for multiple shm segments. 8675 */ 8676 void 8677 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc) 8678 { 8679 ism_map_t *ism_map; 8680 ism_ment_t *free_ment = NULL; 8681 ism_blk_t *ism_blkp; 8682 struct hat *ism_hatid; 8683 int found, i; 8684 hatlock_t *hatlockp; 8685 struct tsb_info *tsbinfo; 8686 uint_t ismshift = page_get_shift(ismszc); 8687 size_t sh_size = ISM_SHIFT(ismshift, len); 8688 uchar_t ism_rid; 8689 sf_scd_t *old_scdp; 8690 8691 ASSERT(ISM_ALIGNED(ismshift, addr)); 8692 ASSERT(ISM_ALIGNED(ismshift, len)); 8693 ASSERT(sfmmup != NULL); 8694 ASSERT(sfmmup != ksfmmup); 8695 8696 ASSERT(sfmmup->sfmmu_as != NULL); 8697 8698 /* 8699 * Make sure that during the entire time ISM mappings are removed, 8700 * the trap handlers serialize behind us, and that no one else 8701 * can be mucking with ISM mappings. This also lets us get away 8702 * with not doing expensive cross calls to flush the TLB -- we 8703 * just discard the context, flush the entire TSB, and call it 8704 * a day. 8705 */ 8706 sfmmu_ismhat_enter(sfmmup, 0); 8707 8708 /* 8709 * Remove the mapping. 8710 * 8711 * We can't have any holes in the ism map. 8712 * The tsb miss code while searching the ism map will 8713 * stop on an empty map slot. So we must move 8714 * everyone past the hole up 1 if any. 8715 * 8716 * Also empty ism map blks are not freed until the 8717 * process exits. This is to prevent a MT race condition 8718 * between sfmmu_unshare() and sfmmu_tsbmiss_exception(). 8719 */ 8720 found = 0; 8721 ism_blkp = sfmmup->sfmmu_iblk; 8722 while (!found && ism_blkp != NULL) { 8723 ism_map = ism_blkp->iblk_maps; 8724 for (i = 0; i < ISM_MAP_SLOTS; i++) { 8725 if (addr == ism_start(ism_map[i]) && 8726 sh_size == (size_t)(ism_size(ism_map[i]))) { 8727 found = 1; 8728 break; 8729 } 8730 } 8731 if (!found) 8732 ism_blkp = ism_blkp->iblk_next; 8733 } 8734 8735 if (found) { 8736 ism_hatid = ism_map[i].imap_ismhat; 8737 ism_rid = ism_map[i].imap_rid; 8738 ASSERT(ism_hatid != NULL); 8739 ASSERT(ism_hatid->sfmmu_ismhat == 1); 8740 8741 /* 8742 * After hat_leave_region, the sfmmup may leave SCD, 8743 * in which case, we want to grow the private tsb size when 8744 * calling sfmmu_check_page_sizes at the end of the routine. 8745 */ 8746 old_scdp = sfmmup->sfmmu_scdp; 8747 /* 8748 * Then remove ourselves from the region. 8749 */ 8750 if (ism_rid != SFMMU_INVALID_ISMRID) { 8751 hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid), 8752 HAT_REGION_ISM); 8753 } 8754 8755 /* 8756 * And now guarantee that any other cpu 8757 * that tries to process an ISM miss 8758 * will go to tl=0. 8759 */ 8760 hatlockp = sfmmu_hat_enter(sfmmup); 8761 sfmmu_invalidate_ctx(sfmmup); 8762 sfmmu_hat_exit(hatlockp); 8763 8764 /* 8765 * Remove ourselves from the ism mapping list. 8766 */ 8767 mutex_enter(&ism_mlist_lock); 8768 iment_sub(ism_map[i].imap_ment, ism_hatid); 8769 mutex_exit(&ism_mlist_lock); 8770 free_ment = ism_map[i].imap_ment; 8771 8772 /* 8773 * We delete the ism map by copying 8774 * the next map over the current one. 8775 * We will take the next one in the maps 8776 * array or from the next ism_blk. 8777 */ 8778 while (ism_blkp != NULL) { 8779 ism_map = ism_blkp->iblk_maps; 8780 while (i < (ISM_MAP_SLOTS - 1)) { 8781 ism_map[i] = ism_map[i + 1]; 8782 i++; 8783 } 8784 /* i == (ISM_MAP_SLOTS - 1) */ 8785 ism_blkp = ism_blkp->iblk_next; 8786 if (ism_blkp != NULL) { 8787 ism_map[i] = ism_blkp->iblk_maps[0]; 8788 i = 0; 8789 } else { 8790 ism_map[i].imap_seg = 0; 8791 ism_map[i].imap_vb_shift = 0; 8792 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID; 8793 ism_map[i].imap_hatflags = 0; 8794 ism_map[i].imap_sz_mask = 0; 8795 ism_map[i].imap_ismhat = NULL; 8796 ism_map[i].imap_ment = NULL; 8797 } 8798 } 8799 8800 /* 8801 * Now flush entire TSB for the process, since 8802 * demapping page by page can be too expensive. 8803 * We don't have to flush the TLB here anymore 8804 * since we switch to a new TLB ctx instead. 8805 * Also, there is no need to flush if the process 8806 * is exiting since the TSB will be freed later. 8807 */ 8808 if (!sfmmup->sfmmu_free) { 8809 hatlockp = sfmmu_hat_enter(sfmmup); 8810 for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL; 8811 tsbinfo = tsbinfo->tsb_next) { 8812 if (tsbinfo->tsb_flags & TSB_SWAPPED) 8813 continue; 8814 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) { 8815 tsbinfo->tsb_flags |= 8816 TSB_FLUSH_NEEDED; 8817 continue; 8818 } 8819 8820 sfmmu_inv_tsb(tsbinfo->tsb_va, 8821 TSB_BYTES(tsbinfo->tsb_szc)); 8822 } 8823 sfmmu_hat_exit(hatlockp); 8824 } 8825 } 8826 8827 /* 8828 * Update our counters for this sfmmup's ism mappings. 8829 */ 8830 for (i = 0; i <= ismszc; i++) { 8831 if (!(disable_ism_large_pages & (1 << i))) 8832 (void) ism_tsb_entries(sfmmup, i); 8833 } 8834 8835 sfmmu_ismhat_exit(sfmmup, 0); 8836 8837 /* 8838 * We must do our freeing here after dropping locks 8839 * to prevent a deadlock in the kmem allocator on the 8840 * mapping list lock. 8841 */ 8842 if (free_ment != NULL) 8843 kmem_cache_free(ism_ment_cache, free_ment); 8844 8845 /* 8846 * Check TSB and TLB page sizes if the process isn't exiting. 8847 */ 8848 if (!sfmmup->sfmmu_free) { 8849 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) { 8850 sfmmu_check_page_sizes(sfmmup, 1); 8851 } else { 8852 sfmmu_check_page_sizes(sfmmup, 0); 8853 } 8854 } 8855 } 8856 8857 /* ARGSUSED */ 8858 static int 8859 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags) 8860 { 8861 /* void *buf is sfmmu_t pointer */ 8862 bzero(buf, sizeof (sfmmu_t)); 8863 8864 return (0); 8865 } 8866 8867 /* ARGSUSED */ 8868 static void 8869 sfmmu_idcache_destructor(void *buf, void *cdrarg) 8870 { 8871 /* void *buf is sfmmu_t pointer */ 8872 } 8873 8874 /* 8875 * setup kmem hmeblks by bzeroing all members and initializing the nextpa 8876 * field to be the pa of this hmeblk 8877 */ 8878 /* ARGSUSED */ 8879 static int 8880 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags) 8881 { 8882 struct hme_blk *hmeblkp; 8883 8884 bzero(buf, (size_t)cdrarg); 8885 hmeblkp = (struct hme_blk *)buf; 8886 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp); 8887 8888 #ifdef HBLK_TRACE 8889 mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL); 8890 #endif /* HBLK_TRACE */ 8891 8892 return (0); 8893 } 8894 8895 /* ARGSUSED */ 8896 static void 8897 sfmmu_hblkcache_destructor(void *buf, void *cdrarg) 8898 { 8899 8900 #ifdef HBLK_TRACE 8901 8902 struct hme_blk *hmeblkp; 8903 8904 hmeblkp = (struct hme_blk *)buf; 8905 mutex_destroy(&hmeblkp->hblk_audit_lock); 8906 8907 #endif /* HBLK_TRACE */ 8908 } 8909 8910 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8 8911 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO; 8912 /* 8913 * The kmem allocator will callback into our reclaim routine when the system 8914 * is running low in memory. We traverse the hash and free up all unused but 8915 * still cached hme_blks. We also traverse the free list and free them up 8916 * as well. 8917 */ 8918 /*ARGSUSED*/ 8919 static void 8920 sfmmu_hblkcache_reclaim(void *cdrarg) 8921 { 8922 int i; 8923 struct hmehash_bucket *hmebp; 8924 struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL; 8925 static struct hmehash_bucket *uhmehash_reclaim_hand; 8926 static struct hmehash_bucket *khmehash_reclaim_hand; 8927 struct hme_blk *list = NULL, *last_hmeblkp; 8928 cpuset_t cpuset = cpu_ready_set; 8929 cpu_hme_pend_t *cpuhp; 8930 8931 /* Free up hmeblks on the cpu pending lists */ 8932 for (i = 0; i < NCPU; i++) { 8933 cpuhp = &cpu_hme_pend[i]; 8934 if (cpuhp->chp_listp != NULL) { 8935 mutex_enter(&cpuhp->chp_mutex); 8936 if (cpuhp->chp_listp == NULL) { 8937 mutex_exit(&cpuhp->chp_mutex); 8938 continue; 8939 } 8940 for (last_hmeblkp = cpuhp->chp_listp; 8941 last_hmeblkp->hblk_next != NULL; 8942 last_hmeblkp = last_hmeblkp->hblk_next) 8943 ; 8944 last_hmeblkp->hblk_next = list; 8945 list = cpuhp->chp_listp; 8946 cpuhp->chp_listp = NULL; 8947 cpuhp->chp_count = 0; 8948 mutex_exit(&cpuhp->chp_mutex); 8949 } 8950 8951 } 8952 8953 if (list != NULL) { 8954 kpreempt_disable(); 8955 CPUSET_DEL(cpuset, CPU->cpu_id); 8956 xt_sync(cpuset); 8957 xt_sync(cpuset); 8958 kpreempt_enable(); 8959 sfmmu_hblk_free(&list); 8960 list = NULL; 8961 } 8962 8963 hmebp = uhmehash_reclaim_hand; 8964 if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ]) 8965 uhmehash_reclaim_hand = hmebp = uhme_hash; 8966 uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; 8967 8968 for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) { 8969 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) { 8970 hmeblkp = hmebp->hmeblkp; 8971 pr_hblk = NULL; 8972 while (hmeblkp) { 8973 nx_hblk = hmeblkp->hblk_next; 8974 if (!hmeblkp->hblk_vcnt && 8975 !hmeblkp->hblk_hmecnt) { 8976 sfmmu_hblk_hash_rm(hmebp, hmeblkp, 8977 pr_hblk, &list, 0); 8978 } else { 8979 pr_hblk = hmeblkp; 8980 } 8981 hmeblkp = nx_hblk; 8982 } 8983 SFMMU_HASH_UNLOCK(hmebp); 8984 } 8985 if (hmebp++ == &uhme_hash[UHMEHASH_SZ]) 8986 hmebp = uhme_hash; 8987 } 8988 8989 hmebp = khmehash_reclaim_hand; 8990 if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ]) 8991 khmehash_reclaim_hand = hmebp = khme_hash; 8992 khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; 8993 8994 for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) { 8995 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) { 8996 hmeblkp = hmebp->hmeblkp; 8997 pr_hblk = NULL; 8998 while (hmeblkp) { 8999 nx_hblk = hmeblkp->hblk_next; 9000 if (!hmeblkp->hblk_vcnt && 9001 !hmeblkp->hblk_hmecnt) { 9002 sfmmu_hblk_hash_rm(hmebp, hmeblkp, 9003 pr_hblk, &list, 0); 9004 } else { 9005 pr_hblk = hmeblkp; 9006 } 9007 hmeblkp = nx_hblk; 9008 } 9009 SFMMU_HASH_UNLOCK(hmebp); 9010 } 9011 if (hmebp++ == &khme_hash[KHMEHASH_SZ]) 9012 hmebp = khme_hash; 9013 } 9014 sfmmu_hblks_list_purge(&list, 0); 9015 } 9016 9017 /* 9018 * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface. 9019 * same goes for sfmmu_get_addrvcolor(). 9020 * 9021 * This function will return the virtual color for the specified page. The 9022 * virtual color corresponds to this page current mapping or its last mapping. 9023 * It is used by memory allocators to choose addresses with the correct 9024 * alignment so vac consistency is automatically maintained. If the page 9025 * has no color it returns -1. 9026 */ 9027 /*ARGSUSED*/ 9028 int 9029 sfmmu_get_ppvcolor(struct page *pp) 9030 { 9031 #ifdef VAC 9032 int color; 9033 9034 if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) { 9035 return (-1); 9036 } 9037 color = PP_GET_VCOLOR(pp); 9038 ASSERT(color < mmu_btop(shm_alignment)); 9039 return (color); 9040 #else 9041 return (-1); 9042 #endif /* VAC */ 9043 } 9044 9045 /* 9046 * This function will return the desired alignment for vac consistency 9047 * (vac color) given a virtual address. If no vac is present it returns -1. 9048 */ 9049 /*ARGSUSED*/ 9050 int 9051 sfmmu_get_addrvcolor(caddr_t vaddr) 9052 { 9053 #ifdef VAC 9054 if (cache & CACHE_VAC) { 9055 return (addr_to_vcolor(vaddr)); 9056 } else { 9057 return (-1); 9058 } 9059 #else 9060 return (-1); 9061 #endif /* VAC */ 9062 } 9063 9064 #ifdef VAC 9065 /* 9066 * Check for conflicts. 9067 * A conflict exists if the new and existent mappings do not match in 9068 * their "shm_alignment fields. If conflicts exist, the existant mappings 9069 * are flushed unless one of them is locked. If one of them is locked, then 9070 * the mappings are flushed and converted to non-cacheable mappings. 9071 */ 9072 static void 9073 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp) 9074 { 9075 struct hat *tmphat; 9076 struct sf_hment *sfhmep, *tmphme = NULL; 9077 struct hme_blk *hmeblkp; 9078 int vcolor; 9079 tte_t tte; 9080 9081 ASSERT(sfmmu_mlist_held(pp)); 9082 ASSERT(!PP_ISNC(pp)); /* page better be cacheable */ 9083 9084 vcolor = addr_to_vcolor(addr); 9085 if (PP_NEWPAGE(pp)) { 9086 PP_SET_VCOLOR(pp, vcolor); 9087 return; 9088 } 9089 9090 if (PP_GET_VCOLOR(pp) == vcolor) { 9091 return; 9092 } 9093 9094 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) { 9095 /* 9096 * Previous user of page had a different color 9097 * but since there are no current users 9098 * we just flush the cache and change the color. 9099 */ 9100 SFMMU_STAT(sf_pgcolor_conflict); 9101 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp)); 9102 PP_SET_VCOLOR(pp, vcolor); 9103 return; 9104 } 9105 9106 /* 9107 * If we get here we have a vac conflict with a current 9108 * mapping. VAC conflict policy is as follows. 9109 * - The default is to unload the other mappings unless: 9110 * - If we have a large mapping we uncache the page. 9111 * We need to uncache the rest of the large page too. 9112 * - If any of the mappings are locked we uncache the page. 9113 * - If the requested mapping is inconsistent 9114 * with another mapping and that mapping 9115 * is in the same address space we have to 9116 * make it non-cached. The default thing 9117 * to do is unload the inconsistent mapping 9118 * but if they are in the same address space 9119 * we run the risk of unmapping the pc or the 9120 * stack which we will use as we return to the user, 9121 * in which case we can then fault on the thing 9122 * we just unloaded and get into an infinite loop. 9123 */ 9124 if (PP_ISMAPPED_LARGE(pp)) { 9125 int sz; 9126 9127 /* 9128 * Existing mapping is for big pages. We don't unload 9129 * existing big mappings to satisfy new mappings. 9130 * Always convert all mappings to TNC. 9131 */ 9132 sz = fnd_mapping_sz(pp); 9133 pp = PP_GROUPLEADER(pp, sz); 9134 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz)); 9135 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 9136 TTEPAGES(sz)); 9137 9138 return; 9139 } 9140 9141 /* 9142 * check if any mapping is in same as or if it is locked 9143 * since in that case we need to uncache. 9144 */ 9145 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) { 9146 tmphme = sfhmep->hme_next; 9147 if (IS_PAHME(sfhmep)) 9148 continue; 9149 hmeblkp = sfmmu_hmetohblk(sfhmep); 9150 tmphat = hblktosfmmu(hmeblkp); 9151 sfmmu_copytte(&sfhmep->hme_tte, &tte); 9152 ASSERT(TTE_IS_VALID(&tte)); 9153 if (hmeblkp->hblk_shared || tmphat == hat || 9154 hmeblkp->hblk_lckcnt) { 9155 /* 9156 * We have an uncache conflict 9157 */ 9158 SFMMU_STAT(sf_uncache_conflict); 9159 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1); 9160 return; 9161 } 9162 } 9163 9164 /* 9165 * We have an unload conflict 9166 * We have already checked for LARGE mappings, therefore 9167 * the remaining mapping(s) must be TTE8K. 9168 */ 9169 SFMMU_STAT(sf_unload_conflict); 9170 9171 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) { 9172 tmphme = sfhmep->hme_next; 9173 if (IS_PAHME(sfhmep)) 9174 continue; 9175 hmeblkp = sfmmu_hmetohblk(sfhmep); 9176 ASSERT(!hmeblkp->hblk_shared); 9177 (void) sfmmu_pageunload(pp, sfhmep, TTE8K); 9178 } 9179 9180 if (PP_ISMAPPED_KPM(pp)) 9181 sfmmu_kpm_vac_unload(pp, addr); 9182 9183 /* 9184 * Unloads only do TLB flushes so we need to flush the 9185 * cache here. 9186 */ 9187 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp)); 9188 PP_SET_VCOLOR(pp, vcolor); 9189 } 9190 9191 /* 9192 * Whenever a mapping is unloaded and the page is in TNC state, 9193 * we see if the page can be made cacheable again. 'pp' is 9194 * the page that we just unloaded a mapping from, the size 9195 * of mapping that was unloaded is 'ottesz'. 9196 * Remark: 9197 * The recache policy for mpss pages can leave a performance problem 9198 * under the following circumstances: 9199 * . A large page in uncached mode has just been unmapped. 9200 * . All constituent pages are TNC due to a conflicting small mapping. 9201 * . There are many other, non conflicting, small mappings around for 9202 * a lot of the constituent pages. 9203 * . We're called w/ the "old" groupleader page and the old ottesz, 9204 * but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so 9205 * we end up w/ TTE8K or npages == 1. 9206 * . We call tst_tnc w/ the old groupleader only, and if there is no 9207 * conflict, we re-cache only this page. 9208 * . All other small mappings are not checked and will be left in TNC mode. 9209 * The problem is not very serious because: 9210 * . mpss is actually only defined for heap and stack, so the probability 9211 * is not very high that a large page mapping exists in parallel to a small 9212 * one (this is possible, but seems to be bad programming style in the 9213 * appl). 9214 * . The problem gets a little bit more serious, when those TNC pages 9215 * have to be mapped into kernel space, e.g. for networking. 9216 * . When VAC alias conflicts occur in applications, this is regarded 9217 * as an application bug. So if kstat's show them, the appl should 9218 * be changed anyway. 9219 */ 9220 void 9221 conv_tnc(page_t *pp, int ottesz) 9222 { 9223 int cursz, dosz; 9224 pgcnt_t curnpgs, dopgs; 9225 pgcnt_t pg64k; 9226 page_t *pp2; 9227 9228 /* 9229 * Determine how big a range we check for TNC and find 9230 * leader page. cursz is the size of the biggest 9231 * mapping that still exist on 'pp'. 9232 */ 9233 if (PP_ISMAPPED_LARGE(pp)) { 9234 cursz = fnd_mapping_sz(pp); 9235 } else { 9236 cursz = TTE8K; 9237 } 9238 9239 if (ottesz >= cursz) { 9240 dosz = ottesz; 9241 pp2 = pp; 9242 } else { 9243 dosz = cursz; 9244 pp2 = PP_GROUPLEADER(pp, dosz); 9245 } 9246 9247 pg64k = TTEPAGES(TTE64K); 9248 dopgs = TTEPAGES(dosz); 9249 9250 ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0)); 9251 9252 while (dopgs != 0) { 9253 curnpgs = TTEPAGES(cursz); 9254 if (tst_tnc(pp2, curnpgs)) { 9255 SFMMU_STAT_ADD(sf_recache, curnpgs); 9256 sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH, 9257 curnpgs); 9258 } 9259 9260 ASSERT(dopgs >= curnpgs); 9261 dopgs -= curnpgs; 9262 9263 if (dopgs == 0) { 9264 break; 9265 } 9266 9267 pp2 = PP_PAGENEXT_N(pp2, curnpgs); 9268 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) { 9269 cursz = fnd_mapping_sz(pp2); 9270 } else { 9271 cursz = TTE8K; 9272 } 9273 } 9274 } 9275 9276 /* 9277 * Returns 1 if page(s) can be converted from TNC to cacheable setting, 9278 * returns 0 otherwise. Note that oaddr argument is valid for only 9279 * 8k pages. 9280 */ 9281 int 9282 tst_tnc(page_t *pp, pgcnt_t npages) 9283 { 9284 struct sf_hment *sfhme; 9285 struct hme_blk *hmeblkp; 9286 tte_t tte; 9287 caddr_t vaddr; 9288 int clr_valid = 0; 9289 int color, color1, bcolor; 9290 int i, ncolors; 9291 9292 ASSERT(pp != NULL); 9293 ASSERT(!(cache & CACHE_WRITEBACK)); 9294 9295 if (npages > 1) { 9296 ncolors = CACHE_NUM_COLOR; 9297 } 9298 9299 for (i = 0; i < npages; i++) { 9300 ASSERT(sfmmu_mlist_held(pp)); 9301 ASSERT(PP_ISTNC(pp)); 9302 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR); 9303 9304 if (PP_ISPNC(pp)) { 9305 return (0); 9306 } 9307 9308 clr_valid = 0; 9309 if (PP_ISMAPPED_KPM(pp)) { 9310 caddr_t kpmvaddr; 9311 9312 ASSERT(kpm_enable); 9313 kpmvaddr = hat_kpm_page2va(pp, 1); 9314 ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr))); 9315 color1 = addr_to_vcolor(kpmvaddr); 9316 clr_valid = 1; 9317 } 9318 9319 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) { 9320 if (IS_PAHME(sfhme)) 9321 continue; 9322 hmeblkp = sfmmu_hmetohblk(sfhme); 9323 9324 sfmmu_copytte(&sfhme->hme_tte, &tte); 9325 ASSERT(TTE_IS_VALID(&tte)); 9326 9327 vaddr = tte_to_vaddr(hmeblkp, tte); 9328 color = addr_to_vcolor(vaddr); 9329 9330 if (npages > 1) { 9331 /* 9332 * If there is a big mapping, make sure 9333 * 8K mapping is consistent with the big 9334 * mapping. 9335 */ 9336 bcolor = i % ncolors; 9337 if (color != bcolor) { 9338 return (0); 9339 } 9340 } 9341 if (!clr_valid) { 9342 clr_valid = 1; 9343 color1 = color; 9344 } 9345 9346 if (color1 != color) { 9347 return (0); 9348 } 9349 } 9350 9351 pp = PP_PAGENEXT(pp); 9352 } 9353 9354 return (1); 9355 } 9356 9357 void 9358 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag, 9359 pgcnt_t npages) 9360 { 9361 kmutex_t *pmtx; 9362 int i, ncolors, bcolor; 9363 kpm_hlk_t *kpmp; 9364 cpuset_t cpuset; 9365 9366 ASSERT(pp != NULL); 9367 ASSERT(!(cache & CACHE_WRITEBACK)); 9368 9369 kpmp = sfmmu_kpm_kpmp_enter(pp, npages); 9370 pmtx = sfmmu_page_enter(pp); 9371 9372 /* 9373 * Fast path caching single unmapped page 9374 */ 9375 if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) && 9376 flags == HAT_CACHE) { 9377 PP_CLRTNC(pp); 9378 PP_CLRPNC(pp); 9379 sfmmu_page_exit(pmtx); 9380 sfmmu_kpm_kpmp_exit(kpmp); 9381 return; 9382 } 9383 9384 /* 9385 * We need to capture all cpus in order to change cacheability 9386 * because we can't allow one cpu to access the same physical 9387 * page using a cacheable and a non-cachebale mapping at the same 9388 * time. Since we may end up walking the ism mapping list 9389 * have to grab it's lock now since we can't after all the 9390 * cpus have been captured. 9391 */ 9392 sfmmu_hat_lock_all(); 9393 mutex_enter(&ism_mlist_lock); 9394 kpreempt_disable(); 9395 cpuset = cpu_ready_set; 9396 xc_attention(cpuset); 9397 9398 if (npages > 1) { 9399 /* 9400 * Make sure all colors are flushed since the 9401 * sfmmu_page_cache() only flushes one color- 9402 * it does not know big pages. 9403 */ 9404 ncolors = CACHE_NUM_COLOR; 9405 if (flags & HAT_TMPNC) { 9406 for (i = 0; i < ncolors; i++) { 9407 sfmmu_cache_flushcolor(i, pp->p_pagenum); 9408 } 9409 cache_flush_flag = CACHE_NO_FLUSH; 9410 } 9411 } 9412 9413 for (i = 0; i < npages; i++) { 9414 9415 ASSERT(sfmmu_mlist_held(pp)); 9416 9417 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) { 9418 9419 if (npages > 1) { 9420 bcolor = i % ncolors; 9421 } else { 9422 bcolor = NO_VCOLOR; 9423 } 9424 9425 sfmmu_page_cache(pp, flags, cache_flush_flag, 9426 bcolor); 9427 } 9428 9429 pp = PP_PAGENEXT(pp); 9430 } 9431 9432 xt_sync(cpuset); 9433 xc_dismissed(cpuset); 9434 mutex_exit(&ism_mlist_lock); 9435 sfmmu_hat_unlock_all(); 9436 sfmmu_page_exit(pmtx); 9437 sfmmu_kpm_kpmp_exit(kpmp); 9438 kpreempt_enable(); 9439 } 9440 9441 /* 9442 * This function changes the virtual cacheability of all mappings to a 9443 * particular page. When changing from uncache to cacheable the mappings will 9444 * only be changed if all of them have the same virtual color. 9445 * We need to flush the cache in all cpus. It is possible that 9446 * a process referenced a page as cacheable but has sinced exited 9447 * and cleared the mapping list. We still to flush it but have no 9448 * state so all cpus is the only alternative. 9449 */ 9450 static void 9451 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor) 9452 { 9453 struct sf_hment *sfhme; 9454 struct hme_blk *hmeblkp; 9455 sfmmu_t *sfmmup; 9456 tte_t tte, ttemod; 9457 caddr_t vaddr; 9458 int ret, color; 9459 pfn_t pfn; 9460 9461 color = bcolor; 9462 pfn = pp->p_pagenum; 9463 9464 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) { 9465 9466 if (IS_PAHME(sfhme)) 9467 continue; 9468 hmeblkp = sfmmu_hmetohblk(sfhme); 9469 9470 sfmmu_copytte(&sfhme->hme_tte, &tte); 9471 ASSERT(TTE_IS_VALID(&tte)); 9472 vaddr = tte_to_vaddr(hmeblkp, tte); 9473 color = addr_to_vcolor(vaddr); 9474 9475 #ifdef DEBUG 9476 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) { 9477 ASSERT(color == bcolor); 9478 } 9479 #endif 9480 9481 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp)); 9482 9483 ttemod = tte; 9484 if (flags & (HAT_UNCACHE | HAT_TMPNC)) { 9485 TTE_CLR_VCACHEABLE(&ttemod); 9486 } else { /* flags & HAT_CACHE */ 9487 TTE_SET_VCACHEABLE(&ttemod); 9488 } 9489 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 9490 if (ret < 0) { 9491 /* 9492 * Since all cpus are captured modifytte should not 9493 * fail. 9494 */ 9495 panic("sfmmu_page_cache: write to tte failed"); 9496 } 9497 9498 sfmmup = hblktosfmmu(hmeblkp); 9499 if (cache_flush_flag == CACHE_FLUSH) { 9500 /* 9501 * Flush TSBs, TLBs and caches 9502 */ 9503 if (hmeblkp->hblk_shared) { 9504 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 9505 uint_t rid = hmeblkp->hblk_tag.htag_rid; 9506 sf_region_t *rgnp; 9507 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 9508 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 9509 ASSERT(srdp != NULL); 9510 rgnp = srdp->srd_hmergnp[rid]; 9511 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 9512 srdp, rgnp, rid); 9513 (void) sfmmu_rgntlb_demap(vaddr, rgnp, 9514 hmeblkp, 0); 9515 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr)); 9516 } else if (sfmmup->sfmmu_ismhat) { 9517 if (flags & HAT_CACHE) { 9518 SFMMU_STAT(sf_ism_recache); 9519 } else { 9520 SFMMU_STAT(sf_ism_uncache); 9521 } 9522 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp, 9523 pfn, CACHE_FLUSH); 9524 } else { 9525 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp, 9526 pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1); 9527 } 9528 9529 /* 9530 * all cache entries belonging to this pfn are 9531 * now flushed. 9532 */ 9533 cache_flush_flag = CACHE_NO_FLUSH; 9534 } else { 9535 /* 9536 * Flush only TSBs and TLBs. 9537 */ 9538 if (hmeblkp->hblk_shared) { 9539 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 9540 uint_t rid = hmeblkp->hblk_tag.htag_rid; 9541 sf_region_t *rgnp; 9542 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 9543 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 9544 ASSERT(srdp != NULL); 9545 rgnp = srdp->srd_hmergnp[rid]; 9546 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 9547 srdp, rgnp, rid); 9548 (void) sfmmu_rgntlb_demap(vaddr, rgnp, 9549 hmeblkp, 0); 9550 } else if (sfmmup->sfmmu_ismhat) { 9551 if (flags & HAT_CACHE) { 9552 SFMMU_STAT(sf_ism_recache); 9553 } else { 9554 SFMMU_STAT(sf_ism_uncache); 9555 } 9556 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp, 9557 pfn, CACHE_NO_FLUSH); 9558 } else { 9559 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1); 9560 } 9561 } 9562 } 9563 9564 if (PP_ISMAPPED_KPM(pp)) 9565 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag); 9566 9567 switch (flags) { 9568 9569 default: 9570 panic("sfmmu_pagecache: unknown flags"); 9571 break; 9572 9573 case HAT_CACHE: 9574 PP_CLRTNC(pp); 9575 PP_CLRPNC(pp); 9576 PP_SET_VCOLOR(pp, color); 9577 break; 9578 9579 case HAT_TMPNC: 9580 PP_SETTNC(pp); 9581 PP_SET_VCOLOR(pp, NO_VCOLOR); 9582 break; 9583 9584 case HAT_UNCACHE: 9585 PP_SETPNC(pp); 9586 PP_CLRTNC(pp); 9587 PP_SET_VCOLOR(pp, NO_VCOLOR); 9588 break; 9589 } 9590 } 9591 #endif /* VAC */ 9592 9593 9594 /* 9595 * Wrapper routine used to return a context. 9596 * 9597 * It's the responsibility of the caller to guarantee that the 9598 * process serializes on calls here by taking the HAT lock for 9599 * the hat. 9600 * 9601 */ 9602 static void 9603 sfmmu_get_ctx(sfmmu_t *sfmmup) 9604 { 9605 mmu_ctx_t *mmu_ctxp; 9606 uint_t pstate_save; 9607 int ret; 9608 9609 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9610 ASSERT(sfmmup != ksfmmup); 9611 9612 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) { 9613 sfmmu_setup_tsbinfo(sfmmup); 9614 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID); 9615 } 9616 9617 kpreempt_disable(); 9618 9619 mmu_ctxp = CPU_MMU_CTXP(CPU); 9620 ASSERT(mmu_ctxp); 9621 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms); 9622 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]); 9623 9624 /* 9625 * Do a wrap-around if cnum reaches the max # cnum supported by a MMU. 9626 */ 9627 if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs) 9628 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE); 9629 9630 /* 9631 * Let the MMU set up the page sizes to use for 9632 * this context in the TLB. Don't program 2nd dtlb for ism hat. 9633 */ 9634 if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) { 9635 mmu_set_ctx_page_sizes(sfmmup); 9636 } 9637 9638 /* 9639 * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with 9640 * interrupts disabled to prevent race condition with wrap-around 9641 * ctx invalidatation. In sun4v, ctx invalidation also involves 9642 * a HV call to set the number of TSBs to 0. If interrupts are not 9643 * disabled until after sfmmu_load_mmustate is complete TSBs may 9644 * become assigned to INVALID_CONTEXT. This is not allowed. 9645 */ 9646 pstate_save = sfmmu_disable_intrs(); 9647 9648 if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) && 9649 sfmmup->sfmmu_scdp != NULL) { 9650 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 9651 sfmmu_t *scsfmmup = scdp->scd_sfmmup; 9652 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED); 9653 /* debug purpose only */ 9654 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum 9655 != INVALID_CONTEXT); 9656 } 9657 sfmmu_load_mmustate(sfmmup); 9658 9659 sfmmu_enable_intrs(pstate_save); 9660 9661 kpreempt_enable(); 9662 } 9663 9664 /* 9665 * When all cnums are used up in a MMU, cnum will wrap around to the 9666 * next generation and start from 2. 9667 */ 9668 static void 9669 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum) 9670 { 9671 9672 /* caller must have disabled the preemption */ 9673 ASSERT(curthread->t_preempt >= 1); 9674 ASSERT(mmu_ctxp != NULL); 9675 9676 /* acquire Per-MMU (PM) spin lock */ 9677 mutex_enter(&mmu_ctxp->mmu_lock); 9678 9679 /* re-check to see if wrap-around is needed */ 9680 if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs) 9681 goto done; 9682 9683 SFMMU_MMU_STAT(mmu_wrap_around); 9684 9685 /* update gnum */ 9686 ASSERT(mmu_ctxp->mmu_gnum != 0); 9687 mmu_ctxp->mmu_gnum++; 9688 if (mmu_ctxp->mmu_gnum == 0 || 9689 mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) { 9690 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.", 9691 (void *)mmu_ctxp); 9692 } 9693 9694 if (mmu_ctxp->mmu_ncpus > 1) { 9695 cpuset_t cpuset; 9696 9697 membar_enter(); /* make sure updated gnum visible */ 9698 9699 SFMMU_XCALL_STATS(NULL); 9700 9701 /* xcall to others on the same MMU to invalidate ctx */ 9702 cpuset = mmu_ctxp->mmu_cpuset; 9703 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum); 9704 CPUSET_DEL(cpuset, CPU->cpu_id); 9705 CPUSET_AND(cpuset, cpu_ready_set); 9706 9707 /* 9708 * Pass in INVALID_CONTEXT as the first parameter to 9709 * sfmmu_raise_tsb_exception, which invalidates the context 9710 * of any process running on the CPUs in the MMU. 9711 */ 9712 xt_some(cpuset, sfmmu_raise_tsb_exception, 9713 INVALID_CONTEXT, INVALID_CONTEXT); 9714 xt_sync(cpuset); 9715 9716 SFMMU_MMU_STAT(mmu_tsb_raise_exception); 9717 } 9718 9719 if (sfmmu_getctx_sec() != INVALID_CONTEXT) { 9720 sfmmu_setctx_sec(INVALID_CONTEXT); 9721 sfmmu_clear_utsbinfo(); 9722 } 9723 9724 /* 9725 * No xcall is needed here. For sun4u systems all CPUs in context 9726 * domain share a single physical MMU therefore it's enough to flush 9727 * TLB on local CPU. On sun4v systems we use 1 global context 9728 * domain and flush all remote TLBs in sfmmu_raise_tsb_exception 9729 * handler. Note that vtag_flushall_uctxs() is called 9730 * for Ultra II machine, where the equivalent flushall functionality 9731 * is implemented in SW, and only user ctx TLB entries are flushed. 9732 */ 9733 if (&vtag_flushall_uctxs != NULL) { 9734 vtag_flushall_uctxs(); 9735 } else { 9736 vtag_flushall(); 9737 } 9738 9739 /* reset mmu cnum, skips cnum 0 and 1 */ 9740 if (reset_cnum == B_TRUE) 9741 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS; 9742 9743 done: 9744 mutex_exit(&mmu_ctxp->mmu_lock); 9745 } 9746 9747 9748 /* 9749 * For multi-threaded process, set the process context to INVALID_CONTEXT 9750 * so that it faults and reloads the MMU state from TL=0. For single-threaded 9751 * process, we can just load the MMU state directly without having to 9752 * set context invalid. Caller must hold the hat lock since we don't 9753 * acquire it here. 9754 */ 9755 static void 9756 sfmmu_sync_mmustate(sfmmu_t *sfmmup) 9757 { 9758 uint_t cnum; 9759 uint_t pstate_save; 9760 9761 ASSERT(sfmmup != ksfmmup); 9762 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9763 9764 kpreempt_disable(); 9765 9766 /* 9767 * We check whether the pass'ed-in sfmmup is the same as the 9768 * current running proc. This is to makes sure the current proc 9769 * stays single-threaded if it already is. 9770 */ 9771 if ((sfmmup == curthread->t_procp->p_as->a_hat) && 9772 (curthread->t_procp->p_lwpcnt == 1)) { 9773 /* single-thread */ 9774 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum; 9775 if (cnum != INVALID_CONTEXT) { 9776 uint_t curcnum; 9777 /* 9778 * Disable interrupts to prevent race condition 9779 * with sfmmu_ctx_wrap_around ctx invalidation. 9780 * In sun4v, ctx invalidation involves setting 9781 * TSB to NULL, hence, interrupts should be disabled 9782 * untill after sfmmu_load_mmustate is completed. 9783 */ 9784 pstate_save = sfmmu_disable_intrs(); 9785 curcnum = sfmmu_getctx_sec(); 9786 if (curcnum == cnum) 9787 sfmmu_load_mmustate(sfmmup); 9788 sfmmu_enable_intrs(pstate_save); 9789 ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT); 9790 } 9791 } else { 9792 /* 9793 * multi-thread 9794 * or when sfmmup is not the same as the curproc. 9795 */ 9796 sfmmu_invalidate_ctx(sfmmup); 9797 } 9798 9799 kpreempt_enable(); 9800 } 9801 9802 9803 /* 9804 * Replace the specified TSB with a new TSB. This function gets called when 9805 * we grow, shrink or swapin a TSB. When swapping in a TSB (TSB_SWAPIN), the 9806 * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB 9807 * (8K). 9808 * 9809 * Caller must hold the HAT lock, but should assume any tsb_info 9810 * pointers it has are no longer valid after calling this function. 9811 * 9812 * Return values: 9813 * TSB_ALLOCFAIL Failed to allocate a TSB, due to memory constraints 9814 * TSB_LOSTRACE HAT is busy, i.e. another thread is already doing 9815 * something to this tsbinfo/TSB 9816 * TSB_SUCCESS Operation succeeded 9817 */ 9818 static tsb_replace_rc_t 9819 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc, 9820 hatlock_t *hatlockp, uint_t flags) 9821 { 9822 struct tsb_info *new_tsbinfo = NULL; 9823 struct tsb_info *curtsb, *prevtsb; 9824 uint_t tte_sz_mask; 9825 int i; 9826 9827 ASSERT(sfmmup != ksfmmup); 9828 ASSERT(sfmmup->sfmmu_ismhat == 0); 9829 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9830 ASSERT(szc <= tsb_max_growsize); 9831 9832 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY)) 9833 return (TSB_LOSTRACE); 9834 9835 /* 9836 * Find the tsb_info ahead of this one in the list, and 9837 * also make sure that the tsb_info passed in really 9838 * exists! 9839 */ 9840 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb; 9841 curtsb != old_tsbinfo && curtsb != NULL; 9842 prevtsb = curtsb, curtsb = curtsb->tsb_next) 9843 ; 9844 ASSERT(curtsb != NULL); 9845 9846 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 9847 /* 9848 * The process is swapped out, so just set the new size 9849 * code. When it swaps back in, we'll allocate a new one 9850 * of the new chosen size. 9851 */ 9852 curtsb->tsb_szc = szc; 9853 return (TSB_SUCCESS); 9854 } 9855 SFMMU_FLAGS_SET(sfmmup, HAT_BUSY); 9856 9857 tte_sz_mask = old_tsbinfo->tsb_ttesz_mask; 9858 9859 /* 9860 * All initialization is done inside of sfmmu_tsbinfo_alloc(). 9861 * If we fail to allocate a TSB, exit. 9862 * 9863 * If tsb grows with new tsb size > 4M and old tsb size < 4M, 9864 * then try 4M slab after the initial alloc fails. 9865 * 9866 * If tsb swapin with tsb size > 4M, then try 4M after the 9867 * initial alloc fails. 9868 */ 9869 sfmmu_hat_exit(hatlockp); 9870 if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc, 9871 tte_sz_mask, flags, sfmmup) && 9872 (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) || 9873 (!(flags & TSB_SWAPIN) && 9874 (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) || 9875 sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE, 9876 tte_sz_mask, flags, sfmmup))) { 9877 (void) sfmmu_hat_enter(sfmmup); 9878 if (!(flags & TSB_SWAPIN)) 9879 SFMMU_STAT(sf_tsb_resize_failures); 9880 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9881 return (TSB_ALLOCFAIL); 9882 } 9883 (void) sfmmu_hat_enter(sfmmup); 9884 9885 /* 9886 * Re-check to make sure somebody else didn't muck with us while we 9887 * didn't hold the HAT lock. If the process swapped out, fine, just 9888 * exit; this can happen if we try to shrink the TSB from the context 9889 * of another process (such as on an ISM unmap), though it is rare. 9890 */ 9891 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 9892 SFMMU_STAT(sf_tsb_resize_failures); 9893 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9894 sfmmu_hat_exit(hatlockp); 9895 sfmmu_tsbinfo_free(new_tsbinfo); 9896 (void) sfmmu_hat_enter(sfmmup); 9897 return (TSB_LOSTRACE); 9898 } 9899 9900 #ifdef DEBUG 9901 /* Reverify that the tsb_info still exists.. for debugging only */ 9902 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb; 9903 curtsb != old_tsbinfo && curtsb != NULL; 9904 prevtsb = curtsb, curtsb = curtsb->tsb_next) 9905 ; 9906 ASSERT(curtsb != NULL); 9907 #endif /* DEBUG */ 9908 9909 /* 9910 * Quiesce any CPUs running this process on their next TLB miss 9911 * so they atomically see the new tsb_info. We temporarily set the 9912 * context to invalid context so new threads that come on processor 9913 * after we do the xcall to cpusran will also serialize behind the 9914 * HAT lock on TLB miss and will see the new TSB. Since this short 9915 * race with a new thread coming on processor is relatively rare, 9916 * this synchronization mechanism should be cheaper than always 9917 * pausing all CPUs for the duration of the setup, which is what 9918 * the old implementation did. This is particuarly true if we are 9919 * copying a huge chunk of memory around during that window. 9920 * 9921 * The memory barriers are to make sure things stay consistent 9922 * with resume() since it does not hold the HAT lock while 9923 * walking the list of tsb_info structures. 9924 */ 9925 if ((flags & TSB_SWAPIN) != TSB_SWAPIN) { 9926 /* The TSB is either growing or shrinking. */ 9927 sfmmu_invalidate_ctx(sfmmup); 9928 } else { 9929 /* 9930 * It is illegal to swap in TSBs from a process other 9931 * than a process being swapped in. This in turn 9932 * implies we do not have a valid MMU context here 9933 * since a process needs one to resolve translation 9934 * misses. 9935 */ 9936 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup); 9937 } 9938 9939 #ifdef DEBUG 9940 ASSERT(max_mmu_ctxdoms > 0); 9941 9942 /* 9943 * Process should have INVALID_CONTEXT on all MMUs 9944 */ 9945 for (i = 0; i < max_mmu_ctxdoms; i++) { 9946 9947 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT); 9948 } 9949 #endif 9950 9951 new_tsbinfo->tsb_next = old_tsbinfo->tsb_next; 9952 membar_stst(); /* strict ordering required */ 9953 if (prevtsb) 9954 prevtsb->tsb_next = new_tsbinfo; 9955 else 9956 sfmmup->sfmmu_tsb = new_tsbinfo; 9957 membar_enter(); /* make sure new TSB globally visible */ 9958 9959 /* 9960 * We need to migrate TSB entries from the old TSB to the new TSB 9961 * if tsb_remap_ttes is set and the TSB is growing. 9962 */ 9963 if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW)) 9964 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo); 9965 9966 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9967 9968 /* 9969 * Drop the HAT lock to free our old tsb_info. 9970 */ 9971 sfmmu_hat_exit(hatlockp); 9972 9973 if ((flags & TSB_GROW) == TSB_GROW) { 9974 SFMMU_STAT(sf_tsb_grow); 9975 } else if ((flags & TSB_SHRINK) == TSB_SHRINK) { 9976 SFMMU_STAT(sf_tsb_shrink); 9977 } 9978 9979 sfmmu_tsbinfo_free(old_tsbinfo); 9980 9981 (void) sfmmu_hat_enter(sfmmup); 9982 return (TSB_SUCCESS); 9983 } 9984 9985 /* 9986 * This function will re-program hat pgsz array, and invalidate the 9987 * process' context, forcing the process to switch to another 9988 * context on the next TLB miss, and therefore start using the 9989 * TLB that is reprogrammed for the new page sizes. 9990 */ 9991 void 9992 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz) 9993 { 9994 int i; 9995 hatlock_t *hatlockp = NULL; 9996 9997 hatlockp = sfmmu_hat_enter(sfmmup); 9998 /* USIII+-IV+ optimization, requires hat lock */ 9999 if (tmp_pgsz) { 10000 for (i = 0; i < mmu_page_sizes; i++) 10001 sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i]; 10002 } 10003 SFMMU_STAT(sf_tlb_reprog_pgsz); 10004 10005 sfmmu_invalidate_ctx(sfmmup); 10006 10007 sfmmu_hat_exit(hatlockp); 10008 } 10009 10010 /* 10011 * The scd_rttecnt field in the SCD must be updated to take account of the 10012 * regions which it contains. 10013 */ 10014 static void 10015 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp) 10016 { 10017 uint_t rid; 10018 uint_t i, j; 10019 ulong_t w; 10020 sf_region_t *rgnp; 10021 10022 ASSERT(srdp != NULL); 10023 10024 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 10025 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 10026 continue; 10027 } 10028 10029 j = 0; 10030 while (w) { 10031 if (!(w & 0x1)) { 10032 j++; 10033 w >>= 1; 10034 continue; 10035 } 10036 rid = (i << BT_ULSHIFT) | j; 10037 j++; 10038 w >>= 1; 10039 10040 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 10041 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 10042 rgnp = srdp->srd_hmergnp[rid]; 10043 ASSERT(rgnp->rgn_refcnt > 0); 10044 ASSERT(rgnp->rgn_id == rid); 10045 10046 scdp->scd_rttecnt[rgnp->rgn_pgszc] += 10047 rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc); 10048 10049 /* 10050 * Maintain the tsb0 inflation cnt for the regions 10051 * in the SCD. 10052 */ 10053 if (rgnp->rgn_pgszc >= TTE4M) { 10054 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt += 10055 rgnp->rgn_size >> 10056 (TTE_PAGE_SHIFT(TTE8K) + 2); 10057 } 10058 } 10059 } 10060 } 10061 10062 /* 10063 * This function assumes that there are either four or six supported page 10064 * sizes and at most two programmable TLBs, so we need to decide which 10065 * page sizes are most important and then tell the MMU layer so it 10066 * can adjust the TLB page sizes accordingly (if supported). 10067 * 10068 * If these assumptions change, this function will need to be 10069 * updated to support whatever the new limits are. 10070 * 10071 * The growing flag is nonzero if we are growing the address space, 10072 * and zero if it is shrinking. This allows us to decide whether 10073 * to grow or shrink our TSB, depending upon available memory 10074 * conditions. 10075 */ 10076 static void 10077 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing) 10078 { 10079 uint64_t ttecnt[MMU_PAGE_SIZES]; 10080 uint64_t tte8k_cnt, tte4m_cnt; 10081 uint8_t i; 10082 int sectsb_thresh; 10083 10084 /* 10085 * Kernel threads, processes with small address spaces not using 10086 * large pages, and dummy ISM HATs need not apply. 10087 */ 10088 if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL) 10089 return; 10090 10091 if (!SFMMU_LGPGS_INUSE(sfmmup) && 10092 sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor) 10093 return; 10094 10095 for (i = 0; i < mmu_page_sizes; i++) { 10096 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] + 10097 sfmmup->sfmmu_ismttecnt[i]; 10098 } 10099 10100 /* Check pagesizes in use, and possibly reprogram DTLB. */ 10101 if (&mmu_check_page_sizes) 10102 mmu_check_page_sizes(sfmmup, ttecnt); 10103 10104 /* 10105 * Calculate the number of 8k ttes to represent the span of these 10106 * pages. 10107 */ 10108 tte8k_cnt = ttecnt[TTE8K] + 10109 (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) + 10110 (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT)); 10111 if (mmu_page_sizes == max_mmu_page_sizes) { 10112 tte4m_cnt = ttecnt[TTE4M] + 10113 (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) + 10114 (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M)); 10115 } else { 10116 tte4m_cnt = ttecnt[TTE4M]; 10117 } 10118 10119 /* 10120 * Inflate tte8k_cnt to allow for region large page allocation failure. 10121 */ 10122 tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt; 10123 10124 /* 10125 * Inflate TSB sizes by a factor of 2 if this process 10126 * uses 4M text pages to minimize extra conflict misses 10127 * in the first TSB since without counting text pages 10128 * 8K TSB may become too small. 10129 * 10130 * Also double the size of the second TSB to minimize 10131 * extra conflict misses due to competition between 4M text pages 10132 * and data pages. 10133 * 10134 * We need to adjust the second TSB allocation threshold by the 10135 * inflation factor, since there is no point in creating a second 10136 * TSB when we know all the mappings can fit in the I/D TLBs. 10137 */ 10138 sectsb_thresh = tsb_sectsb_threshold; 10139 if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) { 10140 tte8k_cnt <<= 1; 10141 tte4m_cnt <<= 1; 10142 sectsb_thresh <<= 1; 10143 } 10144 10145 /* 10146 * Check to see if our TSB is the right size; we may need to 10147 * grow or shrink it. If the process is small, our work is 10148 * finished at this point. 10149 */ 10150 if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) { 10151 return; 10152 } 10153 sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh); 10154 } 10155 10156 static void 10157 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt, 10158 uint64_t tte4m_cnt, int sectsb_thresh) 10159 { 10160 int tsb_bits; 10161 uint_t tsb_szc; 10162 struct tsb_info *tsbinfop; 10163 hatlock_t *hatlockp = NULL; 10164 10165 hatlockp = sfmmu_hat_enter(sfmmup); 10166 ASSERT(hatlockp != NULL); 10167 tsbinfop = sfmmup->sfmmu_tsb; 10168 ASSERT(tsbinfop != NULL); 10169 10170 /* 10171 * If we're growing, select the size based on RSS. If we're 10172 * shrinking, leave some room so we don't have to turn around and 10173 * grow again immediately. 10174 */ 10175 if (growing) 10176 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt); 10177 else 10178 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1); 10179 10180 if (!growing && (tsb_szc < tsbinfop->tsb_szc) && 10181 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) { 10182 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc, 10183 hatlockp, TSB_SHRINK); 10184 } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) { 10185 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc, 10186 hatlockp, TSB_GROW); 10187 } 10188 tsbinfop = sfmmup->sfmmu_tsb; 10189 10190 /* 10191 * With the TLB and first TSB out of the way, we need to see if 10192 * we need a second TSB for 4M pages. If we managed to reprogram 10193 * the TLB page sizes above, the process will start using this new 10194 * TSB right away; otherwise, it will start using it on the next 10195 * context switch. Either way, it's no big deal so there's no 10196 * synchronization with the trap handlers here unless we grow the 10197 * TSB (in which case it's required to prevent using the old one 10198 * after it's freed). Note: second tsb is required for 32M/256M 10199 * page sizes. 10200 */ 10201 if (tte4m_cnt > sectsb_thresh) { 10202 /* 10203 * If we're growing, select the size based on RSS. If we're 10204 * shrinking, leave some room so we don't have to turn 10205 * around and grow again immediately. 10206 */ 10207 if (growing) 10208 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt); 10209 else 10210 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1); 10211 if (tsbinfop->tsb_next == NULL) { 10212 struct tsb_info *newtsb; 10213 int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)? 10214 0 : TSB_ALLOC; 10215 10216 sfmmu_hat_exit(hatlockp); 10217 10218 /* 10219 * Try to allocate a TSB for 4[32|256]M pages. If we 10220 * can't get the size we want, retry w/a minimum sized 10221 * TSB. If that still didn't work, give up; we can 10222 * still run without one. 10223 */ 10224 tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)? 10225 TSB4M|TSB32M|TSB256M:TSB4M; 10226 if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits, 10227 allocflags, sfmmup)) && 10228 (tsb_szc <= TSB_4M_SZCODE || 10229 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE, 10230 tsb_bits, allocflags, sfmmup)) && 10231 sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE, 10232 tsb_bits, allocflags, sfmmup)) { 10233 return; 10234 } 10235 10236 hatlockp = sfmmu_hat_enter(sfmmup); 10237 10238 sfmmu_invalidate_ctx(sfmmup); 10239 10240 if (sfmmup->sfmmu_tsb->tsb_next == NULL) { 10241 sfmmup->sfmmu_tsb->tsb_next = newtsb; 10242 SFMMU_STAT(sf_tsb_sectsb_create); 10243 sfmmu_hat_exit(hatlockp); 10244 return; 10245 } else { 10246 /* 10247 * It's annoying, but possible for us 10248 * to get here.. we dropped the HAT lock 10249 * because of locking order in the kmem 10250 * allocator, and while we were off getting 10251 * our memory, some other thread decided to 10252 * do us a favor and won the race to get a 10253 * second TSB for this process. Sigh. 10254 */ 10255 sfmmu_hat_exit(hatlockp); 10256 sfmmu_tsbinfo_free(newtsb); 10257 return; 10258 } 10259 } 10260 10261 /* 10262 * We have a second TSB, see if it's big enough. 10263 */ 10264 tsbinfop = tsbinfop->tsb_next; 10265 10266 /* 10267 * Check to see if our second TSB is the right size; 10268 * we may need to grow or shrink it. 10269 * To prevent thrashing (e.g. growing the TSB on a 10270 * subsequent map operation), only try to shrink if 10271 * the TSB reach exceeds twice the virtual address 10272 * space size. 10273 */ 10274 if (!growing && (tsb_szc < tsbinfop->tsb_szc) && 10275 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) { 10276 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, 10277 tsb_szc, hatlockp, TSB_SHRINK); 10278 } else if (growing && tsb_szc > tsbinfop->tsb_szc && 10279 TSB_OK_GROW()) { 10280 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, 10281 tsb_szc, hatlockp, TSB_GROW); 10282 } 10283 } 10284 10285 sfmmu_hat_exit(hatlockp); 10286 } 10287 10288 /* 10289 * Free up a sfmmu 10290 * Since the sfmmu is currently embedded in the hat struct we simply zero 10291 * out our fields and free up the ism map blk list if any. 10292 */ 10293 static void 10294 sfmmu_free_sfmmu(sfmmu_t *sfmmup) 10295 { 10296 ism_blk_t *blkp, *nx_blkp; 10297 #ifdef DEBUG 10298 ism_map_t *map; 10299 int i; 10300 #endif 10301 10302 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0); 10303 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0); 10304 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0); 10305 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0); 10306 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 10307 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 10308 ASSERT(SF_RGNMAP_ISNULL(sfmmup)); 10309 10310 sfmmup->sfmmu_free = 0; 10311 sfmmup->sfmmu_ismhat = 0; 10312 10313 blkp = sfmmup->sfmmu_iblk; 10314 sfmmup->sfmmu_iblk = NULL; 10315 10316 while (blkp) { 10317 #ifdef DEBUG 10318 map = blkp->iblk_maps; 10319 for (i = 0; i < ISM_MAP_SLOTS; i++) { 10320 ASSERT(map[i].imap_seg == 0); 10321 ASSERT(map[i].imap_ismhat == NULL); 10322 ASSERT(map[i].imap_ment == NULL); 10323 } 10324 #endif 10325 nx_blkp = blkp->iblk_next; 10326 blkp->iblk_next = NULL; 10327 blkp->iblk_nextpa = (uint64_t)-1; 10328 kmem_cache_free(ism_blk_cache, blkp); 10329 blkp = nx_blkp; 10330 } 10331 } 10332 10333 /* 10334 * Locking primitves accessed by HATLOCK macros 10335 */ 10336 10337 #define SFMMU_SPL_MTX (0x0) 10338 #define SFMMU_ML_MTX (0x1) 10339 10340 #define SFMMU_MLSPL_MTX(type, pg) (((type) == SFMMU_SPL_MTX) ? \ 10341 SPL_HASH(pg) : MLIST_HASH(pg)) 10342 10343 kmutex_t * 10344 sfmmu_page_enter(struct page *pp) 10345 { 10346 return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX)); 10347 } 10348 10349 void 10350 sfmmu_page_exit(kmutex_t *spl) 10351 { 10352 mutex_exit(spl); 10353 } 10354 10355 int 10356 sfmmu_page_spl_held(struct page *pp) 10357 { 10358 return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX)); 10359 } 10360 10361 kmutex_t * 10362 sfmmu_mlist_enter(struct page *pp) 10363 { 10364 return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX)); 10365 } 10366 10367 void 10368 sfmmu_mlist_exit(kmutex_t *mml) 10369 { 10370 mutex_exit(mml); 10371 } 10372 10373 int 10374 sfmmu_mlist_held(struct page *pp) 10375 { 10376 10377 return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX)); 10378 } 10379 10380 /* 10381 * Common code for sfmmu_mlist_enter() and sfmmu_page_enter(). For 10382 * sfmmu_mlist_enter() case mml_table lock array is used and for 10383 * sfmmu_page_enter() sfmmu_page_lock lock array is used. 10384 * 10385 * The lock is taken on a root page so that it protects an operation on all 10386 * constituent pages of a large page pp belongs to. 10387 * 10388 * The routine takes a lock from the appropriate array. The lock is determined 10389 * by hashing the root page. After taking the lock this routine checks if the 10390 * root page has the same size code that was used to determine the root (i.e 10391 * that root hasn't changed). If root page has the expected p_szc field we 10392 * have the right lock and it's returned to the caller. If root's p_szc 10393 * decreased we release the lock and retry from the beginning. This case can 10394 * happen due to hat_page_demote() decreasing p_szc between our load of p_szc 10395 * value and taking the lock. The number of retries due to p_szc decrease is 10396 * limited by the maximum p_szc value. If p_szc is 0 we return the lock 10397 * determined by hashing pp itself. 10398 * 10399 * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also 10400 * possible that p_szc can increase. To increase p_szc a thread has to lock 10401 * all constituent pages EXCL and do hat_pageunload() on all of them. All the 10402 * callers that don't hold a page locked recheck if hmeblk through which pp 10403 * was found still maps this pp. If it doesn't map it anymore returned lock 10404 * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of 10405 * p_szc increase after taking the lock it returns this lock without further 10406 * retries because in this case the caller doesn't care about which lock was 10407 * taken. The caller will drop it right away. 10408 * 10409 * After the routine returns it's guaranteed that hat_page_demote() can't 10410 * change p_szc field of any of constituent pages of a large page pp belongs 10411 * to as long as pp was either locked at least SHARED prior to this call or 10412 * the caller finds that hment that pointed to this pp still references this 10413 * pp (this also assumes that the caller holds hme hash bucket lock so that 10414 * the same pp can't be remapped into the same hmeblk after it was unmapped by 10415 * hat_pageunload()). 10416 */ 10417 static kmutex_t * 10418 sfmmu_mlspl_enter(struct page *pp, int type) 10419 { 10420 kmutex_t *mtx; 10421 uint_t prev_rszc = UINT_MAX; 10422 page_t *rootpp; 10423 uint_t szc; 10424 uint_t rszc; 10425 uint_t pszc = pp->p_szc; 10426 10427 ASSERT(pp != NULL); 10428 10429 again: 10430 if (pszc == 0) { 10431 mtx = SFMMU_MLSPL_MTX(type, pp); 10432 mutex_enter(mtx); 10433 return (mtx); 10434 } 10435 10436 /* The lock lives in the root page */ 10437 rootpp = PP_GROUPLEADER(pp, pszc); 10438 mtx = SFMMU_MLSPL_MTX(type, rootpp); 10439 mutex_enter(mtx); 10440 10441 /* 10442 * Return mml in the following 3 cases: 10443 * 10444 * 1) If pp itself is root since if its p_szc decreased before we took 10445 * the lock pp is still the root of smaller szc page. And if its p_szc 10446 * increased it doesn't matter what lock we return (see comment in 10447 * front of this routine). 10448 * 10449 * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size 10450 * large page we have the right lock since any previous potential 10451 * hat_page_demote() is done demoting from greater than current root's 10452 * p_szc because hat_page_demote() changes root's p_szc last. No 10453 * further hat_page_demote() can start or be in progress since it 10454 * would need the same lock we currently hold. 10455 * 10456 * 3) If rootpp's p_szc increased since previous iteration it doesn't 10457 * matter what lock we return (see comment in front of this routine). 10458 */ 10459 if (pp == rootpp || (rszc = rootpp->p_szc) == pszc || 10460 rszc >= prev_rszc) { 10461 return (mtx); 10462 } 10463 10464 /* 10465 * hat_page_demote() could have decreased root's p_szc. 10466 * In this case pp's p_szc must also be smaller than pszc. 10467 * Retry. 10468 */ 10469 if (rszc < pszc) { 10470 szc = pp->p_szc; 10471 if (szc < pszc) { 10472 mutex_exit(mtx); 10473 pszc = szc; 10474 goto again; 10475 } 10476 /* 10477 * pp's p_szc increased after it was decreased. 10478 * page cannot be mapped. Return current lock. The caller 10479 * will drop it right away. 10480 */ 10481 return (mtx); 10482 } 10483 10484 /* 10485 * root's p_szc is greater than pp's p_szc. 10486 * hat_page_demote() is not done with all pages 10487 * yet. Wait for it to complete. 10488 */ 10489 mutex_exit(mtx); 10490 rootpp = PP_GROUPLEADER(rootpp, rszc); 10491 mtx = SFMMU_MLSPL_MTX(type, rootpp); 10492 mutex_enter(mtx); 10493 mutex_exit(mtx); 10494 prev_rszc = rszc; 10495 goto again; 10496 } 10497 10498 static int 10499 sfmmu_mlspl_held(struct page *pp, int type) 10500 { 10501 kmutex_t *mtx; 10502 10503 ASSERT(pp != NULL); 10504 /* The lock lives in the root page */ 10505 pp = PP_PAGEROOT(pp); 10506 ASSERT(pp != NULL); 10507 10508 mtx = SFMMU_MLSPL_MTX(type, pp); 10509 return (MUTEX_HELD(mtx)); 10510 } 10511 10512 static uint_t 10513 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical) 10514 { 10515 struct hme_blk *hblkp; 10516 10517 10518 if (freehblkp != NULL) { 10519 mutex_enter(&freehblkp_lock); 10520 if (freehblkp != NULL) { 10521 /* 10522 * If the current thread is owning hblk_reserve OR 10523 * critical request from sfmmu_hblk_steal() 10524 * let it succeed even if freehblkcnt is really low. 10525 */ 10526 if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) { 10527 SFMMU_STAT(sf_get_free_throttle); 10528 mutex_exit(&freehblkp_lock); 10529 return (0); 10530 } 10531 freehblkcnt--; 10532 *hmeblkpp = freehblkp; 10533 hblkp = *hmeblkpp; 10534 freehblkp = hblkp->hblk_next; 10535 mutex_exit(&freehblkp_lock); 10536 hblkp->hblk_next = NULL; 10537 SFMMU_STAT(sf_get_free_success); 10538 10539 ASSERT(hblkp->hblk_hmecnt == 0); 10540 ASSERT(hblkp->hblk_vcnt == 0); 10541 ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp)); 10542 10543 return (1); 10544 } 10545 mutex_exit(&freehblkp_lock); 10546 } 10547 10548 /* Check cpu hblk pending queues */ 10549 if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) { 10550 hblkp = *hmeblkpp; 10551 hblkp->hblk_next = NULL; 10552 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp); 10553 10554 ASSERT(hblkp->hblk_hmecnt == 0); 10555 ASSERT(hblkp->hblk_vcnt == 0); 10556 10557 return (1); 10558 } 10559 10560 SFMMU_STAT(sf_get_free_fail); 10561 return (0); 10562 } 10563 10564 static uint_t 10565 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical) 10566 { 10567 struct hme_blk *hblkp; 10568 10569 ASSERT(hmeblkp->hblk_hmecnt == 0); 10570 ASSERT(hmeblkp->hblk_vcnt == 0); 10571 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp)); 10572 10573 /* 10574 * If the current thread is mapping into kernel space, 10575 * let it succede even if freehblkcnt is max 10576 * so that it will avoid freeing it to kmem. 10577 * This will prevent stack overflow due to 10578 * possible recursion since kmem_cache_free() 10579 * might require creation of a slab which 10580 * in turn needs an hmeblk to map that slab; 10581 * let's break this vicious chain at the first 10582 * opportunity. 10583 */ 10584 if (freehblkcnt < HBLK_RESERVE_CNT || critical) { 10585 mutex_enter(&freehblkp_lock); 10586 if (freehblkcnt < HBLK_RESERVE_CNT || critical) { 10587 SFMMU_STAT(sf_put_free_success); 10588 freehblkcnt++; 10589 hmeblkp->hblk_next = freehblkp; 10590 freehblkp = hmeblkp; 10591 mutex_exit(&freehblkp_lock); 10592 return (1); 10593 } 10594 mutex_exit(&freehblkp_lock); 10595 } 10596 10597 /* 10598 * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here 10599 * only if freehblkcnt is at least HBLK_RESERVE_CNT *and* 10600 * we are not in the process of mapping into kernel space. 10601 */ 10602 ASSERT(!critical); 10603 while (freehblkcnt > HBLK_RESERVE_CNT) { 10604 mutex_enter(&freehblkp_lock); 10605 if (freehblkcnt > HBLK_RESERVE_CNT) { 10606 freehblkcnt--; 10607 hblkp = freehblkp; 10608 freehblkp = hblkp->hblk_next; 10609 mutex_exit(&freehblkp_lock); 10610 ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache); 10611 kmem_cache_free(sfmmu8_cache, hblkp); 10612 continue; 10613 } 10614 mutex_exit(&freehblkp_lock); 10615 } 10616 SFMMU_STAT(sf_put_free_fail); 10617 return (0); 10618 } 10619 10620 static void 10621 sfmmu_hblk_swap(struct hme_blk *new) 10622 { 10623 struct hme_blk *old, *hblkp, *prev; 10624 uint64_t newpa; 10625 caddr_t base, vaddr, endaddr; 10626 struct hmehash_bucket *hmebp; 10627 struct sf_hment *osfhme, *nsfhme; 10628 page_t *pp; 10629 kmutex_t *pml; 10630 tte_t tte; 10631 struct hme_blk *list = NULL; 10632 10633 #ifdef DEBUG 10634 hmeblk_tag hblktag; 10635 struct hme_blk *found; 10636 #endif 10637 old = HBLK_RESERVE; 10638 ASSERT(!old->hblk_shared); 10639 10640 /* 10641 * save pa before bcopy clobbers it 10642 */ 10643 newpa = new->hblk_nextpa; 10644 10645 base = (caddr_t)get_hblk_base(old); 10646 endaddr = base + get_hblk_span(old); 10647 10648 /* 10649 * acquire hash bucket lock. 10650 */ 10651 hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K, 10652 SFMMU_INVALID_SHMERID); 10653 10654 /* 10655 * copy contents from old to new 10656 */ 10657 bcopy((void *)old, (void *)new, HME8BLK_SZ); 10658 10659 /* 10660 * add new to hash chain 10661 */ 10662 sfmmu_hblk_hash_add(hmebp, new, newpa); 10663 10664 /* 10665 * search hash chain for hblk_reserve; this needs to be performed 10666 * after adding new, otherwise prev won't correspond to the hblk which 10667 * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to 10668 * remove old later. 10669 */ 10670 for (prev = NULL, 10671 hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old; 10672 prev = hblkp, hblkp = hblkp->hblk_next) 10673 ; 10674 10675 if (hblkp != old) 10676 panic("sfmmu_hblk_swap: hblk_reserve not found"); 10677 10678 /* 10679 * p_mapping list is still pointing to hments in hblk_reserve; 10680 * fix up p_mapping list so that they point to hments in new. 10681 * 10682 * Since all these mappings are created by hblk_reserve_thread 10683 * on the way and it's using at least one of the buffers from each of 10684 * the newly minted slabs, there is no danger of any of these 10685 * mappings getting unloaded by another thread. 10686 * 10687 * tsbmiss could only modify ref/mod bits of hments in old/new. 10688 * Since all of these hments hold mappings established by segkmem 10689 * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits 10690 * have no meaning for the mappings in hblk_reserve. hments in 10691 * old and new are identical except for ref/mod bits. 10692 */ 10693 for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) { 10694 10695 HBLKTOHME(osfhme, old, vaddr); 10696 sfmmu_copytte(&osfhme->hme_tte, &tte); 10697 10698 if (TTE_IS_VALID(&tte)) { 10699 if ((pp = osfhme->hme_page) == NULL) 10700 panic("sfmmu_hblk_swap: page not mapped"); 10701 10702 pml = sfmmu_mlist_enter(pp); 10703 10704 if (pp != osfhme->hme_page) 10705 panic("sfmmu_hblk_swap: mapping changed"); 10706 10707 HBLKTOHME(nsfhme, new, vaddr); 10708 10709 HME_ADD(nsfhme, pp); 10710 HME_SUB(osfhme, pp); 10711 10712 sfmmu_mlist_exit(pml); 10713 } 10714 } 10715 10716 /* 10717 * remove old from hash chain 10718 */ 10719 sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1); 10720 10721 #ifdef DEBUG 10722 10723 hblktag.htag_id = ksfmmup; 10724 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 10725 hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K)); 10726 hblktag.htag_rehash = HME_HASH_REHASH(TTE8K); 10727 HME_HASH_FAST_SEARCH(hmebp, hblktag, found); 10728 10729 if (found != new) 10730 panic("sfmmu_hblk_swap: new hblk not found"); 10731 #endif 10732 10733 SFMMU_HASH_UNLOCK(hmebp); 10734 10735 /* 10736 * Reset hblk_reserve 10737 */ 10738 bzero((void *)old, HME8BLK_SZ); 10739 old->hblk_nextpa = va_to_pa((caddr_t)old); 10740 } 10741 10742 /* 10743 * Grab the mlist mutex for both pages passed in. 10744 * 10745 * low and high will be returned as pointers to the mutexes for these pages. 10746 * low refers to the mutex residing in the lower bin of the mlist hash, while 10747 * high refers to the mutex residing in the higher bin of the mlist hash. This 10748 * is due to the locking order restrictions on the same thread grabbing 10749 * multiple mlist mutexes. The low lock must be acquired before the high lock. 10750 * 10751 * If both pages hash to the same mutex, only grab that single mutex, and 10752 * high will be returned as NULL 10753 * If the pages hash to different bins in the hash, grab the lower addressed 10754 * lock first and then the higher addressed lock in order to follow the locking 10755 * rules involved with the same thread grabbing multiple mlist mutexes. 10756 * low and high will both have non-NULL values. 10757 */ 10758 static void 10759 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl, 10760 kmutex_t **low, kmutex_t **high) 10761 { 10762 kmutex_t *mml_targ, *mml_repl; 10763 10764 /* 10765 * no need to do the dance around szc as in sfmmu_mlist_enter() 10766 * because this routine is only called by hat_page_relocate() and all 10767 * targ and repl pages are already locked EXCL so szc can't change. 10768 */ 10769 10770 mml_targ = MLIST_HASH(PP_PAGEROOT(targ)); 10771 mml_repl = MLIST_HASH(PP_PAGEROOT(repl)); 10772 10773 if (mml_targ == mml_repl) { 10774 *low = mml_targ; 10775 *high = NULL; 10776 } else { 10777 if (mml_targ < mml_repl) { 10778 *low = mml_targ; 10779 *high = mml_repl; 10780 } else { 10781 *low = mml_repl; 10782 *high = mml_targ; 10783 } 10784 } 10785 10786 mutex_enter(*low); 10787 if (*high) 10788 mutex_enter(*high); 10789 } 10790 10791 static void 10792 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high) 10793 { 10794 if (high) 10795 mutex_exit(high); 10796 mutex_exit(low); 10797 } 10798 10799 static hatlock_t * 10800 sfmmu_hat_enter(sfmmu_t *sfmmup) 10801 { 10802 hatlock_t *hatlockp; 10803 10804 if (sfmmup != ksfmmup) { 10805 hatlockp = TSB_HASH(sfmmup); 10806 mutex_enter(HATLOCK_MUTEXP(hatlockp)); 10807 return (hatlockp); 10808 } 10809 return (NULL); 10810 } 10811 10812 static hatlock_t * 10813 sfmmu_hat_tryenter(sfmmu_t *sfmmup) 10814 { 10815 hatlock_t *hatlockp; 10816 10817 if (sfmmup != ksfmmup) { 10818 hatlockp = TSB_HASH(sfmmup); 10819 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0) 10820 return (NULL); 10821 return (hatlockp); 10822 } 10823 return (NULL); 10824 } 10825 10826 static void 10827 sfmmu_hat_exit(hatlock_t *hatlockp) 10828 { 10829 if (hatlockp != NULL) 10830 mutex_exit(HATLOCK_MUTEXP(hatlockp)); 10831 } 10832 10833 static void 10834 sfmmu_hat_lock_all(void) 10835 { 10836 int i; 10837 for (i = 0; i < SFMMU_NUM_LOCK; i++) 10838 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i])); 10839 } 10840 10841 static void 10842 sfmmu_hat_unlock_all(void) 10843 { 10844 int i; 10845 for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--) 10846 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i])); 10847 } 10848 10849 int 10850 sfmmu_hat_lock_held(sfmmu_t *sfmmup) 10851 { 10852 ASSERT(sfmmup != ksfmmup); 10853 return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup)))); 10854 } 10855 10856 /* 10857 * Locking primitives to provide consistency between ISM unmap 10858 * and other operations. Since ISM unmap can take a long time, we 10859 * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating 10860 * contention on the hatlock buckets while ISM segments are being 10861 * unmapped. The tradeoff is that the flags don't prevent priority 10862 * inversion from occurring, so we must request kernel priority in 10863 * case we have to sleep to keep from getting buried while holding 10864 * the HAT_ISMBUSY flag set, which in turn could block other kernel 10865 * threads from running (for example, in sfmmu_uvatopfn()). 10866 */ 10867 static void 10868 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held) 10869 { 10870 hatlock_t *hatlockp; 10871 10872 if (!hatlock_held) 10873 hatlockp = sfmmu_hat_enter(sfmmup); 10874 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) 10875 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp)); 10876 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY); 10877 if (!hatlock_held) 10878 sfmmu_hat_exit(hatlockp); 10879 } 10880 10881 static void 10882 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held) 10883 { 10884 hatlock_t *hatlockp; 10885 10886 if (!hatlock_held) 10887 hatlockp = sfmmu_hat_enter(sfmmup); 10888 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 10889 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY); 10890 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 10891 if (!hatlock_held) 10892 sfmmu_hat_exit(hatlockp); 10893 } 10894 10895 /* 10896 * 10897 * Algorithm: 10898 * 10899 * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed 10900 * hblks. 10901 * 10902 * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache, 10903 * 10904 * (a) try to return an hblk from reserve pool of free hblks; 10905 * (b) if the reserve pool is empty, acquire hblk_reserve_lock 10906 * and return hblk_reserve. 10907 * 10908 * (3) call kmem_cache_alloc() to allocate hblk; 10909 * 10910 * (a) if hblk_reserve_lock is held by the current thread, 10911 * atomically replace hblk_reserve by the hblk that is 10912 * returned by kmem_cache_alloc; release hblk_reserve_lock 10913 * and call kmem_cache_alloc() again. 10914 * (b) if reserve pool is not full, add the hblk that is 10915 * returned by kmem_cache_alloc to reserve pool and 10916 * call kmem_cache_alloc again. 10917 * 10918 */ 10919 static struct hme_blk * 10920 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr, 10921 struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag, 10922 uint_t flags, uint_t rid) 10923 { 10924 struct hme_blk *hmeblkp = NULL; 10925 struct hme_blk *newhblkp; 10926 struct hme_blk *shw_hblkp = NULL; 10927 struct kmem_cache *sfmmu_cache = NULL; 10928 uint64_t hblkpa; 10929 ulong_t index; 10930 uint_t owner; /* set to 1 if using hblk_reserve */ 10931 uint_t forcefree; 10932 int sleep; 10933 sf_srd_t *srdp; 10934 sf_region_t *rgnp; 10935 10936 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 10937 ASSERT(hblktag.htag_rid == rid); 10938 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 10939 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || 10940 IS_P2ALIGNED(vaddr, TTEBYTES(size))); 10941 10942 /* 10943 * If segkmem is not created yet, allocate from static hmeblks 10944 * created at the end of startup_modules(). See the block comment 10945 * in startup_modules() describing how we estimate the number of 10946 * static hmeblks that will be needed during re-map. 10947 */ 10948 if (!hblk_alloc_dynamic) { 10949 10950 ASSERT(!SFMMU_IS_SHMERID_VALID(rid)); 10951 10952 if (size == TTE8K) { 10953 index = nucleus_hblk8.index; 10954 if (index >= nucleus_hblk8.len) { 10955 /* 10956 * If we panic here, see startup_modules() to 10957 * make sure that we are calculating the 10958 * number of hblk8's that we need correctly. 10959 */ 10960 prom_panic("no nucleus hblk8 to allocate"); 10961 } 10962 hmeblkp = 10963 (struct hme_blk *)&nucleus_hblk8.list[index]; 10964 nucleus_hblk8.index++; 10965 SFMMU_STAT(sf_hblk8_nalloc); 10966 } else { 10967 index = nucleus_hblk1.index; 10968 if (nucleus_hblk1.index >= nucleus_hblk1.len) { 10969 /* 10970 * If we panic here, see startup_modules(). 10971 * Most likely you need to update the 10972 * calculation of the number of hblk1 elements 10973 * that the kernel needs to boot. 10974 */ 10975 prom_panic("no nucleus hblk1 to allocate"); 10976 } 10977 hmeblkp = 10978 (struct hme_blk *)&nucleus_hblk1.list[index]; 10979 nucleus_hblk1.index++; 10980 SFMMU_STAT(sf_hblk1_nalloc); 10981 } 10982 10983 goto hblk_init; 10984 } 10985 10986 SFMMU_HASH_UNLOCK(hmebp); 10987 10988 if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) { 10989 if (mmu_page_sizes == max_mmu_page_sizes) { 10990 if (size < TTE256M) 10991 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr, 10992 size, flags); 10993 } else { 10994 if (size < TTE4M) 10995 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr, 10996 size, flags); 10997 } 10998 } else if (SFMMU_IS_SHMERID_VALID(rid)) { 10999 /* 11000 * Shared hmes use per region bitmaps in rgn_hmeflag 11001 * rather than shadow hmeblks to keep track of the 11002 * mapping sizes which have been allocated for the region. 11003 * Here we cleanup old invalid hmeblks with this rid, 11004 * which may be left around by pageunload(). 11005 */ 11006 int ttesz; 11007 caddr_t va; 11008 caddr_t eva = vaddr + TTEBYTES(size); 11009 11010 ASSERT(sfmmup != KHATID); 11011 11012 srdp = sfmmup->sfmmu_srdp; 11013 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 11014 rgnp = srdp->srd_hmergnp[rid]; 11015 ASSERT(rgnp != NULL && rgnp->rgn_id == rid); 11016 ASSERT(rgnp->rgn_refcnt != 0); 11017 ASSERT(size <= rgnp->rgn_pgszc); 11018 11019 ttesz = HBLK_MIN_TTESZ; 11020 do { 11021 if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) { 11022 continue; 11023 } 11024 11025 if (ttesz > size && ttesz != HBLK_MIN_TTESZ) { 11026 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz); 11027 } else if (ttesz < size) { 11028 for (va = vaddr; va < eva; 11029 va += TTEBYTES(ttesz)) { 11030 sfmmu_cleanup_rhblk(srdp, va, rid, 11031 ttesz); 11032 } 11033 } 11034 } while (++ttesz <= rgnp->rgn_pgszc); 11035 } 11036 11037 fill_hblk: 11038 owner = (hblk_reserve_thread == curthread) ? 1 : 0; 11039 11040 if (owner && size == TTE8K) { 11041 11042 ASSERT(!SFMMU_IS_SHMERID_VALID(rid)); 11043 /* 11044 * We are really in a tight spot. We already own 11045 * hblk_reserve and we need another hblk. In anticipation 11046 * of this kind of scenario, we specifically set aside 11047 * HBLK_RESERVE_MIN number of hblks to be used exclusively 11048 * by owner of hblk_reserve. 11049 */ 11050 SFMMU_STAT(sf_hblk_recurse_cnt); 11051 11052 if (!sfmmu_get_free_hblk(&hmeblkp, 1)) 11053 panic("sfmmu_hblk_alloc: reserve list is empty"); 11054 11055 goto hblk_verify; 11056 } 11057 11058 ASSERT(!owner); 11059 11060 if ((flags & HAT_NO_KALLOC) == 0) { 11061 11062 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache); 11063 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP); 11064 11065 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) { 11066 hmeblkp = sfmmu_hblk_steal(size); 11067 } else { 11068 /* 11069 * if we are the owner of hblk_reserve, 11070 * swap hblk_reserve with hmeblkp and 11071 * start a fresh life. Hope things go 11072 * better this time. 11073 */ 11074 if (hblk_reserve_thread == curthread) { 11075 ASSERT(sfmmu_cache == sfmmu8_cache); 11076 sfmmu_hblk_swap(hmeblkp); 11077 hblk_reserve_thread = NULL; 11078 mutex_exit(&hblk_reserve_lock); 11079 goto fill_hblk; 11080 } 11081 /* 11082 * let's donate this hblk to our reserve list if 11083 * we are not mapping kernel range 11084 */ 11085 if (size == TTE8K && sfmmup != KHATID) { 11086 if (sfmmu_put_free_hblk(hmeblkp, 0)) 11087 goto fill_hblk; 11088 } 11089 } 11090 } else { 11091 /* 11092 * We are here to map the slab in sfmmu8_cache; let's 11093 * check if we could tap our reserve list; if successful, 11094 * this will avoid the pain of going thru sfmmu_hblk_swap 11095 */ 11096 SFMMU_STAT(sf_hblk_slab_cnt); 11097 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) { 11098 /* 11099 * let's start hblk_reserve dance 11100 */ 11101 SFMMU_STAT(sf_hblk_reserve_cnt); 11102 owner = 1; 11103 mutex_enter(&hblk_reserve_lock); 11104 hmeblkp = HBLK_RESERVE; 11105 hblk_reserve_thread = curthread; 11106 } 11107 } 11108 11109 hblk_verify: 11110 ASSERT(hmeblkp != NULL); 11111 set_hblk_sz(hmeblkp, size); 11112 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp)); 11113 SFMMU_HASH_LOCK(hmebp); 11114 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp); 11115 if (newhblkp != NULL) { 11116 SFMMU_HASH_UNLOCK(hmebp); 11117 if (hmeblkp != HBLK_RESERVE) { 11118 /* 11119 * This is really tricky! 11120 * 11121 * vmem_alloc(vmem_seg_arena) 11122 * vmem_alloc(vmem_internal_arena) 11123 * segkmem_alloc(heap_arena) 11124 * vmem_alloc(heap_arena) 11125 * page_create() 11126 * hat_memload() 11127 * kmem_cache_free() 11128 * kmem_cache_alloc() 11129 * kmem_slab_create() 11130 * vmem_alloc(kmem_internal_arena) 11131 * segkmem_alloc(heap_arena) 11132 * vmem_alloc(heap_arena) 11133 * page_create() 11134 * hat_memload() 11135 * kmem_cache_free() 11136 * ... 11137 * 11138 * Thus, hat_memload() could call kmem_cache_free 11139 * for enough number of times that we could easily 11140 * hit the bottom of the stack or run out of reserve 11141 * list of vmem_seg structs. So, we must donate 11142 * this hblk to reserve list if it's allocated 11143 * from sfmmu8_cache *and* mapping kernel range. 11144 * We don't need to worry about freeing hmeblk1's 11145 * to kmem since they don't map any kmem slabs. 11146 * 11147 * Note: When segkmem supports largepages, we must 11148 * free hmeblk1's to reserve list as well. 11149 */ 11150 forcefree = (sfmmup == KHATID) ? 1 : 0; 11151 if (size == TTE8K && 11152 sfmmu_put_free_hblk(hmeblkp, forcefree)) { 11153 goto re_verify; 11154 } 11155 ASSERT(sfmmup != KHATID); 11156 kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp); 11157 } else { 11158 /* 11159 * Hey! we don't need hblk_reserve any more. 11160 */ 11161 ASSERT(owner); 11162 hblk_reserve_thread = NULL; 11163 mutex_exit(&hblk_reserve_lock); 11164 owner = 0; 11165 } 11166 re_verify: 11167 /* 11168 * let's check if the goodies are still present 11169 */ 11170 SFMMU_HASH_LOCK(hmebp); 11171 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp); 11172 if (newhblkp != NULL) { 11173 /* 11174 * return newhblkp if it's not hblk_reserve; 11175 * if newhblkp is hblk_reserve, return it 11176 * _only if_ we are the owner of hblk_reserve. 11177 */ 11178 if (newhblkp != HBLK_RESERVE || owner) { 11179 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || 11180 newhblkp->hblk_shared); 11181 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || 11182 !newhblkp->hblk_shared); 11183 return (newhblkp); 11184 } else { 11185 /* 11186 * we just hit hblk_reserve in the hash and 11187 * we are not the owner of that; 11188 * 11189 * block until hblk_reserve_thread completes 11190 * swapping hblk_reserve and try the dance 11191 * once again. 11192 */ 11193 SFMMU_HASH_UNLOCK(hmebp); 11194 mutex_enter(&hblk_reserve_lock); 11195 mutex_exit(&hblk_reserve_lock); 11196 SFMMU_STAT(sf_hblk_reserve_hit); 11197 goto fill_hblk; 11198 } 11199 } else { 11200 /* 11201 * it's no more! try the dance once again. 11202 */ 11203 SFMMU_HASH_UNLOCK(hmebp); 11204 goto fill_hblk; 11205 } 11206 } 11207 11208 hblk_init: 11209 if (SFMMU_IS_SHMERID_VALID(rid)) { 11210 uint16_t tteflag = 0x1 << 11211 ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size); 11212 11213 if (!(rgnp->rgn_hmeflags & tteflag)) { 11214 atomic_or_16(&rgnp->rgn_hmeflags, tteflag); 11215 } 11216 hmeblkp->hblk_shared = 1; 11217 } else { 11218 hmeblkp->hblk_shared = 0; 11219 } 11220 set_hblk_sz(hmeblkp, size); 11221 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 11222 hmeblkp->hblk_next = (struct hme_blk *)NULL; 11223 hmeblkp->hblk_tag = hblktag; 11224 hmeblkp->hblk_shadow = shw_hblkp; 11225 hblkpa = hmeblkp->hblk_nextpa; 11226 hmeblkp->hblk_nextpa = HMEBLK_ENDPA; 11227 11228 ASSERT(get_hblk_ttesz(hmeblkp) == size); 11229 ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size)); 11230 ASSERT(hmeblkp->hblk_hmecnt == 0); 11231 ASSERT(hmeblkp->hblk_vcnt == 0); 11232 ASSERT(hmeblkp->hblk_lckcnt == 0); 11233 ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp)); 11234 sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa); 11235 return (hmeblkp); 11236 } 11237 11238 /* 11239 * This function cleans up the hme_blk and returns it to the free list. 11240 */ 11241 /* ARGSUSED */ 11242 static void 11243 sfmmu_hblk_free(struct hme_blk **listp) 11244 { 11245 struct hme_blk *hmeblkp, *next_hmeblkp; 11246 int size; 11247 uint_t critical; 11248 uint64_t hblkpa; 11249 11250 ASSERT(*listp != NULL); 11251 11252 hmeblkp = *listp; 11253 while (hmeblkp != NULL) { 11254 next_hmeblkp = hmeblkp->hblk_next; 11255 ASSERT(!hmeblkp->hblk_hmecnt); 11256 ASSERT(!hmeblkp->hblk_vcnt); 11257 ASSERT(!hmeblkp->hblk_lckcnt); 11258 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve); 11259 ASSERT(hmeblkp->hblk_shared == 0); 11260 ASSERT(hmeblkp->hblk_shw_bit == 0); 11261 ASSERT(hmeblkp->hblk_shadow == NULL); 11262 11263 hblkpa = va_to_pa((caddr_t)hmeblkp); 11264 ASSERT(hblkpa != (uint64_t)-1); 11265 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0; 11266 11267 size = get_hblk_ttesz(hmeblkp); 11268 hmeblkp->hblk_next = NULL; 11269 hmeblkp->hblk_nextpa = hblkpa; 11270 11271 if (hmeblkp->hblk_nuc_bit == 0) { 11272 11273 if (size != TTE8K || 11274 !sfmmu_put_free_hblk(hmeblkp, critical)) 11275 kmem_cache_free(get_hblk_cache(hmeblkp), 11276 hmeblkp); 11277 } 11278 hmeblkp = next_hmeblkp; 11279 } 11280 } 11281 11282 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30 11283 #define SFMMU_HBLK_STEAL_THRESHOLD 5 11284 11285 static uint_t sfmmu_hblk_steal_twice; 11286 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count; 11287 11288 /* 11289 * Steal a hmeblk from user or kernel hme hash lists. 11290 * For 8K tte grab one from reserve pool (freehblkp) before proceeding to 11291 * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts 11292 * tap into critical reserve of freehblkp. 11293 * Note: We remain looping in this routine until we find one. 11294 */ 11295 static struct hme_blk * 11296 sfmmu_hblk_steal(int size) 11297 { 11298 static struct hmehash_bucket *uhmehash_steal_hand = NULL; 11299 struct hmehash_bucket *hmebp; 11300 struct hme_blk *hmeblkp = NULL, *pr_hblk; 11301 uint64_t hblkpa; 11302 int i; 11303 uint_t loop_cnt = 0, critical; 11304 11305 for (;;) { 11306 /* Check cpu hblk pending queues */ 11307 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) { 11308 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp); 11309 ASSERT(hmeblkp->hblk_hmecnt == 0); 11310 ASSERT(hmeblkp->hblk_vcnt == 0); 11311 return (hmeblkp); 11312 } 11313 11314 if (size == TTE8K) { 11315 critical = 11316 (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0; 11317 if (sfmmu_get_free_hblk(&hmeblkp, critical)) 11318 return (hmeblkp); 11319 } 11320 11321 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash : 11322 uhmehash_steal_hand; 11323 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]); 11324 11325 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ + 11326 BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) { 11327 SFMMU_HASH_LOCK(hmebp); 11328 hmeblkp = hmebp->hmeblkp; 11329 hblkpa = hmebp->hmeh_nextpa; 11330 pr_hblk = NULL; 11331 while (hmeblkp) { 11332 /* 11333 * check if it is a hmeblk that is not locked 11334 * and not shared. skip shadow hmeblks with 11335 * shadow_mask set i.e valid count non zero. 11336 */ 11337 if ((get_hblk_ttesz(hmeblkp) == size) && 11338 (hmeblkp->hblk_shw_bit == 0 || 11339 hmeblkp->hblk_vcnt == 0) && 11340 (hmeblkp->hblk_lckcnt == 0)) { 11341 /* 11342 * there is a high probability that we 11343 * will find a free one. search some 11344 * buckets for a free hmeblk initially 11345 * before unloading a valid hmeblk. 11346 */ 11347 if ((hmeblkp->hblk_vcnt == 0 && 11348 hmeblkp->hblk_hmecnt == 0) || (i >= 11349 BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) { 11350 if (sfmmu_steal_this_hblk(hmebp, 11351 hmeblkp, hblkpa, pr_hblk)) { 11352 /* 11353 * Hblk is unloaded 11354 * successfully 11355 */ 11356 break; 11357 } 11358 } 11359 } 11360 pr_hblk = hmeblkp; 11361 hblkpa = hmeblkp->hblk_nextpa; 11362 hmeblkp = hmeblkp->hblk_next; 11363 } 11364 11365 SFMMU_HASH_UNLOCK(hmebp); 11366 if (hmebp++ == &uhme_hash[UHMEHASH_SZ]) 11367 hmebp = uhme_hash; 11368 } 11369 uhmehash_steal_hand = hmebp; 11370 11371 if (hmeblkp != NULL) 11372 break; 11373 11374 /* 11375 * in the worst case, look for a free one in the kernel 11376 * hash table. 11377 */ 11378 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) { 11379 SFMMU_HASH_LOCK(hmebp); 11380 hmeblkp = hmebp->hmeblkp; 11381 hblkpa = hmebp->hmeh_nextpa; 11382 pr_hblk = NULL; 11383 while (hmeblkp) { 11384 /* 11385 * check if it is free hmeblk 11386 */ 11387 if ((get_hblk_ttesz(hmeblkp) == size) && 11388 (hmeblkp->hblk_lckcnt == 0) && 11389 (hmeblkp->hblk_vcnt == 0) && 11390 (hmeblkp->hblk_hmecnt == 0)) { 11391 if (sfmmu_steal_this_hblk(hmebp, 11392 hmeblkp, hblkpa, pr_hblk)) { 11393 break; 11394 } else { 11395 /* 11396 * Cannot fail since we have 11397 * hash lock. 11398 */ 11399 panic("fail to steal?"); 11400 } 11401 } 11402 11403 pr_hblk = hmeblkp; 11404 hblkpa = hmeblkp->hblk_nextpa; 11405 hmeblkp = hmeblkp->hblk_next; 11406 } 11407 11408 SFMMU_HASH_UNLOCK(hmebp); 11409 if (hmebp++ == &khme_hash[KHMEHASH_SZ]) 11410 hmebp = khme_hash; 11411 } 11412 11413 if (hmeblkp != NULL) 11414 break; 11415 sfmmu_hblk_steal_twice++; 11416 } 11417 return (hmeblkp); 11418 } 11419 11420 /* 11421 * This routine does real work to prepare a hblk to be "stolen" by 11422 * unloading the mappings, updating shadow counts .... 11423 * It returns 1 if the block is ready to be reused (stolen), or 0 11424 * means the block cannot be stolen yet- pageunload is still working 11425 * on this hblk. 11426 */ 11427 static int 11428 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 11429 uint64_t hblkpa, struct hme_blk *pr_hblk) 11430 { 11431 int shw_size, vshift; 11432 struct hme_blk *shw_hblkp; 11433 caddr_t vaddr; 11434 uint_t shw_mask, newshw_mask; 11435 struct hme_blk *list = NULL; 11436 11437 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 11438 11439 /* 11440 * check if the hmeblk is free, unload if necessary 11441 */ 11442 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 11443 sfmmu_t *sfmmup; 11444 demap_range_t dmr; 11445 11446 sfmmup = hblktosfmmu(hmeblkp); 11447 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) { 11448 return (0); 11449 } 11450 DEMAP_RANGE_INIT(sfmmup, &dmr); 11451 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 11452 (caddr_t)get_hblk_base(hmeblkp), 11453 get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD); 11454 DEMAP_RANGE_FLUSH(&dmr); 11455 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 11456 /* 11457 * Pageunload is working on the same hblk. 11458 */ 11459 return (0); 11460 } 11461 11462 sfmmu_hblk_steal_unload_count++; 11463 } 11464 11465 ASSERT(hmeblkp->hblk_lckcnt == 0); 11466 ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0); 11467 11468 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1); 11469 hmeblkp->hblk_nextpa = hblkpa; 11470 11471 shw_hblkp = hmeblkp->hblk_shadow; 11472 if (shw_hblkp) { 11473 ASSERT(!hmeblkp->hblk_shared); 11474 shw_size = get_hblk_ttesz(shw_hblkp); 11475 vaddr = (caddr_t)get_hblk_base(hmeblkp); 11476 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size); 11477 ASSERT(vshift < 8); 11478 /* 11479 * Atomically clear shadow mask bit 11480 */ 11481 do { 11482 shw_mask = shw_hblkp->hblk_shw_mask; 11483 ASSERT(shw_mask & (1 << vshift)); 11484 newshw_mask = shw_mask & ~(1 << vshift); 11485 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask, 11486 shw_mask, newshw_mask); 11487 } while (newshw_mask != shw_mask); 11488 hmeblkp->hblk_shadow = NULL; 11489 } 11490 11491 /* 11492 * remove shadow bit if we are stealing an unused shadow hmeblk. 11493 * sfmmu_hblk_alloc needs it that way, will set shadow bit later if 11494 * we are indeed allocating a shadow hmeblk. 11495 */ 11496 hmeblkp->hblk_shw_bit = 0; 11497 11498 if (hmeblkp->hblk_shared) { 11499 sf_srd_t *srdp; 11500 sf_region_t *rgnp; 11501 uint_t rid; 11502 11503 srdp = hblktosrd(hmeblkp); 11504 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 11505 rid = hmeblkp->hblk_tag.htag_rid; 11506 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 11507 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 11508 rgnp = srdp->srd_hmergnp[rid]; 11509 ASSERT(rgnp != NULL); 11510 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 11511 hmeblkp->hblk_shared = 0; 11512 } 11513 11514 sfmmu_hblk_steal_count++; 11515 SFMMU_STAT(sf_steal_count); 11516 11517 return (1); 11518 } 11519 11520 struct hme_blk * 11521 sfmmu_hmetohblk(struct sf_hment *sfhme) 11522 { 11523 struct hme_blk *hmeblkp; 11524 struct sf_hment *sfhme0; 11525 struct hme_blk *hblk_dummy = 0; 11526 11527 /* 11528 * No dummy sf_hments, please. 11529 */ 11530 ASSERT(sfhme->hme_tte.ll != 0); 11531 11532 sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum; 11533 hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 - 11534 (uintptr_t)&hblk_dummy->hblk_hme[0]); 11535 11536 return (hmeblkp); 11537 } 11538 11539 /* 11540 * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag. 11541 * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using 11542 * KM_SLEEP allocation. 11543 * 11544 * Return 0 on success, -1 otherwise. 11545 */ 11546 static void 11547 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp) 11548 { 11549 struct tsb_info *tsbinfop, *next; 11550 tsb_replace_rc_t rc; 11551 boolean_t gotfirst = B_FALSE; 11552 11553 ASSERT(sfmmup != ksfmmup); 11554 ASSERT(sfmmu_hat_lock_held(sfmmup)); 11555 11556 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) { 11557 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp)); 11558 } 11559 11560 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 11561 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN); 11562 } else { 11563 return; 11564 } 11565 11566 ASSERT(sfmmup->sfmmu_tsb != NULL); 11567 11568 /* 11569 * Loop over all tsbinfo's replacing them with ones that actually have 11570 * a TSB. If any of the replacements ever fail, bail out of the loop. 11571 */ 11572 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) { 11573 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED); 11574 next = tsbinfop->tsb_next; 11575 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc, 11576 hatlockp, TSB_SWAPIN); 11577 if (rc != TSB_SUCCESS) { 11578 break; 11579 } 11580 gotfirst = B_TRUE; 11581 } 11582 11583 switch (rc) { 11584 case TSB_SUCCESS: 11585 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN); 11586 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 11587 return; 11588 case TSB_LOSTRACE: 11589 break; 11590 case TSB_ALLOCFAIL: 11591 break; 11592 default: 11593 panic("sfmmu_replace_tsb returned unrecognized failure code " 11594 "%d", rc); 11595 } 11596 11597 /* 11598 * In this case, we failed to get one of our TSBs. If we failed to 11599 * get the first TSB, get one of minimum size (8KB). Walk the list 11600 * and throw away the tsbinfos, starting where the allocation failed; 11601 * we can get by with just one TSB as long as we don't leave the 11602 * SWAPPED tsbinfo structures lying around. 11603 */ 11604 tsbinfop = sfmmup->sfmmu_tsb; 11605 next = tsbinfop->tsb_next; 11606 tsbinfop->tsb_next = NULL; 11607 11608 sfmmu_hat_exit(hatlockp); 11609 for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) { 11610 next = tsbinfop->tsb_next; 11611 sfmmu_tsbinfo_free(tsbinfop); 11612 } 11613 hatlockp = sfmmu_hat_enter(sfmmup); 11614 11615 /* 11616 * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K 11617 * pages. 11618 */ 11619 if (!gotfirst) { 11620 tsbinfop = sfmmup->sfmmu_tsb; 11621 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE, 11622 hatlockp, TSB_SWAPIN | TSB_FORCEALLOC); 11623 ASSERT(rc == TSB_SUCCESS); 11624 } 11625 11626 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN); 11627 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 11628 } 11629 11630 static int 11631 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw) 11632 { 11633 ulong_t bix = 0; 11634 uint_t rid; 11635 sf_region_t *rgnp; 11636 11637 ASSERT(srdp != NULL); 11638 ASSERT(srdp->srd_refcnt != 0); 11639 11640 w <<= BT_ULSHIFT; 11641 while (bmw) { 11642 if (!(bmw & 0x1)) { 11643 bix++; 11644 bmw >>= 1; 11645 continue; 11646 } 11647 rid = w | bix; 11648 rgnp = srdp->srd_hmergnp[rid]; 11649 ASSERT(rgnp->rgn_refcnt > 0); 11650 ASSERT(rgnp->rgn_id == rid); 11651 if (addr < rgnp->rgn_saddr || 11652 addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) { 11653 bix++; 11654 bmw >>= 1; 11655 } else { 11656 return (1); 11657 } 11658 } 11659 return (0); 11660 } 11661 11662 /* 11663 * Handle exceptions for low level tsb_handler. 11664 * 11665 * There are many scenarios that could land us here: 11666 * 11667 * If the context is invalid we land here. The context can be invalid 11668 * for 3 reasons: 1) we couldn't allocate a new context and now need to 11669 * perform a wrap around operation in order to allocate a new context. 11670 * 2) Context was invalidated to change pagesize programming 3) ISMs or 11671 * TSBs configuration is changeing for this process and we are forced into 11672 * here to do a syncronization operation. If the context is valid we can 11673 * be here from window trap hanlder. In this case just call trap to handle 11674 * the fault. 11675 * 11676 * Note that the process will run in INVALID_CONTEXT before 11677 * faulting into here and subsequently loading the MMU registers 11678 * (including the TSB base register) associated with this process. 11679 * For this reason, the trap handlers must all test for 11680 * INVALID_CONTEXT before attempting to access any registers other 11681 * than the context registers. 11682 */ 11683 void 11684 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype) 11685 { 11686 sfmmu_t *sfmmup, *shsfmmup; 11687 uint_t ctxtype; 11688 klwp_id_t lwp; 11689 char lwp_save_state; 11690 hatlock_t *hatlockp, *shatlockp; 11691 struct tsb_info *tsbinfop; 11692 struct tsbmiss *tsbmp; 11693 sf_scd_t *scdp; 11694 11695 SFMMU_STAT(sf_tsb_exceptions); 11696 SFMMU_MMU_STAT(mmu_tsb_exceptions); 11697 sfmmup = astosfmmu(curthread->t_procp->p_as); 11698 /* 11699 * note that in sun4u, tagacces register contains ctxnum 11700 * while sun4v passes ctxtype in the tagaccess register. 11701 */ 11702 ctxtype = tagaccess & TAGACC_CTX_MASK; 11703 11704 ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT); 11705 ASSERT(sfmmup->sfmmu_ismhat == 0); 11706 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) || 11707 ctxtype == INVALID_CONTEXT); 11708 11709 if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) { 11710 /* 11711 * We may land here because shme bitmap and pagesize 11712 * flags are updated lazily in tsbmiss area on other cpus. 11713 * If we detect here that tsbmiss area is out of sync with 11714 * sfmmu update it and retry the trapped instruction. 11715 * Otherwise call trap(). 11716 */ 11717 int ret = 0; 11718 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K); 11719 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK); 11720 11721 /* 11722 * Must set lwp state to LWP_SYS before 11723 * trying to acquire any adaptive lock 11724 */ 11725 lwp = ttolwp(curthread); 11726 ASSERT(lwp); 11727 lwp_save_state = lwp->lwp_state; 11728 lwp->lwp_state = LWP_SYS; 11729 11730 hatlockp = sfmmu_hat_enter(sfmmup); 11731 kpreempt_disable(); 11732 tsbmp = &tsbmiss_area[CPU->cpu_id]; 11733 ASSERT(sfmmup == tsbmp->usfmmup); 11734 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) & 11735 ~tteflag_mask) || 11736 ((tsbmp->uhat_rtteflags ^ sfmmup->sfmmu_rtteflags) & 11737 ~tteflag_mask)) { 11738 tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags; 11739 tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags; 11740 ret = 1; 11741 } 11742 if (sfmmup->sfmmu_srdp != NULL) { 11743 ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap; 11744 ulong_t *tm = tsbmp->shmermap; 11745 ulong_t i; 11746 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 11747 ulong_t d = tm[i] ^ sm[i]; 11748 if (d) { 11749 if (d & sm[i]) { 11750 if (!ret && sfmmu_is_rgnva( 11751 sfmmup->sfmmu_srdp, 11752 addr, i, d & sm[i])) { 11753 ret = 1; 11754 } 11755 } 11756 tm[i] = sm[i]; 11757 } 11758 } 11759 } 11760 kpreempt_enable(); 11761 sfmmu_hat_exit(hatlockp); 11762 lwp->lwp_state = lwp_save_state; 11763 if (ret) { 11764 return; 11765 } 11766 } else if (ctxtype == INVALID_CONTEXT) { 11767 /* 11768 * First, make sure we come out of here with a valid ctx, 11769 * since if we don't get one we'll simply loop on the 11770 * faulting instruction. 11771 * 11772 * If the ISM mappings are changing, the TSB is relocated, 11773 * the process is swapped, the process is joining SCD or 11774 * leaving SCD or shared regions we serialize behind the 11775 * controlling thread with hat lock, sfmmu_flags and 11776 * sfmmu_tsb_cv condition variable. 11777 */ 11778 11779 /* 11780 * Must set lwp state to LWP_SYS before 11781 * trying to acquire any adaptive lock 11782 */ 11783 lwp = ttolwp(curthread); 11784 ASSERT(lwp); 11785 lwp_save_state = lwp->lwp_state; 11786 lwp->lwp_state = LWP_SYS; 11787 11788 hatlockp = sfmmu_hat_enter(sfmmup); 11789 retry: 11790 if ((scdp = sfmmup->sfmmu_scdp) != NULL) { 11791 shsfmmup = scdp->scd_sfmmup; 11792 ASSERT(shsfmmup != NULL); 11793 11794 for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL; 11795 tsbinfop = tsbinfop->tsb_next) { 11796 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) { 11797 /* drop the private hat lock */ 11798 sfmmu_hat_exit(hatlockp); 11799 /* acquire the shared hat lock */ 11800 shatlockp = sfmmu_hat_enter(shsfmmup); 11801 /* 11802 * recheck to see if anything changed 11803 * after we drop the private hat lock. 11804 */ 11805 if (sfmmup->sfmmu_scdp == scdp && 11806 shsfmmup == scdp->scd_sfmmup) { 11807 sfmmu_tsb_chk_reloc(shsfmmup, 11808 shatlockp); 11809 } 11810 sfmmu_hat_exit(shatlockp); 11811 hatlockp = sfmmu_hat_enter(sfmmup); 11812 goto retry; 11813 } 11814 } 11815 } 11816 11817 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 11818 tsbinfop = tsbinfop->tsb_next) { 11819 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) { 11820 cv_wait(&sfmmup->sfmmu_tsb_cv, 11821 HATLOCK_MUTEXP(hatlockp)); 11822 goto retry; 11823 } 11824 } 11825 11826 /* 11827 * Wait for ISM maps to be updated. 11828 */ 11829 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) { 11830 cv_wait(&sfmmup->sfmmu_tsb_cv, 11831 HATLOCK_MUTEXP(hatlockp)); 11832 goto retry; 11833 } 11834 11835 /* Is this process joining an SCD? */ 11836 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 11837 /* 11838 * Flush private TSB and setup shared TSB. 11839 * sfmmu_finish_join_scd() does not drop the 11840 * hat lock. 11841 */ 11842 sfmmu_finish_join_scd(sfmmup); 11843 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD); 11844 } 11845 11846 /* 11847 * If we're swapping in, get TSB(s). Note that we must do 11848 * this before we get a ctx or load the MMU state. Once 11849 * we swap in we have to recheck to make sure the TSB(s) and 11850 * ISM mappings didn't change while we slept. 11851 */ 11852 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 11853 sfmmu_tsb_swapin(sfmmup, hatlockp); 11854 goto retry; 11855 } 11856 11857 sfmmu_get_ctx(sfmmup); 11858 11859 sfmmu_hat_exit(hatlockp); 11860 /* 11861 * Must restore lwp_state if not calling 11862 * trap() for further processing. Restore 11863 * it anyway. 11864 */ 11865 lwp->lwp_state = lwp_save_state; 11866 return; 11867 } 11868 trap(rp, (caddr_t)tagaccess, traptype, 0); 11869 } 11870 11871 static void 11872 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp) 11873 { 11874 struct tsb_info *tp; 11875 11876 ASSERT(sfmmu_hat_lock_held(sfmmup)); 11877 11878 for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) { 11879 if (tp->tsb_flags & TSB_RELOC_FLAG) { 11880 cv_wait(&sfmmup->sfmmu_tsb_cv, 11881 HATLOCK_MUTEXP(hatlockp)); 11882 break; 11883 } 11884 } 11885 } 11886 11887 /* 11888 * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and 11889 * TTE_SUSPENDED bit set in tte we block on aquiring a page lock 11890 * rather than spinning to avoid send mondo timeouts with 11891 * interrupts enabled. When the lock is acquired it is immediately 11892 * released and we return back to sfmmu_vatopfn just after 11893 * the GET_TTE call. 11894 */ 11895 void 11896 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep) 11897 { 11898 struct page **pp; 11899 11900 (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE); 11901 as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE); 11902 } 11903 11904 /* 11905 * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and 11906 * TTE_SUSPENDED bit set in tte. We do this so that we can handle 11907 * cross traps which cannot be handled while spinning in the 11908 * trap handlers. Simply enter and exit the kpr_suspendlock spin 11909 * mutex, which is held by the holder of the suspend bit, and then 11910 * retry the trapped instruction after unwinding. 11911 */ 11912 /*ARGSUSED*/ 11913 void 11914 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype) 11915 { 11916 ASSERT(curthread != kreloc_thread); 11917 mutex_enter(&kpr_suspendlock); 11918 mutex_exit(&kpr_suspendlock); 11919 } 11920 11921 /* 11922 * This routine could be optimized to reduce the number of xcalls by flushing 11923 * the entire TLBs if region reference count is above some threshold but the 11924 * tradeoff will depend on the size of the TLB. So for now flush the specific 11925 * page a context at a time. 11926 * 11927 * If uselocks is 0 then it's called after all cpus were captured and all the 11928 * hat locks were taken. In this case don't take the region lock by relying on 11929 * the order of list region update operations in hat_join_region(), 11930 * hat_leave_region() and hat_dup_region(). The ordering in those routines 11931 * guarantees that list is always forward walkable and reaches active sfmmus 11932 * regardless of where xc_attention() captures a cpu. 11933 */ 11934 cpuset_t 11935 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp, 11936 struct hme_blk *hmeblkp, int uselocks) 11937 { 11938 sfmmu_t *sfmmup; 11939 cpuset_t cpuset; 11940 cpuset_t rcpuset; 11941 hatlock_t *hatlockp; 11942 uint_t rid = rgnp->rgn_id; 11943 sf_rgn_link_t *rlink; 11944 sf_scd_t *scdp; 11945 11946 ASSERT(hmeblkp->hblk_shared); 11947 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 11948 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 11949 11950 CPUSET_ZERO(rcpuset); 11951 if (uselocks) { 11952 mutex_enter(&rgnp->rgn_mutex); 11953 } 11954 sfmmup = rgnp->rgn_sfmmu_head; 11955 while (sfmmup != NULL) { 11956 if (uselocks) { 11957 hatlockp = sfmmu_hat_enter(sfmmup); 11958 } 11959 11960 /* 11961 * When an SCD is created the SCD hat is linked on the sfmmu 11962 * region lists for each hme region which is part of the 11963 * SCD. If we find an SCD hat, when walking these lists, 11964 * then we flush the shared TSBs, if we find a private hat, 11965 * which is part of an SCD, but where the region 11966 * is not part of the SCD then we flush the private TSBs. 11967 */ 11968 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL && 11969 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 11970 scdp = sfmmup->sfmmu_scdp; 11971 if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 11972 if (uselocks) { 11973 sfmmu_hat_exit(hatlockp); 11974 } 11975 goto next; 11976 } 11977 } 11978 11979 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 11980 11981 kpreempt_disable(); 11982 cpuset = sfmmup->sfmmu_cpusran; 11983 CPUSET_AND(cpuset, cpu_ready_set); 11984 CPUSET_DEL(cpuset, CPU->cpu_id); 11985 SFMMU_XCALL_STATS(sfmmup); 11986 xt_some(cpuset, vtag_flushpage_tl1, 11987 (uint64_t)addr, (uint64_t)sfmmup); 11988 vtag_flushpage(addr, (uint64_t)sfmmup); 11989 if (uselocks) { 11990 sfmmu_hat_exit(hatlockp); 11991 } 11992 kpreempt_enable(); 11993 CPUSET_OR(rcpuset, cpuset); 11994 11995 next: 11996 /* LINTED: constant in conditional context */ 11997 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0); 11998 ASSERT(rlink != NULL); 11999 sfmmup = rlink->next; 12000 } 12001 if (uselocks) { 12002 mutex_exit(&rgnp->rgn_mutex); 12003 } 12004 return (rcpuset); 12005 } 12006 12007 /* 12008 * This routine takes an sfmmu pointer and the va for an adddress in an 12009 * ISM region as input and returns the corresponding region id in ism_rid. 12010 * The return value of 1 indicates that a region has been found and ism_rid 12011 * is valid, otherwise 0 is returned. 12012 */ 12013 static int 12014 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid) 12015 { 12016 ism_blk_t *ism_blkp; 12017 int i; 12018 ism_map_t *ism_map; 12019 #ifdef DEBUG 12020 struct hat *ism_hatid; 12021 #endif 12022 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12023 12024 ism_blkp = sfmmup->sfmmu_iblk; 12025 while (ism_blkp != NULL) { 12026 ism_map = ism_blkp->iblk_maps; 12027 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) { 12028 if ((va >= ism_start(ism_map[i])) && 12029 (va < ism_end(ism_map[i]))) { 12030 12031 *ism_rid = ism_map[i].imap_rid; 12032 #ifdef DEBUG 12033 ism_hatid = ism_map[i].imap_ismhat; 12034 ASSERT(ism_hatid == ism_sfmmup); 12035 ASSERT(ism_hatid->sfmmu_ismhat); 12036 #endif 12037 return (1); 12038 } 12039 } 12040 ism_blkp = ism_blkp->iblk_next; 12041 } 12042 return (0); 12043 } 12044 12045 /* 12046 * Special routine to flush out ism mappings- TSBs, TLBs and D-caches. 12047 * This routine may be called with all cpu's captured. Therefore, the 12048 * caller is responsible for holding all locks and disabling kernel 12049 * preemption. 12050 */ 12051 /* ARGSUSED */ 12052 static void 12053 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup, 12054 struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag) 12055 { 12056 cpuset_t cpuset; 12057 caddr_t va; 12058 ism_ment_t *ment; 12059 sfmmu_t *sfmmup; 12060 #ifdef VAC 12061 int vcolor; 12062 #endif 12063 12064 sf_scd_t *scdp; 12065 uint_t ism_rid; 12066 12067 ASSERT(!hmeblkp->hblk_shared); 12068 /* 12069 * Walk the ism_hat's mapping list and flush the page 12070 * from every hat sharing this ism_hat. This routine 12071 * may be called while all cpu's have been captured. 12072 * Therefore we can't attempt to grab any locks. For now 12073 * this means we will protect the ism mapping list under 12074 * a single lock which will be grabbed by the caller. 12075 * If hat_share/unshare scalibility becomes a performance 12076 * problem then we may need to re-think ism mapping list locking. 12077 */ 12078 ASSERT(ism_sfmmup->sfmmu_ismhat); 12079 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 12080 addr = addr - ISMID_STARTADDR; 12081 12082 for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) { 12083 12084 sfmmup = ment->iment_hat; 12085 12086 va = ment->iment_base_va; 12087 va = (caddr_t)((uintptr_t)va + (uintptr_t)addr); 12088 12089 /* 12090 * When an SCD is created the SCD hat is linked on the ism 12091 * mapping lists for each ISM segment which is part of the 12092 * SCD. If we find an SCD hat, when walking these lists, 12093 * then we flush the shared TSBs, if we find a private hat, 12094 * which is part of an SCD, but where the region 12095 * corresponding to this va is not part of the SCD then we 12096 * flush the private TSBs. 12097 */ 12098 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL && 12099 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) && 12100 !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) { 12101 if (!find_ism_rid(sfmmup, ism_sfmmup, va, 12102 &ism_rid)) { 12103 cmn_err(CE_PANIC, 12104 "can't find matching ISM rid!"); 12105 } 12106 12107 scdp = sfmmup->sfmmu_scdp; 12108 if (SFMMU_IS_ISMRID_VALID(ism_rid) && 12109 SF_RGNMAP_TEST(scdp->scd_ismregion_map, 12110 ism_rid)) { 12111 continue; 12112 } 12113 } 12114 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1); 12115 12116 cpuset = sfmmup->sfmmu_cpusran; 12117 CPUSET_AND(cpuset, cpu_ready_set); 12118 CPUSET_DEL(cpuset, CPU->cpu_id); 12119 SFMMU_XCALL_STATS(sfmmup); 12120 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va, 12121 (uint64_t)sfmmup); 12122 vtag_flushpage(va, (uint64_t)sfmmup); 12123 12124 #ifdef VAC 12125 /* 12126 * Flush D$ 12127 * When flushing D$ we must flush all 12128 * cpu's. See sfmmu_cache_flush(). 12129 */ 12130 if (cache_flush_flag == CACHE_FLUSH) { 12131 cpuset = cpu_ready_set; 12132 CPUSET_DEL(cpuset, CPU->cpu_id); 12133 12134 SFMMU_XCALL_STATS(sfmmup); 12135 vcolor = addr_to_vcolor(va); 12136 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12137 vac_flushpage(pfnum, vcolor); 12138 } 12139 #endif /* VAC */ 12140 } 12141 } 12142 12143 /* 12144 * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of 12145 * a particular virtual address and ctx. If noflush is set we do not 12146 * flush the TLB/TSB. This function may or may not be called with the 12147 * HAT lock held. 12148 */ 12149 static void 12150 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 12151 pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag, 12152 int hat_lock_held) 12153 { 12154 #ifdef VAC 12155 int vcolor; 12156 #endif 12157 cpuset_t cpuset; 12158 hatlock_t *hatlockp; 12159 12160 ASSERT(!hmeblkp->hblk_shared); 12161 12162 #if defined(lint) && !defined(VAC) 12163 pfnum = pfnum; 12164 cpu_flag = cpu_flag; 12165 cache_flush_flag = cache_flush_flag; 12166 #endif 12167 12168 /* 12169 * There is no longer a need to protect against ctx being 12170 * stolen here since we don't store the ctx in the TSB anymore. 12171 */ 12172 #ifdef VAC 12173 vcolor = addr_to_vcolor(addr); 12174 #endif 12175 12176 /* 12177 * We must hold the hat lock during the flush of TLB, 12178 * to avoid a race with sfmmu_invalidate_ctx(), where 12179 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT, 12180 * causing TLB demap routine to skip flush on that MMU. 12181 * If the context on a MMU has already been set to 12182 * INVALID_CONTEXT, we just get an extra flush on 12183 * that MMU. 12184 */ 12185 if (!hat_lock_held && !tlb_noflush) 12186 hatlockp = sfmmu_hat_enter(sfmmup); 12187 12188 kpreempt_disable(); 12189 if (!tlb_noflush) { 12190 /* 12191 * Flush the TSB and TLB. 12192 */ 12193 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 12194 12195 cpuset = sfmmup->sfmmu_cpusran; 12196 CPUSET_AND(cpuset, cpu_ready_set); 12197 CPUSET_DEL(cpuset, CPU->cpu_id); 12198 12199 SFMMU_XCALL_STATS(sfmmup); 12200 12201 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, 12202 (uint64_t)sfmmup); 12203 12204 vtag_flushpage(addr, (uint64_t)sfmmup); 12205 } 12206 12207 if (!hat_lock_held && !tlb_noflush) 12208 sfmmu_hat_exit(hatlockp); 12209 12210 #ifdef VAC 12211 /* 12212 * Flush the D$ 12213 * 12214 * Even if the ctx is stolen, we need to flush the 12215 * cache. Our ctx stealer only flushes the TLBs. 12216 */ 12217 if (cache_flush_flag == CACHE_FLUSH) { 12218 if (cpu_flag & FLUSH_ALL_CPUS) { 12219 cpuset = cpu_ready_set; 12220 } else { 12221 cpuset = sfmmup->sfmmu_cpusran; 12222 CPUSET_AND(cpuset, cpu_ready_set); 12223 } 12224 CPUSET_DEL(cpuset, CPU->cpu_id); 12225 SFMMU_XCALL_STATS(sfmmup); 12226 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12227 vac_flushpage(pfnum, vcolor); 12228 } 12229 #endif /* VAC */ 12230 kpreempt_enable(); 12231 } 12232 12233 /* 12234 * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual 12235 * address and ctx. If noflush is set we do not currently do anything. 12236 * This function may or may not be called with the HAT lock held. 12237 */ 12238 static void 12239 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 12240 int tlb_noflush, int hat_lock_held) 12241 { 12242 cpuset_t cpuset; 12243 hatlock_t *hatlockp; 12244 12245 ASSERT(!hmeblkp->hblk_shared); 12246 12247 /* 12248 * If the process is exiting we have nothing to do. 12249 */ 12250 if (tlb_noflush) 12251 return; 12252 12253 /* 12254 * Flush TSB. 12255 */ 12256 if (!hat_lock_held) 12257 hatlockp = sfmmu_hat_enter(sfmmup); 12258 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 12259 12260 kpreempt_disable(); 12261 12262 cpuset = sfmmup->sfmmu_cpusran; 12263 CPUSET_AND(cpuset, cpu_ready_set); 12264 CPUSET_DEL(cpuset, CPU->cpu_id); 12265 12266 SFMMU_XCALL_STATS(sfmmup); 12267 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup); 12268 12269 vtag_flushpage(addr, (uint64_t)sfmmup); 12270 12271 if (!hat_lock_held) 12272 sfmmu_hat_exit(hatlockp); 12273 12274 kpreempt_enable(); 12275 12276 } 12277 12278 /* 12279 * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall 12280 * call handler that can flush a range of pages to save on xcalls. 12281 */ 12282 static int sfmmu_xcall_save; 12283 12284 /* 12285 * this routine is never used for demaping addresses backed by SRD hmeblks. 12286 */ 12287 static void 12288 sfmmu_tlb_range_demap(demap_range_t *dmrp) 12289 { 12290 sfmmu_t *sfmmup = dmrp->dmr_sfmmup; 12291 hatlock_t *hatlockp; 12292 cpuset_t cpuset; 12293 uint64_t sfmmu_pgcnt; 12294 pgcnt_t pgcnt = 0; 12295 int pgunload = 0; 12296 int dirtypg = 0; 12297 caddr_t addr = dmrp->dmr_addr; 12298 caddr_t eaddr; 12299 uint64_t bitvec = dmrp->dmr_bitvec; 12300 12301 ASSERT(bitvec & 1); 12302 12303 /* 12304 * Flush TSB and calculate number of pages to flush. 12305 */ 12306 while (bitvec != 0) { 12307 dirtypg = 0; 12308 /* 12309 * Find the first page to flush and then count how many 12310 * pages there are after it that also need to be flushed. 12311 * This way the number of TSB flushes is minimized. 12312 */ 12313 while ((bitvec & 1) == 0) { 12314 pgcnt++; 12315 addr += MMU_PAGESIZE; 12316 bitvec >>= 1; 12317 } 12318 while (bitvec & 1) { 12319 dirtypg++; 12320 bitvec >>= 1; 12321 } 12322 eaddr = addr + ptob(dirtypg); 12323 hatlockp = sfmmu_hat_enter(sfmmup); 12324 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K); 12325 sfmmu_hat_exit(hatlockp); 12326 pgunload += dirtypg; 12327 addr = eaddr; 12328 pgcnt += dirtypg; 12329 } 12330 12331 ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr); 12332 if (sfmmup->sfmmu_free == 0) { 12333 addr = dmrp->dmr_addr; 12334 bitvec = dmrp->dmr_bitvec; 12335 12336 /* 12337 * make sure it has SFMMU_PGCNT_SHIFT bits only, 12338 * as it will be used to pack argument for xt_some 12339 */ 12340 ASSERT((pgcnt > 0) && 12341 (pgcnt <= (1 << SFMMU_PGCNT_SHIFT))); 12342 12343 /* 12344 * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in 12345 * the low 6 bits of sfmmup. This is doable since pgcnt 12346 * always >= 1. 12347 */ 12348 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK)); 12349 sfmmu_pgcnt = (uint64_t)sfmmup | 12350 ((pgcnt - 1) & SFMMU_PGCNT_MASK); 12351 12352 /* 12353 * We must hold the hat lock during the flush of TLB, 12354 * to avoid a race with sfmmu_invalidate_ctx(), where 12355 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT, 12356 * causing TLB demap routine to skip flush on that MMU. 12357 * If the context on a MMU has already been set to 12358 * INVALID_CONTEXT, we just get an extra flush on 12359 * that MMU. 12360 */ 12361 hatlockp = sfmmu_hat_enter(sfmmup); 12362 kpreempt_disable(); 12363 12364 cpuset = sfmmup->sfmmu_cpusran; 12365 CPUSET_AND(cpuset, cpu_ready_set); 12366 CPUSET_DEL(cpuset, CPU->cpu_id); 12367 12368 SFMMU_XCALL_STATS(sfmmup); 12369 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr, 12370 sfmmu_pgcnt); 12371 12372 for (; bitvec != 0; bitvec >>= 1) { 12373 if (bitvec & 1) 12374 vtag_flushpage(addr, (uint64_t)sfmmup); 12375 addr += MMU_PAGESIZE; 12376 } 12377 kpreempt_enable(); 12378 sfmmu_hat_exit(hatlockp); 12379 12380 sfmmu_xcall_save += (pgunload-1); 12381 } 12382 dmrp->dmr_bitvec = 0; 12383 } 12384 12385 /* 12386 * In cases where we need to synchronize with TLB/TSB miss trap 12387 * handlers, _and_ need to flush the TLB, it's a lot easier to 12388 * throw away the context from the process than to do a 12389 * special song and dance to keep things consistent for the 12390 * handlers. 12391 * 12392 * Since the process suddenly ends up without a context and our caller 12393 * holds the hat lock, threads that fault after this function is called 12394 * will pile up on the lock. We can then do whatever we need to 12395 * atomically from the context of the caller. The first blocked thread 12396 * to resume executing will get the process a new context, and the 12397 * process will resume executing. 12398 * 12399 * One added advantage of this approach is that on MMUs that 12400 * support a "flush all" operation, we will delay the flush until 12401 * cnum wrap-around, and then flush the TLB one time. This 12402 * is rather rare, so it's a lot less expensive than making 8000 12403 * x-calls to flush the TLB 8000 times. 12404 * 12405 * A per-process (PP) lock is used to synchronize ctx allocations in 12406 * resume() and ctx invalidations here. 12407 */ 12408 static void 12409 sfmmu_invalidate_ctx(sfmmu_t *sfmmup) 12410 { 12411 cpuset_t cpuset; 12412 int cnum, currcnum; 12413 mmu_ctx_t *mmu_ctxp; 12414 int i; 12415 uint_t pstate_save; 12416 12417 SFMMU_STAT(sf_ctx_inv); 12418 12419 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12420 ASSERT(sfmmup != ksfmmup); 12421 12422 kpreempt_disable(); 12423 12424 mmu_ctxp = CPU_MMU_CTXP(CPU); 12425 ASSERT(mmu_ctxp); 12426 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms); 12427 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]); 12428 12429 currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum; 12430 12431 pstate_save = sfmmu_disable_intrs(); 12432 12433 lock_set(&sfmmup->sfmmu_ctx_lock); /* acquire PP lock */ 12434 /* set HAT cnum invalid across all context domains. */ 12435 for (i = 0; i < max_mmu_ctxdoms; i++) { 12436 12437 cnum = sfmmup->sfmmu_ctxs[i].cnum; 12438 if (cnum == INVALID_CONTEXT) { 12439 continue; 12440 } 12441 12442 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT; 12443 } 12444 membar_enter(); /* make sure globally visible to all CPUs */ 12445 lock_clear(&sfmmup->sfmmu_ctx_lock); /* release PP lock */ 12446 12447 sfmmu_enable_intrs(pstate_save); 12448 12449 cpuset = sfmmup->sfmmu_cpusran; 12450 CPUSET_DEL(cpuset, CPU->cpu_id); 12451 CPUSET_AND(cpuset, cpu_ready_set); 12452 if (!CPUSET_ISNULL(cpuset)) { 12453 SFMMU_XCALL_STATS(sfmmup); 12454 xt_some(cpuset, sfmmu_raise_tsb_exception, 12455 (uint64_t)sfmmup, INVALID_CONTEXT); 12456 xt_sync(cpuset); 12457 SFMMU_STAT(sf_tsb_raise_exception); 12458 SFMMU_MMU_STAT(mmu_tsb_raise_exception); 12459 } 12460 12461 /* 12462 * If the hat to-be-invalidated is the same as the current 12463 * process on local CPU we need to invalidate 12464 * this CPU context as well. 12465 */ 12466 if ((sfmmu_getctx_sec() == currcnum) && 12467 (currcnum != INVALID_CONTEXT)) { 12468 /* sets shared context to INVALID too */ 12469 sfmmu_setctx_sec(INVALID_CONTEXT); 12470 sfmmu_clear_utsbinfo(); 12471 } 12472 12473 SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID); 12474 12475 kpreempt_enable(); 12476 12477 /* 12478 * we hold the hat lock, so nobody should allocate a context 12479 * for us yet 12480 */ 12481 ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT); 12482 } 12483 12484 #ifdef VAC 12485 /* 12486 * We need to flush the cache in all cpus. It is possible that 12487 * a process referenced a page as cacheable but has sinced exited 12488 * and cleared the mapping list. We still to flush it but have no 12489 * state so all cpus is the only alternative. 12490 */ 12491 void 12492 sfmmu_cache_flush(pfn_t pfnum, int vcolor) 12493 { 12494 cpuset_t cpuset; 12495 12496 kpreempt_disable(); 12497 cpuset = cpu_ready_set; 12498 CPUSET_DEL(cpuset, CPU->cpu_id); 12499 SFMMU_XCALL_STATS(NULL); /* account to any ctx */ 12500 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12501 xt_sync(cpuset); 12502 vac_flushpage(pfnum, vcolor); 12503 kpreempt_enable(); 12504 } 12505 12506 void 12507 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum) 12508 { 12509 cpuset_t cpuset; 12510 12511 ASSERT(vcolor >= 0); 12512 12513 kpreempt_disable(); 12514 cpuset = cpu_ready_set; 12515 CPUSET_DEL(cpuset, CPU->cpu_id); 12516 SFMMU_XCALL_STATS(NULL); /* account to any ctx */ 12517 xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum); 12518 xt_sync(cpuset); 12519 vac_flushcolor(vcolor, pfnum); 12520 kpreempt_enable(); 12521 } 12522 #endif /* VAC */ 12523 12524 /* 12525 * We need to prevent processes from accessing the TSB using a cached physical 12526 * address. It's alright if they try to access the TSB via virtual address 12527 * since they will just fault on that virtual address once the mapping has 12528 * been suspended. 12529 */ 12530 #pragma weak sendmondo_in_recover 12531 12532 /* ARGSUSED */ 12533 static int 12534 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo) 12535 { 12536 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo; 12537 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu; 12538 hatlock_t *hatlockp; 12539 sf_scd_t *scdp; 12540 12541 if (flags != HAT_PRESUSPEND) 12542 return (0); 12543 12544 /* 12545 * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must 12546 * be a shared hat, then set SCD's tsbinfo's flag. 12547 * If tsb is not shared, sfmmup is a private hat, then set 12548 * its private tsbinfo's flag. 12549 */ 12550 hatlockp = sfmmu_hat_enter(sfmmup); 12551 tsbinfop->tsb_flags |= TSB_RELOC_FLAG; 12552 12553 if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) { 12554 sfmmu_tsb_inv_ctx(sfmmup); 12555 sfmmu_hat_exit(hatlockp); 12556 } else { 12557 /* release lock on the shared hat */ 12558 sfmmu_hat_exit(hatlockp); 12559 /* sfmmup is a shared hat */ 12560 ASSERT(sfmmup->sfmmu_scdhat); 12561 scdp = sfmmup->sfmmu_scdp; 12562 ASSERT(scdp != NULL); 12563 /* get private hat from the scd list */ 12564 mutex_enter(&scdp->scd_mutex); 12565 sfmmup = scdp->scd_sf_list; 12566 while (sfmmup != NULL) { 12567 hatlockp = sfmmu_hat_enter(sfmmup); 12568 /* 12569 * We do not call sfmmu_tsb_inv_ctx here because 12570 * sendmondo_in_recover check is only needed for 12571 * sun4u. 12572 */ 12573 sfmmu_invalidate_ctx(sfmmup); 12574 sfmmu_hat_exit(hatlockp); 12575 sfmmup = sfmmup->sfmmu_scd_link.next; 12576 12577 } 12578 mutex_exit(&scdp->scd_mutex); 12579 } 12580 return (0); 12581 } 12582 12583 static void 12584 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup) 12585 { 12586 extern uint32_t sendmondo_in_recover; 12587 12588 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12589 12590 /* 12591 * For Cheetah+ Erratum 25: 12592 * Wait for any active recovery to finish. We can't risk 12593 * relocating the TSB of the thread running mondo_recover_proc() 12594 * since, if we did that, we would deadlock. The scenario we are 12595 * trying to avoid is as follows: 12596 * 12597 * THIS CPU RECOVER CPU 12598 * -------- ----------- 12599 * Begins recovery, walking through TSB 12600 * hat_pagesuspend() TSB TTE 12601 * TLB miss on TSB TTE, spins at TL1 12602 * xt_sync() 12603 * send_mondo_timeout() 12604 * mondo_recover_proc() 12605 * ((deadlocked)) 12606 * 12607 * The second half of the workaround is that mondo_recover_proc() 12608 * checks to see if the tsb_info has the RELOC flag set, and if it 12609 * does, it skips over that TSB without ever touching tsbinfop->tsb_va 12610 * and hence avoiding the TLB miss that could result in a deadlock. 12611 */ 12612 if (&sendmondo_in_recover) { 12613 membar_enter(); /* make sure RELOC flag visible */ 12614 while (sendmondo_in_recover) { 12615 drv_usecwait(1); 12616 membar_consumer(); 12617 } 12618 } 12619 12620 sfmmu_invalidate_ctx(sfmmup); 12621 } 12622 12623 /* ARGSUSED */ 12624 static int 12625 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags, 12626 void *tsbinfo, pfn_t newpfn) 12627 { 12628 hatlock_t *hatlockp; 12629 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo; 12630 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu; 12631 12632 if (flags != HAT_POSTUNSUSPEND) 12633 return (0); 12634 12635 hatlockp = sfmmu_hat_enter(sfmmup); 12636 12637 SFMMU_STAT(sf_tsb_reloc); 12638 12639 /* 12640 * The process may have swapped out while we were relocating one 12641 * of its TSBs. If so, don't bother doing the setup since the 12642 * process can't be using the memory anymore. 12643 */ 12644 if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) { 12645 ASSERT(va == tsbinfop->tsb_va); 12646 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn); 12647 12648 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) { 12649 sfmmu_inv_tsb(tsbinfop->tsb_va, 12650 TSB_BYTES(tsbinfop->tsb_szc)); 12651 tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED; 12652 } 12653 } 12654 12655 membar_exit(); 12656 tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG; 12657 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 12658 12659 sfmmu_hat_exit(hatlockp); 12660 12661 return (0); 12662 } 12663 12664 /* 12665 * Allocate and initialize a tsb_info structure. Note that we may or may not 12666 * allocate a TSB here, depending on the flags passed in. 12667 */ 12668 static int 12669 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask, 12670 uint_t flags, sfmmu_t *sfmmup) 12671 { 12672 int err; 12673 12674 *tsbinfopp = (struct tsb_info *)kmem_cache_alloc( 12675 sfmmu_tsbinfo_cache, KM_SLEEP); 12676 12677 if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask, 12678 tsb_szc, flags, sfmmup)) != 0) { 12679 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp); 12680 SFMMU_STAT(sf_tsb_allocfail); 12681 *tsbinfopp = NULL; 12682 return (err); 12683 } 12684 SFMMU_STAT(sf_tsb_alloc); 12685 12686 /* 12687 * Bump the TSB size counters for this TSB size. 12688 */ 12689 (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++; 12690 return (0); 12691 } 12692 12693 static void 12694 sfmmu_tsb_free(struct tsb_info *tsbinfo) 12695 { 12696 caddr_t tsbva = tsbinfo->tsb_va; 12697 uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc); 12698 struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache; 12699 vmem_t *vmp = tsbinfo->tsb_vmp; 12700 12701 /* 12702 * If we allocated this TSB from relocatable kernel memory, then we 12703 * need to uninstall the callback handler. 12704 */ 12705 if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) { 12706 uintptr_t slab_mask; 12707 caddr_t slab_vaddr; 12708 page_t **ppl; 12709 int ret; 12710 12711 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena); 12712 if (tsb_size > MMU_PAGESIZE4M) 12713 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT; 12714 else 12715 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT; 12716 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask); 12717 12718 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE); 12719 ASSERT(ret == 0); 12720 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo, 12721 0, NULL); 12722 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE); 12723 } 12724 12725 if (kmem_cachep != NULL) { 12726 kmem_cache_free(kmem_cachep, tsbva); 12727 } else { 12728 vmem_xfree(vmp, (void *)tsbva, tsb_size); 12729 } 12730 tsbinfo->tsb_va = (caddr_t)0xbad00bad; 12731 atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size); 12732 } 12733 12734 static void 12735 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo) 12736 { 12737 if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) { 12738 sfmmu_tsb_free(tsbinfo); 12739 } 12740 kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo); 12741 12742 } 12743 12744 /* 12745 * Setup all the references to physical memory for this tsbinfo. 12746 * The underlying page(s) must be locked. 12747 */ 12748 static void 12749 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn) 12750 { 12751 ASSERT(pfn != PFN_INVALID); 12752 ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va)); 12753 12754 #ifndef sun4v 12755 if (tsbinfo->tsb_szc == 0) { 12756 sfmmu_memtte(&tsbinfo->tsb_tte, pfn, 12757 PROT_WRITE|PROT_READ, TTE8K); 12758 } else { 12759 /* 12760 * Round down PA and use a large mapping; the handlers will 12761 * compute the TSB pointer at the correct offset into the 12762 * big virtual page. NOTE: this assumes all TSBs larger 12763 * than 8K must come from physically contiguous slabs of 12764 * size tsb_slab_size. 12765 */ 12766 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask, 12767 PROT_WRITE|PROT_READ, tsb_slab_ttesz); 12768 } 12769 tsbinfo->tsb_pa = ptob(pfn); 12770 12771 TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */ 12772 TTE_SET_MOD(&tsbinfo->tsb_tte); /* enable writes */ 12773 12774 ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte)); 12775 ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte)); 12776 #else /* sun4v */ 12777 tsbinfo->tsb_pa = ptob(pfn); 12778 #endif /* sun4v */ 12779 } 12780 12781 12782 /* 12783 * Returns zero on success, ENOMEM if over the high water mark, 12784 * or EAGAIN if the caller needs to retry with a smaller TSB 12785 * size (or specify TSB_FORCEALLOC if the allocation can't fail). 12786 * 12787 * This call cannot fail to allocate a TSB if TSB_FORCEALLOC 12788 * is specified and the TSB requested is PAGESIZE, though it 12789 * may sleep waiting for memory if sufficient memory is not 12790 * available. 12791 */ 12792 static int 12793 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask, 12794 int tsbcode, uint_t flags, sfmmu_t *sfmmup) 12795 { 12796 caddr_t vaddr = NULL; 12797 caddr_t slab_vaddr; 12798 uintptr_t slab_mask; 12799 int tsbbytes = TSB_BYTES(tsbcode); 12800 int lowmem = 0; 12801 struct kmem_cache *kmem_cachep = NULL; 12802 vmem_t *vmp = NULL; 12803 lgrp_id_t lgrpid = LGRP_NONE; 12804 pfn_t pfn; 12805 uint_t cbflags = HAC_SLEEP; 12806 page_t **pplist; 12807 int ret; 12808 12809 ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena); 12810 if (tsbbytes > MMU_PAGESIZE4M) 12811 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT; 12812 else 12813 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT; 12814 12815 if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK)) 12816 flags |= TSB_ALLOC; 12817 12818 ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE); 12819 12820 tsbinfo->tsb_sfmmu = sfmmup; 12821 12822 /* 12823 * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and 12824 * return. 12825 */ 12826 if ((flags & TSB_ALLOC) == 0) { 12827 tsbinfo->tsb_szc = tsbcode; 12828 tsbinfo->tsb_ttesz_mask = tteszmask; 12829 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef; 12830 tsbinfo->tsb_pa = -1; 12831 tsbinfo->tsb_tte.ll = 0; 12832 tsbinfo->tsb_next = NULL; 12833 tsbinfo->tsb_flags = TSB_SWAPPED; 12834 tsbinfo->tsb_cache = NULL; 12835 tsbinfo->tsb_vmp = NULL; 12836 return (0); 12837 } 12838 12839 #ifdef DEBUG 12840 /* 12841 * For debugging: 12842 * Randomly force allocation failures every tsb_alloc_mtbf 12843 * tries if TSB_FORCEALLOC is not specified. This will 12844 * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if 12845 * it is even, to allow testing of both failure paths... 12846 */ 12847 if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) && 12848 (tsb_alloc_count++ == tsb_alloc_mtbf)) { 12849 tsb_alloc_count = 0; 12850 tsb_alloc_fail_mtbf++; 12851 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN); 12852 } 12853 #endif /* DEBUG */ 12854 12855 /* 12856 * Enforce high water mark if we are not doing a forced allocation 12857 * and are not shrinking a process' TSB. 12858 */ 12859 if ((flags & TSB_SHRINK) == 0 && 12860 (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) { 12861 if ((flags & TSB_FORCEALLOC) == 0) 12862 return (ENOMEM); 12863 lowmem = 1; 12864 } 12865 12866 /* 12867 * Allocate from the correct location based upon the size of the TSB 12868 * compared to the base page size, and what memory conditions dictate. 12869 * Note we always do nonblocking allocations from the TSB arena since 12870 * we don't want memory fragmentation to cause processes to block 12871 * indefinitely waiting for memory; until the kernel algorithms that 12872 * coalesce large pages are improved this is our best option. 12873 * 12874 * Algorithm: 12875 * If allocating a "large" TSB (>8K), allocate from the 12876 * appropriate kmem_tsb_default_arena vmem arena 12877 * else if low on memory or the TSB_FORCEALLOC flag is set or 12878 * tsb_forceheap is set 12879 * Allocate from kernel heap via sfmmu_tsb8k_cache with 12880 * KM_SLEEP (never fails) 12881 * else 12882 * Allocate from appropriate sfmmu_tsb_cache with 12883 * KM_NOSLEEP 12884 * endif 12885 */ 12886 if (tsb_lgrp_affinity) 12887 lgrpid = lgrp_home_id(curthread); 12888 if (lgrpid == LGRP_NONE) 12889 lgrpid = 0; /* use lgrp of boot CPU */ 12890 12891 if (tsbbytes > MMU_PAGESIZE) { 12892 if (tsbbytes > MMU_PAGESIZE4M) { 12893 vmp = kmem_bigtsb_default_arena[lgrpid]; 12894 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes, 12895 0, 0, NULL, NULL, VM_NOSLEEP); 12896 } else { 12897 vmp = kmem_tsb_default_arena[lgrpid]; 12898 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes, 12899 0, 0, NULL, NULL, VM_NOSLEEP); 12900 } 12901 #ifdef DEBUG 12902 } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) { 12903 #else /* !DEBUG */ 12904 } else if (lowmem || (flags & TSB_FORCEALLOC)) { 12905 #endif /* DEBUG */ 12906 kmem_cachep = sfmmu_tsb8k_cache; 12907 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP); 12908 ASSERT(vaddr != NULL); 12909 } else { 12910 kmem_cachep = sfmmu_tsb_cache[lgrpid]; 12911 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP); 12912 } 12913 12914 tsbinfo->tsb_cache = kmem_cachep; 12915 tsbinfo->tsb_vmp = vmp; 12916 12917 if (vaddr == NULL) { 12918 return (EAGAIN); 12919 } 12920 12921 atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes); 12922 kmem_cachep = tsbinfo->tsb_cache; 12923 12924 /* 12925 * If we are allocating from outside the cage, then we need to 12926 * register a relocation callback handler. Note that for now 12927 * since pseudo mappings always hang off of the slab's root page, 12928 * we need only lock the first 8K of the TSB slab. This is a bit 12929 * hacky but it is good for performance. 12930 */ 12931 if (kmem_cachep != sfmmu_tsb8k_cache) { 12932 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask); 12933 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE); 12934 ASSERT(ret == 0); 12935 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes, 12936 cbflags, (void *)tsbinfo, &pfn, NULL); 12937 12938 /* 12939 * Need to free up resources if we could not successfully 12940 * add the callback function and return an error condition. 12941 */ 12942 if (ret != 0) { 12943 if (kmem_cachep) { 12944 kmem_cache_free(kmem_cachep, vaddr); 12945 } else { 12946 vmem_xfree(vmp, (void *)vaddr, tsbbytes); 12947 } 12948 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, 12949 S_WRITE); 12950 return (EAGAIN); 12951 } 12952 } else { 12953 /* 12954 * Since allocation of 8K TSBs from heap is rare and occurs 12955 * during memory pressure we allocate them from permanent 12956 * memory rather than using callbacks to get the PFN. 12957 */ 12958 pfn = hat_getpfnum(kas.a_hat, vaddr); 12959 } 12960 12961 tsbinfo->tsb_va = vaddr; 12962 tsbinfo->tsb_szc = tsbcode; 12963 tsbinfo->tsb_ttesz_mask = tteszmask; 12964 tsbinfo->tsb_next = NULL; 12965 tsbinfo->tsb_flags = 0; 12966 12967 sfmmu_tsbinfo_setup_phys(tsbinfo, pfn); 12968 12969 sfmmu_inv_tsb(vaddr, tsbbytes); 12970 12971 if (kmem_cachep != sfmmu_tsb8k_cache) { 12972 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE); 12973 } 12974 12975 return (0); 12976 } 12977 12978 /* 12979 * Initialize per cpu tsb and per cpu tsbmiss_area 12980 */ 12981 void 12982 sfmmu_init_tsbs(void) 12983 { 12984 int i; 12985 struct tsbmiss *tsbmissp; 12986 struct kpmtsbm *kpmtsbmp; 12987 #ifndef sun4v 12988 extern int dcache_line_mask; 12989 #endif /* sun4v */ 12990 extern uint_t vac_colors; 12991 12992 /* 12993 * Init. tsb miss area. 12994 */ 12995 tsbmissp = tsbmiss_area; 12996 12997 for (i = 0; i < NCPU; tsbmissp++, i++) { 12998 /* 12999 * initialize the tsbmiss area. 13000 * Do this for all possible CPUs as some may be added 13001 * while the system is running. There is no cost to this. 13002 */ 13003 tsbmissp->ksfmmup = ksfmmup; 13004 #ifndef sun4v 13005 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask; 13006 #endif /* sun4v */ 13007 tsbmissp->khashstart = 13008 (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash); 13009 tsbmissp->uhashstart = 13010 (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash); 13011 tsbmissp->khashsz = khmehash_num; 13012 tsbmissp->uhashsz = uhmehash_num; 13013 } 13014 13015 sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B', 13016 sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0); 13017 13018 if (kpm_enable == 0) 13019 return; 13020 13021 /* -- Begin KPM specific init -- */ 13022 13023 if (kpm_smallpages) { 13024 /* 13025 * If we're using base pagesize pages for seg_kpm 13026 * mappings, we use the kernel TSB since we can't afford 13027 * to allocate a second huge TSB for these mappings. 13028 */ 13029 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base; 13030 kpm_tsbsz = ktsb_szcode; 13031 kpmsm_tsbbase = kpm_tsbbase; 13032 kpmsm_tsbsz = kpm_tsbsz; 13033 } else { 13034 /* 13035 * In VAC conflict case, just put the entries in the 13036 * kernel 8K indexed TSB for now so we can find them. 13037 * This could really be changed in the future if we feel 13038 * the need... 13039 */ 13040 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base; 13041 kpmsm_tsbsz = ktsb_szcode; 13042 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base; 13043 kpm_tsbsz = ktsb4m_szcode; 13044 } 13045 13046 kpmtsbmp = kpmtsbm_area; 13047 for (i = 0; i < NCPU; kpmtsbmp++, i++) { 13048 /* 13049 * Initialize the kpmtsbm area. 13050 * Do this for all possible CPUs as some may be added 13051 * while the system is running. There is no cost to this. 13052 */ 13053 kpmtsbmp->vbase = kpm_vbase; 13054 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors; 13055 kpmtsbmp->sz_shift = kpm_size_shift; 13056 kpmtsbmp->kpmp_shift = kpmp_shift; 13057 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft; 13058 if (kpm_smallpages == 0) { 13059 kpmtsbmp->kpmp_table_sz = kpmp_table_sz; 13060 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table); 13061 } else { 13062 kpmtsbmp->kpmp_table_sz = kpmp_stable_sz; 13063 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable); 13064 } 13065 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash); 13066 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG; 13067 #ifdef DEBUG 13068 kpmtsbmp->flags |= (kpm_tsbmtl) ? KPMTSBM_TLTSBM_FLAG : 0; 13069 #endif /* DEBUG */ 13070 if (ktsb_phys) 13071 kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG; 13072 } 13073 13074 /* -- End KPM specific init -- */ 13075 } 13076 13077 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */ 13078 struct tsb_info ktsb_info[2]; 13079 13080 /* 13081 * Called from hat_kern_setup() to setup the tsb_info for ksfmmup. 13082 */ 13083 void 13084 sfmmu_init_ktsbinfo() 13085 { 13086 ASSERT(ksfmmup != NULL); 13087 ASSERT(ksfmmup->sfmmu_tsb == NULL); 13088 /* 13089 * Allocate tsbinfos for kernel and copy in data 13090 * to make debug easier and sun4v setup easier. 13091 */ 13092 ktsb_info[0].tsb_sfmmu = ksfmmup; 13093 ktsb_info[0].tsb_szc = ktsb_szcode; 13094 ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K; 13095 ktsb_info[0].tsb_va = ktsb_base; 13096 ktsb_info[0].tsb_pa = ktsb_pbase; 13097 ktsb_info[0].tsb_flags = 0; 13098 ktsb_info[0].tsb_tte.ll = 0; 13099 ktsb_info[0].tsb_cache = NULL; 13100 13101 ktsb_info[1].tsb_sfmmu = ksfmmup; 13102 ktsb_info[1].tsb_szc = ktsb4m_szcode; 13103 ktsb_info[1].tsb_ttesz_mask = TSB4M; 13104 ktsb_info[1].tsb_va = ktsb4m_base; 13105 ktsb_info[1].tsb_pa = ktsb4m_pbase; 13106 ktsb_info[1].tsb_flags = 0; 13107 ktsb_info[1].tsb_tte.ll = 0; 13108 ktsb_info[1].tsb_cache = NULL; 13109 13110 /* Link them into ksfmmup. */ 13111 ktsb_info[0].tsb_next = &ktsb_info[1]; 13112 ktsb_info[1].tsb_next = NULL; 13113 ksfmmup->sfmmu_tsb = &ktsb_info[0]; 13114 13115 sfmmu_setup_tsbinfo(ksfmmup); 13116 } 13117 13118 /* 13119 * Cache the last value returned from va_to_pa(). If the VA specified 13120 * in the current call to cached_va_to_pa() maps to the same Page (as the 13121 * previous call to cached_va_to_pa()), then compute the PA using 13122 * cached info, else call va_to_pa(). 13123 * 13124 * Note: this function is neither MT-safe nor consistent in the presence 13125 * of multiple, interleaved threads. This function was created to enable 13126 * an optimization used during boot (at a point when there's only one thread 13127 * executing on the "boot CPU", and before startup_vm() has been called). 13128 */ 13129 static uint64_t 13130 cached_va_to_pa(void *vaddr) 13131 { 13132 static uint64_t prev_vaddr_base = 0; 13133 static uint64_t prev_pfn = 0; 13134 13135 if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) { 13136 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET)); 13137 } else { 13138 uint64_t pa = va_to_pa(vaddr); 13139 13140 if (pa != ((uint64_t)-1)) { 13141 /* 13142 * Computed physical address is valid. Cache its 13143 * related info for the next cached_va_to_pa() call. 13144 */ 13145 prev_pfn = pa & MMU_PAGEMASK; 13146 prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK; 13147 } 13148 13149 return (pa); 13150 } 13151 } 13152 13153 /* 13154 * Carve up our nucleus hblk region. We may allocate more hblks than 13155 * asked due to rounding errors but we are guaranteed to have at least 13156 * enough space to allocate the requested number of hblk8's and hblk1's. 13157 */ 13158 void 13159 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1) 13160 { 13161 struct hme_blk *hmeblkp; 13162 size_t hme8blk_sz, hme1blk_sz; 13163 size_t i; 13164 size_t hblk8_bound; 13165 ulong_t j = 0, k = 0; 13166 13167 ASSERT(addr != NULL && size != 0); 13168 13169 /* Need to use proper structure alignment */ 13170 hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t)); 13171 hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t)); 13172 13173 nucleus_hblk8.list = (void *)addr; 13174 nucleus_hblk8.index = 0; 13175 13176 /* 13177 * Use as much memory as possible for hblk8's since we 13178 * expect all bop_alloc'ed memory to be allocated in 8k chunks. 13179 * We need to hold back enough space for the hblk1's which 13180 * we'll allocate next. 13181 */ 13182 hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz; 13183 for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) { 13184 hmeblkp = (struct hme_blk *)addr; 13185 addr += hme8blk_sz; 13186 hmeblkp->hblk_nuc_bit = 1; 13187 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp); 13188 } 13189 nucleus_hblk8.len = j; 13190 ASSERT(j >= nhblk8); 13191 SFMMU_STAT_ADD(sf_hblk8_ncreate, j); 13192 13193 nucleus_hblk1.list = (void *)addr; 13194 nucleus_hblk1.index = 0; 13195 for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) { 13196 hmeblkp = (struct hme_blk *)addr; 13197 addr += hme1blk_sz; 13198 hmeblkp->hblk_nuc_bit = 1; 13199 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp); 13200 } 13201 ASSERT(k >= nhblk1); 13202 nucleus_hblk1.len = k; 13203 SFMMU_STAT_ADD(sf_hblk1_ncreate, k); 13204 } 13205 13206 /* 13207 * This function is currently not supported on this platform. For what 13208 * it's supposed to do, see hat.c and hat_srmmu.c 13209 */ 13210 /* ARGSUSED */ 13211 faultcode_t 13212 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp, 13213 uint_t flags) 13214 { 13215 return (FC_NOSUPPORT); 13216 } 13217 13218 /* 13219 * Searchs the mapping list of the page for a mapping of the same size. If not 13220 * found the corresponding bit is cleared in the p_index field. When large 13221 * pages are more prevalent in the system, we can maintain the mapping list 13222 * in order and we don't have to traverse the list each time. Just check the 13223 * next and prev entries, and if both are of different size, we clear the bit. 13224 */ 13225 static void 13226 sfmmu_rm_large_mappings(page_t *pp, int ttesz) 13227 { 13228 struct sf_hment *sfhmep; 13229 int index; 13230 pgcnt_t npgs; 13231 13232 ASSERT(ttesz > TTE8K); 13233 13234 ASSERT(sfmmu_mlist_held(pp)); 13235 13236 ASSERT(PP_ISMAPPED_LARGE(pp)); 13237 13238 /* 13239 * Traverse mapping list looking for another mapping of same size. 13240 * since we only want to clear index field if all mappings of 13241 * that size are gone. 13242 */ 13243 13244 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 13245 if (IS_PAHME(sfhmep)) 13246 continue; 13247 if (hme_size(sfhmep) == ttesz) { 13248 /* 13249 * another mapping of the same size. don't clear index. 13250 */ 13251 return; 13252 } 13253 } 13254 13255 /* 13256 * Clear the p_index bit for large page. 13257 */ 13258 index = PAGESZ_TO_INDEX(ttesz); 13259 npgs = TTEPAGES(ttesz); 13260 while (npgs-- > 0) { 13261 ASSERT(pp->p_index & index); 13262 pp->p_index &= ~index; 13263 pp = PP_PAGENEXT(pp); 13264 } 13265 } 13266 13267 /* 13268 * return supported features 13269 */ 13270 /* ARGSUSED */ 13271 int 13272 hat_supported(enum hat_features feature, void *arg) 13273 { 13274 switch (feature) { 13275 case HAT_SHARED_PT: 13276 case HAT_DYNAMIC_ISM_UNMAP: 13277 case HAT_VMODSORT: 13278 return (1); 13279 case HAT_SHARED_REGIONS: 13280 if (shctx_on) 13281 return (1); 13282 else 13283 return (0); 13284 default: 13285 return (0); 13286 } 13287 } 13288 13289 void 13290 hat_enter(struct hat *hat) 13291 { 13292 hatlock_t *hatlockp; 13293 13294 if (hat != ksfmmup) { 13295 hatlockp = TSB_HASH(hat); 13296 mutex_enter(HATLOCK_MUTEXP(hatlockp)); 13297 } 13298 } 13299 13300 void 13301 hat_exit(struct hat *hat) 13302 { 13303 hatlock_t *hatlockp; 13304 13305 if (hat != ksfmmup) { 13306 hatlockp = TSB_HASH(hat); 13307 mutex_exit(HATLOCK_MUTEXP(hatlockp)); 13308 } 13309 } 13310 13311 /*ARGSUSED*/ 13312 void 13313 hat_reserve(struct as *as, caddr_t addr, size_t len) 13314 { 13315 } 13316 13317 static void 13318 hat_kstat_init(void) 13319 { 13320 kstat_t *ksp; 13321 13322 ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat", 13323 KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat), 13324 KSTAT_FLAG_VIRTUAL); 13325 if (ksp) { 13326 ksp->ks_data = (void *) &sfmmu_global_stat; 13327 kstat_install(ksp); 13328 } 13329 ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat", 13330 KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat), 13331 KSTAT_FLAG_VIRTUAL); 13332 if (ksp) { 13333 ksp->ks_data = (void *) &sfmmu_tsbsize_stat; 13334 kstat_install(ksp); 13335 } 13336 ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat", 13337 KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU, 13338 KSTAT_FLAG_WRITABLE); 13339 if (ksp) { 13340 ksp->ks_update = sfmmu_kstat_percpu_update; 13341 kstat_install(ksp); 13342 } 13343 } 13344 13345 /* ARGSUSED */ 13346 static int 13347 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw) 13348 { 13349 struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data; 13350 struct tsbmiss *tsbm = tsbmiss_area; 13351 struct kpmtsbm *kpmtsbm = kpmtsbm_area; 13352 int i; 13353 13354 ASSERT(cpu_kstat); 13355 if (rw == KSTAT_READ) { 13356 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) { 13357 cpu_kstat->sf_itlb_misses = 0; 13358 cpu_kstat->sf_dtlb_misses = 0; 13359 cpu_kstat->sf_utsb_misses = tsbm->utsb_misses - 13360 tsbm->uprot_traps; 13361 cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses + 13362 kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps; 13363 cpu_kstat->sf_tsb_hits = 0; 13364 cpu_kstat->sf_umod_faults = tsbm->uprot_traps; 13365 cpu_kstat->sf_kmod_faults = tsbm->kprot_traps; 13366 } 13367 } else { 13368 /* KSTAT_WRITE is used to clear stats */ 13369 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) { 13370 tsbm->utsb_misses = 0; 13371 tsbm->ktsb_misses = 0; 13372 tsbm->uprot_traps = 0; 13373 tsbm->kprot_traps = 0; 13374 kpmtsbm->kpm_dtlb_misses = 0; 13375 kpmtsbm->kpm_tsb_misses = 0; 13376 } 13377 } 13378 return (0); 13379 } 13380 13381 #ifdef DEBUG 13382 13383 tte_t *gorig[NCPU], *gcur[NCPU], *gnew[NCPU]; 13384 13385 /* 13386 * A tte checker. *orig_old is the value we read before cas. 13387 * *cur is the value returned by cas. 13388 * *new is the desired value when we do the cas. 13389 * 13390 * *hmeblkp is currently unused. 13391 */ 13392 13393 /* ARGSUSED */ 13394 void 13395 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp) 13396 { 13397 pfn_t i, j, k; 13398 int cpuid = CPU->cpu_id; 13399 13400 gorig[cpuid] = orig_old; 13401 gcur[cpuid] = cur; 13402 gnew[cpuid] = new; 13403 13404 #ifdef lint 13405 hmeblkp = hmeblkp; 13406 #endif 13407 13408 if (TTE_IS_VALID(orig_old)) { 13409 if (TTE_IS_VALID(cur)) { 13410 i = TTE_TO_TTEPFN(orig_old); 13411 j = TTE_TO_TTEPFN(cur); 13412 k = TTE_TO_TTEPFN(new); 13413 if (i != j) { 13414 /* remap error? */ 13415 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j); 13416 } 13417 13418 if (i != k) { 13419 /* remap error? */ 13420 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k); 13421 } 13422 } else { 13423 if (TTE_IS_VALID(new)) { 13424 panic("chk_tte: invalid cur? "); 13425 } 13426 13427 i = TTE_TO_TTEPFN(orig_old); 13428 k = TTE_TO_TTEPFN(new); 13429 if (i != k) { 13430 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k); 13431 } 13432 } 13433 } else { 13434 if (TTE_IS_VALID(cur)) { 13435 j = TTE_TO_TTEPFN(cur); 13436 if (TTE_IS_VALID(new)) { 13437 k = TTE_TO_TTEPFN(new); 13438 if (j != k) { 13439 panic("chk_tte: bad pfn4, 0x%lx, 0x%lx", 13440 j, k); 13441 } 13442 } else { 13443 panic("chk_tte: why here?"); 13444 } 13445 } else { 13446 if (!TTE_IS_VALID(new)) { 13447 panic("chk_tte: why here2 ?"); 13448 } 13449 } 13450 } 13451 } 13452 13453 #endif /* DEBUG */ 13454 13455 extern void prefetch_tsbe_read(struct tsbe *); 13456 extern void prefetch_tsbe_write(struct tsbe *); 13457 13458 13459 /* 13460 * We want to prefetch 7 cache lines ahead for our read prefetch. This gives 13461 * us optimal performance on Cheetah+. You can only have 8 outstanding 13462 * prefetches at any one time, so we opted for 7 read prefetches and 1 write 13463 * prefetch to make the most utilization of the prefetch capability. 13464 */ 13465 #define TSBE_PREFETCH_STRIDE (7) 13466 13467 void 13468 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo) 13469 { 13470 int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc); 13471 int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc); 13472 int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc); 13473 int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc); 13474 struct tsbe *old; 13475 struct tsbe *new; 13476 struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va; 13477 uint64_t va; 13478 int new_offset; 13479 int i; 13480 int vpshift; 13481 int last_prefetch; 13482 13483 if (old_bytes == new_bytes) { 13484 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes); 13485 } else { 13486 13487 /* 13488 * A TSBE is 16 bytes which means there are four TSBE's per 13489 * P$ line (64 bytes), thus every 4 TSBE's we prefetch. 13490 */ 13491 old = (struct tsbe *)old_tsbinfo->tsb_va; 13492 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1)); 13493 for (i = 0; i < old_entries; i++, old++) { 13494 if (((i & (4-1)) == 0) && (i < last_prefetch)) 13495 prefetch_tsbe_read(old); 13496 if (!old->tte_tag.tag_invalid) { 13497 /* 13498 * We have a valid TTE to remap. Check the 13499 * size. We won't remap 64K or 512K TTEs 13500 * because they span more than one TSB entry 13501 * and are indexed using an 8K virt. page. 13502 * Ditto for 32M and 256M TTEs. 13503 */ 13504 if (TTE_CSZ(&old->tte_data) == TTE64K || 13505 TTE_CSZ(&old->tte_data) == TTE512K) 13506 continue; 13507 if (mmu_page_sizes == max_mmu_page_sizes) { 13508 if (TTE_CSZ(&old->tte_data) == TTE32M || 13509 TTE_CSZ(&old->tte_data) == TTE256M) 13510 continue; 13511 } 13512 13513 /* clear the lower 22 bits of the va */ 13514 va = *(uint64_t *)old << 22; 13515 /* turn va into a virtual pfn */ 13516 va >>= 22 - TSB_START_SIZE; 13517 /* 13518 * or in bits from the offset in the tsb 13519 * to get the real virtual pfn. These 13520 * correspond to bits [21:13] in the va 13521 */ 13522 vpshift = 13523 TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) & 13524 0x1ff; 13525 va |= (i << vpshift); 13526 va >>= vpshift; 13527 new_offset = va & (new_entries - 1); 13528 new = new_base + new_offset; 13529 prefetch_tsbe_write(new); 13530 *new = *old; 13531 } 13532 } 13533 } 13534 } 13535 13536 /* 13537 * unused in sfmmu 13538 */ 13539 void 13540 hat_dump(void) 13541 { 13542 } 13543 13544 /* 13545 * Called when a thread is exiting and we have switched to the kernel address 13546 * space. Perform the same VM initialization resume() uses when switching 13547 * processes. 13548 * 13549 * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but 13550 * we call it anyway in case the semantics change in the future. 13551 */ 13552 /*ARGSUSED*/ 13553 void 13554 hat_thread_exit(kthread_t *thd) 13555 { 13556 uint_t pgsz_cnum; 13557 uint_t pstate_save; 13558 13559 ASSERT(thd->t_procp->p_as == &kas); 13560 13561 pgsz_cnum = KCONTEXT; 13562 #ifdef sun4u 13563 pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT); 13564 #endif 13565 13566 /* 13567 * Note that sfmmu_load_mmustate() is currently a no-op for 13568 * kernel threads. We need to disable interrupts here, 13569 * simply because otherwise sfmmu_load_mmustate() would panic 13570 * if the caller does not disable interrupts. 13571 */ 13572 pstate_save = sfmmu_disable_intrs(); 13573 13574 /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */ 13575 sfmmu_setctx_sec(pgsz_cnum); 13576 sfmmu_load_mmustate(ksfmmup); 13577 sfmmu_enable_intrs(pstate_save); 13578 } 13579 13580 13581 /* 13582 * SRD support 13583 */ 13584 #define SRD_HASH_FUNCTION(vp) (((((uintptr_t)(vp)) >> 4) ^ \ 13585 (((uintptr_t)(vp)) >> 11)) & \ 13586 srd_hashmask) 13587 13588 /* 13589 * Attach the process to the srd struct associated with the exec vnode 13590 * from which the process is started. 13591 */ 13592 void 13593 hat_join_srd(struct hat *sfmmup, vnode_t *evp) 13594 { 13595 uint_t hash = SRD_HASH_FUNCTION(evp); 13596 sf_srd_t *srdp; 13597 sf_srd_t *newsrdp; 13598 13599 ASSERT(sfmmup != ksfmmup); 13600 ASSERT(sfmmup->sfmmu_srdp == NULL); 13601 13602 if (!shctx_on) { 13603 return; 13604 } 13605 13606 VN_HOLD(evp); 13607 13608 if (srd_buckets[hash].srdb_srdp != NULL) { 13609 mutex_enter(&srd_buckets[hash].srdb_lock); 13610 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL; 13611 srdp = srdp->srd_hash) { 13612 if (srdp->srd_evp == evp) { 13613 ASSERT(srdp->srd_refcnt >= 0); 13614 sfmmup->sfmmu_srdp = srdp; 13615 atomic_inc_32( 13616 (volatile uint_t *)&srdp->srd_refcnt); 13617 mutex_exit(&srd_buckets[hash].srdb_lock); 13618 return; 13619 } 13620 } 13621 mutex_exit(&srd_buckets[hash].srdb_lock); 13622 } 13623 newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP); 13624 ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0); 13625 13626 newsrdp->srd_evp = evp; 13627 newsrdp->srd_refcnt = 1; 13628 newsrdp->srd_hmergnfree = NULL; 13629 newsrdp->srd_ismrgnfree = NULL; 13630 13631 mutex_enter(&srd_buckets[hash].srdb_lock); 13632 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL; 13633 srdp = srdp->srd_hash) { 13634 if (srdp->srd_evp == evp) { 13635 ASSERT(srdp->srd_refcnt >= 0); 13636 sfmmup->sfmmu_srdp = srdp; 13637 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt); 13638 mutex_exit(&srd_buckets[hash].srdb_lock); 13639 kmem_cache_free(srd_cache, newsrdp); 13640 return; 13641 } 13642 } 13643 newsrdp->srd_hash = srd_buckets[hash].srdb_srdp; 13644 srd_buckets[hash].srdb_srdp = newsrdp; 13645 sfmmup->sfmmu_srdp = newsrdp; 13646 13647 mutex_exit(&srd_buckets[hash].srdb_lock); 13648 13649 } 13650 13651 static void 13652 sfmmu_leave_srd(sfmmu_t *sfmmup) 13653 { 13654 vnode_t *evp; 13655 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 13656 uint_t hash; 13657 sf_srd_t **prev_srdpp; 13658 sf_region_t *rgnp; 13659 sf_region_t *nrgnp; 13660 #ifdef DEBUG 13661 int rgns = 0; 13662 #endif 13663 int i; 13664 13665 ASSERT(sfmmup != ksfmmup); 13666 ASSERT(srdp != NULL); 13667 ASSERT(srdp->srd_refcnt > 0); 13668 ASSERT(sfmmup->sfmmu_scdp == NULL); 13669 ASSERT(sfmmup->sfmmu_free == 1); 13670 13671 sfmmup->sfmmu_srdp = NULL; 13672 evp = srdp->srd_evp; 13673 ASSERT(evp != NULL); 13674 if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) { 13675 VN_RELE(evp); 13676 return; 13677 } 13678 13679 hash = SRD_HASH_FUNCTION(evp); 13680 mutex_enter(&srd_buckets[hash].srdb_lock); 13681 for (prev_srdpp = &srd_buckets[hash].srdb_srdp; 13682 (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) { 13683 if (srdp->srd_evp == evp) { 13684 break; 13685 } 13686 } 13687 if (srdp == NULL || srdp->srd_refcnt) { 13688 mutex_exit(&srd_buckets[hash].srdb_lock); 13689 VN_RELE(evp); 13690 return; 13691 } 13692 *prev_srdpp = srdp->srd_hash; 13693 mutex_exit(&srd_buckets[hash].srdb_lock); 13694 13695 ASSERT(srdp->srd_refcnt == 0); 13696 VN_RELE(evp); 13697 13698 #ifdef DEBUG 13699 for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) { 13700 ASSERT(srdp->srd_rgnhash[i] == NULL); 13701 } 13702 #endif /* DEBUG */ 13703 13704 /* free each hme regions in the srd */ 13705 for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) { 13706 nrgnp = rgnp->rgn_next; 13707 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid); 13708 ASSERT(rgnp->rgn_refcnt == 0); 13709 ASSERT(rgnp->rgn_sfmmu_head == NULL); 13710 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 13711 ASSERT(rgnp->rgn_hmeflags == 0); 13712 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp); 13713 #ifdef DEBUG 13714 for (i = 0; i < MMU_PAGE_SIZES; i++) { 13715 ASSERT(rgnp->rgn_ttecnt[i] == 0); 13716 } 13717 rgns++; 13718 #endif /* DEBUG */ 13719 kmem_cache_free(region_cache, rgnp); 13720 } 13721 ASSERT(rgns == srdp->srd_next_hmerid); 13722 13723 #ifdef DEBUG 13724 rgns = 0; 13725 #endif 13726 /* free each ism rgns in the srd */ 13727 for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) { 13728 nrgnp = rgnp->rgn_next; 13729 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid); 13730 ASSERT(rgnp->rgn_refcnt == 0); 13731 ASSERT(rgnp->rgn_sfmmu_head == NULL); 13732 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 13733 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp); 13734 #ifdef DEBUG 13735 for (i = 0; i < MMU_PAGE_SIZES; i++) { 13736 ASSERT(rgnp->rgn_ttecnt[i] == 0); 13737 } 13738 rgns++; 13739 #endif /* DEBUG */ 13740 kmem_cache_free(region_cache, rgnp); 13741 } 13742 ASSERT(rgns == srdp->srd_next_ismrid); 13743 ASSERT(srdp->srd_ismbusyrgns == 0); 13744 ASSERT(srdp->srd_hmebusyrgns == 0); 13745 13746 srdp->srd_next_ismrid = 0; 13747 srdp->srd_next_hmerid = 0; 13748 13749 bzero((void *)srdp->srd_ismrgnp, 13750 sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS); 13751 bzero((void *)srdp->srd_hmergnp, 13752 sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS); 13753 13754 ASSERT(srdp->srd_scdp == NULL); 13755 kmem_cache_free(srd_cache, srdp); 13756 } 13757 13758 /* ARGSUSED */ 13759 static int 13760 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags) 13761 { 13762 sf_srd_t *srdp = (sf_srd_t *)buf; 13763 bzero(buf, sizeof (*srdp)); 13764 13765 mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL); 13766 mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL); 13767 return (0); 13768 } 13769 13770 /* ARGSUSED */ 13771 static void 13772 sfmmu_srdcache_destructor(void *buf, void *cdrarg) 13773 { 13774 sf_srd_t *srdp = (sf_srd_t *)buf; 13775 13776 mutex_destroy(&srdp->srd_mutex); 13777 mutex_destroy(&srdp->srd_scd_mutex); 13778 } 13779 13780 /* 13781 * The caller makes sure hat_join_region()/hat_leave_region() can't be called 13782 * at the same time for the same process and address range. This is ensured by 13783 * the fact that address space is locked as writer when a process joins the 13784 * regions. Therefore there's no need to hold an srd lock during the entire 13785 * execution of hat_join_region()/hat_leave_region(). 13786 */ 13787 13788 #define RGN_HASH_FUNCTION(obj) (((((uintptr_t)(obj)) >> 4) ^ \ 13789 (((uintptr_t)(obj)) >> 11)) & \ 13790 srd_rgn_hashmask) 13791 /* 13792 * This routine implements the shared context functionality required when 13793 * attaching a segment to an address space. It must be called from 13794 * hat_share() for D(ISM) segments and from segvn_create() for segments 13795 * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie 13796 * which is saved in the private segment data for hme segments and 13797 * the ism_map structure for ism segments. 13798 */ 13799 hat_region_cookie_t 13800 hat_join_region(struct hat *sfmmup, caddr_t r_saddr, size_t r_size, 13801 void *r_obj, u_offset_t r_objoff, uchar_t r_perm, uchar_t r_pgszc, 13802 hat_rgn_cb_func_t r_cb_function, uint_t flags) 13803 { 13804 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 13805 uint_t rhash; 13806 uint_t rid; 13807 hatlock_t *hatlockp; 13808 sf_region_t *rgnp; 13809 sf_region_t *new_rgnp = NULL; 13810 int i; 13811 uint16_t *nextidp; 13812 sf_region_t **freelistp; 13813 int maxids; 13814 sf_region_t **rarrp; 13815 uint16_t *busyrgnsp; 13816 ulong_t rttecnt; 13817 uchar_t tteflag; 13818 uchar_t r_type = flags & HAT_REGION_TYPE_MASK; 13819 int text = (r_type == HAT_REGION_TEXT); 13820 13821 if (srdp == NULL || r_size == 0) { 13822 return (HAT_INVALID_REGION_COOKIE); 13823 } 13824 13825 ASSERT(sfmmup != ksfmmup); 13826 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 13827 ASSERT(srdp->srd_refcnt > 0); 13828 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK)); 13829 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM); 13830 ASSERT(r_pgszc < mmu_page_sizes); 13831 if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) || 13832 !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) { 13833 panic("hat_join_region: region addr or size is not aligned\n"); 13834 } 13835 13836 13837 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM : 13838 SFMMU_REGION_HME; 13839 /* 13840 * Currently only support shared hmes for the read only main text 13841 * region. 13842 */ 13843 if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) || 13844 (r_perm & PROT_WRITE))) { 13845 return (HAT_INVALID_REGION_COOKIE); 13846 } 13847 13848 rhash = RGN_HASH_FUNCTION(r_obj); 13849 13850 if (r_type == SFMMU_REGION_ISM) { 13851 nextidp = &srdp->srd_next_ismrid; 13852 freelistp = &srdp->srd_ismrgnfree; 13853 maxids = SFMMU_MAX_ISM_REGIONS; 13854 rarrp = srdp->srd_ismrgnp; 13855 busyrgnsp = &srdp->srd_ismbusyrgns; 13856 } else { 13857 nextidp = &srdp->srd_next_hmerid; 13858 freelistp = &srdp->srd_hmergnfree; 13859 maxids = SFMMU_MAX_HME_REGIONS; 13860 rarrp = srdp->srd_hmergnp; 13861 busyrgnsp = &srdp->srd_hmebusyrgns; 13862 } 13863 13864 mutex_enter(&srdp->srd_mutex); 13865 13866 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL; 13867 rgnp = rgnp->rgn_hash) { 13868 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size && 13869 rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff && 13870 rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) { 13871 break; 13872 } 13873 } 13874 13875 rfound: 13876 if (rgnp != NULL) { 13877 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 13878 ASSERT(rgnp->rgn_cb_function == r_cb_function); 13879 ASSERT(rgnp->rgn_refcnt >= 0); 13880 rid = rgnp->rgn_id; 13881 ASSERT(rid < maxids); 13882 ASSERT(rarrp[rid] == rgnp); 13883 ASSERT(rid < *nextidp); 13884 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt); 13885 mutex_exit(&srdp->srd_mutex); 13886 if (new_rgnp != NULL) { 13887 kmem_cache_free(region_cache, new_rgnp); 13888 } 13889 if (r_type == SFMMU_REGION_HME) { 13890 int myjoin = 13891 (sfmmup == astosfmmu(curthread->t_procp->p_as)); 13892 13893 sfmmu_link_to_hmeregion(sfmmup, rgnp); 13894 /* 13895 * bitmap should be updated after linking sfmmu on 13896 * region list so that pageunload() doesn't skip 13897 * TSB/TLB flush. As soon as bitmap is updated another 13898 * thread in this process can already start accessing 13899 * this region. 13900 */ 13901 /* 13902 * Normally ttecnt accounting is done as part of 13903 * pagefault handling. But a process may not take any 13904 * pagefaults on shared hmeblks created by some other 13905 * process. To compensate for this assume that the 13906 * entire region will end up faulted in using 13907 * the region's pagesize. 13908 * 13909 */ 13910 if (r_pgszc > TTE8K) { 13911 tteflag = 1 << r_pgszc; 13912 if (disable_large_pages & tteflag) { 13913 tteflag = 0; 13914 } 13915 } else { 13916 tteflag = 0; 13917 } 13918 if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) { 13919 hatlockp = sfmmu_hat_enter(sfmmup); 13920 sfmmup->sfmmu_rtteflags |= tteflag; 13921 sfmmu_hat_exit(hatlockp); 13922 } 13923 hatlockp = sfmmu_hat_enter(sfmmup); 13924 13925 /* 13926 * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M 13927 * region to allow for large page allocation failure. 13928 */ 13929 if (r_pgszc >= TTE4M) { 13930 sfmmup->sfmmu_tsb0_4minflcnt += 13931 r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 13932 } 13933 13934 /* update sfmmu_ttecnt with the shme rgn ttecnt */ 13935 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 13936 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], 13937 rttecnt); 13938 13939 if (text && r_pgszc >= TTE4M && 13940 (tteflag || ((disable_large_pages >> TTE4M) & 13941 ((1 << (r_pgszc - TTE4M + 1)) - 1))) && 13942 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) { 13943 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG); 13944 } 13945 13946 sfmmu_hat_exit(hatlockp); 13947 /* 13948 * On Panther we need to make sure TLB is programmed 13949 * to accept 32M/256M pages. Call 13950 * sfmmu_check_page_sizes() now to make sure TLB is 13951 * setup before making hmeregions visible to other 13952 * threads. 13953 */ 13954 sfmmu_check_page_sizes(sfmmup, 1); 13955 hatlockp = sfmmu_hat_enter(sfmmup); 13956 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid); 13957 13958 /* 13959 * if context is invalid tsb miss exception code will 13960 * call sfmmu_check_page_sizes() and update tsbmiss 13961 * area later. 13962 */ 13963 kpreempt_disable(); 13964 if (myjoin && 13965 (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum 13966 != INVALID_CONTEXT)) { 13967 struct tsbmiss *tsbmp; 13968 13969 tsbmp = &tsbmiss_area[CPU->cpu_id]; 13970 ASSERT(sfmmup == tsbmp->usfmmup); 13971 BT_SET(tsbmp->shmermap, rid); 13972 if (r_pgszc > TTE64K) { 13973 tsbmp->uhat_rtteflags |= tteflag; 13974 } 13975 13976 } 13977 kpreempt_enable(); 13978 13979 sfmmu_hat_exit(hatlockp); 13980 ASSERT((hat_region_cookie_t)((uint64_t)rid) != 13981 HAT_INVALID_REGION_COOKIE); 13982 } else { 13983 hatlockp = sfmmu_hat_enter(sfmmup); 13984 SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid); 13985 sfmmu_hat_exit(hatlockp); 13986 } 13987 ASSERT(rid < maxids); 13988 13989 if (r_type == SFMMU_REGION_ISM) { 13990 sfmmu_find_scd(sfmmup); 13991 } 13992 return ((hat_region_cookie_t)((uint64_t)rid)); 13993 } 13994 13995 ASSERT(new_rgnp == NULL); 13996 13997 if (*busyrgnsp >= maxids) { 13998 mutex_exit(&srdp->srd_mutex); 13999 return (HAT_INVALID_REGION_COOKIE); 14000 } 14001 14002 ASSERT(MUTEX_HELD(&srdp->srd_mutex)); 14003 if (*freelistp != NULL) { 14004 rgnp = *freelistp; 14005 *freelistp = rgnp->rgn_next; 14006 ASSERT(rgnp->rgn_id < *nextidp); 14007 ASSERT(rgnp->rgn_id < maxids); 14008 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 14009 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) 14010 == r_type); 14011 ASSERT(rarrp[rgnp->rgn_id] == rgnp); 14012 ASSERT(rgnp->rgn_hmeflags == 0); 14013 } else { 14014 /* 14015 * release local locks before memory allocation. 14016 */ 14017 mutex_exit(&srdp->srd_mutex); 14018 14019 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP); 14020 14021 mutex_enter(&srdp->srd_mutex); 14022 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL; 14023 rgnp = rgnp->rgn_hash) { 14024 if (rgnp->rgn_saddr == r_saddr && 14025 rgnp->rgn_size == r_size && 14026 rgnp->rgn_obj == r_obj && 14027 rgnp->rgn_objoff == r_objoff && 14028 rgnp->rgn_perm == r_perm && 14029 rgnp->rgn_pgszc == r_pgszc) { 14030 break; 14031 } 14032 } 14033 if (rgnp != NULL) { 14034 goto rfound; 14035 } 14036 14037 if (*nextidp >= maxids) { 14038 mutex_exit(&srdp->srd_mutex); 14039 goto fail; 14040 } 14041 rgnp = new_rgnp; 14042 new_rgnp = NULL; 14043 rgnp->rgn_id = (*nextidp)++; 14044 ASSERT(rgnp->rgn_id < maxids); 14045 ASSERT(rarrp[rgnp->rgn_id] == NULL); 14046 rarrp[rgnp->rgn_id] = rgnp; 14047 } 14048 14049 ASSERT(rgnp->rgn_sfmmu_head == NULL); 14050 ASSERT(rgnp->rgn_hmeflags == 0); 14051 #ifdef DEBUG 14052 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14053 ASSERT(rgnp->rgn_ttecnt[i] == 0); 14054 } 14055 #endif 14056 rgnp->rgn_saddr = r_saddr; 14057 rgnp->rgn_size = r_size; 14058 rgnp->rgn_obj = r_obj; 14059 rgnp->rgn_objoff = r_objoff; 14060 rgnp->rgn_perm = r_perm; 14061 rgnp->rgn_pgszc = r_pgszc; 14062 rgnp->rgn_flags = r_type; 14063 rgnp->rgn_refcnt = 0; 14064 rgnp->rgn_cb_function = r_cb_function; 14065 rgnp->rgn_hash = srdp->srd_rgnhash[rhash]; 14066 srdp->srd_rgnhash[rhash] = rgnp; 14067 (*busyrgnsp)++; 14068 ASSERT(*busyrgnsp <= maxids); 14069 goto rfound; 14070 14071 fail: 14072 ASSERT(new_rgnp != NULL); 14073 kmem_cache_free(region_cache, new_rgnp); 14074 return (HAT_INVALID_REGION_COOKIE); 14075 } 14076 14077 /* 14078 * This function implements the shared context functionality required 14079 * when detaching a segment from an address space. It must be called 14080 * from hat_unshare() for all D(ISM) segments and from segvn_unmap(), 14081 * for segments with a valid region_cookie. 14082 * It will also be called from all seg_vn routines which change a 14083 * segment's attributes such as segvn_setprot(), segvn_setpagesize(), 14084 * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault 14085 * from segvn_fault(). 14086 */ 14087 void 14088 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags) 14089 { 14090 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14091 sf_scd_t *scdp; 14092 uint_t rhash; 14093 uint_t rid = (uint_t)((uint64_t)rcookie); 14094 hatlock_t *hatlockp = NULL; 14095 sf_region_t *rgnp; 14096 sf_region_t **prev_rgnpp; 14097 sf_region_t *cur_rgnp; 14098 void *r_obj; 14099 int i; 14100 caddr_t r_saddr; 14101 caddr_t r_eaddr; 14102 size_t r_size; 14103 uchar_t r_pgszc; 14104 uchar_t r_type = flags & HAT_REGION_TYPE_MASK; 14105 14106 ASSERT(sfmmup != ksfmmup); 14107 ASSERT(srdp != NULL); 14108 ASSERT(srdp->srd_refcnt > 0); 14109 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK)); 14110 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM); 14111 ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL); 14112 14113 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM : 14114 SFMMU_REGION_HME; 14115 14116 if (r_type == SFMMU_REGION_ISM) { 14117 ASSERT(SFMMU_IS_ISMRID_VALID(rid)); 14118 ASSERT(rid < SFMMU_MAX_ISM_REGIONS); 14119 rgnp = srdp->srd_ismrgnp[rid]; 14120 } else { 14121 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14122 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 14123 rgnp = srdp->srd_hmergnp[rid]; 14124 } 14125 ASSERT(rgnp != NULL); 14126 ASSERT(rgnp->rgn_id == rid); 14127 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 14128 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE)); 14129 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as)); 14130 14131 if (sfmmup->sfmmu_free) { 14132 ulong_t rttecnt; 14133 r_pgszc = rgnp->rgn_pgszc; 14134 r_size = rgnp->rgn_size; 14135 14136 ASSERT(sfmmup->sfmmu_scdp == NULL); 14137 if (r_type == SFMMU_REGION_ISM) { 14138 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid); 14139 } else { 14140 /* update shme rgns ttecnt in sfmmu_ttecnt */ 14141 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 14142 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt); 14143 14144 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], 14145 -rttecnt); 14146 14147 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid); 14148 } 14149 } else if (r_type == SFMMU_REGION_ISM) { 14150 hatlockp = sfmmu_hat_enter(sfmmup); 14151 ASSERT(rid < srdp->srd_next_ismrid); 14152 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid); 14153 scdp = sfmmup->sfmmu_scdp; 14154 if (scdp != NULL && 14155 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) { 14156 sfmmu_leave_scd(sfmmup, r_type); 14157 ASSERT(sfmmu_hat_lock_held(sfmmup)); 14158 } 14159 sfmmu_hat_exit(hatlockp); 14160 } else { 14161 ulong_t rttecnt; 14162 r_pgszc = rgnp->rgn_pgszc; 14163 r_saddr = rgnp->rgn_saddr; 14164 r_size = rgnp->rgn_size; 14165 r_eaddr = r_saddr + r_size; 14166 14167 ASSERT(r_type == SFMMU_REGION_HME); 14168 hatlockp = sfmmu_hat_enter(sfmmup); 14169 ASSERT(rid < srdp->srd_next_hmerid); 14170 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid); 14171 14172 /* 14173 * If region is part of an SCD call sfmmu_leave_scd(). 14174 * Otherwise if process is not exiting and has valid context 14175 * just drop the context on the floor to lose stale TLB 14176 * entries and force the update of tsb miss area to reflect 14177 * the new region map. After that clean our TSB entries. 14178 */ 14179 scdp = sfmmup->sfmmu_scdp; 14180 if (scdp != NULL && 14181 SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 14182 sfmmu_leave_scd(sfmmup, r_type); 14183 ASSERT(sfmmu_hat_lock_held(sfmmup)); 14184 } 14185 sfmmu_invalidate_ctx(sfmmup); 14186 14187 i = TTE8K; 14188 while (i < mmu_page_sizes) { 14189 if (rgnp->rgn_ttecnt[i] != 0) { 14190 sfmmu_unload_tsb_range(sfmmup, r_saddr, 14191 r_eaddr, i); 14192 if (i < TTE4M) { 14193 i = TTE4M; 14194 continue; 14195 } else { 14196 break; 14197 } 14198 } 14199 i++; 14200 } 14201 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */ 14202 if (r_pgszc >= TTE4M) { 14203 rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 14204 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >= 14205 rttecnt); 14206 sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt; 14207 } 14208 14209 /* update shme rgns ttecnt in sfmmu_ttecnt */ 14210 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 14211 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt); 14212 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt); 14213 14214 sfmmu_hat_exit(hatlockp); 14215 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) { 14216 /* sfmmup left the scd, grow private tsb */ 14217 sfmmu_check_page_sizes(sfmmup, 1); 14218 } else { 14219 sfmmu_check_page_sizes(sfmmup, 0); 14220 } 14221 } 14222 14223 if (r_type == SFMMU_REGION_HME) { 14224 sfmmu_unlink_from_hmeregion(sfmmup, rgnp); 14225 } 14226 14227 r_obj = rgnp->rgn_obj; 14228 if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) { 14229 return; 14230 } 14231 14232 /* 14233 * looks like nobody uses this region anymore. Free it. 14234 */ 14235 rhash = RGN_HASH_FUNCTION(r_obj); 14236 mutex_enter(&srdp->srd_mutex); 14237 for (prev_rgnpp = &srdp->srd_rgnhash[rhash]; 14238 (cur_rgnp = *prev_rgnpp) != NULL; 14239 prev_rgnpp = &cur_rgnp->rgn_hash) { 14240 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) { 14241 break; 14242 } 14243 } 14244 14245 if (cur_rgnp == NULL) { 14246 mutex_exit(&srdp->srd_mutex); 14247 return; 14248 } 14249 14250 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 14251 *prev_rgnpp = rgnp->rgn_hash; 14252 if (r_type == SFMMU_REGION_ISM) { 14253 rgnp->rgn_flags |= SFMMU_REGION_FREE; 14254 ASSERT(rid < srdp->srd_next_ismrid); 14255 rgnp->rgn_next = srdp->srd_ismrgnfree; 14256 srdp->srd_ismrgnfree = rgnp; 14257 ASSERT(srdp->srd_ismbusyrgns > 0); 14258 srdp->srd_ismbusyrgns--; 14259 mutex_exit(&srdp->srd_mutex); 14260 return; 14261 } 14262 mutex_exit(&srdp->srd_mutex); 14263 14264 /* 14265 * Destroy region's hmeblks. 14266 */ 14267 sfmmu_unload_hmeregion(srdp, rgnp); 14268 14269 rgnp->rgn_hmeflags = 0; 14270 14271 ASSERT(rgnp->rgn_sfmmu_head == NULL); 14272 ASSERT(rgnp->rgn_id == rid); 14273 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14274 rgnp->rgn_ttecnt[i] = 0; 14275 } 14276 rgnp->rgn_flags |= SFMMU_REGION_FREE; 14277 mutex_enter(&srdp->srd_mutex); 14278 ASSERT(rid < srdp->srd_next_hmerid); 14279 rgnp->rgn_next = srdp->srd_hmergnfree; 14280 srdp->srd_hmergnfree = rgnp; 14281 ASSERT(srdp->srd_hmebusyrgns > 0); 14282 srdp->srd_hmebusyrgns--; 14283 mutex_exit(&srdp->srd_mutex); 14284 } 14285 14286 /* 14287 * For now only called for hmeblk regions and not for ISM regions. 14288 */ 14289 void 14290 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie) 14291 { 14292 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14293 uint_t rid = (uint_t)((uint64_t)rcookie); 14294 sf_region_t *rgnp; 14295 sf_rgn_link_t *rlink; 14296 sf_rgn_link_t *hrlink; 14297 ulong_t rttecnt; 14298 14299 ASSERT(sfmmup != ksfmmup); 14300 ASSERT(srdp != NULL); 14301 ASSERT(srdp->srd_refcnt > 0); 14302 14303 ASSERT(rid < srdp->srd_next_hmerid); 14304 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14305 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 14306 14307 rgnp = srdp->srd_hmergnp[rid]; 14308 ASSERT(rgnp->rgn_refcnt > 0); 14309 ASSERT(rgnp->rgn_id == rid); 14310 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME); 14311 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE)); 14312 14313 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt); 14314 14315 /* LINTED: constant in conditional context */ 14316 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0); 14317 ASSERT(rlink != NULL); 14318 mutex_enter(&rgnp->rgn_mutex); 14319 ASSERT(rgnp->rgn_sfmmu_head != NULL); 14320 /* LINTED: constant in conditional context */ 14321 SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0); 14322 ASSERT(hrlink != NULL); 14323 ASSERT(hrlink->prev == NULL); 14324 rlink->next = rgnp->rgn_sfmmu_head; 14325 rlink->prev = NULL; 14326 hrlink->prev = sfmmup; 14327 /* 14328 * make sure rlink's next field is correct 14329 * before making this link visible. 14330 */ 14331 membar_stst(); 14332 rgnp->rgn_sfmmu_head = sfmmup; 14333 mutex_exit(&rgnp->rgn_mutex); 14334 14335 /* update sfmmu_ttecnt with the shme rgn ttecnt */ 14336 rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc); 14337 atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt); 14338 /* update tsb0 inflation count */ 14339 if (rgnp->rgn_pgszc >= TTE4M) { 14340 sfmmup->sfmmu_tsb0_4minflcnt += 14341 rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 14342 } 14343 /* 14344 * Update regionid bitmask without hat lock since no other thread 14345 * can update this region bitmask right now. 14346 */ 14347 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid); 14348 } 14349 14350 /* ARGSUSED */ 14351 static int 14352 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags) 14353 { 14354 sf_region_t *rgnp = (sf_region_t *)buf; 14355 bzero(buf, sizeof (*rgnp)); 14356 14357 mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL); 14358 14359 return (0); 14360 } 14361 14362 /* ARGSUSED */ 14363 static void 14364 sfmmu_rgncache_destructor(void *buf, void *cdrarg) 14365 { 14366 sf_region_t *rgnp = (sf_region_t *)buf; 14367 mutex_destroy(&rgnp->rgn_mutex); 14368 } 14369 14370 static int 14371 sfrgnmap_isnull(sf_region_map_t *map) 14372 { 14373 int i; 14374 14375 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14376 if (map->bitmap[i] != 0) { 14377 return (0); 14378 } 14379 } 14380 return (1); 14381 } 14382 14383 static int 14384 sfhmergnmap_isnull(sf_hmeregion_map_t *map) 14385 { 14386 int i; 14387 14388 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 14389 if (map->bitmap[i] != 0) { 14390 return (0); 14391 } 14392 } 14393 return (1); 14394 } 14395 14396 #ifdef DEBUG 14397 static void 14398 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist) 14399 { 14400 sfmmu_t *sp; 14401 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14402 14403 for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) { 14404 ASSERT(srdp == sp->sfmmu_srdp); 14405 if (sp == sfmmup) { 14406 if (onlist) { 14407 return; 14408 } else { 14409 panic("shctx: sfmmu 0x%p found on scd" 14410 "list 0x%p", (void *)sfmmup, 14411 (void *)*headp); 14412 } 14413 } 14414 } 14415 if (onlist) { 14416 panic("shctx: sfmmu 0x%p not found on scd list 0x%p", 14417 (void *)sfmmup, (void *)*headp); 14418 } else { 14419 return; 14420 } 14421 } 14422 #else /* DEBUG */ 14423 #define check_scd_sfmmu_list(headp, sfmmup, onlist) 14424 #endif /* DEBUG */ 14425 14426 /* 14427 * Removes an sfmmu from the SCD sfmmu list. 14428 */ 14429 static void 14430 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup) 14431 { 14432 ASSERT(sfmmup->sfmmu_srdp != NULL); 14433 check_scd_sfmmu_list(headp, sfmmup, 1); 14434 if (sfmmup->sfmmu_scd_link.prev != NULL) { 14435 ASSERT(*headp != sfmmup); 14436 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next = 14437 sfmmup->sfmmu_scd_link.next; 14438 } else { 14439 ASSERT(*headp == sfmmup); 14440 *headp = sfmmup->sfmmu_scd_link.next; 14441 } 14442 if (sfmmup->sfmmu_scd_link.next != NULL) { 14443 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev = 14444 sfmmup->sfmmu_scd_link.prev; 14445 } 14446 } 14447 14448 14449 /* 14450 * Adds an sfmmu to the start of the queue. 14451 */ 14452 static void 14453 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup) 14454 { 14455 check_scd_sfmmu_list(headp, sfmmup, 0); 14456 sfmmup->sfmmu_scd_link.prev = NULL; 14457 sfmmup->sfmmu_scd_link.next = *headp; 14458 if (*headp != NULL) 14459 (*headp)->sfmmu_scd_link.prev = sfmmup; 14460 *headp = sfmmup; 14461 } 14462 14463 /* 14464 * Remove an scd from the start of the queue. 14465 */ 14466 static void 14467 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp) 14468 { 14469 if (scdp->scd_prev != NULL) { 14470 ASSERT(*headp != scdp); 14471 scdp->scd_prev->scd_next = scdp->scd_next; 14472 } else { 14473 ASSERT(*headp == scdp); 14474 *headp = scdp->scd_next; 14475 } 14476 14477 if (scdp->scd_next != NULL) { 14478 scdp->scd_next->scd_prev = scdp->scd_prev; 14479 } 14480 } 14481 14482 /* 14483 * Add an scd to the start of the queue. 14484 */ 14485 static void 14486 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp) 14487 { 14488 scdp->scd_prev = NULL; 14489 scdp->scd_next = *headp; 14490 if (*headp != NULL) { 14491 (*headp)->scd_prev = scdp; 14492 } 14493 *headp = scdp; 14494 } 14495 14496 static int 14497 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp) 14498 { 14499 uint_t rid; 14500 uint_t i; 14501 uint_t j; 14502 ulong_t w; 14503 sf_region_t *rgnp; 14504 ulong_t tte8k_cnt = 0; 14505 ulong_t tte4m_cnt = 0; 14506 uint_t tsb_szc; 14507 sfmmu_t *scsfmmup = scdp->scd_sfmmup; 14508 sfmmu_t *ism_hatid; 14509 struct tsb_info *newtsb; 14510 int szc; 14511 14512 ASSERT(srdp != NULL); 14513 14514 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14515 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14516 continue; 14517 } 14518 j = 0; 14519 while (w) { 14520 if (!(w & 0x1)) { 14521 j++; 14522 w >>= 1; 14523 continue; 14524 } 14525 rid = (i << BT_ULSHIFT) | j; 14526 j++; 14527 w >>= 1; 14528 14529 if (rid < SFMMU_MAX_HME_REGIONS) { 14530 rgnp = srdp->srd_hmergnp[rid]; 14531 ASSERT(rgnp->rgn_id == rid); 14532 ASSERT(rgnp->rgn_refcnt > 0); 14533 14534 if (rgnp->rgn_pgszc < TTE4M) { 14535 tte8k_cnt += rgnp->rgn_size >> 14536 TTE_PAGE_SHIFT(TTE8K); 14537 } else { 14538 ASSERT(rgnp->rgn_pgszc >= TTE4M); 14539 tte4m_cnt += rgnp->rgn_size >> 14540 TTE_PAGE_SHIFT(TTE4M); 14541 /* 14542 * Inflate SCD tsb0 by preallocating 14543 * 1/4 8k ttecnt for 4M regions to 14544 * allow for lgpg alloc failure. 14545 */ 14546 tte8k_cnt += rgnp->rgn_size >> 14547 (TTE_PAGE_SHIFT(TTE8K) + 2); 14548 } 14549 } else { 14550 rid -= SFMMU_MAX_HME_REGIONS; 14551 rgnp = srdp->srd_ismrgnp[rid]; 14552 ASSERT(rgnp->rgn_id == rid); 14553 ASSERT(rgnp->rgn_refcnt > 0); 14554 14555 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14556 ASSERT(ism_hatid->sfmmu_ismhat); 14557 14558 for (szc = 0; szc < TTE4M; szc++) { 14559 tte8k_cnt += 14560 ism_hatid->sfmmu_ttecnt[szc] << 14561 TTE_BSZS_SHIFT(szc); 14562 } 14563 14564 ASSERT(rgnp->rgn_pgszc >= TTE4M); 14565 if (rgnp->rgn_pgszc >= TTE4M) { 14566 tte4m_cnt += rgnp->rgn_size >> 14567 TTE_PAGE_SHIFT(TTE4M); 14568 } 14569 } 14570 } 14571 } 14572 14573 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt); 14574 14575 /* Allocate both the SCD TSBs here. */ 14576 if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb, 14577 tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) && 14578 (tsb_szc <= TSB_4M_SZCODE || 14579 sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb, 14580 TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K, 14581 TSB_ALLOC, scsfmmup))) { 14582 14583 SFMMU_STAT(sf_scd_1sttsb_allocfail); 14584 return (TSB_ALLOCFAIL); 14585 } else { 14586 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX; 14587 14588 if (tte4m_cnt) { 14589 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt); 14590 if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, 14591 TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) && 14592 (tsb_szc <= TSB_4M_SZCODE || 14593 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE, 14594 TSB4M|TSB32M|TSB256M, 14595 TSB_ALLOC, scsfmmup))) { 14596 /* 14597 * If we fail to allocate the 2nd shared tsb, 14598 * just free the 1st tsb, return failure. 14599 */ 14600 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb); 14601 SFMMU_STAT(sf_scd_2ndtsb_allocfail); 14602 return (TSB_ALLOCFAIL); 14603 } else { 14604 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL); 14605 newtsb->tsb_flags |= TSB_SHAREDCTX; 14606 scsfmmup->sfmmu_tsb->tsb_next = newtsb; 14607 SFMMU_STAT(sf_scd_2ndtsb_alloc); 14608 } 14609 } 14610 SFMMU_STAT(sf_scd_1sttsb_alloc); 14611 } 14612 return (TSB_SUCCESS); 14613 } 14614 14615 static void 14616 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu) 14617 { 14618 while (scd_sfmmu->sfmmu_tsb != NULL) { 14619 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next; 14620 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb); 14621 scd_sfmmu->sfmmu_tsb = next; 14622 } 14623 } 14624 14625 /* 14626 * Link the sfmmu onto the hme region list. 14627 */ 14628 void 14629 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp) 14630 { 14631 uint_t rid; 14632 sf_rgn_link_t *rlink; 14633 sfmmu_t *head; 14634 sf_rgn_link_t *hrlink; 14635 14636 rid = rgnp->rgn_id; 14637 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14638 14639 /* LINTED: constant in conditional context */ 14640 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1); 14641 ASSERT(rlink != NULL); 14642 mutex_enter(&rgnp->rgn_mutex); 14643 if ((head = rgnp->rgn_sfmmu_head) == NULL) { 14644 rlink->next = NULL; 14645 rlink->prev = NULL; 14646 /* 14647 * make sure rlink's next field is NULL 14648 * before making this link visible. 14649 */ 14650 membar_stst(); 14651 rgnp->rgn_sfmmu_head = sfmmup; 14652 } else { 14653 /* LINTED: constant in conditional context */ 14654 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0); 14655 ASSERT(hrlink != NULL); 14656 ASSERT(hrlink->prev == NULL); 14657 rlink->next = head; 14658 rlink->prev = NULL; 14659 hrlink->prev = sfmmup; 14660 /* 14661 * make sure rlink's next field is correct 14662 * before making this link visible. 14663 */ 14664 membar_stst(); 14665 rgnp->rgn_sfmmu_head = sfmmup; 14666 } 14667 mutex_exit(&rgnp->rgn_mutex); 14668 } 14669 14670 /* 14671 * Unlink the sfmmu from the hme region list. 14672 */ 14673 void 14674 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp) 14675 { 14676 uint_t rid; 14677 sf_rgn_link_t *rlink; 14678 14679 rid = rgnp->rgn_id; 14680 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14681 14682 /* LINTED: constant in conditional context */ 14683 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0); 14684 ASSERT(rlink != NULL); 14685 mutex_enter(&rgnp->rgn_mutex); 14686 if (rgnp->rgn_sfmmu_head == sfmmup) { 14687 sfmmu_t *next = rlink->next; 14688 rgnp->rgn_sfmmu_head = next; 14689 /* 14690 * if we are stopped by xc_attention() after this 14691 * point the forward link walking in 14692 * sfmmu_rgntlb_demap() will work correctly since the 14693 * head correctly points to the next element. 14694 */ 14695 membar_stst(); 14696 rlink->next = NULL; 14697 ASSERT(rlink->prev == NULL); 14698 if (next != NULL) { 14699 sf_rgn_link_t *nrlink; 14700 /* LINTED: constant in conditional context */ 14701 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0); 14702 ASSERT(nrlink != NULL); 14703 ASSERT(nrlink->prev == sfmmup); 14704 nrlink->prev = NULL; 14705 } 14706 } else { 14707 sfmmu_t *next = rlink->next; 14708 sfmmu_t *prev = rlink->prev; 14709 sf_rgn_link_t *prlink; 14710 14711 ASSERT(prev != NULL); 14712 /* LINTED: constant in conditional context */ 14713 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0); 14714 ASSERT(prlink != NULL); 14715 ASSERT(prlink->next == sfmmup); 14716 prlink->next = next; 14717 /* 14718 * if we are stopped by xc_attention() 14719 * after this point the forward link walking 14720 * will work correctly since the prev element 14721 * correctly points to the next element. 14722 */ 14723 membar_stst(); 14724 rlink->next = NULL; 14725 rlink->prev = NULL; 14726 if (next != NULL) { 14727 sf_rgn_link_t *nrlink; 14728 /* LINTED: constant in conditional context */ 14729 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0); 14730 ASSERT(nrlink != NULL); 14731 ASSERT(nrlink->prev == sfmmup); 14732 nrlink->prev = prev; 14733 } 14734 } 14735 mutex_exit(&rgnp->rgn_mutex); 14736 } 14737 14738 /* 14739 * Link scd sfmmu onto ism or hme region list for each region in the 14740 * scd region map. 14741 */ 14742 void 14743 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp) 14744 { 14745 uint_t rid; 14746 uint_t i; 14747 uint_t j; 14748 ulong_t w; 14749 sf_region_t *rgnp; 14750 sfmmu_t *scsfmmup; 14751 14752 scsfmmup = scdp->scd_sfmmup; 14753 ASSERT(scsfmmup->sfmmu_scdhat); 14754 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14755 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14756 continue; 14757 } 14758 j = 0; 14759 while (w) { 14760 if (!(w & 0x1)) { 14761 j++; 14762 w >>= 1; 14763 continue; 14764 } 14765 rid = (i << BT_ULSHIFT) | j; 14766 j++; 14767 w >>= 1; 14768 14769 if (rid < SFMMU_MAX_HME_REGIONS) { 14770 rgnp = srdp->srd_hmergnp[rid]; 14771 ASSERT(rgnp->rgn_id == rid); 14772 ASSERT(rgnp->rgn_refcnt > 0); 14773 sfmmu_link_to_hmeregion(scsfmmup, rgnp); 14774 } else { 14775 sfmmu_t *ism_hatid = NULL; 14776 ism_ment_t *ism_ment; 14777 rid -= SFMMU_MAX_HME_REGIONS; 14778 rgnp = srdp->srd_ismrgnp[rid]; 14779 ASSERT(rgnp->rgn_id == rid); 14780 ASSERT(rgnp->rgn_refcnt > 0); 14781 14782 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14783 ASSERT(ism_hatid->sfmmu_ismhat); 14784 ism_ment = &scdp->scd_ism_links[rid]; 14785 ism_ment->iment_hat = scsfmmup; 14786 ism_ment->iment_base_va = rgnp->rgn_saddr; 14787 mutex_enter(&ism_mlist_lock); 14788 iment_add(ism_ment, ism_hatid); 14789 mutex_exit(&ism_mlist_lock); 14790 14791 } 14792 } 14793 } 14794 } 14795 /* 14796 * Unlink scd sfmmu from ism or hme region list for each region in the 14797 * scd region map. 14798 */ 14799 void 14800 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp) 14801 { 14802 uint_t rid; 14803 uint_t i; 14804 uint_t j; 14805 ulong_t w; 14806 sf_region_t *rgnp; 14807 sfmmu_t *scsfmmup; 14808 14809 scsfmmup = scdp->scd_sfmmup; 14810 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14811 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14812 continue; 14813 } 14814 j = 0; 14815 while (w) { 14816 if (!(w & 0x1)) { 14817 j++; 14818 w >>= 1; 14819 continue; 14820 } 14821 rid = (i << BT_ULSHIFT) | j; 14822 j++; 14823 w >>= 1; 14824 14825 if (rid < SFMMU_MAX_HME_REGIONS) { 14826 rgnp = srdp->srd_hmergnp[rid]; 14827 ASSERT(rgnp->rgn_id == rid); 14828 ASSERT(rgnp->rgn_refcnt > 0); 14829 sfmmu_unlink_from_hmeregion(scsfmmup, 14830 rgnp); 14831 14832 } else { 14833 sfmmu_t *ism_hatid = NULL; 14834 ism_ment_t *ism_ment; 14835 rid -= SFMMU_MAX_HME_REGIONS; 14836 rgnp = srdp->srd_ismrgnp[rid]; 14837 ASSERT(rgnp->rgn_id == rid); 14838 ASSERT(rgnp->rgn_refcnt > 0); 14839 14840 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14841 ASSERT(ism_hatid->sfmmu_ismhat); 14842 ism_ment = &scdp->scd_ism_links[rid]; 14843 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup); 14844 ASSERT(ism_ment->iment_base_va == 14845 rgnp->rgn_saddr); 14846 mutex_enter(&ism_mlist_lock); 14847 iment_sub(ism_ment, ism_hatid); 14848 mutex_exit(&ism_mlist_lock); 14849 14850 } 14851 } 14852 } 14853 } 14854 /* 14855 * Allocates and initialises a new SCD structure, this is called with 14856 * the srd_scd_mutex held and returns with the reference count 14857 * initialised to 1. 14858 */ 14859 static sf_scd_t * 14860 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map) 14861 { 14862 sf_scd_t *new_scdp; 14863 sfmmu_t *scsfmmup; 14864 int i; 14865 14866 ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex)); 14867 new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP); 14868 14869 scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP); 14870 new_scdp->scd_sfmmup = scsfmmup; 14871 scsfmmup->sfmmu_srdp = srdp; 14872 scsfmmup->sfmmu_scdp = new_scdp; 14873 scsfmmup->sfmmu_tsb0_4minflcnt = 0; 14874 scsfmmup->sfmmu_scdhat = 1; 14875 CPUSET_ALL(scsfmmup->sfmmu_cpusran); 14876 bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE); 14877 14878 ASSERT(max_mmu_ctxdoms > 0); 14879 for (i = 0; i < max_mmu_ctxdoms; i++) { 14880 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT; 14881 scsfmmup->sfmmu_ctxs[i].gnum = 0; 14882 } 14883 14884 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14885 new_scdp->scd_rttecnt[i] = 0; 14886 } 14887 14888 new_scdp->scd_region_map = *new_map; 14889 new_scdp->scd_refcnt = 1; 14890 if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) { 14891 kmem_cache_free(scd_cache, new_scdp); 14892 kmem_cache_free(sfmmuid_cache, scsfmmup); 14893 return (NULL); 14894 } 14895 if (&mmu_init_scd) { 14896 mmu_init_scd(new_scdp); 14897 } 14898 return (new_scdp); 14899 } 14900 14901 /* 14902 * The first phase of a process joining an SCD. The hat structure is 14903 * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set 14904 * and a cross-call with context invalidation is used to cause the 14905 * remaining work to be carried out in the sfmmu_tsbmiss_exception() 14906 * routine. 14907 */ 14908 static void 14909 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup) 14910 { 14911 hatlock_t *hatlockp; 14912 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14913 int i; 14914 sf_scd_t *old_scdp; 14915 14916 ASSERT(srdp != NULL); 14917 ASSERT(scdp != NULL); 14918 ASSERT(scdp->scd_refcnt > 0); 14919 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 14920 14921 if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) { 14922 ASSERT(old_scdp != scdp); 14923 14924 mutex_enter(&old_scdp->scd_mutex); 14925 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup); 14926 mutex_exit(&old_scdp->scd_mutex); 14927 /* 14928 * sfmmup leaves the old scd. Update sfmmu_ttecnt to 14929 * include the shme rgn ttecnt for rgns that 14930 * were in the old SCD 14931 */ 14932 for (i = 0; i < mmu_page_sizes; i++) { 14933 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 14934 old_scdp->scd_rttecnt[i]); 14935 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 14936 sfmmup->sfmmu_scdrttecnt[i]); 14937 } 14938 } 14939 14940 /* 14941 * Move sfmmu to the scd lists. 14942 */ 14943 mutex_enter(&scdp->scd_mutex); 14944 sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup); 14945 mutex_exit(&scdp->scd_mutex); 14946 SF_SCD_INCR_REF(scdp); 14947 14948 hatlockp = sfmmu_hat_enter(sfmmup); 14949 /* 14950 * For a multi-thread process, we must stop 14951 * all the other threads before joining the scd. 14952 */ 14953 14954 SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD); 14955 14956 sfmmu_invalidate_ctx(sfmmup); 14957 sfmmup->sfmmu_scdp = scdp; 14958 14959 /* 14960 * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update 14961 * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD. 14962 */ 14963 for (i = 0; i < mmu_page_sizes; i++) { 14964 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i]; 14965 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]); 14966 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 14967 -sfmmup->sfmmu_scdrttecnt[i]); 14968 } 14969 /* update tsb0 inflation count */ 14970 if (old_scdp != NULL) { 14971 sfmmup->sfmmu_tsb0_4minflcnt += 14972 old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 14973 } 14974 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >= 14975 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt); 14976 sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 14977 14978 sfmmu_hat_exit(hatlockp); 14979 14980 if (old_scdp != NULL) { 14981 SF_SCD_DECR_REF(srdp, old_scdp); 14982 } 14983 14984 } 14985 14986 /* 14987 * This routine is called by a process to become part of an SCD. It is called 14988 * from sfmmu_tsbmiss_exception() once most of the initial work has been 14989 * done by sfmmu_join_scd(). This routine must not drop the hat lock. 14990 */ 14991 static void 14992 sfmmu_finish_join_scd(sfmmu_t *sfmmup) 14993 { 14994 struct tsb_info *tsbinfop; 14995 14996 ASSERT(sfmmu_hat_lock_held(sfmmup)); 14997 ASSERT(sfmmup->sfmmu_scdp != NULL); 14998 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)); 14999 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15000 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)); 15001 15002 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 15003 tsbinfop = tsbinfop->tsb_next) { 15004 if (tsbinfop->tsb_flags & TSB_SWAPPED) { 15005 continue; 15006 } 15007 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG)); 15008 15009 sfmmu_inv_tsb(tsbinfop->tsb_va, 15010 TSB_BYTES(tsbinfop->tsb_szc)); 15011 } 15012 15013 /* Set HAT_CTX1_FLAG for all SCD ISMs */ 15014 sfmmu_ism_hatflags(sfmmup, 1); 15015 15016 SFMMU_STAT(sf_join_scd); 15017 } 15018 15019 /* 15020 * This routine is called in order to check if there is an SCD which matches 15021 * the process's region map if not then a new SCD may be created. 15022 */ 15023 static void 15024 sfmmu_find_scd(sfmmu_t *sfmmup) 15025 { 15026 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 15027 sf_scd_t *scdp, *new_scdp; 15028 int ret; 15029 15030 ASSERT(srdp != NULL); 15031 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 15032 15033 mutex_enter(&srdp->srd_scd_mutex); 15034 for (scdp = srdp->srd_scdp; scdp != NULL; 15035 scdp = scdp->scd_next) { 15036 SF_RGNMAP_EQUAL(&scdp->scd_region_map, 15037 &sfmmup->sfmmu_region_map, ret); 15038 if (ret == 1) { 15039 SF_SCD_INCR_REF(scdp); 15040 mutex_exit(&srdp->srd_scd_mutex); 15041 sfmmu_join_scd(scdp, sfmmup); 15042 ASSERT(scdp->scd_refcnt >= 2); 15043 atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt); 15044 return; 15045 } else { 15046 /* 15047 * If the sfmmu region map is a subset of the scd 15048 * region map, then the assumption is that this process 15049 * will continue attaching to ISM segments until the 15050 * region maps are equal. 15051 */ 15052 SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map, 15053 &sfmmup->sfmmu_region_map, ret); 15054 if (ret == 1) { 15055 mutex_exit(&srdp->srd_scd_mutex); 15056 return; 15057 } 15058 } 15059 } 15060 15061 ASSERT(scdp == NULL); 15062 /* 15063 * No matching SCD has been found, create a new one. 15064 */ 15065 if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) == 15066 NULL) { 15067 mutex_exit(&srdp->srd_scd_mutex); 15068 return; 15069 } 15070 15071 /* 15072 * sfmmu_alloc_scd() returns with a ref count of 1 on the scd. 15073 */ 15074 15075 /* Set scd_rttecnt for shme rgns in SCD */ 15076 sfmmu_set_scd_rttecnt(srdp, new_scdp); 15077 15078 /* 15079 * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists. 15080 */ 15081 sfmmu_link_scd_to_regions(srdp, new_scdp); 15082 sfmmu_add_scd(&srdp->srd_scdp, new_scdp); 15083 SFMMU_STAT_ADD(sf_create_scd, 1); 15084 15085 mutex_exit(&srdp->srd_scd_mutex); 15086 sfmmu_join_scd(new_scdp, sfmmup); 15087 ASSERT(new_scdp->scd_refcnt >= 2); 15088 atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt); 15089 } 15090 15091 /* 15092 * This routine is called by a process to remove itself from an SCD. It is 15093 * either called when the processes has detached from a segment or from 15094 * hat_free_start() as a result of calling exit. 15095 */ 15096 static void 15097 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type) 15098 { 15099 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 15100 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 15101 hatlock_t *hatlockp = TSB_HASH(sfmmup); 15102 int i; 15103 15104 ASSERT(scdp != NULL); 15105 ASSERT(srdp != NULL); 15106 15107 if (sfmmup->sfmmu_free) { 15108 /* 15109 * If the process is part of an SCD the sfmmu is unlinked 15110 * from scd_sf_list. 15111 */ 15112 mutex_enter(&scdp->scd_mutex); 15113 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup); 15114 mutex_exit(&scdp->scd_mutex); 15115 /* 15116 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that 15117 * are about to leave the SCD 15118 */ 15119 for (i = 0; i < mmu_page_sizes; i++) { 15120 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 15121 scdp->scd_rttecnt[i]); 15122 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 15123 sfmmup->sfmmu_scdrttecnt[i]); 15124 sfmmup->sfmmu_scdrttecnt[i] = 0; 15125 } 15126 sfmmup->sfmmu_scdp = NULL; 15127 15128 SF_SCD_DECR_REF(srdp, scdp); 15129 return; 15130 } 15131 15132 ASSERT(r_type != SFMMU_REGION_ISM || 15133 SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15134 ASSERT(scdp->scd_refcnt); 15135 ASSERT(!sfmmup->sfmmu_free); 15136 ASSERT(sfmmu_hat_lock_held(sfmmup)); 15137 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as)); 15138 15139 /* 15140 * Wait for ISM maps to be updated. 15141 */ 15142 if (r_type != SFMMU_REGION_ISM) { 15143 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) && 15144 sfmmup->sfmmu_scdp != NULL) { 15145 cv_wait(&sfmmup->sfmmu_tsb_cv, 15146 HATLOCK_MUTEXP(hatlockp)); 15147 } 15148 15149 if (sfmmup->sfmmu_scdp == NULL) { 15150 sfmmu_hat_exit(hatlockp); 15151 return; 15152 } 15153 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY); 15154 } 15155 15156 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 15157 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD); 15158 /* 15159 * Since HAT_JOIN_SCD was set our context 15160 * is still invalid. 15161 */ 15162 } else { 15163 /* 15164 * For a multi-thread process, we must stop 15165 * all the other threads before leaving the scd. 15166 */ 15167 15168 sfmmu_invalidate_ctx(sfmmup); 15169 } 15170 15171 /* Clear all the rid's for ISM, delete flags, etc */ 15172 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15173 sfmmu_ism_hatflags(sfmmup, 0); 15174 15175 /* 15176 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that 15177 * are in SCD before this sfmmup leaves the SCD. 15178 */ 15179 for (i = 0; i < mmu_page_sizes; i++) { 15180 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 15181 scdp->scd_rttecnt[i]); 15182 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 15183 sfmmup->sfmmu_scdrttecnt[i]); 15184 sfmmup->sfmmu_scdrttecnt[i] = 0; 15185 /* update ismttecnt to include SCD ism before hat leaves SCD */ 15186 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i]; 15187 sfmmup->sfmmu_scdismttecnt[i] = 0; 15188 } 15189 /* update tsb0 inflation count */ 15190 sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 15191 15192 if (r_type != SFMMU_REGION_ISM) { 15193 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY); 15194 } 15195 sfmmup->sfmmu_scdp = NULL; 15196 15197 sfmmu_hat_exit(hatlockp); 15198 15199 /* 15200 * Unlink sfmmu from scd_sf_list this can be done without holding 15201 * the hat lock as we hold the sfmmu_as lock which prevents 15202 * hat_join_region from adding this thread to the scd again. Other 15203 * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL 15204 * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp 15205 * while holding the hat lock. 15206 */ 15207 mutex_enter(&scdp->scd_mutex); 15208 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup); 15209 mutex_exit(&scdp->scd_mutex); 15210 SFMMU_STAT(sf_leave_scd); 15211 15212 SF_SCD_DECR_REF(srdp, scdp); 15213 hatlockp = sfmmu_hat_enter(sfmmup); 15214 15215 } 15216 15217 /* 15218 * Unlink and free up an SCD structure with a reference count of 0. 15219 */ 15220 static void 15221 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap) 15222 { 15223 sfmmu_t *scsfmmup; 15224 sf_scd_t *sp; 15225 hatlock_t *shatlockp; 15226 int i, ret; 15227 15228 mutex_enter(&srdp->srd_scd_mutex); 15229 for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) { 15230 if (sp == scdp) 15231 break; 15232 } 15233 if (sp == NULL || sp->scd_refcnt) { 15234 mutex_exit(&srdp->srd_scd_mutex); 15235 return; 15236 } 15237 15238 /* 15239 * It is possible that the scd has been freed and reallocated with a 15240 * different region map while we've been waiting for the srd_scd_mutex. 15241 */ 15242 SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret); 15243 if (ret != 1) { 15244 mutex_exit(&srdp->srd_scd_mutex); 15245 return; 15246 } 15247 15248 ASSERT(scdp->scd_sf_list == NULL); 15249 /* 15250 * Unlink scd from srd_scdp list. 15251 */ 15252 sfmmu_remove_scd(&srdp->srd_scdp, scdp); 15253 mutex_exit(&srdp->srd_scd_mutex); 15254 15255 sfmmu_unlink_scd_from_regions(srdp, scdp); 15256 15257 /* Clear shared context tsb and release ctx */ 15258 scsfmmup = scdp->scd_sfmmup; 15259 15260 /* 15261 * create a barrier so that scd will not be destroyed 15262 * if other thread still holds the same shared hat lock. 15263 * E.g., sfmmu_tsbmiss_exception() needs to acquire the 15264 * shared hat lock before checking the shared tsb reloc flag. 15265 */ 15266 shatlockp = sfmmu_hat_enter(scsfmmup); 15267 sfmmu_hat_exit(shatlockp); 15268 15269 sfmmu_free_scd_tsbs(scsfmmup); 15270 15271 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 15272 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) { 15273 kmem_free(scsfmmup->sfmmu_hmeregion_links[i], 15274 SFMMU_L2_HMERLINKS_SIZE); 15275 scsfmmup->sfmmu_hmeregion_links[i] = NULL; 15276 } 15277 } 15278 kmem_cache_free(sfmmuid_cache, scsfmmup); 15279 kmem_cache_free(scd_cache, scdp); 15280 SFMMU_STAT(sf_destroy_scd); 15281 } 15282 15283 /* 15284 * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to 15285 * bits which are set in the ism_region_map parameter. This flag indicates to 15286 * the tsbmiss handler that mapping for these segments should be loaded using 15287 * the shared context. 15288 */ 15289 static void 15290 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag) 15291 { 15292 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 15293 ism_blk_t *ism_blkp; 15294 ism_map_t *ism_map; 15295 int i, rid; 15296 15297 ASSERT(sfmmup->sfmmu_iblk != NULL); 15298 ASSERT(scdp != NULL); 15299 /* 15300 * Note that the caller either set HAT_ISMBUSY flag or checked 15301 * under hat lock that HAT_ISMBUSY was not set by another thread. 15302 */ 15303 ASSERT(sfmmu_hat_lock_held(sfmmup)); 15304 15305 ism_blkp = sfmmup->sfmmu_iblk; 15306 while (ism_blkp != NULL) { 15307 ism_map = ism_blkp->iblk_maps; 15308 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) { 15309 rid = ism_map[i].imap_rid; 15310 if (rid == SFMMU_INVALID_ISMRID) { 15311 continue; 15312 } 15313 ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS); 15314 if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) && 15315 addflag) { 15316 ism_map[i].imap_hatflags |= 15317 HAT_CTX1_FLAG; 15318 } else { 15319 ism_map[i].imap_hatflags &= 15320 ~HAT_CTX1_FLAG; 15321 } 15322 } 15323 ism_blkp = ism_blkp->iblk_next; 15324 } 15325 } 15326 15327 static int 15328 sfmmu_srd_lock_held(sf_srd_t *srdp) 15329 { 15330 return (MUTEX_HELD(&srdp->srd_mutex)); 15331 } 15332 15333 /* ARGSUSED */ 15334 static int 15335 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags) 15336 { 15337 sf_scd_t *scdp = (sf_scd_t *)buf; 15338 15339 bzero(buf, sizeof (sf_scd_t)); 15340 mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL); 15341 return (0); 15342 } 15343 15344 /* ARGSUSED */ 15345 static void 15346 sfmmu_scdcache_destructor(void *buf, void *cdrarg) 15347 { 15348 sf_scd_t *scdp = (sf_scd_t *)buf; 15349 15350 mutex_destroy(&scdp->scd_mutex); 15351 } 15352 15353 /* 15354 * The listp parameter is a pointer to a list of hmeblks which are partially 15355 * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the 15356 * freeing process is to cross-call all cpus to ensure that there are no 15357 * remaining cached references. 15358 * 15359 * If the local generation number is less than the global then we can free 15360 * hmeblks which are already on the pending queue as another cpu has completed 15361 * the cross-call. 15362 * 15363 * We cross-call to make sure that there are no threads on other cpus accessing 15364 * these hmblks and then complete the process of freeing them under the 15365 * following conditions: 15366 * The total number of pending hmeblks is greater than the threshold 15367 * The reserve list has fewer than HBLK_RESERVE_CNT hmeblks 15368 * It is at least 1 second since the last time we cross-called 15369 * 15370 * Otherwise, we add the hmeblks to the per-cpu pending queue. 15371 */ 15372 static void 15373 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree) 15374 { 15375 struct hme_blk *hblkp, *pr_hblkp = NULL; 15376 int count = 0; 15377 cpuset_t cpuset = cpu_ready_set; 15378 cpu_hme_pend_t *cpuhp; 15379 timestruc_t now; 15380 int one_second_expired = 0; 15381 15382 gethrestime_lasttick(&now); 15383 15384 for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) { 15385 ASSERT(hblkp->hblk_shw_bit == 0); 15386 ASSERT(hblkp->hblk_shared == 0); 15387 count++; 15388 pr_hblkp = hblkp; 15389 } 15390 15391 cpuhp = &cpu_hme_pend[CPU->cpu_seqid]; 15392 mutex_enter(&cpuhp->chp_mutex); 15393 15394 if ((cpuhp->chp_count + count) == 0) { 15395 mutex_exit(&cpuhp->chp_mutex); 15396 return; 15397 } 15398 15399 if ((now.tv_sec - cpuhp->chp_timestamp) > 1) { 15400 one_second_expired = 1; 15401 } 15402 15403 if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT || 15404 (cpuhp->chp_count + count) > cpu_hme_pend_thresh || 15405 one_second_expired)) { 15406 /* Append global list to local */ 15407 if (pr_hblkp == NULL) { 15408 *listp = cpuhp->chp_listp; 15409 } else { 15410 pr_hblkp->hblk_next = cpuhp->chp_listp; 15411 } 15412 cpuhp->chp_listp = NULL; 15413 cpuhp->chp_count = 0; 15414 cpuhp->chp_timestamp = now.tv_sec; 15415 mutex_exit(&cpuhp->chp_mutex); 15416 15417 kpreempt_disable(); 15418 CPUSET_DEL(cpuset, CPU->cpu_id); 15419 xt_sync(cpuset); 15420 xt_sync(cpuset); 15421 kpreempt_enable(); 15422 15423 /* 15424 * At this stage we know that no trap handlers on other 15425 * cpus can have references to hmeblks on the list. 15426 */ 15427 sfmmu_hblk_free(listp); 15428 } else if (*listp != NULL) { 15429 pr_hblkp->hblk_next = cpuhp->chp_listp; 15430 cpuhp->chp_listp = *listp; 15431 cpuhp->chp_count += count; 15432 *listp = NULL; 15433 mutex_exit(&cpuhp->chp_mutex); 15434 } else { 15435 mutex_exit(&cpuhp->chp_mutex); 15436 } 15437 } 15438 15439 /* 15440 * Add an hmeblk to the the hash list. 15441 */ 15442 void 15443 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 15444 uint64_t hblkpa) 15445 { 15446 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 15447 #ifdef DEBUG 15448 if (hmebp->hmeblkp == NULL) { 15449 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA); 15450 } 15451 #endif /* DEBUG */ 15452 15453 hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa; 15454 /* 15455 * Since the TSB miss handler now does not lock the hash chain before 15456 * walking it, make sure that the hmeblks nextpa is globally visible 15457 * before we make the hmeblk globally visible by updating the chain root 15458 * pointer in the hash bucket. 15459 */ 15460 membar_producer(); 15461 hmebp->hmeh_nextpa = hblkpa; 15462 hmeblkp->hblk_next = hmebp->hmeblkp; 15463 hmebp->hmeblkp = hmeblkp; 15464 15465 } 15466 15467 /* 15468 * This function is the first part of a 2 part process to remove an hmeblk 15469 * from the hash chain. In this phase we unlink the hmeblk from the hash chain 15470 * but leave the next physical pointer unchanged. The hmeblk is then linked onto 15471 * a per-cpu pending list using the virtual address pointer. 15472 * 15473 * TSB miss trap handlers that start after this phase will no longer see 15474 * this hmeblk. TSB miss handlers that still cache this hmeblk in a register 15475 * can still use it for further chain traversal because we haven't yet modifed 15476 * the next physical pointer or freed it. 15477 * 15478 * In the second phase of hmeblk removal we'll issue a barrier xcall before 15479 * we reuse or free this hmeblk. This will make sure all lingering references to 15480 * the hmeblk after first phase disappear before we finally reclaim it. 15481 * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains 15482 * during their traversal. 15483 * 15484 * The hmehash_mutex must be held when calling this function. 15485 * 15486 * Input: 15487 * hmebp - hme hash bucket pointer 15488 * hmeblkp - address of hmeblk to be removed 15489 * pr_hblk - virtual address of previous hmeblkp 15490 * listp - pointer to list of hmeblks linked by virtual address 15491 * free_now flag - indicates that a complete removal from the hash chains 15492 * is necessary. 15493 * 15494 * It is inefficient to use the free_now flag as a cross-call is required to 15495 * remove a single hmeblk from the hash chain but is necessary when hmeblks are 15496 * in short supply. 15497 */ 15498 void 15499 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 15500 struct hme_blk *pr_hblk, struct hme_blk **listp, int free_now) 15501 { 15502 int shw_size, vshift; 15503 struct hme_blk *shw_hblkp; 15504 uint_t shw_mask, newshw_mask; 15505 caddr_t vaddr; 15506 int size; 15507 cpuset_t cpuset = cpu_ready_set; 15508 15509 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 15510 15511 if (hmebp->hmeblkp == hmeblkp) { 15512 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa; 15513 hmebp->hmeblkp = hmeblkp->hblk_next; 15514 } else { 15515 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa; 15516 pr_hblk->hblk_next = hmeblkp->hblk_next; 15517 } 15518 15519 size = get_hblk_ttesz(hmeblkp); 15520 shw_hblkp = hmeblkp->hblk_shadow; 15521 if (shw_hblkp) { 15522 ASSERT(hblktosfmmu(hmeblkp) != KHATID); 15523 ASSERT(!hmeblkp->hblk_shared); 15524 #ifdef DEBUG 15525 if (mmu_page_sizes == max_mmu_page_sizes) { 15526 ASSERT(size < TTE256M); 15527 } else { 15528 ASSERT(size < TTE4M); 15529 } 15530 #endif /* DEBUG */ 15531 15532 shw_size = get_hblk_ttesz(shw_hblkp); 15533 vaddr = (caddr_t)get_hblk_base(hmeblkp); 15534 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size); 15535 ASSERT(vshift < 8); 15536 /* 15537 * Atomically clear shadow mask bit 15538 */ 15539 do { 15540 shw_mask = shw_hblkp->hblk_shw_mask; 15541 ASSERT(shw_mask & (1 << vshift)); 15542 newshw_mask = shw_mask & ~(1 << vshift); 15543 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask, 15544 shw_mask, newshw_mask); 15545 } while (newshw_mask != shw_mask); 15546 hmeblkp->hblk_shadow = NULL; 15547 } 15548 hmeblkp->hblk_shw_bit = 0; 15549 15550 if (hmeblkp->hblk_shared) { 15551 #ifdef DEBUG 15552 sf_srd_t *srdp; 15553 sf_region_t *rgnp; 15554 uint_t rid; 15555 15556 srdp = hblktosrd(hmeblkp); 15557 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 15558 rid = hmeblkp->hblk_tag.htag_rid; 15559 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 15560 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 15561 rgnp = srdp->srd_hmergnp[rid]; 15562 ASSERT(rgnp != NULL); 15563 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 15564 #endif /* DEBUG */ 15565 hmeblkp->hblk_shared = 0; 15566 } 15567 if (free_now) { 15568 kpreempt_disable(); 15569 CPUSET_DEL(cpuset, CPU->cpu_id); 15570 xt_sync(cpuset); 15571 xt_sync(cpuset); 15572 kpreempt_enable(); 15573 15574 hmeblkp->hblk_nextpa = HMEBLK_ENDPA; 15575 hmeblkp->hblk_next = NULL; 15576 } else { 15577 /* Append hmeblkp to listp for processing later. */ 15578 hmeblkp->hblk_next = *listp; 15579 *listp = hmeblkp; 15580 } 15581 } 15582 15583 /* 15584 * This routine is called when memory is in short supply and returns a free 15585 * hmeblk of the requested size from the cpu pending lists. 15586 */ 15587 static struct hme_blk * 15588 sfmmu_check_pending_hblks(int size) 15589 { 15590 int i; 15591 struct hme_blk *hmeblkp = NULL, *last_hmeblkp; 15592 int found_hmeblk; 15593 cpuset_t cpuset = cpu_ready_set; 15594 cpu_hme_pend_t *cpuhp; 15595 15596 /* Flush cpu hblk pending queues */ 15597 for (i = 0; i < NCPU; i++) { 15598 cpuhp = &cpu_hme_pend[i]; 15599 if (cpuhp->chp_listp != NULL) { 15600 mutex_enter(&cpuhp->chp_mutex); 15601 if (cpuhp->chp_listp == NULL) { 15602 mutex_exit(&cpuhp->chp_mutex); 15603 continue; 15604 } 15605 found_hmeblk = 0; 15606 last_hmeblkp = NULL; 15607 for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL; 15608 hmeblkp = hmeblkp->hblk_next) { 15609 if (get_hblk_ttesz(hmeblkp) == size) { 15610 if (last_hmeblkp == NULL) { 15611 cpuhp->chp_listp = 15612 hmeblkp->hblk_next; 15613 } else { 15614 last_hmeblkp->hblk_next = 15615 hmeblkp->hblk_next; 15616 } 15617 ASSERT(cpuhp->chp_count > 0); 15618 cpuhp->chp_count--; 15619 found_hmeblk = 1; 15620 break; 15621 } else { 15622 last_hmeblkp = hmeblkp; 15623 } 15624 } 15625 mutex_exit(&cpuhp->chp_mutex); 15626 15627 if (found_hmeblk) { 15628 kpreempt_disable(); 15629 CPUSET_DEL(cpuset, CPU->cpu_id); 15630 xt_sync(cpuset); 15631 xt_sync(cpuset); 15632 kpreempt_enable(); 15633 return (hmeblkp); 15634 } 15635 } 15636 } 15637 return (NULL); 15638 } 15639