xref: /titanic_51/usr/src/uts/common/io/winlockio.c (revision 791a814c934fcd4deb13b26c1f116ff283272a0d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 
27 /*
28  * This is the lock device driver.
29  *
30  * The lock driver provides a variation of inter-process mutexes with the
31  * following twist in semantics:
32  *	A waiter for a lock after a set timeout can "break" the lock and
33  *	grab it from the current owner (without informing the owner).
34  *
35  * These semantics result in temporarily multiple processes thinking they
36  * own the lock. This usually does not make sense for cases where locks are
37  * used to protect a critical region and it is important to serialize access
38  * to data structures. As breaking the lock will also lose the serialization
39  * and result in corrupt data structures.
40  *
41  * The usage for winlock driver is primarily driven by the graphics system
42  * when doing DGA (direct graphics access) graphics. The locks are used to
43  * protect access to the frame buffer (presumably reflects back to the screen)
44  * between competing processes that directly write to the screen as opposed
45  * to going through the window server etc.
46  * In this case, the result of breaking the lock at worst causes the screen
47  * image to be distorted and is easily fixed by doing a "refresh"
48  *
49  * In well-behaved applications, the lock is held for a very short time and
50  * the breaking semantics do not come into play. Not having this feature and
51  * using normal inter-process mutexes will result in a misbehaved application
52  * from grabbing the screen writing capability from the window manager and
53  * effectively make the system look like it is hung (mouse pointer does not
54  * move).
55  *
56  * A secondary aspect of the winlock driver is that it allows for extremely
57  * fast lock acquire/release in cases where there is low contention. A memory
58  * write is all that is needed (not even a function call). And the window
59  * manager is the only DGA writer usually and this optimized for. Occasionally
60  * some processes might do DGA graphics and cause kernel faults to handle
61  * the contention/locking (and that has got to be slow!).
62  *
63  * The following IOCTLs are supported:
64  *
65  *   GRABPAGEALLOC:
66  *	Compatibility with old cgsix device driver lockpage ioctls.
67  *	Lockpages created this way must be an entire page for compatibility with
68  *	older software.	 This ioctl allocates a lock context with its own
69  *	private lock page.  The unique "ident" that identifies this lock is
70  *	returned.
71  *
72  *   GRABPAGEFREE:
73  *	Compatibility with cgsix device driver lockpage ioctls.	 This
74  *	ioctl releases the lock context allocated by GRABPAGEALLOC.
75  *
76  *   GRABLOCKINFO:
77  *	Returns a one-word flag.  '1' means that multiple clients may
78  *	access this lock page.	Older device drivers returned '0',
79  *	meaning that only two clients could access a lock page.
80  *
81  *   GRABATTACH:
82  *	Not supported.	This ioctl would have grabbed all lock pages
83  *	on behalf of the calling program.
84  *
85  *   WINLOCKALLOC:
86  *	Allocate a lock context.  This ioctl accepts a key value.  as
87  *	its argument.  If the key is zero, a new lock context is
88  *	created, and its "ident" is returned.	If the key is nonzero,
89  *	all existing contexts are checked to see if they match they
90  *	key.  If a match is found, its reference count is incremented
91  *	and its ident is returned, otherwise a new context is created
92  *	and its ident is returned.
93  *
94  *   WINLOCKFREE:
95  *	Free a lock context.  This ioctl accepts the ident of a lock
96  *	context and decrements its reference count.  Once the reference
97  *	count reaches zero *and* all mappings are released, the lock
98  *	context is freed.  When all the lock context in the lock page are
99  *	freed, the lock page is freed as well.
100  *
101  *   WINLOCKSETTIMEOUT:
102  *	Set lock timeout for a context.	 This ioctl accepts the ident
103  *	of a lock context and a timeout value in milliseconds.
104  *	Whenever lock contention occurs, the timer is started and the lock is
105  *	broken after the timeout expires. If timeout value is zero, lock does
106  *	not timeout.  This value will be rounded to the nearest clock
107  *	tick, so don't try to use it for real-time control or something.
108  *
109  *   WINLOCKGETTIMEOUT:
110  *	Get lock timeout from a context.
111  *
112  *   WINLOCKDUMP:
113  *	Dump state of this device.
114  *
115  *
116  * How /dev/winlock works:
117  *
118  *   Every lock context consists of two mappings for the client to the lock
119  *   page.  These mappings are known as the "lock page" and "unlock page"
120  *   to the client. The first mmap to the lock context (identified by the
121  *   sy_ident field returns during alloc) allocates mapping to the lock page,
122  *   the second mmap allocates a mapping to the unlock page.
123  *	The mappings dont have to be ordered in virtual address space, but do
124  *   need to be ordered in time. Mapping and unmapping of these lock and unlock
125  *   pages should happen in pairs. Doing them one at a time or unmapping one
126  *   and leaving one mapped etc cause undefined behaviors.
127  *	The mappings are always of length PAGESIZE, and type MAP_SHARED.
128  *
129  *   The first ioctl is to ALLOC a lock, either based on a key (if trying to
130  *	grab a preexisting lock) or 0 (gets a default new one)
131  *	This ioctl returns a value in sy_ident which is needed to do the
132  *	later mmaps and FREE/other ioctls.
133  *
134  *   The "page number" portion of the sy_ident needs to be passed as the
135  *	file offset when doing an mmap for both the lock page and unlock page
136  *
137  *   The value returned by mmap ( a user virtual address) needs to be
138  *	incremented by the "page offset" portion of sy_ident to obtain the
139  *	pointer to the actual lock. (Skipping this step, does not cause any
140  *	visible error, but the process will be using the wrong lock!)
141  *
142  *	On a fork(), the child process will inherit the mappings for free, but
143  *   will not inherit the parent's lock ownership if any. The child should NOT
144  *   do an explicit FREE on the lock context unless it did an explicit ALLOC.
145  *	Only one process at a time is allowed to have a valid hat
146  *   mapping to a lock page. This is enforced by this driver.
147  *   A client acquires a lock by writing a '1' to the lock page.
148  *   Note, that it is not necessary to read and veryify that the lock is '0'
149  *	prior to writing a '1' in it.
150  *   If it does not already have a valid mapping to that page, the driver
151  *   takes a fault (devmap_access), loads the client mapping
152  *   and allows the client to continue.	 The client releases the lock by
153  *   writing a '0' to the unlock page.	Again, if it does not have a valid
154  *   mapping to the unlock page, the segment driver takes a fault,
155  *   loads the mapping, and lets the client continue.  From this point
156  *   forward, the client can make as many locks and unlocks as it
157  *   wants, without any more faults into the kernel.
158  *
159  *   If a different process wants to acquire a lock, it takes a page fault
160  *   when it writes the '1' to the lock page.  If the segment driver sees
161  *   that the lock page contained a zero, then it invalidates the owner's
162  *   mappings and gives the mappings to this process.
163  *
164  *   If there is already a '1' in the lock page when the second client
165  *   tries to access the lock page, then a lock exists.	 The segment
166  *   driver sleeps the second client and, if applicable, starts the
167  *   timeout on the lock.  The owner's mapping to the unlock page
168  *   is invalidated so that the driver will be woken again when the owner
169  *   releases the lock.
170  *
171  *   When the locking client finally writes a '0' to the unlock page, the
172  *   segment driver takes another fault.  The client is given a valid
173  *   mapping, not to the unlock page, but to the "trash page", and allowed
174  *   to continue.  Meanwhile, the sleeping client is given a valid mapping
175  *   to the lock/unlock pages and allowed to continue as well.
176  *
177  * RFE: There is a leak if process exits before freeing allocated locks
178  * But currently not tracking which locks were allocated by which
179  * process and we do not have a clean entry point into the driver
180  * to do garbage collection. If the interface used a file descriptor for each
181  * lock it allocs, then the driver can free up stuff in the _close routine
182  */
183 
184 #include <sys/types.h>		/* various type defn's */
185 #include <sys/debug.h>
186 #include <sys/param.h>		/* various kernel limits */
187 #include <sys/time.h>
188 #include <sys/errno.h>
189 #include <sys/kmem.h>		/* defines kmem_alloc() */
190 #include <sys/conf.h>		/* defines cdevsw */
191 #include <sys/file.h>		/* various file modes, etc. */
192 #include <sys/uio.h>		/* UIO stuff */
193 #include <sys/ioctl.h>
194 #include <sys/cred.h>		/* defines cred struct */
195 #include <sys/mman.h>		/* defines mmap(2) parameters */
196 #include <sys/stat.h>		/* defines S_IFCHR */
197 #include <sys/cmn_err.h>	/* use cmn_err */
198 #include <sys/ddi.h>		/* ddi stuff */
199 #include <sys/sunddi.h>		/* ddi stuff */
200 #include <sys/ddi_impldefs.h>	/* ddi stuff */
201 #include <sys/winlockio.h>	/* defines ioctls, flags, data structs */
202 
203 static int	winlock_ioctl(dev_t, int, intptr_t, int, cred_t *, int *);
204 static int	winlock_devmap(dev_t, devmap_cookie_t, offset_t, size_t,
205 			size_t *, uint_t);
206 static int	winlocksegmap(dev_t, off_t, struct as *, caddr_t *, off_t,
207 			uint_t, uint_t, uint_t, cred_t *);
208 
209 static struct cb_ops	winlock_cb_ops = {
210 	nulldev,		/* open */
211 	nulldev,		/* close */
212 	nodev,			/* strategy */
213 	nodev,			/* print */
214 	nodev,			/* dump */
215 	nodev,			/* read */
216 	nodev,			/* write */
217 	winlock_ioctl,		/* ioctl */
218 	winlock_devmap,		/* devmap */
219 	nodev,			/* mmap */
220 	winlocksegmap,		/* segmap */
221 	nochpoll,		/* poll */
222 	ddi_prop_op,		/* prop_op */
223 	NULL,			/* streamtab */
224 	D_NEW|D_MP|D_DEVMAP,	/* Driver compatibility flag */
225 	0,			/* rev */
226 	nodev,			/* aread */
227 	nodev			/* awrite */
228 };
229 
230 static int winlock_info(dev_info_t *, ddi_info_cmd_t, void *, void **);
231 static int winlock_attach(dev_info_t *, ddi_attach_cmd_t);
232 static int winlock_detach(dev_info_t *, ddi_detach_cmd_t);
233 
234 static struct dev_ops	winlock_ops = {
235 	DEVO_REV,
236 	0,			/* refcount */
237 	winlock_info,		/* info */
238 	nulldev,		/* identify */
239 	nulldev,		/* probe */
240 	winlock_attach,		/* attach */
241 	winlock_detach,		/* detach */
242 	nodev,			/* reset */
243 	&winlock_cb_ops,	/* driver ops */
244 	NULL,			/* bus ops */
245 	NULL,			/* power */
246 	ddi_quiesce_not_needed,		/* quiesce */
247 };
248 
249 static int winlockmap_map(devmap_cookie_t, dev_t, uint_t, offset_t, size_t,
250 		void **);
251 static void winlockmap_unmap(devmap_cookie_t, void *, offset_t, size_t,
252 		devmap_cookie_t, void **, devmap_cookie_t, void **);
253 static int winlockmap_dup(devmap_cookie_t, void *,
254 		devmap_cookie_t, void **);
255 static int winlockmap_access(devmap_cookie_t, void *, offset_t, size_t,
256 		uint_t, uint_t);
257 
258 static
259 struct devmap_callback_ctl winlockmap_ops = {
260 	DEVMAP_OPS_REV,
261 	winlockmap_map,
262 	winlockmap_access,
263 	winlockmap_dup,
264 	winlockmap_unmap,
265 };
266 
267 #if DEBUG
268 static	int	lock_debug = 0;
269 #define	DEBUGF(level, args)	{ if (lock_debug >= (level)) cmn_err args; }
270 #else
271 #define	DEBUGF(level, args)
272 #endif
273 
274 /* Driver supports two styles of locks */
275 enum winlock_style { NEWSTYLE_LOCK, OLDSTYLE_LOCK };
276 
277 /*
278  * These structures describe a lock context.  We permit multiple
279  * clients (not just two) to access a lock page
280  *
281  * The "cookie" identifies the lock context. It is the page number portion
282  * sy_ident returned on lock allocation. Cookie is used in later ioctls.
283  * "cookie" is lockid * PAGESIZE
284  * "lockptr" is the kernel virtual address to the lock itself
285  * The page offset portion of lockptr is the page offset portion of sy_ident
286  */
287 
288 /*
289  * per-process information about locks.  This is the private field of
290  * a devmap mapping.  Note that usually *two* mappings point to this.
291  */
292 
293 /*
294  * Each process using winlock is associated with a segproc structure
295  * In various driver entry points, we need to search to find the right
296  * segproc structure (If we were using file handles for each lock this
297  * would not have been necessary).
298  * It would have been simple to use the process pid (and ddi_get_pid)
299  * However, during fork devmap_dup is called in the parent process context
300  * and using the pid complicates the code by introducing orphans.
301  * Instead we use the as pointer for the process as a cookie
302  * which requires delving into various non-DDI kosher structs
303  */
304 typedef struct segproc {
305 	struct segproc	*next;		/* next client of this lock */
306 	struct seglock	*lp;		/* associated lock context */
307 	devmap_cookie_t	lockseg;	/* lock mapping, if any */
308 	devmap_cookie_t unlockseg;	/* unlock mapping, if any */
309 	void		*tag;		/* process as pointer as tag */
310 	uint_t		flag;		/* see "flag bits" in winlockio.h */
311 } SegProc;
312 
313 #define	ID(sdp)		((sdp)->tag)
314 #define	CURPROC_ID	(void *)(curproc->p_as)
315 
316 /* per lock context information */
317 
318 typedef struct seglock {
319 	struct seglock	*next;		/* next lock */
320 	uint_t		sleepers;	/* nthreads sleeping on this lock */
321 	uint_t		alloccount;	/* how many times created? */
322 	uint_t		cookie;		/* mmap() offset (page #) into device */
323 	uint_t		key;		/* key, if any */
324 	enum winlock_style	style;	/* style of lock - OLDSTYLE, NEWSTYLE */
325 	clock_t		timeout;	/* sleep time in ticks */
326 	ddi_umem_cookie_t umem_cookie;	/* cookie for umem allocated memory */
327 	int		*lockptr;	/* kernel virtual addr of lock */
328 	struct segproc	*clients;	/* list of clients of this lock */
329 	struct segproc	*owner;		/* current owner of lock */
330 	kmutex_t	mutex;		/* mutex for lock */
331 	kcondvar_t	locksleep;	/* for sleeping on lock */
332 } SegLock;
333 
334 #define	LOCK(lp)	(*((lp)->lockptr))
335 
336 /*
337  * Number of locks that can fit in a page. Driver can support only that many.
338  * For oldsytle locks, it is relatively easy to increase the limit as each
339  * is in a separate page (MAX_LOCKS mostly serves to prevent runaway allocation
340  * For newstyle locks, this is trickier as the code needs to allow for mapping
341  * into the second or third page of the cookie for some locks.
342  */
343 #define	MAX_LOCKS	(PAGESIZE/sizeof (int))
344 
345 #define	LOCKTIME	3	/* Default lock timeout in seconds */
346 
347 
348 /* Protections setting for winlock user mappings */
349 #define	WINLOCK_PROT	(PROT_READ|PROT_WRITE|PROT_USER)
350 
351 /*
352  * The trash page is where unwanted writes go
353  * when a process is releasing a lock.
354  */
355 static	ddi_umem_cookie_t trashpage_cookie = NULL;
356 
357 /* For newstyle allocations a common page of locks is used */
358 static	caddr_t	lockpage = NULL;
359 static	ddi_umem_cookie_t lockpage_cookie = NULL;
360 
361 static	dev_info_t	*winlock_dip = NULL;
362 static	kmutex_t	winlock_mutex;
363 
364 /*
365  * winlock_mutex protects
366  *	lock_list
367  *	lock_free_list
368  *	"next" field in SegLock
369  *	next_lock
370  *	trashpage_cookie
371  *	lockpage & lockpage_cookie
372  *
373  * SegLock_mutex protects
374  *	rest of fields in SegLock
375  *	All fields in list of SegProc (lp->clients)
376  *
377  * Lock ordering is winlock_mutex->SegLock_mutex
378  * During devmap/seg operations SegLock_mutex acquired without winlock_mutex
379  *
380  * During devmap callbacks, the pointer to SegProc is stored as the private
381  * data in the devmap handle. This pointer will not go stale (i.e., the
382  * SegProc getting deleted) as the SegProc is not deleted until both the
383  * lockseg and unlockseg have been unmapped and the pointers stored in
384  * the devmap handles have been NULL'ed.
385  * But before this pointer is used to access any fields (other than the 'lp')
386  * lp->mutex must be held.
387  */
388 
389 /*
390  * The allocation code tries to allocate from lock_free_list
391  * first, otherwise it uses kmem_zalloc.  When lock list is idle, all
392  * locks in lock_free_list are kmem_freed
393  */
394 static	SegLock	*lock_list = NULL;		/* in-use locks */
395 static	SegLock	*lock_free_list = NULL;		/* free locks */
396 static	int	next_lock = 0;			/* next lock cookie */
397 
398 /* Routines to find a lock in lock_list based on offset or key */
399 static SegLock *seglock_findlock(uint_t);
400 static SegLock *seglock_findkey(uint_t);
401 
402 /* Routines to find and allocate SegProc structures */
403 static SegProc *seglock_find_specific(SegLock *, void *);
404 static SegProc *seglock_alloc_specific(SegLock *, void *);
405 #define	seglock_findclient(lp)	seglock_find_specific((lp), CURPROC_ID)
406 #define	seglock_allocclient(lp)	seglock_alloc_specific((lp), CURPROC_ID)
407 
408 /* Delete client from lock's client list */
409 static void seglock_deleteclient(SegLock *, SegProc *);
410 static void garbage_collect_lock(SegLock *, SegProc *);
411 
412 /* Create a new lock */
413 static SegLock *seglock_createlock(enum winlock_style);
414 /* Destroy lock */
415 static void seglock_destroylock(SegLock *);
416 static void lock_destroyall(void);
417 
418 /* Helper functions in winlockmap_access */
419 static int give_mapping(SegLock *, SegProc *, uint_t);
420 static int lock_giveup(SegLock *, int);
421 static int seglock_lockfault(devmap_cookie_t, SegProc *, SegLock *, uint_t);
422 
423 /* routines called from ioctl */
424 static int seglock_graballoc(intptr_t, enum winlock_style, int);
425 static int seglock_grabinfo(intptr_t, int);
426 static int seglock_grabfree(intptr_t, int);
427 static int seglock_gettimeout(intptr_t, int);
428 static int seglock_settimeout(intptr_t, int);
429 static void seglock_dump_all(void);
430 
431 static	int
432 winlock_attach(dev_info_t *devi, ddi_attach_cmd_t cmd)
433 {
434 	DEBUGF(1, (CE_CONT, "winlock_attach, devi=%p, cmd=%d\n",
435 	    (void *)devi, (int)cmd));
436 	if (cmd != DDI_ATTACH)
437 		return (DDI_FAILURE);
438 	if (ddi_create_minor_node(devi, "winlock", S_IFCHR, 0, DDI_PSEUDO, 0)
439 	    == DDI_FAILURE) {
440 		return (DDI_FAILURE);
441 	}
442 	winlock_dip = devi;
443 	ddi_report_dev(devi);
444 	return (DDI_SUCCESS);
445 }
446 
447 /*ARGSUSED*/
448 static	int
449 winlock_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
450 {
451 	DEBUGF(1, (CE_CONT, "winlock_detach, devi=%p, cmd=%d\n",
452 	    (void *)devi, (int)cmd));
453 	if (cmd != DDI_DETACH)
454 		return (DDI_FAILURE);
455 
456 	mutex_enter(&winlock_mutex);
457 	if (lock_list != NULL) {
458 		mutex_exit(&winlock_mutex);
459 		return (DDI_FAILURE);
460 	}
461 	ASSERT(lock_free_list == NULL);
462 
463 	DEBUGF(1, (CE_CONT, "detach freeing trashpage and lockpage\n"));
464 	/* destroy any common stuff created */
465 	if (trashpage_cookie != NULL) {
466 		ddi_umem_free(trashpage_cookie);
467 		trashpage_cookie = NULL;
468 	}
469 	if (lockpage != NULL) {
470 		ddi_umem_free(lockpage_cookie);
471 		lockpage = NULL;
472 		lockpage_cookie = NULL;
473 	}
474 	winlock_dip = NULL;
475 	mutex_exit(&winlock_mutex);
476 	return (DDI_SUCCESS);
477 }
478 
479 /*ARGSUSED*/
480 static	int
481 winlock_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result)
482 {
483 	register int error;
484 
485 	/* initialize result */
486 	*result = NULL;
487 
488 	/* only valid instance (i.e., getminor) is 0 */
489 	if (getminor((dev_t)arg) >= 1)
490 		return (DDI_FAILURE);
491 
492 	switch (infocmd) {
493 	case DDI_INFO_DEVT2DEVINFO:
494 		if (winlock_dip == NULL)
495 			error = DDI_FAILURE;
496 		else {
497 			*result = (void *)winlock_dip;
498 			error = DDI_SUCCESS;
499 		}
500 		break;
501 	case DDI_INFO_DEVT2INSTANCE:
502 		*result = (void *)0;
503 		error = DDI_SUCCESS;
504 		break;
505 	default:
506 		error = DDI_FAILURE;
507 	}
508 	return (error);
509 }
510 
511 
512 /*ARGSUSED*/
513 int
514 winlock_ioctl(dev_t dev, int cmd, intptr_t arg, int mode,
515 	cred_t *cred, int *rval)
516 {
517 	DEBUGF(1, (CE_CONT, "winlockioctl: cmd=%d, arg=0x%p\n",
518 	    cmd, (void *)arg));
519 
520 	switch (cmd) {
521 	/*
522 	 * ioctls that used to be handled by framebuffers (defined in fbio.h)
523 	 * RFE: No code really calls the GRAB* ioctls now. Should EOL.
524 	 */
525 
526 	case GRABPAGEALLOC:
527 		return (seglock_graballoc(arg, OLDSTYLE_LOCK, mode));
528 	case GRABPAGEFREE:
529 		return (seglock_grabfree(arg, mode));
530 	case GRABLOCKINFO:
531 		return (seglock_grabinfo(arg, mode));
532 	case GRABATTACH:
533 		return (EINVAL); /* GRABATTACH is not supported (never was) */
534 
535 	case WINLOCKALLOC:
536 		return (seglock_graballoc(arg, NEWSTYLE_LOCK, mode));
537 	case WINLOCKFREE:
538 		return (seglock_grabfree(arg, mode));
539 	case WINLOCKSETTIMEOUT:
540 		return (seglock_settimeout(arg, mode));
541 	case WINLOCKGETTIMEOUT:
542 		return (seglock_gettimeout(arg, mode));
543 	case WINLOCKDUMP:
544 		seglock_dump_all();
545 		return (0);
546 
547 #ifdef DEBUG
548 	case (WIOC|255):
549 		lock_debug = arg;
550 		return (0);
551 #endif
552 
553 	default:
554 		return (ENOTTY);		/* Why is this not EINVAL */
555 	}
556 }
557 
558 int
559 winlocksegmap(
560 	dev_t	dev,		/* major:minor */
561 	off_t	off,		/* device offset from mmap(2) */
562 	struct as *as,		/* user's address space. */
563 	caddr_t	*addr,		/* address from mmap(2) */
564 	off_t	len,		/* length from mmap(2) */
565 	uint_t	prot,		/* user wants this access */
566 	uint_t	maxprot,	/* this is the maximum the user can have */
567 	uint_t	flags,		/* flags from mmap(2) */
568 	cred_t	*cred)
569 {
570 	DEBUGF(1, (CE_CONT, "winlock_segmap off=%lx, len=0x%lx\n", off, len));
571 
572 	/* Only MAP_SHARED mappings are supported */
573 	if ((flags & MAP_TYPE) == MAP_PRIVATE) {
574 		return (EINVAL);
575 	}
576 
577 	/* Use devmap_setup to setup the mapping */
578 	return (devmap_setup(dev, (offset_t)off, as, addr, (size_t)len, prot,
579 	    maxprot, flags, cred));
580 }
581 
582 /*ARGSUSED*/
583 int
584 winlock_devmap(dev_t dev, devmap_cookie_t dhp, offset_t off, size_t len,
585     size_t *maplen, uint_t model)
586 {
587 	SegLock *lp;
588 	int err;
589 
590 	DEBUGF(1, (CE_CONT, "winlock devmap: off=%llx, len=%lx, dhp=%p\n",
591 	    off, len, (void *)dhp));
592 
593 	*maplen = 0;
594 
595 	/* Check if the lock exists, i.e., has been created by alloc */
596 	/* off is the sy_ident returned in the alloc ioctl */
597 	if ((lp = seglock_findlock((uint_t)off)) == NULL) {
598 		return (ENXIO);
599 	}
600 
601 	/*
602 	 * The offset bits in mmap(2) offset has to be same as in lockptr
603 	 * OR the offset should be 0 (i.e. masked off)
604 	 */
605 	if (((off & PAGEOFFSET) != 0) &&
606 	    ((off ^ (uintptr_t)(lp->lockptr)) & (offset_t)PAGEOFFSET) != 0) {
607 		DEBUGF(2, (CE_CONT,
608 		    "mmap offset %llx mismatch with lockptr %p\n",
609 		    off, (void *)lp->lockptr));
610 		mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
611 		return (EINVAL);
612 	}
613 
614 	/* Only supports PAGESIZE length mappings */
615 	if (len != PAGESIZE) {
616 		mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
617 		return (EINVAL);
618 	}
619 
620 	/*
621 	 * Set up devmap to point at page associated with lock
622 	 * RFE: At this point we dont know if this is a lockpage or unlockpage
623 	 * a lockpage would not need DEVMAP_ALLOW_REMAP setting
624 	 * We could have kept track of the mapping order here,
625 	 * but devmap framework does not support storing any state in this
626 	 * devmap callback as it does not callback for error cleanup if some
627 	 * other error happens in the framework.
628 	 * RFE: We should modify the winlock mmap interface so that the
629 	 * user process marks in the offset passed in whether this is for a
630 	 * lock or unlock mapping instead of guessing based on order of maps
631 	 * This would cleanup other things (such as in fork)
632 	 */
633 	if ((err = devmap_umem_setup(dhp, winlock_dip, &winlockmap_ops,
634 	    lp->umem_cookie, 0, PAGESIZE, WINLOCK_PROT,
635 	    DEVMAP_ALLOW_REMAP, 0)) < 0) {
636 		mutex_exit(&lp->mutex);	/* held by seglock_findlock */
637 		return (err);
638 	}
639 	/*
640 	 * No mappings are loaded to those segments yet. The correctness
641 	 * of the winlock semantics depends on the devmap framework/seg_dev NOT
642 	 * loading the translations without calling _access callback.
643 	 */
644 
645 	mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
646 	*maplen = PAGESIZE;
647 	return (0);
648 }
649 
650 /*
651  * This routine is called by the devmap framework after the devmap entry point
652  * above and the mapping is setup in seg_dev.
653  * We store the pointer to the per-process context in the devmap private data.
654  */
655 /*ARGSUSED*/
656 static int
657 winlockmap_map(devmap_cookie_t dhp, dev_t dev, uint_t flags, offset_t off,
658 	size_t len, void **pvtp)
659 {
660 	SegLock *lp = seglock_findlock((uint_t)off); /* returns w/ mutex held */
661 	SegProc *sdp;
662 
663 	ASSERT(len == PAGESIZE);
664 
665 	/* Find the per-process context for this lock, alloc one if not found */
666 	sdp = seglock_allocclient(lp);
667 
668 	/*
669 	 * RFE: Determining which is a lock vs unlock seg is based on order
670 	 * of mmaps, we should change that to be derivable from off
671 	 */
672 	if (sdp->lockseg == NULL) {
673 		sdp->lockseg = dhp;
674 	} else if (sdp->unlockseg == NULL) {
675 		sdp->unlockseg = dhp;
676 	} else {
677 		/* attempting to map lock more than twice */
678 		mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
679 		return (ENOMEM);
680 	}
681 
682 	*pvtp = sdp;
683 	mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
684 	return (DDI_SUCCESS);
685 }
686 
687 /*
688  * duplicate a segment, as in fork()
689  * On fork, the child inherits the mappings to the lock
690  *	lp->alloccount is NOT incremented, so child should not do a free().
691  *	Semantics same as if done an alloc(), map(), map().
692  *	This way it would work fine if doing an exec() variant later
693  *	Child does not inherit any UFLAGS set in parent
694  * The lock and unlock pages are started off unmapped, i.e., child does not
695  *	own the lock.
696  * The code assumes that the child process has a valid pid at this point
697  * RFE: This semantics depends on fork not duplicating the hat mappings
698  *	(which is the current implementation). To enforce it would need to
699  *	call devmap_unload from here - not clear if that is allowed.
700  */
701 
702 static int
703 winlockmap_dup(devmap_cookie_t dhp, void *oldpvt, devmap_cookie_t new_dhp,
704 	void **newpvt)
705 {
706 	SegProc *sdp = (SegProc *)oldpvt;
707 	SegProc *ndp;
708 	SegLock *lp = sdp->lp;
709 
710 	mutex_enter(&lp->mutex);
711 	ASSERT((dhp == sdp->lockseg) || (dhp == sdp->unlockseg));
712 
713 	/*
714 	 * Note: At this point, the child process does have a pid, but
715 	 * the arguments passed to as_dup and hence to devmap_dup dont pass it
716 	 * down. So we cannot use normal seglock_findclient - which finds the
717 	 * parent sdp itself!
718 	 * Instead we allocate the child's SegProc by using the child as pointer
719 	 * RFE: we are using the as stucture which means peeking into the
720 	 * devmap_cookie. This is not DDI-compliant. Need a compliant way of
721 	 * getting at either the as or, better, a way to get the child's new pid
722 	 */
723 	ndp = seglock_alloc_specific(lp,
724 	    (void *)((devmap_handle_t *)new_dhp)->dh_seg->s_as);
725 	ASSERT(ndp != sdp);
726 
727 	if (sdp->lockseg == dhp) {
728 		ASSERT(ndp->lockseg == NULL);
729 		ndp->lockseg = new_dhp;
730 	} else {
731 		ASSERT(sdp->unlockseg == dhp);
732 		ASSERT(ndp->unlockseg == NULL);
733 		ndp->unlockseg = new_dhp;
734 		if (sdp->flag & TRASHPAGE) {
735 			ndp->flag |= TRASHPAGE;
736 		}
737 	}
738 	mutex_exit(&lp->mutex);
739 	*newpvt = (void *)ndp;
740 	return (0);
741 }
742 
743 
744 /*ARGSUSED*/
745 static void
746 winlockmap_unmap(devmap_cookie_t dhp, void *pvtp, offset_t off, size_t len,
747 	devmap_cookie_t new_dhp1, void **newpvtp1,
748 	devmap_cookie_t new_dhp2, void **newpvtp2)
749 {
750 	SegProc	*sdp = (SegProc *)pvtp;
751 	SegLock	*lp = sdp->lp;
752 
753 	/*
754 	 * We always create PAGESIZE length mappings, so there should never
755 	 * be a partial unmapping case
756 	 */
757 	ASSERT((new_dhp1 == NULL) && (new_dhp2 == NULL));
758 
759 	mutex_enter(&lp->mutex);
760 	ASSERT((dhp == sdp->lockseg) || (dhp == sdp->unlockseg));
761 	/* make sure this process doesn't own the lock */
762 	if (sdp == lp->owner) {
763 		/*
764 		 * Not handling errors - i.e., errors in unloading mapping
765 		 * As part of unmapping hat/seg structure get torn down anyway
766 		 */
767 		(void) lock_giveup(lp, 0);
768 	}
769 
770 	ASSERT(sdp != lp->owner);
771 	if (sdp->lockseg == dhp) {
772 		sdp->lockseg = NULL;
773 	} else {
774 		ASSERT(sdp->unlockseg == dhp);
775 		sdp->unlockseg = NULL;
776 		sdp->flag &= ~TRASHPAGE;	/* clear flag if set */
777 	}
778 
779 	garbage_collect_lock(lp, sdp);
780 }
781 
782 /*ARGSUSED*/
783 static int
784 winlockmap_access(devmap_cookie_t dhp, void *pvt, offset_t off, size_t len,
785 	uint_t type, uint_t rw)
786 {
787 	SegProc *sdp = (SegProc *)pvt;
788 	SegLock *lp = sdp->lp;
789 	int err;
790 
791 	/* Driver handles only DEVMAP_ACCESS type of faults */
792 	if (type != DEVMAP_ACCESS)
793 		return (-1);
794 
795 	mutex_enter(&lp->mutex);
796 	ASSERT((dhp == sdp->lockseg) || (dhp == sdp->unlockseg));
797 
798 	/* should be using a SegProc that corresponds to current process */
799 	ASSERT(ID(sdp) == CURPROC_ID);
800 
801 	/*
802 	 * If process is faulting but does not have both segments mapped
803 	 * return error (should cause a segv).
804 	 * RFE: could give it a permanent trashpage
805 	 */
806 	if ((sdp->lockseg == NULL) || (sdp->unlockseg == NULL)) {
807 		err = -1;
808 	} else {
809 		err = seglock_lockfault(dhp, sdp, lp, rw);
810 	}
811 	mutex_exit(&lp->mutex);
812 	return (err);
813 }
814 
815 	/* INTERNAL ROUTINES START HERE */
816 
817 
818 
819 /*
820  * search the lock_list list for the specified cookie
821  * The cookie is the sy_ident field returns by ALLOC ioctl.
822  * This has two parts:
823  * the pageoffset bits contain offset into the lock page.
824  * the pagenumber bits contain the lock id.
825  * The user code is supposed to pass in only the pagenumber portion
826  *	(i.e. mask off the pageoffset bits). However the code below
827  *	does the mask in case the users are not diligent
828  * if found, returns with mutex for SegLock structure held
829  */
830 static SegLock *
831 seglock_findlock(uint_t cookie)
832 {
833 	SegLock	*lp;
834 
835 	cookie &= (uint_t)PAGEMASK;   /* remove pageoffset bits to get cookie */
836 	mutex_enter(&winlock_mutex);
837 	for (lp = lock_list; lp != NULL; lp = lp->next) {
838 		mutex_enter(&lp->mutex);
839 		if (cookie == lp->cookie) {
840 			break;	/* return with lp->mutex held */
841 		}
842 		mutex_exit(&lp->mutex);
843 	}
844 	mutex_exit(&winlock_mutex);
845 	return (lp);
846 }
847 
848 /*
849  * search the lock_list list for the specified non-zero key
850  * if found, returns with lock for SegLock structure held
851  */
852 static SegLock *
853 seglock_findkey(uint_t key)
854 {
855 	SegLock	*lp;
856 
857 	ASSERT(MUTEX_HELD(&winlock_mutex));
858 	/* The driver allows multiple locks with key 0, dont search */
859 	if (key == 0)
860 		return (NULL);
861 	for (lp = lock_list; lp != NULL; lp = lp->next) {
862 		mutex_enter(&lp->mutex);
863 		if (key == lp->key)
864 			break;
865 		mutex_exit(&lp->mutex);
866 	}
867 	return (lp);
868 }
869 
870 /*
871  * Create a new lock context.
872  * Returns with SegLock mutex held
873  */
874 
875 static SegLock *
876 seglock_createlock(enum winlock_style style)
877 {
878 	SegLock	*lp;
879 
880 	DEBUGF(3, (CE_CONT, "seglock_createlock: free_list=%p, next_lock %d\n",
881 	    (void *)lock_free_list, next_lock));
882 
883 	ASSERT(MUTEX_HELD(&winlock_mutex));
884 	if (lock_free_list != NULL) {
885 		lp = lock_free_list;
886 		lock_free_list = lp->next;
887 	} else if (next_lock >= MAX_LOCKS) {
888 		return (NULL);
889 	} else {
890 		lp = kmem_zalloc(sizeof (SegLock), KM_SLEEP);
891 		lp->cookie = (next_lock + 1) * (uint_t)PAGESIZE;
892 		mutex_init(&lp->mutex, NULL, MUTEX_DEFAULT, NULL);
893 		cv_init(&lp->locksleep, NULL, CV_DEFAULT, NULL);
894 		++next_lock;
895 	}
896 
897 	mutex_enter(&lp->mutex);
898 	ASSERT((lp->cookie/PAGESIZE) <= next_lock);
899 
900 	if (style == OLDSTYLE_LOCK) {
901 		lp->lockptr = (int *)ddi_umem_alloc(PAGESIZE,
902 		    DDI_UMEM_SLEEP, &(lp->umem_cookie));
903 	} else {
904 		lp->lockptr = ((int *)lockpage) + ((lp->cookie/PAGESIZE) - 1);
905 		lp->umem_cookie = lockpage_cookie;
906 	}
907 
908 	ASSERT(lp->lockptr != NULL);
909 	lp->style = style;
910 	lp->sleepers = 0;
911 	lp->alloccount = 1;
912 	lp->timeout = LOCKTIME*hz;
913 	lp->clients = NULL;
914 	lp->owner = NULL;
915 	LOCK(lp) = 0;
916 	lp->next = lock_list;
917 	lock_list = lp;
918 	return (lp);
919 }
920 
921 /*
922  * Routine to destory a lock structure.
923  * This routine is called while holding the lp->mutex but not the
924  * winlock_mutex.
925  */
926 
927 static void
928 seglock_destroylock(SegLock *lp)
929 {
930 	ASSERT(MUTEX_HELD(&lp->mutex));
931 	ASSERT(!MUTEX_HELD(&winlock_mutex));
932 
933 	DEBUGF(3, (CE_CONT, "destroying lock cookie %d key %d\n",
934 	    lp->cookie, lp->key));
935 
936 	ASSERT(lp->alloccount == 0);
937 	ASSERT(lp->clients == NULL);
938 	ASSERT(lp->owner == NULL);
939 	ASSERT(lp->sleepers == 0);
940 
941 	/* clean up/release fields in lp */
942 	if (lp->style == OLDSTYLE_LOCK) {
943 		ddi_umem_free(lp->umem_cookie);
944 	}
945 	lp->umem_cookie = NULL;
946 	lp->lockptr = NULL;
947 	lp->key = 0;
948 
949 	/*
950 	 * Reduce cookie by 1, makes it non page-aligned and invalid
951 	 * This prevents any valid lookup from finding this lock
952 	 * so when we drop the lock and regrab it it will still
953 	 * be there and nobody else would have attached to it
954 	 */
955 	lp->cookie--;
956 
957 	/* Drop and reacquire mutexes in right order */
958 	mutex_exit(&lp->mutex);
959 	mutex_enter(&winlock_mutex);
960 	mutex_enter(&lp->mutex);
961 
962 	/* reincrement the cookie to get the original valid cookie */
963 	lp->cookie++;
964 	ASSERT((lp->cookie & PAGEOFFSET) == 0);
965 	ASSERT(lp->alloccount == 0);
966 	ASSERT(lp->clients == NULL);
967 	ASSERT(lp->owner == NULL);
968 	ASSERT(lp->sleepers == 0);
969 
970 	/* Remove lp from lock_list */
971 	if (lock_list == lp) {
972 		lock_list = lp->next;
973 	} else {
974 		SegLock *tmp = lock_list;
975 		while (tmp->next != lp) {
976 			tmp = tmp->next;
977 			ASSERT(tmp != NULL);
978 		}
979 		tmp->next = lp->next;
980 	}
981 
982 	/* Add to lock_free_list */
983 	lp->next = lock_free_list;
984 	lock_free_list = lp;
985 	mutex_exit(&lp->mutex);
986 
987 	/* Check if all locks deleted and cleanup */
988 	if (lock_list == NULL) {
989 		lock_destroyall();
990 	}
991 
992 	mutex_exit(&winlock_mutex);
993 }
994 
995 /* Routine to find a SegProc corresponding to the tag */
996 
997 static SegProc *
998 seglock_find_specific(SegLock *lp, void *tag)
999 {
1000 	SegProc *sdp;
1001 
1002 	ASSERT(MUTEX_HELD(&lp->mutex));
1003 	ASSERT(tag != NULL);
1004 	for (sdp = lp->clients; sdp != NULL; sdp = sdp->next) {
1005 		if (ID(sdp) == tag)
1006 			break;
1007 	}
1008 	return (sdp);
1009 }
1010 
1011 /* Routine to find (and if needed allocate) a SegProc corresponding to tag */
1012 
1013 static SegProc *
1014 seglock_alloc_specific(SegLock *lp, void *tag)
1015 {
1016 	SegProc *sdp;
1017 
1018 	ASSERT(MUTEX_HELD(&lp->mutex));
1019 	ASSERT(tag != NULL);
1020 
1021 	/* Search and return if existing one found */
1022 	sdp = seglock_find_specific(lp, tag);
1023 	if (sdp != NULL)
1024 		return (sdp);
1025 
1026 	DEBUGF(3, (CE_CONT, "Allocating segproc structure for tag %p lock %d\n",
1027 	    tag, lp->cookie));
1028 
1029 	/* Allocate a new SegProc */
1030 	sdp = kmem_zalloc(sizeof (SegProc), KM_SLEEP);
1031 	sdp->next = lp->clients;
1032 	lp->clients = sdp;
1033 	sdp->lp = lp;
1034 	ID(sdp) = tag;
1035 	return (sdp);
1036 }
1037 
1038 /*
1039  * search a context's client list for the given client and delete
1040  */
1041 
1042 static void
1043 seglock_deleteclient(SegLock *lp, SegProc *sdp)
1044 {
1045 	ASSERT(MUTEX_HELD(&lp->mutex));
1046 	ASSERT(lp->owner != sdp);	/* Not current owner of lock */
1047 	ASSERT(sdp->lockseg == NULL);	/* Mappings torn down */
1048 	ASSERT(sdp->unlockseg == NULL);
1049 
1050 	DEBUGF(3, (CE_CONT, "Deleting segproc structure for pid %d lock %d\n",
1051 	    ddi_get_pid(), lp->cookie));
1052 	if (lp->clients == sdp) {
1053 		lp->clients = sdp->next;
1054 	} else {
1055 		SegProc *tmp = lp->clients;
1056 		while (tmp->next != sdp) {
1057 			tmp = tmp->next;
1058 			ASSERT(tmp != NULL);
1059 		}
1060 		tmp->next = sdp->next;
1061 	}
1062 	kmem_free(sdp, sizeof (SegProc));
1063 }
1064 
1065 /*
1066  * Routine to verify if a SegProc and SegLock
1067  * structures are empty/idle.
1068  * Destroys the structures if they are ready
1069  * Can be called with sdp == NULL if want to verify only the lock state
1070  * caller should hold the lp->mutex
1071  * and this routine drops the mutex
1072  */
1073 static void
1074 garbage_collect_lock(SegLock *lp, SegProc *sdp)
1075 {
1076 	ASSERT(MUTEX_HELD(&lp->mutex));
1077 	/* see if both segments unmapped from client structure */
1078 	if ((sdp != NULL) && (sdp->lockseg == NULL) && (sdp->unlockseg == NULL))
1079 		seglock_deleteclient(lp, sdp);
1080 
1081 	/* see if this is last client in the entire lock context */
1082 	if ((lp->clients == NULL) && (lp->alloccount == 0)) {
1083 		seglock_destroylock(lp);
1084 	} else {
1085 		mutex_exit(&lp->mutex);
1086 	}
1087 }
1088 
1089 
1090 /* IOCTLS START HERE */
1091 
1092 static int
1093 seglock_grabinfo(intptr_t arg, int mode)
1094 {
1095 	int i = 1;
1096 
1097 	/* multiple clients per lock supported - see comments up top */
1098 	if (ddi_copyout((caddr_t)&i, (caddr_t)arg, sizeof (int), mode) != 0)
1099 		return (EFAULT);
1100 	return (0);
1101 }
1102 
1103 static int
1104 seglock_graballoc(intptr_t arg, enum winlock_style style, int mode) /* IOCTL */
1105 {
1106 	struct seglock	*lp;
1107 	uint_t		key;
1108 	struct		winlockalloc wla;
1109 	int		err;
1110 
1111 	if (style == OLDSTYLE_LOCK) {
1112 		key = 0;
1113 	} else {
1114 		if (ddi_copyin((caddr_t)arg, (caddr_t)&wla, sizeof (wla),
1115 		    mode)) {
1116 			return (EFAULT);
1117 		}
1118 		key = wla.sy_key;
1119 	}
1120 
1121 	DEBUGF(3, (CE_CONT,
1122 	    "seglock_graballoc: key=%u, style=%d\n", key, style));
1123 
1124 	mutex_enter(&winlock_mutex);
1125 	/* Allocate lockpage on first new style alloc */
1126 	if ((lockpage == NULL) && (style == NEWSTYLE_LOCK)) {
1127 		lockpage = ddi_umem_alloc(PAGESIZE, DDI_UMEM_SLEEP,
1128 		    &lockpage_cookie);
1129 	}
1130 
1131 	/* Allocate trashpage on first alloc (any style) */
1132 	if (trashpage_cookie == NULL) {
1133 		(void) ddi_umem_alloc(PAGESIZE, DDI_UMEM_TRASH | DDI_UMEM_SLEEP,
1134 		    &trashpage_cookie);
1135 	}
1136 
1137 	if ((lp = seglock_findkey(key)) != NULL) {
1138 		DEBUGF(2, (CE_CONT, "alloc: found lock key %d cookie %d\n",
1139 		    key, lp->cookie));
1140 		++lp->alloccount;
1141 	} else if ((lp = seglock_createlock(style)) != NULL) {
1142 		DEBUGF(2, (CE_CONT, "alloc: created lock key %d cookie %d\n",
1143 		    key, lp->cookie));
1144 		lp->key = key;
1145 	} else {
1146 		DEBUGF(2, (CE_CONT, "alloc: cannot create lock key %d\n", key));
1147 		mutex_exit(&winlock_mutex);
1148 		return (ENOMEM);
1149 	}
1150 	ASSERT((lp != NULL) && MUTEX_HELD(&lp->mutex));
1151 
1152 	mutex_exit(&winlock_mutex);
1153 
1154 	if (style == OLDSTYLE_LOCK) {
1155 		err = ddi_copyout((caddr_t)&lp->cookie, (caddr_t)arg,
1156 		    sizeof (lp->cookie), mode);
1157 	} else {
1158 		wla.sy_ident = lp->cookie +
1159 		    (uint_t)((uintptr_t)(lp->lockptr) & PAGEOFFSET);
1160 		err = ddi_copyout((caddr_t)&wla, (caddr_t)arg,
1161 		    sizeof (wla), mode);
1162 	}
1163 
1164 	if (err) {
1165 		/* On error, should undo allocation */
1166 		lp->alloccount--;
1167 
1168 		/* Verify and delete if lock is unused now */
1169 		garbage_collect_lock(lp, NULL);
1170 		return (EFAULT);
1171 	}
1172 
1173 	mutex_exit(&lp->mutex);
1174 	return (0);
1175 }
1176 
1177 static int
1178 seglock_grabfree(intptr_t arg, int mode)	/* IOCTL */
1179 {
1180 	struct seglock	*lp;
1181 	uint_t	offset;
1182 
1183 	if (ddi_copyin((caddr_t)arg, &offset, sizeof (offset), mode)
1184 	    != 0) {
1185 		return (EFAULT);
1186 	}
1187 	DEBUGF(2, (CE_CONT, "seglock_grabfree: offset=%u", offset));
1188 
1189 	if ((lp = seglock_findlock(offset)) == NULL) {
1190 		DEBUGF(2, (CE_CONT, "did not find lock\n"));
1191 		return (EINVAL);
1192 	}
1193 	DEBUGF(3, (CE_CONT, " lock key %d, cookie %d, alloccount %d\n",
1194 	    lp->key, lp->cookie, lp->alloccount));
1195 
1196 	if (lp->alloccount > 0)
1197 		lp->alloccount--;
1198 
1199 	/* Verify and delete if lock is unused now */
1200 	garbage_collect_lock(lp, NULL);
1201 	return (0);
1202 }
1203 
1204 
1205 /*
1206  * Sets timeout in lock and UFLAGS in client
1207  *	the UFLAGS are stored in the client structure and persistent only
1208  *	till the unmap of the lock pages. If the process sets UFLAGS
1209  *	does a map of the lock/unlock pages and unmaps them, the client
1210  *	structure will get deleted and the UFLAGS will be lost. The process
1211  *	will need to resetup the flags.
1212  */
1213 static int
1214 seglock_settimeout(intptr_t arg, int mode)	/* IOCTL */
1215 {
1216 	SegLock		*lp;
1217 	SegProc		*sdp;
1218 	struct winlocktimeout		wlt;
1219 
1220 	if (ddi_copyin((caddr_t)arg, &wlt, sizeof (wlt), mode) != 0) {
1221 		return (EFAULT);
1222 	}
1223 
1224 	if ((lp = seglock_findlock(wlt.sy_ident)) == NULL)
1225 		return (EINVAL);
1226 
1227 	lp->timeout = MSEC_TO_TICK_ROUNDUP(wlt.sy_timeout);
1228 	/* if timeout modified, wake up any sleepers */
1229 	if (lp->sleepers > 0) {
1230 		cv_broadcast(&lp->locksleep);
1231 	}
1232 
1233 	/*
1234 	 * If the process is trying to set UFLAGS,
1235 	 *	Find the client segproc and allocate one if needed
1236 	 *	Set the flags preserving the kernel flags
1237 	 * If the process is clearing UFLAGS
1238 	 *	Find the client segproc but dont allocate one if does not exist
1239 	 */
1240 	if (wlt.sy_flags & UFLAGS) {
1241 		sdp = seglock_allocclient(lp);
1242 		sdp->flag = sdp->flag & KFLAGS | wlt.sy_flags & UFLAGS;
1243 	} else if ((sdp = seglock_findclient(lp)) != NULL) {
1244 		sdp->flag = sdp->flag & KFLAGS;
1245 		/* If clearing UFLAGS leaves the segment or lock idle, delete */
1246 		garbage_collect_lock(lp, sdp);
1247 		return (0);
1248 	}
1249 	mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
1250 	return (0);
1251 }
1252 
1253 static int
1254 seglock_gettimeout(intptr_t arg, int mode)
1255 {
1256 	SegLock		*lp;
1257 	SegProc		*sdp;
1258 	struct winlocktimeout		wlt;
1259 
1260 	if (ddi_copyin((caddr_t)arg, &wlt, sizeof (wlt), mode) != 0)
1261 		return (EFAULT);
1262 
1263 	if ((lp = seglock_findlock(wlt.sy_ident)) == NULL)
1264 		return (EINVAL);
1265 
1266 	wlt.sy_timeout = TICK_TO_MSEC(lp->timeout);
1267 	/*
1268 	 * If this process has an active allocated lock return those flags
1269 	 *	Dont allocate a client structure on gettimeout
1270 	 * If not, return 0.
1271 	 */
1272 	if ((sdp = seglock_findclient(lp)) != NULL) {
1273 		wlt.sy_flags = sdp->flag & UFLAGS;
1274 	} else {
1275 		wlt.sy_flags = 0;
1276 	}
1277 	mutex_exit(&lp->mutex);	/* mutex held by seglock_findlock */
1278 
1279 	if (ddi_copyout(&wlt, (caddr_t)arg, sizeof (wlt), mode) != 0)
1280 		return (EFAULT);
1281 
1282 	return (0);
1283 }
1284 
1285 /*
1286  * Handle lock segment faults here...
1287  *
1288  * This is where the magic happens.
1289  */
1290 
1291 /* ARGSUSED */
1292 static	int
1293 seglock_lockfault(devmap_cookie_t dhp, SegProc *sdp, SegLock *lp, uint_t rw)
1294 {
1295 	SegProc *owner = lp->owner;
1296 	int err;
1297 
1298 	ASSERT(MUTEX_HELD(&lp->mutex));
1299 	DEBUGF(3, (CE_CONT,
1300 	    "seglock_lockfault: hdl=%p, sdp=%p, lp=%p owner=%p\n",
1301 	    (void *)dhp, (void *)sdp, (void *)lp, (void *)owner));
1302 
1303 	/* lockfault is always called with sdp in current process context */
1304 	ASSERT(ID(sdp) == CURPROC_ID);
1305 
1306 	/* If Lock has no current owner, give the mapping to new owner */
1307 	if (owner == NULL) {
1308 		DEBUGF(4, (CE_CONT, " lock has no current owner\n"));
1309 		return (give_mapping(lp, sdp, rw));
1310 	}
1311 
1312 	if (owner == sdp) {
1313 		/*
1314 		 * Current owner is faulting on owned lock segment OR
1315 		 * Current owner is faulting on unlock page and has no waiters
1316 		 * Then can give the mapping to current owner
1317 		 */
1318 		if ((sdp->lockseg == dhp) || (lp->sleepers == 0)) {
1319 		DEBUGF(4, (CE_CONT, "lock owner faulting\n"));
1320 		return (give_mapping(lp, sdp, rw));
1321 		} else {
1322 		/*
1323 		 * Owner must be writing to unlock page and there are waiters.
1324 		 * other cases have been checked earlier.
1325 		 * Release the lock, owner, and owners mappings
1326 		 * As the owner is trying to write to the unlock page, leave
1327 		 * it with a trashpage mapping and wake up the sleepers
1328 		 */
1329 		ASSERT((dhp == sdp->unlockseg) && (lp->sleepers != 0));
1330 		DEBUGF(4, (CE_CONT, " owner fault on unlock seg w/ sleeper\n"));
1331 		return (lock_giveup(lp, 1));
1332 		}
1333 	}
1334 
1335 	ASSERT(owner != sdp);
1336 
1337 	/*
1338 	 * If old owner faulting on trash unlock mapping,
1339 	 * load hat mappings to trash page
1340 	 * RFE: non-owners should NOT be faulting on unlock mapping as they
1341 	 * as first supposed to fault on the lock seg. We could give them
1342 	 * a trash page or return error.
1343 	 */
1344 	if ((sdp->unlockseg == dhp) && (sdp->flag & TRASHPAGE)) {
1345 		DEBUGF(4, (CE_CONT, " old owner reloads trash mapping\n"));
1346 		return (devmap_load(sdp->unlockseg, lp->cookie, PAGESIZE,
1347 		    DEVMAP_ACCESS, rw));
1348 	}
1349 
1350 	/*
1351 	 * Non-owner faulting. Need to check current LOCK state.
1352 	 *
1353 	 * Before reading lock value in LOCK(lp), we must make sure that
1354 	 * the owner cannot change its value before we change mappings
1355 	 * or else we could end up either with a hung process
1356 	 * or more than one process thinking they have the lock.
1357 	 * We do that by unloading the owner's mappings
1358 	 */
1359 	DEBUGF(4, (CE_CONT, " owner loses mappings to check lock state\n"));
1360 	err = devmap_unload(owner->lockseg, lp->cookie, PAGESIZE);
1361 	err |= devmap_unload(owner->unlockseg, lp->cookie, PAGESIZE);
1362 	if (err != 0)
1363 		return (err);	/* unable to remove owner mapping */
1364 
1365 	/*
1366 	 * If lock is not held, then current owner mappings were
1367 	 * unloaded above and we can give the lock to the new owner
1368 	 */
1369 	if (LOCK(lp) == 0) {
1370 		DEBUGF(4, (CE_CONT,
1371 		    "Free lock (%p): Giving mapping to new owner %d\n",
1372 		    (void *)lp, ddi_get_pid()));
1373 		return (give_mapping(lp, sdp, rw));
1374 	}
1375 
1376 	DEBUGF(4, (CE_CONT, "  lock held, sleeping\n"));
1377 
1378 	/*
1379 	 * A non-owning process tried to write (presumably to the lockpage,
1380 	 * but it doesn't matter) but the lock is held; we need to sleep for
1381 	 * the lock while there is an owner.
1382 	 */
1383 
1384 	lp->sleepers++;
1385 	while ((owner = lp->owner) != NULL) {
1386 		int rval;
1387 
1388 		if ((lp->timeout == 0) || (owner->flag & SY_NOTIMEOUT)) {
1389 			/*
1390 			 * No timeout has been specified for this lock;
1391 			 * we'll simply sleep on the condition variable.
1392 			 */
1393 			rval = cv_wait_sig(&lp->locksleep, &lp->mutex);
1394 		} else {
1395 			/*
1396 			 * A timeout _has_ been specified for this lock. We need
1397 			 * to wake up and possibly steal this lock if the owner
1398 			 * does not let it go. Note that all sleepers on a lock
1399 			 * with a timeout wait; the sleeper with the earliest
1400 			 * timeout will wakeup, and potentially steal the lock
1401 			 * Stealing the lock will cause a broadcast on the
1402 			 * locksleep cv and thus kick the other timed waiters
1403 			 * and cause everyone to restart in a new timedwait
1404 			 */
1405 			rval = cv_timedwait_sig(&lp->locksleep,
1406 			    &lp->mutex, ddi_get_lbolt() + lp->timeout);
1407 		}
1408 
1409 		/*
1410 		 * Timeout and still old owner - steal lock
1411 		 * Force-Release lock and give old owner a trashpage mapping
1412 		 */
1413 		if ((rval == -1) && (lp->owner == owner)) {
1414 			/*
1415 			 * if any errors in lock_giveup, go back and sleep/retry
1416 			 * If successful, will break out of loop
1417 			 */
1418 			cmn_err(CE_NOTE, "Process %d timed out on lock %d\n",
1419 			    ddi_get_pid(), lp->cookie);
1420 			(void) lock_giveup(lp, 1);
1421 		} else if (rval == 0) { /* signal pending */
1422 			cmn_err(CE_NOTE,
1423 			    "Process %d signalled while waiting on lock %d\n",
1424 			    ddi_get_pid(), lp->cookie);
1425 			lp->sleepers--;
1426 			return (FC_MAKE_ERR(EINTR));
1427 		}
1428 	}
1429 
1430 	lp->sleepers--;
1431 	/*
1432 	 * Give mapping to this process and save a fault later
1433 	 */
1434 	return (give_mapping(lp, sdp, rw));
1435 }
1436 
1437 /*
1438  * Utility: give a valid mapping to lock and unlock pages to current process.
1439  * Caller responsible for unloading old owner's mappings
1440  */
1441 
1442 static int
1443 give_mapping(SegLock *lp, SegProc *sdp, uint_t rw)
1444 {
1445 	int err = 0;
1446 
1447 	ASSERT(MUTEX_HELD(&lp->mutex));
1448 	ASSERT(!((lp->owner == NULL) && (LOCK(lp) != 0)));
1449 	/* give_mapping is always called with sdp in current process context */
1450 	ASSERT(ID(sdp) == CURPROC_ID);
1451 
1452 	/* remap any old trash mappings */
1453 	if (sdp->flag & TRASHPAGE) {
1454 		/* current owner should not have a trash mapping */
1455 		ASSERT(sdp != lp->owner);
1456 
1457 		DEBUGF(4, (CE_CONT,
1458 		    "new owner %d remapping old trash mapping\n",
1459 		    ddi_get_pid()));
1460 		if ((err = devmap_umem_remap(sdp->unlockseg, winlock_dip,
1461 		    lp->umem_cookie, 0, PAGESIZE, WINLOCK_PROT, 0, 0)) != 0) {
1462 			/*
1463 			 * unable to remap old trash page,
1464 			 * abort before changing owner
1465 			 */
1466 			DEBUGF(4, (CE_CONT,
1467 			    "aborting: error in umem_remap %d\n", err));
1468 			return (err);
1469 		}
1470 		sdp->flag &= ~TRASHPAGE;
1471 	}
1472 
1473 	/* we have a new owner now */
1474 	lp->owner = sdp;
1475 
1476 	if ((err = devmap_load(sdp->lockseg, lp->cookie, PAGESIZE,
1477 	    DEVMAP_ACCESS, rw)) != 0) {
1478 		return (err);
1479 	}
1480 	DEBUGF(4, (CE_CONT, "new owner %d gets lock mapping", ddi_get_pid()));
1481 
1482 	if (lp->sleepers) {
1483 		/* Force unload unlock mapping if there are waiters */
1484 		DEBUGF(4, (CE_CONT,
1485 		    " lock has %d sleepers => remove unlock mapping\n",
1486 		    lp->sleepers));
1487 		err = devmap_unload(sdp->unlockseg, lp->cookie, PAGESIZE);
1488 	} else {
1489 		/*
1490 		 * while here, give new owner a valid mapping to unlock
1491 		 * page so we don't get called again.
1492 		 */
1493 		DEBUGF(4, (CE_CONT, " and unlock mapping\n"));
1494 		err = devmap_load(sdp->unlockseg, lp->cookie, PAGESIZE,
1495 		    DEVMAP_ACCESS, PROT_WRITE);
1496 	}
1497 	return (err);
1498 }
1499 
1500 /*
1501  * Unload owner's mappings, release the lock and wakeup any sleepers
1502  * If trash, then the old owner is given a trash mapping
1503  *	=> old owner held lock too long and caused a timeout
1504  */
1505 static int
1506 lock_giveup(SegLock *lp, int trash)
1507 {
1508 	SegProc *owner = lp->owner;
1509 
1510 	DEBUGF(4, (CE_CONT, "winlock_giveup: lp=%p, owner=%p, trash %d\n",
1511 	    (void *)lp, (void *)ID(lp->owner), trash));
1512 
1513 	ASSERT(MUTEX_HELD(&lp->mutex));
1514 	ASSERT(owner != NULL);
1515 
1516 	/*
1517 	 * owner loses lockpage/unlockpage mappings and gains a
1518 	 * trashpage mapping, if needed.
1519 	 */
1520 	if (!trash) {
1521 		/*
1522 		 * We do not handle errors in devmap_unload in the !trash case,
1523 		 * as the process is attempting to unmap/exit or otherwise
1524 		 * release the lock. Errors in unloading the mapping are not
1525 		 * going to affect that (unmap does not take error return).
1526 		 */
1527 		(void) devmap_unload(owner->lockseg, lp->cookie, PAGESIZE);
1528 		(void) devmap_unload(owner->unlockseg, lp->cookie, PAGESIZE);
1529 	} else {
1530 		int err;
1531 
1532 		if (err = devmap_unload(owner->lockseg, lp->cookie, PAGESIZE)) {
1533 			/* error unloading lockseg mapping. abort giveup */
1534 			return (err);
1535 		}
1536 
1537 		/*
1538 		 * old owner gets mapping to trash page so it can continue
1539 		 * devmap_umem_remap does a hat_unload (and does it holding
1540 		 * the right locks), so no need to devmap_unload on unlockseg
1541 		 */
1542 		if ((err = devmap_umem_remap(owner->unlockseg, winlock_dip,
1543 		    trashpage_cookie, 0, PAGESIZE, WINLOCK_PROT, 0, 0)) != 0) {
1544 			/* error remapping to trash page, abort giveup */
1545 			return (err);
1546 		}
1547 		owner->flag |= TRASHPAGE;
1548 		/*
1549 		 * Preload mapping to trash page by calling devmap_load
1550 		 * However, devmap_load can only be called on the faulting
1551 		 * process context and not on the owner's process context
1552 		 * we preload only if we happen to be in owner process context
1553 		 * Other processes will fault on the unlock mapping
1554 		 * and be given a trash mapping at that time.
1555 		 */
1556 		if (ID(owner) == CURPROC_ID) {
1557 			(void) devmap_load(owner->unlockseg, lp->cookie,
1558 			    PAGESIZE, DEVMAP_ACCESS, PROT_WRITE);
1559 		}
1560 	}
1561 
1562 	lp->owner = NULL;
1563 
1564 	/* Clear the lock value in underlying page so new owner can grab it */
1565 	LOCK(lp) = 0;
1566 
1567 	if (lp->sleepers) {
1568 		DEBUGF(4, (CE_CONT, "  waking up, lp=%p\n", (void *)lp));
1569 		cv_broadcast(&lp->locksleep);
1570 	}
1571 	return (0);
1572 }
1573 
1574 /*
1575  * destroy all allocated memory.
1576  */
1577 
1578 static void
1579 lock_destroyall(void)
1580 {
1581 	SegLock	*lp, *lpnext;
1582 
1583 	ASSERT(MUTEX_HELD(&winlock_mutex));
1584 	ASSERT(lock_list == NULL);
1585 
1586 	DEBUGF(1, (CE_CONT, "Lock list empty. Releasing free list\n"));
1587 	for (lp = lock_free_list; lp != NULL; lp = lpnext) {
1588 		mutex_enter(&lp->mutex);
1589 		lpnext =  lp->next;
1590 		ASSERT(lp->clients == NULL);
1591 		ASSERT(lp->owner == NULL);
1592 		ASSERT(lp->alloccount == 0);
1593 		mutex_destroy(&lp->mutex);
1594 		cv_destroy(&lp->locksleep);
1595 		kmem_free(lp, sizeof (SegLock));
1596 	}
1597 	lock_free_list = NULL;
1598 	next_lock = 0;
1599 }
1600 
1601 
1602 /* RFE: create mdb walkers instead of dump routines? */
1603 static void
1604 seglock_dump_all(void)
1605 {
1606 	SegLock	*lp;
1607 
1608 	mutex_enter(&winlock_mutex);
1609 	cmn_err(CE_CONT, "ID\tKEY\tNALLOC\tATTCH\tOWNED\tLOCK\tWAITER\n");
1610 
1611 	cmn_err(CE_CONT, "Lock List:\n");
1612 	for (lp = lock_list; lp != NULL; lp = lp->next) {
1613 		mutex_enter(&lp->mutex);
1614 		cmn_err(CE_CONT, "%d\t%d\t%u\t%c\t%c\t%c\t%d\n",
1615 		    lp->cookie, lp->key, lp->alloccount,
1616 		    lp->clients ? 'Y' : 'N',
1617 		    lp->owner ? 'Y' : 'N',
1618 		    lp->lockptr != 0 && LOCK(lp) ? 'Y' : 'N',
1619 		    lp->sleepers);
1620 		mutex_exit(&lp->mutex);
1621 	}
1622 	cmn_err(CE_CONT, "Free Lock List:\n");
1623 	for (lp = lock_free_list; lp != NULL; lp = lp->next) {
1624 		mutex_enter(&lp->mutex);
1625 		cmn_err(CE_CONT, "%d\t%d\t%u\t%c\t%c\t%c\t%d\n",
1626 		    lp->cookie, lp->key, lp->alloccount,
1627 		    lp->clients ? 'Y' : 'N',
1628 		    lp->owner ? 'Y' : 'N',
1629 		    lp->lockptr != 0 && LOCK(lp) ? 'Y' : 'N',
1630 		    lp->sleepers);
1631 		mutex_exit(&lp->mutex);
1632 	}
1633 
1634 #ifdef DEBUG
1635 	if (lock_debug < 3) {
1636 		mutex_exit(&winlock_mutex);
1637 		return;
1638 	}
1639 
1640 	for (lp = lock_list; lp != NULL; lp = lp->next) {
1641 		SegProc	*sdp;
1642 
1643 		mutex_enter(&lp->mutex);
1644 		cmn_err(CE_CONT,
1645 		    "lock %p, key=%d, cookie=%d, nalloc=%u, lock=%d, wait=%d\n",
1646 		    (void *)lp, lp->key, lp->cookie, lp->alloccount,
1647 		    lp->lockptr != 0 ? LOCK(lp) : -1, lp->sleepers);
1648 
1649 		cmn_err(CE_CONT,
1650 		    "style=%d, lockptr=%p, timeout=%ld, clients=%p, owner=%p\n",
1651 		    lp->style, (void *)lp->lockptr, lp->timeout,
1652 		    (void *)lp->clients, (void *)lp->owner);
1653 
1654 
1655 		for (sdp = lp->clients; sdp != NULL; sdp = sdp->next) {
1656 			cmn_err(CE_CONT, "  client %p%s, lp=%p, flag=%x, "
1657 			    "process tag=%p, lockseg=%p, unlockseg=%p\n",
1658 			    (void *)sdp, sdp == lp->owner ? " (owner)" : "",
1659 			    (void *)sdp->lp, sdp->flag, (void *)ID(sdp),
1660 			    (void *)sdp->lockseg, (void *)sdp->unlockseg);
1661 		}
1662 		mutex_exit(&lp->mutex);
1663 	}
1664 #endif
1665 	mutex_exit(&winlock_mutex);
1666 }
1667 
1668 #include <sys/modctl.h>
1669 
1670 static struct modldrv modldrv = {
1671 	&mod_driverops,		/* Type of module.  This one is a driver */
1672 	"Winlock Driver",	/* Name of the module */
1673 	&winlock_ops,		/* driver ops */
1674 };
1675 
1676 static struct modlinkage modlinkage = {
1677 	MODREV_1,
1678 	(void *)&modldrv,
1679 	0,
1680 	0,
1681 	0
1682 };
1683 
1684 int
1685 _init(void)
1686 {
1687 	int e;
1688 
1689 	mutex_init(&winlock_mutex, NULL, MUTEX_DEFAULT, NULL);
1690 	e = mod_install(&modlinkage);
1691 	if (e) {
1692 		mutex_destroy(&winlock_mutex);
1693 	}
1694 	return (e);
1695 }
1696 
1697 
1698 int
1699 _info(struct modinfo *modinfop)
1700 {
1701 	return (mod_info(&modlinkage, modinfop));
1702 }
1703 
1704 int
1705 _fini(void)
1706 {
1707 	int	e;
1708 
1709 	e = mod_remove(&modlinkage);
1710 	if (e == 0) {
1711 		mutex_destroy(&winlock_mutex);
1712 	}
1713 	return (e);
1714 }
1715