1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 /* 25 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 26 */ 27 28 /* 29 * VM - Hardware Address Translation management for Spitfire MMU. 30 * 31 * This file implements the machine specific hardware translation 32 * needed by the VM system. The machine independent interface is 33 * described in <vm/hat.h> while the machine dependent interface 34 * and data structures are described in <vm/hat_sfmmu.h>. 35 * 36 * The hat layer manages the address translation hardware as a cache 37 * driven by calls from the higher levels in the VM system. 38 */ 39 40 #include <sys/types.h> 41 #include <sys/kstat.h> 42 #include <vm/hat.h> 43 #include <vm/hat_sfmmu.h> 44 #include <vm/page.h> 45 #include <sys/pte.h> 46 #include <sys/systm.h> 47 #include <sys/mman.h> 48 #include <sys/sysmacros.h> 49 #include <sys/machparam.h> 50 #include <sys/vtrace.h> 51 #include <sys/kmem.h> 52 #include <sys/mmu.h> 53 #include <sys/cmn_err.h> 54 #include <sys/cpu.h> 55 #include <sys/cpuvar.h> 56 #include <sys/debug.h> 57 #include <sys/lgrp.h> 58 #include <sys/archsystm.h> 59 #include <sys/machsystm.h> 60 #include <sys/vmsystm.h> 61 #include <vm/as.h> 62 #include <vm/seg.h> 63 #include <vm/seg_kp.h> 64 #include <vm/seg_kmem.h> 65 #include <vm/seg_kpm.h> 66 #include <vm/rm.h> 67 #include <sys/t_lock.h> 68 #include <sys/obpdefs.h> 69 #include <sys/vm_machparam.h> 70 #include <sys/var.h> 71 #include <sys/trap.h> 72 #include <sys/machtrap.h> 73 #include <sys/scb.h> 74 #include <sys/bitmap.h> 75 #include <sys/machlock.h> 76 #include <sys/membar.h> 77 #include <sys/atomic.h> 78 #include <sys/cpu_module.h> 79 #include <sys/prom_debug.h> 80 #include <sys/ksynch.h> 81 #include <sys/mem_config.h> 82 #include <sys/mem_cage.h> 83 #include <vm/vm_dep.h> 84 #include <sys/fpu/fpusystm.h> 85 #include <vm/mach_kpm.h> 86 #include <sys/callb.h> 87 88 #ifdef DEBUG 89 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len) \ 90 if (SFMMU_IS_SHMERID_VALID(rid)) { \ 91 caddr_t _eaddr = (saddr) + (len); \ 92 sf_srd_t *_srdp; \ 93 sf_region_t *_rgnp; \ 94 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \ 95 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid)); \ 96 ASSERT((hat) != ksfmmup); \ 97 _srdp = (hat)->sfmmu_srdp; \ 98 ASSERT(_srdp != NULL); \ 99 ASSERT(_srdp->srd_refcnt != 0); \ 100 _rgnp = _srdp->srd_hmergnp[(rid)]; \ 101 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid); \ 102 ASSERT(_rgnp->rgn_refcnt != 0); \ 103 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \ 104 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == \ 105 SFMMU_REGION_HME); \ 106 ASSERT((saddr) >= _rgnp->rgn_saddr); \ 107 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size); \ 108 ASSERT(_eaddr > _rgnp->rgn_saddr); \ 109 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size); \ 110 } 111 112 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) \ 113 { \ 114 caddr_t _hsva; \ 115 caddr_t _heva; \ 116 caddr_t _rsva; \ 117 caddr_t _reva; \ 118 int _ttesz = get_hblk_ttesz(hmeblkp); \ 119 int _flagtte; \ 120 ASSERT((srdp)->srd_refcnt != 0); \ 121 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \ 122 ASSERT((rgnp)->rgn_id == rid); \ 123 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE)); \ 124 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) == \ 125 SFMMU_REGION_HME); \ 126 ASSERT(_ttesz <= (rgnp)->rgn_pgszc); \ 127 _hsva = (caddr_t)get_hblk_base(hmeblkp); \ 128 _heva = get_hblk_endaddr(hmeblkp); \ 129 _rsva = (caddr_t)P2ALIGN( \ 130 (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES); \ 131 _reva = (caddr_t)P2ROUNDUP( \ 132 (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size), \ 133 HBLK_MIN_BYTES); \ 134 ASSERT(_hsva >= _rsva); \ 135 ASSERT(_hsva < _reva); \ 136 ASSERT(_heva > _rsva); \ 137 ASSERT(_heva <= _reva); \ 138 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : \ 139 _ttesz; \ 140 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte)); \ 141 } 142 143 #else /* DEBUG */ 144 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len) 145 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) 146 #endif /* DEBUG */ 147 148 #if defined(SF_ERRATA_57) 149 extern caddr_t errata57_limit; 150 #endif 151 152 #define HME8BLK_SZ_RND ((roundup(HME8BLK_SZ, sizeof (int64_t))) / \ 153 (sizeof (int64_t))) 154 #define HBLK_RESERVE ((struct hme_blk *)hblk_reserve) 155 156 #define HBLK_RESERVE_CNT 128 157 #define HBLK_RESERVE_MIN 20 158 159 static struct hme_blk *freehblkp; 160 static kmutex_t freehblkp_lock; 161 static int freehblkcnt; 162 163 static int64_t hblk_reserve[HME8BLK_SZ_RND]; 164 static kmutex_t hblk_reserve_lock; 165 static kthread_t *hblk_reserve_thread; 166 167 static nucleus_hblk8_info_t nucleus_hblk8; 168 static nucleus_hblk1_info_t nucleus_hblk1; 169 170 /* 171 * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here 172 * after the initial phase of removing an hmeblk from the hash chain, see 173 * the detailed comment in sfmmu_hblk_hash_rm() for further details. 174 */ 175 static cpu_hme_pend_t *cpu_hme_pend; 176 static uint_t cpu_hme_pend_thresh; 177 /* 178 * SFMMU specific hat functions 179 */ 180 void hat_pagecachectl(struct page *, int); 181 182 /* flags for hat_pagecachectl */ 183 #define HAT_CACHE 0x1 184 #define HAT_UNCACHE 0x2 185 #define HAT_TMPNC 0x4 186 187 /* 188 * Flag to allow the creation of non-cacheable translations 189 * to system memory. It is off by default. At the moment this 190 * flag is used by the ecache error injector. The error injector 191 * will turn it on when creating such a translation then shut it 192 * off when it's finished. 193 */ 194 195 int sfmmu_allow_nc_trans = 0; 196 197 /* 198 * Flag to disable large page support. 199 * value of 1 => disable all large pages. 200 * bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively. 201 * 202 * For example, use the value 0x4 to disable 512K pages. 203 * 204 */ 205 #define LARGE_PAGES_OFF 0x1 206 207 /* 208 * The disable_large_pages and disable_ism_large_pages variables control 209 * hat_memload_array and the page sizes to be used by ISM and the kernel. 210 * 211 * The disable_auto_data_large_pages and disable_auto_text_large_pages variables 212 * are only used to control which OOB pages to use at upper VM segment creation 213 * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines. 214 * Their values may come from platform or CPU specific code to disable page 215 * sizes that should not be used. 216 * 217 * WARNING: 512K pages are currently not supported for ISM/DISM. 218 */ 219 uint_t disable_large_pages = 0; 220 uint_t disable_ism_large_pages = (1 << TTE512K); 221 uint_t disable_auto_data_large_pages = 0; 222 uint_t disable_auto_text_large_pages = 0; 223 224 /* 225 * Private sfmmu data structures for hat management 226 */ 227 static struct kmem_cache *sfmmuid_cache; 228 static struct kmem_cache *mmuctxdom_cache; 229 230 /* 231 * Private sfmmu data structures for tsb management 232 */ 233 static struct kmem_cache *sfmmu_tsbinfo_cache; 234 static struct kmem_cache *sfmmu_tsb8k_cache; 235 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX]; 236 static vmem_t *kmem_bigtsb_arena; 237 static vmem_t *kmem_tsb_arena; 238 239 /* 240 * sfmmu static variables for hmeblk resource management. 241 */ 242 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */ 243 static struct kmem_cache *sfmmu8_cache; 244 static struct kmem_cache *sfmmu1_cache; 245 static struct kmem_cache *pa_hment_cache; 246 247 static kmutex_t ism_mlist_lock; /* mutex for ism mapping list */ 248 /* 249 * private data for ism 250 */ 251 static struct kmem_cache *ism_blk_cache; 252 static struct kmem_cache *ism_ment_cache; 253 #define ISMID_STARTADDR NULL 254 255 /* 256 * Region management data structures and function declarations. 257 */ 258 259 static void sfmmu_leave_srd(sfmmu_t *); 260 static int sfmmu_srdcache_constructor(void *, void *, int); 261 static void sfmmu_srdcache_destructor(void *, void *); 262 static int sfmmu_rgncache_constructor(void *, void *, int); 263 static void sfmmu_rgncache_destructor(void *, void *); 264 static int sfrgnmap_isnull(sf_region_map_t *); 265 static int sfhmergnmap_isnull(sf_hmeregion_map_t *); 266 static int sfmmu_scdcache_constructor(void *, void *, int); 267 static void sfmmu_scdcache_destructor(void *, void *); 268 static void sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t, 269 size_t, void *, u_offset_t); 270 271 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1; 272 static sf_srd_bucket_t *srd_buckets; 273 static struct kmem_cache *srd_cache; 274 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1; 275 static struct kmem_cache *region_cache; 276 static struct kmem_cache *scd_cache; 277 278 #ifdef sun4v 279 int use_bigtsb_arena = 1; 280 #else 281 int use_bigtsb_arena = 0; 282 #endif 283 284 /* External /etc/system tunable, for turning on&off the shctx support */ 285 int disable_shctx = 0; 286 /* Internal variable, set by MD if the HW supports shctx feature */ 287 int shctx_on = 0; 288 289 #ifdef DEBUG 290 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int); 291 #endif 292 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *); 293 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *); 294 295 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *); 296 static void sfmmu_find_scd(sfmmu_t *); 297 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *); 298 static void sfmmu_finish_join_scd(sfmmu_t *); 299 static void sfmmu_leave_scd(sfmmu_t *, uchar_t); 300 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *); 301 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *); 302 static void sfmmu_free_scd_tsbs(sfmmu_t *); 303 static void sfmmu_tsb_inv_ctx(sfmmu_t *); 304 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *); 305 static void sfmmu_ism_hatflags(sfmmu_t *, int); 306 static int sfmmu_srd_lock_held(sf_srd_t *); 307 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *); 308 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *); 309 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *); 310 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *); 311 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *); 312 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *); 313 314 /* 315 * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists, 316 * HAT flags, synchronizing TLB/TSB coherency, and context management. 317 * The lock is hashed on the sfmmup since the case where we need to lock 318 * all processes is rare but does occur (e.g. we need to unload a shared 319 * mapping from all processes using the mapping). We have a lot of buckets, 320 * and each slab of sfmmu_t's can use about a quarter of them, giving us 321 * a fairly good distribution without wasting too much space and overhead 322 * when we have to grab them all. 323 */ 324 #define SFMMU_NUM_LOCK 128 /* must be power of two */ 325 hatlock_t hat_lock[SFMMU_NUM_LOCK]; 326 327 /* 328 * Hash algorithm optimized for a small number of slabs. 329 * 7 is (highbit((sizeof sfmmu_t)) - 1) 330 * This hash algorithm is based upon the knowledge that sfmmu_t's come from a 331 * kmem_cache, and thus they will be sequential within that cache. In 332 * addition, each new slab will have a different "color" up to cache_maxcolor 333 * which will skew the hashing for each successive slab which is allocated. 334 * If the size of sfmmu_t changed to a larger size, this algorithm may need 335 * to be revisited. 336 */ 337 #define TSB_HASH_SHIFT_BITS (7) 338 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS) 339 340 #ifdef DEBUG 341 int tsb_hash_debug = 0; 342 #define TSB_HASH(sfmmup) \ 343 (tsb_hash_debug ? &hat_lock[0] : \ 344 &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]) 345 #else /* DEBUG */ 346 #define TSB_HASH(sfmmup) &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)] 347 #endif /* DEBUG */ 348 349 350 /* sfmmu_replace_tsb() return codes. */ 351 typedef enum tsb_replace_rc { 352 TSB_SUCCESS, 353 TSB_ALLOCFAIL, 354 TSB_LOSTRACE, 355 TSB_ALREADY_SWAPPED, 356 TSB_CANTGROW 357 } tsb_replace_rc_t; 358 359 /* 360 * Flags for TSB allocation routines. 361 */ 362 #define TSB_ALLOC 0x01 363 #define TSB_FORCEALLOC 0x02 364 #define TSB_GROW 0x04 365 #define TSB_SHRINK 0x08 366 #define TSB_SWAPIN 0x10 367 368 /* 369 * Support for HAT callbacks. 370 */ 371 #define SFMMU_MAX_RELOC_CALLBACKS 10 372 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS; 373 static id_t sfmmu_cb_nextid = 0; 374 static id_t sfmmu_tsb_cb_id; 375 struct sfmmu_callback *sfmmu_cb_table; 376 377 kmutex_t kpr_mutex; 378 kmutex_t kpr_suspendlock; 379 kthread_t *kreloc_thread; 380 381 /* 382 * Enable VA->PA translation sanity checking on DEBUG kernels. 383 * Disabled by default. This is incompatible with some 384 * drivers (error injector, RSM) so if it breaks you get 385 * to keep both pieces. 386 */ 387 int hat_check_vtop = 0; 388 389 /* 390 * Private sfmmu routines (prototypes) 391 */ 392 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t); 393 static struct hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t, 394 struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t, 395 uint_t); 396 static caddr_t sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t, 397 caddr_t, demap_range_t *, uint_t); 398 static caddr_t sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t, 399 caddr_t, int); 400 static void sfmmu_hblk_free(struct hme_blk **); 401 static void sfmmu_hblks_list_purge(struct hme_blk **, int); 402 static uint_t sfmmu_get_free_hblk(struct hme_blk **, uint_t); 403 static uint_t sfmmu_put_free_hblk(struct hme_blk *, uint_t); 404 static struct hme_blk *sfmmu_hblk_steal(int); 405 static int sfmmu_steal_this_hblk(struct hmehash_bucket *, 406 struct hme_blk *, uint64_t, struct hme_blk *); 407 static caddr_t sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t); 408 409 static void hat_do_memload_array(struct hat *, caddr_t, size_t, 410 struct page **, uint_t, uint_t, uint_t); 411 static void hat_do_memload(struct hat *, caddr_t, struct page *, 412 uint_t, uint_t, uint_t); 413 static void sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **, 414 uint_t, uint_t, pgcnt_t, uint_t); 415 void sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *, 416 uint_t); 417 static int sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **, 418 uint_t, uint_t); 419 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *, 420 caddr_t, int, uint_t); 421 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *, 422 struct hmehash_bucket *, caddr_t, uint_t, uint_t, 423 uint_t); 424 static int sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *, 425 caddr_t, page_t **, uint_t, uint_t); 426 static void sfmmu_tteload_release_hashbucket(struct hmehash_bucket *); 427 428 static int sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int); 429 static pfn_t sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *); 430 void sfmmu_memtte(tte_t *, pfn_t, uint_t, int); 431 #ifdef VAC 432 static void sfmmu_vac_conflict(struct hat *, caddr_t, page_t *); 433 static int sfmmu_vacconflict_array(caddr_t, page_t *, int *); 434 int tst_tnc(page_t *pp, pgcnt_t); 435 void conv_tnc(page_t *pp, int); 436 #endif 437 438 static void sfmmu_get_ctx(sfmmu_t *); 439 static void sfmmu_free_sfmmu(sfmmu_t *); 440 441 static void sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *); 442 static void sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int); 443 444 cpuset_t sfmmu_pageunload(page_t *, struct sf_hment *, int); 445 static void hat_pagereload(struct page *, struct page *); 446 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t); 447 #ifdef VAC 448 void sfmmu_page_cache_array(page_t *, int, int, pgcnt_t); 449 static void sfmmu_page_cache(page_t *, int, int, int); 450 #endif 451 452 cpuset_t sfmmu_rgntlb_demap(caddr_t, sf_region_t *, 453 struct hme_blk *, int); 454 static void sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *, 455 pfn_t, int, int, int, int); 456 static void sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *, 457 pfn_t, int); 458 static void sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int); 459 static void sfmmu_tlb_range_demap(demap_range_t *); 460 static void sfmmu_invalidate_ctx(sfmmu_t *); 461 static void sfmmu_sync_mmustate(sfmmu_t *); 462 463 static void sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t); 464 static int sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t, 465 sfmmu_t *); 466 static void sfmmu_tsb_free(struct tsb_info *); 467 static void sfmmu_tsbinfo_free(struct tsb_info *); 468 static int sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t, 469 sfmmu_t *); 470 static void sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *); 471 static void sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *); 472 static int sfmmu_select_tsb_szc(pgcnt_t); 473 static void sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int); 474 #define sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \ 475 sfmmu_mod_tsb(sfmmup, vaddr, tte, szc) 476 #define sfmmu_unload_tsb(sfmmup, vaddr, szc) \ 477 sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc) 478 static void sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *); 479 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t, 480 hatlock_t *, uint_t); 481 static void sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int); 482 483 #ifdef VAC 484 void sfmmu_cache_flush(pfn_t, int); 485 void sfmmu_cache_flushcolor(int, pfn_t); 486 #endif 487 static caddr_t sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t, 488 caddr_t, demap_range_t *, uint_t, int); 489 490 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *); 491 static uint_t sfmmu_ptov_attr(tte_t *); 492 static caddr_t sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t, 493 caddr_t, demap_range_t *, uint_t); 494 static uint_t sfmmu_vtop_prot(uint_t, uint_t *); 495 static int sfmmu_idcache_constructor(void *, void *, int); 496 static void sfmmu_idcache_destructor(void *, void *); 497 static int sfmmu_hblkcache_constructor(void *, void *, int); 498 static void sfmmu_hblkcache_destructor(void *, void *); 499 static void sfmmu_hblkcache_reclaim(void *); 500 static void sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *, 501 struct hmehash_bucket *); 502 static void sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *, 503 struct hme_blk *, struct hme_blk **, int); 504 static void sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *, 505 uint64_t); 506 static struct hme_blk *sfmmu_check_pending_hblks(int); 507 static void sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int); 508 static void sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int); 509 static void sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t, 510 int, caddr_t *); 511 static void sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *); 512 513 static void sfmmu_rm_large_mappings(page_t *, int); 514 515 static void hat_lock_init(void); 516 static void hat_kstat_init(void); 517 static int sfmmu_kstat_percpu_update(kstat_t *ksp, int rw); 518 static void sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *); 519 static int sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t); 520 static void sfmmu_check_page_sizes(sfmmu_t *, int); 521 int fnd_mapping_sz(page_t *); 522 static void iment_add(struct ism_ment *, struct hat *); 523 static void iment_sub(struct ism_ment *, struct hat *); 524 static pgcnt_t ism_tsb_entries(sfmmu_t *, int szc); 525 extern void sfmmu_setup_tsbinfo(sfmmu_t *); 526 extern void sfmmu_clear_utsbinfo(void); 527 528 static void sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t); 529 530 extern int vpm_enable; 531 532 /* kpm globals */ 533 #ifdef DEBUG 534 /* 535 * Enable trap level tsbmiss handling 536 */ 537 int kpm_tsbmtl = 1; 538 539 /* 540 * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the 541 * required TLB shootdowns in this case, so handle w/ care. Off by default. 542 */ 543 int kpm_tlb_flush; 544 #endif /* DEBUG */ 545 546 static void *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int); 547 548 #ifdef DEBUG 549 static void sfmmu_check_hblk_flist(); 550 #endif 551 552 /* 553 * Semi-private sfmmu data structures. Some of them are initialize in 554 * startup or in hat_init. Some of them are private but accessed by 555 * assembly code or mach_sfmmu.c 556 */ 557 struct hmehash_bucket *uhme_hash; /* user hmeblk hash table */ 558 struct hmehash_bucket *khme_hash; /* kernel hmeblk hash table */ 559 uint64_t uhme_hash_pa; /* PA of uhme_hash */ 560 uint64_t khme_hash_pa; /* PA of khme_hash */ 561 int uhmehash_num; /* # of buckets in user hash table */ 562 int khmehash_num; /* # of buckets in kernel hash table */ 563 564 uint_t max_mmu_ctxdoms = 0; /* max context domains in the system */ 565 mmu_ctx_t **mmu_ctxs_tbl; /* global array of context domains */ 566 uint64_t mmu_saved_gnum = 0; /* to init incoming MMUs' gnums */ 567 568 #define DEFAULT_NUM_CTXS_PER_MMU 8192 569 static uint_t nctxs = DEFAULT_NUM_CTXS_PER_MMU; 570 571 int cache; /* describes system cache */ 572 573 caddr_t ktsb_base; /* kernel 8k-indexed tsb base address */ 574 uint64_t ktsb_pbase; /* kernel 8k-indexed tsb phys address */ 575 int ktsb_szcode; /* kernel 8k-indexed tsb size code */ 576 int ktsb_sz; /* kernel 8k-indexed tsb size */ 577 578 caddr_t ktsb4m_base; /* kernel 4m-indexed tsb base address */ 579 uint64_t ktsb4m_pbase; /* kernel 4m-indexed tsb phys address */ 580 int ktsb4m_szcode; /* kernel 4m-indexed tsb size code */ 581 int ktsb4m_sz; /* kernel 4m-indexed tsb size */ 582 583 uint64_t kpm_tsbbase; /* kernel seg_kpm 4M TSB base address */ 584 int kpm_tsbsz; /* kernel seg_kpm 4M TSB size code */ 585 uint64_t kpmsm_tsbbase; /* kernel seg_kpm 8K TSB base address */ 586 int kpmsm_tsbsz; /* kernel seg_kpm 8K TSB size code */ 587 588 #ifndef sun4v 589 int utsb_dtlb_ttenum = -1; /* index in TLB for utsb locked TTE */ 590 int utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */ 591 int dtlb_resv_ttenum; /* index in TLB of first reserved TTE */ 592 caddr_t utsb_vabase; /* reserved kernel virtual memory */ 593 caddr_t utsb4m_vabase; /* for trap handler TSB accesses */ 594 #endif /* sun4v */ 595 uint64_t tsb_alloc_bytes = 0; /* bytes allocated to TSBs */ 596 vmem_t *kmem_tsb_default_arena[NLGRPS_MAX]; /* For dynamic TSBs */ 597 vmem_t *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */ 598 599 /* 600 * Size to use for TSB slabs. Future platforms that support page sizes 601 * larger than 4M may wish to change these values, and provide their own 602 * assembly macros for building and decoding the TSB base register contents. 603 * Note disable_large_pages will override the value set here. 604 */ 605 static uint_t tsb_slab_ttesz = TTE4M; 606 size_t tsb_slab_size = MMU_PAGESIZE4M; 607 uint_t tsb_slab_shift = MMU_PAGESHIFT4M; 608 /* PFN mask for TTE */ 609 size_t tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT; 610 611 /* 612 * Size to use for TSB slabs. These are used only when 256M tsb arenas 613 * exist. 614 */ 615 static uint_t bigtsb_slab_ttesz = TTE256M; 616 static size_t bigtsb_slab_size = MMU_PAGESIZE256M; 617 static uint_t bigtsb_slab_shift = MMU_PAGESHIFT256M; 618 /* 256M page alignment for 8K pfn */ 619 static size_t bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT; 620 621 /* largest TSB size to grow to, will be smaller on smaller memory systems */ 622 static int tsb_max_growsize = 0; 623 624 /* 625 * Tunable parameters dealing with TSB policies. 626 */ 627 628 /* 629 * This undocumented tunable forces all 8K TSBs to be allocated from 630 * the kernel heap rather than from the kmem_tsb_default_arena arenas. 631 */ 632 #ifdef DEBUG 633 int tsb_forceheap = 0; 634 #endif /* DEBUG */ 635 636 /* 637 * Decide whether to use per-lgroup arenas, or one global set of 638 * TSB arenas. The default is not to break up per-lgroup, since 639 * most platforms don't recognize any tangible benefit from it. 640 */ 641 int tsb_lgrp_affinity = 0; 642 643 /* 644 * Used for growing the TSB based on the process RSS. 645 * tsb_rss_factor is based on the smallest TSB, and is 646 * shifted by the TSB size to determine if we need to grow. 647 * The default will grow the TSB if the number of TTEs for 648 * this page size exceeds 75% of the number of TSB entries, 649 * which should _almost_ eliminate all conflict misses 650 * (at the expense of using up lots and lots of memory). 651 */ 652 #define TSB_RSS_FACTOR (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75) 653 #define SFMMU_RSS_TSBSIZE(tsbszc) (tsb_rss_factor << tsbszc) 654 #define SELECT_TSB_SIZECODE(pgcnt) ( \ 655 (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \ 656 default_tsb_size) 657 #define TSB_OK_SHRINK() \ 658 (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree) 659 #define TSB_OK_GROW() \ 660 (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree) 661 662 int enable_tsb_rss_sizing = 1; 663 int tsb_rss_factor = (int)TSB_RSS_FACTOR; 664 665 /* which TSB size code to use for new address spaces or if rss sizing off */ 666 int default_tsb_size = TSB_8K_SZCODE; 667 668 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */ 669 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */ 670 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT 32 671 672 #ifdef DEBUG 673 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */ 674 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */ 675 static int tsb_alloc_mtbf = 0; /* fail allocation every n attempts */ 676 static int tsb_alloc_fail_mtbf = 0; 677 static int tsb_alloc_count = 0; 678 #endif /* DEBUG */ 679 680 /* if set to 1, will remap valid TTEs when growing TSB. */ 681 int tsb_remap_ttes = 1; 682 683 /* 684 * If we have more than this many mappings, allocate a second TSB. 685 * This default is chosen because the I/D fully associative TLBs are 686 * assumed to have at least 8 available entries. Platforms with a 687 * larger fully-associative TLB could probably override the default. 688 */ 689 690 #ifdef sun4v 691 int tsb_sectsb_threshold = 0; 692 #else 693 int tsb_sectsb_threshold = 8; 694 #endif 695 696 /* 697 * kstat data 698 */ 699 struct sfmmu_global_stat sfmmu_global_stat; 700 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat; 701 702 /* 703 * Global data 704 */ 705 sfmmu_t *ksfmmup; /* kernel's hat id */ 706 707 #ifdef DEBUG 708 static void chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *); 709 #endif 710 711 /* sfmmu locking operations */ 712 static kmutex_t *sfmmu_mlspl_enter(struct page *, int); 713 static int sfmmu_mlspl_held(struct page *, int); 714 715 kmutex_t *sfmmu_page_enter(page_t *); 716 void sfmmu_page_exit(kmutex_t *); 717 int sfmmu_page_spl_held(struct page *); 718 719 /* sfmmu internal locking operations - accessed directly */ 720 static void sfmmu_mlist_reloc_enter(page_t *, page_t *, 721 kmutex_t **, kmutex_t **); 722 static void sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *); 723 static hatlock_t * 724 sfmmu_hat_enter(sfmmu_t *); 725 static hatlock_t * 726 sfmmu_hat_tryenter(sfmmu_t *); 727 static void sfmmu_hat_exit(hatlock_t *); 728 static void sfmmu_hat_lock_all(void); 729 static void sfmmu_hat_unlock_all(void); 730 static void sfmmu_ismhat_enter(sfmmu_t *, int); 731 static void sfmmu_ismhat_exit(sfmmu_t *, int); 732 733 kpm_hlk_t *kpmp_table; 734 uint_t kpmp_table_sz; /* must be a power of 2 */ 735 uchar_t kpmp_shift; 736 737 kpm_shlk_t *kpmp_stable; 738 uint_t kpmp_stable_sz; /* must be a power of 2 */ 739 740 /* 741 * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128. 742 * SPL_SHIFT is log2(SPL_TABLE_SIZE). 743 */ 744 #if ((2*NCPU_P2) > 128) 745 #define SPL_SHIFT ((unsigned)(NCPU_LOG2 + 1)) 746 #else 747 #define SPL_SHIFT 7U 748 #endif 749 #define SPL_TABLE_SIZE (1U << SPL_SHIFT) 750 #define SPL_MASK (SPL_TABLE_SIZE - 1) 751 752 /* 753 * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t 754 * and by multiples of SPL_SHIFT to get as many varied bits as we can. 755 */ 756 #define SPL_INDEX(pp) \ 757 ((((uintptr_t)(pp) >> PP_SHIFT) ^ \ 758 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \ 759 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \ 760 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \ 761 SPL_MASK) 762 763 #define SPL_HASH(pp) \ 764 (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex) 765 766 static pad_mutex_t sfmmu_page_lock[SPL_TABLE_SIZE]; 767 768 /* Array of mutexes protecting a page's mapping list and p_nrm field. */ 769 770 #define MML_TABLE_SIZE SPL_TABLE_SIZE 771 #define MLIST_HASH(pp) (&mml_table[SPL_INDEX(pp)].pad_mutex) 772 773 static pad_mutex_t mml_table[MML_TABLE_SIZE]; 774 775 /* 776 * hat_unload_callback() will group together callbacks in order 777 * to avoid xt_sync() calls. This is the maximum size of the group. 778 */ 779 #define MAX_CB_ADDR 32 780 781 tte_t hw_tte; 782 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT; 783 784 static char *mmu_ctx_kstat_names[] = { 785 "mmu_ctx_tsb_exceptions", 786 "mmu_ctx_tsb_raise_exception", 787 "mmu_ctx_wrap_around", 788 }; 789 790 /* 791 * Wrapper for vmem_xalloc since vmem_create only allows limited 792 * parameters for vm_source_alloc functions. This function allows us 793 * to specify alignment consistent with the size of the object being 794 * allocated. 795 */ 796 static void * 797 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag) 798 { 799 return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag)); 800 } 801 802 /* Common code for setting tsb_alloc_hiwater. */ 803 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages) tsb_alloc_hiwater = \ 804 ptob(pages) / tsb_alloc_hiwater_factor 805 806 /* 807 * Set tsb_max_growsize to allow at most all of physical memory to be mapped by 808 * a single TSB. physmem is the number of physical pages so we need physmem 8K 809 * TTEs to represent all those physical pages. We round this up by using 810 * 1<<highbit(). To figure out which size code to use, remember that the size 811 * code is just an amount to shift the smallest TSB size to get the size of 812 * this TSB. So we subtract that size, TSB_START_SIZE, from highbit() (or 813 * highbit() - 1) to get the size code for the smallest TSB that can represent 814 * all of physical memory, while erring on the side of too much. 815 * 816 * Restrict tsb_max_growsize to make sure that: 817 * 1) TSBs can't grow larger than the TSB slab size 818 * 2) TSBs can't grow larger than UTSB_MAX_SZCODE. 819 */ 820 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) { \ 821 int _i, _szc, _slabszc, _tsbszc; \ 822 \ 823 _i = highbit(pages); \ 824 if ((1 << (_i - 1)) == (pages)) \ 825 _i--; /* 2^n case, round down */ \ 826 _szc = _i - TSB_START_SIZE; \ 827 _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \ 828 _tsbszc = MIN(_szc, _slabszc); \ 829 tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE); \ 830 } 831 832 /* 833 * Given a pointer to an sfmmu and a TTE size code, return a pointer to the 834 * tsb_info which handles that TTE size. 835 */ 836 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) { \ 837 (tsbinfop) = (sfmmup)->sfmmu_tsb; \ 838 ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) || \ 839 sfmmu_hat_lock_held(sfmmup)); \ 840 if ((tte_szc) >= TTE4M) { \ 841 ASSERT((tsbinfop) != NULL); \ 842 (tsbinfop) = (tsbinfop)->tsb_next; \ 843 } \ 844 } 845 846 /* 847 * Macro to use to unload entries from the TSB. 848 * It has knowledge of which page sizes get replicated in the TSB 849 * and will call the appropriate unload routine for the appropriate size. 850 */ 851 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat) \ 852 { \ 853 int ttesz = get_hblk_ttesz(hmeblkp); \ 854 if (ttesz == TTE8K || ttesz == TTE4M) { \ 855 sfmmu_unload_tsb(sfmmup, addr, ttesz); \ 856 } else { \ 857 caddr_t sva = ismhat ? addr : \ 858 (caddr_t)get_hblk_base(hmeblkp); \ 859 caddr_t eva = sva + get_hblk_span(hmeblkp); \ 860 ASSERT(addr >= sva && addr < eva); \ 861 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz); \ 862 } \ 863 } 864 865 866 /* Update tsb_alloc_hiwater after memory is configured. */ 867 /*ARGSUSED*/ 868 static void 869 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages) 870 { 871 /* Assumes physmem has already been updated. */ 872 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 873 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 874 } 875 876 /* 877 * Update tsb_alloc_hiwater before memory is deleted. We'll do nothing here 878 * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is 879 * deleted. 880 */ 881 /*ARGSUSED*/ 882 static int 883 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages) 884 { 885 return (0); 886 } 887 888 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */ 889 /*ARGSUSED*/ 890 static void 891 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled) 892 { 893 /* 894 * Whether the delete was cancelled or not, just go ahead and update 895 * tsb_alloc_hiwater and tsb_max_growsize. 896 */ 897 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 898 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 899 } 900 901 static kphysm_setup_vector_t sfmmu_update_vec = { 902 KPHYSM_SETUP_VECTOR_VERSION, /* version */ 903 sfmmu_update_post_add, /* post_add */ 904 sfmmu_update_pre_del, /* pre_del */ 905 sfmmu_update_post_del /* post_del */ 906 }; 907 908 909 /* 910 * HME_BLK HASH PRIMITIVES 911 */ 912 913 /* 914 * Enter a hme on the mapping list for page pp. 915 * When large pages are more prevalent in the system we might want to 916 * keep the mapping list in ascending order by the hment size. For now, 917 * small pages are more frequent, so don't slow it down. 918 */ 919 #define HME_ADD(hme, pp) \ 920 { \ 921 ASSERT(sfmmu_mlist_held(pp)); \ 922 \ 923 hme->hme_prev = NULL; \ 924 hme->hme_next = pp->p_mapping; \ 925 hme->hme_page = pp; \ 926 if (pp->p_mapping) { \ 927 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\ 928 ASSERT(pp->p_share > 0); \ 929 } else { \ 930 /* EMPTY */ \ 931 ASSERT(pp->p_share == 0); \ 932 } \ 933 pp->p_mapping = hme; \ 934 pp->p_share++; \ 935 } 936 937 /* 938 * Enter a hme on the mapping list for page pp. 939 * If we are unmapping a large translation, we need to make sure that the 940 * change is reflect in the corresponding bit of the p_index field. 941 */ 942 #define HME_SUB(hme, pp) \ 943 { \ 944 ASSERT(sfmmu_mlist_held(pp)); \ 945 ASSERT(hme->hme_page == pp || IS_PAHME(hme)); \ 946 \ 947 if (pp->p_mapping == NULL) { \ 948 panic("hme_remove - no mappings"); \ 949 } \ 950 \ 951 membar_stst(); /* ensure previous stores finish */ \ 952 \ 953 ASSERT(pp->p_share > 0); \ 954 pp->p_share--; \ 955 \ 956 if (hme->hme_prev) { \ 957 ASSERT(pp->p_mapping != hme); \ 958 ASSERT(hme->hme_prev->hme_page == pp || \ 959 IS_PAHME(hme->hme_prev)); \ 960 hme->hme_prev->hme_next = hme->hme_next; \ 961 } else { \ 962 ASSERT(pp->p_mapping == hme); \ 963 pp->p_mapping = hme->hme_next; \ 964 ASSERT((pp->p_mapping == NULL) ? \ 965 (pp->p_share == 0) : 1); \ 966 } \ 967 \ 968 if (hme->hme_next) { \ 969 ASSERT(hme->hme_next->hme_page == pp || \ 970 IS_PAHME(hme->hme_next)); \ 971 hme->hme_next->hme_prev = hme->hme_prev; \ 972 } \ 973 \ 974 /* zero out the entry */ \ 975 hme->hme_next = NULL; \ 976 hme->hme_prev = NULL; \ 977 hme->hme_page = NULL; \ 978 \ 979 if (hme_size(hme) > TTE8K) { \ 980 /* remove mappings for remainder of large pg */ \ 981 sfmmu_rm_large_mappings(pp, hme_size(hme)); \ 982 } \ 983 } 984 985 /* 986 * This function returns the hment given the hme_blk and a vaddr. 987 * It assumes addr has already been checked to belong to hme_blk's 988 * range. 989 */ 990 #define HBLKTOHME(hment, hmeblkp, addr) \ 991 { \ 992 int index; \ 993 HBLKTOHME_IDX(hment, hmeblkp, addr, index) \ 994 } 995 996 /* 997 * Version of HBLKTOHME that also returns the index in hmeblkp 998 * of the hment. 999 */ 1000 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx) \ 1001 { \ 1002 ASSERT(in_hblk_range((hmeblkp), (addr))); \ 1003 \ 1004 if (get_hblk_ttesz(hmeblkp) == TTE8K) { \ 1005 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \ 1006 } else \ 1007 idx = 0; \ 1008 \ 1009 (hment) = &(hmeblkp)->hblk_hme[idx]; \ 1010 } 1011 1012 /* 1013 * Disable any page sizes not supported by the CPU 1014 */ 1015 void 1016 hat_init_pagesizes() 1017 { 1018 int i; 1019 1020 mmu_exported_page_sizes = 0; 1021 for (i = TTE8K; i < max_mmu_page_sizes; i++) { 1022 1023 szc_2_userszc[i] = (uint_t)-1; 1024 userszc_2_szc[i] = (uint_t)-1; 1025 1026 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) { 1027 disable_large_pages |= (1 << i); 1028 } else { 1029 szc_2_userszc[i] = mmu_exported_page_sizes; 1030 userszc_2_szc[mmu_exported_page_sizes] = i; 1031 mmu_exported_page_sizes++; 1032 } 1033 } 1034 1035 disable_ism_large_pages |= disable_large_pages; 1036 disable_auto_data_large_pages = disable_large_pages; 1037 disable_auto_text_large_pages = disable_large_pages; 1038 1039 /* 1040 * Initialize mmu-specific large page sizes. 1041 */ 1042 if (&mmu_large_pages_disabled) { 1043 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD); 1044 disable_ism_large_pages |= 1045 mmu_large_pages_disabled(HAT_LOAD_SHARE); 1046 disable_auto_data_large_pages |= 1047 mmu_large_pages_disabled(HAT_AUTO_DATA); 1048 disable_auto_text_large_pages |= 1049 mmu_large_pages_disabled(HAT_AUTO_TEXT); 1050 } 1051 } 1052 1053 /* 1054 * Initialize the hardware address translation structures. 1055 */ 1056 void 1057 hat_init(void) 1058 { 1059 int i; 1060 uint_t sz; 1061 size_t size; 1062 1063 hat_lock_init(); 1064 hat_kstat_init(); 1065 1066 /* 1067 * Hardware-only bits in a TTE 1068 */ 1069 MAKE_TTE_MASK(&hw_tte); 1070 1071 hat_init_pagesizes(); 1072 1073 /* Initialize the hash locks */ 1074 for (i = 0; i < khmehash_num; i++) { 1075 mutex_init(&khme_hash[i].hmehash_mutex, NULL, 1076 MUTEX_DEFAULT, NULL); 1077 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA; 1078 } 1079 for (i = 0; i < uhmehash_num; i++) { 1080 mutex_init(&uhme_hash[i].hmehash_mutex, NULL, 1081 MUTEX_DEFAULT, NULL); 1082 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA; 1083 } 1084 khmehash_num--; /* make sure counter starts from 0 */ 1085 uhmehash_num--; /* make sure counter starts from 0 */ 1086 1087 /* 1088 * Allocate context domain structures. 1089 * 1090 * A platform may choose to modify max_mmu_ctxdoms in 1091 * set_platform_defaults(). If a platform does not define 1092 * a set_platform_defaults() or does not choose to modify 1093 * max_mmu_ctxdoms, it gets one MMU context domain for every CPU. 1094 * 1095 * For all platforms that have CPUs sharing MMUs, this 1096 * value must be defined. 1097 */ 1098 if (max_mmu_ctxdoms == 0) 1099 max_mmu_ctxdoms = max_ncpus; 1100 1101 size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *); 1102 mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP); 1103 1104 /* mmu_ctx_t is 64 bytes aligned */ 1105 mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache", 1106 sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0); 1107 /* 1108 * MMU context domain initialization for the Boot CPU. 1109 * This needs the context domains array allocated above. 1110 */ 1111 mutex_enter(&cpu_lock); 1112 sfmmu_cpu_init(CPU); 1113 mutex_exit(&cpu_lock); 1114 1115 /* 1116 * Intialize ism mapping list lock. 1117 */ 1118 1119 mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL); 1120 1121 /* 1122 * Each sfmmu structure carries an array of MMU context info 1123 * structures, one per context domain. The size of this array depends 1124 * on the maximum number of context domains. So, the size of the 1125 * sfmmu structure varies per platform. 1126 * 1127 * sfmmu is allocated from static arena, because trap 1128 * handler at TL > 0 is not allowed to touch kernel relocatable 1129 * memory. sfmmu's alignment is changed to 64 bytes from 1130 * default 8 bytes, as the lower 6 bits will be used to pass 1131 * pgcnt to vtag_flush_pgcnt_tl1. 1132 */ 1133 size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1); 1134 1135 sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size, 1136 64, sfmmu_idcache_constructor, sfmmu_idcache_destructor, 1137 NULL, NULL, static_arena, 0); 1138 1139 sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache", 1140 sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0); 1141 1142 /* 1143 * Since we only use the tsb8k cache to "borrow" pages for TSBs 1144 * from the heap when low on memory or when TSB_FORCEALLOC is 1145 * specified, don't use magazines to cache them--we want to return 1146 * them to the system as quickly as possible. 1147 */ 1148 sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache", 1149 MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL, 1150 static_arena, KMC_NOMAGAZINE); 1151 1152 /* 1153 * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical 1154 * memory, which corresponds to the old static reserve for TSBs. 1155 * tsb_alloc_hiwater_factor defaults to 32. This caps the amount of 1156 * memory we'll allocate for TSB slabs; beyond this point TSB 1157 * allocations will be taken from the kernel heap (via 1158 * sfmmu_tsb8k_cache) and will be throttled as would any other kmem 1159 * consumer. 1160 */ 1161 if (tsb_alloc_hiwater_factor == 0) { 1162 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT; 1163 } 1164 SFMMU_SET_TSB_ALLOC_HIWATER(physmem); 1165 1166 for (sz = tsb_slab_ttesz; sz > 0; sz--) { 1167 if (!(disable_large_pages & (1 << sz))) 1168 break; 1169 } 1170 1171 if (sz < tsb_slab_ttesz) { 1172 tsb_slab_ttesz = sz; 1173 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz; 1174 tsb_slab_size = 1 << tsb_slab_shift; 1175 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1; 1176 use_bigtsb_arena = 0; 1177 } else if (use_bigtsb_arena && 1178 (disable_large_pages & (1 << bigtsb_slab_ttesz))) { 1179 use_bigtsb_arena = 0; 1180 } 1181 1182 if (!use_bigtsb_arena) { 1183 bigtsb_slab_shift = tsb_slab_shift; 1184 } 1185 SFMMU_SET_TSB_MAX_GROWSIZE(physmem); 1186 1187 /* 1188 * On smaller memory systems, allocate TSB memory in smaller chunks 1189 * than the default 4M slab size. We also honor disable_large_pages 1190 * here. 1191 * 1192 * The trap handlers need to be patched with the final slab shift, 1193 * since they need to be able to construct the TSB pointer at runtime. 1194 */ 1195 if ((tsb_max_growsize <= TSB_512K_SZCODE) && 1196 !(disable_large_pages & (1 << TTE512K))) { 1197 tsb_slab_ttesz = TTE512K; 1198 tsb_slab_shift = MMU_PAGESHIFT512K; 1199 tsb_slab_size = MMU_PAGESIZE512K; 1200 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT; 1201 use_bigtsb_arena = 0; 1202 } 1203 1204 if (!use_bigtsb_arena) { 1205 bigtsb_slab_ttesz = tsb_slab_ttesz; 1206 bigtsb_slab_shift = tsb_slab_shift; 1207 bigtsb_slab_size = tsb_slab_size; 1208 bigtsb_slab_mask = tsb_slab_mask; 1209 } 1210 1211 1212 /* 1213 * Set up memory callback to update tsb_alloc_hiwater and 1214 * tsb_max_growsize. 1215 */ 1216 i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0); 1217 ASSERT(i == 0); 1218 1219 /* 1220 * kmem_tsb_arena is the source from which large TSB slabs are 1221 * drawn. The quantum of this arena corresponds to the largest 1222 * TSB size we can dynamically allocate for user processes. 1223 * Currently it must also be a supported page size since we 1224 * use exactly one translation entry to map each slab page. 1225 * 1226 * The per-lgroup kmem_tsb_default_arena arenas are the arenas from 1227 * which most TSBs are allocated. Since most TSB allocations are 1228 * typically 8K we have a kmem cache we stack on top of each 1229 * kmem_tsb_default_arena to speed up those allocations. 1230 * 1231 * Note the two-level scheme of arenas is required only 1232 * because vmem_create doesn't allow us to specify alignment 1233 * requirements. If this ever changes the code could be 1234 * simplified to use only one level of arenas. 1235 * 1236 * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena 1237 * will be provided in addition to the 4M kmem_tsb_arena. 1238 */ 1239 if (use_bigtsb_arena) { 1240 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0, 1241 bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper, 1242 vmem_xfree, heap_arena, 0, VM_SLEEP); 1243 } 1244 1245 kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size, 1246 sfmmu_vmem_xalloc_aligned_wrapper, 1247 vmem_xfree, heap_arena, 0, VM_SLEEP); 1248 1249 if (tsb_lgrp_affinity) { 1250 char s[50]; 1251 for (i = 0; i < NLGRPS_MAX; i++) { 1252 if (use_bigtsb_arena) { 1253 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i); 1254 kmem_bigtsb_default_arena[i] = vmem_create(s, 1255 NULL, 0, 2 * tsb_slab_size, 1256 sfmmu_tsb_segkmem_alloc, 1257 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 1258 0, VM_SLEEP | VM_BESTFIT); 1259 } 1260 1261 (void) sprintf(s, "kmem_tsb_lgrp%d", i); 1262 kmem_tsb_default_arena[i] = vmem_create(s, 1263 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc, 1264 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0, 1265 VM_SLEEP | VM_BESTFIT); 1266 1267 (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i); 1268 sfmmu_tsb_cache[i] = kmem_cache_create(s, 1269 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL, 1270 kmem_tsb_default_arena[i], 0); 1271 } 1272 } else { 1273 if (use_bigtsb_arena) { 1274 kmem_bigtsb_default_arena[0] = 1275 vmem_create("kmem_bigtsb_default", NULL, 0, 1276 2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc, 1277 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0, 1278 VM_SLEEP | VM_BESTFIT); 1279 } 1280 1281 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default", 1282 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc, 1283 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0, 1284 VM_SLEEP | VM_BESTFIT); 1285 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache", 1286 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL, 1287 kmem_tsb_default_arena[0], 0); 1288 } 1289 1290 sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ, 1291 HMEBLK_ALIGN, sfmmu_hblkcache_constructor, 1292 sfmmu_hblkcache_destructor, 1293 sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ, 1294 hat_memload_arena, KMC_NOHASH); 1295 1296 hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE, 1297 segkmem_alloc_permanent, segkmem_free, heap_arena, 0, 1298 VMC_DUMPSAFE | VM_SLEEP); 1299 1300 sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ, 1301 HMEBLK_ALIGN, sfmmu_hblkcache_constructor, 1302 sfmmu_hblkcache_destructor, 1303 NULL, (void *)HME1BLK_SZ, 1304 hat_memload1_arena, KMC_NOHASH); 1305 1306 pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ, 1307 0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH); 1308 1309 ism_blk_cache = kmem_cache_create("ism_blk_cache", 1310 sizeof (ism_blk_t), ecache_alignsize, NULL, NULL, 1311 NULL, NULL, static_arena, KMC_NOHASH); 1312 1313 ism_ment_cache = kmem_cache_create("ism_ment_cache", 1314 sizeof (ism_ment_t), 0, NULL, NULL, 1315 NULL, NULL, NULL, 0); 1316 1317 /* 1318 * We grab the first hat for the kernel, 1319 */ 1320 AS_LOCK_ENTER(&kas, RW_WRITER); 1321 kas.a_hat = hat_alloc(&kas); 1322 AS_LOCK_EXIT(&kas); 1323 1324 /* 1325 * Initialize hblk_reserve. 1326 */ 1327 ((struct hme_blk *)hblk_reserve)->hblk_nextpa = 1328 va_to_pa((caddr_t)hblk_reserve); 1329 1330 #ifndef UTSB_PHYS 1331 /* 1332 * Reserve some kernel virtual address space for the locked TTEs 1333 * that allow us to probe the TSB from TL>0. 1334 */ 1335 utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size, 1336 0, 0, NULL, NULL, VM_SLEEP); 1337 utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size, 1338 0, 0, NULL, NULL, VM_SLEEP); 1339 #endif 1340 1341 #ifdef VAC 1342 /* 1343 * The big page VAC handling code assumes VAC 1344 * will not be bigger than the smallest big 1345 * page- which is 64K. 1346 */ 1347 if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) { 1348 cmn_err(CE_PANIC, "VAC too big!"); 1349 } 1350 #endif 1351 1352 uhme_hash_pa = va_to_pa(uhme_hash); 1353 khme_hash_pa = va_to_pa(khme_hash); 1354 1355 /* 1356 * Initialize relocation locks. kpr_suspendlock is held 1357 * at PIL_MAX to prevent interrupts from pinning the holder 1358 * of a suspended TTE which may access it leading to a 1359 * deadlock condition. 1360 */ 1361 mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL); 1362 mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX); 1363 1364 /* 1365 * If Shared context support is disabled via /etc/system 1366 * set shctx_on to 0 here if it was set to 1 earlier in boot 1367 * sequence by cpu module initialization code. 1368 */ 1369 if (shctx_on && disable_shctx) { 1370 shctx_on = 0; 1371 } 1372 1373 if (shctx_on) { 1374 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS * 1375 sizeof (srd_buckets[0]), KM_SLEEP); 1376 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) { 1377 mutex_init(&srd_buckets[i].srdb_lock, NULL, 1378 MUTEX_DEFAULT, NULL); 1379 } 1380 1381 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t), 1382 0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor, 1383 NULL, NULL, NULL, 0); 1384 region_cache = kmem_cache_create("region_cache", 1385 sizeof (sf_region_t), 0, sfmmu_rgncache_constructor, 1386 sfmmu_rgncache_destructor, NULL, NULL, NULL, 0); 1387 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t), 1388 0, sfmmu_scdcache_constructor, sfmmu_scdcache_destructor, 1389 NULL, NULL, NULL, 0); 1390 } 1391 1392 /* 1393 * Pre-allocate hrm_hashtab before enabling the collection of 1394 * refmod statistics. Allocating on the fly would mean us 1395 * running the risk of suffering recursive mutex enters or 1396 * deadlocks. 1397 */ 1398 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *), 1399 KM_SLEEP); 1400 1401 /* Allocate per-cpu pending freelist of hmeblks */ 1402 cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64, 1403 KM_SLEEP); 1404 cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP( 1405 (uintptr_t)cpu_hme_pend, 64); 1406 1407 for (i = 0; i < NCPU; i++) { 1408 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT, 1409 NULL); 1410 } 1411 1412 if (cpu_hme_pend_thresh == 0) { 1413 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH; 1414 } 1415 } 1416 1417 /* 1418 * Initialize locking for the hat layer, called early during boot. 1419 */ 1420 static void 1421 hat_lock_init() 1422 { 1423 int i; 1424 1425 /* 1426 * initialize the array of mutexes protecting a page's mapping 1427 * list and p_nrm field. 1428 */ 1429 for (i = 0; i < MML_TABLE_SIZE; i++) 1430 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL); 1431 1432 if (kpm_enable) { 1433 for (i = 0; i < kpmp_table_sz; i++) { 1434 mutex_init(&kpmp_table[i].khl_mutex, NULL, 1435 MUTEX_DEFAULT, NULL); 1436 } 1437 } 1438 1439 /* 1440 * Initialize array of mutex locks that protects sfmmu fields and 1441 * TSB lists. 1442 */ 1443 for (i = 0; i < SFMMU_NUM_LOCK; i++) 1444 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT, 1445 NULL); 1446 } 1447 1448 #define SFMMU_KERNEL_MAXVA \ 1449 (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT)) 1450 1451 /* 1452 * Allocate a hat structure. 1453 * Called when an address space first uses a hat. 1454 */ 1455 struct hat * 1456 hat_alloc(struct as *as) 1457 { 1458 sfmmu_t *sfmmup; 1459 int i; 1460 uint64_t cnum; 1461 extern uint_t get_color_start(struct as *); 1462 1463 ASSERT(AS_WRITE_HELD(as)); 1464 sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP); 1465 sfmmup->sfmmu_as = as; 1466 sfmmup->sfmmu_flags = 0; 1467 sfmmup->sfmmu_tteflags = 0; 1468 sfmmup->sfmmu_rtteflags = 0; 1469 LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock); 1470 1471 if (as == &kas) { 1472 ksfmmup = sfmmup; 1473 sfmmup->sfmmu_cext = 0; 1474 cnum = KCONTEXT; 1475 1476 sfmmup->sfmmu_clrstart = 0; 1477 sfmmup->sfmmu_tsb = NULL; 1478 /* 1479 * hat_kern_setup() will call sfmmu_init_ktsbinfo() 1480 * to setup tsb_info for ksfmmup. 1481 */ 1482 } else { 1483 1484 /* 1485 * Just set to invalid ctx. When it faults, it will 1486 * get a valid ctx. This would avoid the situation 1487 * where we get a ctx, but it gets stolen and then 1488 * we fault when we try to run and so have to get 1489 * another ctx. 1490 */ 1491 sfmmup->sfmmu_cext = 0; 1492 cnum = INVALID_CONTEXT; 1493 1494 /* initialize original physical page coloring bin */ 1495 sfmmup->sfmmu_clrstart = get_color_start(as); 1496 #ifdef DEBUG 1497 if (tsb_random_size) { 1498 uint32_t randval = (uint32_t)gettick() >> 4; 1499 int size = randval % (tsb_max_growsize + 1); 1500 1501 /* chose a random tsb size for stress testing */ 1502 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size, 1503 TSB8K|TSB64K|TSB512K, 0, sfmmup); 1504 } else 1505 #endif /* DEBUG */ 1506 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, 1507 default_tsb_size, 1508 TSB8K|TSB64K|TSB512K, 0, sfmmup); 1509 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID; 1510 ASSERT(sfmmup->sfmmu_tsb != NULL); 1511 } 1512 1513 ASSERT(max_mmu_ctxdoms > 0); 1514 for (i = 0; i < max_mmu_ctxdoms; i++) { 1515 sfmmup->sfmmu_ctxs[i].cnum = cnum; 1516 sfmmup->sfmmu_ctxs[i].gnum = 0; 1517 } 1518 1519 for (i = 0; i < max_mmu_page_sizes; i++) { 1520 sfmmup->sfmmu_ttecnt[i] = 0; 1521 sfmmup->sfmmu_scdrttecnt[i] = 0; 1522 sfmmup->sfmmu_ismttecnt[i] = 0; 1523 sfmmup->sfmmu_scdismttecnt[i] = 0; 1524 sfmmup->sfmmu_pgsz[i] = TTE8K; 1525 } 1526 sfmmup->sfmmu_tsb0_4minflcnt = 0; 1527 sfmmup->sfmmu_iblk = NULL; 1528 sfmmup->sfmmu_ismhat = 0; 1529 sfmmup->sfmmu_scdhat = 0; 1530 sfmmup->sfmmu_ismblkpa = (uint64_t)-1; 1531 if (sfmmup == ksfmmup) { 1532 CPUSET_ALL(sfmmup->sfmmu_cpusran); 1533 } else { 1534 CPUSET_ZERO(sfmmup->sfmmu_cpusran); 1535 } 1536 sfmmup->sfmmu_free = 0; 1537 sfmmup->sfmmu_rmstat = 0; 1538 sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart; 1539 cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL); 1540 sfmmup->sfmmu_srdp = NULL; 1541 SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map); 1542 bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE); 1543 sfmmup->sfmmu_scdp = NULL; 1544 sfmmup->sfmmu_scd_link.next = NULL; 1545 sfmmup->sfmmu_scd_link.prev = NULL; 1546 return (sfmmup); 1547 } 1548 1549 /* 1550 * Create per-MMU context domain kstats for a given MMU ctx. 1551 */ 1552 static void 1553 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp) 1554 { 1555 mmu_ctx_stat_t stat; 1556 kstat_t *mmu_kstat; 1557 1558 ASSERT(MUTEX_HELD(&cpu_lock)); 1559 ASSERT(mmu_ctxp->mmu_kstat == NULL); 1560 1561 mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx", 1562 "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL); 1563 1564 if (mmu_kstat == NULL) { 1565 cmn_err(CE_WARN, "kstat_create for MMU %d failed", 1566 mmu_ctxp->mmu_idx); 1567 } else { 1568 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data; 1569 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++) 1570 kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat], 1571 mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64); 1572 mmu_ctxp->mmu_kstat = mmu_kstat; 1573 kstat_install(mmu_kstat); 1574 } 1575 } 1576 1577 /* 1578 * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU 1579 * context domain information for a given CPU. If a platform does not 1580 * specify that interface, then the function below is used instead to return 1581 * default information. The defaults are as follows: 1582 * 1583 * - The number of MMU context IDs supported on any CPU in the 1584 * system is 8K. 1585 * - There is one MMU context domain per CPU. 1586 */ 1587 /*ARGSUSED*/ 1588 static void 1589 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop) 1590 { 1591 infop->mmu_nctxs = nctxs; 1592 infop->mmu_idx = cpu[cpuid]->cpu_seqid; 1593 } 1594 1595 /* 1596 * Called during CPU initialization to set the MMU context-related information 1597 * for a CPU. 1598 * 1599 * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum. 1600 */ 1601 void 1602 sfmmu_cpu_init(cpu_t *cp) 1603 { 1604 mmu_ctx_info_t info; 1605 mmu_ctx_t *mmu_ctxp; 1606 1607 ASSERT(MUTEX_HELD(&cpu_lock)); 1608 1609 if (&plat_cpuid_to_mmu_ctx_info == NULL) 1610 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info); 1611 else 1612 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info); 1613 1614 ASSERT(info.mmu_idx < max_mmu_ctxdoms); 1615 1616 if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) { 1617 /* Each mmu_ctx is cacheline aligned. */ 1618 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP); 1619 bzero(mmu_ctxp, sizeof (mmu_ctx_t)); 1620 1621 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN, 1622 (void *)ipltospl(DISP_LEVEL)); 1623 mmu_ctxp->mmu_idx = info.mmu_idx; 1624 mmu_ctxp->mmu_nctxs = info.mmu_nctxs; 1625 /* 1626 * Globally for lifetime of a system, 1627 * gnum must always increase. 1628 * mmu_saved_gnum is protected by the cpu_lock. 1629 */ 1630 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1; 1631 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS; 1632 1633 sfmmu_mmu_kstat_create(mmu_ctxp); 1634 1635 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp; 1636 } else { 1637 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx); 1638 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs); 1639 } 1640 1641 /* 1642 * The mmu_lock is acquired here to prevent races with 1643 * the wrap-around code. 1644 */ 1645 mutex_enter(&mmu_ctxp->mmu_lock); 1646 1647 1648 mmu_ctxp->mmu_ncpus++; 1649 CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id); 1650 CPU_MMU_IDX(cp) = info.mmu_idx; 1651 CPU_MMU_CTXP(cp) = mmu_ctxp; 1652 1653 mutex_exit(&mmu_ctxp->mmu_lock); 1654 } 1655 1656 static void 1657 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp) 1658 { 1659 ASSERT(MUTEX_HELD(&cpu_lock)); 1660 ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock)); 1661 1662 mutex_destroy(&mmu_ctxp->mmu_lock); 1663 1664 if (mmu_ctxp->mmu_kstat) 1665 kstat_delete(mmu_ctxp->mmu_kstat); 1666 1667 /* mmu_saved_gnum is protected by the cpu_lock. */ 1668 if (mmu_saved_gnum < mmu_ctxp->mmu_gnum) 1669 mmu_saved_gnum = mmu_ctxp->mmu_gnum; 1670 1671 kmem_cache_free(mmuctxdom_cache, mmu_ctxp); 1672 } 1673 1674 /* 1675 * Called to perform MMU context-related cleanup for a CPU. 1676 */ 1677 void 1678 sfmmu_cpu_cleanup(cpu_t *cp) 1679 { 1680 mmu_ctx_t *mmu_ctxp; 1681 1682 ASSERT(MUTEX_HELD(&cpu_lock)); 1683 1684 mmu_ctxp = CPU_MMU_CTXP(cp); 1685 ASSERT(mmu_ctxp != NULL); 1686 1687 /* 1688 * The mmu_lock is acquired here to prevent races with 1689 * the wrap-around code. 1690 */ 1691 mutex_enter(&mmu_ctxp->mmu_lock); 1692 1693 CPU_MMU_CTXP(cp) = NULL; 1694 1695 CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id); 1696 if (--mmu_ctxp->mmu_ncpus == 0) { 1697 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL; 1698 mutex_exit(&mmu_ctxp->mmu_lock); 1699 sfmmu_ctxdom_free(mmu_ctxp); 1700 return; 1701 } 1702 1703 mutex_exit(&mmu_ctxp->mmu_lock); 1704 } 1705 1706 uint_t 1707 sfmmu_ctxdom_nctxs(int idx) 1708 { 1709 return (mmu_ctxs_tbl[idx]->mmu_nctxs); 1710 } 1711 1712 #ifdef sun4v 1713 /* 1714 * sfmmu_ctxdoms_* is an interface provided to help keep context domains 1715 * consistant after suspend/resume on system that can resume on a different 1716 * hardware than it was suspended. 1717 * 1718 * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts 1719 * from being allocated. It acquires all hat_locks, which blocks most access to 1720 * context data, except for a few cases that are handled separately or are 1721 * harmless. It wraps each domain to increment gnum and invalidate on-CPU 1722 * contexts, and forces cnum to its max. As a result of this call all user 1723 * threads that are running on CPUs trap and try to perform wrap around but 1724 * can't because hat_locks are taken. Threads that were not on CPUs but started 1725 * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking 1726 * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block 1727 * on hat_lock trying to wrap. sfmmu_ctxdom_lock() must be called before CPUs 1728 * are paused, else it could deadlock acquiring locks held by paused CPUs. 1729 * 1730 * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records 1731 * the CPUs that had them. It must be called after CPUs have been paused. This 1732 * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data, 1733 * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx 1734 * runs with interrupts disabled. When CPUs are later resumed, they may enter 1735 * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately 1736 * return failure. Or, they will be blocked trying to acquire hat_lock. Thus 1737 * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is 1738 * accessing the old context domains. 1739 * 1740 * sfmmu_ctxdoms_update(void) frees space used by old context domains and 1741 * allocates new context domains based on hardware layout. It initializes 1742 * every CPU that had context domain before migration to have one again. 1743 * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it 1744 * could deadlock acquiring locks held by paused CPUs. 1745 * 1746 * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads 1747 * acquire new context ids and continue execution. 1748 * 1749 * Therefore functions should be called in the following order: 1750 * suspend_routine() 1751 * sfmmu_ctxdom_lock() 1752 * pause_cpus() 1753 * suspend() 1754 * if (suspend failed) 1755 * sfmmu_ctxdom_unlock() 1756 * ... 1757 * sfmmu_ctxdom_remove() 1758 * resume_cpus() 1759 * sfmmu_ctxdom_update() 1760 * sfmmu_ctxdom_unlock() 1761 */ 1762 static cpuset_t sfmmu_ctxdoms_pset; 1763 1764 void 1765 sfmmu_ctxdoms_remove() 1766 { 1767 processorid_t id; 1768 cpu_t *cp; 1769 1770 /* 1771 * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can 1772 * be restored post-migration. A CPU may be powered off and not have a 1773 * domain, for example. 1774 */ 1775 CPUSET_ZERO(sfmmu_ctxdoms_pset); 1776 1777 for (id = 0; id < NCPU; id++) { 1778 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) { 1779 CPUSET_ADD(sfmmu_ctxdoms_pset, id); 1780 CPU_MMU_CTXP(cp) = NULL; 1781 } 1782 } 1783 } 1784 1785 void 1786 sfmmu_ctxdoms_lock(void) 1787 { 1788 int idx; 1789 mmu_ctx_t *mmu_ctxp; 1790 1791 sfmmu_hat_lock_all(); 1792 1793 /* 1794 * At this point, no thread can be in sfmmu_ctx_wrap_around, because 1795 * hat_lock is always taken before calling it. 1796 * 1797 * For each domain, set mmu_cnum to max so no more contexts can be 1798 * allocated, and wrap to flush on-CPU contexts and force threads to 1799 * acquire a new context when we later drop hat_lock after migration. 1800 * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum, 1801 * but the latter uses CAS and will miscompare and not overwrite it. 1802 */ 1803 kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */ 1804 for (idx = 0; idx < max_mmu_ctxdoms; idx++) { 1805 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) { 1806 mutex_enter(&mmu_ctxp->mmu_lock); 1807 mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs; 1808 /* make sure updated cnum visible */ 1809 membar_enter(); 1810 mutex_exit(&mmu_ctxp->mmu_lock); 1811 sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE); 1812 } 1813 } 1814 kpreempt_enable(); 1815 } 1816 1817 void 1818 sfmmu_ctxdoms_unlock(void) 1819 { 1820 sfmmu_hat_unlock_all(); 1821 } 1822 1823 void 1824 sfmmu_ctxdoms_update(void) 1825 { 1826 processorid_t id; 1827 cpu_t *cp; 1828 uint_t idx; 1829 mmu_ctx_t *mmu_ctxp; 1830 1831 /* 1832 * Free all context domains. As side effect, this increases 1833 * mmu_saved_gnum to the maximum gnum over all domains, which is used to 1834 * init gnum in the new domains, which therefore will be larger than the 1835 * sfmmu gnum for any process, guaranteeing that every process will see 1836 * a new generation and allocate a new context regardless of what new 1837 * domain it runs in. 1838 */ 1839 mutex_enter(&cpu_lock); 1840 1841 for (idx = 0; idx < max_mmu_ctxdoms; idx++) { 1842 if (mmu_ctxs_tbl[idx] != NULL) { 1843 mmu_ctxp = mmu_ctxs_tbl[idx]; 1844 mmu_ctxs_tbl[idx] = NULL; 1845 sfmmu_ctxdom_free(mmu_ctxp); 1846 } 1847 } 1848 1849 for (id = 0; id < NCPU; id++) { 1850 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) && 1851 (cp = cpu[id]) != NULL) 1852 sfmmu_cpu_init(cp); 1853 } 1854 mutex_exit(&cpu_lock); 1855 } 1856 #endif 1857 1858 /* 1859 * Hat_setup, makes an address space context the current active one. 1860 * In sfmmu this translates to setting the secondary context with the 1861 * corresponding context. 1862 */ 1863 void 1864 hat_setup(struct hat *sfmmup, int allocflag) 1865 { 1866 hatlock_t *hatlockp; 1867 1868 /* Init needs some special treatment. */ 1869 if (allocflag == HAT_INIT) { 1870 /* 1871 * Make sure that we have 1872 * 1. a TSB 1873 * 2. a valid ctx that doesn't get stolen after this point. 1874 */ 1875 hatlockp = sfmmu_hat_enter(sfmmup); 1876 1877 /* 1878 * Swap in the TSB. hat_init() allocates tsbinfos without 1879 * TSBs, but we need one for init, since the kernel does some 1880 * special things to set up its stack and needs the TSB to 1881 * resolve page faults. 1882 */ 1883 sfmmu_tsb_swapin(sfmmup, hatlockp); 1884 1885 sfmmu_get_ctx(sfmmup); 1886 1887 sfmmu_hat_exit(hatlockp); 1888 } else { 1889 ASSERT(allocflag == HAT_ALLOC); 1890 1891 hatlockp = sfmmu_hat_enter(sfmmup); 1892 kpreempt_disable(); 1893 1894 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id); 1895 /* 1896 * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter, 1897 * pagesize bits don't matter in this case since we are passing 1898 * INVALID_CONTEXT to it. 1899 * Compatibility Note: hw takes care of MMU_SCONTEXT1 1900 */ 1901 sfmmu_setctx_sec(INVALID_CONTEXT); 1902 sfmmu_clear_utsbinfo(); 1903 1904 kpreempt_enable(); 1905 sfmmu_hat_exit(hatlockp); 1906 } 1907 } 1908 1909 /* 1910 * Free all the translation resources for the specified address space. 1911 * Called from as_free when an address space is being destroyed. 1912 */ 1913 void 1914 hat_free_start(struct hat *sfmmup) 1915 { 1916 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 1917 ASSERT(sfmmup != ksfmmup); 1918 1919 sfmmup->sfmmu_free = 1; 1920 if (sfmmup->sfmmu_scdp != NULL) { 1921 sfmmu_leave_scd(sfmmup, 0); 1922 } 1923 1924 ASSERT(sfmmup->sfmmu_scdp == NULL); 1925 } 1926 1927 void 1928 hat_free_end(struct hat *sfmmup) 1929 { 1930 int i; 1931 1932 ASSERT(sfmmup->sfmmu_free == 1); 1933 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0); 1934 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0); 1935 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0); 1936 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0); 1937 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 1938 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 1939 1940 if (sfmmup->sfmmu_rmstat) { 1941 hat_freestat(sfmmup->sfmmu_as, NULL); 1942 } 1943 1944 while (sfmmup->sfmmu_tsb != NULL) { 1945 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next; 1946 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb); 1947 sfmmup->sfmmu_tsb = next; 1948 } 1949 1950 if (sfmmup->sfmmu_srdp != NULL) { 1951 sfmmu_leave_srd(sfmmup); 1952 ASSERT(sfmmup->sfmmu_srdp == NULL); 1953 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 1954 if (sfmmup->sfmmu_hmeregion_links[i] != NULL) { 1955 kmem_free(sfmmup->sfmmu_hmeregion_links[i], 1956 SFMMU_L2_HMERLINKS_SIZE); 1957 sfmmup->sfmmu_hmeregion_links[i] = NULL; 1958 } 1959 } 1960 } 1961 sfmmu_free_sfmmu(sfmmup); 1962 1963 #ifdef DEBUG 1964 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 1965 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL); 1966 } 1967 #endif 1968 1969 kmem_cache_free(sfmmuid_cache, sfmmup); 1970 } 1971 1972 /* 1973 * Set up any translation structures, for the specified address space, 1974 * that are needed or preferred when the process is being swapped in. 1975 */ 1976 /* ARGSUSED */ 1977 void 1978 hat_swapin(struct hat *hat) 1979 { 1980 } 1981 1982 /* 1983 * Free all of the translation resources, for the specified address space, 1984 * that can be freed while the process is swapped out. Called from as_swapout. 1985 * Also, free up the ctx that this process was using. 1986 */ 1987 void 1988 hat_swapout(struct hat *sfmmup) 1989 { 1990 struct hmehash_bucket *hmebp; 1991 struct hme_blk *hmeblkp; 1992 struct hme_blk *pr_hblk = NULL; 1993 struct hme_blk *nx_hblk; 1994 int i; 1995 struct hme_blk *list = NULL; 1996 hatlock_t *hatlockp; 1997 struct tsb_info *tsbinfop; 1998 struct free_tsb { 1999 struct free_tsb *next; 2000 struct tsb_info *tsbinfop; 2001 }; /* free list of TSBs */ 2002 struct free_tsb *freelist, *last, *next; 2003 2004 SFMMU_STAT(sf_swapout); 2005 2006 /* 2007 * There is no way to go from an as to all its translations in sfmmu. 2008 * Here is one of the times when we take the big hit and traverse 2009 * the hash looking for hme_blks to free up. Not only do we free up 2010 * this as hme_blks but all those that are free. We are obviously 2011 * swapping because we need memory so let's free up as much 2012 * as we can. 2013 * 2014 * Note that we don't flush TLB/TSB here -- it's not necessary 2015 * because: 2016 * 1) we free the ctx we're using and throw away the TSB(s); 2017 * 2) processes aren't runnable while being swapped out. 2018 */ 2019 ASSERT(sfmmup != KHATID); 2020 for (i = 0; i <= UHMEHASH_SZ; i++) { 2021 hmebp = &uhme_hash[i]; 2022 SFMMU_HASH_LOCK(hmebp); 2023 hmeblkp = hmebp->hmeblkp; 2024 pr_hblk = NULL; 2025 while (hmeblkp) { 2026 2027 if ((hmeblkp->hblk_tag.htag_id == sfmmup) && 2028 !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) { 2029 ASSERT(!hmeblkp->hblk_shared); 2030 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 2031 (caddr_t)get_hblk_base(hmeblkp), 2032 get_hblk_endaddr(hmeblkp), 2033 NULL, HAT_UNLOAD); 2034 } 2035 nx_hblk = hmeblkp->hblk_next; 2036 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 2037 ASSERT(!hmeblkp->hblk_lckcnt); 2038 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 2039 &list, 0); 2040 } else { 2041 pr_hblk = hmeblkp; 2042 } 2043 hmeblkp = nx_hblk; 2044 } 2045 SFMMU_HASH_UNLOCK(hmebp); 2046 } 2047 2048 sfmmu_hblks_list_purge(&list, 0); 2049 2050 /* 2051 * Now free up the ctx so that others can reuse it. 2052 */ 2053 hatlockp = sfmmu_hat_enter(sfmmup); 2054 2055 sfmmu_invalidate_ctx(sfmmup); 2056 2057 /* 2058 * Free TSBs, but not tsbinfos, and set SWAPPED flag. 2059 * If TSBs were never swapped in, just return. 2060 * This implies that we don't support partial swapping 2061 * of TSBs -- either all are swapped out, or none are. 2062 * 2063 * We must hold the HAT lock here to prevent racing with another 2064 * thread trying to unmap TTEs from the TSB or running the post- 2065 * relocator after relocating the TSB's memory. Unfortunately, we 2066 * can't free memory while holding the HAT lock or we could 2067 * deadlock, so we build a list of TSBs to be freed after marking 2068 * the tsbinfos as swapped out and free them after dropping the 2069 * lock. 2070 */ 2071 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 2072 sfmmu_hat_exit(hatlockp); 2073 return; 2074 } 2075 2076 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED); 2077 last = freelist = NULL; 2078 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 2079 tsbinfop = tsbinfop->tsb_next) { 2080 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0); 2081 2082 /* 2083 * Cast the TSB into a struct free_tsb and put it on the free 2084 * list. 2085 */ 2086 if (freelist == NULL) { 2087 last = freelist = (struct free_tsb *)tsbinfop->tsb_va; 2088 } else { 2089 last->next = (struct free_tsb *)tsbinfop->tsb_va; 2090 last = last->next; 2091 } 2092 last->next = NULL; 2093 last->tsbinfop = tsbinfop; 2094 tsbinfop->tsb_flags |= TSB_SWAPPED; 2095 /* 2096 * Zero out the TTE to clear the valid bit. 2097 * Note we can't use a value like 0xbad because we want to 2098 * ensure diagnostic bits are NEVER set on TTEs that might 2099 * be loaded. The intent is to catch any invalid access 2100 * to the swapped TSB, such as a thread running with a valid 2101 * context without first calling sfmmu_tsb_swapin() to 2102 * allocate TSB memory. 2103 */ 2104 tsbinfop->tsb_tte.ll = 0; 2105 } 2106 2107 /* Now we can drop the lock and free the TSB memory. */ 2108 sfmmu_hat_exit(hatlockp); 2109 for (; freelist != NULL; freelist = next) { 2110 next = freelist->next; 2111 sfmmu_tsb_free(freelist->tsbinfop); 2112 } 2113 } 2114 2115 /* 2116 * Duplicate the translations of an as into another newas 2117 */ 2118 /* ARGSUSED */ 2119 int 2120 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len, 2121 uint_t flag) 2122 { 2123 sf_srd_t *srdp; 2124 sf_scd_t *scdp; 2125 int i; 2126 extern uint_t get_color_start(struct as *); 2127 2128 ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) || 2129 (flag == HAT_DUP_SRD)); 2130 ASSERT(hat != ksfmmup); 2131 ASSERT(newhat != ksfmmup); 2132 ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp); 2133 2134 if (flag == HAT_DUP_COW) { 2135 panic("hat_dup: HAT_DUP_COW not supported"); 2136 } 2137 2138 if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) { 2139 ASSERT(srdp->srd_evp != NULL); 2140 VN_HOLD(srdp->srd_evp); 2141 ASSERT(srdp->srd_refcnt > 0); 2142 newhat->sfmmu_srdp = srdp; 2143 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt); 2144 } 2145 2146 /* 2147 * HAT_DUP_ALL flag is used after as duplication is done. 2148 */ 2149 if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) { 2150 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2); 2151 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags; 2152 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) { 2153 newhat->sfmmu_flags |= HAT_4MTEXT_FLAG; 2154 } 2155 2156 /* check if need to join scd */ 2157 if ((scdp = hat->sfmmu_scdp) != NULL && 2158 newhat->sfmmu_scdp != scdp) { 2159 int ret; 2160 SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map, 2161 &scdp->scd_region_map, ret); 2162 ASSERT(ret); 2163 sfmmu_join_scd(scdp, newhat); 2164 ASSERT(newhat->sfmmu_scdp == scdp && 2165 scdp->scd_refcnt >= 2); 2166 for (i = 0; i < max_mmu_page_sizes; i++) { 2167 newhat->sfmmu_ismttecnt[i] = 2168 hat->sfmmu_ismttecnt[i]; 2169 newhat->sfmmu_scdismttecnt[i] = 2170 hat->sfmmu_scdismttecnt[i]; 2171 } 2172 } 2173 2174 sfmmu_check_page_sizes(newhat, 1); 2175 } 2176 2177 if (flag == HAT_DUP_ALL && consistent_coloring == 0 && 2178 update_proc_pgcolorbase_after_fork != 0) { 2179 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as); 2180 } 2181 return (0); 2182 } 2183 2184 void 2185 hat_memload(struct hat *hat, caddr_t addr, struct page *pp, 2186 uint_t attr, uint_t flags) 2187 { 2188 hat_do_memload(hat, addr, pp, attr, flags, 2189 SFMMU_INVALID_SHMERID); 2190 } 2191 2192 void 2193 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp, 2194 uint_t attr, uint_t flags, hat_region_cookie_t rcookie) 2195 { 2196 uint_t rid; 2197 if (rcookie == HAT_INVALID_REGION_COOKIE) { 2198 hat_do_memload(hat, addr, pp, attr, flags, 2199 SFMMU_INVALID_SHMERID); 2200 return; 2201 } 2202 rid = (uint_t)((uint64_t)rcookie); 2203 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 2204 hat_do_memload(hat, addr, pp, attr, flags, rid); 2205 } 2206 2207 /* 2208 * Set up addr to map to page pp with protection prot. 2209 * As an optimization we also load the TSB with the 2210 * corresponding tte but it is no big deal if the tte gets kicked out. 2211 */ 2212 static void 2213 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp, 2214 uint_t attr, uint_t flags, uint_t rid) 2215 { 2216 tte_t tte; 2217 2218 2219 ASSERT(hat != NULL); 2220 ASSERT(PAGE_LOCKED(pp)); 2221 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 2222 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG)); 2223 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2224 SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE); 2225 2226 if (PP_ISFREE(pp)) { 2227 panic("hat_memload: loading a mapping to free page %p", 2228 (void *)pp); 2229 } 2230 2231 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as)); 2232 2233 if (flags & ~SFMMU_LOAD_ALLFLAG) 2234 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d", 2235 flags & ~SFMMU_LOAD_ALLFLAG); 2236 2237 if (hat->sfmmu_rmstat) 2238 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr); 2239 2240 #if defined(SF_ERRATA_57) 2241 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2242 (addr < errata57_limit) && (attr & PROT_EXEC) && 2243 !(flags & HAT_LOAD_SHARE)) { 2244 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user " 2245 " page executable"); 2246 attr &= ~PROT_EXEC; 2247 } 2248 #endif 2249 2250 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K); 2251 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid); 2252 2253 /* 2254 * Check TSB and TLB page sizes. 2255 */ 2256 if ((flags & HAT_LOAD_SHARE) == 0) { 2257 sfmmu_check_page_sizes(hat, 1); 2258 } 2259 } 2260 2261 /* 2262 * hat_devload can be called to map real memory (e.g. 2263 * /dev/kmem) and even though hat_devload will determine pf is 2264 * for memory, it will be unable to get a shared lock on the 2265 * page (because someone else has it exclusively) and will 2266 * pass dp = NULL. If tteload doesn't get a non-NULL 2267 * page pointer it can't cache memory. 2268 */ 2269 void 2270 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn, 2271 uint_t attr, int flags) 2272 { 2273 tte_t tte; 2274 struct page *pp = NULL; 2275 int use_lgpg = 0; 2276 2277 ASSERT(hat != NULL); 2278 2279 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG)); 2280 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2281 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as)); 2282 if (len == 0) 2283 panic("hat_devload: zero len"); 2284 if (flags & ~SFMMU_LOAD_ALLFLAG) 2285 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d", 2286 flags & ~SFMMU_LOAD_ALLFLAG); 2287 2288 #if defined(SF_ERRATA_57) 2289 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2290 (addr < errata57_limit) && (attr & PROT_EXEC) && 2291 !(flags & HAT_LOAD_SHARE)) { 2292 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user " 2293 " page executable"); 2294 attr &= ~PROT_EXEC; 2295 } 2296 #endif 2297 2298 /* 2299 * If it's a memory page find its pp 2300 */ 2301 if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) { 2302 pp = page_numtopp_nolock(pfn); 2303 if (pp == NULL) { 2304 flags |= HAT_LOAD_NOCONSIST; 2305 } else { 2306 if (PP_ISFREE(pp)) { 2307 panic("hat_memload: loading " 2308 "a mapping to free page %p", 2309 (void *)pp); 2310 } 2311 if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) { 2312 panic("hat_memload: loading a mapping " 2313 "to unlocked relocatable page %p", 2314 (void *)pp); 2315 } 2316 ASSERT(len == MMU_PAGESIZE); 2317 } 2318 } 2319 2320 if (hat->sfmmu_rmstat) 2321 hat_resvstat(len, hat->sfmmu_as, addr); 2322 2323 if (flags & HAT_LOAD_NOCONSIST) { 2324 attr |= SFMMU_UNCACHEVTTE; 2325 use_lgpg = 1; 2326 } 2327 if (!pf_is_memory(pfn)) { 2328 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC; 2329 use_lgpg = 1; 2330 switch (attr & HAT_ORDER_MASK) { 2331 case HAT_STRICTORDER: 2332 case HAT_UNORDERED_OK: 2333 /* 2334 * we set the side effect bit for all non 2335 * memory mappings unless merging is ok 2336 */ 2337 attr |= SFMMU_SIDEFFECT; 2338 break; 2339 case HAT_MERGING_OK: 2340 case HAT_LOADCACHING_OK: 2341 case HAT_STORECACHING_OK: 2342 break; 2343 default: 2344 panic("hat_devload: bad attr"); 2345 break; 2346 } 2347 } 2348 while (len) { 2349 if (!use_lgpg) { 2350 sfmmu_memtte(&tte, pfn, attr, TTE8K); 2351 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2352 flags, SFMMU_INVALID_SHMERID); 2353 len -= MMU_PAGESIZE; 2354 addr += MMU_PAGESIZE; 2355 pfn++; 2356 continue; 2357 } 2358 /* 2359 * try to use large pages, check va/pa alignments 2360 * Note that 32M/256M page sizes are not (yet) supported. 2361 */ 2362 if ((len >= MMU_PAGESIZE4M) && 2363 !((uintptr_t)addr & MMU_PAGEOFFSET4M) && 2364 !(disable_large_pages & (1 << TTE4M)) && 2365 !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) { 2366 sfmmu_memtte(&tte, pfn, attr, TTE4M); 2367 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2368 flags, SFMMU_INVALID_SHMERID); 2369 len -= MMU_PAGESIZE4M; 2370 addr += MMU_PAGESIZE4M; 2371 pfn += MMU_PAGESIZE4M / MMU_PAGESIZE; 2372 } else if ((len >= MMU_PAGESIZE512K) && 2373 !((uintptr_t)addr & MMU_PAGEOFFSET512K) && 2374 !(disable_large_pages & (1 << TTE512K)) && 2375 !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) { 2376 sfmmu_memtte(&tte, pfn, attr, TTE512K); 2377 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2378 flags, SFMMU_INVALID_SHMERID); 2379 len -= MMU_PAGESIZE512K; 2380 addr += MMU_PAGESIZE512K; 2381 pfn += MMU_PAGESIZE512K / MMU_PAGESIZE; 2382 } else if ((len >= MMU_PAGESIZE64K) && 2383 !((uintptr_t)addr & MMU_PAGEOFFSET64K) && 2384 !(disable_large_pages & (1 << TTE64K)) && 2385 !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) { 2386 sfmmu_memtte(&tte, pfn, attr, TTE64K); 2387 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2388 flags, SFMMU_INVALID_SHMERID); 2389 len -= MMU_PAGESIZE64K; 2390 addr += MMU_PAGESIZE64K; 2391 pfn += MMU_PAGESIZE64K / MMU_PAGESIZE; 2392 } else { 2393 sfmmu_memtte(&tte, pfn, attr, TTE8K); 2394 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, 2395 flags, SFMMU_INVALID_SHMERID); 2396 len -= MMU_PAGESIZE; 2397 addr += MMU_PAGESIZE; 2398 pfn++; 2399 } 2400 } 2401 2402 /* 2403 * Check TSB and TLB page sizes. 2404 */ 2405 if ((flags & HAT_LOAD_SHARE) == 0) { 2406 sfmmu_check_page_sizes(hat, 1); 2407 } 2408 } 2409 2410 void 2411 hat_memload_array(struct hat *hat, caddr_t addr, size_t len, 2412 struct page **pps, uint_t attr, uint_t flags) 2413 { 2414 hat_do_memload_array(hat, addr, len, pps, attr, flags, 2415 SFMMU_INVALID_SHMERID); 2416 } 2417 2418 void 2419 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len, 2420 struct page **pps, uint_t attr, uint_t flags, 2421 hat_region_cookie_t rcookie) 2422 { 2423 uint_t rid; 2424 if (rcookie == HAT_INVALID_REGION_COOKIE) { 2425 hat_do_memload_array(hat, addr, len, pps, attr, flags, 2426 SFMMU_INVALID_SHMERID); 2427 return; 2428 } 2429 rid = (uint_t)((uint64_t)rcookie); 2430 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 2431 hat_do_memload_array(hat, addr, len, pps, attr, flags, rid); 2432 } 2433 2434 /* 2435 * Map the largest extend possible out of the page array. The array may NOT 2436 * be in order. The largest possible mapping a page can have 2437 * is specified in the p_szc field. The p_szc field 2438 * cannot change as long as there any mappings (large or small) 2439 * to any of the pages that make up the large page. (ie. any 2440 * promotion/demotion of page size is not up to the hat but up to 2441 * the page free list manager). The array 2442 * should consist of properly aligned contigous pages that are 2443 * part of a big page for a large mapping to be created. 2444 */ 2445 static void 2446 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len, 2447 struct page **pps, uint_t attr, uint_t flags, uint_t rid) 2448 { 2449 int ttesz; 2450 size_t mapsz; 2451 pgcnt_t numpg, npgs; 2452 tte_t tte; 2453 page_t *pp; 2454 uint_t large_pages_disable; 2455 2456 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 2457 SFMMU_VALIDATE_HMERID(hat, rid, addr, len); 2458 2459 if (hat->sfmmu_rmstat) 2460 hat_resvstat(len, hat->sfmmu_as, addr); 2461 2462 #if defined(SF_ERRATA_57) 2463 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) && 2464 (addr < errata57_limit) && (attr & PROT_EXEC) && 2465 !(flags & HAT_LOAD_SHARE)) { 2466 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make " 2467 "user page executable"); 2468 attr &= ~PROT_EXEC; 2469 } 2470 #endif 2471 2472 /* Get number of pages */ 2473 npgs = len >> MMU_PAGESHIFT; 2474 2475 if (flags & HAT_LOAD_SHARE) { 2476 large_pages_disable = disable_ism_large_pages; 2477 } else { 2478 large_pages_disable = disable_large_pages; 2479 } 2480 2481 if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) { 2482 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs, 2483 rid); 2484 return; 2485 } 2486 2487 while (npgs >= NHMENTS) { 2488 pp = *pps; 2489 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) { 2490 /* 2491 * Check if this page size is disabled. 2492 */ 2493 if (large_pages_disable & (1 << ttesz)) 2494 continue; 2495 2496 numpg = TTEPAGES(ttesz); 2497 mapsz = numpg << MMU_PAGESHIFT; 2498 if ((npgs >= numpg) && 2499 IS_P2ALIGNED(addr, mapsz) && 2500 IS_P2ALIGNED(pp->p_pagenum, numpg)) { 2501 /* 2502 * At this point we have enough pages and 2503 * we know the virtual address and the pfn 2504 * are properly aligned. We still need 2505 * to check for physical contiguity but since 2506 * it is very likely that this is the case 2507 * we will assume they are so and undo 2508 * the request if necessary. It would 2509 * be great if we could get a hint flag 2510 * like HAT_CONTIG which would tell us 2511 * the pages are contigous for sure. 2512 */ 2513 sfmmu_memtte(&tte, (*pps)->p_pagenum, 2514 attr, ttesz); 2515 if (!sfmmu_tteload_array(hat, &tte, addr, 2516 pps, flags, rid)) { 2517 break; 2518 } 2519 } 2520 } 2521 if (ttesz == TTE8K) { 2522 /* 2523 * We were not able to map array using a large page 2524 * batch a hmeblk or fraction at a time. 2525 */ 2526 numpg = ((uintptr_t)addr >> MMU_PAGESHIFT) 2527 & (NHMENTS-1); 2528 numpg = NHMENTS - numpg; 2529 ASSERT(numpg <= npgs); 2530 mapsz = numpg * MMU_PAGESIZE; 2531 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, 2532 numpg, rid); 2533 } 2534 addr += mapsz; 2535 npgs -= numpg; 2536 pps += numpg; 2537 } 2538 2539 if (npgs) { 2540 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs, 2541 rid); 2542 } 2543 2544 /* 2545 * Check TSB and TLB page sizes. 2546 */ 2547 if ((flags & HAT_LOAD_SHARE) == 0) { 2548 sfmmu_check_page_sizes(hat, 1); 2549 } 2550 } 2551 2552 /* 2553 * Function tries to batch 8K pages into the same hme blk. 2554 */ 2555 static void 2556 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps, 2557 uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid) 2558 { 2559 tte_t tte; 2560 page_t *pp; 2561 struct hmehash_bucket *hmebp; 2562 struct hme_blk *hmeblkp; 2563 int index; 2564 2565 while (npgs) { 2566 /* 2567 * Acquire the hash bucket. 2568 */ 2569 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K, 2570 rid); 2571 ASSERT(hmebp); 2572 2573 /* 2574 * Find the hment block. 2575 */ 2576 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr, 2577 TTE8K, flags, rid); 2578 ASSERT(hmeblkp); 2579 2580 do { 2581 /* 2582 * Make the tte. 2583 */ 2584 pp = *pps; 2585 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K); 2586 2587 /* 2588 * Add the translation. 2589 */ 2590 (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte, 2591 vaddr, pps, flags, rid); 2592 2593 /* 2594 * Goto next page. 2595 */ 2596 pps++; 2597 npgs--; 2598 2599 /* 2600 * Goto next address. 2601 */ 2602 vaddr += MMU_PAGESIZE; 2603 2604 /* 2605 * Don't crossover into a different hmentblk. 2606 */ 2607 index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) & 2608 (NHMENTS-1)); 2609 2610 } while (index != 0 && npgs != 0); 2611 2612 /* 2613 * Release the hash bucket. 2614 */ 2615 2616 sfmmu_tteload_release_hashbucket(hmebp); 2617 } 2618 } 2619 2620 /* 2621 * Construct a tte for a page: 2622 * 2623 * tte_valid = 1 2624 * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only) 2625 * tte_size = size 2626 * tte_nfo = attr & HAT_NOFAULT 2627 * tte_ie = attr & HAT_STRUCTURE_LE 2628 * tte_hmenum = hmenum 2629 * tte_pahi = pp->p_pagenum >> TTE_PASHIFT; 2630 * tte_palo = pp->p_pagenum & TTE_PALOMASK; 2631 * tte_ref = 1 (optimization) 2632 * tte_wr_perm = attr & PROT_WRITE; 2633 * tte_no_sync = attr & HAT_NOSYNC 2634 * tte_lock = attr & SFMMU_LOCKTTE 2635 * tte_cp = !(attr & SFMMU_UNCACHEPTTE) 2636 * tte_cv = !(attr & SFMMU_UNCACHEVTTE) 2637 * tte_e = attr & SFMMU_SIDEFFECT 2638 * tte_priv = !(attr & PROT_USER) 2639 * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt) 2640 * tte_glb = 0 2641 */ 2642 void 2643 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz) 2644 { 2645 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 2646 2647 ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */); 2648 ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */); 2649 2650 if (TTE_IS_NOSYNC(ttep)) { 2651 TTE_SET_REF(ttep); 2652 if (TTE_IS_WRITABLE(ttep)) { 2653 TTE_SET_MOD(ttep); 2654 } 2655 } 2656 if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) { 2657 panic("sfmmu_memtte: can't set both NFO and EXEC bits"); 2658 } 2659 } 2660 2661 /* 2662 * This function will add a translation to the hme_blk and allocate the 2663 * hme_blk if one does not exist. 2664 * If a page structure is specified then it will add the 2665 * corresponding hment to the mapping list. 2666 * It will also update the hmenum field for the tte. 2667 * 2668 * Currently this function is only used for kernel mappings. 2669 * So pass invalid region to sfmmu_tteload_array(). 2670 */ 2671 void 2672 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp, 2673 uint_t flags) 2674 { 2675 ASSERT(sfmmup == ksfmmup); 2676 (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags, 2677 SFMMU_INVALID_SHMERID); 2678 } 2679 2680 /* 2681 * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB. 2682 * Assumes that a particular page size may only be resident in one TSB. 2683 */ 2684 static void 2685 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz) 2686 { 2687 struct tsb_info *tsbinfop = NULL; 2688 uint64_t tag; 2689 struct tsbe *tsbe_addr; 2690 uint64_t tsb_base; 2691 uint_t tsb_size; 2692 int vpshift = MMU_PAGESHIFT; 2693 int phys = 0; 2694 2695 if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */ 2696 phys = ktsb_phys; 2697 if (ttesz >= TTE4M) { 2698 #ifndef sun4v 2699 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M)); 2700 #endif 2701 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base; 2702 tsb_size = ktsb4m_szcode; 2703 } else { 2704 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base; 2705 tsb_size = ktsb_szcode; 2706 } 2707 } else { 2708 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz); 2709 2710 /* 2711 * If there isn't a TSB for this page size, or the TSB is 2712 * swapped out, there is nothing to do. Note that the latter 2713 * case seems impossible but can occur if hat_pageunload() 2714 * is called on an ISM mapping while the process is swapped 2715 * out. 2716 */ 2717 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED)) 2718 return; 2719 2720 /* 2721 * If another thread is in the middle of relocating a TSB 2722 * we can't unload the entry so set a flag so that the 2723 * TSB will be flushed before it can be accessed by the 2724 * process. 2725 */ 2726 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) { 2727 if (ttep == NULL) 2728 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED; 2729 return; 2730 } 2731 #if defined(UTSB_PHYS) 2732 phys = 1; 2733 tsb_base = (uint64_t)tsbinfop->tsb_pa; 2734 #else 2735 tsb_base = (uint64_t)tsbinfop->tsb_va; 2736 #endif 2737 tsb_size = tsbinfop->tsb_szc; 2738 } 2739 if (ttesz >= TTE4M) 2740 vpshift = MMU_PAGESHIFT4M; 2741 2742 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size); 2743 tag = sfmmu_make_tsbtag(vaddr); 2744 2745 if (ttep == NULL) { 2746 sfmmu_unload_tsbe(tsbe_addr, tag, phys); 2747 } else { 2748 if (ttesz >= TTE4M) { 2749 SFMMU_STAT(sf_tsb_load4m); 2750 } else { 2751 SFMMU_STAT(sf_tsb_load8k); 2752 } 2753 2754 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys); 2755 } 2756 } 2757 2758 /* 2759 * Unmap all entries from [start, end) matching the given page size. 2760 * 2761 * This function is used primarily to unmap replicated 64K or 512K entries 2762 * from the TSB that are inserted using the base page size TSB pointer, but 2763 * it may also be called to unmap a range of addresses from the TSB. 2764 */ 2765 void 2766 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz) 2767 { 2768 struct tsb_info *tsbinfop; 2769 uint64_t tag; 2770 struct tsbe *tsbe_addr; 2771 caddr_t vaddr; 2772 uint64_t tsb_base; 2773 int vpshift, vpgsz; 2774 uint_t tsb_size; 2775 int phys = 0; 2776 2777 /* 2778 * Assumptions: 2779 * If ttesz == 8K, 64K or 512K, we walk through the range 8K 2780 * at a time shooting down any valid entries we encounter. 2781 * 2782 * If ttesz >= 4M we walk the range 4M at a time shooting 2783 * down any valid mappings we find. 2784 */ 2785 if (sfmmup == ksfmmup) { 2786 phys = ktsb_phys; 2787 if (ttesz >= TTE4M) { 2788 #ifndef sun4v 2789 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M)); 2790 #endif 2791 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base; 2792 tsb_size = ktsb4m_szcode; 2793 } else { 2794 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base; 2795 tsb_size = ktsb_szcode; 2796 } 2797 } else { 2798 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz); 2799 2800 /* 2801 * If there isn't a TSB for this page size, or the TSB is 2802 * swapped out, there is nothing to do. Note that the latter 2803 * case seems impossible but can occur if hat_pageunload() 2804 * is called on an ISM mapping while the process is swapped 2805 * out. 2806 */ 2807 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED)) 2808 return; 2809 2810 /* 2811 * If another thread is in the middle of relocating a TSB 2812 * we can't unload the entry so set a flag so that the 2813 * TSB will be flushed before it can be accessed by the 2814 * process. 2815 */ 2816 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) { 2817 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED; 2818 return; 2819 } 2820 #if defined(UTSB_PHYS) 2821 phys = 1; 2822 tsb_base = (uint64_t)tsbinfop->tsb_pa; 2823 #else 2824 tsb_base = (uint64_t)tsbinfop->tsb_va; 2825 #endif 2826 tsb_size = tsbinfop->tsb_szc; 2827 } 2828 if (ttesz >= TTE4M) { 2829 vpshift = MMU_PAGESHIFT4M; 2830 vpgsz = MMU_PAGESIZE4M; 2831 } else { 2832 vpshift = MMU_PAGESHIFT; 2833 vpgsz = MMU_PAGESIZE; 2834 } 2835 2836 for (vaddr = start; vaddr < end; vaddr += vpgsz) { 2837 tag = sfmmu_make_tsbtag(vaddr); 2838 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size); 2839 sfmmu_unload_tsbe(tsbe_addr, tag, phys); 2840 } 2841 } 2842 2843 /* 2844 * Select the optimum TSB size given the number of mappings 2845 * that need to be cached. 2846 */ 2847 static int 2848 sfmmu_select_tsb_szc(pgcnt_t pgcnt) 2849 { 2850 int szc = 0; 2851 2852 #ifdef DEBUG 2853 if (tsb_grow_stress) { 2854 uint32_t randval = (uint32_t)gettick() >> 4; 2855 return (randval % (tsb_max_growsize + 1)); 2856 } 2857 #endif /* DEBUG */ 2858 2859 while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc))) 2860 szc++; 2861 return (szc); 2862 } 2863 2864 /* 2865 * This function will add a translation to the hme_blk and allocate the 2866 * hme_blk if one does not exist. 2867 * If a page structure is specified then it will add the 2868 * corresponding hment to the mapping list. 2869 * It will also update the hmenum field for the tte. 2870 * Furthermore, it attempts to create a large page translation 2871 * for <addr,hat> at page array pps. It assumes addr and first 2872 * pp is correctly aligned. It returns 0 if successful and 1 otherwise. 2873 */ 2874 static int 2875 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr, 2876 page_t **pps, uint_t flags, uint_t rid) 2877 { 2878 struct hmehash_bucket *hmebp; 2879 struct hme_blk *hmeblkp; 2880 int ret; 2881 uint_t size; 2882 2883 /* 2884 * Get mapping size. 2885 */ 2886 size = TTE_CSZ(ttep); 2887 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size))); 2888 2889 /* 2890 * Acquire the hash bucket. 2891 */ 2892 hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid); 2893 ASSERT(hmebp); 2894 2895 /* 2896 * Find the hment block. 2897 */ 2898 hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags, 2899 rid); 2900 ASSERT(hmeblkp); 2901 2902 /* 2903 * Add the translation. 2904 */ 2905 ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags, 2906 rid); 2907 2908 /* 2909 * Release the hash bucket. 2910 */ 2911 sfmmu_tteload_release_hashbucket(hmebp); 2912 2913 return (ret); 2914 } 2915 2916 /* 2917 * Function locks and returns a pointer to the hash bucket for vaddr and size. 2918 */ 2919 static struct hmehash_bucket * 2920 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size, 2921 uint_t rid) 2922 { 2923 struct hmehash_bucket *hmebp; 2924 int hmeshift; 2925 void *htagid = sfmmutohtagid(sfmmup, rid); 2926 2927 ASSERT(htagid != NULL); 2928 2929 hmeshift = HME_HASH_SHIFT(size); 2930 2931 hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift); 2932 2933 SFMMU_HASH_LOCK(hmebp); 2934 2935 return (hmebp); 2936 } 2937 2938 /* 2939 * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the 2940 * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is 2941 * allocated. 2942 */ 2943 static struct hme_blk * 2944 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp, 2945 caddr_t vaddr, uint_t size, uint_t flags, uint_t rid) 2946 { 2947 hmeblk_tag hblktag; 2948 int hmeshift; 2949 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL; 2950 2951 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 2952 2953 hblktag.htag_id = sfmmutohtagid(sfmmup, rid); 2954 ASSERT(hblktag.htag_id != NULL); 2955 hmeshift = HME_HASH_SHIFT(size); 2956 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 2957 hblktag.htag_rehash = HME_HASH_REHASH(size); 2958 hblktag.htag_rid = rid; 2959 2960 ttearray_realloc: 2961 2962 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 2963 2964 /* 2965 * We block until hblk_reserve_lock is released; it's held by 2966 * the thread, temporarily using hblk_reserve, until hblk_reserve is 2967 * replaced by a hblk from sfmmu8_cache. 2968 */ 2969 if (hmeblkp == (struct hme_blk *)hblk_reserve && 2970 hblk_reserve_thread != curthread) { 2971 SFMMU_HASH_UNLOCK(hmebp); 2972 mutex_enter(&hblk_reserve_lock); 2973 mutex_exit(&hblk_reserve_lock); 2974 SFMMU_STAT(sf_hblk_reserve_hit); 2975 SFMMU_HASH_LOCK(hmebp); 2976 goto ttearray_realloc; 2977 } 2978 2979 if (hmeblkp == NULL) { 2980 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size, 2981 hblktag, flags, rid); 2982 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 2983 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 2984 } else { 2985 /* 2986 * It is possible for 8k and 64k hblks to collide since they 2987 * have the same rehash value. This is because we 2988 * lazily free hblks and 8K/64K blks could be lingering. 2989 * If we find size mismatch we free the block and & try again. 2990 */ 2991 if (get_hblk_ttesz(hmeblkp) != size) { 2992 ASSERT(!hmeblkp->hblk_vcnt); 2993 ASSERT(!hmeblkp->hblk_hmecnt); 2994 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 2995 &list, 0); 2996 goto ttearray_realloc; 2997 } 2998 if (hmeblkp->hblk_shw_bit) { 2999 /* 3000 * if the hblk was previously used as a shadow hblk then 3001 * we will change it to a normal hblk 3002 */ 3003 ASSERT(!hmeblkp->hblk_shared); 3004 if (hmeblkp->hblk_shw_mask) { 3005 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp); 3006 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3007 goto ttearray_realloc; 3008 } else { 3009 hmeblkp->hblk_shw_bit = 0; 3010 } 3011 } 3012 SFMMU_STAT(sf_hblk_hit); 3013 } 3014 3015 /* 3016 * hat_memload() should never call kmem_cache_free() for kernel hmeblks; 3017 * see block comment showing the stacktrace in sfmmu_hblk_alloc(); 3018 * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will 3019 * just add these hmeblks to the per-cpu pending queue. 3020 */ 3021 sfmmu_hblks_list_purge(&list, 1); 3022 3023 ASSERT(get_hblk_ttesz(hmeblkp) == size); 3024 ASSERT(!hmeblkp->hblk_shw_bit); 3025 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 3026 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 3027 ASSERT(hmeblkp->hblk_tag.htag_rid == rid); 3028 3029 return (hmeblkp); 3030 } 3031 3032 /* 3033 * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1 3034 * otherwise. 3035 */ 3036 static int 3037 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep, 3038 caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid) 3039 { 3040 page_t *pp = *pps; 3041 int hmenum, size, remap; 3042 tte_t tteold, flush_tte; 3043 #ifdef DEBUG 3044 tte_t orig_old; 3045 #endif /* DEBUG */ 3046 struct sf_hment *sfhme; 3047 kmutex_t *pml, *pmtx; 3048 hatlock_t *hatlockp; 3049 int myflt; 3050 3051 /* 3052 * remove this panic when we decide to let user virtual address 3053 * space be >= USERLIMIT. 3054 */ 3055 if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT) 3056 panic("user addr %p in kernel space", (void *)vaddr); 3057 #if defined(TTE_IS_GLOBAL) 3058 if (TTE_IS_GLOBAL(ttep)) 3059 panic("sfmmu_tteload: creating global tte"); 3060 #endif 3061 3062 #ifdef DEBUG 3063 if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) && 3064 !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans) 3065 panic("sfmmu_tteload: non cacheable memory tte"); 3066 #endif /* DEBUG */ 3067 3068 /* don't simulate dirty bit for writeable ISM/DISM mappings */ 3069 if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) { 3070 TTE_SET_REF(ttep); 3071 TTE_SET_MOD(ttep); 3072 } 3073 3074 if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) || 3075 !TTE_IS_MOD(ttep)) { 3076 /* 3077 * Don't load TSB for dummy as in ISM. Also don't preload 3078 * the TSB if the TTE isn't writable since we're likely to 3079 * fault on it again -- preloading can be fairly expensive. 3080 */ 3081 flags |= SFMMU_NO_TSBLOAD; 3082 } 3083 3084 size = TTE_CSZ(ttep); 3085 switch (size) { 3086 case TTE8K: 3087 SFMMU_STAT(sf_tteload8k); 3088 break; 3089 case TTE64K: 3090 SFMMU_STAT(sf_tteload64k); 3091 break; 3092 case TTE512K: 3093 SFMMU_STAT(sf_tteload512k); 3094 break; 3095 case TTE4M: 3096 SFMMU_STAT(sf_tteload4m); 3097 break; 3098 case (TTE32M): 3099 SFMMU_STAT(sf_tteload32m); 3100 ASSERT(mmu_page_sizes == max_mmu_page_sizes); 3101 break; 3102 case (TTE256M): 3103 SFMMU_STAT(sf_tteload256m); 3104 ASSERT(mmu_page_sizes == max_mmu_page_sizes); 3105 break; 3106 } 3107 3108 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size))); 3109 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 3110 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared); 3111 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared); 3112 3113 HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum); 3114 3115 /* 3116 * Need to grab mlist lock here so that pageunload 3117 * will not change tte behind us. 3118 */ 3119 if (pp) { 3120 pml = sfmmu_mlist_enter(pp); 3121 } 3122 3123 sfmmu_copytte(&sfhme->hme_tte, &tteold); 3124 /* 3125 * Look for corresponding hment and if valid verify 3126 * pfns are equal. 3127 */ 3128 remap = TTE_IS_VALID(&tteold); 3129 if (remap) { 3130 pfn_t new_pfn, old_pfn; 3131 3132 old_pfn = TTE_TO_PFN(vaddr, &tteold); 3133 new_pfn = TTE_TO_PFN(vaddr, ttep); 3134 3135 if (flags & HAT_LOAD_REMAP) { 3136 /* make sure we are remapping same type of pages */ 3137 if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) { 3138 panic("sfmmu_tteload - tte remap io<->memory"); 3139 } 3140 if (old_pfn != new_pfn && 3141 (pp != NULL || sfhme->hme_page != NULL)) { 3142 panic("sfmmu_tteload - tte remap pp != NULL"); 3143 } 3144 } else if (old_pfn != new_pfn) { 3145 panic("sfmmu_tteload - tte remap, hmeblkp 0x%p", 3146 (void *)hmeblkp); 3147 } 3148 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep)); 3149 } 3150 3151 if (pp) { 3152 if (size == TTE8K) { 3153 #ifdef VAC 3154 /* 3155 * Handle VAC consistency 3156 */ 3157 if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) { 3158 sfmmu_vac_conflict(sfmmup, vaddr, pp); 3159 } 3160 #endif 3161 3162 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) { 3163 pmtx = sfmmu_page_enter(pp); 3164 PP_CLRRO(pp); 3165 sfmmu_page_exit(pmtx); 3166 } else if (!PP_ISMAPPED(pp) && 3167 (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) { 3168 pmtx = sfmmu_page_enter(pp); 3169 if (!(PP_ISMOD(pp))) { 3170 PP_SETRO(pp); 3171 } 3172 sfmmu_page_exit(pmtx); 3173 } 3174 3175 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) { 3176 /* 3177 * sfmmu_pagearray_setup failed so return 3178 */ 3179 sfmmu_mlist_exit(pml); 3180 return (1); 3181 } 3182 } 3183 3184 /* 3185 * Make sure hment is not on a mapping list. 3186 */ 3187 ASSERT(remap || (sfhme->hme_page == NULL)); 3188 3189 /* if it is not a remap then hme->next better be NULL */ 3190 ASSERT((!remap) ? sfhme->hme_next == NULL : 1); 3191 3192 if (flags & HAT_LOAD_LOCK) { 3193 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) { 3194 panic("too high lckcnt-hmeblk %p", 3195 (void *)hmeblkp); 3196 } 3197 atomic_inc_32(&hmeblkp->hblk_lckcnt); 3198 3199 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK); 3200 } 3201 3202 #ifdef VAC 3203 if (pp && PP_ISNC(pp)) { 3204 /* 3205 * If the physical page is marked to be uncacheable, like 3206 * by a vac conflict, make sure the new mapping is also 3207 * uncacheable. 3208 */ 3209 TTE_CLR_VCACHEABLE(ttep); 3210 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR); 3211 } 3212 #endif 3213 ttep->tte_hmenum = hmenum; 3214 3215 #ifdef DEBUG 3216 orig_old = tteold; 3217 #endif /* DEBUG */ 3218 3219 while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) { 3220 if ((sfmmup == KHATID) && 3221 (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) { 3222 sfmmu_copytte(&sfhme->hme_tte, &tteold); 3223 } 3224 #ifdef DEBUG 3225 chk_tte(&orig_old, &tteold, ttep, hmeblkp); 3226 #endif /* DEBUG */ 3227 } 3228 ASSERT(TTE_IS_VALID(&sfhme->hme_tte)); 3229 3230 if (!TTE_IS_VALID(&tteold)) { 3231 3232 atomic_inc_16(&hmeblkp->hblk_vcnt); 3233 if (rid == SFMMU_INVALID_SHMERID) { 3234 atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]); 3235 } else { 3236 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 3237 sf_region_t *rgnp = srdp->srd_hmergnp[rid]; 3238 /* 3239 * We already accounted for region ttecnt's in sfmmu 3240 * during hat_join_region() processing. Here we 3241 * only update ttecnt's in region struture. 3242 */ 3243 atomic_inc_ulong(&rgnp->rgn_ttecnt[size]); 3244 } 3245 } 3246 3247 myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup); 3248 if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 && 3249 sfmmup != ksfmmup) { 3250 uchar_t tteflag = 1 << size; 3251 if (rid == SFMMU_INVALID_SHMERID) { 3252 if (!(sfmmup->sfmmu_tteflags & tteflag)) { 3253 hatlockp = sfmmu_hat_enter(sfmmup); 3254 sfmmup->sfmmu_tteflags |= tteflag; 3255 sfmmu_hat_exit(hatlockp); 3256 } 3257 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) { 3258 hatlockp = sfmmu_hat_enter(sfmmup); 3259 sfmmup->sfmmu_rtteflags |= tteflag; 3260 sfmmu_hat_exit(hatlockp); 3261 } 3262 /* 3263 * Update the current CPU tsbmiss area, so the current thread 3264 * won't need to take the tsbmiss for the new pagesize. 3265 * The other threads in the process will update their tsb 3266 * miss area lazily in sfmmu_tsbmiss_exception() when they 3267 * fail to find the translation for a newly added pagesize. 3268 */ 3269 if (size > TTE64K && myflt) { 3270 struct tsbmiss *tsbmp; 3271 kpreempt_disable(); 3272 tsbmp = &tsbmiss_area[CPU->cpu_id]; 3273 if (rid == SFMMU_INVALID_SHMERID) { 3274 if (!(tsbmp->uhat_tteflags & tteflag)) { 3275 tsbmp->uhat_tteflags |= tteflag; 3276 } 3277 } else { 3278 if (!(tsbmp->uhat_rtteflags & tteflag)) { 3279 tsbmp->uhat_rtteflags |= tteflag; 3280 } 3281 } 3282 kpreempt_enable(); 3283 } 3284 } 3285 3286 if (size >= TTE4M && (flags & HAT_LOAD_TEXT) && 3287 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) { 3288 hatlockp = sfmmu_hat_enter(sfmmup); 3289 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG); 3290 sfmmu_hat_exit(hatlockp); 3291 } 3292 3293 flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) & 3294 hw_tte.tte_intlo; 3295 flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) & 3296 hw_tte.tte_inthi; 3297 3298 if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) { 3299 /* 3300 * If remap and new tte differs from old tte we need 3301 * to sync the mod bit and flush TLB/TSB. We don't 3302 * need to sync ref bit because we currently always set 3303 * ref bit in tteload. 3304 */ 3305 ASSERT(TTE_IS_REF(ttep)); 3306 if (TTE_IS_MOD(&tteold)) { 3307 sfmmu_ttesync(sfmmup, vaddr, &tteold, pp); 3308 } 3309 /* 3310 * hwtte bits shouldn't change for SRD hmeblks as long as SRD 3311 * hmes are only used for read only text. Adding this code for 3312 * completeness and future use of shared hmeblks with writable 3313 * mappings of VMODSORT vnodes. 3314 */ 3315 if (hmeblkp->hblk_shared) { 3316 cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr, 3317 sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1); 3318 xt_sync(cpuset); 3319 SFMMU_STAT_ADD(sf_region_remap_demap, 1); 3320 } else { 3321 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0); 3322 xt_sync(sfmmup->sfmmu_cpusran); 3323 } 3324 } 3325 3326 if ((flags & SFMMU_NO_TSBLOAD) == 0) { 3327 /* 3328 * We only preload 8K and 4M mappings into the TSB, since 3329 * 64K and 512K mappings are replicated and hence don't 3330 * have a single, unique TSB entry. Ditto for 32M/256M. 3331 */ 3332 if (size == TTE8K || size == TTE4M) { 3333 sf_scd_t *scdp; 3334 hatlockp = sfmmu_hat_enter(sfmmup); 3335 /* 3336 * Don't preload private TSB if the mapping is used 3337 * by the shctx in the SCD. 3338 */ 3339 scdp = sfmmup->sfmmu_scdp; 3340 if (rid == SFMMU_INVALID_SHMERID || scdp == NULL || 3341 !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 3342 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte, 3343 size); 3344 } 3345 sfmmu_hat_exit(hatlockp); 3346 } 3347 } 3348 if (pp) { 3349 if (!remap) { 3350 HME_ADD(sfhme, pp); 3351 atomic_inc_16(&hmeblkp->hblk_hmecnt); 3352 ASSERT(hmeblkp->hblk_hmecnt > 0); 3353 3354 /* 3355 * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS) 3356 * see pageunload() for comment. 3357 */ 3358 } 3359 sfmmu_mlist_exit(pml); 3360 } 3361 3362 return (0); 3363 } 3364 /* 3365 * Function unlocks hash bucket. 3366 */ 3367 static void 3368 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp) 3369 { 3370 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3371 SFMMU_HASH_UNLOCK(hmebp); 3372 } 3373 3374 /* 3375 * function which checks and sets up page array for a large 3376 * translation. Will set p_vcolor, p_index, p_ro fields. 3377 * Assumes addr and pfnum of first page are properly aligned. 3378 * Will check for physical contiguity. If check fails it return 3379 * non null. 3380 */ 3381 static int 3382 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap) 3383 { 3384 int i, index, ttesz; 3385 pfn_t pfnum; 3386 pgcnt_t npgs; 3387 page_t *pp, *pp1; 3388 kmutex_t *pmtx; 3389 #ifdef VAC 3390 int osz; 3391 int cflags = 0; 3392 int vac_err = 0; 3393 #endif 3394 int newidx = 0; 3395 3396 ttesz = TTE_CSZ(ttep); 3397 3398 ASSERT(ttesz > TTE8K); 3399 3400 npgs = TTEPAGES(ttesz); 3401 index = PAGESZ_TO_INDEX(ttesz); 3402 3403 pfnum = (*pps)->p_pagenum; 3404 ASSERT(IS_P2ALIGNED(pfnum, npgs)); 3405 3406 /* 3407 * Save the first pp so we can do HAT_TMPNC at the end. 3408 */ 3409 pp1 = *pps; 3410 #ifdef VAC 3411 osz = fnd_mapping_sz(pp1); 3412 #endif 3413 3414 for (i = 0; i < npgs; i++, pps++) { 3415 pp = *pps; 3416 ASSERT(PAGE_LOCKED(pp)); 3417 ASSERT(pp->p_szc >= ttesz); 3418 ASSERT(pp->p_szc == pp1->p_szc); 3419 ASSERT(sfmmu_mlist_held(pp)); 3420 3421 /* 3422 * XXX is it possible to maintain P_RO on the root only? 3423 */ 3424 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) { 3425 pmtx = sfmmu_page_enter(pp); 3426 PP_CLRRO(pp); 3427 sfmmu_page_exit(pmtx); 3428 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) && 3429 !PP_ISMOD(pp)) { 3430 pmtx = sfmmu_page_enter(pp); 3431 if (!(PP_ISMOD(pp))) { 3432 PP_SETRO(pp); 3433 } 3434 sfmmu_page_exit(pmtx); 3435 } 3436 3437 /* 3438 * If this is a remap we skip vac & contiguity checks. 3439 */ 3440 if (remap) 3441 continue; 3442 3443 /* 3444 * set p_vcolor and detect any vac conflicts. 3445 */ 3446 #ifdef VAC 3447 if (vac_err == 0) { 3448 vac_err = sfmmu_vacconflict_array(addr, pp, &cflags); 3449 3450 } 3451 #endif 3452 3453 /* 3454 * Save current index in case we need to undo it. 3455 * Note: "PAGESZ_TO_INDEX(sz) (1 << (sz))" 3456 * "SFMMU_INDEX_SHIFT 6" 3457 * "SFMMU_INDEX_MASK ((1 << SFMMU_INDEX_SHIFT) - 1)" 3458 * "PP_MAPINDEX(p_index) (p_index & SFMMU_INDEX_MASK)" 3459 * 3460 * So: index = PAGESZ_TO_INDEX(ttesz); 3461 * if ttesz == 1 then index = 0x2 3462 * 2 then index = 0x4 3463 * 3 then index = 0x8 3464 * 4 then index = 0x10 3465 * 5 then index = 0x20 3466 * The code below checks if it's a new pagesize (ie, newidx) 3467 * in case we need to take it back out of p_index, 3468 * and then or's the new index into the existing index. 3469 */ 3470 if ((PP_MAPINDEX(pp) & index) == 0) 3471 newidx = 1; 3472 pp->p_index = (PP_MAPINDEX(pp) | index); 3473 3474 /* 3475 * contiguity check 3476 */ 3477 if (pp->p_pagenum != pfnum) { 3478 /* 3479 * If we fail the contiguity test then 3480 * the only thing we need to fix is the p_index field. 3481 * We might get a few extra flushes but since this 3482 * path is rare that is ok. The p_ro field will 3483 * get automatically fixed on the next tteload to 3484 * the page. NO TNC bit is set yet. 3485 */ 3486 while (i >= 0) { 3487 pp = *pps; 3488 if (newidx) 3489 pp->p_index = (PP_MAPINDEX(pp) & 3490 ~index); 3491 pps--; 3492 i--; 3493 } 3494 return (1); 3495 } 3496 pfnum++; 3497 addr += MMU_PAGESIZE; 3498 } 3499 3500 #ifdef VAC 3501 if (vac_err) { 3502 if (ttesz > osz) { 3503 /* 3504 * There are some smaller mappings that causes vac 3505 * conflicts. Convert all existing small mappings to 3506 * TNC. 3507 */ 3508 SFMMU_STAT_ADD(sf_uncache_conflict, npgs); 3509 sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH, 3510 npgs); 3511 } else { 3512 /* EMPTY */ 3513 /* 3514 * If there exists an big page mapping, 3515 * that means the whole existing big page 3516 * has TNC setting already. No need to covert to 3517 * TNC again. 3518 */ 3519 ASSERT(PP_ISTNC(pp1)); 3520 } 3521 } 3522 #endif /* VAC */ 3523 3524 return (0); 3525 } 3526 3527 #ifdef VAC 3528 /* 3529 * Routine that detects vac consistency for a large page. It also 3530 * sets virtual color for all pp's for this big mapping. 3531 */ 3532 static int 3533 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags) 3534 { 3535 int vcolor, ocolor; 3536 3537 ASSERT(sfmmu_mlist_held(pp)); 3538 3539 if (PP_ISNC(pp)) { 3540 return (HAT_TMPNC); 3541 } 3542 3543 vcolor = addr_to_vcolor(addr); 3544 if (PP_NEWPAGE(pp)) { 3545 PP_SET_VCOLOR(pp, vcolor); 3546 return (0); 3547 } 3548 3549 ocolor = PP_GET_VCOLOR(pp); 3550 if (ocolor == vcolor) { 3551 return (0); 3552 } 3553 3554 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) { 3555 /* 3556 * Previous user of page had a differnet color 3557 * but since there are no current users 3558 * we just flush the cache and change the color. 3559 * As an optimization for large pages we flush the 3560 * entire cache of that color and set a flag. 3561 */ 3562 SFMMU_STAT(sf_pgcolor_conflict); 3563 if (!CacheColor_IsFlushed(*cflags, ocolor)) { 3564 CacheColor_SetFlushed(*cflags, ocolor); 3565 sfmmu_cache_flushcolor(ocolor, pp->p_pagenum); 3566 } 3567 PP_SET_VCOLOR(pp, vcolor); 3568 return (0); 3569 } 3570 3571 /* 3572 * We got a real conflict with a current mapping. 3573 * set flags to start unencaching all mappings 3574 * and return failure so we restart looping 3575 * the pp array from the beginning. 3576 */ 3577 return (HAT_TMPNC); 3578 } 3579 #endif /* VAC */ 3580 3581 /* 3582 * creates a large page shadow hmeblk for a tte. 3583 * The purpose of this routine is to allow us to do quick unloads because 3584 * the vm layer can easily pass a very large but sparsely populated range. 3585 */ 3586 static struct hme_blk * 3587 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags) 3588 { 3589 struct hmehash_bucket *hmebp; 3590 hmeblk_tag hblktag; 3591 int hmeshift, size, vshift; 3592 uint_t shw_mask, newshw_mask; 3593 struct hme_blk *hmeblkp; 3594 3595 ASSERT(sfmmup != KHATID); 3596 if (mmu_page_sizes == max_mmu_page_sizes) { 3597 ASSERT(ttesz < TTE256M); 3598 } else { 3599 ASSERT(ttesz < TTE4M); 3600 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 3601 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 3602 } 3603 3604 if (ttesz == TTE8K) { 3605 size = TTE512K; 3606 } else { 3607 size = ++ttesz; 3608 } 3609 3610 hblktag.htag_id = sfmmup; 3611 hmeshift = HME_HASH_SHIFT(size); 3612 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 3613 hblktag.htag_rehash = HME_HASH_REHASH(size); 3614 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3615 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift); 3616 3617 SFMMU_HASH_LOCK(hmebp); 3618 3619 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 3620 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve); 3621 if (hmeblkp == NULL) { 3622 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size, 3623 hblktag, flags, SFMMU_INVALID_SHMERID); 3624 } 3625 ASSERT(hmeblkp); 3626 if (!hmeblkp->hblk_shw_mask) { 3627 /* 3628 * if this is a unused hblk it was just allocated or could 3629 * potentially be a previous large page hblk so we need to 3630 * set the shadow bit. 3631 */ 3632 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt); 3633 hmeblkp->hblk_shw_bit = 1; 3634 } else if (hmeblkp->hblk_shw_bit == 0) { 3635 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p", 3636 (void *)hmeblkp); 3637 } 3638 ASSERT(hmeblkp->hblk_shw_bit == 1); 3639 ASSERT(!hmeblkp->hblk_shared); 3640 vshift = vaddr_to_vshift(hblktag, vaddr, size); 3641 ASSERT(vshift < 8); 3642 /* 3643 * Atomically set shw mask bit 3644 */ 3645 do { 3646 shw_mask = hmeblkp->hblk_shw_mask; 3647 newshw_mask = shw_mask | (1 << vshift); 3648 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask, 3649 newshw_mask); 3650 } while (newshw_mask != shw_mask); 3651 3652 SFMMU_HASH_UNLOCK(hmebp); 3653 3654 return (hmeblkp); 3655 } 3656 3657 /* 3658 * This routine cleanup a previous shadow hmeblk and changes it to 3659 * a regular hblk. This happens rarely but it is possible 3660 * when a process wants to use large pages and there are hblks still 3661 * lying around from the previous as that used these hmeblks. 3662 * The alternative was to cleanup the shadow hblks at unload time 3663 * but since so few user processes actually use large pages, it is 3664 * better to be lazy and cleanup at this time. 3665 */ 3666 static void 3667 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 3668 struct hmehash_bucket *hmebp) 3669 { 3670 caddr_t addr, endaddr; 3671 int hashno, size; 3672 3673 ASSERT(hmeblkp->hblk_shw_bit); 3674 ASSERT(!hmeblkp->hblk_shared); 3675 3676 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 3677 3678 if (!hmeblkp->hblk_shw_mask) { 3679 hmeblkp->hblk_shw_bit = 0; 3680 return; 3681 } 3682 addr = (caddr_t)get_hblk_base(hmeblkp); 3683 endaddr = get_hblk_endaddr(hmeblkp); 3684 size = get_hblk_ttesz(hmeblkp); 3685 hashno = size - 1; 3686 ASSERT(hashno > 0); 3687 SFMMU_HASH_UNLOCK(hmebp); 3688 3689 sfmmu_free_hblks(sfmmup, addr, endaddr, hashno); 3690 3691 SFMMU_HASH_LOCK(hmebp); 3692 } 3693 3694 static void 3695 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr, 3696 int hashno) 3697 { 3698 int hmeshift, shadow = 0; 3699 hmeblk_tag hblktag; 3700 struct hmehash_bucket *hmebp; 3701 struct hme_blk *hmeblkp; 3702 struct hme_blk *nx_hblk, *pr_hblk, *list = NULL; 3703 3704 ASSERT(hashno > 0); 3705 hblktag.htag_id = sfmmup; 3706 hblktag.htag_rehash = hashno; 3707 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3708 3709 hmeshift = HME_HASH_SHIFT(hashno); 3710 3711 while (addr < endaddr) { 3712 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3713 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 3714 SFMMU_HASH_LOCK(hmebp); 3715 /* inline HME_HASH_SEARCH */ 3716 hmeblkp = hmebp->hmeblkp; 3717 pr_hblk = NULL; 3718 while (hmeblkp) { 3719 if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) { 3720 /* found hme_blk */ 3721 ASSERT(!hmeblkp->hblk_shared); 3722 if (hmeblkp->hblk_shw_bit) { 3723 if (hmeblkp->hblk_shw_mask) { 3724 shadow = 1; 3725 sfmmu_shadow_hcleanup(sfmmup, 3726 hmeblkp, hmebp); 3727 break; 3728 } else { 3729 hmeblkp->hblk_shw_bit = 0; 3730 } 3731 } 3732 3733 /* 3734 * Hblk_hmecnt and hblk_vcnt could be non zero 3735 * since hblk_unload() does not gurantee that. 3736 * 3737 * XXX - this could cause tteload() to spin 3738 * where sfmmu_shadow_hcleanup() is called. 3739 */ 3740 } 3741 3742 nx_hblk = hmeblkp->hblk_next; 3743 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 3744 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3745 &list, 0); 3746 } else { 3747 pr_hblk = hmeblkp; 3748 } 3749 hmeblkp = nx_hblk; 3750 } 3751 3752 SFMMU_HASH_UNLOCK(hmebp); 3753 3754 if (shadow) { 3755 /* 3756 * We found another shadow hblk so cleaned its 3757 * children. We need to go back and cleanup 3758 * the original hblk so we don't change the 3759 * addr. 3760 */ 3761 shadow = 0; 3762 } else { 3763 addr = (caddr_t)roundup((uintptr_t)addr + 1, 3764 (1 << hmeshift)); 3765 } 3766 } 3767 sfmmu_hblks_list_purge(&list, 0); 3768 } 3769 3770 /* 3771 * This routine's job is to delete stale invalid shared hmeregions hmeblks that 3772 * may still linger on after pageunload. 3773 */ 3774 static void 3775 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz) 3776 { 3777 int hmeshift; 3778 hmeblk_tag hblktag; 3779 struct hmehash_bucket *hmebp; 3780 struct hme_blk *hmeblkp; 3781 struct hme_blk *pr_hblk; 3782 struct hme_blk *list = NULL; 3783 3784 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3785 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3786 3787 hmeshift = HME_HASH_SHIFT(ttesz); 3788 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3789 hblktag.htag_rehash = ttesz; 3790 hblktag.htag_rid = rid; 3791 hblktag.htag_id = srdp; 3792 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift); 3793 3794 SFMMU_HASH_LOCK(hmebp); 3795 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 3796 if (hmeblkp != NULL) { 3797 ASSERT(hmeblkp->hblk_shared); 3798 ASSERT(!hmeblkp->hblk_shw_bit); 3799 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 3800 panic("sfmmu_cleanup_rhblk: valid hmeblk"); 3801 } 3802 ASSERT(!hmeblkp->hblk_lckcnt); 3803 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3804 &list, 0); 3805 } 3806 SFMMU_HASH_UNLOCK(hmebp); 3807 sfmmu_hblks_list_purge(&list, 0); 3808 } 3809 3810 /* ARGSUSED */ 3811 static void 3812 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr, 3813 size_t r_size, void *r_obj, u_offset_t r_objoff) 3814 { 3815 } 3816 3817 /* 3818 * Searches for an hmeblk which maps addr, then unloads this mapping 3819 * and updates *eaddrp, if the hmeblk is found. 3820 */ 3821 static void 3822 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr, 3823 caddr_t eaddr, int ttesz, caddr_t *eaddrp) 3824 { 3825 int hmeshift; 3826 hmeblk_tag hblktag; 3827 struct hmehash_bucket *hmebp; 3828 struct hme_blk *hmeblkp; 3829 struct hme_blk *pr_hblk; 3830 struct hme_blk *list = NULL; 3831 3832 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3833 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3834 ASSERT(ttesz >= HBLK_MIN_TTESZ); 3835 3836 hmeshift = HME_HASH_SHIFT(ttesz); 3837 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3838 hblktag.htag_rehash = ttesz; 3839 hblktag.htag_rid = rid; 3840 hblktag.htag_id = srdp; 3841 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift); 3842 3843 SFMMU_HASH_LOCK(hmebp); 3844 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 3845 if (hmeblkp != NULL) { 3846 ASSERT(hmeblkp->hblk_shared); 3847 ASSERT(!hmeblkp->hblk_lckcnt); 3848 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 3849 *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr, 3850 eaddr, NULL, HAT_UNLOAD); 3851 ASSERT(*eaddrp > addr); 3852 } 3853 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt); 3854 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 3855 &list, 0); 3856 } 3857 SFMMU_HASH_UNLOCK(hmebp); 3858 sfmmu_hblks_list_purge(&list, 0); 3859 } 3860 3861 static void 3862 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp) 3863 { 3864 int ttesz = rgnp->rgn_pgszc; 3865 size_t rsz = rgnp->rgn_size; 3866 caddr_t rsaddr = rgnp->rgn_saddr; 3867 caddr_t readdr = rsaddr + rsz; 3868 caddr_t rhsaddr; 3869 caddr_t va; 3870 uint_t rid = rgnp->rgn_id; 3871 caddr_t cbsaddr; 3872 caddr_t cbeaddr; 3873 hat_rgn_cb_func_t rcbfunc; 3874 ulong_t cnt; 3875 3876 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 3877 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 3878 3879 ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz))); 3880 ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz))); 3881 if (ttesz < HBLK_MIN_TTESZ) { 3882 ttesz = HBLK_MIN_TTESZ; 3883 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES); 3884 } else { 3885 rhsaddr = rsaddr; 3886 } 3887 3888 if ((rcbfunc = rgnp->rgn_cb_function) == NULL) { 3889 rcbfunc = sfmmu_rgn_cb_noop; 3890 } 3891 3892 while (ttesz >= HBLK_MIN_TTESZ) { 3893 cbsaddr = rsaddr; 3894 cbeaddr = rsaddr; 3895 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) { 3896 ttesz--; 3897 continue; 3898 } 3899 cnt = 0; 3900 va = rsaddr; 3901 while (va < readdr) { 3902 ASSERT(va >= rhsaddr); 3903 if (va != cbeaddr) { 3904 if (cbeaddr != cbsaddr) { 3905 ASSERT(cbeaddr > cbsaddr); 3906 (*rcbfunc)(cbsaddr, cbeaddr, 3907 rsaddr, rsz, rgnp->rgn_obj, 3908 rgnp->rgn_objoff); 3909 } 3910 cbsaddr = va; 3911 cbeaddr = va; 3912 } 3913 sfmmu_unload_hmeregion_va(srdp, rid, va, readdr, 3914 ttesz, &cbeaddr); 3915 cnt++; 3916 va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz)); 3917 } 3918 if (cbeaddr != cbsaddr) { 3919 ASSERT(cbeaddr > cbsaddr); 3920 (*rcbfunc)(cbsaddr, cbeaddr, rsaddr, 3921 rsz, rgnp->rgn_obj, 3922 rgnp->rgn_objoff); 3923 } 3924 ttesz--; 3925 } 3926 } 3927 3928 /* 3929 * Release one hardware address translation lock on the given address range. 3930 */ 3931 void 3932 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len) 3933 { 3934 struct hmehash_bucket *hmebp; 3935 hmeblk_tag hblktag; 3936 int hmeshift, hashno = 1; 3937 struct hme_blk *hmeblkp, *list = NULL; 3938 caddr_t endaddr; 3939 3940 ASSERT(sfmmup != NULL); 3941 3942 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 3943 ASSERT((len & MMU_PAGEOFFSET) == 0); 3944 endaddr = addr + len; 3945 hblktag.htag_id = sfmmup; 3946 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 3947 3948 /* 3949 * Spitfire supports 4 page sizes. 3950 * Most pages are expected to be of the smallest page size (8K) and 3951 * these will not need to be rehashed. 64K pages also don't need to be 3952 * rehashed because an hmeblk spans 64K of address space. 512K pages 3953 * might need 1 rehash and and 4M pages might need 2 rehashes. 3954 */ 3955 while (addr < endaddr) { 3956 hmeshift = HME_HASH_SHIFT(hashno); 3957 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 3958 hblktag.htag_rehash = hashno; 3959 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 3960 3961 SFMMU_HASH_LOCK(hmebp); 3962 3963 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 3964 if (hmeblkp != NULL) { 3965 ASSERT(!hmeblkp->hblk_shared); 3966 /* 3967 * If we encounter a shadow hmeblk then 3968 * we know there are no valid hmeblks mapping 3969 * this address at this size or larger. 3970 * Just increment address by the smallest 3971 * page size. 3972 */ 3973 if (hmeblkp->hblk_shw_bit) { 3974 addr += MMU_PAGESIZE; 3975 } else { 3976 addr = sfmmu_hblk_unlock(hmeblkp, addr, 3977 endaddr); 3978 } 3979 SFMMU_HASH_UNLOCK(hmebp); 3980 hashno = 1; 3981 continue; 3982 } 3983 SFMMU_HASH_UNLOCK(hmebp); 3984 3985 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 3986 /* 3987 * We have traversed the whole list and rehashed 3988 * if necessary without finding the address to unlock 3989 * which should never happen. 3990 */ 3991 panic("sfmmu_unlock: addr not found. " 3992 "addr %p hat %p", (void *)addr, (void *)sfmmup); 3993 } else { 3994 hashno++; 3995 } 3996 } 3997 3998 sfmmu_hblks_list_purge(&list, 0); 3999 } 4000 4001 void 4002 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len, 4003 hat_region_cookie_t rcookie) 4004 { 4005 sf_srd_t *srdp; 4006 sf_region_t *rgnp; 4007 int ttesz; 4008 uint_t rid; 4009 caddr_t eaddr; 4010 caddr_t va; 4011 int hmeshift; 4012 hmeblk_tag hblktag; 4013 struct hmehash_bucket *hmebp; 4014 struct hme_blk *hmeblkp; 4015 struct hme_blk *pr_hblk; 4016 struct hme_blk *list; 4017 4018 if (rcookie == HAT_INVALID_REGION_COOKIE) { 4019 hat_unlock(sfmmup, addr, len); 4020 return; 4021 } 4022 4023 ASSERT(sfmmup != NULL); 4024 ASSERT(sfmmup != ksfmmup); 4025 4026 srdp = sfmmup->sfmmu_srdp; 4027 rid = (uint_t)((uint64_t)rcookie); 4028 VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS); 4029 eaddr = addr + len; 4030 va = addr; 4031 list = NULL; 4032 rgnp = srdp->srd_hmergnp[rid]; 4033 SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len); 4034 4035 ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc))); 4036 ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc))); 4037 if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) { 4038 ttesz = HBLK_MIN_TTESZ; 4039 } else { 4040 ttesz = rgnp->rgn_pgszc; 4041 } 4042 while (va < eaddr) { 4043 while (ttesz < rgnp->rgn_pgszc && 4044 IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) { 4045 ttesz++; 4046 } 4047 while (ttesz >= HBLK_MIN_TTESZ) { 4048 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) { 4049 ttesz--; 4050 continue; 4051 } 4052 hmeshift = HME_HASH_SHIFT(ttesz); 4053 hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift); 4054 hblktag.htag_rehash = ttesz; 4055 hblktag.htag_rid = rid; 4056 hblktag.htag_id = srdp; 4057 hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift); 4058 SFMMU_HASH_LOCK(hmebp); 4059 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, 4060 &list); 4061 if (hmeblkp == NULL) { 4062 SFMMU_HASH_UNLOCK(hmebp); 4063 ttesz--; 4064 continue; 4065 } 4066 ASSERT(hmeblkp->hblk_shared); 4067 va = sfmmu_hblk_unlock(hmeblkp, va, eaddr); 4068 ASSERT(va >= eaddr || 4069 IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz))); 4070 SFMMU_HASH_UNLOCK(hmebp); 4071 break; 4072 } 4073 if (ttesz < HBLK_MIN_TTESZ) { 4074 panic("hat_unlock_region: addr not found " 4075 "addr %p hat %p", (void *)va, (void *)sfmmup); 4076 } 4077 } 4078 sfmmu_hblks_list_purge(&list, 0); 4079 } 4080 4081 /* 4082 * Function to unlock a range of addresses in an hmeblk. It returns the 4083 * next address that needs to be unlocked. 4084 * Should be called with the hash lock held. 4085 */ 4086 static caddr_t 4087 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr) 4088 { 4089 struct sf_hment *sfhme; 4090 tte_t tteold, ttemod; 4091 int ttesz, ret; 4092 4093 ASSERT(in_hblk_range(hmeblkp, addr)); 4094 ASSERT(hmeblkp->hblk_shw_bit == 0); 4095 4096 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 4097 ttesz = get_hblk_ttesz(hmeblkp); 4098 4099 HBLKTOHME(sfhme, hmeblkp, addr); 4100 while (addr < endaddr) { 4101 readtte: 4102 sfmmu_copytte(&sfhme->hme_tte, &tteold); 4103 if (TTE_IS_VALID(&tteold)) { 4104 4105 ttemod = tteold; 4106 4107 ret = sfmmu_modifytte_try(&tteold, &ttemod, 4108 &sfhme->hme_tte); 4109 4110 if (ret < 0) 4111 goto readtte; 4112 4113 if (hmeblkp->hblk_lckcnt == 0) 4114 panic("zero hblk lckcnt"); 4115 4116 if (((uintptr_t)addr + TTEBYTES(ttesz)) > 4117 (uintptr_t)endaddr) 4118 panic("can't unlock large tte"); 4119 4120 ASSERT(hmeblkp->hblk_lckcnt > 0); 4121 atomic_dec_32(&hmeblkp->hblk_lckcnt); 4122 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK); 4123 } else { 4124 panic("sfmmu_hblk_unlock: invalid tte"); 4125 } 4126 addr += TTEBYTES(ttesz); 4127 sfhme++; 4128 } 4129 return (addr); 4130 } 4131 4132 /* 4133 * Physical Address Mapping Framework 4134 * 4135 * General rules: 4136 * 4137 * (1) Applies only to seg_kmem memory pages. To make things easier, 4138 * seg_kpm addresses are also accepted by the routines, but nothing 4139 * is done with them since by definition their PA mappings are static. 4140 * (2) hat_add_callback() may only be called while holding the page lock 4141 * SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()), 4142 * or passing HAC_PAGELOCK flag. 4143 * (3) prehandler() and posthandler() may not call hat_add_callback() or 4144 * hat_delete_callback(), nor should they allocate memory. Post quiesce 4145 * callbacks may not sleep or acquire adaptive mutex locks. 4146 * (4) Either prehandler() or posthandler() (but not both) may be specified 4147 * as being NULL. Specifying an errhandler() is optional. 4148 * 4149 * Details of using the framework: 4150 * 4151 * registering a callback (hat_register_callback()) 4152 * 4153 * Pass prehandler, posthandler, errhandler addresses 4154 * as described below. If capture_cpus argument is nonzero, 4155 * suspend callback to the prehandler will occur with CPUs 4156 * captured and executing xc_loop() and CPUs will remain 4157 * captured until after the posthandler suspend callback 4158 * occurs. 4159 * 4160 * adding a callback (hat_add_callback()) 4161 * 4162 * as_pagelock(); 4163 * hat_add_callback(); 4164 * save returned pfn in private data structures or program registers; 4165 * as_pageunlock(); 4166 * 4167 * prehandler() 4168 * 4169 * Stop all accesses by physical address to this memory page. 4170 * Called twice: the first, PRESUSPEND, is a context safe to acquire 4171 * adaptive locks. The second, SUSPEND, is called at high PIL with 4172 * CPUs captured so adaptive locks may NOT be acquired (and all spin 4173 * locks must be XCALL_PIL or higher locks). 4174 * 4175 * May return the following errors: 4176 * EIO: A fatal error has occurred. This will result in panic. 4177 * EAGAIN: The page cannot be suspended. This will fail the 4178 * relocation. 4179 * 0: Success. 4180 * 4181 * posthandler() 4182 * 4183 * Save new pfn in private data structures or program registers; 4184 * not allowed to fail (non-zero return values will result in panic). 4185 * 4186 * errhandler() 4187 * 4188 * called when an error occurs related to the callback. Currently 4189 * the only such error is HAT_CB_ERR_LEAKED which indicates that 4190 * a page is being freed, but there are still outstanding callback(s) 4191 * registered on the page. 4192 * 4193 * removing a callback (hat_delete_callback(); e.g., prior to freeing memory) 4194 * 4195 * stop using physical address 4196 * hat_delete_callback(); 4197 * 4198 */ 4199 4200 /* 4201 * Register a callback class. Each subsystem should do this once and 4202 * cache the id_t returned for use in setting up and tearing down callbacks. 4203 * 4204 * There is no facility for removing callback IDs once they are created; 4205 * the "key" should be unique for each module, so in case a module is unloaded 4206 * and subsequently re-loaded, we can recycle the module's previous entry. 4207 */ 4208 id_t 4209 hat_register_callback(int key, 4210 int (*prehandler)(caddr_t, uint_t, uint_t, void *), 4211 int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t), 4212 int (*errhandler)(caddr_t, uint_t, uint_t, void *), 4213 int capture_cpus) 4214 { 4215 id_t id; 4216 4217 /* 4218 * Search the table for a pre-existing callback associated with 4219 * the identifier "key". If one exists, we re-use that entry in 4220 * the table for this instance, otherwise we assign the next 4221 * available table slot. 4222 */ 4223 for (id = 0; id < sfmmu_max_cb_id; id++) { 4224 if (sfmmu_cb_table[id].key == key) 4225 break; 4226 } 4227 4228 if (id == sfmmu_max_cb_id) { 4229 id = sfmmu_cb_nextid++; 4230 if (id >= sfmmu_max_cb_id) 4231 panic("hat_register_callback: out of callback IDs"); 4232 } 4233 4234 ASSERT(prehandler != NULL || posthandler != NULL); 4235 4236 sfmmu_cb_table[id].key = key; 4237 sfmmu_cb_table[id].prehandler = prehandler; 4238 sfmmu_cb_table[id].posthandler = posthandler; 4239 sfmmu_cb_table[id].errhandler = errhandler; 4240 sfmmu_cb_table[id].capture_cpus = capture_cpus; 4241 4242 return (id); 4243 } 4244 4245 #define HAC_COOKIE_NONE (void *)-1 4246 4247 /* 4248 * Add relocation callbacks to the specified addr/len which will be called 4249 * when relocating the associated page. See the description of pre and 4250 * posthandler above for more details. 4251 * 4252 * If HAC_PAGELOCK is included in flags, the underlying memory page is 4253 * locked internally so the caller must be able to deal with the callback 4254 * running even before this function has returned. If HAC_PAGELOCK is not 4255 * set, it is assumed that the underlying memory pages are locked. 4256 * 4257 * Since the caller must track the individual page boundaries anyway, 4258 * we only allow a callback to be added to a single page (large 4259 * or small). Thus [addr, addr + len) MUST be contained within a single 4260 * page. 4261 * 4262 * Registering multiple callbacks on the same [addr, addr+len) is supported, 4263 * _provided_that_ a unique parameter is specified for each callback. 4264 * If multiple callbacks are registered on the same range the callback will 4265 * be invoked with each unique parameter. Registering the same callback with 4266 * the same argument more than once will result in corrupted kernel state. 4267 * 4268 * Returns the pfn of the underlying kernel page in *rpfn 4269 * on success, or PFN_INVALID on failure. 4270 * 4271 * cookiep (if passed) provides storage space for an opaque cookie 4272 * to return later to hat_delete_callback(). This cookie makes the callback 4273 * deletion significantly quicker by avoiding a potentially lengthy hash 4274 * search. 4275 * 4276 * Returns values: 4277 * 0: success 4278 * ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP) 4279 * EINVAL: callback ID is not valid 4280 * ENXIO: ["vaddr", "vaddr" + len) is not mapped in the kernel's address 4281 * space 4282 * ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary 4283 */ 4284 int 4285 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags, 4286 void *pvt, pfn_t *rpfn, void **cookiep) 4287 { 4288 struct hmehash_bucket *hmebp; 4289 hmeblk_tag hblktag; 4290 struct hme_blk *hmeblkp; 4291 int hmeshift, hashno; 4292 caddr_t saddr, eaddr, baseaddr; 4293 struct pa_hment *pahmep; 4294 struct sf_hment *sfhmep, *osfhmep; 4295 kmutex_t *pml; 4296 tte_t tte; 4297 page_t *pp; 4298 vnode_t *vp; 4299 u_offset_t off; 4300 pfn_t pfn; 4301 int kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP; 4302 int locked = 0; 4303 4304 /* 4305 * For KPM mappings, just return the physical address since we 4306 * don't need to register any callbacks. 4307 */ 4308 if (IS_KPM_ADDR(vaddr)) { 4309 uint64_t paddr; 4310 SFMMU_KPM_VTOP(vaddr, paddr); 4311 *rpfn = btop(paddr); 4312 if (cookiep != NULL) 4313 *cookiep = HAC_COOKIE_NONE; 4314 return (0); 4315 } 4316 4317 if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) { 4318 *rpfn = PFN_INVALID; 4319 return (EINVAL); 4320 } 4321 4322 if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) { 4323 *rpfn = PFN_INVALID; 4324 return (ENOMEM); 4325 } 4326 4327 sfhmep = &pahmep->sfment; 4328 4329 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK); 4330 eaddr = saddr + len; 4331 4332 rehash: 4333 /* Find the mapping(s) for this page */ 4334 for (hashno = TTE64K, hmeblkp = NULL; 4335 hmeblkp == NULL && hashno <= mmu_hashcnt; 4336 hashno++) { 4337 hmeshift = HME_HASH_SHIFT(hashno); 4338 hblktag.htag_id = ksfmmup; 4339 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4340 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift); 4341 hblktag.htag_rehash = hashno; 4342 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift); 4343 4344 SFMMU_HASH_LOCK(hmebp); 4345 4346 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 4347 4348 if (hmeblkp == NULL) 4349 SFMMU_HASH_UNLOCK(hmebp); 4350 } 4351 4352 if (hmeblkp == NULL) { 4353 kmem_cache_free(pa_hment_cache, pahmep); 4354 *rpfn = PFN_INVALID; 4355 return (ENXIO); 4356 } 4357 4358 ASSERT(!hmeblkp->hblk_shared); 4359 4360 HBLKTOHME(osfhmep, hmeblkp, saddr); 4361 sfmmu_copytte(&osfhmep->hme_tte, &tte); 4362 4363 if (!TTE_IS_VALID(&tte)) { 4364 SFMMU_HASH_UNLOCK(hmebp); 4365 kmem_cache_free(pa_hment_cache, pahmep); 4366 *rpfn = PFN_INVALID; 4367 return (ENXIO); 4368 } 4369 4370 /* 4371 * Make sure the boundaries for the callback fall within this 4372 * single mapping. 4373 */ 4374 baseaddr = (caddr_t)get_hblk_base(hmeblkp); 4375 ASSERT(saddr >= baseaddr); 4376 if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) { 4377 SFMMU_HASH_UNLOCK(hmebp); 4378 kmem_cache_free(pa_hment_cache, pahmep); 4379 *rpfn = PFN_INVALID; 4380 return (ERANGE); 4381 } 4382 4383 pfn = sfmmu_ttetopfn(&tte, vaddr); 4384 4385 /* 4386 * The pfn may not have a page_t underneath in which case we 4387 * just return it. This can happen if we are doing I/O to a 4388 * static portion of the kernel's address space, for instance. 4389 */ 4390 pp = osfhmep->hme_page; 4391 if (pp == NULL) { 4392 SFMMU_HASH_UNLOCK(hmebp); 4393 kmem_cache_free(pa_hment_cache, pahmep); 4394 *rpfn = pfn; 4395 if (cookiep) 4396 *cookiep = HAC_COOKIE_NONE; 4397 return (0); 4398 } 4399 ASSERT(pp == PP_PAGEROOT(pp)); 4400 4401 vp = pp->p_vnode; 4402 off = pp->p_offset; 4403 4404 pml = sfmmu_mlist_enter(pp); 4405 4406 if (flags & HAC_PAGELOCK) { 4407 if (!page_trylock(pp, SE_SHARED)) { 4408 /* 4409 * Somebody is holding SE_EXCL lock. Might 4410 * even be hat_page_relocate(). Drop all 4411 * our locks, lookup the page in &kvp, and 4412 * retry. If it doesn't exist in &kvp and &zvp, 4413 * then we must be dealing with a kernel mapped 4414 * page which doesn't actually belong to 4415 * segkmem so we punt. 4416 */ 4417 sfmmu_mlist_exit(pml); 4418 SFMMU_HASH_UNLOCK(hmebp); 4419 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED); 4420 4421 /* check zvp before giving up */ 4422 if (pp == NULL) 4423 pp = page_lookup(&zvp, (u_offset_t)saddr, 4424 SE_SHARED); 4425 4426 /* Okay, we didn't find it, give up */ 4427 if (pp == NULL) { 4428 kmem_cache_free(pa_hment_cache, pahmep); 4429 *rpfn = pfn; 4430 if (cookiep) 4431 *cookiep = HAC_COOKIE_NONE; 4432 return (0); 4433 } 4434 page_unlock(pp); 4435 goto rehash; 4436 } 4437 locked = 1; 4438 } 4439 4440 if (!PAGE_LOCKED(pp) && !panicstr) 4441 panic("hat_add_callback: page 0x%p not locked", (void *)pp); 4442 4443 if (osfhmep->hme_page != pp || pp->p_vnode != vp || 4444 pp->p_offset != off) { 4445 /* 4446 * The page moved before we got our hands on it. Drop 4447 * all the locks and try again. 4448 */ 4449 ASSERT((flags & HAC_PAGELOCK) != 0); 4450 sfmmu_mlist_exit(pml); 4451 SFMMU_HASH_UNLOCK(hmebp); 4452 page_unlock(pp); 4453 locked = 0; 4454 goto rehash; 4455 } 4456 4457 if (!VN_ISKAS(vp)) { 4458 /* 4459 * This is not a segkmem page but another page which 4460 * has been kernel mapped. It had better have at least 4461 * a share lock on it. Return the pfn. 4462 */ 4463 sfmmu_mlist_exit(pml); 4464 SFMMU_HASH_UNLOCK(hmebp); 4465 if (locked) 4466 page_unlock(pp); 4467 kmem_cache_free(pa_hment_cache, pahmep); 4468 ASSERT(PAGE_LOCKED(pp)); 4469 *rpfn = pfn; 4470 if (cookiep) 4471 *cookiep = HAC_COOKIE_NONE; 4472 return (0); 4473 } 4474 4475 /* 4476 * Setup this pa_hment and link its embedded dummy sf_hment into 4477 * the mapping list. 4478 */ 4479 pp->p_share++; 4480 pahmep->cb_id = callback_id; 4481 pahmep->addr = vaddr; 4482 pahmep->len = len; 4483 pahmep->refcnt = 1; 4484 pahmep->flags = 0; 4485 pahmep->pvt = pvt; 4486 4487 sfhmep->hme_tte.ll = 0; 4488 sfhmep->hme_data = pahmep; 4489 sfhmep->hme_prev = osfhmep; 4490 sfhmep->hme_next = osfhmep->hme_next; 4491 4492 if (osfhmep->hme_next) 4493 osfhmep->hme_next->hme_prev = sfhmep; 4494 4495 osfhmep->hme_next = sfhmep; 4496 4497 sfmmu_mlist_exit(pml); 4498 SFMMU_HASH_UNLOCK(hmebp); 4499 4500 if (locked) 4501 page_unlock(pp); 4502 4503 *rpfn = pfn; 4504 if (cookiep) 4505 *cookiep = (void *)pahmep; 4506 4507 return (0); 4508 } 4509 4510 /* 4511 * Remove the relocation callbacks from the specified addr/len. 4512 */ 4513 void 4514 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags, 4515 void *cookie) 4516 { 4517 struct hmehash_bucket *hmebp; 4518 hmeblk_tag hblktag; 4519 struct hme_blk *hmeblkp; 4520 int hmeshift, hashno; 4521 caddr_t saddr; 4522 struct pa_hment *pahmep; 4523 struct sf_hment *sfhmep, *osfhmep; 4524 kmutex_t *pml; 4525 tte_t tte; 4526 page_t *pp; 4527 vnode_t *vp; 4528 u_offset_t off; 4529 int locked = 0; 4530 4531 /* 4532 * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to 4533 * remove so just return. 4534 */ 4535 if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr)) 4536 return; 4537 4538 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK); 4539 4540 rehash: 4541 /* Find the mapping(s) for this page */ 4542 for (hashno = TTE64K, hmeblkp = NULL; 4543 hmeblkp == NULL && hashno <= mmu_hashcnt; 4544 hashno++) { 4545 hmeshift = HME_HASH_SHIFT(hashno); 4546 hblktag.htag_id = ksfmmup; 4547 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4548 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift); 4549 hblktag.htag_rehash = hashno; 4550 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift); 4551 4552 SFMMU_HASH_LOCK(hmebp); 4553 4554 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 4555 4556 if (hmeblkp == NULL) 4557 SFMMU_HASH_UNLOCK(hmebp); 4558 } 4559 4560 if (hmeblkp == NULL) 4561 return; 4562 4563 ASSERT(!hmeblkp->hblk_shared); 4564 4565 HBLKTOHME(osfhmep, hmeblkp, saddr); 4566 4567 sfmmu_copytte(&osfhmep->hme_tte, &tte); 4568 if (!TTE_IS_VALID(&tte)) { 4569 SFMMU_HASH_UNLOCK(hmebp); 4570 return; 4571 } 4572 4573 pp = osfhmep->hme_page; 4574 if (pp == NULL) { 4575 SFMMU_HASH_UNLOCK(hmebp); 4576 ASSERT(cookie == NULL); 4577 return; 4578 } 4579 4580 vp = pp->p_vnode; 4581 off = pp->p_offset; 4582 4583 pml = sfmmu_mlist_enter(pp); 4584 4585 if (flags & HAC_PAGELOCK) { 4586 if (!page_trylock(pp, SE_SHARED)) { 4587 /* 4588 * Somebody is holding SE_EXCL lock. Might 4589 * even be hat_page_relocate(). Drop all 4590 * our locks, lookup the page in &kvp, and 4591 * retry. If it doesn't exist in &kvp and &zvp, 4592 * then we must be dealing with a kernel mapped 4593 * page which doesn't actually belong to 4594 * segkmem so we punt. 4595 */ 4596 sfmmu_mlist_exit(pml); 4597 SFMMU_HASH_UNLOCK(hmebp); 4598 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED); 4599 /* check zvp before giving up */ 4600 if (pp == NULL) 4601 pp = page_lookup(&zvp, (u_offset_t)saddr, 4602 SE_SHARED); 4603 4604 if (pp == NULL) { 4605 ASSERT(cookie == NULL); 4606 return; 4607 } 4608 page_unlock(pp); 4609 goto rehash; 4610 } 4611 locked = 1; 4612 } 4613 4614 ASSERT(PAGE_LOCKED(pp)); 4615 4616 if (osfhmep->hme_page != pp || pp->p_vnode != vp || 4617 pp->p_offset != off) { 4618 /* 4619 * The page moved before we got our hands on it. Drop 4620 * all the locks and try again. 4621 */ 4622 ASSERT((flags & HAC_PAGELOCK) != 0); 4623 sfmmu_mlist_exit(pml); 4624 SFMMU_HASH_UNLOCK(hmebp); 4625 page_unlock(pp); 4626 locked = 0; 4627 goto rehash; 4628 } 4629 4630 if (!VN_ISKAS(vp)) { 4631 /* 4632 * This is not a segkmem page but another page which 4633 * has been kernel mapped. 4634 */ 4635 sfmmu_mlist_exit(pml); 4636 SFMMU_HASH_UNLOCK(hmebp); 4637 if (locked) 4638 page_unlock(pp); 4639 ASSERT(cookie == NULL); 4640 return; 4641 } 4642 4643 if (cookie != NULL) { 4644 pahmep = (struct pa_hment *)cookie; 4645 sfhmep = &pahmep->sfment; 4646 } else { 4647 for (sfhmep = pp->p_mapping; sfhmep != NULL; 4648 sfhmep = sfhmep->hme_next) { 4649 4650 /* 4651 * skip va<->pa mappings 4652 */ 4653 if (!IS_PAHME(sfhmep)) 4654 continue; 4655 4656 pahmep = sfhmep->hme_data; 4657 ASSERT(pahmep != NULL); 4658 4659 /* 4660 * if pa_hment matches, remove it 4661 */ 4662 if ((pahmep->pvt == pvt) && 4663 (pahmep->addr == vaddr) && 4664 (pahmep->len == len)) { 4665 break; 4666 } 4667 } 4668 } 4669 4670 if (sfhmep == NULL) { 4671 if (!panicstr) { 4672 panic("hat_delete_callback: pa_hment not found, pp %p", 4673 (void *)pp); 4674 } 4675 return; 4676 } 4677 4678 /* 4679 * Note: at this point a valid kernel mapping must still be 4680 * present on this page. 4681 */ 4682 pp->p_share--; 4683 if (pp->p_share <= 0) 4684 panic("hat_delete_callback: zero p_share"); 4685 4686 if (--pahmep->refcnt == 0) { 4687 if (pahmep->flags != 0) 4688 panic("hat_delete_callback: pa_hment is busy"); 4689 4690 /* 4691 * Remove sfhmep from the mapping list for the page. 4692 */ 4693 if (sfhmep->hme_prev) { 4694 sfhmep->hme_prev->hme_next = sfhmep->hme_next; 4695 } else { 4696 pp->p_mapping = sfhmep->hme_next; 4697 } 4698 4699 if (sfhmep->hme_next) 4700 sfhmep->hme_next->hme_prev = sfhmep->hme_prev; 4701 4702 sfmmu_mlist_exit(pml); 4703 SFMMU_HASH_UNLOCK(hmebp); 4704 4705 if (locked) 4706 page_unlock(pp); 4707 4708 kmem_cache_free(pa_hment_cache, pahmep); 4709 return; 4710 } 4711 4712 sfmmu_mlist_exit(pml); 4713 SFMMU_HASH_UNLOCK(hmebp); 4714 if (locked) 4715 page_unlock(pp); 4716 } 4717 4718 /* 4719 * hat_probe returns 1 if the translation for the address 'addr' is 4720 * loaded, zero otherwise. 4721 * 4722 * hat_probe should be used only for advisorary purposes because it may 4723 * occasionally return the wrong value. The implementation must guarantee that 4724 * returning the wrong value is a very rare event. hat_probe is used 4725 * to implement optimizations in the segment drivers. 4726 * 4727 */ 4728 int 4729 hat_probe(struct hat *sfmmup, caddr_t addr) 4730 { 4731 pfn_t pfn; 4732 tte_t tte; 4733 4734 ASSERT(sfmmup != NULL); 4735 4736 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 4737 4738 if (sfmmup == ksfmmup) { 4739 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte)) 4740 == PFN_SUSPENDED) { 4741 sfmmu_vatopfn_suspended(addr, sfmmup, &tte); 4742 } 4743 } else { 4744 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL); 4745 } 4746 4747 if (pfn != PFN_INVALID) 4748 return (1); 4749 else 4750 return (0); 4751 } 4752 4753 ssize_t 4754 hat_getpagesize(struct hat *sfmmup, caddr_t addr) 4755 { 4756 tte_t tte; 4757 4758 if (sfmmup == ksfmmup) { 4759 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4760 return (-1); 4761 } 4762 } else { 4763 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4764 return (-1); 4765 } 4766 } 4767 4768 ASSERT(TTE_IS_VALID(&tte)); 4769 return (TTEBYTES(TTE_CSZ(&tte))); 4770 } 4771 4772 uint_t 4773 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr) 4774 { 4775 tte_t tte; 4776 4777 if (sfmmup == ksfmmup) { 4778 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4779 tte.ll = 0; 4780 } 4781 } else { 4782 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) { 4783 tte.ll = 0; 4784 } 4785 } 4786 if (TTE_IS_VALID(&tte)) { 4787 *attr = sfmmu_ptov_attr(&tte); 4788 return (0); 4789 } 4790 *attr = 0; 4791 return ((uint_t)0xffffffff); 4792 } 4793 4794 /* 4795 * Enables more attributes on specified address range (ie. logical OR) 4796 */ 4797 void 4798 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4799 { 4800 ASSERT(hat->sfmmu_as != NULL); 4801 4802 sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR); 4803 } 4804 4805 /* 4806 * Assigns attributes to the specified address range. All the attributes 4807 * are specified. 4808 */ 4809 void 4810 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4811 { 4812 ASSERT(hat->sfmmu_as != NULL); 4813 4814 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR); 4815 } 4816 4817 /* 4818 * Remove attributes on the specified address range (ie. loginal NAND) 4819 */ 4820 void 4821 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr) 4822 { 4823 ASSERT(hat->sfmmu_as != NULL); 4824 4825 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR); 4826 } 4827 4828 /* 4829 * Change attributes on an address range to that specified by attr and mode. 4830 */ 4831 static void 4832 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr, 4833 int mode) 4834 { 4835 struct hmehash_bucket *hmebp; 4836 hmeblk_tag hblktag; 4837 int hmeshift, hashno = 1; 4838 struct hme_blk *hmeblkp, *list = NULL; 4839 caddr_t endaddr; 4840 cpuset_t cpuset; 4841 demap_range_t dmr; 4842 4843 CPUSET_ZERO(cpuset); 4844 4845 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 4846 ASSERT((len & MMU_PAGEOFFSET) == 0); 4847 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0); 4848 4849 if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) && 4850 ((addr + len) > (caddr_t)USERLIMIT)) { 4851 panic("user addr %p in kernel space", 4852 (void *)addr); 4853 } 4854 4855 endaddr = addr + len; 4856 hblktag.htag_id = sfmmup; 4857 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 4858 DEMAP_RANGE_INIT(sfmmup, &dmr); 4859 4860 while (addr < endaddr) { 4861 hmeshift = HME_HASH_SHIFT(hashno); 4862 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 4863 hblktag.htag_rehash = hashno; 4864 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 4865 4866 SFMMU_HASH_LOCK(hmebp); 4867 4868 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 4869 if (hmeblkp != NULL) { 4870 ASSERT(!hmeblkp->hblk_shared); 4871 /* 4872 * We've encountered a shadow hmeblk so skip the range 4873 * of the next smaller mapping size. 4874 */ 4875 if (hmeblkp->hblk_shw_bit) { 4876 ASSERT(sfmmup != ksfmmup); 4877 ASSERT(hashno > 1); 4878 addr = (caddr_t)P2END((uintptr_t)addr, 4879 TTEBYTES(hashno - 1)); 4880 } else { 4881 addr = sfmmu_hblk_chgattr(sfmmup, 4882 hmeblkp, addr, endaddr, &dmr, attr, mode); 4883 } 4884 SFMMU_HASH_UNLOCK(hmebp); 4885 hashno = 1; 4886 continue; 4887 } 4888 SFMMU_HASH_UNLOCK(hmebp); 4889 4890 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 4891 /* 4892 * We have traversed the whole list and rehashed 4893 * if necessary without finding the address to chgattr. 4894 * This is ok, so we increment the address by the 4895 * smallest hmeblk range for kernel mappings or for 4896 * user mappings with no large pages, and the largest 4897 * hmeblk range, to account for shadow hmeblks, for 4898 * user mappings with large pages and continue. 4899 */ 4900 if (sfmmup == ksfmmup) 4901 addr = (caddr_t)P2END((uintptr_t)addr, 4902 TTEBYTES(1)); 4903 else 4904 addr = (caddr_t)P2END((uintptr_t)addr, 4905 TTEBYTES(hashno)); 4906 hashno = 1; 4907 } else { 4908 hashno++; 4909 } 4910 } 4911 4912 sfmmu_hblks_list_purge(&list, 0); 4913 DEMAP_RANGE_FLUSH(&dmr); 4914 cpuset = sfmmup->sfmmu_cpusran; 4915 xt_sync(cpuset); 4916 } 4917 4918 /* 4919 * This function chgattr on a range of addresses in an hmeblk. It returns the 4920 * next addres that needs to be chgattr. 4921 * It should be called with the hash lock held. 4922 * XXX It should be possible to optimize chgattr by not flushing every time but 4923 * on the other hand: 4924 * 1. do one flush crosscall. 4925 * 2. only flush if we are increasing permissions (make sure this will work) 4926 */ 4927 static caddr_t 4928 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 4929 caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode) 4930 { 4931 tte_t tte, tteattr, tteflags, ttemod; 4932 struct sf_hment *sfhmep; 4933 int ttesz; 4934 struct page *pp = NULL; 4935 kmutex_t *pml, *pmtx; 4936 int ret; 4937 int use_demap_range; 4938 #if defined(SF_ERRATA_57) 4939 int check_exec; 4940 #endif 4941 4942 ASSERT(in_hblk_range(hmeblkp, addr)); 4943 ASSERT(hmeblkp->hblk_shw_bit == 0); 4944 ASSERT(!hmeblkp->hblk_shared); 4945 4946 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 4947 ttesz = get_hblk_ttesz(hmeblkp); 4948 4949 /* 4950 * Flush the current demap region if addresses have been 4951 * skipped or the page size doesn't match. 4952 */ 4953 use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)); 4954 if (use_demap_range) { 4955 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 4956 } else if (dmrp != NULL) { 4957 DEMAP_RANGE_FLUSH(dmrp); 4958 } 4959 4960 tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags); 4961 #if defined(SF_ERRATA_57) 4962 check_exec = (sfmmup != ksfmmup) && 4963 AS_TYPE_64BIT(sfmmup->sfmmu_as) && 4964 TTE_IS_EXECUTABLE(&tteattr); 4965 #endif 4966 HBLKTOHME(sfhmep, hmeblkp, addr); 4967 while (addr < endaddr) { 4968 sfmmu_copytte(&sfhmep->hme_tte, &tte); 4969 if (TTE_IS_VALID(&tte)) { 4970 if ((tte.ll & tteflags.ll) == tteattr.ll) { 4971 /* 4972 * if the new attr is the same as old 4973 * continue 4974 */ 4975 goto next_addr; 4976 } 4977 if (!TTE_IS_WRITABLE(&tteattr)) { 4978 /* 4979 * make sure we clear hw modify bit if we 4980 * removing write protections 4981 */ 4982 tteflags.tte_intlo |= TTE_HWWR_INT; 4983 } 4984 4985 pml = NULL; 4986 pp = sfhmep->hme_page; 4987 if (pp) { 4988 pml = sfmmu_mlist_enter(pp); 4989 } 4990 4991 if (pp != sfhmep->hme_page) { 4992 /* 4993 * tte must have been unloaded. 4994 */ 4995 ASSERT(pml); 4996 sfmmu_mlist_exit(pml); 4997 continue; 4998 } 4999 5000 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5001 5002 ttemod = tte; 5003 ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll; 5004 ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte)); 5005 5006 #if defined(SF_ERRATA_57) 5007 if (check_exec && addr < errata57_limit) 5008 ttemod.tte_exec_perm = 0; 5009 #endif 5010 ret = sfmmu_modifytte_try(&tte, &ttemod, 5011 &sfhmep->hme_tte); 5012 5013 if (ret < 0) { 5014 /* tte changed underneath us */ 5015 if (pml) { 5016 sfmmu_mlist_exit(pml); 5017 } 5018 continue; 5019 } 5020 5021 if (tteflags.tte_intlo & TTE_HWWR_INT) { 5022 /* 5023 * need to sync if we are clearing modify bit. 5024 */ 5025 sfmmu_ttesync(sfmmup, addr, &tte, pp); 5026 } 5027 5028 if (pp && PP_ISRO(pp)) { 5029 if (tteattr.tte_intlo & TTE_WRPRM_INT) { 5030 pmtx = sfmmu_page_enter(pp); 5031 PP_CLRRO(pp); 5032 sfmmu_page_exit(pmtx); 5033 } 5034 } 5035 5036 if (ret > 0 && use_demap_range) { 5037 DEMAP_RANGE_MARKPG(dmrp, addr); 5038 } else if (ret > 0) { 5039 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 5040 } 5041 5042 if (pml) { 5043 sfmmu_mlist_exit(pml); 5044 } 5045 } 5046 next_addr: 5047 addr += TTEBYTES(ttesz); 5048 sfhmep++; 5049 DEMAP_RANGE_NEXTPG(dmrp); 5050 } 5051 return (addr); 5052 } 5053 5054 /* 5055 * This routine converts virtual attributes to physical ones. It will 5056 * update the tteflags field with the tte mask corresponding to the attributes 5057 * affected and it returns the new attributes. It will also clear the modify 5058 * bit if we are taking away write permission. This is necessary since the 5059 * modify bit is the hardware permission bit and we need to clear it in order 5060 * to detect write faults. 5061 */ 5062 static uint64_t 5063 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp) 5064 { 5065 tte_t ttevalue; 5066 5067 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR)); 5068 5069 switch (mode) { 5070 case SFMMU_CHGATTR: 5071 /* all attributes specified */ 5072 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr); 5073 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr); 5074 ttemaskp->tte_inthi = TTEINTHI_ATTR; 5075 ttemaskp->tte_intlo = TTEINTLO_ATTR; 5076 break; 5077 case SFMMU_SETATTR: 5078 ASSERT(!(attr & ~HAT_PROT_MASK)); 5079 ttemaskp->ll = 0; 5080 ttevalue.ll = 0; 5081 /* 5082 * a valid tte implies exec and read for sfmmu 5083 * so no need to do anything about them. 5084 * since priviledged access implies user access 5085 * PROT_USER doesn't make sense either. 5086 */ 5087 if (attr & PROT_WRITE) { 5088 ttemaskp->tte_intlo |= TTE_WRPRM_INT; 5089 ttevalue.tte_intlo |= TTE_WRPRM_INT; 5090 } 5091 break; 5092 case SFMMU_CLRATTR: 5093 /* attributes will be nand with current ones */ 5094 if (attr & ~(PROT_WRITE | PROT_USER)) { 5095 panic("sfmmu: attr %x not supported", attr); 5096 } 5097 ttemaskp->ll = 0; 5098 ttevalue.ll = 0; 5099 if (attr & PROT_WRITE) { 5100 /* clear both writable and modify bit */ 5101 ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT; 5102 } 5103 if (attr & PROT_USER) { 5104 ttemaskp->tte_intlo |= TTE_PRIV_INT; 5105 ttevalue.tte_intlo |= TTE_PRIV_INT; 5106 } 5107 break; 5108 default: 5109 panic("sfmmu_vtop_attr: bad mode %x", mode); 5110 } 5111 ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0); 5112 return (ttevalue.ll); 5113 } 5114 5115 static uint_t 5116 sfmmu_ptov_attr(tte_t *ttep) 5117 { 5118 uint_t attr; 5119 5120 ASSERT(TTE_IS_VALID(ttep)); 5121 5122 attr = PROT_READ; 5123 5124 if (TTE_IS_WRITABLE(ttep)) { 5125 attr |= PROT_WRITE; 5126 } 5127 if (TTE_IS_EXECUTABLE(ttep)) { 5128 attr |= PROT_EXEC; 5129 } 5130 if (!TTE_IS_PRIVILEGED(ttep)) { 5131 attr |= PROT_USER; 5132 } 5133 if (TTE_IS_NFO(ttep)) { 5134 attr |= HAT_NOFAULT; 5135 } 5136 if (TTE_IS_NOSYNC(ttep)) { 5137 attr |= HAT_NOSYNC; 5138 } 5139 if (TTE_IS_SIDEFFECT(ttep)) { 5140 attr |= SFMMU_SIDEFFECT; 5141 } 5142 if (!TTE_IS_VCACHEABLE(ttep)) { 5143 attr |= SFMMU_UNCACHEVTTE; 5144 } 5145 if (!TTE_IS_PCACHEABLE(ttep)) { 5146 attr |= SFMMU_UNCACHEPTTE; 5147 } 5148 return (attr); 5149 } 5150 5151 /* 5152 * hat_chgprot is a deprecated hat call. New segment drivers 5153 * should store all attributes and use hat_*attr calls. 5154 * 5155 * Change the protections in the virtual address range 5156 * given to the specified virtual protection. If vprot is ~PROT_WRITE, 5157 * then remove write permission, leaving the other 5158 * permissions unchanged. If vprot is ~PROT_USER, remove user permissions. 5159 * 5160 */ 5161 void 5162 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot) 5163 { 5164 struct hmehash_bucket *hmebp; 5165 hmeblk_tag hblktag; 5166 int hmeshift, hashno = 1; 5167 struct hme_blk *hmeblkp, *list = NULL; 5168 caddr_t endaddr; 5169 cpuset_t cpuset; 5170 demap_range_t dmr; 5171 5172 ASSERT((len & MMU_PAGEOFFSET) == 0); 5173 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0); 5174 5175 ASSERT(sfmmup->sfmmu_as != NULL); 5176 5177 CPUSET_ZERO(cpuset); 5178 5179 if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) && 5180 ((addr + len) > (caddr_t)USERLIMIT)) { 5181 panic("user addr %p vprot %x in kernel space", 5182 (void *)addr, vprot); 5183 } 5184 endaddr = addr + len; 5185 hblktag.htag_id = sfmmup; 5186 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 5187 DEMAP_RANGE_INIT(sfmmup, &dmr); 5188 5189 while (addr < endaddr) { 5190 hmeshift = HME_HASH_SHIFT(hashno); 5191 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 5192 hblktag.htag_rehash = hashno; 5193 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 5194 5195 SFMMU_HASH_LOCK(hmebp); 5196 5197 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 5198 if (hmeblkp != NULL) { 5199 ASSERT(!hmeblkp->hblk_shared); 5200 /* 5201 * We've encountered a shadow hmeblk so skip the range 5202 * of the next smaller mapping size. 5203 */ 5204 if (hmeblkp->hblk_shw_bit) { 5205 ASSERT(sfmmup != ksfmmup); 5206 ASSERT(hashno > 1); 5207 addr = (caddr_t)P2END((uintptr_t)addr, 5208 TTEBYTES(hashno - 1)); 5209 } else { 5210 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp, 5211 addr, endaddr, &dmr, vprot); 5212 } 5213 SFMMU_HASH_UNLOCK(hmebp); 5214 hashno = 1; 5215 continue; 5216 } 5217 SFMMU_HASH_UNLOCK(hmebp); 5218 5219 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 5220 /* 5221 * We have traversed the whole list and rehashed 5222 * if necessary without finding the address to chgprot. 5223 * This is ok so we increment the address by the 5224 * smallest hmeblk range for kernel mappings and the 5225 * largest hmeblk range, to account for shadow hmeblks, 5226 * for user mappings and continue. 5227 */ 5228 if (sfmmup == ksfmmup) 5229 addr = (caddr_t)P2END((uintptr_t)addr, 5230 TTEBYTES(1)); 5231 else 5232 addr = (caddr_t)P2END((uintptr_t)addr, 5233 TTEBYTES(hashno)); 5234 hashno = 1; 5235 } else { 5236 hashno++; 5237 } 5238 } 5239 5240 sfmmu_hblks_list_purge(&list, 0); 5241 DEMAP_RANGE_FLUSH(&dmr); 5242 cpuset = sfmmup->sfmmu_cpusran; 5243 xt_sync(cpuset); 5244 } 5245 5246 /* 5247 * This function chgprots a range of addresses in an hmeblk. It returns the 5248 * next addres that needs to be chgprot. 5249 * It should be called with the hash lock held. 5250 * XXX It shold be possible to optimize chgprot by not flushing every time but 5251 * on the other hand: 5252 * 1. do one flush crosscall. 5253 * 2. only flush if we are increasing permissions (make sure this will work) 5254 */ 5255 static caddr_t 5256 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 5257 caddr_t endaddr, demap_range_t *dmrp, uint_t vprot) 5258 { 5259 uint_t pprot; 5260 tte_t tte, ttemod; 5261 struct sf_hment *sfhmep; 5262 uint_t tteflags; 5263 int ttesz; 5264 struct page *pp = NULL; 5265 kmutex_t *pml, *pmtx; 5266 int ret; 5267 int use_demap_range; 5268 #if defined(SF_ERRATA_57) 5269 int check_exec; 5270 #endif 5271 5272 ASSERT(in_hblk_range(hmeblkp, addr)); 5273 ASSERT(hmeblkp->hblk_shw_bit == 0); 5274 ASSERT(!hmeblkp->hblk_shared); 5275 5276 #ifdef DEBUG 5277 if (get_hblk_ttesz(hmeblkp) != TTE8K && 5278 (endaddr < get_hblk_endaddr(hmeblkp))) { 5279 panic("sfmmu_hblk_chgprot: partial chgprot of large page"); 5280 } 5281 #endif /* DEBUG */ 5282 5283 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 5284 ttesz = get_hblk_ttesz(hmeblkp); 5285 5286 pprot = sfmmu_vtop_prot(vprot, &tteflags); 5287 #if defined(SF_ERRATA_57) 5288 check_exec = (sfmmup != ksfmmup) && 5289 AS_TYPE_64BIT(sfmmup->sfmmu_as) && 5290 ((vprot & PROT_EXEC) == PROT_EXEC); 5291 #endif 5292 HBLKTOHME(sfhmep, hmeblkp, addr); 5293 5294 /* 5295 * Flush the current demap region if addresses have been 5296 * skipped or the page size doesn't match. 5297 */ 5298 use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE); 5299 if (use_demap_range) { 5300 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 5301 } else if (dmrp != NULL) { 5302 DEMAP_RANGE_FLUSH(dmrp); 5303 } 5304 5305 while (addr < endaddr) { 5306 sfmmu_copytte(&sfhmep->hme_tte, &tte); 5307 if (TTE_IS_VALID(&tte)) { 5308 if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) { 5309 /* 5310 * if the new protection is the same as old 5311 * continue 5312 */ 5313 goto next_addr; 5314 } 5315 pml = NULL; 5316 pp = sfhmep->hme_page; 5317 if (pp) { 5318 pml = sfmmu_mlist_enter(pp); 5319 } 5320 if (pp != sfhmep->hme_page) { 5321 /* 5322 * tte most have been unloaded 5323 * underneath us. Recheck 5324 */ 5325 ASSERT(pml); 5326 sfmmu_mlist_exit(pml); 5327 continue; 5328 } 5329 5330 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5331 5332 ttemod = tte; 5333 TTE_SET_LOFLAGS(&ttemod, tteflags, pprot); 5334 #if defined(SF_ERRATA_57) 5335 if (check_exec && addr < errata57_limit) 5336 ttemod.tte_exec_perm = 0; 5337 #endif 5338 ret = sfmmu_modifytte_try(&tte, &ttemod, 5339 &sfhmep->hme_tte); 5340 5341 if (ret < 0) { 5342 /* tte changed underneath us */ 5343 if (pml) { 5344 sfmmu_mlist_exit(pml); 5345 } 5346 continue; 5347 } 5348 5349 if (tteflags & TTE_HWWR_INT) { 5350 /* 5351 * need to sync if we are clearing modify bit. 5352 */ 5353 sfmmu_ttesync(sfmmup, addr, &tte, pp); 5354 } 5355 5356 if (pp && PP_ISRO(pp)) { 5357 if (pprot & TTE_WRPRM_INT) { 5358 pmtx = sfmmu_page_enter(pp); 5359 PP_CLRRO(pp); 5360 sfmmu_page_exit(pmtx); 5361 } 5362 } 5363 5364 if (ret > 0 && use_demap_range) { 5365 DEMAP_RANGE_MARKPG(dmrp, addr); 5366 } else if (ret > 0) { 5367 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 5368 } 5369 5370 if (pml) { 5371 sfmmu_mlist_exit(pml); 5372 } 5373 } 5374 next_addr: 5375 addr += TTEBYTES(ttesz); 5376 sfhmep++; 5377 DEMAP_RANGE_NEXTPG(dmrp); 5378 } 5379 return (addr); 5380 } 5381 5382 /* 5383 * This routine is deprecated and should only be used by hat_chgprot. 5384 * The correct routine is sfmmu_vtop_attr. 5385 * This routine converts virtual page protections to physical ones. It will 5386 * update the tteflags field with the tte mask corresponding to the protections 5387 * affected and it returns the new protections. It will also clear the modify 5388 * bit if we are taking away write permission. This is necessary since the 5389 * modify bit is the hardware permission bit and we need to clear it in order 5390 * to detect write faults. 5391 * It accepts the following special protections: 5392 * ~PROT_WRITE = remove write permissions. 5393 * ~PROT_USER = remove user permissions. 5394 */ 5395 static uint_t 5396 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp) 5397 { 5398 if (vprot == (uint_t)~PROT_WRITE) { 5399 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT; 5400 return (0); /* will cause wrprm to be cleared */ 5401 } 5402 if (vprot == (uint_t)~PROT_USER) { 5403 *tteflagsp = TTE_PRIV_INT; 5404 return (0); /* will cause privprm to be cleared */ 5405 } 5406 if ((vprot == 0) || (vprot == PROT_USER) || 5407 ((vprot & PROT_ALL) != vprot)) { 5408 panic("sfmmu_vtop_prot -- bad prot %x", vprot); 5409 } 5410 5411 switch (vprot) { 5412 case (PROT_READ): 5413 case (PROT_EXEC): 5414 case (PROT_EXEC | PROT_READ): 5415 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT; 5416 return (TTE_PRIV_INT); /* set prv and clr wrt */ 5417 case (PROT_WRITE): 5418 case (PROT_WRITE | PROT_READ): 5419 case (PROT_EXEC | PROT_WRITE): 5420 case (PROT_EXEC | PROT_WRITE | PROT_READ): 5421 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT; 5422 return (TTE_PRIV_INT | TTE_WRPRM_INT); /* set prv and wrt */ 5423 case (PROT_USER | PROT_READ): 5424 case (PROT_USER | PROT_EXEC): 5425 case (PROT_USER | PROT_EXEC | PROT_READ): 5426 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT; 5427 return (0); /* clr prv and wrt */ 5428 case (PROT_USER | PROT_WRITE): 5429 case (PROT_USER | PROT_WRITE | PROT_READ): 5430 case (PROT_USER | PROT_EXEC | PROT_WRITE): 5431 case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ): 5432 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT; 5433 return (TTE_WRPRM_INT); /* clr prv and set wrt */ 5434 default: 5435 panic("sfmmu_vtop_prot -- bad prot %x", vprot); 5436 } 5437 return (0); 5438 } 5439 5440 /* 5441 * Alternate unload for very large virtual ranges. With a true 64 bit VA, 5442 * the normal algorithm would take too long for a very large VA range with 5443 * few real mappings. This routine just walks thru all HMEs in the global 5444 * hash table to find and remove mappings. 5445 */ 5446 static void 5447 hat_unload_large_virtual( 5448 struct hat *sfmmup, 5449 caddr_t startaddr, 5450 size_t len, 5451 uint_t flags, 5452 hat_callback_t *callback) 5453 { 5454 struct hmehash_bucket *hmebp; 5455 struct hme_blk *hmeblkp; 5456 struct hme_blk *pr_hblk = NULL; 5457 struct hme_blk *nx_hblk; 5458 struct hme_blk *list = NULL; 5459 int i; 5460 demap_range_t dmr, *dmrp; 5461 cpuset_t cpuset; 5462 caddr_t endaddr = startaddr + len; 5463 caddr_t sa; 5464 caddr_t ea; 5465 caddr_t cb_sa[MAX_CB_ADDR]; 5466 caddr_t cb_ea[MAX_CB_ADDR]; 5467 int addr_cnt = 0; 5468 int a = 0; 5469 5470 if (sfmmup->sfmmu_free) { 5471 dmrp = NULL; 5472 } else { 5473 dmrp = &dmr; 5474 DEMAP_RANGE_INIT(sfmmup, dmrp); 5475 } 5476 5477 /* 5478 * Loop through all the hash buckets of HME blocks looking for matches. 5479 */ 5480 for (i = 0; i <= UHMEHASH_SZ; i++) { 5481 hmebp = &uhme_hash[i]; 5482 SFMMU_HASH_LOCK(hmebp); 5483 hmeblkp = hmebp->hmeblkp; 5484 pr_hblk = NULL; 5485 while (hmeblkp) { 5486 nx_hblk = hmeblkp->hblk_next; 5487 5488 /* 5489 * skip if not this context, if a shadow block or 5490 * if the mapping is not in the requested range 5491 */ 5492 if (hmeblkp->hblk_tag.htag_id != sfmmup || 5493 hmeblkp->hblk_shw_bit || 5494 (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr || 5495 (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) { 5496 pr_hblk = hmeblkp; 5497 goto next_block; 5498 } 5499 5500 ASSERT(!hmeblkp->hblk_shared); 5501 /* 5502 * unload if there are any current valid mappings 5503 */ 5504 if (hmeblkp->hblk_vcnt != 0 || 5505 hmeblkp->hblk_hmecnt != 0) 5506 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 5507 sa, ea, dmrp, flags); 5508 5509 /* 5510 * on unmap we also release the HME block itself, once 5511 * all mappings are gone. 5512 */ 5513 if ((flags & HAT_UNLOAD_UNMAP) != 0 && 5514 !hmeblkp->hblk_vcnt && 5515 !hmeblkp->hblk_hmecnt) { 5516 ASSERT(!hmeblkp->hblk_lckcnt); 5517 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 5518 &list, 0); 5519 } else { 5520 pr_hblk = hmeblkp; 5521 } 5522 5523 if (callback == NULL) 5524 goto next_block; 5525 5526 /* 5527 * HME blocks may span more than one page, but we may be 5528 * unmapping only one page, so check for a smaller range 5529 * for the callback 5530 */ 5531 if (sa < startaddr) 5532 sa = startaddr; 5533 if (--ea > endaddr) 5534 ea = endaddr - 1; 5535 5536 cb_sa[addr_cnt] = sa; 5537 cb_ea[addr_cnt] = ea; 5538 if (++addr_cnt == MAX_CB_ADDR) { 5539 if (dmrp != NULL) { 5540 DEMAP_RANGE_FLUSH(dmrp); 5541 cpuset = sfmmup->sfmmu_cpusran; 5542 xt_sync(cpuset); 5543 } 5544 5545 for (a = 0; a < MAX_CB_ADDR; ++a) { 5546 callback->hcb_start_addr = cb_sa[a]; 5547 callback->hcb_end_addr = cb_ea[a]; 5548 callback->hcb_function(callback); 5549 } 5550 addr_cnt = 0; 5551 } 5552 5553 next_block: 5554 hmeblkp = nx_hblk; 5555 } 5556 SFMMU_HASH_UNLOCK(hmebp); 5557 } 5558 5559 sfmmu_hblks_list_purge(&list, 0); 5560 if (dmrp != NULL) { 5561 DEMAP_RANGE_FLUSH(dmrp); 5562 cpuset = sfmmup->sfmmu_cpusran; 5563 xt_sync(cpuset); 5564 } 5565 5566 for (a = 0; a < addr_cnt; ++a) { 5567 callback->hcb_start_addr = cb_sa[a]; 5568 callback->hcb_end_addr = cb_ea[a]; 5569 callback->hcb_function(callback); 5570 } 5571 5572 /* 5573 * Check TSB and TLB page sizes if the process isn't exiting. 5574 */ 5575 if (!sfmmup->sfmmu_free) 5576 sfmmu_check_page_sizes(sfmmup, 0); 5577 } 5578 5579 /* 5580 * Unload all the mappings in the range [addr..addr+len). addr and len must 5581 * be MMU_PAGESIZE aligned. 5582 */ 5583 5584 extern struct seg *segkmap; 5585 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \ 5586 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size)) 5587 5588 5589 void 5590 hat_unload_callback( 5591 struct hat *sfmmup, 5592 caddr_t addr, 5593 size_t len, 5594 uint_t flags, 5595 hat_callback_t *callback) 5596 { 5597 struct hmehash_bucket *hmebp; 5598 hmeblk_tag hblktag; 5599 int hmeshift, hashno, iskernel; 5600 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL; 5601 caddr_t endaddr; 5602 cpuset_t cpuset; 5603 int addr_count = 0; 5604 int a; 5605 caddr_t cb_start_addr[MAX_CB_ADDR]; 5606 caddr_t cb_end_addr[MAX_CB_ADDR]; 5607 int issegkmap = ISSEGKMAP(sfmmup, addr); 5608 demap_range_t dmr, *dmrp; 5609 5610 ASSERT(sfmmup->sfmmu_as != NULL); 5611 5612 ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \ 5613 AS_LOCK_HELD(sfmmup->sfmmu_as)); 5614 5615 ASSERT(sfmmup != NULL); 5616 ASSERT((len & MMU_PAGEOFFSET) == 0); 5617 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET)); 5618 5619 /* 5620 * Probing through a large VA range (say 63 bits) will be slow, even 5621 * at 4 Meg steps between the probes. So, when the virtual address range 5622 * is very large, search the HME entries for what to unload. 5623 * 5624 * len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need 5625 * 5626 * UHMEHASH_SZ is number of hash buckets to examine 5627 * 5628 */ 5629 if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) { 5630 hat_unload_large_virtual(sfmmup, addr, len, flags, callback); 5631 return; 5632 } 5633 5634 CPUSET_ZERO(cpuset); 5635 5636 /* 5637 * If the process is exiting, we can save a lot of fuss since 5638 * we'll flush the TLB when we free the ctx anyway. 5639 */ 5640 if (sfmmup->sfmmu_free) { 5641 dmrp = NULL; 5642 } else { 5643 dmrp = &dmr; 5644 DEMAP_RANGE_INIT(sfmmup, dmrp); 5645 } 5646 5647 endaddr = addr + len; 5648 hblktag.htag_id = sfmmup; 5649 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 5650 5651 /* 5652 * It is likely for the vm to call unload over a wide range of 5653 * addresses that are actually very sparsely populated by 5654 * translations. In order to speed this up the sfmmu hat supports 5655 * the concept of shadow hmeblks. Dummy large page hmeblks that 5656 * correspond to actual small translations are allocated at tteload 5657 * time and are referred to as shadow hmeblks. Now, during unload 5658 * time, we first check if we have a shadow hmeblk for that 5659 * translation. The absence of one means the corresponding address 5660 * range is empty and can be skipped. 5661 * 5662 * The kernel is an exception to above statement and that is why 5663 * we don't use shadow hmeblks and hash starting from the smallest 5664 * page size. 5665 */ 5666 if (sfmmup == KHATID) { 5667 iskernel = 1; 5668 hashno = TTE64K; 5669 } else { 5670 iskernel = 0; 5671 if (mmu_page_sizes == max_mmu_page_sizes) { 5672 hashno = TTE256M; 5673 } else { 5674 hashno = TTE4M; 5675 } 5676 } 5677 while (addr < endaddr) { 5678 hmeshift = HME_HASH_SHIFT(hashno); 5679 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 5680 hblktag.htag_rehash = hashno; 5681 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 5682 5683 SFMMU_HASH_LOCK(hmebp); 5684 5685 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list); 5686 if (hmeblkp == NULL) { 5687 /* 5688 * didn't find an hmeblk. skip the appropiate 5689 * address range. 5690 */ 5691 SFMMU_HASH_UNLOCK(hmebp); 5692 if (iskernel) { 5693 if (hashno < mmu_hashcnt) { 5694 hashno++; 5695 continue; 5696 } else { 5697 hashno = TTE64K; 5698 addr = (caddr_t)roundup((uintptr_t)addr 5699 + 1, MMU_PAGESIZE64K); 5700 continue; 5701 } 5702 } 5703 addr = (caddr_t)roundup((uintptr_t)addr + 1, 5704 (1 << hmeshift)); 5705 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5706 ASSERT(hashno == TTE64K); 5707 continue; 5708 } 5709 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5710 hashno = TTE512K; 5711 continue; 5712 } 5713 if (mmu_page_sizes == max_mmu_page_sizes) { 5714 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5715 hashno = TTE4M; 5716 continue; 5717 } 5718 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5719 hashno = TTE32M; 5720 continue; 5721 } 5722 hashno = TTE256M; 5723 continue; 5724 } else { 5725 hashno = TTE4M; 5726 continue; 5727 } 5728 } 5729 ASSERT(hmeblkp); 5730 ASSERT(!hmeblkp->hblk_shared); 5731 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 5732 /* 5733 * If the valid count is zero we can skip the range 5734 * mapped by this hmeblk. 5735 * We free hblks in the case of HAT_UNMAP. HAT_UNMAP 5736 * is used by segment drivers as a hint 5737 * that the mapping resource won't be used any longer. 5738 * The best example of this is during exit(). 5739 */ 5740 addr = (caddr_t)roundup((uintptr_t)addr + 1, 5741 get_hblk_span(hmeblkp)); 5742 if ((flags & HAT_UNLOAD_UNMAP) || 5743 (iskernel && !issegkmap)) { 5744 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, 5745 &list, 0); 5746 } 5747 SFMMU_HASH_UNLOCK(hmebp); 5748 5749 if (iskernel) { 5750 hashno = TTE64K; 5751 continue; 5752 } 5753 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5754 ASSERT(hashno == TTE64K); 5755 continue; 5756 } 5757 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5758 hashno = TTE512K; 5759 continue; 5760 } 5761 if (mmu_page_sizes == max_mmu_page_sizes) { 5762 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5763 hashno = TTE4M; 5764 continue; 5765 } 5766 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5767 hashno = TTE32M; 5768 continue; 5769 } 5770 hashno = TTE256M; 5771 continue; 5772 } else { 5773 hashno = TTE4M; 5774 continue; 5775 } 5776 } 5777 if (hmeblkp->hblk_shw_bit) { 5778 /* 5779 * If we encounter a shadow hmeblk we know there is 5780 * smaller sized hmeblks mapping the same address space. 5781 * Decrement the hash size and rehash. 5782 */ 5783 ASSERT(sfmmup != KHATID); 5784 hashno--; 5785 SFMMU_HASH_UNLOCK(hmebp); 5786 continue; 5787 } 5788 5789 /* 5790 * track callback address ranges. 5791 * only start a new range when it's not contiguous 5792 */ 5793 if (callback != NULL) { 5794 if (addr_count > 0 && 5795 addr == cb_end_addr[addr_count - 1]) 5796 --addr_count; 5797 else 5798 cb_start_addr[addr_count] = addr; 5799 } 5800 5801 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr, 5802 dmrp, flags); 5803 5804 if (callback != NULL) 5805 cb_end_addr[addr_count++] = addr; 5806 5807 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) && 5808 !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) { 5809 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0); 5810 } 5811 SFMMU_HASH_UNLOCK(hmebp); 5812 5813 /* 5814 * Notify our caller as to exactly which pages 5815 * have been unloaded. We do these in clumps, 5816 * to minimize the number of xt_sync()s that need to occur. 5817 */ 5818 if (callback != NULL && addr_count == MAX_CB_ADDR) { 5819 if (dmrp != NULL) { 5820 DEMAP_RANGE_FLUSH(dmrp); 5821 cpuset = sfmmup->sfmmu_cpusran; 5822 xt_sync(cpuset); 5823 } 5824 5825 for (a = 0; a < MAX_CB_ADDR; ++a) { 5826 callback->hcb_start_addr = cb_start_addr[a]; 5827 callback->hcb_end_addr = cb_end_addr[a]; 5828 callback->hcb_function(callback); 5829 } 5830 addr_count = 0; 5831 } 5832 if (iskernel) { 5833 hashno = TTE64K; 5834 continue; 5835 } 5836 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) { 5837 ASSERT(hashno == TTE64K); 5838 continue; 5839 } 5840 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) { 5841 hashno = TTE512K; 5842 continue; 5843 } 5844 if (mmu_page_sizes == max_mmu_page_sizes) { 5845 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) { 5846 hashno = TTE4M; 5847 continue; 5848 } 5849 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) { 5850 hashno = TTE32M; 5851 continue; 5852 } 5853 hashno = TTE256M; 5854 } else { 5855 hashno = TTE4M; 5856 } 5857 } 5858 5859 sfmmu_hblks_list_purge(&list, 0); 5860 if (dmrp != NULL) { 5861 DEMAP_RANGE_FLUSH(dmrp); 5862 cpuset = sfmmup->sfmmu_cpusran; 5863 xt_sync(cpuset); 5864 } 5865 if (callback && addr_count != 0) { 5866 for (a = 0; a < addr_count; ++a) { 5867 callback->hcb_start_addr = cb_start_addr[a]; 5868 callback->hcb_end_addr = cb_end_addr[a]; 5869 callback->hcb_function(callback); 5870 } 5871 } 5872 5873 /* 5874 * Check TSB and TLB page sizes if the process isn't exiting. 5875 */ 5876 if (!sfmmup->sfmmu_free) 5877 sfmmu_check_page_sizes(sfmmup, 0); 5878 } 5879 5880 /* 5881 * Unload all the mappings in the range [addr..addr+len). addr and len must 5882 * be MMU_PAGESIZE aligned. 5883 */ 5884 void 5885 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags) 5886 { 5887 hat_unload_callback(sfmmup, addr, len, flags, NULL); 5888 } 5889 5890 5891 /* 5892 * Find the largest mapping size for this page. 5893 */ 5894 int 5895 fnd_mapping_sz(page_t *pp) 5896 { 5897 int sz; 5898 int p_index; 5899 5900 p_index = PP_MAPINDEX(pp); 5901 5902 sz = 0; 5903 p_index >>= 1; /* don't care about 8K bit */ 5904 for (; p_index; p_index >>= 1) { 5905 sz++; 5906 } 5907 5908 return (sz); 5909 } 5910 5911 /* 5912 * This function unloads a range of addresses for an hmeblk. 5913 * It returns the next address to be unloaded. 5914 * It should be called with the hash lock held. 5915 */ 5916 static caddr_t 5917 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 5918 caddr_t endaddr, demap_range_t *dmrp, uint_t flags) 5919 { 5920 tte_t tte, ttemod; 5921 struct sf_hment *sfhmep; 5922 int ttesz; 5923 long ttecnt; 5924 page_t *pp; 5925 kmutex_t *pml; 5926 int ret; 5927 int use_demap_range; 5928 5929 ASSERT(in_hblk_range(hmeblkp, addr)); 5930 ASSERT(!hmeblkp->hblk_shw_bit); 5931 ASSERT(sfmmup != NULL || hmeblkp->hblk_shared); 5932 ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared); 5933 ASSERT(dmrp == NULL || !hmeblkp->hblk_shared); 5934 5935 #ifdef DEBUG 5936 if (get_hblk_ttesz(hmeblkp) != TTE8K && 5937 (endaddr < get_hblk_endaddr(hmeblkp))) { 5938 panic("sfmmu_hblk_unload: partial unload of large page"); 5939 } 5940 #endif /* DEBUG */ 5941 5942 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 5943 ttesz = get_hblk_ttesz(hmeblkp); 5944 5945 use_demap_range = ((dmrp == NULL) || 5946 (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp))); 5947 5948 if (use_demap_range) { 5949 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr); 5950 } else if (dmrp != NULL) { 5951 DEMAP_RANGE_FLUSH(dmrp); 5952 } 5953 ttecnt = 0; 5954 HBLKTOHME(sfhmep, hmeblkp, addr); 5955 5956 while (addr < endaddr) { 5957 pml = NULL; 5958 sfmmu_copytte(&sfhmep->hme_tte, &tte); 5959 if (TTE_IS_VALID(&tte)) { 5960 pp = sfhmep->hme_page; 5961 if (pp != NULL) { 5962 pml = sfmmu_mlist_enter(pp); 5963 } 5964 5965 /* 5966 * Verify if hme still points to 'pp' now that 5967 * we have p_mapping lock. 5968 */ 5969 if (sfhmep->hme_page != pp) { 5970 if (pp != NULL && sfhmep->hme_page != NULL) { 5971 ASSERT(pml != NULL); 5972 sfmmu_mlist_exit(pml); 5973 /* Re-start this iteration. */ 5974 continue; 5975 } 5976 ASSERT((pp != NULL) && 5977 (sfhmep->hme_page == NULL)); 5978 goto tte_unloaded; 5979 } 5980 5981 /* 5982 * This point on we have both HASH and p_mapping 5983 * lock. 5984 */ 5985 ASSERT(pp == sfhmep->hme_page); 5986 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 5987 5988 /* 5989 * We need to loop on modify tte because it is 5990 * possible for pagesync to come along and 5991 * change the software bits beneath us. 5992 * 5993 * Page_unload can also invalidate the tte after 5994 * we read tte outside of p_mapping lock. 5995 */ 5996 again: 5997 ttemod = tte; 5998 5999 TTE_SET_INVALID(&ttemod); 6000 ret = sfmmu_modifytte_try(&tte, &ttemod, 6001 &sfhmep->hme_tte); 6002 6003 if (ret <= 0) { 6004 if (TTE_IS_VALID(&tte)) { 6005 ASSERT(ret < 0); 6006 goto again; 6007 } 6008 if (pp != NULL) { 6009 panic("sfmmu_hblk_unload: pp = 0x%p " 6010 "tte became invalid under mlist" 6011 " lock = 0x%p", (void *)pp, 6012 (void *)pml); 6013 } 6014 continue; 6015 } 6016 6017 if (!(flags & HAT_UNLOAD_NOSYNC)) { 6018 sfmmu_ttesync(sfmmup, addr, &tte, pp); 6019 } 6020 6021 /* 6022 * Ok- we invalidated the tte. Do the rest of the job. 6023 */ 6024 ttecnt++; 6025 6026 if (flags & HAT_UNLOAD_UNLOCK) { 6027 ASSERT(hmeblkp->hblk_lckcnt > 0); 6028 atomic_dec_32(&hmeblkp->hblk_lckcnt); 6029 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK); 6030 } 6031 6032 /* 6033 * Normally we would need to flush the page 6034 * from the virtual cache at this point in 6035 * order to prevent a potential cache alias 6036 * inconsistency. 6037 * The particular scenario we need to worry 6038 * about is: 6039 * Given: va1 and va2 are two virtual address 6040 * that alias and map the same physical 6041 * address. 6042 * 1. mapping exists from va1 to pa and data 6043 * has been read into the cache. 6044 * 2. unload va1. 6045 * 3. load va2 and modify data using va2. 6046 * 4 unload va2. 6047 * 5. load va1 and reference data. Unless we 6048 * flush the data cache when we unload we will 6049 * get stale data. 6050 * Fortunately, page coloring eliminates the 6051 * above scenario by remembering the color a 6052 * physical page was last or is currently 6053 * mapped to. Now, we delay the flush until 6054 * the loading of translations. Only when the 6055 * new translation is of a different color 6056 * are we forced to flush. 6057 */ 6058 if (use_demap_range) { 6059 /* 6060 * Mark this page as needing a demap. 6061 */ 6062 DEMAP_RANGE_MARKPG(dmrp, addr); 6063 } else { 6064 ASSERT(sfmmup != NULL); 6065 ASSERT(!hmeblkp->hblk_shared); 6066 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 6067 sfmmup->sfmmu_free, 0); 6068 } 6069 6070 if (pp) { 6071 /* 6072 * Remove the hment from the mapping list 6073 */ 6074 ASSERT(hmeblkp->hblk_hmecnt > 0); 6075 6076 /* 6077 * Again, we cannot 6078 * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS); 6079 */ 6080 HME_SUB(sfhmep, pp); 6081 membar_stst(); 6082 atomic_dec_16(&hmeblkp->hblk_hmecnt); 6083 } 6084 6085 ASSERT(hmeblkp->hblk_vcnt > 0); 6086 atomic_dec_16(&hmeblkp->hblk_vcnt); 6087 6088 ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt || 6089 !hmeblkp->hblk_lckcnt); 6090 6091 #ifdef VAC 6092 if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) { 6093 if (PP_ISTNC(pp)) { 6094 /* 6095 * If page was temporary 6096 * uncached, try to recache 6097 * it. Note that HME_SUB() was 6098 * called above so p_index and 6099 * mlist had been updated. 6100 */ 6101 conv_tnc(pp, ttesz); 6102 } else if (pp->p_mapping == NULL) { 6103 ASSERT(kpm_enable); 6104 /* 6105 * Page is marked to be in VAC conflict 6106 * to an existing kpm mapping and/or is 6107 * kpm mapped using only the regular 6108 * pagesize. 6109 */ 6110 sfmmu_kpm_hme_unload(pp); 6111 } 6112 } 6113 #endif /* VAC */ 6114 } else if ((pp = sfhmep->hme_page) != NULL) { 6115 /* 6116 * TTE is invalid but the hme 6117 * still exists. let pageunload 6118 * complete its job. 6119 */ 6120 ASSERT(pml == NULL); 6121 pml = sfmmu_mlist_enter(pp); 6122 if (sfhmep->hme_page != NULL) { 6123 sfmmu_mlist_exit(pml); 6124 continue; 6125 } 6126 ASSERT(sfhmep->hme_page == NULL); 6127 } else if (hmeblkp->hblk_hmecnt != 0) { 6128 /* 6129 * pageunload may have not finished decrementing 6130 * hblk_vcnt and hblk_hmecnt. Find page_t if any and 6131 * wait for pageunload to finish. Rely on pageunload 6132 * to decrement hblk_hmecnt after hblk_vcnt. 6133 */ 6134 pfn_t pfn = TTE_TO_TTEPFN(&tte); 6135 ASSERT(pml == NULL); 6136 if (pf_is_memory(pfn)) { 6137 pp = page_numtopp_nolock(pfn); 6138 if (pp != NULL) { 6139 pml = sfmmu_mlist_enter(pp); 6140 sfmmu_mlist_exit(pml); 6141 pml = NULL; 6142 } 6143 } 6144 } 6145 6146 tte_unloaded: 6147 /* 6148 * At this point, the tte we are looking at 6149 * should be unloaded, and hme has been unlinked 6150 * from page too. This is important because in 6151 * pageunload, it does ttesync() then HME_SUB. 6152 * We need to make sure HME_SUB has been completed 6153 * so we know ttesync() has been completed. Otherwise, 6154 * at exit time, after return from hat layer, VM will 6155 * release as structure which hat_setstat() (called 6156 * by ttesync()) needs. 6157 */ 6158 #ifdef DEBUG 6159 { 6160 tte_t dtte; 6161 6162 ASSERT(sfhmep->hme_page == NULL); 6163 6164 sfmmu_copytte(&sfhmep->hme_tte, &dtte); 6165 ASSERT(!TTE_IS_VALID(&dtte)); 6166 } 6167 #endif 6168 6169 if (pml) { 6170 sfmmu_mlist_exit(pml); 6171 } 6172 6173 addr += TTEBYTES(ttesz); 6174 sfhmep++; 6175 DEMAP_RANGE_NEXTPG(dmrp); 6176 } 6177 /* 6178 * For shared hmeblks this routine is only called when region is freed 6179 * and no longer referenced. So no need to decrement ttecnt 6180 * in the region structure here. 6181 */ 6182 if (ttecnt > 0 && sfmmup != NULL) { 6183 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt); 6184 } 6185 return (addr); 6186 } 6187 6188 /* 6189 * Invalidate a virtual address range for the local CPU. 6190 * For best performance ensure that the va range is completely 6191 * mapped, otherwise the entire TLB will be flushed. 6192 */ 6193 void 6194 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size) 6195 { 6196 ssize_t sz; 6197 caddr_t endva = va + size; 6198 6199 while (va < endva) { 6200 sz = hat_getpagesize(sfmmup, va); 6201 if (sz < 0) { 6202 vtag_flushall(); 6203 break; 6204 } 6205 vtag_flushpage(va, (uint64_t)sfmmup); 6206 va += sz; 6207 } 6208 } 6209 6210 /* 6211 * Synchronize all the mappings in the range [addr..addr+len). 6212 * Can be called with clearflag having two states: 6213 * HAT_SYNC_DONTZERO means just return the rm stats 6214 * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats 6215 */ 6216 void 6217 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag) 6218 { 6219 struct hmehash_bucket *hmebp; 6220 hmeblk_tag hblktag; 6221 int hmeshift, hashno = 1; 6222 struct hme_blk *hmeblkp, *list = NULL; 6223 caddr_t endaddr; 6224 cpuset_t cpuset; 6225 6226 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as)); 6227 ASSERT((len & MMU_PAGEOFFSET) == 0); 6228 ASSERT((clearflag == HAT_SYNC_DONTZERO) || 6229 (clearflag == HAT_SYNC_ZERORM)); 6230 6231 CPUSET_ZERO(cpuset); 6232 6233 endaddr = addr + len; 6234 hblktag.htag_id = sfmmup; 6235 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 6236 6237 /* 6238 * Spitfire supports 4 page sizes. 6239 * Most pages are expected to be of the smallest page 6240 * size (8K) and these will not need to be rehashed. 64K 6241 * pages also don't need to be rehashed because the an hmeblk 6242 * spans 64K of address space. 512K pages might need 1 rehash and 6243 * and 4M pages 2 rehashes. 6244 */ 6245 while (addr < endaddr) { 6246 hmeshift = HME_HASH_SHIFT(hashno); 6247 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift); 6248 hblktag.htag_rehash = hashno; 6249 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift); 6250 6251 SFMMU_HASH_LOCK(hmebp); 6252 6253 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list); 6254 if (hmeblkp != NULL) { 6255 ASSERT(!hmeblkp->hblk_shared); 6256 /* 6257 * We've encountered a shadow hmeblk so skip the range 6258 * of the next smaller mapping size. 6259 */ 6260 if (hmeblkp->hblk_shw_bit) { 6261 ASSERT(sfmmup != ksfmmup); 6262 ASSERT(hashno > 1); 6263 addr = (caddr_t)P2END((uintptr_t)addr, 6264 TTEBYTES(hashno - 1)); 6265 } else { 6266 addr = sfmmu_hblk_sync(sfmmup, hmeblkp, 6267 addr, endaddr, clearflag); 6268 } 6269 SFMMU_HASH_UNLOCK(hmebp); 6270 hashno = 1; 6271 continue; 6272 } 6273 SFMMU_HASH_UNLOCK(hmebp); 6274 6275 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) { 6276 /* 6277 * We have traversed the whole list and rehashed 6278 * if necessary without finding the address to sync. 6279 * This is ok so we increment the address by the 6280 * smallest hmeblk range for kernel mappings and the 6281 * largest hmeblk range, to account for shadow hmeblks, 6282 * for user mappings and continue. 6283 */ 6284 if (sfmmup == ksfmmup) 6285 addr = (caddr_t)P2END((uintptr_t)addr, 6286 TTEBYTES(1)); 6287 else 6288 addr = (caddr_t)P2END((uintptr_t)addr, 6289 TTEBYTES(hashno)); 6290 hashno = 1; 6291 } else { 6292 hashno++; 6293 } 6294 } 6295 sfmmu_hblks_list_purge(&list, 0); 6296 cpuset = sfmmup->sfmmu_cpusran; 6297 xt_sync(cpuset); 6298 } 6299 6300 static caddr_t 6301 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr, 6302 caddr_t endaddr, int clearflag) 6303 { 6304 tte_t tte, ttemod; 6305 struct sf_hment *sfhmep; 6306 int ttesz; 6307 struct page *pp; 6308 kmutex_t *pml; 6309 int ret; 6310 6311 ASSERT(hmeblkp->hblk_shw_bit == 0); 6312 ASSERT(!hmeblkp->hblk_shared); 6313 6314 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp)); 6315 6316 ttesz = get_hblk_ttesz(hmeblkp); 6317 HBLKTOHME(sfhmep, hmeblkp, addr); 6318 6319 while (addr < endaddr) { 6320 sfmmu_copytte(&sfhmep->hme_tte, &tte); 6321 if (TTE_IS_VALID(&tte)) { 6322 pml = NULL; 6323 pp = sfhmep->hme_page; 6324 if (pp) { 6325 pml = sfmmu_mlist_enter(pp); 6326 } 6327 if (pp != sfhmep->hme_page) { 6328 /* 6329 * tte most have been unloaded 6330 * underneath us. Recheck 6331 */ 6332 ASSERT(pml); 6333 sfmmu_mlist_exit(pml); 6334 continue; 6335 } 6336 6337 ASSERT(pp == NULL || sfmmu_mlist_held(pp)); 6338 6339 if (clearflag == HAT_SYNC_ZERORM) { 6340 ttemod = tte; 6341 TTE_CLR_RM(&ttemod); 6342 ret = sfmmu_modifytte_try(&tte, &ttemod, 6343 &sfhmep->hme_tte); 6344 if (ret < 0) { 6345 if (pml) { 6346 sfmmu_mlist_exit(pml); 6347 } 6348 continue; 6349 } 6350 6351 if (ret > 0) { 6352 sfmmu_tlb_demap(addr, sfmmup, 6353 hmeblkp, 0, 0); 6354 } 6355 } 6356 sfmmu_ttesync(sfmmup, addr, &tte, pp); 6357 if (pml) { 6358 sfmmu_mlist_exit(pml); 6359 } 6360 } 6361 addr += TTEBYTES(ttesz); 6362 sfhmep++; 6363 } 6364 return (addr); 6365 } 6366 6367 /* 6368 * This function will sync a tte to the page struct and it will 6369 * update the hat stats. Currently it allows us to pass a NULL pp 6370 * and we will simply update the stats. We may want to change this 6371 * so we only keep stats for pages backed by pp's. 6372 */ 6373 static void 6374 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp) 6375 { 6376 uint_t rm = 0; 6377 int sz; 6378 pgcnt_t npgs; 6379 6380 ASSERT(TTE_IS_VALID(ttep)); 6381 6382 if (TTE_IS_NOSYNC(ttep)) { 6383 return; 6384 } 6385 6386 if (TTE_IS_REF(ttep)) { 6387 rm = P_REF; 6388 } 6389 if (TTE_IS_MOD(ttep)) { 6390 rm |= P_MOD; 6391 } 6392 6393 if (rm == 0) { 6394 return; 6395 } 6396 6397 sz = TTE_CSZ(ttep); 6398 if (sfmmup != NULL && sfmmup->sfmmu_rmstat) { 6399 int i; 6400 caddr_t vaddr = addr; 6401 6402 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) { 6403 hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm); 6404 } 6405 6406 } 6407 6408 /* 6409 * XXX I want to use cas to update nrm bits but they 6410 * currently belong in common/vm and not in hat where 6411 * they should be. 6412 * The nrm bits are protected by the same mutex as 6413 * the one that protects the page's mapping list. 6414 */ 6415 if (!pp) 6416 return; 6417 ASSERT(sfmmu_mlist_held(pp)); 6418 /* 6419 * If the tte is for a large page, we need to sync all the 6420 * pages covered by the tte. 6421 */ 6422 if (sz != TTE8K) { 6423 ASSERT(pp->p_szc != 0); 6424 pp = PP_GROUPLEADER(pp, sz); 6425 ASSERT(sfmmu_mlist_held(pp)); 6426 } 6427 6428 /* Get number of pages from tte size. */ 6429 npgs = TTEPAGES(sz); 6430 6431 do { 6432 ASSERT(pp); 6433 ASSERT(sfmmu_mlist_held(pp)); 6434 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) || 6435 ((rm & P_MOD) != 0 && !PP_ISMOD(pp))) 6436 hat_page_setattr(pp, rm); 6437 6438 /* 6439 * Are we done? If not, we must have a large mapping. 6440 * For large mappings we need to sync the rest of the pages 6441 * covered by this tte; goto the next page. 6442 */ 6443 } while (--npgs > 0 && (pp = PP_PAGENEXT(pp))); 6444 } 6445 6446 /* 6447 * Execute pre-callback handler of each pa_hment linked to pp 6448 * 6449 * Inputs: 6450 * flag: either HAT_PRESUSPEND or HAT_SUSPEND. 6451 * capture_cpus: pointer to return value (below) 6452 * 6453 * Returns: 6454 * Propagates the subsystem callback return values back to the caller; 6455 * returns 0 on success. If capture_cpus is non-NULL, the value returned 6456 * is zero if all of the pa_hments are of a type that do not require 6457 * capturing CPUs prior to suspending the mapping, else it is 1. 6458 */ 6459 static int 6460 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus) 6461 { 6462 struct sf_hment *sfhmep; 6463 struct pa_hment *pahmep; 6464 int (*f)(caddr_t, uint_t, uint_t, void *); 6465 int ret; 6466 id_t id; 6467 int locked = 0; 6468 kmutex_t *pml; 6469 6470 ASSERT(PAGE_EXCL(pp)); 6471 if (!sfmmu_mlist_held(pp)) { 6472 pml = sfmmu_mlist_enter(pp); 6473 locked = 1; 6474 } 6475 6476 if (capture_cpus) 6477 *capture_cpus = 0; 6478 6479 top: 6480 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6481 /* 6482 * skip sf_hments corresponding to VA<->PA mappings; 6483 * for pa_hment's, hme_tte.ll is zero 6484 */ 6485 if (!IS_PAHME(sfhmep)) 6486 continue; 6487 6488 pahmep = sfhmep->hme_data; 6489 ASSERT(pahmep != NULL); 6490 6491 /* 6492 * skip if pre-handler has been called earlier in this loop 6493 */ 6494 if (pahmep->flags & flag) 6495 continue; 6496 6497 id = pahmep->cb_id; 6498 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid); 6499 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0) 6500 *capture_cpus = 1; 6501 if ((f = sfmmu_cb_table[id].prehandler) == NULL) { 6502 pahmep->flags |= flag; 6503 continue; 6504 } 6505 6506 /* 6507 * Drop the mapping list lock to avoid locking order issues. 6508 */ 6509 if (locked) 6510 sfmmu_mlist_exit(pml); 6511 6512 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt); 6513 if (ret != 0) 6514 return (ret); /* caller must do the cleanup */ 6515 6516 if (locked) { 6517 pml = sfmmu_mlist_enter(pp); 6518 pahmep->flags |= flag; 6519 goto top; 6520 } 6521 6522 pahmep->flags |= flag; 6523 } 6524 6525 if (locked) 6526 sfmmu_mlist_exit(pml); 6527 6528 return (0); 6529 } 6530 6531 /* 6532 * Execute post-callback handler of each pa_hment linked to pp 6533 * 6534 * Same overall assumptions and restrictions apply as for 6535 * hat_pageprocess_precallbacks(). 6536 */ 6537 static void 6538 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag) 6539 { 6540 pfn_t pgpfn = pp->p_pagenum; 6541 pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1; 6542 pfn_t newpfn; 6543 struct sf_hment *sfhmep; 6544 struct pa_hment *pahmep; 6545 int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t); 6546 id_t id; 6547 int locked = 0; 6548 kmutex_t *pml; 6549 6550 ASSERT(PAGE_EXCL(pp)); 6551 if (!sfmmu_mlist_held(pp)) { 6552 pml = sfmmu_mlist_enter(pp); 6553 locked = 1; 6554 } 6555 6556 top: 6557 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6558 /* 6559 * skip sf_hments corresponding to VA<->PA mappings; 6560 * for pa_hment's, hme_tte.ll is zero 6561 */ 6562 if (!IS_PAHME(sfhmep)) 6563 continue; 6564 6565 pahmep = sfhmep->hme_data; 6566 ASSERT(pahmep != NULL); 6567 6568 if ((pahmep->flags & flag) == 0) 6569 continue; 6570 6571 pahmep->flags &= ~flag; 6572 6573 id = pahmep->cb_id; 6574 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid); 6575 if ((f = sfmmu_cb_table[id].posthandler) == NULL) 6576 continue; 6577 6578 /* 6579 * Convert the base page PFN into the constituent PFN 6580 * which is needed by the callback handler. 6581 */ 6582 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask); 6583 6584 /* 6585 * Drop the mapping list lock to avoid locking order issues. 6586 */ 6587 if (locked) 6588 sfmmu_mlist_exit(pml); 6589 6590 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn) 6591 != 0) 6592 panic("sfmmu: posthandler failed"); 6593 6594 if (locked) { 6595 pml = sfmmu_mlist_enter(pp); 6596 goto top; 6597 } 6598 } 6599 6600 if (locked) 6601 sfmmu_mlist_exit(pml); 6602 } 6603 6604 /* 6605 * Suspend locked kernel mapping 6606 */ 6607 void 6608 hat_pagesuspend(struct page *pp) 6609 { 6610 struct sf_hment *sfhmep; 6611 sfmmu_t *sfmmup; 6612 tte_t tte, ttemod; 6613 struct hme_blk *hmeblkp; 6614 caddr_t addr; 6615 int index, cons; 6616 cpuset_t cpuset; 6617 6618 ASSERT(PAGE_EXCL(pp)); 6619 ASSERT(sfmmu_mlist_held(pp)); 6620 6621 mutex_enter(&kpr_suspendlock); 6622 6623 /* 6624 * We're about to suspend a kernel mapping so mark this thread as 6625 * non-traceable by DTrace. This prevents us from running into issues 6626 * with probe context trying to touch a suspended page 6627 * in the relocation codepath itself. 6628 */ 6629 curthread->t_flag |= T_DONTDTRACE; 6630 6631 index = PP_MAPINDEX(pp); 6632 cons = TTE8K; 6633 6634 retry: 6635 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 6636 6637 if (IS_PAHME(sfhmep)) 6638 continue; 6639 6640 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons) 6641 continue; 6642 6643 /* 6644 * Loop until we successfully set the suspend bit in 6645 * the TTE. 6646 */ 6647 again: 6648 sfmmu_copytte(&sfhmep->hme_tte, &tte); 6649 ASSERT(TTE_IS_VALID(&tte)); 6650 6651 ttemod = tte; 6652 TTE_SET_SUSPEND(&ttemod); 6653 if (sfmmu_modifytte_try(&tte, &ttemod, 6654 &sfhmep->hme_tte) < 0) 6655 goto again; 6656 6657 /* 6658 * Invalidate TSB entry 6659 */ 6660 hmeblkp = sfmmu_hmetohblk(sfhmep); 6661 6662 sfmmup = hblktosfmmu(hmeblkp); 6663 ASSERT(sfmmup == ksfmmup); 6664 ASSERT(!hmeblkp->hblk_shared); 6665 6666 addr = tte_to_vaddr(hmeblkp, tte); 6667 6668 /* 6669 * No need to make sure that the TSB for this sfmmu is 6670 * not being relocated since it is ksfmmup and thus it 6671 * will never be relocated. 6672 */ 6673 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 6674 6675 /* 6676 * Update xcall stats 6677 */ 6678 cpuset = cpu_ready_set; 6679 CPUSET_DEL(cpuset, CPU->cpu_id); 6680 6681 /* LINTED: constant in conditional context */ 6682 SFMMU_XCALL_STATS(ksfmmup); 6683 6684 /* 6685 * Flush TLB entry on remote CPU's 6686 */ 6687 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, 6688 (uint64_t)ksfmmup); 6689 xt_sync(cpuset); 6690 6691 /* 6692 * Flush TLB entry on local CPU 6693 */ 6694 vtag_flushpage(addr, (uint64_t)ksfmmup); 6695 } 6696 6697 while (index != 0) { 6698 index = index >> 1; 6699 if (index != 0) 6700 cons++; 6701 if (index & 0x1) { 6702 pp = PP_GROUPLEADER(pp, cons); 6703 goto retry; 6704 } 6705 } 6706 } 6707 6708 #ifdef DEBUG 6709 6710 #define N_PRLE 1024 6711 struct prle { 6712 page_t *targ; 6713 page_t *repl; 6714 int status; 6715 int pausecpus; 6716 hrtime_t whence; 6717 }; 6718 6719 static struct prle page_relocate_log[N_PRLE]; 6720 static int prl_entry; 6721 static kmutex_t prl_mutex; 6722 6723 #define PAGE_RELOCATE_LOG(t, r, s, p) \ 6724 mutex_enter(&prl_mutex); \ 6725 page_relocate_log[prl_entry].targ = *(t); \ 6726 page_relocate_log[prl_entry].repl = *(r); \ 6727 page_relocate_log[prl_entry].status = (s); \ 6728 page_relocate_log[prl_entry].pausecpus = (p); \ 6729 page_relocate_log[prl_entry].whence = gethrtime(); \ 6730 prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1; \ 6731 mutex_exit(&prl_mutex); 6732 6733 #else /* !DEBUG */ 6734 #define PAGE_RELOCATE_LOG(t, r, s, p) 6735 #endif 6736 6737 /* 6738 * Core Kernel Page Relocation Algorithm 6739 * 6740 * Input: 6741 * 6742 * target : constituent pages are SE_EXCL locked. 6743 * replacement: constituent pages are SE_EXCL locked. 6744 * 6745 * Output: 6746 * 6747 * nrelocp: number of pages relocated 6748 */ 6749 int 6750 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp) 6751 { 6752 page_t *targ, *repl; 6753 page_t *tpp, *rpp; 6754 kmutex_t *low, *high; 6755 spgcnt_t npages, i; 6756 page_t *pl = NULL; 6757 int old_pil; 6758 cpuset_t cpuset; 6759 int cap_cpus; 6760 int ret; 6761 #ifdef VAC 6762 int cflags = 0; 6763 #endif 6764 6765 if (!kcage_on || PP_ISNORELOC(*target)) { 6766 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1); 6767 return (EAGAIN); 6768 } 6769 6770 mutex_enter(&kpr_mutex); 6771 kreloc_thread = curthread; 6772 6773 targ = *target; 6774 repl = *replacement; 6775 ASSERT(repl != NULL); 6776 ASSERT(targ->p_szc == repl->p_szc); 6777 6778 npages = page_get_pagecnt(targ->p_szc); 6779 6780 /* 6781 * unload VA<->PA mappings that are not locked 6782 */ 6783 tpp = targ; 6784 for (i = 0; i < npages; i++) { 6785 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC); 6786 tpp++; 6787 } 6788 6789 /* 6790 * Do "presuspend" callbacks, in a context from which we can still 6791 * block as needed. Note that we don't hold the mapping list lock 6792 * of "targ" at this point due to potential locking order issues; 6793 * we assume that between the hat_pageunload() above and holding 6794 * the SE_EXCL lock that the mapping list *cannot* change at this 6795 * point. 6796 */ 6797 ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus); 6798 if (ret != 0) { 6799 /* 6800 * EIO translates to fatal error, for all others cleanup 6801 * and return EAGAIN. 6802 */ 6803 ASSERT(ret != EIO); 6804 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND); 6805 PAGE_RELOCATE_LOG(target, replacement, ret, -1); 6806 kreloc_thread = NULL; 6807 mutex_exit(&kpr_mutex); 6808 return (EAGAIN); 6809 } 6810 6811 /* 6812 * acquire p_mapping list lock for both the target and replacement 6813 * root pages. 6814 * 6815 * low and high refer to the need to grab the mlist locks in a 6816 * specific order in order to prevent race conditions. Thus the 6817 * lower lock must be grabbed before the higher lock. 6818 * 6819 * This will block hat_unload's accessing p_mapping list. Since 6820 * we have SE_EXCL lock, hat_memload and hat_pageunload will be 6821 * blocked. Thus, no one else will be accessing the p_mapping list 6822 * while we suspend and reload the locked mapping below. 6823 */ 6824 tpp = targ; 6825 rpp = repl; 6826 sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high); 6827 6828 kpreempt_disable(); 6829 6830 /* 6831 * We raise our PIL to 13 so that we don't get captured by 6832 * another CPU or pinned by an interrupt thread. We can't go to 6833 * PIL 14 since the nexus driver(s) may need to interrupt at 6834 * that level in the case of IOMMU pseudo mappings. 6835 */ 6836 cpuset = cpu_ready_set; 6837 CPUSET_DEL(cpuset, CPU->cpu_id); 6838 if (!cap_cpus || CPUSET_ISNULL(cpuset)) { 6839 old_pil = splr(XCALL_PIL); 6840 } else { 6841 old_pil = -1; 6842 xc_attention(cpuset); 6843 } 6844 ASSERT(getpil() == XCALL_PIL); 6845 6846 /* 6847 * Now do suspend callbacks. In the case of an IOMMU mapping 6848 * this will suspend all DMA activity to the page while it is 6849 * being relocated. Since we are well above LOCK_LEVEL and CPUs 6850 * may be captured at this point we should have acquired any needed 6851 * locks in the presuspend callback. 6852 */ 6853 ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL); 6854 if (ret != 0) { 6855 repl = targ; 6856 goto suspend_fail; 6857 } 6858 6859 /* 6860 * Raise the PIL yet again, this time to block all high-level 6861 * interrupts on this CPU. This is necessary to prevent an 6862 * interrupt routine from pinning the thread which holds the 6863 * mapping suspended and then touching the suspended page. 6864 * 6865 * Once the page is suspended we also need to be careful to 6866 * avoid calling any functions which touch any seg_kmem memory 6867 * since that memory may be backed by the very page we are 6868 * relocating in here! 6869 */ 6870 hat_pagesuspend(targ); 6871 6872 /* 6873 * Now that we are confident everybody has stopped using this page, 6874 * copy the page contents. Note we use a physical copy to prevent 6875 * locking issues and to avoid fpRAS because we can't handle it in 6876 * this context. 6877 */ 6878 for (i = 0; i < npages; i++, tpp++, rpp++) { 6879 #ifdef VAC 6880 /* 6881 * If the replacement has a different vcolor than 6882 * the one being replacd, we need to handle VAC 6883 * consistency for it just as we were setting up 6884 * a new mapping to it. 6885 */ 6886 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) && 6887 (tpp->p_vcolor != rpp->p_vcolor) && 6888 !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) { 6889 CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp)); 6890 sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp), 6891 rpp->p_pagenum); 6892 } 6893 #endif 6894 /* 6895 * Copy the contents of the page. 6896 */ 6897 ppcopy_kernel(tpp, rpp); 6898 } 6899 6900 tpp = targ; 6901 rpp = repl; 6902 for (i = 0; i < npages; i++, tpp++, rpp++) { 6903 /* 6904 * Copy attributes. VAC consistency was handled above, 6905 * if required. 6906 */ 6907 rpp->p_nrm = tpp->p_nrm; 6908 tpp->p_nrm = 0; 6909 rpp->p_index = tpp->p_index; 6910 tpp->p_index = 0; 6911 #ifdef VAC 6912 rpp->p_vcolor = tpp->p_vcolor; 6913 #endif 6914 } 6915 6916 /* 6917 * First, unsuspend the page, if we set the suspend bit, and transfer 6918 * the mapping list from the target page to the replacement page. 6919 * Next process postcallbacks; since pa_hment's are linked only to the 6920 * p_mapping list of root page, we don't iterate over the constituent 6921 * pages. 6922 */ 6923 hat_pagereload(targ, repl); 6924 6925 suspend_fail: 6926 hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND); 6927 6928 /* 6929 * Now lower our PIL and release any captured CPUs since we 6930 * are out of the "danger zone". After this it will again be 6931 * safe to acquire adaptive mutex locks, or to drop them... 6932 */ 6933 if (old_pil != -1) { 6934 splx(old_pil); 6935 } else { 6936 xc_dismissed(cpuset); 6937 } 6938 6939 kpreempt_enable(); 6940 6941 sfmmu_mlist_reloc_exit(low, high); 6942 6943 /* 6944 * Postsuspend callbacks should drop any locks held across 6945 * the suspend callbacks. As before, we don't hold the mapping 6946 * list lock at this point.. our assumption is that the mapping 6947 * list still can't change due to our holding SE_EXCL lock and 6948 * there being no unlocked mappings left. Hence the restriction 6949 * on calling context to hat_delete_callback() 6950 */ 6951 hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND); 6952 if (ret != 0) { 6953 /* 6954 * The second presuspend call failed: we got here through 6955 * the suspend_fail label above. 6956 */ 6957 ASSERT(ret != EIO); 6958 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus); 6959 kreloc_thread = NULL; 6960 mutex_exit(&kpr_mutex); 6961 return (EAGAIN); 6962 } 6963 6964 /* 6965 * Now that we're out of the performance critical section we can 6966 * take care of updating the hash table, since we still 6967 * hold all the pages locked SE_EXCL at this point we 6968 * needn't worry about things changing out from under us. 6969 */ 6970 tpp = targ; 6971 rpp = repl; 6972 for (i = 0; i < npages; i++, tpp++, rpp++) { 6973 6974 /* 6975 * replace targ with replacement in page_hash table 6976 */ 6977 targ = tpp; 6978 page_relocate_hash(rpp, targ); 6979 6980 /* 6981 * concatenate target; caller of platform_page_relocate() 6982 * expects target to be concatenated after returning. 6983 */ 6984 ASSERT(targ->p_next == targ); 6985 ASSERT(targ->p_prev == targ); 6986 page_list_concat(&pl, &targ); 6987 } 6988 6989 ASSERT(*target == pl); 6990 *nrelocp = npages; 6991 PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus); 6992 kreloc_thread = NULL; 6993 mutex_exit(&kpr_mutex); 6994 return (0); 6995 } 6996 6997 /* 6998 * Called when stray pa_hments are found attached to a page which is 6999 * being freed. Notify the subsystem which attached the pa_hment of 7000 * the error if it registered a suitable handler, else panic. 7001 */ 7002 static void 7003 sfmmu_pahment_leaked(struct pa_hment *pahmep) 7004 { 7005 id_t cb_id = pahmep->cb_id; 7006 7007 ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid); 7008 if (sfmmu_cb_table[cb_id].errhandler != NULL) { 7009 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len, 7010 HAT_CB_ERR_LEAKED, pahmep->pvt) == 0) 7011 return; /* non-fatal */ 7012 } 7013 panic("pa_hment leaked: 0x%p", (void *)pahmep); 7014 } 7015 7016 /* 7017 * Remove all mappings to page 'pp'. 7018 */ 7019 int 7020 hat_pageunload(struct page *pp, uint_t forceflag) 7021 { 7022 struct page *origpp = pp; 7023 struct sf_hment *sfhme, *tmphme; 7024 struct hme_blk *hmeblkp; 7025 kmutex_t *pml; 7026 #ifdef VAC 7027 kmutex_t *pmtx; 7028 #endif 7029 cpuset_t cpuset, tset; 7030 int index, cons; 7031 int pa_hments; 7032 7033 ASSERT(PAGE_EXCL(pp)); 7034 7035 tmphme = NULL; 7036 pa_hments = 0; 7037 CPUSET_ZERO(cpuset); 7038 7039 pml = sfmmu_mlist_enter(pp); 7040 7041 #ifdef VAC 7042 if (pp->p_kpmref) 7043 sfmmu_kpm_pageunload(pp); 7044 ASSERT(!PP_ISMAPPED_KPM(pp)); 7045 #endif 7046 /* 7047 * Clear vpm reference. Since the page is exclusively locked 7048 * vpm cannot be referencing it. 7049 */ 7050 if (vpm_enable) { 7051 pp->p_vpmref = 0; 7052 } 7053 7054 index = PP_MAPINDEX(pp); 7055 cons = TTE8K; 7056 retry: 7057 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7058 tmphme = sfhme->hme_next; 7059 7060 if (IS_PAHME(sfhme)) { 7061 ASSERT(sfhme->hme_data != NULL); 7062 pa_hments++; 7063 continue; 7064 } 7065 7066 hmeblkp = sfmmu_hmetohblk(sfhme); 7067 7068 /* 7069 * If there are kernel mappings don't unload them, they will 7070 * be suspended. 7071 */ 7072 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt && 7073 hmeblkp->hblk_tag.htag_id == ksfmmup) 7074 continue; 7075 7076 tset = sfmmu_pageunload(pp, sfhme, cons); 7077 CPUSET_OR(cpuset, tset); 7078 } 7079 7080 while (index != 0) { 7081 index = index >> 1; 7082 if (index != 0) 7083 cons++; 7084 if (index & 0x1) { 7085 /* Go to leading page */ 7086 pp = PP_GROUPLEADER(pp, cons); 7087 ASSERT(sfmmu_mlist_held(pp)); 7088 goto retry; 7089 } 7090 } 7091 7092 /* 7093 * cpuset may be empty if the page was only mapped by segkpm, 7094 * in which case we won't actually cross-trap. 7095 */ 7096 xt_sync(cpuset); 7097 7098 /* 7099 * The page should have no mappings at this point, unless 7100 * we were called from hat_page_relocate() in which case we 7101 * leave the locked mappings which will be suspended later. 7102 */ 7103 ASSERT(!PP_ISMAPPED(origpp) || pa_hments || 7104 (forceflag == SFMMU_KERNEL_RELOC)); 7105 7106 #ifdef VAC 7107 if (PP_ISTNC(pp)) { 7108 if (cons == TTE8K) { 7109 pmtx = sfmmu_page_enter(pp); 7110 PP_CLRTNC(pp); 7111 sfmmu_page_exit(pmtx); 7112 } else { 7113 conv_tnc(pp, cons); 7114 } 7115 } 7116 #endif /* VAC */ 7117 7118 if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) { 7119 /* 7120 * Unlink any pa_hments and free them, calling back 7121 * the responsible subsystem to notify it of the error. 7122 * This can occur in situations such as drivers leaking 7123 * DMA handles: naughty, but common enough that we'd like 7124 * to keep the system running rather than bringing it 7125 * down with an obscure error like "pa_hment leaked" 7126 * which doesn't aid the user in debugging their driver. 7127 */ 7128 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7129 tmphme = sfhme->hme_next; 7130 if (IS_PAHME(sfhme)) { 7131 struct pa_hment *pahmep = sfhme->hme_data; 7132 sfmmu_pahment_leaked(pahmep); 7133 HME_SUB(sfhme, pp); 7134 kmem_cache_free(pa_hment_cache, pahmep); 7135 } 7136 } 7137 7138 ASSERT(!PP_ISMAPPED(origpp)); 7139 } 7140 7141 sfmmu_mlist_exit(pml); 7142 7143 return (0); 7144 } 7145 7146 cpuset_t 7147 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons) 7148 { 7149 struct hme_blk *hmeblkp; 7150 sfmmu_t *sfmmup; 7151 tte_t tte, ttemod; 7152 #ifdef DEBUG 7153 tte_t orig_old; 7154 #endif /* DEBUG */ 7155 caddr_t addr; 7156 int ttesz; 7157 int ret; 7158 cpuset_t cpuset; 7159 7160 ASSERT(pp != NULL); 7161 ASSERT(sfmmu_mlist_held(pp)); 7162 ASSERT(!PP_ISKAS(pp)); 7163 7164 CPUSET_ZERO(cpuset); 7165 7166 hmeblkp = sfmmu_hmetohblk(sfhme); 7167 7168 readtte: 7169 sfmmu_copytte(&sfhme->hme_tte, &tte); 7170 if (TTE_IS_VALID(&tte)) { 7171 sfmmup = hblktosfmmu(hmeblkp); 7172 ttesz = get_hblk_ttesz(hmeblkp); 7173 /* 7174 * Only unload mappings of 'cons' size. 7175 */ 7176 if (ttesz != cons) 7177 return (cpuset); 7178 7179 /* 7180 * Note that we have p_mapping lock, but no hash lock here. 7181 * hblk_unload() has to have both hash lock AND p_mapping 7182 * lock before it tries to modify tte. So, the tte could 7183 * not become invalid in the sfmmu_modifytte_try() below. 7184 */ 7185 ttemod = tte; 7186 #ifdef DEBUG 7187 orig_old = tte; 7188 #endif /* DEBUG */ 7189 7190 TTE_SET_INVALID(&ttemod); 7191 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 7192 if (ret < 0) { 7193 #ifdef DEBUG 7194 /* only R/M bits can change. */ 7195 chk_tte(&orig_old, &tte, &ttemod, hmeblkp); 7196 #endif /* DEBUG */ 7197 goto readtte; 7198 } 7199 7200 if (ret == 0) { 7201 panic("pageunload: cas failed?"); 7202 } 7203 7204 addr = tte_to_vaddr(hmeblkp, tte); 7205 7206 if (hmeblkp->hblk_shared) { 7207 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7208 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7209 sf_region_t *rgnp; 7210 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7211 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7212 ASSERT(srdp != NULL); 7213 rgnp = srdp->srd_hmergnp[rid]; 7214 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 7215 cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1); 7216 sfmmu_ttesync(NULL, addr, &tte, pp); 7217 ASSERT(rgnp->rgn_ttecnt[ttesz] > 0); 7218 atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]); 7219 } else { 7220 sfmmu_ttesync(sfmmup, addr, &tte, pp); 7221 atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]); 7222 7223 /* 7224 * We need to flush the page from the virtual cache 7225 * in order to prevent a virtual cache alias 7226 * inconsistency. The particular scenario we need 7227 * to worry about is: 7228 * Given: va1 and va2 are two virtual address that 7229 * alias and will map the same physical address. 7230 * 1. mapping exists from va1 to pa and data has 7231 * been read into the cache. 7232 * 2. unload va1. 7233 * 3. load va2 and modify data using va2. 7234 * 4 unload va2. 7235 * 5. load va1 and reference data. Unless we flush 7236 * the data cache when we unload we will get 7237 * stale data. 7238 * This scenario is taken care of by using virtual 7239 * page coloring. 7240 */ 7241 if (sfmmup->sfmmu_ismhat) { 7242 /* 7243 * Flush TSBs, TLBs and caches 7244 * of every process 7245 * sharing this ism segment. 7246 */ 7247 sfmmu_hat_lock_all(); 7248 mutex_enter(&ism_mlist_lock); 7249 kpreempt_disable(); 7250 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp, 7251 pp->p_pagenum, CACHE_NO_FLUSH); 7252 kpreempt_enable(); 7253 mutex_exit(&ism_mlist_lock); 7254 sfmmu_hat_unlock_all(); 7255 cpuset = cpu_ready_set; 7256 } else { 7257 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 7258 cpuset = sfmmup->sfmmu_cpusran; 7259 } 7260 } 7261 7262 /* 7263 * Hme_sub has to run after ttesync() and a_rss update. 7264 * See hblk_unload(). 7265 */ 7266 HME_SUB(sfhme, pp); 7267 membar_stst(); 7268 7269 /* 7270 * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS) 7271 * since pteload may have done a HME_ADD() right after 7272 * we did the HME_SUB() above. Hmecnt is now maintained 7273 * by cas only. no lock guranteed its value. The only 7274 * gurantee we have is the hmecnt should not be less than 7275 * what it should be so the hblk will not be taken away. 7276 * It's also important that we decremented the hmecnt after 7277 * we are done with hmeblkp so that this hmeblk won't be 7278 * stolen. 7279 */ 7280 ASSERT(hmeblkp->hblk_hmecnt > 0); 7281 ASSERT(hmeblkp->hblk_vcnt > 0); 7282 atomic_dec_16(&hmeblkp->hblk_vcnt); 7283 atomic_dec_16(&hmeblkp->hblk_hmecnt); 7284 /* 7285 * This is bug 4063182. 7286 * XXX: fixme 7287 * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt || 7288 * !hmeblkp->hblk_lckcnt); 7289 */ 7290 } else { 7291 panic("invalid tte? pp %p &tte %p", 7292 (void *)pp, (void *)&tte); 7293 } 7294 7295 return (cpuset); 7296 } 7297 7298 /* 7299 * While relocating a kernel page, this function will move the mappings 7300 * from tpp to dpp and modify any associated data with these mappings. 7301 * It also unsuspends the suspended kernel mapping. 7302 */ 7303 static void 7304 hat_pagereload(struct page *tpp, struct page *dpp) 7305 { 7306 struct sf_hment *sfhme; 7307 tte_t tte, ttemod; 7308 int index, cons; 7309 7310 ASSERT(getpil() == PIL_MAX); 7311 ASSERT(sfmmu_mlist_held(tpp)); 7312 ASSERT(sfmmu_mlist_held(dpp)); 7313 7314 index = PP_MAPINDEX(tpp); 7315 cons = TTE8K; 7316 7317 /* Update real mappings to the page */ 7318 retry: 7319 for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) { 7320 if (IS_PAHME(sfhme)) 7321 continue; 7322 sfmmu_copytte(&sfhme->hme_tte, &tte); 7323 ttemod = tte; 7324 7325 /* 7326 * replace old pfn with new pfn in TTE 7327 */ 7328 PFN_TO_TTE(ttemod, dpp->p_pagenum); 7329 7330 /* 7331 * clear suspend bit 7332 */ 7333 ASSERT(TTE_IS_SUSPEND(&ttemod)); 7334 TTE_CLR_SUSPEND(&ttemod); 7335 7336 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0) 7337 panic("hat_pagereload(): sfmmu_modifytte_try() failed"); 7338 7339 /* 7340 * set hme_page point to new page 7341 */ 7342 sfhme->hme_page = dpp; 7343 } 7344 7345 /* 7346 * move p_mapping list from old page to new page 7347 */ 7348 dpp->p_mapping = tpp->p_mapping; 7349 tpp->p_mapping = NULL; 7350 dpp->p_share = tpp->p_share; 7351 tpp->p_share = 0; 7352 7353 while (index != 0) { 7354 index = index >> 1; 7355 if (index != 0) 7356 cons++; 7357 if (index & 0x1) { 7358 tpp = PP_GROUPLEADER(tpp, cons); 7359 dpp = PP_GROUPLEADER(dpp, cons); 7360 goto retry; 7361 } 7362 } 7363 7364 curthread->t_flag &= ~T_DONTDTRACE; 7365 mutex_exit(&kpr_suspendlock); 7366 } 7367 7368 uint_t 7369 hat_pagesync(struct page *pp, uint_t clearflag) 7370 { 7371 struct sf_hment *sfhme, *tmphme = NULL; 7372 struct hme_blk *hmeblkp; 7373 kmutex_t *pml; 7374 cpuset_t cpuset, tset; 7375 int index, cons; 7376 extern ulong_t po_share; 7377 page_t *save_pp = pp; 7378 int stop_on_sh = 0; 7379 uint_t shcnt; 7380 7381 CPUSET_ZERO(cpuset); 7382 7383 if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) { 7384 return (PP_GENERIC_ATTR(pp)); 7385 } 7386 7387 if ((clearflag & HAT_SYNC_ZERORM) == 0) { 7388 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) { 7389 return (PP_GENERIC_ATTR(pp)); 7390 } 7391 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) { 7392 return (PP_GENERIC_ATTR(pp)); 7393 } 7394 if (clearflag & HAT_SYNC_STOPON_SHARED) { 7395 if (pp->p_share > po_share) { 7396 hat_page_setattr(pp, P_REF); 7397 return (PP_GENERIC_ATTR(pp)); 7398 } 7399 stop_on_sh = 1; 7400 shcnt = 0; 7401 } 7402 } 7403 7404 clearflag &= ~HAT_SYNC_STOPON_SHARED; 7405 pml = sfmmu_mlist_enter(pp); 7406 index = PP_MAPINDEX(pp); 7407 cons = TTE8K; 7408 retry: 7409 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7410 /* 7411 * We need to save the next hment on the list since 7412 * it is possible for pagesync to remove an invalid hment 7413 * from the list. 7414 */ 7415 tmphme = sfhme->hme_next; 7416 if (IS_PAHME(sfhme)) 7417 continue; 7418 /* 7419 * If we are looking for large mappings and this hme doesn't 7420 * reach the range we are seeking, just ignore it. 7421 */ 7422 hmeblkp = sfmmu_hmetohblk(sfhme); 7423 7424 if (hme_size(sfhme) < cons) 7425 continue; 7426 7427 if (stop_on_sh) { 7428 if (hmeblkp->hblk_shared) { 7429 sf_srd_t *srdp = hblktosrd(hmeblkp); 7430 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7431 sf_region_t *rgnp; 7432 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7433 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7434 ASSERT(srdp != NULL); 7435 rgnp = srdp->srd_hmergnp[rid]; 7436 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, 7437 rgnp, rid); 7438 shcnt += rgnp->rgn_refcnt; 7439 } else { 7440 shcnt++; 7441 } 7442 if (shcnt > po_share) { 7443 /* 7444 * tell the pager to spare the page this time 7445 * around. 7446 */ 7447 hat_page_setattr(save_pp, P_REF); 7448 index = 0; 7449 break; 7450 } 7451 } 7452 tset = sfmmu_pagesync(pp, sfhme, 7453 clearflag & ~HAT_SYNC_STOPON_RM); 7454 CPUSET_OR(cpuset, tset); 7455 7456 /* 7457 * If clearflag is HAT_SYNC_DONTZERO, break out as soon 7458 * as the "ref" or "mod" is set or share cnt exceeds po_share. 7459 */ 7460 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO && 7461 (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) || 7462 ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) { 7463 index = 0; 7464 break; 7465 } 7466 } 7467 7468 while (index) { 7469 index = index >> 1; 7470 cons++; 7471 if (index & 0x1) { 7472 /* Go to leading page */ 7473 pp = PP_GROUPLEADER(pp, cons); 7474 goto retry; 7475 } 7476 } 7477 7478 xt_sync(cpuset); 7479 sfmmu_mlist_exit(pml); 7480 return (PP_GENERIC_ATTR(save_pp)); 7481 } 7482 7483 /* 7484 * Get all the hardware dependent attributes for a page struct 7485 */ 7486 static cpuset_t 7487 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme, 7488 uint_t clearflag) 7489 { 7490 caddr_t addr; 7491 tte_t tte, ttemod; 7492 struct hme_blk *hmeblkp; 7493 int ret; 7494 sfmmu_t *sfmmup; 7495 cpuset_t cpuset; 7496 7497 ASSERT(pp != NULL); 7498 ASSERT(sfmmu_mlist_held(pp)); 7499 ASSERT((clearflag == HAT_SYNC_DONTZERO) || 7500 (clearflag == HAT_SYNC_ZERORM)); 7501 7502 SFMMU_STAT(sf_pagesync); 7503 7504 CPUSET_ZERO(cpuset); 7505 7506 sfmmu_pagesync_retry: 7507 7508 sfmmu_copytte(&sfhme->hme_tte, &tte); 7509 if (TTE_IS_VALID(&tte)) { 7510 hmeblkp = sfmmu_hmetohblk(sfhme); 7511 sfmmup = hblktosfmmu(hmeblkp); 7512 addr = tte_to_vaddr(hmeblkp, tte); 7513 if (clearflag == HAT_SYNC_ZERORM) { 7514 ttemod = tte; 7515 TTE_CLR_RM(&ttemod); 7516 ret = sfmmu_modifytte_try(&tte, &ttemod, 7517 &sfhme->hme_tte); 7518 if (ret < 0) { 7519 /* 7520 * cas failed and the new value is not what 7521 * we want. 7522 */ 7523 goto sfmmu_pagesync_retry; 7524 } 7525 7526 if (ret > 0) { 7527 /* we win the cas */ 7528 if (hmeblkp->hblk_shared) { 7529 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7530 uint_t rid = 7531 hmeblkp->hblk_tag.htag_rid; 7532 sf_region_t *rgnp; 7533 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7534 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7535 ASSERT(srdp != NULL); 7536 rgnp = srdp->srd_hmergnp[rid]; 7537 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 7538 srdp, rgnp, rid); 7539 cpuset = sfmmu_rgntlb_demap(addr, 7540 rgnp, hmeblkp, 1); 7541 } else { 7542 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 7543 0, 0); 7544 cpuset = sfmmup->sfmmu_cpusran; 7545 } 7546 } 7547 } 7548 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr, 7549 &tte, pp); 7550 } 7551 return (cpuset); 7552 } 7553 7554 /* 7555 * Remove write permission from a mappings to a page, so that 7556 * we can detect the next modification of it. This requires modifying 7557 * the TTE then invalidating (demap) any TLB entry using that TTE. 7558 * This code is similar to sfmmu_pagesync(). 7559 */ 7560 static cpuset_t 7561 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme) 7562 { 7563 caddr_t addr; 7564 tte_t tte; 7565 tte_t ttemod; 7566 struct hme_blk *hmeblkp; 7567 int ret; 7568 sfmmu_t *sfmmup; 7569 cpuset_t cpuset; 7570 7571 ASSERT(pp != NULL); 7572 ASSERT(sfmmu_mlist_held(pp)); 7573 7574 CPUSET_ZERO(cpuset); 7575 SFMMU_STAT(sf_clrwrt); 7576 7577 retry: 7578 7579 sfmmu_copytte(&sfhme->hme_tte, &tte); 7580 if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) { 7581 hmeblkp = sfmmu_hmetohblk(sfhme); 7582 sfmmup = hblktosfmmu(hmeblkp); 7583 addr = tte_to_vaddr(hmeblkp, tte); 7584 7585 ttemod = tte; 7586 TTE_CLR_WRT(&ttemod); 7587 TTE_CLR_MOD(&ttemod); 7588 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 7589 7590 /* 7591 * if cas failed and the new value is not what 7592 * we want retry 7593 */ 7594 if (ret < 0) 7595 goto retry; 7596 7597 /* we win the cas */ 7598 if (ret > 0) { 7599 if (hmeblkp->hblk_shared) { 7600 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 7601 uint_t rid = hmeblkp->hblk_tag.htag_rid; 7602 sf_region_t *rgnp; 7603 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7604 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7605 ASSERT(srdp != NULL); 7606 rgnp = srdp->srd_hmergnp[rid]; 7607 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 7608 srdp, rgnp, rid); 7609 cpuset = sfmmu_rgntlb_demap(addr, 7610 rgnp, hmeblkp, 1); 7611 } else { 7612 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0); 7613 cpuset = sfmmup->sfmmu_cpusran; 7614 } 7615 } 7616 } 7617 7618 return (cpuset); 7619 } 7620 7621 /* 7622 * Walk all mappings of a page, removing write permission and clearing the 7623 * ref/mod bits. This code is similar to hat_pagesync() 7624 */ 7625 static void 7626 hat_page_clrwrt(page_t *pp) 7627 { 7628 struct sf_hment *sfhme; 7629 struct sf_hment *tmphme = NULL; 7630 kmutex_t *pml; 7631 cpuset_t cpuset; 7632 cpuset_t tset; 7633 int index; 7634 int cons; 7635 7636 CPUSET_ZERO(cpuset); 7637 7638 pml = sfmmu_mlist_enter(pp); 7639 index = PP_MAPINDEX(pp); 7640 cons = TTE8K; 7641 retry: 7642 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 7643 tmphme = sfhme->hme_next; 7644 7645 /* 7646 * If we are looking for large mappings and this hme doesn't 7647 * reach the range we are seeking, just ignore its. 7648 */ 7649 7650 if (hme_size(sfhme) < cons) 7651 continue; 7652 7653 tset = sfmmu_pageclrwrt(pp, sfhme); 7654 CPUSET_OR(cpuset, tset); 7655 } 7656 7657 while (index) { 7658 index = index >> 1; 7659 cons++; 7660 if (index & 0x1) { 7661 /* Go to leading page */ 7662 pp = PP_GROUPLEADER(pp, cons); 7663 goto retry; 7664 } 7665 } 7666 7667 xt_sync(cpuset); 7668 sfmmu_mlist_exit(pml); 7669 } 7670 7671 /* 7672 * Set the given REF/MOD/RO bits for the given page. 7673 * For a vnode with a sorted v_pages list, we need to change 7674 * the attributes and the v_pages list together under page_vnode_mutex. 7675 */ 7676 void 7677 hat_page_setattr(page_t *pp, uint_t flag) 7678 { 7679 vnode_t *vp = pp->p_vnode; 7680 page_t **listp; 7681 kmutex_t *pmtx; 7682 kmutex_t *vphm = NULL; 7683 int noshuffle; 7684 7685 noshuffle = flag & P_NSH; 7686 flag &= ~P_NSH; 7687 7688 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7689 7690 /* 7691 * nothing to do if attribute already set 7692 */ 7693 if ((pp->p_nrm & flag) == flag) 7694 return; 7695 7696 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) && 7697 !noshuffle) { 7698 vphm = page_vnode_mutex(vp); 7699 mutex_enter(vphm); 7700 } 7701 7702 pmtx = sfmmu_page_enter(pp); 7703 pp->p_nrm |= flag; 7704 sfmmu_page_exit(pmtx); 7705 7706 if (vphm != NULL) { 7707 /* 7708 * Some File Systems examine v_pages for NULL w/o 7709 * grabbing the vphm mutex. Must not let it become NULL when 7710 * pp is the only page on the list. 7711 */ 7712 if (pp->p_vpnext != pp) { 7713 page_vpsub(&vp->v_pages, pp); 7714 if (vp->v_pages != NULL) 7715 listp = &vp->v_pages->p_vpprev->p_vpnext; 7716 else 7717 listp = &vp->v_pages; 7718 page_vpadd(listp, pp); 7719 } 7720 mutex_exit(vphm); 7721 } 7722 } 7723 7724 void 7725 hat_page_clrattr(page_t *pp, uint_t flag) 7726 { 7727 vnode_t *vp = pp->p_vnode; 7728 kmutex_t *pmtx; 7729 7730 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7731 7732 pmtx = sfmmu_page_enter(pp); 7733 7734 /* 7735 * Caller is expected to hold page's io lock for VMODSORT to work 7736 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod 7737 * bit is cleared. 7738 * We don't have assert to avoid tripping some existing third party 7739 * code. The dirty page is moved back to top of the v_page list 7740 * after IO is done in pvn_write_done(). 7741 */ 7742 pp->p_nrm &= ~flag; 7743 sfmmu_page_exit(pmtx); 7744 7745 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 7746 7747 /* 7748 * VMODSORT works by removing write permissions and getting 7749 * a fault when a page is made dirty. At this point 7750 * we need to remove write permission from all mappings 7751 * to this page. 7752 */ 7753 hat_page_clrwrt(pp); 7754 } 7755 } 7756 7757 uint_t 7758 hat_page_getattr(page_t *pp, uint_t flag) 7759 { 7760 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 7761 return ((uint_t)(pp->p_nrm & flag)); 7762 } 7763 7764 /* 7765 * DEBUG kernels: verify that a kernel va<->pa translation 7766 * is safe by checking the underlying page_t is in a page 7767 * relocation-safe state. 7768 */ 7769 #ifdef DEBUG 7770 void 7771 sfmmu_check_kpfn(pfn_t pfn) 7772 { 7773 page_t *pp; 7774 int index, cons; 7775 7776 if (hat_check_vtop == 0) 7777 return; 7778 7779 if (kvseg.s_base == NULL || panicstr) 7780 return; 7781 7782 pp = page_numtopp_nolock(pfn); 7783 if (!pp) 7784 return; 7785 7786 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp)) 7787 return; 7788 7789 /* 7790 * Handed a large kernel page, we dig up the root page since we 7791 * know the root page might have the lock also. 7792 */ 7793 if (pp->p_szc != 0) { 7794 index = PP_MAPINDEX(pp); 7795 cons = TTE8K; 7796 again: 7797 while (index != 0) { 7798 index >>= 1; 7799 if (index != 0) 7800 cons++; 7801 if (index & 0x1) { 7802 pp = PP_GROUPLEADER(pp, cons); 7803 goto again; 7804 } 7805 } 7806 } 7807 7808 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp)) 7809 return; 7810 7811 /* 7812 * Pages need to be locked or allocated "permanent" (either from 7813 * static_arena arena or explicitly setting PG_NORELOC when calling 7814 * page_create_va()) for VA->PA translations to be valid. 7815 */ 7816 if (!PP_ISNORELOC(pp)) 7817 panic("Illegal VA->PA translation, pp 0x%p not permanent", 7818 (void *)pp); 7819 else 7820 panic("Illegal VA->PA translation, pp 0x%p not locked", 7821 (void *)pp); 7822 } 7823 #endif /* DEBUG */ 7824 7825 /* 7826 * Returns a page frame number for a given virtual address. 7827 * Returns PFN_INVALID to indicate an invalid mapping 7828 */ 7829 pfn_t 7830 hat_getpfnum(struct hat *hat, caddr_t addr) 7831 { 7832 pfn_t pfn; 7833 tte_t tte; 7834 7835 /* 7836 * We would like to 7837 * ASSERT(AS_LOCK_HELD(as)); 7838 * but we can't because the iommu driver will call this 7839 * routine at interrupt time and it can't grab the as lock 7840 * or it will deadlock: A thread could have the as lock 7841 * and be waiting for io. The io can't complete 7842 * because the interrupt thread is blocked trying to grab 7843 * the as lock. 7844 */ 7845 7846 if (hat == ksfmmup) { 7847 if (IS_KMEM_VA_LARGEPAGE(addr)) { 7848 ASSERT(segkmem_lpszc > 0); 7849 pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc); 7850 if (pfn != PFN_INVALID) { 7851 sfmmu_check_kpfn(pfn); 7852 return (pfn); 7853 } 7854 } else if (segkpm && IS_KPM_ADDR(addr)) { 7855 return (sfmmu_kpm_vatopfn(addr)); 7856 } 7857 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte)) 7858 == PFN_SUSPENDED) { 7859 sfmmu_vatopfn_suspended(addr, ksfmmup, &tte); 7860 } 7861 sfmmu_check_kpfn(pfn); 7862 return (pfn); 7863 } else { 7864 return (sfmmu_uvatopfn(addr, hat, NULL)); 7865 } 7866 } 7867 7868 /* 7869 * This routine will return both pfn and tte for the vaddr. 7870 */ 7871 static pfn_t 7872 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep) 7873 { 7874 struct hmehash_bucket *hmebp; 7875 hmeblk_tag hblktag; 7876 int hmeshift, hashno = 1; 7877 struct hme_blk *hmeblkp = NULL; 7878 tte_t tte; 7879 7880 struct sf_hment *sfhmep; 7881 pfn_t pfn; 7882 7883 /* support for ISM */ 7884 ism_map_t *ism_map; 7885 ism_blk_t *ism_blkp; 7886 int i; 7887 sfmmu_t *ism_hatid = NULL; 7888 sfmmu_t *locked_hatid = NULL; 7889 sfmmu_t *sv_sfmmup = sfmmup; 7890 caddr_t sv_vaddr = vaddr; 7891 sf_srd_t *srdp; 7892 7893 if (ttep == NULL) { 7894 ttep = &tte; 7895 } else { 7896 ttep->ll = 0; 7897 } 7898 7899 ASSERT(sfmmup != ksfmmup); 7900 SFMMU_STAT(sf_user_vtop); 7901 /* 7902 * Set ism_hatid if vaddr falls in a ISM segment. 7903 */ 7904 ism_blkp = sfmmup->sfmmu_iblk; 7905 if (ism_blkp != NULL) { 7906 sfmmu_ismhat_enter(sfmmup, 0); 7907 locked_hatid = sfmmup; 7908 } 7909 while (ism_blkp != NULL && ism_hatid == NULL) { 7910 ism_map = ism_blkp->iblk_maps; 7911 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) { 7912 if (vaddr >= ism_start(ism_map[i]) && 7913 vaddr < ism_end(ism_map[i])) { 7914 sfmmup = ism_hatid = ism_map[i].imap_ismhat; 7915 vaddr = (caddr_t)(vaddr - 7916 ism_start(ism_map[i])); 7917 break; 7918 } 7919 } 7920 ism_blkp = ism_blkp->iblk_next; 7921 } 7922 if (locked_hatid) { 7923 sfmmu_ismhat_exit(locked_hatid, 0); 7924 } 7925 7926 hblktag.htag_id = sfmmup; 7927 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 7928 do { 7929 hmeshift = HME_HASH_SHIFT(hashno); 7930 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift); 7931 hblktag.htag_rehash = hashno; 7932 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift); 7933 7934 SFMMU_HASH_LOCK(hmebp); 7935 7936 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp); 7937 if (hmeblkp != NULL) { 7938 ASSERT(!hmeblkp->hblk_shared); 7939 HBLKTOHME(sfhmep, hmeblkp, vaddr); 7940 sfmmu_copytte(&sfhmep->hme_tte, ttep); 7941 SFMMU_HASH_UNLOCK(hmebp); 7942 if (TTE_IS_VALID(ttep)) { 7943 pfn = TTE_TO_PFN(vaddr, ttep); 7944 return (pfn); 7945 } 7946 break; 7947 } 7948 SFMMU_HASH_UNLOCK(hmebp); 7949 hashno++; 7950 } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt)); 7951 7952 if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) { 7953 return (PFN_INVALID); 7954 } 7955 srdp = sv_sfmmup->sfmmu_srdp; 7956 ASSERT(srdp != NULL); 7957 ASSERT(srdp->srd_refcnt != 0); 7958 hblktag.htag_id = srdp; 7959 hashno = 1; 7960 do { 7961 hmeshift = HME_HASH_SHIFT(hashno); 7962 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift); 7963 hblktag.htag_rehash = hashno; 7964 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift); 7965 7966 SFMMU_HASH_LOCK(hmebp); 7967 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL; 7968 hmeblkp = hmeblkp->hblk_next) { 7969 uint_t rid; 7970 sf_region_t *rgnp; 7971 caddr_t rsaddr; 7972 caddr_t readdr; 7973 7974 if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag, 7975 sv_sfmmup->sfmmu_hmeregion_map)) { 7976 continue; 7977 } 7978 ASSERT(hmeblkp->hblk_shared); 7979 rid = hmeblkp->hblk_tag.htag_rid; 7980 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 7981 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 7982 rgnp = srdp->srd_hmergnp[rid]; 7983 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 7984 HBLKTOHME(sfhmep, hmeblkp, sv_vaddr); 7985 sfmmu_copytte(&sfhmep->hme_tte, ttep); 7986 rsaddr = rgnp->rgn_saddr; 7987 readdr = rsaddr + rgnp->rgn_size; 7988 #ifdef DEBUG 7989 if (TTE_IS_VALID(ttep) || 7990 get_hblk_ttesz(hmeblkp) > TTE8K) { 7991 caddr_t eva = tte_to_evaddr(hmeblkp, ttep); 7992 ASSERT(eva > sv_vaddr); 7993 ASSERT(sv_vaddr >= rsaddr); 7994 ASSERT(sv_vaddr < readdr); 7995 ASSERT(eva <= readdr); 7996 } 7997 #endif /* DEBUG */ 7998 /* 7999 * Continue the search if we 8000 * found an invalid 8K tte outside of the area 8001 * covered by this hmeblk's region. 8002 */ 8003 if (TTE_IS_VALID(ttep)) { 8004 SFMMU_HASH_UNLOCK(hmebp); 8005 pfn = TTE_TO_PFN(sv_vaddr, ttep); 8006 return (pfn); 8007 } else if (get_hblk_ttesz(hmeblkp) > TTE8K || 8008 (sv_vaddr >= rsaddr && sv_vaddr < readdr)) { 8009 SFMMU_HASH_UNLOCK(hmebp); 8010 pfn = PFN_INVALID; 8011 return (pfn); 8012 } 8013 } 8014 SFMMU_HASH_UNLOCK(hmebp); 8015 hashno++; 8016 } while (hashno <= mmu_hashcnt); 8017 return (PFN_INVALID); 8018 } 8019 8020 8021 /* 8022 * For compatability with AT&T and later optimizations 8023 */ 8024 /* ARGSUSED */ 8025 void 8026 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags) 8027 { 8028 ASSERT(hat != NULL); 8029 } 8030 8031 /* 8032 * Return the number of mappings to a particular page. This number is an 8033 * approximation of the number of people sharing the page. 8034 * 8035 * shared hmeblks or ism hmeblks are counted as 1 mapping here. 8036 * hat_page_checkshare() can be used to compare threshold to share 8037 * count that reflects the number of region sharers albeit at higher cost. 8038 */ 8039 ulong_t 8040 hat_page_getshare(page_t *pp) 8041 { 8042 page_t *spp = pp; /* start page */ 8043 kmutex_t *pml; 8044 ulong_t cnt; 8045 int index, sz = TTE64K; 8046 8047 /* 8048 * We need to grab the mlist lock to make sure any outstanding 8049 * load/unloads complete. Otherwise we could return zero 8050 * even though the unload(s) hasn't finished yet. 8051 */ 8052 pml = sfmmu_mlist_enter(spp); 8053 cnt = spp->p_share; 8054 8055 #ifdef VAC 8056 if (kpm_enable) 8057 cnt += spp->p_kpmref; 8058 #endif 8059 if (vpm_enable && pp->p_vpmref) { 8060 cnt += 1; 8061 } 8062 8063 /* 8064 * If we have any large mappings, we count the number of 8065 * mappings that this large page is part of. 8066 */ 8067 index = PP_MAPINDEX(spp); 8068 index >>= 1; 8069 while (index) { 8070 pp = PP_GROUPLEADER(spp, sz); 8071 if ((index & 0x1) && pp != spp) { 8072 cnt += pp->p_share; 8073 spp = pp; 8074 } 8075 index >>= 1; 8076 sz++; 8077 } 8078 sfmmu_mlist_exit(pml); 8079 return (cnt); 8080 } 8081 8082 /* 8083 * Return 1 if the number of mappings exceeds sh_thresh. Return 0 8084 * otherwise. Count shared hmeblks by region's refcnt. 8085 */ 8086 int 8087 hat_page_checkshare(page_t *pp, ulong_t sh_thresh) 8088 { 8089 kmutex_t *pml; 8090 ulong_t cnt = 0; 8091 int index, sz = TTE8K; 8092 struct sf_hment *sfhme, *tmphme = NULL; 8093 struct hme_blk *hmeblkp; 8094 8095 pml = sfmmu_mlist_enter(pp); 8096 8097 #ifdef VAC 8098 if (kpm_enable) 8099 cnt = pp->p_kpmref; 8100 #endif 8101 8102 if (vpm_enable && pp->p_vpmref) { 8103 cnt += 1; 8104 } 8105 8106 if (pp->p_share + cnt > sh_thresh) { 8107 sfmmu_mlist_exit(pml); 8108 return (1); 8109 } 8110 8111 index = PP_MAPINDEX(pp); 8112 8113 again: 8114 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) { 8115 tmphme = sfhme->hme_next; 8116 if (IS_PAHME(sfhme)) { 8117 continue; 8118 } 8119 8120 hmeblkp = sfmmu_hmetohblk(sfhme); 8121 if (hme_size(sfhme) != sz) { 8122 continue; 8123 } 8124 8125 if (hmeblkp->hblk_shared) { 8126 sf_srd_t *srdp = hblktosrd(hmeblkp); 8127 uint_t rid = hmeblkp->hblk_tag.htag_rid; 8128 sf_region_t *rgnp; 8129 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 8130 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 8131 ASSERT(srdp != NULL); 8132 rgnp = srdp->srd_hmergnp[rid]; 8133 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, 8134 rgnp, rid); 8135 cnt += rgnp->rgn_refcnt; 8136 } else { 8137 cnt++; 8138 } 8139 if (cnt > sh_thresh) { 8140 sfmmu_mlist_exit(pml); 8141 return (1); 8142 } 8143 } 8144 8145 index >>= 1; 8146 sz++; 8147 while (index) { 8148 pp = PP_GROUPLEADER(pp, sz); 8149 ASSERT(sfmmu_mlist_held(pp)); 8150 if (index & 0x1) { 8151 goto again; 8152 } 8153 index >>= 1; 8154 sz++; 8155 } 8156 sfmmu_mlist_exit(pml); 8157 return (0); 8158 } 8159 8160 /* 8161 * Unload all large mappings to the pp and reset the p_szc field of every 8162 * constituent page according to the remaining mappings. 8163 * 8164 * pp must be locked SE_EXCL. Even though no other constituent pages are 8165 * locked it's legal to unload the large mappings to the pp because all 8166 * constituent pages of large locked mappings have to be locked SE_SHARED. 8167 * This means if we have SE_EXCL lock on one of constituent pages none of the 8168 * large mappings to pp are locked. 8169 * 8170 * Decrease p_szc field starting from the last constituent page and ending 8171 * with the root page. This method is used because other threads rely on the 8172 * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc 8173 * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This 8174 * ensures that p_szc changes of the constituent pages appears atomic for all 8175 * threads that use sfmmu_mlspl_enter() to examine p_szc field. 8176 * 8177 * This mechanism is only used for file system pages where it's not always 8178 * possible to get SE_EXCL locks on all constituent pages to demote the size 8179 * code (as is done for anonymous or kernel large pages). 8180 * 8181 * See more comments in front of sfmmu_mlspl_enter(). 8182 */ 8183 void 8184 hat_page_demote(page_t *pp) 8185 { 8186 int index; 8187 int sz; 8188 cpuset_t cpuset; 8189 int sync = 0; 8190 page_t *rootpp; 8191 struct sf_hment *sfhme; 8192 struct sf_hment *tmphme = NULL; 8193 struct hme_blk *hmeblkp; 8194 uint_t pszc; 8195 page_t *lastpp; 8196 cpuset_t tset; 8197 pgcnt_t npgs; 8198 kmutex_t *pml; 8199 kmutex_t *pmtx = NULL; 8200 8201 ASSERT(PAGE_EXCL(pp)); 8202 ASSERT(!PP_ISFREE(pp)); 8203 ASSERT(!PP_ISKAS(pp)); 8204 ASSERT(page_szc_lock_assert(pp)); 8205 pml = sfmmu_mlist_enter(pp); 8206 8207 pszc = pp->p_szc; 8208 if (pszc == 0) { 8209 goto out; 8210 } 8211 8212 index = PP_MAPINDEX(pp) >> 1; 8213 8214 if (index) { 8215 CPUSET_ZERO(cpuset); 8216 sz = TTE64K; 8217 sync = 1; 8218 } 8219 8220 while (index) { 8221 if (!(index & 0x1)) { 8222 index >>= 1; 8223 sz++; 8224 continue; 8225 } 8226 ASSERT(sz <= pszc); 8227 rootpp = PP_GROUPLEADER(pp, sz); 8228 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) { 8229 tmphme = sfhme->hme_next; 8230 ASSERT(!IS_PAHME(sfhme)); 8231 hmeblkp = sfmmu_hmetohblk(sfhme); 8232 if (hme_size(sfhme) != sz) { 8233 continue; 8234 } 8235 tset = sfmmu_pageunload(rootpp, sfhme, sz); 8236 CPUSET_OR(cpuset, tset); 8237 } 8238 if (index >>= 1) { 8239 sz++; 8240 } 8241 } 8242 8243 ASSERT(!PP_ISMAPPED_LARGE(pp)); 8244 8245 if (sync) { 8246 xt_sync(cpuset); 8247 #ifdef VAC 8248 if (PP_ISTNC(pp)) { 8249 conv_tnc(rootpp, sz); 8250 } 8251 #endif /* VAC */ 8252 } 8253 8254 pmtx = sfmmu_page_enter(pp); 8255 8256 ASSERT(pp->p_szc == pszc); 8257 rootpp = PP_PAGEROOT(pp); 8258 ASSERT(rootpp->p_szc == pszc); 8259 lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1); 8260 8261 while (lastpp != rootpp) { 8262 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0; 8263 ASSERT(sz < pszc); 8264 npgs = (sz == 0) ? 1 : TTEPAGES(sz); 8265 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1); 8266 while (--npgs > 0) { 8267 lastpp->p_szc = (uchar_t)sz; 8268 lastpp = PP_PAGEPREV(lastpp); 8269 } 8270 if (sz) { 8271 /* 8272 * make sure before current root's pszc 8273 * is updated all updates to constituent pages pszc 8274 * fields are globally visible. 8275 */ 8276 membar_producer(); 8277 } 8278 lastpp->p_szc = sz; 8279 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz))); 8280 if (lastpp != rootpp) { 8281 lastpp = PP_PAGEPREV(lastpp); 8282 } 8283 } 8284 if (sz == 0) { 8285 /* the loop above doesn't cover this case */ 8286 rootpp->p_szc = 0; 8287 } 8288 out: 8289 ASSERT(pp->p_szc == 0); 8290 if (pmtx != NULL) { 8291 sfmmu_page_exit(pmtx); 8292 } 8293 sfmmu_mlist_exit(pml); 8294 } 8295 8296 /* 8297 * Refresh the HAT ismttecnt[] element for size szc. 8298 * Caller must have set ISM busy flag to prevent mapping 8299 * lists from changing while we're traversing them. 8300 */ 8301 pgcnt_t 8302 ism_tsb_entries(sfmmu_t *sfmmup, int szc) 8303 { 8304 ism_blk_t *ism_blkp = sfmmup->sfmmu_iblk; 8305 ism_map_t *ism_map; 8306 pgcnt_t npgs = 0; 8307 pgcnt_t npgs_scd = 0; 8308 int j; 8309 sf_scd_t *scdp; 8310 uchar_t rid; 8311 8312 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 8313 scdp = sfmmup->sfmmu_scdp; 8314 8315 for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) { 8316 ism_map = ism_blkp->iblk_maps; 8317 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) { 8318 rid = ism_map[j].imap_rid; 8319 ASSERT(rid == SFMMU_INVALID_ISMRID || 8320 rid < sfmmup->sfmmu_srdp->srd_next_ismrid); 8321 8322 if (scdp != NULL && rid != SFMMU_INVALID_ISMRID && 8323 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) { 8324 /* ISM is in sfmmup's SCD */ 8325 npgs_scd += 8326 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc]; 8327 } else { 8328 /* ISMs is not in SCD */ 8329 npgs += 8330 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc]; 8331 } 8332 } 8333 } 8334 sfmmup->sfmmu_ismttecnt[szc] = npgs; 8335 sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd; 8336 return (npgs); 8337 } 8338 8339 /* 8340 * Yield the memory claim requirement for an address space. 8341 * 8342 * This is currently implemented as the number of bytes that have active 8343 * hardware translations that have page structures. Therefore, it can 8344 * underestimate the traditional resident set size, eg, if the 8345 * physical page is present and the hardware translation is missing; 8346 * and it can overestimate the rss, eg, if there are active 8347 * translations to a frame buffer with page structs. 8348 * Also, it does not take sharing into account. 8349 * 8350 * Note that we don't acquire locks here since this function is most often 8351 * called from the clock thread. 8352 */ 8353 size_t 8354 hat_get_mapped_size(struct hat *hat) 8355 { 8356 size_t assize = 0; 8357 int i; 8358 8359 if (hat == NULL) 8360 return (0); 8361 8362 for (i = 0; i < mmu_page_sizes; i++) 8363 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] + 8364 (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i); 8365 8366 if (hat->sfmmu_iblk == NULL) 8367 return (assize); 8368 8369 for (i = 0; i < mmu_page_sizes; i++) 8370 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] + 8371 (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i); 8372 8373 return (assize); 8374 } 8375 8376 int 8377 hat_stats_enable(struct hat *hat) 8378 { 8379 hatlock_t *hatlockp; 8380 8381 hatlockp = sfmmu_hat_enter(hat); 8382 hat->sfmmu_rmstat++; 8383 sfmmu_hat_exit(hatlockp); 8384 return (1); 8385 } 8386 8387 void 8388 hat_stats_disable(struct hat *hat) 8389 { 8390 hatlock_t *hatlockp; 8391 8392 hatlockp = sfmmu_hat_enter(hat); 8393 hat->sfmmu_rmstat--; 8394 sfmmu_hat_exit(hatlockp); 8395 } 8396 8397 /* 8398 * Routines for entering or removing ourselves from the 8399 * ism_hat's mapping list. This is used for both private and 8400 * SCD hats. 8401 */ 8402 static void 8403 iment_add(struct ism_ment *iment, struct hat *ism_hat) 8404 { 8405 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 8406 8407 iment->iment_prev = NULL; 8408 iment->iment_next = ism_hat->sfmmu_iment; 8409 if (ism_hat->sfmmu_iment) { 8410 ism_hat->sfmmu_iment->iment_prev = iment; 8411 } 8412 ism_hat->sfmmu_iment = iment; 8413 } 8414 8415 static void 8416 iment_sub(struct ism_ment *iment, struct hat *ism_hat) 8417 { 8418 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 8419 8420 if (ism_hat->sfmmu_iment == NULL) { 8421 panic("ism map entry remove - no entries"); 8422 } 8423 8424 if (iment->iment_prev) { 8425 ASSERT(ism_hat->sfmmu_iment != iment); 8426 iment->iment_prev->iment_next = iment->iment_next; 8427 } else { 8428 ASSERT(ism_hat->sfmmu_iment == iment); 8429 ism_hat->sfmmu_iment = iment->iment_next; 8430 } 8431 8432 if (iment->iment_next) { 8433 iment->iment_next->iment_prev = iment->iment_prev; 8434 } 8435 8436 /* 8437 * zero out the entry 8438 */ 8439 iment->iment_next = NULL; 8440 iment->iment_prev = NULL; 8441 iment->iment_hat = NULL; 8442 iment->iment_base_va = 0; 8443 } 8444 8445 /* 8446 * Hat_share()/unshare() return an (non-zero) error 8447 * when saddr and daddr are not properly aligned. 8448 * 8449 * The top level mapping element determines the alignment 8450 * requirement for saddr and daddr, depending on different 8451 * architectures. 8452 * 8453 * When hat_share()/unshare() are not supported, 8454 * HATOP_SHARE()/UNSHARE() return 0 8455 */ 8456 int 8457 hat_share(struct hat *sfmmup, caddr_t addr, 8458 struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc) 8459 { 8460 ism_blk_t *ism_blkp; 8461 ism_blk_t *new_iblk; 8462 ism_map_t *ism_map; 8463 ism_ment_t *ism_ment; 8464 int i, added; 8465 hatlock_t *hatlockp; 8466 int reload_mmu = 0; 8467 uint_t ismshift = page_get_shift(ismszc); 8468 size_t ismpgsz = page_get_pagesize(ismszc); 8469 uint_t ismmask = (uint_t)ismpgsz - 1; 8470 size_t sh_size = ISM_SHIFT(ismshift, len); 8471 ushort_t ismhatflag; 8472 hat_region_cookie_t rcookie; 8473 sf_scd_t *old_scdp; 8474 8475 #ifdef DEBUG 8476 caddr_t eaddr = addr + len; 8477 #endif /* DEBUG */ 8478 8479 ASSERT(ism_hatid != NULL && sfmmup != NULL); 8480 ASSERT(sptaddr == ISMID_STARTADDR); 8481 /* 8482 * Check the alignment. 8483 */ 8484 if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr)) 8485 return (EINVAL); 8486 8487 /* 8488 * Check size alignment. 8489 */ 8490 if (!ISM_ALIGNED(ismshift, len)) 8491 return (EINVAL); 8492 8493 /* 8494 * Allocate ism_ment for the ism_hat's mapping list, and an 8495 * ism map blk in case we need one. We must do our 8496 * allocations before acquiring locks to prevent a deadlock 8497 * in the kmem allocator on the mapping list lock. 8498 */ 8499 new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP); 8500 ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP); 8501 8502 /* 8503 * Serialize ISM mappings with the ISM busy flag, and also the 8504 * trap handlers. 8505 */ 8506 sfmmu_ismhat_enter(sfmmup, 0); 8507 8508 /* 8509 * Allocate an ism map blk if necessary. 8510 */ 8511 if (sfmmup->sfmmu_iblk == NULL) { 8512 sfmmup->sfmmu_iblk = new_iblk; 8513 bzero(new_iblk, sizeof (*new_iblk)); 8514 new_iblk->iblk_nextpa = (uint64_t)-1; 8515 membar_stst(); /* make sure next ptr visible to all CPUs */ 8516 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk); 8517 reload_mmu = 1; 8518 new_iblk = NULL; 8519 } 8520 8521 #ifdef DEBUG 8522 /* 8523 * Make sure mapping does not already exist. 8524 */ 8525 ism_blkp = sfmmup->sfmmu_iblk; 8526 while (ism_blkp != NULL) { 8527 ism_map = ism_blkp->iblk_maps; 8528 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) { 8529 if ((addr >= ism_start(ism_map[i]) && 8530 addr < ism_end(ism_map[i])) || 8531 eaddr > ism_start(ism_map[i]) && 8532 eaddr <= ism_end(ism_map[i])) { 8533 panic("sfmmu_share: Already mapped!"); 8534 } 8535 } 8536 ism_blkp = ism_blkp->iblk_next; 8537 } 8538 #endif /* DEBUG */ 8539 8540 ASSERT(ismszc >= TTE4M); 8541 if (ismszc == TTE4M) { 8542 ismhatflag = HAT_4M_FLAG; 8543 } else if (ismszc == TTE32M) { 8544 ismhatflag = HAT_32M_FLAG; 8545 } else if (ismszc == TTE256M) { 8546 ismhatflag = HAT_256M_FLAG; 8547 } 8548 /* 8549 * Add mapping to first available mapping slot. 8550 */ 8551 ism_blkp = sfmmup->sfmmu_iblk; 8552 added = 0; 8553 while (!added) { 8554 ism_map = ism_blkp->iblk_maps; 8555 for (i = 0; i < ISM_MAP_SLOTS; i++) { 8556 if (ism_map[i].imap_ismhat == NULL) { 8557 8558 ism_map[i].imap_ismhat = ism_hatid; 8559 ism_map[i].imap_vb_shift = (uchar_t)ismshift; 8560 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID; 8561 ism_map[i].imap_hatflags = ismhatflag; 8562 ism_map[i].imap_sz_mask = ismmask; 8563 /* 8564 * imap_seg is checked in ISM_CHECK to see if 8565 * non-NULL, then other info assumed valid. 8566 */ 8567 membar_stst(); 8568 ism_map[i].imap_seg = (uintptr_t)addr | sh_size; 8569 ism_map[i].imap_ment = ism_ment; 8570 8571 /* 8572 * Now add ourselves to the ism_hat's 8573 * mapping list. 8574 */ 8575 ism_ment->iment_hat = sfmmup; 8576 ism_ment->iment_base_va = addr; 8577 ism_hatid->sfmmu_ismhat = 1; 8578 mutex_enter(&ism_mlist_lock); 8579 iment_add(ism_ment, ism_hatid); 8580 mutex_exit(&ism_mlist_lock); 8581 added = 1; 8582 break; 8583 } 8584 } 8585 if (!added && ism_blkp->iblk_next == NULL) { 8586 ism_blkp->iblk_next = new_iblk; 8587 new_iblk = NULL; 8588 bzero(ism_blkp->iblk_next, 8589 sizeof (*ism_blkp->iblk_next)); 8590 ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1; 8591 membar_stst(); 8592 ism_blkp->iblk_nextpa = 8593 va_to_pa((caddr_t)ism_blkp->iblk_next); 8594 } 8595 ism_blkp = ism_blkp->iblk_next; 8596 } 8597 8598 /* 8599 * After calling hat_join_region, sfmmup may join a new SCD or 8600 * move from the old scd to a new scd, in which case, we want to 8601 * shrink the sfmmup's private tsb size, i.e., pass shrink to 8602 * sfmmu_check_page_sizes at the end of this routine. 8603 */ 8604 old_scdp = sfmmup->sfmmu_scdp; 8605 8606 rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0, 8607 PROT_ALL, ismszc, NULL, HAT_REGION_ISM); 8608 if (rcookie != HAT_INVALID_REGION_COOKIE) { 8609 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie); 8610 } 8611 /* 8612 * Update our counters for this sfmmup's ism mappings. 8613 */ 8614 for (i = 0; i <= ismszc; i++) { 8615 if (!(disable_ism_large_pages & (1 << i))) 8616 (void) ism_tsb_entries(sfmmup, i); 8617 } 8618 8619 /* 8620 * For ISM and DISM we do not support 512K pages, so we only only 8621 * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the 8622 * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus. 8623 * 8624 * Need to set 32M/256M ISM flags to make sure 8625 * sfmmu_check_page_sizes() enables them on Panther. 8626 */ 8627 ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0); 8628 8629 switch (ismszc) { 8630 case TTE256M: 8631 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) { 8632 hatlockp = sfmmu_hat_enter(sfmmup); 8633 SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM); 8634 sfmmu_hat_exit(hatlockp); 8635 } 8636 break; 8637 case TTE32M: 8638 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) { 8639 hatlockp = sfmmu_hat_enter(sfmmup); 8640 SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM); 8641 sfmmu_hat_exit(hatlockp); 8642 } 8643 break; 8644 default: 8645 break; 8646 } 8647 8648 /* 8649 * If we updated the ismblkpa for this HAT we must make 8650 * sure all CPUs running this process reload their tsbmiss area. 8651 * Otherwise they will fail to load the mappings in the tsbmiss 8652 * handler and will loop calling pagefault(). 8653 */ 8654 if (reload_mmu) { 8655 hatlockp = sfmmu_hat_enter(sfmmup); 8656 sfmmu_sync_mmustate(sfmmup); 8657 sfmmu_hat_exit(hatlockp); 8658 } 8659 8660 sfmmu_ismhat_exit(sfmmup, 0); 8661 8662 /* 8663 * Free up ismblk if we didn't use it. 8664 */ 8665 if (new_iblk != NULL) 8666 kmem_cache_free(ism_blk_cache, new_iblk); 8667 8668 /* 8669 * Check TSB and TLB page sizes. 8670 */ 8671 if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) { 8672 sfmmu_check_page_sizes(sfmmup, 0); 8673 } else { 8674 sfmmu_check_page_sizes(sfmmup, 1); 8675 } 8676 return (0); 8677 } 8678 8679 /* 8680 * hat_unshare removes exactly one ism_map from 8681 * this process's as. It expects multiple calls 8682 * to hat_unshare for multiple shm segments. 8683 */ 8684 void 8685 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc) 8686 { 8687 ism_map_t *ism_map; 8688 ism_ment_t *free_ment = NULL; 8689 ism_blk_t *ism_blkp; 8690 struct hat *ism_hatid; 8691 int found, i; 8692 hatlock_t *hatlockp; 8693 struct tsb_info *tsbinfo; 8694 uint_t ismshift = page_get_shift(ismszc); 8695 size_t sh_size = ISM_SHIFT(ismshift, len); 8696 uchar_t ism_rid; 8697 sf_scd_t *old_scdp; 8698 8699 ASSERT(ISM_ALIGNED(ismshift, addr)); 8700 ASSERT(ISM_ALIGNED(ismshift, len)); 8701 ASSERT(sfmmup != NULL); 8702 ASSERT(sfmmup != ksfmmup); 8703 8704 ASSERT(sfmmup->sfmmu_as != NULL); 8705 8706 /* 8707 * Make sure that during the entire time ISM mappings are removed, 8708 * the trap handlers serialize behind us, and that no one else 8709 * can be mucking with ISM mappings. This also lets us get away 8710 * with not doing expensive cross calls to flush the TLB -- we 8711 * just discard the context, flush the entire TSB, and call it 8712 * a day. 8713 */ 8714 sfmmu_ismhat_enter(sfmmup, 0); 8715 8716 /* 8717 * Remove the mapping. 8718 * 8719 * We can't have any holes in the ism map. 8720 * The tsb miss code while searching the ism map will 8721 * stop on an empty map slot. So we must move 8722 * everyone past the hole up 1 if any. 8723 * 8724 * Also empty ism map blks are not freed until the 8725 * process exits. This is to prevent a MT race condition 8726 * between sfmmu_unshare() and sfmmu_tsbmiss_exception(). 8727 */ 8728 found = 0; 8729 ism_blkp = sfmmup->sfmmu_iblk; 8730 while (!found && ism_blkp != NULL) { 8731 ism_map = ism_blkp->iblk_maps; 8732 for (i = 0; i < ISM_MAP_SLOTS; i++) { 8733 if (addr == ism_start(ism_map[i]) && 8734 sh_size == (size_t)(ism_size(ism_map[i]))) { 8735 found = 1; 8736 break; 8737 } 8738 } 8739 if (!found) 8740 ism_blkp = ism_blkp->iblk_next; 8741 } 8742 8743 if (found) { 8744 ism_hatid = ism_map[i].imap_ismhat; 8745 ism_rid = ism_map[i].imap_rid; 8746 ASSERT(ism_hatid != NULL); 8747 ASSERT(ism_hatid->sfmmu_ismhat == 1); 8748 8749 /* 8750 * After hat_leave_region, the sfmmup may leave SCD, 8751 * in which case, we want to grow the private tsb size when 8752 * calling sfmmu_check_page_sizes at the end of the routine. 8753 */ 8754 old_scdp = sfmmup->sfmmu_scdp; 8755 /* 8756 * Then remove ourselves from the region. 8757 */ 8758 if (ism_rid != SFMMU_INVALID_ISMRID) { 8759 hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid), 8760 HAT_REGION_ISM); 8761 } 8762 8763 /* 8764 * And now guarantee that any other cpu 8765 * that tries to process an ISM miss 8766 * will go to tl=0. 8767 */ 8768 hatlockp = sfmmu_hat_enter(sfmmup); 8769 sfmmu_invalidate_ctx(sfmmup); 8770 sfmmu_hat_exit(hatlockp); 8771 8772 /* 8773 * Remove ourselves from the ism mapping list. 8774 */ 8775 mutex_enter(&ism_mlist_lock); 8776 iment_sub(ism_map[i].imap_ment, ism_hatid); 8777 mutex_exit(&ism_mlist_lock); 8778 free_ment = ism_map[i].imap_ment; 8779 8780 /* 8781 * We delete the ism map by copying 8782 * the next map over the current one. 8783 * We will take the next one in the maps 8784 * array or from the next ism_blk. 8785 */ 8786 while (ism_blkp != NULL) { 8787 ism_map = ism_blkp->iblk_maps; 8788 while (i < (ISM_MAP_SLOTS - 1)) { 8789 ism_map[i] = ism_map[i + 1]; 8790 i++; 8791 } 8792 /* i == (ISM_MAP_SLOTS - 1) */ 8793 ism_blkp = ism_blkp->iblk_next; 8794 if (ism_blkp != NULL) { 8795 ism_map[i] = ism_blkp->iblk_maps[0]; 8796 i = 0; 8797 } else { 8798 ism_map[i].imap_seg = 0; 8799 ism_map[i].imap_vb_shift = 0; 8800 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID; 8801 ism_map[i].imap_hatflags = 0; 8802 ism_map[i].imap_sz_mask = 0; 8803 ism_map[i].imap_ismhat = NULL; 8804 ism_map[i].imap_ment = NULL; 8805 } 8806 } 8807 8808 /* 8809 * Now flush entire TSB for the process, since 8810 * demapping page by page can be too expensive. 8811 * We don't have to flush the TLB here anymore 8812 * since we switch to a new TLB ctx instead. 8813 * Also, there is no need to flush if the process 8814 * is exiting since the TSB will be freed later. 8815 */ 8816 if (!sfmmup->sfmmu_free) { 8817 hatlockp = sfmmu_hat_enter(sfmmup); 8818 for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL; 8819 tsbinfo = tsbinfo->tsb_next) { 8820 if (tsbinfo->tsb_flags & TSB_SWAPPED) 8821 continue; 8822 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) { 8823 tsbinfo->tsb_flags |= 8824 TSB_FLUSH_NEEDED; 8825 continue; 8826 } 8827 8828 sfmmu_inv_tsb(tsbinfo->tsb_va, 8829 TSB_BYTES(tsbinfo->tsb_szc)); 8830 } 8831 sfmmu_hat_exit(hatlockp); 8832 } 8833 } 8834 8835 /* 8836 * Update our counters for this sfmmup's ism mappings. 8837 */ 8838 for (i = 0; i <= ismszc; i++) { 8839 if (!(disable_ism_large_pages & (1 << i))) 8840 (void) ism_tsb_entries(sfmmup, i); 8841 } 8842 8843 sfmmu_ismhat_exit(sfmmup, 0); 8844 8845 /* 8846 * We must do our freeing here after dropping locks 8847 * to prevent a deadlock in the kmem allocator on the 8848 * mapping list lock. 8849 */ 8850 if (free_ment != NULL) 8851 kmem_cache_free(ism_ment_cache, free_ment); 8852 8853 /* 8854 * Check TSB and TLB page sizes if the process isn't exiting. 8855 */ 8856 if (!sfmmup->sfmmu_free) { 8857 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) { 8858 sfmmu_check_page_sizes(sfmmup, 1); 8859 } else { 8860 sfmmu_check_page_sizes(sfmmup, 0); 8861 } 8862 } 8863 } 8864 8865 /* ARGSUSED */ 8866 static int 8867 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags) 8868 { 8869 /* void *buf is sfmmu_t pointer */ 8870 bzero(buf, sizeof (sfmmu_t)); 8871 8872 return (0); 8873 } 8874 8875 /* ARGSUSED */ 8876 static void 8877 sfmmu_idcache_destructor(void *buf, void *cdrarg) 8878 { 8879 /* void *buf is sfmmu_t pointer */ 8880 } 8881 8882 /* 8883 * setup kmem hmeblks by bzeroing all members and initializing the nextpa 8884 * field to be the pa of this hmeblk 8885 */ 8886 /* ARGSUSED */ 8887 static int 8888 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags) 8889 { 8890 struct hme_blk *hmeblkp; 8891 8892 bzero(buf, (size_t)cdrarg); 8893 hmeblkp = (struct hme_blk *)buf; 8894 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp); 8895 8896 #ifdef HBLK_TRACE 8897 mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL); 8898 #endif /* HBLK_TRACE */ 8899 8900 return (0); 8901 } 8902 8903 /* ARGSUSED */ 8904 static void 8905 sfmmu_hblkcache_destructor(void *buf, void *cdrarg) 8906 { 8907 8908 #ifdef HBLK_TRACE 8909 8910 struct hme_blk *hmeblkp; 8911 8912 hmeblkp = (struct hme_blk *)buf; 8913 mutex_destroy(&hmeblkp->hblk_audit_lock); 8914 8915 #endif /* HBLK_TRACE */ 8916 } 8917 8918 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8 8919 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO; 8920 /* 8921 * The kmem allocator will callback into our reclaim routine when the system 8922 * is running low in memory. We traverse the hash and free up all unused but 8923 * still cached hme_blks. We also traverse the free list and free them up 8924 * as well. 8925 */ 8926 /*ARGSUSED*/ 8927 static void 8928 sfmmu_hblkcache_reclaim(void *cdrarg) 8929 { 8930 int i; 8931 struct hmehash_bucket *hmebp; 8932 struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL; 8933 static struct hmehash_bucket *uhmehash_reclaim_hand; 8934 static struct hmehash_bucket *khmehash_reclaim_hand; 8935 struct hme_blk *list = NULL, *last_hmeblkp; 8936 cpuset_t cpuset = cpu_ready_set; 8937 cpu_hme_pend_t *cpuhp; 8938 8939 /* Free up hmeblks on the cpu pending lists */ 8940 for (i = 0; i < NCPU; i++) { 8941 cpuhp = &cpu_hme_pend[i]; 8942 if (cpuhp->chp_listp != NULL) { 8943 mutex_enter(&cpuhp->chp_mutex); 8944 if (cpuhp->chp_listp == NULL) { 8945 mutex_exit(&cpuhp->chp_mutex); 8946 continue; 8947 } 8948 for (last_hmeblkp = cpuhp->chp_listp; 8949 last_hmeblkp->hblk_next != NULL; 8950 last_hmeblkp = last_hmeblkp->hblk_next) 8951 ; 8952 last_hmeblkp->hblk_next = list; 8953 list = cpuhp->chp_listp; 8954 cpuhp->chp_listp = NULL; 8955 cpuhp->chp_count = 0; 8956 mutex_exit(&cpuhp->chp_mutex); 8957 } 8958 8959 } 8960 8961 if (list != NULL) { 8962 kpreempt_disable(); 8963 CPUSET_DEL(cpuset, CPU->cpu_id); 8964 xt_sync(cpuset); 8965 xt_sync(cpuset); 8966 kpreempt_enable(); 8967 sfmmu_hblk_free(&list); 8968 list = NULL; 8969 } 8970 8971 hmebp = uhmehash_reclaim_hand; 8972 if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ]) 8973 uhmehash_reclaim_hand = hmebp = uhme_hash; 8974 uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; 8975 8976 for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) { 8977 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) { 8978 hmeblkp = hmebp->hmeblkp; 8979 pr_hblk = NULL; 8980 while (hmeblkp) { 8981 nx_hblk = hmeblkp->hblk_next; 8982 if (!hmeblkp->hblk_vcnt && 8983 !hmeblkp->hblk_hmecnt) { 8984 sfmmu_hblk_hash_rm(hmebp, hmeblkp, 8985 pr_hblk, &list, 0); 8986 } else { 8987 pr_hblk = hmeblkp; 8988 } 8989 hmeblkp = nx_hblk; 8990 } 8991 SFMMU_HASH_UNLOCK(hmebp); 8992 } 8993 if (hmebp++ == &uhme_hash[UHMEHASH_SZ]) 8994 hmebp = uhme_hash; 8995 } 8996 8997 hmebp = khmehash_reclaim_hand; 8998 if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ]) 8999 khmehash_reclaim_hand = hmebp = khme_hash; 9000 khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; 9001 9002 for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) { 9003 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) { 9004 hmeblkp = hmebp->hmeblkp; 9005 pr_hblk = NULL; 9006 while (hmeblkp) { 9007 nx_hblk = hmeblkp->hblk_next; 9008 if (!hmeblkp->hblk_vcnt && 9009 !hmeblkp->hblk_hmecnt) { 9010 sfmmu_hblk_hash_rm(hmebp, hmeblkp, 9011 pr_hblk, &list, 0); 9012 } else { 9013 pr_hblk = hmeblkp; 9014 } 9015 hmeblkp = nx_hblk; 9016 } 9017 SFMMU_HASH_UNLOCK(hmebp); 9018 } 9019 if (hmebp++ == &khme_hash[KHMEHASH_SZ]) 9020 hmebp = khme_hash; 9021 } 9022 sfmmu_hblks_list_purge(&list, 0); 9023 } 9024 9025 /* 9026 * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface. 9027 * same goes for sfmmu_get_addrvcolor(). 9028 * 9029 * This function will return the virtual color for the specified page. The 9030 * virtual color corresponds to this page current mapping or its last mapping. 9031 * It is used by memory allocators to choose addresses with the correct 9032 * alignment so vac consistency is automatically maintained. If the page 9033 * has no color it returns -1. 9034 */ 9035 /*ARGSUSED*/ 9036 int 9037 sfmmu_get_ppvcolor(struct page *pp) 9038 { 9039 #ifdef VAC 9040 int color; 9041 9042 if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) { 9043 return (-1); 9044 } 9045 color = PP_GET_VCOLOR(pp); 9046 ASSERT(color < mmu_btop(shm_alignment)); 9047 return (color); 9048 #else 9049 return (-1); 9050 #endif /* VAC */ 9051 } 9052 9053 /* 9054 * This function will return the desired alignment for vac consistency 9055 * (vac color) given a virtual address. If no vac is present it returns -1. 9056 */ 9057 /*ARGSUSED*/ 9058 int 9059 sfmmu_get_addrvcolor(caddr_t vaddr) 9060 { 9061 #ifdef VAC 9062 if (cache & CACHE_VAC) { 9063 return (addr_to_vcolor(vaddr)); 9064 } else { 9065 return (-1); 9066 } 9067 #else 9068 return (-1); 9069 #endif /* VAC */ 9070 } 9071 9072 #ifdef VAC 9073 /* 9074 * Check for conflicts. 9075 * A conflict exists if the new and existent mappings do not match in 9076 * their "shm_alignment fields. If conflicts exist, the existant mappings 9077 * are flushed unless one of them is locked. If one of them is locked, then 9078 * the mappings are flushed and converted to non-cacheable mappings. 9079 */ 9080 static void 9081 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp) 9082 { 9083 struct hat *tmphat; 9084 struct sf_hment *sfhmep, *tmphme = NULL; 9085 struct hme_blk *hmeblkp; 9086 int vcolor; 9087 tte_t tte; 9088 9089 ASSERT(sfmmu_mlist_held(pp)); 9090 ASSERT(!PP_ISNC(pp)); /* page better be cacheable */ 9091 9092 vcolor = addr_to_vcolor(addr); 9093 if (PP_NEWPAGE(pp)) { 9094 PP_SET_VCOLOR(pp, vcolor); 9095 return; 9096 } 9097 9098 if (PP_GET_VCOLOR(pp) == vcolor) { 9099 return; 9100 } 9101 9102 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) { 9103 /* 9104 * Previous user of page had a different color 9105 * but since there are no current users 9106 * we just flush the cache and change the color. 9107 */ 9108 SFMMU_STAT(sf_pgcolor_conflict); 9109 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp)); 9110 PP_SET_VCOLOR(pp, vcolor); 9111 return; 9112 } 9113 9114 /* 9115 * If we get here we have a vac conflict with a current 9116 * mapping. VAC conflict policy is as follows. 9117 * - The default is to unload the other mappings unless: 9118 * - If we have a large mapping we uncache the page. 9119 * We need to uncache the rest of the large page too. 9120 * - If any of the mappings are locked we uncache the page. 9121 * - If the requested mapping is inconsistent 9122 * with another mapping and that mapping 9123 * is in the same address space we have to 9124 * make it non-cached. The default thing 9125 * to do is unload the inconsistent mapping 9126 * but if they are in the same address space 9127 * we run the risk of unmapping the pc or the 9128 * stack which we will use as we return to the user, 9129 * in which case we can then fault on the thing 9130 * we just unloaded and get into an infinite loop. 9131 */ 9132 if (PP_ISMAPPED_LARGE(pp)) { 9133 int sz; 9134 9135 /* 9136 * Existing mapping is for big pages. We don't unload 9137 * existing big mappings to satisfy new mappings. 9138 * Always convert all mappings to TNC. 9139 */ 9140 sz = fnd_mapping_sz(pp); 9141 pp = PP_GROUPLEADER(pp, sz); 9142 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz)); 9143 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 9144 TTEPAGES(sz)); 9145 9146 return; 9147 } 9148 9149 /* 9150 * check if any mapping is in same as or if it is locked 9151 * since in that case we need to uncache. 9152 */ 9153 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) { 9154 tmphme = sfhmep->hme_next; 9155 if (IS_PAHME(sfhmep)) 9156 continue; 9157 hmeblkp = sfmmu_hmetohblk(sfhmep); 9158 tmphat = hblktosfmmu(hmeblkp); 9159 sfmmu_copytte(&sfhmep->hme_tte, &tte); 9160 ASSERT(TTE_IS_VALID(&tte)); 9161 if (hmeblkp->hblk_shared || tmphat == hat || 9162 hmeblkp->hblk_lckcnt) { 9163 /* 9164 * We have an uncache conflict 9165 */ 9166 SFMMU_STAT(sf_uncache_conflict); 9167 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1); 9168 return; 9169 } 9170 } 9171 9172 /* 9173 * We have an unload conflict 9174 * We have already checked for LARGE mappings, therefore 9175 * the remaining mapping(s) must be TTE8K. 9176 */ 9177 SFMMU_STAT(sf_unload_conflict); 9178 9179 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) { 9180 tmphme = sfhmep->hme_next; 9181 if (IS_PAHME(sfhmep)) 9182 continue; 9183 hmeblkp = sfmmu_hmetohblk(sfhmep); 9184 ASSERT(!hmeblkp->hblk_shared); 9185 (void) sfmmu_pageunload(pp, sfhmep, TTE8K); 9186 } 9187 9188 if (PP_ISMAPPED_KPM(pp)) 9189 sfmmu_kpm_vac_unload(pp, addr); 9190 9191 /* 9192 * Unloads only do TLB flushes so we need to flush the 9193 * cache here. 9194 */ 9195 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp)); 9196 PP_SET_VCOLOR(pp, vcolor); 9197 } 9198 9199 /* 9200 * Whenever a mapping is unloaded and the page is in TNC state, 9201 * we see if the page can be made cacheable again. 'pp' is 9202 * the page that we just unloaded a mapping from, the size 9203 * of mapping that was unloaded is 'ottesz'. 9204 * Remark: 9205 * The recache policy for mpss pages can leave a performance problem 9206 * under the following circumstances: 9207 * . A large page in uncached mode has just been unmapped. 9208 * . All constituent pages are TNC due to a conflicting small mapping. 9209 * . There are many other, non conflicting, small mappings around for 9210 * a lot of the constituent pages. 9211 * . We're called w/ the "old" groupleader page and the old ottesz, 9212 * but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so 9213 * we end up w/ TTE8K or npages == 1. 9214 * . We call tst_tnc w/ the old groupleader only, and if there is no 9215 * conflict, we re-cache only this page. 9216 * . All other small mappings are not checked and will be left in TNC mode. 9217 * The problem is not very serious because: 9218 * . mpss is actually only defined for heap and stack, so the probability 9219 * is not very high that a large page mapping exists in parallel to a small 9220 * one (this is possible, but seems to be bad programming style in the 9221 * appl). 9222 * . The problem gets a little bit more serious, when those TNC pages 9223 * have to be mapped into kernel space, e.g. for networking. 9224 * . When VAC alias conflicts occur in applications, this is regarded 9225 * as an application bug. So if kstat's show them, the appl should 9226 * be changed anyway. 9227 */ 9228 void 9229 conv_tnc(page_t *pp, int ottesz) 9230 { 9231 int cursz, dosz; 9232 pgcnt_t curnpgs, dopgs; 9233 pgcnt_t pg64k; 9234 page_t *pp2; 9235 9236 /* 9237 * Determine how big a range we check for TNC and find 9238 * leader page. cursz is the size of the biggest 9239 * mapping that still exist on 'pp'. 9240 */ 9241 if (PP_ISMAPPED_LARGE(pp)) { 9242 cursz = fnd_mapping_sz(pp); 9243 } else { 9244 cursz = TTE8K; 9245 } 9246 9247 if (ottesz >= cursz) { 9248 dosz = ottesz; 9249 pp2 = pp; 9250 } else { 9251 dosz = cursz; 9252 pp2 = PP_GROUPLEADER(pp, dosz); 9253 } 9254 9255 pg64k = TTEPAGES(TTE64K); 9256 dopgs = TTEPAGES(dosz); 9257 9258 ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0)); 9259 9260 while (dopgs != 0) { 9261 curnpgs = TTEPAGES(cursz); 9262 if (tst_tnc(pp2, curnpgs)) { 9263 SFMMU_STAT_ADD(sf_recache, curnpgs); 9264 sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH, 9265 curnpgs); 9266 } 9267 9268 ASSERT(dopgs >= curnpgs); 9269 dopgs -= curnpgs; 9270 9271 if (dopgs == 0) { 9272 break; 9273 } 9274 9275 pp2 = PP_PAGENEXT_N(pp2, curnpgs); 9276 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) { 9277 cursz = fnd_mapping_sz(pp2); 9278 } else { 9279 cursz = TTE8K; 9280 } 9281 } 9282 } 9283 9284 /* 9285 * Returns 1 if page(s) can be converted from TNC to cacheable setting, 9286 * returns 0 otherwise. Note that oaddr argument is valid for only 9287 * 8k pages. 9288 */ 9289 int 9290 tst_tnc(page_t *pp, pgcnt_t npages) 9291 { 9292 struct sf_hment *sfhme; 9293 struct hme_blk *hmeblkp; 9294 tte_t tte; 9295 caddr_t vaddr; 9296 int clr_valid = 0; 9297 int color, color1, bcolor; 9298 int i, ncolors; 9299 9300 ASSERT(pp != NULL); 9301 ASSERT(!(cache & CACHE_WRITEBACK)); 9302 9303 if (npages > 1) { 9304 ncolors = CACHE_NUM_COLOR; 9305 } 9306 9307 for (i = 0; i < npages; i++) { 9308 ASSERT(sfmmu_mlist_held(pp)); 9309 ASSERT(PP_ISTNC(pp)); 9310 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR); 9311 9312 if (PP_ISPNC(pp)) { 9313 return (0); 9314 } 9315 9316 clr_valid = 0; 9317 if (PP_ISMAPPED_KPM(pp)) { 9318 caddr_t kpmvaddr; 9319 9320 ASSERT(kpm_enable); 9321 kpmvaddr = hat_kpm_page2va(pp, 1); 9322 ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr))); 9323 color1 = addr_to_vcolor(kpmvaddr); 9324 clr_valid = 1; 9325 } 9326 9327 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) { 9328 if (IS_PAHME(sfhme)) 9329 continue; 9330 hmeblkp = sfmmu_hmetohblk(sfhme); 9331 9332 sfmmu_copytte(&sfhme->hme_tte, &tte); 9333 ASSERT(TTE_IS_VALID(&tte)); 9334 9335 vaddr = tte_to_vaddr(hmeblkp, tte); 9336 color = addr_to_vcolor(vaddr); 9337 9338 if (npages > 1) { 9339 /* 9340 * If there is a big mapping, make sure 9341 * 8K mapping is consistent with the big 9342 * mapping. 9343 */ 9344 bcolor = i % ncolors; 9345 if (color != bcolor) { 9346 return (0); 9347 } 9348 } 9349 if (!clr_valid) { 9350 clr_valid = 1; 9351 color1 = color; 9352 } 9353 9354 if (color1 != color) { 9355 return (0); 9356 } 9357 } 9358 9359 pp = PP_PAGENEXT(pp); 9360 } 9361 9362 return (1); 9363 } 9364 9365 void 9366 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag, 9367 pgcnt_t npages) 9368 { 9369 kmutex_t *pmtx; 9370 int i, ncolors, bcolor; 9371 kpm_hlk_t *kpmp; 9372 cpuset_t cpuset; 9373 9374 ASSERT(pp != NULL); 9375 ASSERT(!(cache & CACHE_WRITEBACK)); 9376 9377 kpmp = sfmmu_kpm_kpmp_enter(pp, npages); 9378 pmtx = sfmmu_page_enter(pp); 9379 9380 /* 9381 * Fast path caching single unmapped page 9382 */ 9383 if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) && 9384 flags == HAT_CACHE) { 9385 PP_CLRTNC(pp); 9386 PP_CLRPNC(pp); 9387 sfmmu_page_exit(pmtx); 9388 sfmmu_kpm_kpmp_exit(kpmp); 9389 return; 9390 } 9391 9392 /* 9393 * We need to capture all cpus in order to change cacheability 9394 * because we can't allow one cpu to access the same physical 9395 * page using a cacheable and a non-cachebale mapping at the same 9396 * time. Since we may end up walking the ism mapping list 9397 * have to grab it's lock now since we can't after all the 9398 * cpus have been captured. 9399 */ 9400 sfmmu_hat_lock_all(); 9401 mutex_enter(&ism_mlist_lock); 9402 kpreempt_disable(); 9403 cpuset = cpu_ready_set; 9404 xc_attention(cpuset); 9405 9406 if (npages > 1) { 9407 /* 9408 * Make sure all colors are flushed since the 9409 * sfmmu_page_cache() only flushes one color- 9410 * it does not know big pages. 9411 */ 9412 ncolors = CACHE_NUM_COLOR; 9413 if (flags & HAT_TMPNC) { 9414 for (i = 0; i < ncolors; i++) { 9415 sfmmu_cache_flushcolor(i, pp->p_pagenum); 9416 } 9417 cache_flush_flag = CACHE_NO_FLUSH; 9418 } 9419 } 9420 9421 for (i = 0; i < npages; i++) { 9422 9423 ASSERT(sfmmu_mlist_held(pp)); 9424 9425 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) { 9426 9427 if (npages > 1) { 9428 bcolor = i % ncolors; 9429 } else { 9430 bcolor = NO_VCOLOR; 9431 } 9432 9433 sfmmu_page_cache(pp, flags, cache_flush_flag, 9434 bcolor); 9435 } 9436 9437 pp = PP_PAGENEXT(pp); 9438 } 9439 9440 xt_sync(cpuset); 9441 xc_dismissed(cpuset); 9442 mutex_exit(&ism_mlist_lock); 9443 sfmmu_hat_unlock_all(); 9444 sfmmu_page_exit(pmtx); 9445 sfmmu_kpm_kpmp_exit(kpmp); 9446 kpreempt_enable(); 9447 } 9448 9449 /* 9450 * This function changes the virtual cacheability of all mappings to a 9451 * particular page. When changing from uncache to cacheable the mappings will 9452 * only be changed if all of them have the same virtual color. 9453 * We need to flush the cache in all cpus. It is possible that 9454 * a process referenced a page as cacheable but has sinced exited 9455 * and cleared the mapping list. We still to flush it but have no 9456 * state so all cpus is the only alternative. 9457 */ 9458 static void 9459 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor) 9460 { 9461 struct sf_hment *sfhme; 9462 struct hme_blk *hmeblkp; 9463 sfmmu_t *sfmmup; 9464 tte_t tte, ttemod; 9465 caddr_t vaddr; 9466 int ret, color; 9467 pfn_t pfn; 9468 9469 color = bcolor; 9470 pfn = pp->p_pagenum; 9471 9472 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) { 9473 9474 if (IS_PAHME(sfhme)) 9475 continue; 9476 hmeblkp = sfmmu_hmetohblk(sfhme); 9477 9478 sfmmu_copytte(&sfhme->hme_tte, &tte); 9479 ASSERT(TTE_IS_VALID(&tte)); 9480 vaddr = tte_to_vaddr(hmeblkp, tte); 9481 color = addr_to_vcolor(vaddr); 9482 9483 #ifdef DEBUG 9484 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) { 9485 ASSERT(color == bcolor); 9486 } 9487 #endif 9488 9489 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp)); 9490 9491 ttemod = tte; 9492 if (flags & (HAT_UNCACHE | HAT_TMPNC)) { 9493 TTE_CLR_VCACHEABLE(&ttemod); 9494 } else { /* flags & HAT_CACHE */ 9495 TTE_SET_VCACHEABLE(&ttemod); 9496 } 9497 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte); 9498 if (ret < 0) { 9499 /* 9500 * Since all cpus are captured modifytte should not 9501 * fail. 9502 */ 9503 panic("sfmmu_page_cache: write to tte failed"); 9504 } 9505 9506 sfmmup = hblktosfmmu(hmeblkp); 9507 if (cache_flush_flag == CACHE_FLUSH) { 9508 /* 9509 * Flush TSBs, TLBs and caches 9510 */ 9511 if (hmeblkp->hblk_shared) { 9512 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 9513 uint_t rid = hmeblkp->hblk_tag.htag_rid; 9514 sf_region_t *rgnp; 9515 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 9516 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 9517 ASSERT(srdp != NULL); 9518 rgnp = srdp->srd_hmergnp[rid]; 9519 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 9520 srdp, rgnp, rid); 9521 (void) sfmmu_rgntlb_demap(vaddr, rgnp, 9522 hmeblkp, 0); 9523 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr)); 9524 } else if (sfmmup->sfmmu_ismhat) { 9525 if (flags & HAT_CACHE) { 9526 SFMMU_STAT(sf_ism_recache); 9527 } else { 9528 SFMMU_STAT(sf_ism_uncache); 9529 } 9530 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp, 9531 pfn, CACHE_FLUSH); 9532 } else { 9533 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp, 9534 pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1); 9535 } 9536 9537 /* 9538 * all cache entries belonging to this pfn are 9539 * now flushed. 9540 */ 9541 cache_flush_flag = CACHE_NO_FLUSH; 9542 } else { 9543 /* 9544 * Flush only TSBs and TLBs. 9545 */ 9546 if (hmeblkp->hblk_shared) { 9547 sf_srd_t *srdp = (sf_srd_t *)sfmmup; 9548 uint_t rid = hmeblkp->hblk_tag.htag_rid; 9549 sf_region_t *rgnp; 9550 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 9551 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 9552 ASSERT(srdp != NULL); 9553 rgnp = srdp->srd_hmergnp[rid]; 9554 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, 9555 srdp, rgnp, rid); 9556 (void) sfmmu_rgntlb_demap(vaddr, rgnp, 9557 hmeblkp, 0); 9558 } else if (sfmmup->sfmmu_ismhat) { 9559 if (flags & HAT_CACHE) { 9560 SFMMU_STAT(sf_ism_recache); 9561 } else { 9562 SFMMU_STAT(sf_ism_uncache); 9563 } 9564 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp, 9565 pfn, CACHE_NO_FLUSH); 9566 } else { 9567 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1); 9568 } 9569 } 9570 } 9571 9572 if (PP_ISMAPPED_KPM(pp)) 9573 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag); 9574 9575 switch (flags) { 9576 9577 default: 9578 panic("sfmmu_pagecache: unknown flags"); 9579 break; 9580 9581 case HAT_CACHE: 9582 PP_CLRTNC(pp); 9583 PP_CLRPNC(pp); 9584 PP_SET_VCOLOR(pp, color); 9585 break; 9586 9587 case HAT_TMPNC: 9588 PP_SETTNC(pp); 9589 PP_SET_VCOLOR(pp, NO_VCOLOR); 9590 break; 9591 9592 case HAT_UNCACHE: 9593 PP_SETPNC(pp); 9594 PP_CLRTNC(pp); 9595 PP_SET_VCOLOR(pp, NO_VCOLOR); 9596 break; 9597 } 9598 } 9599 #endif /* VAC */ 9600 9601 9602 /* 9603 * Wrapper routine used to return a context. 9604 * 9605 * It's the responsibility of the caller to guarantee that the 9606 * process serializes on calls here by taking the HAT lock for 9607 * the hat. 9608 * 9609 */ 9610 static void 9611 sfmmu_get_ctx(sfmmu_t *sfmmup) 9612 { 9613 mmu_ctx_t *mmu_ctxp; 9614 uint_t pstate_save; 9615 int ret; 9616 9617 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9618 ASSERT(sfmmup != ksfmmup); 9619 9620 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) { 9621 sfmmu_setup_tsbinfo(sfmmup); 9622 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID); 9623 } 9624 9625 kpreempt_disable(); 9626 9627 mmu_ctxp = CPU_MMU_CTXP(CPU); 9628 ASSERT(mmu_ctxp); 9629 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms); 9630 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]); 9631 9632 /* 9633 * Do a wrap-around if cnum reaches the max # cnum supported by a MMU. 9634 */ 9635 if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs) 9636 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE); 9637 9638 /* 9639 * Let the MMU set up the page sizes to use for 9640 * this context in the TLB. Don't program 2nd dtlb for ism hat. 9641 */ 9642 if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) { 9643 mmu_set_ctx_page_sizes(sfmmup); 9644 } 9645 9646 /* 9647 * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with 9648 * interrupts disabled to prevent race condition with wrap-around 9649 * ctx invalidatation. In sun4v, ctx invalidation also involves 9650 * a HV call to set the number of TSBs to 0. If interrupts are not 9651 * disabled until after sfmmu_load_mmustate is complete TSBs may 9652 * become assigned to INVALID_CONTEXT. This is not allowed. 9653 */ 9654 pstate_save = sfmmu_disable_intrs(); 9655 9656 if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) && 9657 sfmmup->sfmmu_scdp != NULL) { 9658 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 9659 sfmmu_t *scsfmmup = scdp->scd_sfmmup; 9660 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED); 9661 /* debug purpose only */ 9662 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum 9663 != INVALID_CONTEXT); 9664 } 9665 sfmmu_load_mmustate(sfmmup); 9666 9667 sfmmu_enable_intrs(pstate_save); 9668 9669 kpreempt_enable(); 9670 } 9671 9672 /* 9673 * When all cnums are used up in a MMU, cnum will wrap around to the 9674 * next generation and start from 2. 9675 */ 9676 static void 9677 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum) 9678 { 9679 9680 /* caller must have disabled the preemption */ 9681 ASSERT(curthread->t_preempt >= 1); 9682 ASSERT(mmu_ctxp != NULL); 9683 9684 /* acquire Per-MMU (PM) spin lock */ 9685 mutex_enter(&mmu_ctxp->mmu_lock); 9686 9687 /* re-check to see if wrap-around is needed */ 9688 if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs) 9689 goto done; 9690 9691 SFMMU_MMU_STAT(mmu_wrap_around); 9692 9693 /* update gnum */ 9694 ASSERT(mmu_ctxp->mmu_gnum != 0); 9695 mmu_ctxp->mmu_gnum++; 9696 if (mmu_ctxp->mmu_gnum == 0 || 9697 mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) { 9698 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.", 9699 (void *)mmu_ctxp); 9700 } 9701 9702 if (mmu_ctxp->mmu_ncpus > 1) { 9703 cpuset_t cpuset; 9704 9705 membar_enter(); /* make sure updated gnum visible */ 9706 9707 SFMMU_XCALL_STATS(NULL); 9708 9709 /* xcall to others on the same MMU to invalidate ctx */ 9710 cpuset = mmu_ctxp->mmu_cpuset; 9711 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum); 9712 CPUSET_DEL(cpuset, CPU->cpu_id); 9713 CPUSET_AND(cpuset, cpu_ready_set); 9714 9715 /* 9716 * Pass in INVALID_CONTEXT as the first parameter to 9717 * sfmmu_raise_tsb_exception, which invalidates the context 9718 * of any process running on the CPUs in the MMU. 9719 */ 9720 xt_some(cpuset, sfmmu_raise_tsb_exception, 9721 INVALID_CONTEXT, INVALID_CONTEXT); 9722 xt_sync(cpuset); 9723 9724 SFMMU_MMU_STAT(mmu_tsb_raise_exception); 9725 } 9726 9727 if (sfmmu_getctx_sec() != INVALID_CONTEXT) { 9728 sfmmu_setctx_sec(INVALID_CONTEXT); 9729 sfmmu_clear_utsbinfo(); 9730 } 9731 9732 /* 9733 * No xcall is needed here. For sun4u systems all CPUs in context 9734 * domain share a single physical MMU therefore it's enough to flush 9735 * TLB on local CPU. On sun4v systems we use 1 global context 9736 * domain and flush all remote TLBs in sfmmu_raise_tsb_exception 9737 * handler. Note that vtag_flushall_uctxs() is called 9738 * for Ultra II machine, where the equivalent flushall functionality 9739 * is implemented in SW, and only user ctx TLB entries are flushed. 9740 */ 9741 if (&vtag_flushall_uctxs != NULL) { 9742 vtag_flushall_uctxs(); 9743 } else { 9744 vtag_flushall(); 9745 } 9746 9747 /* reset mmu cnum, skips cnum 0 and 1 */ 9748 if (reset_cnum == B_TRUE) 9749 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS; 9750 9751 done: 9752 mutex_exit(&mmu_ctxp->mmu_lock); 9753 } 9754 9755 9756 /* 9757 * For multi-threaded process, set the process context to INVALID_CONTEXT 9758 * so that it faults and reloads the MMU state from TL=0. For single-threaded 9759 * process, we can just load the MMU state directly without having to 9760 * set context invalid. Caller must hold the hat lock since we don't 9761 * acquire it here. 9762 */ 9763 static void 9764 sfmmu_sync_mmustate(sfmmu_t *sfmmup) 9765 { 9766 uint_t cnum; 9767 uint_t pstate_save; 9768 9769 ASSERT(sfmmup != ksfmmup); 9770 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9771 9772 kpreempt_disable(); 9773 9774 /* 9775 * We check whether the pass'ed-in sfmmup is the same as the 9776 * current running proc. This is to makes sure the current proc 9777 * stays single-threaded if it already is. 9778 */ 9779 if ((sfmmup == curthread->t_procp->p_as->a_hat) && 9780 (curthread->t_procp->p_lwpcnt == 1)) { 9781 /* single-thread */ 9782 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum; 9783 if (cnum != INVALID_CONTEXT) { 9784 uint_t curcnum; 9785 /* 9786 * Disable interrupts to prevent race condition 9787 * with sfmmu_ctx_wrap_around ctx invalidation. 9788 * In sun4v, ctx invalidation involves setting 9789 * TSB to NULL, hence, interrupts should be disabled 9790 * untill after sfmmu_load_mmustate is completed. 9791 */ 9792 pstate_save = sfmmu_disable_intrs(); 9793 curcnum = sfmmu_getctx_sec(); 9794 if (curcnum == cnum) 9795 sfmmu_load_mmustate(sfmmup); 9796 sfmmu_enable_intrs(pstate_save); 9797 ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT); 9798 } 9799 } else { 9800 /* 9801 * multi-thread 9802 * or when sfmmup is not the same as the curproc. 9803 */ 9804 sfmmu_invalidate_ctx(sfmmup); 9805 } 9806 9807 kpreempt_enable(); 9808 } 9809 9810 9811 /* 9812 * Replace the specified TSB with a new TSB. This function gets called when 9813 * we grow, shrink or swapin a TSB. When swapping in a TSB (TSB_SWAPIN), the 9814 * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB 9815 * (8K). 9816 * 9817 * Caller must hold the HAT lock, but should assume any tsb_info 9818 * pointers it has are no longer valid after calling this function. 9819 * 9820 * Return values: 9821 * TSB_ALLOCFAIL Failed to allocate a TSB, due to memory constraints 9822 * TSB_LOSTRACE HAT is busy, i.e. another thread is already doing 9823 * something to this tsbinfo/TSB 9824 * TSB_SUCCESS Operation succeeded 9825 */ 9826 static tsb_replace_rc_t 9827 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc, 9828 hatlock_t *hatlockp, uint_t flags) 9829 { 9830 struct tsb_info *new_tsbinfo = NULL; 9831 struct tsb_info *curtsb, *prevtsb; 9832 uint_t tte_sz_mask; 9833 int i; 9834 9835 ASSERT(sfmmup != ksfmmup); 9836 ASSERT(sfmmup->sfmmu_ismhat == 0); 9837 ASSERT(sfmmu_hat_lock_held(sfmmup)); 9838 ASSERT(szc <= tsb_max_growsize); 9839 9840 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY)) 9841 return (TSB_LOSTRACE); 9842 9843 /* 9844 * Find the tsb_info ahead of this one in the list, and 9845 * also make sure that the tsb_info passed in really 9846 * exists! 9847 */ 9848 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb; 9849 curtsb != old_tsbinfo && curtsb != NULL; 9850 prevtsb = curtsb, curtsb = curtsb->tsb_next) 9851 ; 9852 ASSERT(curtsb != NULL); 9853 9854 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 9855 /* 9856 * The process is swapped out, so just set the new size 9857 * code. When it swaps back in, we'll allocate a new one 9858 * of the new chosen size. 9859 */ 9860 curtsb->tsb_szc = szc; 9861 return (TSB_SUCCESS); 9862 } 9863 SFMMU_FLAGS_SET(sfmmup, HAT_BUSY); 9864 9865 tte_sz_mask = old_tsbinfo->tsb_ttesz_mask; 9866 9867 /* 9868 * All initialization is done inside of sfmmu_tsbinfo_alloc(). 9869 * If we fail to allocate a TSB, exit. 9870 * 9871 * If tsb grows with new tsb size > 4M and old tsb size < 4M, 9872 * then try 4M slab after the initial alloc fails. 9873 * 9874 * If tsb swapin with tsb size > 4M, then try 4M after the 9875 * initial alloc fails. 9876 */ 9877 sfmmu_hat_exit(hatlockp); 9878 if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc, 9879 tte_sz_mask, flags, sfmmup) && 9880 (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) || 9881 (!(flags & TSB_SWAPIN) && 9882 (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) || 9883 sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE, 9884 tte_sz_mask, flags, sfmmup))) { 9885 (void) sfmmu_hat_enter(sfmmup); 9886 if (!(flags & TSB_SWAPIN)) 9887 SFMMU_STAT(sf_tsb_resize_failures); 9888 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9889 return (TSB_ALLOCFAIL); 9890 } 9891 (void) sfmmu_hat_enter(sfmmup); 9892 9893 /* 9894 * Re-check to make sure somebody else didn't muck with us while we 9895 * didn't hold the HAT lock. If the process swapped out, fine, just 9896 * exit; this can happen if we try to shrink the TSB from the context 9897 * of another process (such as on an ISM unmap), though it is rare. 9898 */ 9899 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 9900 SFMMU_STAT(sf_tsb_resize_failures); 9901 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9902 sfmmu_hat_exit(hatlockp); 9903 sfmmu_tsbinfo_free(new_tsbinfo); 9904 (void) sfmmu_hat_enter(sfmmup); 9905 return (TSB_LOSTRACE); 9906 } 9907 9908 #ifdef DEBUG 9909 /* Reverify that the tsb_info still exists.. for debugging only */ 9910 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb; 9911 curtsb != old_tsbinfo && curtsb != NULL; 9912 prevtsb = curtsb, curtsb = curtsb->tsb_next) 9913 ; 9914 ASSERT(curtsb != NULL); 9915 #endif /* DEBUG */ 9916 9917 /* 9918 * Quiesce any CPUs running this process on their next TLB miss 9919 * so they atomically see the new tsb_info. We temporarily set the 9920 * context to invalid context so new threads that come on processor 9921 * after we do the xcall to cpusran will also serialize behind the 9922 * HAT lock on TLB miss and will see the new TSB. Since this short 9923 * race with a new thread coming on processor is relatively rare, 9924 * this synchronization mechanism should be cheaper than always 9925 * pausing all CPUs for the duration of the setup, which is what 9926 * the old implementation did. This is particuarly true if we are 9927 * copying a huge chunk of memory around during that window. 9928 * 9929 * The memory barriers are to make sure things stay consistent 9930 * with resume() since it does not hold the HAT lock while 9931 * walking the list of tsb_info structures. 9932 */ 9933 if ((flags & TSB_SWAPIN) != TSB_SWAPIN) { 9934 /* The TSB is either growing or shrinking. */ 9935 sfmmu_invalidate_ctx(sfmmup); 9936 } else { 9937 /* 9938 * It is illegal to swap in TSBs from a process other 9939 * than a process being swapped in. This in turn 9940 * implies we do not have a valid MMU context here 9941 * since a process needs one to resolve translation 9942 * misses. 9943 */ 9944 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup); 9945 } 9946 9947 #ifdef DEBUG 9948 ASSERT(max_mmu_ctxdoms > 0); 9949 9950 /* 9951 * Process should have INVALID_CONTEXT on all MMUs 9952 */ 9953 for (i = 0; i < max_mmu_ctxdoms; i++) { 9954 9955 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT); 9956 } 9957 #endif 9958 9959 new_tsbinfo->tsb_next = old_tsbinfo->tsb_next; 9960 membar_stst(); /* strict ordering required */ 9961 if (prevtsb) 9962 prevtsb->tsb_next = new_tsbinfo; 9963 else 9964 sfmmup->sfmmu_tsb = new_tsbinfo; 9965 membar_enter(); /* make sure new TSB globally visible */ 9966 9967 /* 9968 * We need to migrate TSB entries from the old TSB to the new TSB 9969 * if tsb_remap_ttes is set and the TSB is growing. 9970 */ 9971 if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW)) 9972 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo); 9973 9974 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY); 9975 9976 /* 9977 * Drop the HAT lock to free our old tsb_info. 9978 */ 9979 sfmmu_hat_exit(hatlockp); 9980 9981 if ((flags & TSB_GROW) == TSB_GROW) { 9982 SFMMU_STAT(sf_tsb_grow); 9983 } else if ((flags & TSB_SHRINK) == TSB_SHRINK) { 9984 SFMMU_STAT(sf_tsb_shrink); 9985 } 9986 9987 sfmmu_tsbinfo_free(old_tsbinfo); 9988 9989 (void) sfmmu_hat_enter(sfmmup); 9990 return (TSB_SUCCESS); 9991 } 9992 9993 /* 9994 * This function will re-program hat pgsz array, and invalidate the 9995 * process' context, forcing the process to switch to another 9996 * context on the next TLB miss, and therefore start using the 9997 * TLB that is reprogrammed for the new page sizes. 9998 */ 9999 void 10000 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz) 10001 { 10002 int i; 10003 hatlock_t *hatlockp = NULL; 10004 10005 hatlockp = sfmmu_hat_enter(sfmmup); 10006 /* USIII+-IV+ optimization, requires hat lock */ 10007 if (tmp_pgsz) { 10008 for (i = 0; i < mmu_page_sizes; i++) 10009 sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i]; 10010 } 10011 SFMMU_STAT(sf_tlb_reprog_pgsz); 10012 10013 sfmmu_invalidate_ctx(sfmmup); 10014 10015 sfmmu_hat_exit(hatlockp); 10016 } 10017 10018 /* 10019 * The scd_rttecnt field in the SCD must be updated to take account of the 10020 * regions which it contains. 10021 */ 10022 static void 10023 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp) 10024 { 10025 uint_t rid; 10026 uint_t i, j; 10027 ulong_t w; 10028 sf_region_t *rgnp; 10029 10030 ASSERT(srdp != NULL); 10031 10032 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 10033 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 10034 continue; 10035 } 10036 10037 j = 0; 10038 while (w) { 10039 if (!(w & 0x1)) { 10040 j++; 10041 w >>= 1; 10042 continue; 10043 } 10044 rid = (i << BT_ULSHIFT) | j; 10045 j++; 10046 w >>= 1; 10047 10048 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 10049 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 10050 rgnp = srdp->srd_hmergnp[rid]; 10051 ASSERT(rgnp->rgn_refcnt > 0); 10052 ASSERT(rgnp->rgn_id == rid); 10053 10054 scdp->scd_rttecnt[rgnp->rgn_pgszc] += 10055 rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc); 10056 10057 /* 10058 * Maintain the tsb0 inflation cnt for the regions 10059 * in the SCD. 10060 */ 10061 if (rgnp->rgn_pgszc >= TTE4M) { 10062 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt += 10063 rgnp->rgn_size >> 10064 (TTE_PAGE_SHIFT(TTE8K) + 2); 10065 } 10066 } 10067 } 10068 } 10069 10070 /* 10071 * This function assumes that there are either four or six supported page 10072 * sizes and at most two programmable TLBs, so we need to decide which 10073 * page sizes are most important and then tell the MMU layer so it 10074 * can adjust the TLB page sizes accordingly (if supported). 10075 * 10076 * If these assumptions change, this function will need to be 10077 * updated to support whatever the new limits are. 10078 * 10079 * The growing flag is nonzero if we are growing the address space, 10080 * and zero if it is shrinking. This allows us to decide whether 10081 * to grow or shrink our TSB, depending upon available memory 10082 * conditions. 10083 */ 10084 static void 10085 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing) 10086 { 10087 uint64_t ttecnt[MMU_PAGE_SIZES]; 10088 uint64_t tte8k_cnt, tte4m_cnt; 10089 uint8_t i; 10090 int sectsb_thresh; 10091 10092 /* 10093 * Kernel threads, processes with small address spaces not using 10094 * large pages, and dummy ISM HATs need not apply. 10095 */ 10096 if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL) 10097 return; 10098 10099 if (!SFMMU_LGPGS_INUSE(sfmmup) && 10100 sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor) 10101 return; 10102 10103 for (i = 0; i < mmu_page_sizes; i++) { 10104 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] + 10105 sfmmup->sfmmu_ismttecnt[i]; 10106 } 10107 10108 /* Check pagesizes in use, and possibly reprogram DTLB. */ 10109 if (&mmu_check_page_sizes) 10110 mmu_check_page_sizes(sfmmup, ttecnt); 10111 10112 /* 10113 * Calculate the number of 8k ttes to represent the span of these 10114 * pages. 10115 */ 10116 tte8k_cnt = ttecnt[TTE8K] + 10117 (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) + 10118 (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT)); 10119 if (mmu_page_sizes == max_mmu_page_sizes) { 10120 tte4m_cnt = ttecnt[TTE4M] + 10121 (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) + 10122 (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M)); 10123 } else { 10124 tte4m_cnt = ttecnt[TTE4M]; 10125 } 10126 10127 /* 10128 * Inflate tte8k_cnt to allow for region large page allocation failure. 10129 */ 10130 tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt; 10131 10132 /* 10133 * Inflate TSB sizes by a factor of 2 if this process 10134 * uses 4M text pages to minimize extra conflict misses 10135 * in the first TSB since without counting text pages 10136 * 8K TSB may become too small. 10137 * 10138 * Also double the size of the second TSB to minimize 10139 * extra conflict misses due to competition between 4M text pages 10140 * and data pages. 10141 * 10142 * We need to adjust the second TSB allocation threshold by the 10143 * inflation factor, since there is no point in creating a second 10144 * TSB when we know all the mappings can fit in the I/D TLBs. 10145 */ 10146 sectsb_thresh = tsb_sectsb_threshold; 10147 if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) { 10148 tte8k_cnt <<= 1; 10149 tte4m_cnt <<= 1; 10150 sectsb_thresh <<= 1; 10151 } 10152 10153 /* 10154 * Check to see if our TSB is the right size; we may need to 10155 * grow or shrink it. If the process is small, our work is 10156 * finished at this point. 10157 */ 10158 if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) { 10159 return; 10160 } 10161 sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh); 10162 } 10163 10164 static void 10165 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt, 10166 uint64_t tte4m_cnt, int sectsb_thresh) 10167 { 10168 int tsb_bits; 10169 uint_t tsb_szc; 10170 struct tsb_info *tsbinfop; 10171 hatlock_t *hatlockp = NULL; 10172 10173 hatlockp = sfmmu_hat_enter(sfmmup); 10174 ASSERT(hatlockp != NULL); 10175 tsbinfop = sfmmup->sfmmu_tsb; 10176 ASSERT(tsbinfop != NULL); 10177 10178 /* 10179 * If we're growing, select the size based on RSS. If we're 10180 * shrinking, leave some room so we don't have to turn around and 10181 * grow again immediately. 10182 */ 10183 if (growing) 10184 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt); 10185 else 10186 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1); 10187 10188 if (!growing && (tsb_szc < tsbinfop->tsb_szc) && 10189 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) { 10190 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc, 10191 hatlockp, TSB_SHRINK); 10192 } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) { 10193 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc, 10194 hatlockp, TSB_GROW); 10195 } 10196 tsbinfop = sfmmup->sfmmu_tsb; 10197 10198 /* 10199 * With the TLB and first TSB out of the way, we need to see if 10200 * we need a second TSB for 4M pages. If we managed to reprogram 10201 * the TLB page sizes above, the process will start using this new 10202 * TSB right away; otherwise, it will start using it on the next 10203 * context switch. Either way, it's no big deal so there's no 10204 * synchronization with the trap handlers here unless we grow the 10205 * TSB (in which case it's required to prevent using the old one 10206 * after it's freed). Note: second tsb is required for 32M/256M 10207 * page sizes. 10208 */ 10209 if (tte4m_cnt > sectsb_thresh) { 10210 /* 10211 * If we're growing, select the size based on RSS. If we're 10212 * shrinking, leave some room so we don't have to turn 10213 * around and grow again immediately. 10214 */ 10215 if (growing) 10216 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt); 10217 else 10218 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1); 10219 if (tsbinfop->tsb_next == NULL) { 10220 struct tsb_info *newtsb; 10221 int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)? 10222 0 : TSB_ALLOC; 10223 10224 sfmmu_hat_exit(hatlockp); 10225 10226 /* 10227 * Try to allocate a TSB for 4[32|256]M pages. If we 10228 * can't get the size we want, retry w/a minimum sized 10229 * TSB. If that still didn't work, give up; we can 10230 * still run without one. 10231 */ 10232 tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)? 10233 TSB4M|TSB32M|TSB256M:TSB4M; 10234 if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits, 10235 allocflags, sfmmup)) && 10236 (tsb_szc <= TSB_4M_SZCODE || 10237 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE, 10238 tsb_bits, allocflags, sfmmup)) && 10239 sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE, 10240 tsb_bits, allocflags, sfmmup)) { 10241 return; 10242 } 10243 10244 hatlockp = sfmmu_hat_enter(sfmmup); 10245 10246 sfmmu_invalidate_ctx(sfmmup); 10247 10248 if (sfmmup->sfmmu_tsb->tsb_next == NULL) { 10249 sfmmup->sfmmu_tsb->tsb_next = newtsb; 10250 SFMMU_STAT(sf_tsb_sectsb_create); 10251 sfmmu_hat_exit(hatlockp); 10252 return; 10253 } else { 10254 /* 10255 * It's annoying, but possible for us 10256 * to get here.. we dropped the HAT lock 10257 * because of locking order in the kmem 10258 * allocator, and while we were off getting 10259 * our memory, some other thread decided to 10260 * do us a favor and won the race to get a 10261 * second TSB for this process. Sigh. 10262 */ 10263 sfmmu_hat_exit(hatlockp); 10264 sfmmu_tsbinfo_free(newtsb); 10265 return; 10266 } 10267 } 10268 10269 /* 10270 * We have a second TSB, see if it's big enough. 10271 */ 10272 tsbinfop = tsbinfop->tsb_next; 10273 10274 /* 10275 * Check to see if our second TSB is the right size; 10276 * we may need to grow or shrink it. 10277 * To prevent thrashing (e.g. growing the TSB on a 10278 * subsequent map operation), only try to shrink if 10279 * the TSB reach exceeds twice the virtual address 10280 * space size. 10281 */ 10282 if (!growing && (tsb_szc < tsbinfop->tsb_szc) && 10283 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) { 10284 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, 10285 tsb_szc, hatlockp, TSB_SHRINK); 10286 } else if (growing && tsb_szc > tsbinfop->tsb_szc && 10287 TSB_OK_GROW()) { 10288 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, 10289 tsb_szc, hatlockp, TSB_GROW); 10290 } 10291 } 10292 10293 sfmmu_hat_exit(hatlockp); 10294 } 10295 10296 /* 10297 * Free up a sfmmu 10298 * Since the sfmmu is currently embedded in the hat struct we simply zero 10299 * out our fields and free up the ism map blk list if any. 10300 */ 10301 static void 10302 sfmmu_free_sfmmu(sfmmu_t *sfmmup) 10303 { 10304 ism_blk_t *blkp, *nx_blkp; 10305 #ifdef DEBUG 10306 ism_map_t *map; 10307 int i; 10308 #endif 10309 10310 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0); 10311 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0); 10312 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0); 10313 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0); 10314 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0); 10315 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0); 10316 ASSERT(SF_RGNMAP_ISNULL(sfmmup)); 10317 10318 sfmmup->sfmmu_free = 0; 10319 sfmmup->sfmmu_ismhat = 0; 10320 10321 blkp = sfmmup->sfmmu_iblk; 10322 sfmmup->sfmmu_iblk = NULL; 10323 10324 while (blkp) { 10325 #ifdef DEBUG 10326 map = blkp->iblk_maps; 10327 for (i = 0; i < ISM_MAP_SLOTS; i++) { 10328 ASSERT(map[i].imap_seg == 0); 10329 ASSERT(map[i].imap_ismhat == NULL); 10330 ASSERT(map[i].imap_ment == NULL); 10331 } 10332 #endif 10333 nx_blkp = blkp->iblk_next; 10334 blkp->iblk_next = NULL; 10335 blkp->iblk_nextpa = (uint64_t)-1; 10336 kmem_cache_free(ism_blk_cache, blkp); 10337 blkp = nx_blkp; 10338 } 10339 } 10340 10341 /* 10342 * Locking primitves accessed by HATLOCK macros 10343 */ 10344 10345 #define SFMMU_SPL_MTX (0x0) 10346 #define SFMMU_ML_MTX (0x1) 10347 10348 #define SFMMU_MLSPL_MTX(type, pg) (((type) == SFMMU_SPL_MTX) ? \ 10349 SPL_HASH(pg) : MLIST_HASH(pg)) 10350 10351 kmutex_t * 10352 sfmmu_page_enter(struct page *pp) 10353 { 10354 return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX)); 10355 } 10356 10357 void 10358 sfmmu_page_exit(kmutex_t *spl) 10359 { 10360 mutex_exit(spl); 10361 } 10362 10363 int 10364 sfmmu_page_spl_held(struct page *pp) 10365 { 10366 return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX)); 10367 } 10368 10369 kmutex_t * 10370 sfmmu_mlist_enter(struct page *pp) 10371 { 10372 return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX)); 10373 } 10374 10375 void 10376 sfmmu_mlist_exit(kmutex_t *mml) 10377 { 10378 mutex_exit(mml); 10379 } 10380 10381 int 10382 sfmmu_mlist_held(struct page *pp) 10383 { 10384 10385 return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX)); 10386 } 10387 10388 /* 10389 * Common code for sfmmu_mlist_enter() and sfmmu_page_enter(). For 10390 * sfmmu_mlist_enter() case mml_table lock array is used and for 10391 * sfmmu_page_enter() sfmmu_page_lock lock array is used. 10392 * 10393 * The lock is taken on a root page so that it protects an operation on all 10394 * constituent pages of a large page pp belongs to. 10395 * 10396 * The routine takes a lock from the appropriate array. The lock is determined 10397 * by hashing the root page. After taking the lock this routine checks if the 10398 * root page has the same size code that was used to determine the root (i.e 10399 * that root hasn't changed). If root page has the expected p_szc field we 10400 * have the right lock and it's returned to the caller. If root's p_szc 10401 * decreased we release the lock and retry from the beginning. This case can 10402 * happen due to hat_page_demote() decreasing p_szc between our load of p_szc 10403 * value and taking the lock. The number of retries due to p_szc decrease is 10404 * limited by the maximum p_szc value. If p_szc is 0 we return the lock 10405 * determined by hashing pp itself. 10406 * 10407 * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also 10408 * possible that p_szc can increase. To increase p_szc a thread has to lock 10409 * all constituent pages EXCL and do hat_pageunload() on all of them. All the 10410 * callers that don't hold a page locked recheck if hmeblk through which pp 10411 * was found still maps this pp. If it doesn't map it anymore returned lock 10412 * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of 10413 * p_szc increase after taking the lock it returns this lock without further 10414 * retries because in this case the caller doesn't care about which lock was 10415 * taken. The caller will drop it right away. 10416 * 10417 * After the routine returns it's guaranteed that hat_page_demote() can't 10418 * change p_szc field of any of constituent pages of a large page pp belongs 10419 * to as long as pp was either locked at least SHARED prior to this call or 10420 * the caller finds that hment that pointed to this pp still references this 10421 * pp (this also assumes that the caller holds hme hash bucket lock so that 10422 * the same pp can't be remapped into the same hmeblk after it was unmapped by 10423 * hat_pageunload()). 10424 */ 10425 static kmutex_t * 10426 sfmmu_mlspl_enter(struct page *pp, int type) 10427 { 10428 kmutex_t *mtx; 10429 uint_t prev_rszc = UINT_MAX; 10430 page_t *rootpp; 10431 uint_t szc; 10432 uint_t rszc; 10433 uint_t pszc = pp->p_szc; 10434 10435 ASSERT(pp != NULL); 10436 10437 again: 10438 if (pszc == 0) { 10439 mtx = SFMMU_MLSPL_MTX(type, pp); 10440 mutex_enter(mtx); 10441 return (mtx); 10442 } 10443 10444 /* The lock lives in the root page */ 10445 rootpp = PP_GROUPLEADER(pp, pszc); 10446 mtx = SFMMU_MLSPL_MTX(type, rootpp); 10447 mutex_enter(mtx); 10448 10449 /* 10450 * Return mml in the following 3 cases: 10451 * 10452 * 1) If pp itself is root since if its p_szc decreased before we took 10453 * the lock pp is still the root of smaller szc page. And if its p_szc 10454 * increased it doesn't matter what lock we return (see comment in 10455 * front of this routine). 10456 * 10457 * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size 10458 * large page we have the right lock since any previous potential 10459 * hat_page_demote() is done demoting from greater than current root's 10460 * p_szc because hat_page_demote() changes root's p_szc last. No 10461 * further hat_page_demote() can start or be in progress since it 10462 * would need the same lock we currently hold. 10463 * 10464 * 3) If rootpp's p_szc increased since previous iteration it doesn't 10465 * matter what lock we return (see comment in front of this routine). 10466 */ 10467 if (pp == rootpp || (rszc = rootpp->p_szc) == pszc || 10468 rszc >= prev_rszc) { 10469 return (mtx); 10470 } 10471 10472 /* 10473 * hat_page_demote() could have decreased root's p_szc. 10474 * In this case pp's p_szc must also be smaller than pszc. 10475 * Retry. 10476 */ 10477 if (rszc < pszc) { 10478 szc = pp->p_szc; 10479 if (szc < pszc) { 10480 mutex_exit(mtx); 10481 pszc = szc; 10482 goto again; 10483 } 10484 /* 10485 * pp's p_szc increased after it was decreased. 10486 * page cannot be mapped. Return current lock. The caller 10487 * will drop it right away. 10488 */ 10489 return (mtx); 10490 } 10491 10492 /* 10493 * root's p_szc is greater than pp's p_szc. 10494 * hat_page_demote() is not done with all pages 10495 * yet. Wait for it to complete. 10496 */ 10497 mutex_exit(mtx); 10498 rootpp = PP_GROUPLEADER(rootpp, rszc); 10499 mtx = SFMMU_MLSPL_MTX(type, rootpp); 10500 mutex_enter(mtx); 10501 mutex_exit(mtx); 10502 prev_rszc = rszc; 10503 goto again; 10504 } 10505 10506 static int 10507 sfmmu_mlspl_held(struct page *pp, int type) 10508 { 10509 kmutex_t *mtx; 10510 10511 ASSERT(pp != NULL); 10512 /* The lock lives in the root page */ 10513 pp = PP_PAGEROOT(pp); 10514 ASSERT(pp != NULL); 10515 10516 mtx = SFMMU_MLSPL_MTX(type, pp); 10517 return (MUTEX_HELD(mtx)); 10518 } 10519 10520 static uint_t 10521 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical) 10522 { 10523 struct hme_blk *hblkp; 10524 10525 10526 if (freehblkp != NULL) { 10527 mutex_enter(&freehblkp_lock); 10528 if (freehblkp != NULL) { 10529 /* 10530 * If the current thread is owning hblk_reserve OR 10531 * critical request from sfmmu_hblk_steal() 10532 * let it succeed even if freehblkcnt is really low. 10533 */ 10534 if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) { 10535 SFMMU_STAT(sf_get_free_throttle); 10536 mutex_exit(&freehblkp_lock); 10537 return (0); 10538 } 10539 freehblkcnt--; 10540 *hmeblkpp = freehblkp; 10541 hblkp = *hmeblkpp; 10542 freehblkp = hblkp->hblk_next; 10543 mutex_exit(&freehblkp_lock); 10544 hblkp->hblk_next = NULL; 10545 SFMMU_STAT(sf_get_free_success); 10546 10547 ASSERT(hblkp->hblk_hmecnt == 0); 10548 ASSERT(hblkp->hblk_vcnt == 0); 10549 ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp)); 10550 10551 return (1); 10552 } 10553 mutex_exit(&freehblkp_lock); 10554 } 10555 10556 /* Check cpu hblk pending queues */ 10557 if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) { 10558 hblkp = *hmeblkpp; 10559 hblkp->hblk_next = NULL; 10560 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp); 10561 10562 ASSERT(hblkp->hblk_hmecnt == 0); 10563 ASSERT(hblkp->hblk_vcnt == 0); 10564 10565 return (1); 10566 } 10567 10568 SFMMU_STAT(sf_get_free_fail); 10569 return (0); 10570 } 10571 10572 static uint_t 10573 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical) 10574 { 10575 struct hme_blk *hblkp; 10576 10577 ASSERT(hmeblkp->hblk_hmecnt == 0); 10578 ASSERT(hmeblkp->hblk_vcnt == 0); 10579 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp)); 10580 10581 /* 10582 * If the current thread is mapping into kernel space, 10583 * let it succede even if freehblkcnt is max 10584 * so that it will avoid freeing it to kmem. 10585 * This will prevent stack overflow due to 10586 * possible recursion since kmem_cache_free() 10587 * might require creation of a slab which 10588 * in turn needs an hmeblk to map that slab; 10589 * let's break this vicious chain at the first 10590 * opportunity. 10591 */ 10592 if (freehblkcnt < HBLK_RESERVE_CNT || critical) { 10593 mutex_enter(&freehblkp_lock); 10594 if (freehblkcnt < HBLK_RESERVE_CNT || critical) { 10595 SFMMU_STAT(sf_put_free_success); 10596 freehblkcnt++; 10597 hmeblkp->hblk_next = freehblkp; 10598 freehblkp = hmeblkp; 10599 mutex_exit(&freehblkp_lock); 10600 return (1); 10601 } 10602 mutex_exit(&freehblkp_lock); 10603 } 10604 10605 /* 10606 * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here 10607 * only if freehblkcnt is at least HBLK_RESERVE_CNT *and* 10608 * we are not in the process of mapping into kernel space. 10609 */ 10610 ASSERT(!critical); 10611 while (freehblkcnt > HBLK_RESERVE_CNT) { 10612 mutex_enter(&freehblkp_lock); 10613 if (freehblkcnt > HBLK_RESERVE_CNT) { 10614 freehblkcnt--; 10615 hblkp = freehblkp; 10616 freehblkp = hblkp->hblk_next; 10617 mutex_exit(&freehblkp_lock); 10618 ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache); 10619 kmem_cache_free(sfmmu8_cache, hblkp); 10620 continue; 10621 } 10622 mutex_exit(&freehblkp_lock); 10623 } 10624 SFMMU_STAT(sf_put_free_fail); 10625 return (0); 10626 } 10627 10628 static void 10629 sfmmu_hblk_swap(struct hme_blk *new) 10630 { 10631 struct hme_blk *old, *hblkp, *prev; 10632 uint64_t newpa; 10633 caddr_t base, vaddr, endaddr; 10634 struct hmehash_bucket *hmebp; 10635 struct sf_hment *osfhme, *nsfhme; 10636 page_t *pp; 10637 kmutex_t *pml; 10638 tte_t tte; 10639 struct hme_blk *list = NULL; 10640 10641 #ifdef DEBUG 10642 hmeblk_tag hblktag; 10643 struct hme_blk *found; 10644 #endif 10645 old = HBLK_RESERVE; 10646 ASSERT(!old->hblk_shared); 10647 10648 /* 10649 * save pa before bcopy clobbers it 10650 */ 10651 newpa = new->hblk_nextpa; 10652 10653 base = (caddr_t)get_hblk_base(old); 10654 endaddr = base + get_hblk_span(old); 10655 10656 /* 10657 * acquire hash bucket lock. 10658 */ 10659 hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K, 10660 SFMMU_INVALID_SHMERID); 10661 10662 /* 10663 * copy contents from old to new 10664 */ 10665 bcopy((void *)old, (void *)new, HME8BLK_SZ); 10666 10667 /* 10668 * add new to hash chain 10669 */ 10670 sfmmu_hblk_hash_add(hmebp, new, newpa); 10671 10672 /* 10673 * search hash chain for hblk_reserve; this needs to be performed 10674 * after adding new, otherwise prev won't correspond to the hblk which 10675 * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to 10676 * remove old later. 10677 */ 10678 for (prev = NULL, 10679 hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old; 10680 prev = hblkp, hblkp = hblkp->hblk_next) 10681 ; 10682 10683 if (hblkp != old) 10684 panic("sfmmu_hblk_swap: hblk_reserve not found"); 10685 10686 /* 10687 * p_mapping list is still pointing to hments in hblk_reserve; 10688 * fix up p_mapping list so that they point to hments in new. 10689 * 10690 * Since all these mappings are created by hblk_reserve_thread 10691 * on the way and it's using at least one of the buffers from each of 10692 * the newly minted slabs, there is no danger of any of these 10693 * mappings getting unloaded by another thread. 10694 * 10695 * tsbmiss could only modify ref/mod bits of hments in old/new. 10696 * Since all of these hments hold mappings established by segkmem 10697 * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits 10698 * have no meaning for the mappings in hblk_reserve. hments in 10699 * old and new are identical except for ref/mod bits. 10700 */ 10701 for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) { 10702 10703 HBLKTOHME(osfhme, old, vaddr); 10704 sfmmu_copytte(&osfhme->hme_tte, &tte); 10705 10706 if (TTE_IS_VALID(&tte)) { 10707 if ((pp = osfhme->hme_page) == NULL) 10708 panic("sfmmu_hblk_swap: page not mapped"); 10709 10710 pml = sfmmu_mlist_enter(pp); 10711 10712 if (pp != osfhme->hme_page) 10713 panic("sfmmu_hblk_swap: mapping changed"); 10714 10715 HBLKTOHME(nsfhme, new, vaddr); 10716 10717 HME_ADD(nsfhme, pp); 10718 HME_SUB(osfhme, pp); 10719 10720 sfmmu_mlist_exit(pml); 10721 } 10722 } 10723 10724 /* 10725 * remove old from hash chain 10726 */ 10727 sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1); 10728 10729 #ifdef DEBUG 10730 10731 hblktag.htag_id = ksfmmup; 10732 hblktag.htag_rid = SFMMU_INVALID_SHMERID; 10733 hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K)); 10734 hblktag.htag_rehash = HME_HASH_REHASH(TTE8K); 10735 HME_HASH_FAST_SEARCH(hmebp, hblktag, found); 10736 10737 if (found != new) 10738 panic("sfmmu_hblk_swap: new hblk not found"); 10739 #endif 10740 10741 SFMMU_HASH_UNLOCK(hmebp); 10742 10743 /* 10744 * Reset hblk_reserve 10745 */ 10746 bzero((void *)old, HME8BLK_SZ); 10747 old->hblk_nextpa = va_to_pa((caddr_t)old); 10748 } 10749 10750 /* 10751 * Grab the mlist mutex for both pages passed in. 10752 * 10753 * low and high will be returned as pointers to the mutexes for these pages. 10754 * low refers to the mutex residing in the lower bin of the mlist hash, while 10755 * high refers to the mutex residing in the higher bin of the mlist hash. This 10756 * is due to the locking order restrictions on the same thread grabbing 10757 * multiple mlist mutexes. The low lock must be acquired before the high lock. 10758 * 10759 * If both pages hash to the same mutex, only grab that single mutex, and 10760 * high will be returned as NULL 10761 * If the pages hash to different bins in the hash, grab the lower addressed 10762 * lock first and then the higher addressed lock in order to follow the locking 10763 * rules involved with the same thread grabbing multiple mlist mutexes. 10764 * low and high will both have non-NULL values. 10765 */ 10766 static void 10767 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl, 10768 kmutex_t **low, kmutex_t **high) 10769 { 10770 kmutex_t *mml_targ, *mml_repl; 10771 10772 /* 10773 * no need to do the dance around szc as in sfmmu_mlist_enter() 10774 * because this routine is only called by hat_page_relocate() and all 10775 * targ and repl pages are already locked EXCL so szc can't change. 10776 */ 10777 10778 mml_targ = MLIST_HASH(PP_PAGEROOT(targ)); 10779 mml_repl = MLIST_HASH(PP_PAGEROOT(repl)); 10780 10781 if (mml_targ == mml_repl) { 10782 *low = mml_targ; 10783 *high = NULL; 10784 } else { 10785 if (mml_targ < mml_repl) { 10786 *low = mml_targ; 10787 *high = mml_repl; 10788 } else { 10789 *low = mml_repl; 10790 *high = mml_targ; 10791 } 10792 } 10793 10794 mutex_enter(*low); 10795 if (*high) 10796 mutex_enter(*high); 10797 } 10798 10799 static void 10800 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high) 10801 { 10802 if (high) 10803 mutex_exit(high); 10804 mutex_exit(low); 10805 } 10806 10807 static hatlock_t * 10808 sfmmu_hat_enter(sfmmu_t *sfmmup) 10809 { 10810 hatlock_t *hatlockp; 10811 10812 if (sfmmup != ksfmmup) { 10813 hatlockp = TSB_HASH(sfmmup); 10814 mutex_enter(HATLOCK_MUTEXP(hatlockp)); 10815 return (hatlockp); 10816 } 10817 return (NULL); 10818 } 10819 10820 static hatlock_t * 10821 sfmmu_hat_tryenter(sfmmu_t *sfmmup) 10822 { 10823 hatlock_t *hatlockp; 10824 10825 if (sfmmup != ksfmmup) { 10826 hatlockp = TSB_HASH(sfmmup); 10827 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0) 10828 return (NULL); 10829 return (hatlockp); 10830 } 10831 return (NULL); 10832 } 10833 10834 static void 10835 sfmmu_hat_exit(hatlock_t *hatlockp) 10836 { 10837 if (hatlockp != NULL) 10838 mutex_exit(HATLOCK_MUTEXP(hatlockp)); 10839 } 10840 10841 static void 10842 sfmmu_hat_lock_all(void) 10843 { 10844 int i; 10845 for (i = 0; i < SFMMU_NUM_LOCK; i++) 10846 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i])); 10847 } 10848 10849 static void 10850 sfmmu_hat_unlock_all(void) 10851 { 10852 int i; 10853 for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--) 10854 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i])); 10855 } 10856 10857 int 10858 sfmmu_hat_lock_held(sfmmu_t *sfmmup) 10859 { 10860 ASSERT(sfmmup != ksfmmup); 10861 return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup)))); 10862 } 10863 10864 /* 10865 * Locking primitives to provide consistency between ISM unmap 10866 * and other operations. Since ISM unmap can take a long time, we 10867 * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating 10868 * contention on the hatlock buckets while ISM segments are being 10869 * unmapped. The tradeoff is that the flags don't prevent priority 10870 * inversion from occurring, so we must request kernel priority in 10871 * case we have to sleep to keep from getting buried while holding 10872 * the HAT_ISMBUSY flag set, which in turn could block other kernel 10873 * threads from running (for example, in sfmmu_uvatopfn()). 10874 */ 10875 static void 10876 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held) 10877 { 10878 hatlock_t *hatlockp; 10879 10880 THREAD_KPRI_REQUEST(); 10881 if (!hatlock_held) 10882 hatlockp = sfmmu_hat_enter(sfmmup); 10883 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) 10884 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp)); 10885 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY); 10886 if (!hatlock_held) 10887 sfmmu_hat_exit(hatlockp); 10888 } 10889 10890 static void 10891 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held) 10892 { 10893 hatlock_t *hatlockp; 10894 10895 if (!hatlock_held) 10896 hatlockp = sfmmu_hat_enter(sfmmup); 10897 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 10898 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY); 10899 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 10900 if (!hatlock_held) 10901 sfmmu_hat_exit(hatlockp); 10902 THREAD_KPRI_RELEASE(); 10903 } 10904 10905 /* 10906 * 10907 * Algorithm: 10908 * 10909 * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed 10910 * hblks. 10911 * 10912 * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache, 10913 * 10914 * (a) try to return an hblk from reserve pool of free hblks; 10915 * (b) if the reserve pool is empty, acquire hblk_reserve_lock 10916 * and return hblk_reserve. 10917 * 10918 * (3) call kmem_cache_alloc() to allocate hblk; 10919 * 10920 * (a) if hblk_reserve_lock is held by the current thread, 10921 * atomically replace hblk_reserve by the hblk that is 10922 * returned by kmem_cache_alloc; release hblk_reserve_lock 10923 * and call kmem_cache_alloc() again. 10924 * (b) if reserve pool is not full, add the hblk that is 10925 * returned by kmem_cache_alloc to reserve pool and 10926 * call kmem_cache_alloc again. 10927 * 10928 */ 10929 static struct hme_blk * 10930 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr, 10931 struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag, 10932 uint_t flags, uint_t rid) 10933 { 10934 struct hme_blk *hmeblkp = NULL; 10935 struct hme_blk *newhblkp; 10936 struct hme_blk *shw_hblkp = NULL; 10937 struct kmem_cache *sfmmu_cache = NULL; 10938 uint64_t hblkpa; 10939 ulong_t index; 10940 uint_t owner; /* set to 1 if using hblk_reserve */ 10941 uint_t forcefree; 10942 int sleep; 10943 sf_srd_t *srdp; 10944 sf_region_t *rgnp; 10945 10946 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 10947 ASSERT(hblktag.htag_rid == rid); 10948 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size)); 10949 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || 10950 IS_P2ALIGNED(vaddr, TTEBYTES(size))); 10951 10952 /* 10953 * If segkmem is not created yet, allocate from static hmeblks 10954 * created at the end of startup_modules(). See the block comment 10955 * in startup_modules() describing how we estimate the number of 10956 * static hmeblks that will be needed during re-map. 10957 */ 10958 if (!hblk_alloc_dynamic) { 10959 10960 ASSERT(!SFMMU_IS_SHMERID_VALID(rid)); 10961 10962 if (size == TTE8K) { 10963 index = nucleus_hblk8.index; 10964 if (index >= nucleus_hblk8.len) { 10965 /* 10966 * If we panic here, see startup_modules() to 10967 * make sure that we are calculating the 10968 * number of hblk8's that we need correctly. 10969 */ 10970 prom_panic("no nucleus hblk8 to allocate"); 10971 } 10972 hmeblkp = 10973 (struct hme_blk *)&nucleus_hblk8.list[index]; 10974 nucleus_hblk8.index++; 10975 SFMMU_STAT(sf_hblk8_nalloc); 10976 } else { 10977 index = nucleus_hblk1.index; 10978 if (nucleus_hblk1.index >= nucleus_hblk1.len) { 10979 /* 10980 * If we panic here, see startup_modules(). 10981 * Most likely you need to update the 10982 * calculation of the number of hblk1 elements 10983 * that the kernel needs to boot. 10984 */ 10985 prom_panic("no nucleus hblk1 to allocate"); 10986 } 10987 hmeblkp = 10988 (struct hme_blk *)&nucleus_hblk1.list[index]; 10989 nucleus_hblk1.index++; 10990 SFMMU_STAT(sf_hblk1_nalloc); 10991 } 10992 10993 goto hblk_init; 10994 } 10995 10996 SFMMU_HASH_UNLOCK(hmebp); 10997 10998 if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) { 10999 if (mmu_page_sizes == max_mmu_page_sizes) { 11000 if (size < TTE256M) 11001 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr, 11002 size, flags); 11003 } else { 11004 if (size < TTE4M) 11005 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr, 11006 size, flags); 11007 } 11008 } else if (SFMMU_IS_SHMERID_VALID(rid)) { 11009 /* 11010 * Shared hmes use per region bitmaps in rgn_hmeflag 11011 * rather than shadow hmeblks to keep track of the 11012 * mapping sizes which have been allocated for the region. 11013 * Here we cleanup old invalid hmeblks with this rid, 11014 * which may be left around by pageunload(). 11015 */ 11016 int ttesz; 11017 caddr_t va; 11018 caddr_t eva = vaddr + TTEBYTES(size); 11019 11020 ASSERT(sfmmup != KHATID); 11021 11022 srdp = sfmmup->sfmmu_srdp; 11023 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 11024 rgnp = srdp->srd_hmergnp[rid]; 11025 ASSERT(rgnp != NULL && rgnp->rgn_id == rid); 11026 ASSERT(rgnp->rgn_refcnt != 0); 11027 ASSERT(size <= rgnp->rgn_pgszc); 11028 11029 ttesz = HBLK_MIN_TTESZ; 11030 do { 11031 if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) { 11032 continue; 11033 } 11034 11035 if (ttesz > size && ttesz != HBLK_MIN_TTESZ) { 11036 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz); 11037 } else if (ttesz < size) { 11038 for (va = vaddr; va < eva; 11039 va += TTEBYTES(ttesz)) { 11040 sfmmu_cleanup_rhblk(srdp, va, rid, 11041 ttesz); 11042 } 11043 } 11044 } while (++ttesz <= rgnp->rgn_pgszc); 11045 } 11046 11047 fill_hblk: 11048 owner = (hblk_reserve_thread == curthread) ? 1 : 0; 11049 11050 if (owner && size == TTE8K) { 11051 11052 ASSERT(!SFMMU_IS_SHMERID_VALID(rid)); 11053 /* 11054 * We are really in a tight spot. We already own 11055 * hblk_reserve and we need another hblk. In anticipation 11056 * of this kind of scenario, we specifically set aside 11057 * HBLK_RESERVE_MIN number of hblks to be used exclusively 11058 * by owner of hblk_reserve. 11059 */ 11060 SFMMU_STAT(sf_hblk_recurse_cnt); 11061 11062 if (!sfmmu_get_free_hblk(&hmeblkp, 1)) 11063 panic("sfmmu_hblk_alloc: reserve list is empty"); 11064 11065 goto hblk_verify; 11066 } 11067 11068 ASSERT(!owner); 11069 11070 if ((flags & HAT_NO_KALLOC) == 0) { 11071 11072 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache); 11073 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP); 11074 11075 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) { 11076 hmeblkp = sfmmu_hblk_steal(size); 11077 } else { 11078 /* 11079 * if we are the owner of hblk_reserve, 11080 * swap hblk_reserve with hmeblkp and 11081 * start a fresh life. Hope things go 11082 * better this time. 11083 */ 11084 if (hblk_reserve_thread == curthread) { 11085 ASSERT(sfmmu_cache == sfmmu8_cache); 11086 sfmmu_hblk_swap(hmeblkp); 11087 hblk_reserve_thread = NULL; 11088 mutex_exit(&hblk_reserve_lock); 11089 goto fill_hblk; 11090 } 11091 /* 11092 * let's donate this hblk to our reserve list if 11093 * we are not mapping kernel range 11094 */ 11095 if (size == TTE8K && sfmmup != KHATID) { 11096 if (sfmmu_put_free_hblk(hmeblkp, 0)) 11097 goto fill_hblk; 11098 } 11099 } 11100 } else { 11101 /* 11102 * We are here to map the slab in sfmmu8_cache; let's 11103 * check if we could tap our reserve list; if successful, 11104 * this will avoid the pain of going thru sfmmu_hblk_swap 11105 */ 11106 SFMMU_STAT(sf_hblk_slab_cnt); 11107 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) { 11108 /* 11109 * let's start hblk_reserve dance 11110 */ 11111 SFMMU_STAT(sf_hblk_reserve_cnt); 11112 owner = 1; 11113 mutex_enter(&hblk_reserve_lock); 11114 hmeblkp = HBLK_RESERVE; 11115 hblk_reserve_thread = curthread; 11116 } 11117 } 11118 11119 hblk_verify: 11120 ASSERT(hmeblkp != NULL); 11121 set_hblk_sz(hmeblkp, size); 11122 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp)); 11123 SFMMU_HASH_LOCK(hmebp); 11124 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp); 11125 if (newhblkp != NULL) { 11126 SFMMU_HASH_UNLOCK(hmebp); 11127 if (hmeblkp != HBLK_RESERVE) { 11128 /* 11129 * This is really tricky! 11130 * 11131 * vmem_alloc(vmem_seg_arena) 11132 * vmem_alloc(vmem_internal_arena) 11133 * segkmem_alloc(heap_arena) 11134 * vmem_alloc(heap_arena) 11135 * page_create() 11136 * hat_memload() 11137 * kmem_cache_free() 11138 * kmem_cache_alloc() 11139 * kmem_slab_create() 11140 * vmem_alloc(kmem_internal_arena) 11141 * segkmem_alloc(heap_arena) 11142 * vmem_alloc(heap_arena) 11143 * page_create() 11144 * hat_memload() 11145 * kmem_cache_free() 11146 * ... 11147 * 11148 * Thus, hat_memload() could call kmem_cache_free 11149 * for enough number of times that we could easily 11150 * hit the bottom of the stack or run out of reserve 11151 * list of vmem_seg structs. So, we must donate 11152 * this hblk to reserve list if it's allocated 11153 * from sfmmu8_cache *and* mapping kernel range. 11154 * We don't need to worry about freeing hmeblk1's 11155 * to kmem since they don't map any kmem slabs. 11156 * 11157 * Note: When segkmem supports largepages, we must 11158 * free hmeblk1's to reserve list as well. 11159 */ 11160 forcefree = (sfmmup == KHATID) ? 1 : 0; 11161 if (size == TTE8K && 11162 sfmmu_put_free_hblk(hmeblkp, forcefree)) { 11163 goto re_verify; 11164 } 11165 ASSERT(sfmmup != KHATID); 11166 kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp); 11167 } else { 11168 /* 11169 * Hey! we don't need hblk_reserve any more. 11170 */ 11171 ASSERT(owner); 11172 hblk_reserve_thread = NULL; 11173 mutex_exit(&hblk_reserve_lock); 11174 owner = 0; 11175 } 11176 re_verify: 11177 /* 11178 * let's check if the goodies are still present 11179 */ 11180 SFMMU_HASH_LOCK(hmebp); 11181 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp); 11182 if (newhblkp != NULL) { 11183 /* 11184 * return newhblkp if it's not hblk_reserve; 11185 * if newhblkp is hblk_reserve, return it 11186 * _only if_ we are the owner of hblk_reserve. 11187 */ 11188 if (newhblkp != HBLK_RESERVE || owner) { 11189 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || 11190 newhblkp->hblk_shared); 11191 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || 11192 !newhblkp->hblk_shared); 11193 return (newhblkp); 11194 } else { 11195 /* 11196 * we just hit hblk_reserve in the hash and 11197 * we are not the owner of that; 11198 * 11199 * block until hblk_reserve_thread completes 11200 * swapping hblk_reserve and try the dance 11201 * once again. 11202 */ 11203 SFMMU_HASH_UNLOCK(hmebp); 11204 mutex_enter(&hblk_reserve_lock); 11205 mutex_exit(&hblk_reserve_lock); 11206 SFMMU_STAT(sf_hblk_reserve_hit); 11207 goto fill_hblk; 11208 } 11209 } else { 11210 /* 11211 * it's no more! try the dance once again. 11212 */ 11213 SFMMU_HASH_UNLOCK(hmebp); 11214 goto fill_hblk; 11215 } 11216 } 11217 11218 hblk_init: 11219 if (SFMMU_IS_SHMERID_VALID(rid)) { 11220 uint16_t tteflag = 0x1 << 11221 ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size); 11222 11223 if (!(rgnp->rgn_hmeflags & tteflag)) { 11224 atomic_or_16(&rgnp->rgn_hmeflags, tteflag); 11225 } 11226 hmeblkp->hblk_shared = 1; 11227 } else { 11228 hmeblkp->hblk_shared = 0; 11229 } 11230 set_hblk_sz(hmeblkp, size); 11231 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 11232 hmeblkp->hblk_next = (struct hme_blk *)NULL; 11233 hmeblkp->hblk_tag = hblktag; 11234 hmeblkp->hblk_shadow = shw_hblkp; 11235 hblkpa = hmeblkp->hblk_nextpa; 11236 hmeblkp->hblk_nextpa = HMEBLK_ENDPA; 11237 11238 ASSERT(get_hblk_ttesz(hmeblkp) == size); 11239 ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size)); 11240 ASSERT(hmeblkp->hblk_hmecnt == 0); 11241 ASSERT(hmeblkp->hblk_vcnt == 0); 11242 ASSERT(hmeblkp->hblk_lckcnt == 0); 11243 ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp)); 11244 sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa); 11245 return (hmeblkp); 11246 } 11247 11248 /* 11249 * This function cleans up the hme_blk and returns it to the free list. 11250 */ 11251 /* ARGSUSED */ 11252 static void 11253 sfmmu_hblk_free(struct hme_blk **listp) 11254 { 11255 struct hme_blk *hmeblkp, *next_hmeblkp; 11256 int size; 11257 uint_t critical; 11258 uint64_t hblkpa; 11259 11260 ASSERT(*listp != NULL); 11261 11262 hmeblkp = *listp; 11263 while (hmeblkp != NULL) { 11264 next_hmeblkp = hmeblkp->hblk_next; 11265 ASSERT(!hmeblkp->hblk_hmecnt); 11266 ASSERT(!hmeblkp->hblk_vcnt); 11267 ASSERT(!hmeblkp->hblk_lckcnt); 11268 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve); 11269 ASSERT(hmeblkp->hblk_shared == 0); 11270 ASSERT(hmeblkp->hblk_shw_bit == 0); 11271 ASSERT(hmeblkp->hblk_shadow == NULL); 11272 11273 hblkpa = va_to_pa((caddr_t)hmeblkp); 11274 ASSERT(hblkpa != (uint64_t)-1); 11275 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0; 11276 11277 size = get_hblk_ttesz(hmeblkp); 11278 hmeblkp->hblk_next = NULL; 11279 hmeblkp->hblk_nextpa = hblkpa; 11280 11281 if (hmeblkp->hblk_nuc_bit == 0) { 11282 11283 if (size != TTE8K || 11284 !sfmmu_put_free_hblk(hmeblkp, critical)) 11285 kmem_cache_free(get_hblk_cache(hmeblkp), 11286 hmeblkp); 11287 } 11288 hmeblkp = next_hmeblkp; 11289 } 11290 } 11291 11292 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30 11293 #define SFMMU_HBLK_STEAL_THRESHOLD 5 11294 11295 static uint_t sfmmu_hblk_steal_twice; 11296 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count; 11297 11298 /* 11299 * Steal a hmeblk from user or kernel hme hash lists. 11300 * For 8K tte grab one from reserve pool (freehblkp) before proceeding to 11301 * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts 11302 * tap into critical reserve of freehblkp. 11303 * Note: We remain looping in this routine until we find one. 11304 */ 11305 static struct hme_blk * 11306 sfmmu_hblk_steal(int size) 11307 { 11308 static struct hmehash_bucket *uhmehash_steal_hand = NULL; 11309 struct hmehash_bucket *hmebp; 11310 struct hme_blk *hmeblkp = NULL, *pr_hblk; 11311 uint64_t hblkpa; 11312 int i; 11313 uint_t loop_cnt = 0, critical; 11314 11315 for (;;) { 11316 /* Check cpu hblk pending queues */ 11317 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) { 11318 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp); 11319 ASSERT(hmeblkp->hblk_hmecnt == 0); 11320 ASSERT(hmeblkp->hblk_vcnt == 0); 11321 return (hmeblkp); 11322 } 11323 11324 if (size == TTE8K) { 11325 critical = 11326 (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0; 11327 if (sfmmu_get_free_hblk(&hmeblkp, critical)) 11328 return (hmeblkp); 11329 } 11330 11331 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash : 11332 uhmehash_steal_hand; 11333 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]); 11334 11335 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ + 11336 BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) { 11337 SFMMU_HASH_LOCK(hmebp); 11338 hmeblkp = hmebp->hmeblkp; 11339 hblkpa = hmebp->hmeh_nextpa; 11340 pr_hblk = NULL; 11341 while (hmeblkp) { 11342 /* 11343 * check if it is a hmeblk that is not locked 11344 * and not shared. skip shadow hmeblks with 11345 * shadow_mask set i.e valid count non zero. 11346 */ 11347 if ((get_hblk_ttesz(hmeblkp) == size) && 11348 (hmeblkp->hblk_shw_bit == 0 || 11349 hmeblkp->hblk_vcnt == 0) && 11350 (hmeblkp->hblk_lckcnt == 0)) { 11351 /* 11352 * there is a high probability that we 11353 * will find a free one. search some 11354 * buckets for a free hmeblk initially 11355 * before unloading a valid hmeblk. 11356 */ 11357 if ((hmeblkp->hblk_vcnt == 0 && 11358 hmeblkp->hblk_hmecnt == 0) || (i >= 11359 BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) { 11360 if (sfmmu_steal_this_hblk(hmebp, 11361 hmeblkp, hblkpa, pr_hblk)) { 11362 /* 11363 * Hblk is unloaded 11364 * successfully 11365 */ 11366 break; 11367 } 11368 } 11369 } 11370 pr_hblk = hmeblkp; 11371 hblkpa = hmeblkp->hblk_nextpa; 11372 hmeblkp = hmeblkp->hblk_next; 11373 } 11374 11375 SFMMU_HASH_UNLOCK(hmebp); 11376 if (hmebp++ == &uhme_hash[UHMEHASH_SZ]) 11377 hmebp = uhme_hash; 11378 } 11379 uhmehash_steal_hand = hmebp; 11380 11381 if (hmeblkp != NULL) 11382 break; 11383 11384 /* 11385 * in the worst case, look for a free one in the kernel 11386 * hash table. 11387 */ 11388 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) { 11389 SFMMU_HASH_LOCK(hmebp); 11390 hmeblkp = hmebp->hmeblkp; 11391 hblkpa = hmebp->hmeh_nextpa; 11392 pr_hblk = NULL; 11393 while (hmeblkp) { 11394 /* 11395 * check if it is free hmeblk 11396 */ 11397 if ((get_hblk_ttesz(hmeblkp) == size) && 11398 (hmeblkp->hblk_lckcnt == 0) && 11399 (hmeblkp->hblk_vcnt == 0) && 11400 (hmeblkp->hblk_hmecnt == 0)) { 11401 if (sfmmu_steal_this_hblk(hmebp, 11402 hmeblkp, hblkpa, pr_hblk)) { 11403 break; 11404 } else { 11405 /* 11406 * Cannot fail since we have 11407 * hash lock. 11408 */ 11409 panic("fail to steal?"); 11410 } 11411 } 11412 11413 pr_hblk = hmeblkp; 11414 hblkpa = hmeblkp->hblk_nextpa; 11415 hmeblkp = hmeblkp->hblk_next; 11416 } 11417 11418 SFMMU_HASH_UNLOCK(hmebp); 11419 if (hmebp++ == &khme_hash[KHMEHASH_SZ]) 11420 hmebp = khme_hash; 11421 } 11422 11423 if (hmeblkp != NULL) 11424 break; 11425 sfmmu_hblk_steal_twice++; 11426 } 11427 return (hmeblkp); 11428 } 11429 11430 /* 11431 * This routine does real work to prepare a hblk to be "stolen" by 11432 * unloading the mappings, updating shadow counts .... 11433 * It returns 1 if the block is ready to be reused (stolen), or 0 11434 * means the block cannot be stolen yet- pageunload is still working 11435 * on this hblk. 11436 */ 11437 static int 11438 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 11439 uint64_t hblkpa, struct hme_blk *pr_hblk) 11440 { 11441 int shw_size, vshift; 11442 struct hme_blk *shw_hblkp; 11443 caddr_t vaddr; 11444 uint_t shw_mask, newshw_mask; 11445 struct hme_blk *list = NULL; 11446 11447 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 11448 11449 /* 11450 * check if the hmeblk is free, unload if necessary 11451 */ 11452 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 11453 sfmmu_t *sfmmup; 11454 demap_range_t dmr; 11455 11456 sfmmup = hblktosfmmu(hmeblkp); 11457 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) { 11458 return (0); 11459 } 11460 DEMAP_RANGE_INIT(sfmmup, &dmr); 11461 (void) sfmmu_hblk_unload(sfmmup, hmeblkp, 11462 (caddr_t)get_hblk_base(hmeblkp), 11463 get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD); 11464 DEMAP_RANGE_FLUSH(&dmr); 11465 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) { 11466 /* 11467 * Pageunload is working on the same hblk. 11468 */ 11469 return (0); 11470 } 11471 11472 sfmmu_hblk_steal_unload_count++; 11473 } 11474 11475 ASSERT(hmeblkp->hblk_lckcnt == 0); 11476 ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0); 11477 11478 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1); 11479 hmeblkp->hblk_nextpa = hblkpa; 11480 11481 shw_hblkp = hmeblkp->hblk_shadow; 11482 if (shw_hblkp) { 11483 ASSERT(!hmeblkp->hblk_shared); 11484 shw_size = get_hblk_ttesz(shw_hblkp); 11485 vaddr = (caddr_t)get_hblk_base(hmeblkp); 11486 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size); 11487 ASSERT(vshift < 8); 11488 /* 11489 * Atomically clear shadow mask bit 11490 */ 11491 do { 11492 shw_mask = shw_hblkp->hblk_shw_mask; 11493 ASSERT(shw_mask & (1 << vshift)); 11494 newshw_mask = shw_mask & ~(1 << vshift); 11495 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask, 11496 shw_mask, newshw_mask); 11497 } while (newshw_mask != shw_mask); 11498 hmeblkp->hblk_shadow = NULL; 11499 } 11500 11501 /* 11502 * remove shadow bit if we are stealing an unused shadow hmeblk. 11503 * sfmmu_hblk_alloc needs it that way, will set shadow bit later if 11504 * we are indeed allocating a shadow hmeblk. 11505 */ 11506 hmeblkp->hblk_shw_bit = 0; 11507 11508 if (hmeblkp->hblk_shared) { 11509 sf_srd_t *srdp; 11510 sf_region_t *rgnp; 11511 uint_t rid; 11512 11513 srdp = hblktosrd(hmeblkp); 11514 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 11515 rid = hmeblkp->hblk_tag.htag_rid; 11516 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 11517 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 11518 rgnp = srdp->srd_hmergnp[rid]; 11519 ASSERT(rgnp != NULL); 11520 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 11521 hmeblkp->hblk_shared = 0; 11522 } 11523 11524 sfmmu_hblk_steal_count++; 11525 SFMMU_STAT(sf_steal_count); 11526 11527 return (1); 11528 } 11529 11530 struct hme_blk * 11531 sfmmu_hmetohblk(struct sf_hment *sfhme) 11532 { 11533 struct hme_blk *hmeblkp; 11534 struct sf_hment *sfhme0; 11535 struct hme_blk *hblk_dummy = 0; 11536 11537 /* 11538 * No dummy sf_hments, please. 11539 */ 11540 ASSERT(sfhme->hme_tte.ll != 0); 11541 11542 sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum; 11543 hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 - 11544 (uintptr_t)&hblk_dummy->hblk_hme[0]); 11545 11546 return (hmeblkp); 11547 } 11548 11549 /* 11550 * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag. 11551 * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using 11552 * KM_SLEEP allocation. 11553 * 11554 * Return 0 on success, -1 otherwise. 11555 */ 11556 static void 11557 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp) 11558 { 11559 struct tsb_info *tsbinfop, *next; 11560 tsb_replace_rc_t rc; 11561 boolean_t gotfirst = B_FALSE; 11562 11563 ASSERT(sfmmup != ksfmmup); 11564 ASSERT(sfmmu_hat_lock_held(sfmmup)); 11565 11566 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) { 11567 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp)); 11568 } 11569 11570 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 11571 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN); 11572 } else { 11573 return; 11574 } 11575 11576 ASSERT(sfmmup->sfmmu_tsb != NULL); 11577 11578 /* 11579 * Loop over all tsbinfo's replacing them with ones that actually have 11580 * a TSB. If any of the replacements ever fail, bail out of the loop. 11581 */ 11582 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) { 11583 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED); 11584 next = tsbinfop->tsb_next; 11585 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc, 11586 hatlockp, TSB_SWAPIN); 11587 if (rc != TSB_SUCCESS) { 11588 break; 11589 } 11590 gotfirst = B_TRUE; 11591 } 11592 11593 switch (rc) { 11594 case TSB_SUCCESS: 11595 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN); 11596 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 11597 return; 11598 case TSB_LOSTRACE: 11599 break; 11600 case TSB_ALLOCFAIL: 11601 break; 11602 default: 11603 panic("sfmmu_replace_tsb returned unrecognized failure code " 11604 "%d", rc); 11605 } 11606 11607 /* 11608 * In this case, we failed to get one of our TSBs. If we failed to 11609 * get the first TSB, get one of minimum size (8KB). Walk the list 11610 * and throw away the tsbinfos, starting where the allocation failed; 11611 * we can get by with just one TSB as long as we don't leave the 11612 * SWAPPED tsbinfo structures lying around. 11613 */ 11614 tsbinfop = sfmmup->sfmmu_tsb; 11615 next = tsbinfop->tsb_next; 11616 tsbinfop->tsb_next = NULL; 11617 11618 sfmmu_hat_exit(hatlockp); 11619 for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) { 11620 next = tsbinfop->tsb_next; 11621 sfmmu_tsbinfo_free(tsbinfop); 11622 } 11623 hatlockp = sfmmu_hat_enter(sfmmup); 11624 11625 /* 11626 * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K 11627 * pages. 11628 */ 11629 if (!gotfirst) { 11630 tsbinfop = sfmmup->sfmmu_tsb; 11631 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE, 11632 hatlockp, TSB_SWAPIN | TSB_FORCEALLOC); 11633 ASSERT(rc == TSB_SUCCESS); 11634 } 11635 11636 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN); 11637 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 11638 } 11639 11640 static int 11641 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw) 11642 { 11643 ulong_t bix = 0; 11644 uint_t rid; 11645 sf_region_t *rgnp; 11646 11647 ASSERT(srdp != NULL); 11648 ASSERT(srdp->srd_refcnt != 0); 11649 11650 w <<= BT_ULSHIFT; 11651 while (bmw) { 11652 if (!(bmw & 0x1)) { 11653 bix++; 11654 bmw >>= 1; 11655 continue; 11656 } 11657 rid = w | bix; 11658 rgnp = srdp->srd_hmergnp[rid]; 11659 ASSERT(rgnp->rgn_refcnt > 0); 11660 ASSERT(rgnp->rgn_id == rid); 11661 if (addr < rgnp->rgn_saddr || 11662 addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) { 11663 bix++; 11664 bmw >>= 1; 11665 } else { 11666 return (1); 11667 } 11668 } 11669 return (0); 11670 } 11671 11672 /* 11673 * Handle exceptions for low level tsb_handler. 11674 * 11675 * There are many scenarios that could land us here: 11676 * 11677 * If the context is invalid we land here. The context can be invalid 11678 * for 3 reasons: 1) we couldn't allocate a new context and now need to 11679 * perform a wrap around operation in order to allocate a new context. 11680 * 2) Context was invalidated to change pagesize programming 3) ISMs or 11681 * TSBs configuration is changeing for this process and we are forced into 11682 * here to do a syncronization operation. If the context is valid we can 11683 * be here from window trap hanlder. In this case just call trap to handle 11684 * the fault. 11685 * 11686 * Note that the process will run in INVALID_CONTEXT before 11687 * faulting into here and subsequently loading the MMU registers 11688 * (including the TSB base register) associated with this process. 11689 * For this reason, the trap handlers must all test for 11690 * INVALID_CONTEXT before attempting to access any registers other 11691 * than the context registers. 11692 */ 11693 void 11694 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype) 11695 { 11696 sfmmu_t *sfmmup, *shsfmmup; 11697 uint_t ctxtype; 11698 klwp_id_t lwp; 11699 char lwp_save_state; 11700 hatlock_t *hatlockp, *shatlockp; 11701 struct tsb_info *tsbinfop; 11702 struct tsbmiss *tsbmp; 11703 sf_scd_t *scdp; 11704 11705 SFMMU_STAT(sf_tsb_exceptions); 11706 SFMMU_MMU_STAT(mmu_tsb_exceptions); 11707 sfmmup = astosfmmu(curthread->t_procp->p_as); 11708 /* 11709 * note that in sun4u, tagacces register contains ctxnum 11710 * while sun4v passes ctxtype in the tagaccess register. 11711 */ 11712 ctxtype = tagaccess & TAGACC_CTX_MASK; 11713 11714 ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT); 11715 ASSERT(sfmmup->sfmmu_ismhat == 0); 11716 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) || 11717 ctxtype == INVALID_CONTEXT); 11718 11719 if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) { 11720 /* 11721 * We may land here because shme bitmap and pagesize 11722 * flags are updated lazily in tsbmiss area on other cpus. 11723 * If we detect here that tsbmiss area is out of sync with 11724 * sfmmu update it and retry the trapped instruction. 11725 * Otherwise call trap(). 11726 */ 11727 int ret = 0; 11728 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K); 11729 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK); 11730 11731 /* 11732 * Must set lwp state to LWP_SYS before 11733 * trying to acquire any adaptive lock 11734 */ 11735 lwp = ttolwp(curthread); 11736 ASSERT(lwp); 11737 lwp_save_state = lwp->lwp_state; 11738 lwp->lwp_state = LWP_SYS; 11739 11740 hatlockp = sfmmu_hat_enter(sfmmup); 11741 kpreempt_disable(); 11742 tsbmp = &tsbmiss_area[CPU->cpu_id]; 11743 ASSERT(sfmmup == tsbmp->usfmmup); 11744 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) & 11745 ~tteflag_mask) || 11746 ((tsbmp->uhat_rtteflags ^ sfmmup->sfmmu_rtteflags) & 11747 ~tteflag_mask)) { 11748 tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags; 11749 tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags; 11750 ret = 1; 11751 } 11752 if (sfmmup->sfmmu_srdp != NULL) { 11753 ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap; 11754 ulong_t *tm = tsbmp->shmermap; 11755 ulong_t i; 11756 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 11757 ulong_t d = tm[i] ^ sm[i]; 11758 if (d) { 11759 if (d & sm[i]) { 11760 if (!ret && sfmmu_is_rgnva( 11761 sfmmup->sfmmu_srdp, 11762 addr, i, d & sm[i])) { 11763 ret = 1; 11764 } 11765 } 11766 tm[i] = sm[i]; 11767 } 11768 } 11769 } 11770 kpreempt_enable(); 11771 sfmmu_hat_exit(hatlockp); 11772 lwp->lwp_state = lwp_save_state; 11773 if (ret) { 11774 return; 11775 } 11776 } else if (ctxtype == INVALID_CONTEXT) { 11777 /* 11778 * First, make sure we come out of here with a valid ctx, 11779 * since if we don't get one we'll simply loop on the 11780 * faulting instruction. 11781 * 11782 * If the ISM mappings are changing, the TSB is relocated, 11783 * the process is swapped, the process is joining SCD or 11784 * leaving SCD or shared regions we serialize behind the 11785 * controlling thread with hat lock, sfmmu_flags and 11786 * sfmmu_tsb_cv condition variable. 11787 */ 11788 11789 /* 11790 * Must set lwp state to LWP_SYS before 11791 * trying to acquire any adaptive lock 11792 */ 11793 lwp = ttolwp(curthread); 11794 ASSERT(lwp); 11795 lwp_save_state = lwp->lwp_state; 11796 lwp->lwp_state = LWP_SYS; 11797 11798 hatlockp = sfmmu_hat_enter(sfmmup); 11799 retry: 11800 if ((scdp = sfmmup->sfmmu_scdp) != NULL) { 11801 shsfmmup = scdp->scd_sfmmup; 11802 ASSERT(shsfmmup != NULL); 11803 11804 for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL; 11805 tsbinfop = tsbinfop->tsb_next) { 11806 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) { 11807 /* drop the private hat lock */ 11808 sfmmu_hat_exit(hatlockp); 11809 /* acquire the shared hat lock */ 11810 shatlockp = sfmmu_hat_enter(shsfmmup); 11811 /* 11812 * recheck to see if anything changed 11813 * after we drop the private hat lock. 11814 */ 11815 if (sfmmup->sfmmu_scdp == scdp && 11816 shsfmmup == scdp->scd_sfmmup) { 11817 sfmmu_tsb_chk_reloc(shsfmmup, 11818 shatlockp); 11819 } 11820 sfmmu_hat_exit(shatlockp); 11821 hatlockp = sfmmu_hat_enter(sfmmup); 11822 goto retry; 11823 } 11824 } 11825 } 11826 11827 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 11828 tsbinfop = tsbinfop->tsb_next) { 11829 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) { 11830 cv_wait(&sfmmup->sfmmu_tsb_cv, 11831 HATLOCK_MUTEXP(hatlockp)); 11832 goto retry; 11833 } 11834 } 11835 11836 /* 11837 * Wait for ISM maps to be updated. 11838 */ 11839 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) { 11840 cv_wait(&sfmmup->sfmmu_tsb_cv, 11841 HATLOCK_MUTEXP(hatlockp)); 11842 goto retry; 11843 } 11844 11845 /* Is this process joining an SCD? */ 11846 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 11847 /* 11848 * Flush private TSB and setup shared TSB. 11849 * sfmmu_finish_join_scd() does not drop the 11850 * hat lock. 11851 */ 11852 sfmmu_finish_join_scd(sfmmup); 11853 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD); 11854 } 11855 11856 /* 11857 * If we're swapping in, get TSB(s). Note that we must do 11858 * this before we get a ctx or load the MMU state. Once 11859 * we swap in we have to recheck to make sure the TSB(s) and 11860 * ISM mappings didn't change while we slept. 11861 */ 11862 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) { 11863 sfmmu_tsb_swapin(sfmmup, hatlockp); 11864 goto retry; 11865 } 11866 11867 sfmmu_get_ctx(sfmmup); 11868 11869 sfmmu_hat_exit(hatlockp); 11870 /* 11871 * Must restore lwp_state if not calling 11872 * trap() for further processing. Restore 11873 * it anyway. 11874 */ 11875 lwp->lwp_state = lwp_save_state; 11876 return; 11877 } 11878 trap(rp, (caddr_t)tagaccess, traptype, 0); 11879 } 11880 11881 static void 11882 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp) 11883 { 11884 struct tsb_info *tp; 11885 11886 ASSERT(sfmmu_hat_lock_held(sfmmup)); 11887 11888 for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) { 11889 if (tp->tsb_flags & TSB_RELOC_FLAG) { 11890 cv_wait(&sfmmup->sfmmu_tsb_cv, 11891 HATLOCK_MUTEXP(hatlockp)); 11892 break; 11893 } 11894 } 11895 } 11896 11897 /* 11898 * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and 11899 * TTE_SUSPENDED bit set in tte we block on aquiring a page lock 11900 * rather than spinning to avoid send mondo timeouts with 11901 * interrupts enabled. When the lock is acquired it is immediately 11902 * released and we return back to sfmmu_vatopfn just after 11903 * the GET_TTE call. 11904 */ 11905 void 11906 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep) 11907 { 11908 struct page **pp; 11909 11910 (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE); 11911 as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE); 11912 } 11913 11914 /* 11915 * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and 11916 * TTE_SUSPENDED bit set in tte. We do this so that we can handle 11917 * cross traps which cannot be handled while spinning in the 11918 * trap handlers. Simply enter and exit the kpr_suspendlock spin 11919 * mutex, which is held by the holder of the suspend bit, and then 11920 * retry the trapped instruction after unwinding. 11921 */ 11922 /*ARGSUSED*/ 11923 void 11924 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype) 11925 { 11926 ASSERT(curthread != kreloc_thread); 11927 mutex_enter(&kpr_suspendlock); 11928 mutex_exit(&kpr_suspendlock); 11929 } 11930 11931 /* 11932 * This routine could be optimized to reduce the number of xcalls by flushing 11933 * the entire TLBs if region reference count is above some threshold but the 11934 * tradeoff will depend on the size of the TLB. So for now flush the specific 11935 * page a context at a time. 11936 * 11937 * If uselocks is 0 then it's called after all cpus were captured and all the 11938 * hat locks were taken. In this case don't take the region lock by relying on 11939 * the order of list region update operations in hat_join_region(), 11940 * hat_leave_region() and hat_dup_region(). The ordering in those routines 11941 * guarantees that list is always forward walkable and reaches active sfmmus 11942 * regardless of where xc_attention() captures a cpu. 11943 */ 11944 cpuset_t 11945 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp, 11946 struct hme_blk *hmeblkp, int uselocks) 11947 { 11948 sfmmu_t *sfmmup; 11949 cpuset_t cpuset; 11950 cpuset_t rcpuset; 11951 hatlock_t *hatlockp; 11952 uint_t rid = rgnp->rgn_id; 11953 sf_rgn_link_t *rlink; 11954 sf_scd_t *scdp; 11955 11956 ASSERT(hmeblkp->hblk_shared); 11957 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 11958 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 11959 11960 CPUSET_ZERO(rcpuset); 11961 if (uselocks) { 11962 mutex_enter(&rgnp->rgn_mutex); 11963 } 11964 sfmmup = rgnp->rgn_sfmmu_head; 11965 while (sfmmup != NULL) { 11966 if (uselocks) { 11967 hatlockp = sfmmu_hat_enter(sfmmup); 11968 } 11969 11970 /* 11971 * When an SCD is created the SCD hat is linked on the sfmmu 11972 * region lists for each hme region which is part of the 11973 * SCD. If we find an SCD hat, when walking these lists, 11974 * then we flush the shared TSBs, if we find a private hat, 11975 * which is part of an SCD, but where the region 11976 * is not part of the SCD then we flush the private TSBs. 11977 */ 11978 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL && 11979 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 11980 scdp = sfmmup->sfmmu_scdp; 11981 if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 11982 if (uselocks) { 11983 sfmmu_hat_exit(hatlockp); 11984 } 11985 goto next; 11986 } 11987 } 11988 11989 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 11990 11991 kpreempt_disable(); 11992 cpuset = sfmmup->sfmmu_cpusran; 11993 CPUSET_AND(cpuset, cpu_ready_set); 11994 CPUSET_DEL(cpuset, CPU->cpu_id); 11995 SFMMU_XCALL_STATS(sfmmup); 11996 xt_some(cpuset, vtag_flushpage_tl1, 11997 (uint64_t)addr, (uint64_t)sfmmup); 11998 vtag_flushpage(addr, (uint64_t)sfmmup); 11999 if (uselocks) { 12000 sfmmu_hat_exit(hatlockp); 12001 } 12002 kpreempt_enable(); 12003 CPUSET_OR(rcpuset, cpuset); 12004 12005 next: 12006 /* LINTED: constant in conditional context */ 12007 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0); 12008 ASSERT(rlink != NULL); 12009 sfmmup = rlink->next; 12010 } 12011 if (uselocks) { 12012 mutex_exit(&rgnp->rgn_mutex); 12013 } 12014 return (rcpuset); 12015 } 12016 12017 /* 12018 * This routine takes an sfmmu pointer and the va for an adddress in an 12019 * ISM region as input and returns the corresponding region id in ism_rid. 12020 * The return value of 1 indicates that a region has been found and ism_rid 12021 * is valid, otherwise 0 is returned. 12022 */ 12023 static int 12024 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid) 12025 { 12026 ism_blk_t *ism_blkp; 12027 int i; 12028 ism_map_t *ism_map; 12029 #ifdef DEBUG 12030 struct hat *ism_hatid; 12031 #endif 12032 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12033 12034 ism_blkp = sfmmup->sfmmu_iblk; 12035 while (ism_blkp != NULL) { 12036 ism_map = ism_blkp->iblk_maps; 12037 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) { 12038 if ((va >= ism_start(ism_map[i])) && 12039 (va < ism_end(ism_map[i]))) { 12040 12041 *ism_rid = ism_map[i].imap_rid; 12042 #ifdef DEBUG 12043 ism_hatid = ism_map[i].imap_ismhat; 12044 ASSERT(ism_hatid == ism_sfmmup); 12045 ASSERT(ism_hatid->sfmmu_ismhat); 12046 #endif 12047 return (1); 12048 } 12049 } 12050 ism_blkp = ism_blkp->iblk_next; 12051 } 12052 return (0); 12053 } 12054 12055 /* 12056 * Special routine to flush out ism mappings- TSBs, TLBs and D-caches. 12057 * This routine may be called with all cpu's captured. Therefore, the 12058 * caller is responsible for holding all locks and disabling kernel 12059 * preemption. 12060 */ 12061 /* ARGSUSED */ 12062 static void 12063 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup, 12064 struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag) 12065 { 12066 cpuset_t cpuset; 12067 caddr_t va; 12068 ism_ment_t *ment; 12069 sfmmu_t *sfmmup; 12070 #ifdef VAC 12071 int vcolor; 12072 #endif 12073 12074 sf_scd_t *scdp; 12075 uint_t ism_rid; 12076 12077 ASSERT(!hmeblkp->hblk_shared); 12078 /* 12079 * Walk the ism_hat's mapping list and flush the page 12080 * from every hat sharing this ism_hat. This routine 12081 * may be called while all cpu's have been captured. 12082 * Therefore we can't attempt to grab any locks. For now 12083 * this means we will protect the ism mapping list under 12084 * a single lock which will be grabbed by the caller. 12085 * If hat_share/unshare scalibility becomes a performance 12086 * problem then we may need to re-think ism mapping list locking. 12087 */ 12088 ASSERT(ism_sfmmup->sfmmu_ismhat); 12089 ASSERT(MUTEX_HELD(&ism_mlist_lock)); 12090 addr = addr - ISMID_STARTADDR; 12091 12092 for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) { 12093 12094 sfmmup = ment->iment_hat; 12095 12096 va = ment->iment_base_va; 12097 va = (caddr_t)((uintptr_t)va + (uintptr_t)addr); 12098 12099 /* 12100 * When an SCD is created the SCD hat is linked on the ism 12101 * mapping lists for each ISM segment which is part of the 12102 * SCD. If we find an SCD hat, when walking these lists, 12103 * then we flush the shared TSBs, if we find a private hat, 12104 * which is part of an SCD, but where the region 12105 * corresponding to this va is not part of the SCD then we 12106 * flush the private TSBs. 12107 */ 12108 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL && 12109 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) && 12110 !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) { 12111 if (!find_ism_rid(sfmmup, ism_sfmmup, va, 12112 &ism_rid)) { 12113 cmn_err(CE_PANIC, 12114 "can't find matching ISM rid!"); 12115 } 12116 12117 scdp = sfmmup->sfmmu_scdp; 12118 if (SFMMU_IS_ISMRID_VALID(ism_rid) && 12119 SF_RGNMAP_TEST(scdp->scd_ismregion_map, 12120 ism_rid)) { 12121 continue; 12122 } 12123 } 12124 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1); 12125 12126 cpuset = sfmmup->sfmmu_cpusran; 12127 CPUSET_AND(cpuset, cpu_ready_set); 12128 CPUSET_DEL(cpuset, CPU->cpu_id); 12129 SFMMU_XCALL_STATS(sfmmup); 12130 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va, 12131 (uint64_t)sfmmup); 12132 vtag_flushpage(va, (uint64_t)sfmmup); 12133 12134 #ifdef VAC 12135 /* 12136 * Flush D$ 12137 * When flushing D$ we must flush all 12138 * cpu's. See sfmmu_cache_flush(). 12139 */ 12140 if (cache_flush_flag == CACHE_FLUSH) { 12141 cpuset = cpu_ready_set; 12142 CPUSET_DEL(cpuset, CPU->cpu_id); 12143 12144 SFMMU_XCALL_STATS(sfmmup); 12145 vcolor = addr_to_vcolor(va); 12146 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12147 vac_flushpage(pfnum, vcolor); 12148 } 12149 #endif /* VAC */ 12150 } 12151 } 12152 12153 /* 12154 * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of 12155 * a particular virtual address and ctx. If noflush is set we do not 12156 * flush the TLB/TSB. This function may or may not be called with the 12157 * HAT lock held. 12158 */ 12159 static void 12160 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 12161 pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag, 12162 int hat_lock_held) 12163 { 12164 #ifdef VAC 12165 int vcolor; 12166 #endif 12167 cpuset_t cpuset; 12168 hatlock_t *hatlockp; 12169 12170 ASSERT(!hmeblkp->hblk_shared); 12171 12172 #if defined(lint) && !defined(VAC) 12173 pfnum = pfnum; 12174 cpu_flag = cpu_flag; 12175 cache_flush_flag = cache_flush_flag; 12176 #endif 12177 12178 /* 12179 * There is no longer a need to protect against ctx being 12180 * stolen here since we don't store the ctx in the TSB anymore. 12181 */ 12182 #ifdef VAC 12183 vcolor = addr_to_vcolor(addr); 12184 #endif 12185 12186 /* 12187 * We must hold the hat lock during the flush of TLB, 12188 * to avoid a race with sfmmu_invalidate_ctx(), where 12189 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT, 12190 * causing TLB demap routine to skip flush on that MMU. 12191 * If the context on a MMU has already been set to 12192 * INVALID_CONTEXT, we just get an extra flush on 12193 * that MMU. 12194 */ 12195 if (!hat_lock_held && !tlb_noflush) 12196 hatlockp = sfmmu_hat_enter(sfmmup); 12197 12198 kpreempt_disable(); 12199 if (!tlb_noflush) { 12200 /* 12201 * Flush the TSB and TLB. 12202 */ 12203 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 12204 12205 cpuset = sfmmup->sfmmu_cpusran; 12206 CPUSET_AND(cpuset, cpu_ready_set); 12207 CPUSET_DEL(cpuset, CPU->cpu_id); 12208 12209 SFMMU_XCALL_STATS(sfmmup); 12210 12211 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, 12212 (uint64_t)sfmmup); 12213 12214 vtag_flushpage(addr, (uint64_t)sfmmup); 12215 } 12216 12217 if (!hat_lock_held && !tlb_noflush) 12218 sfmmu_hat_exit(hatlockp); 12219 12220 #ifdef VAC 12221 /* 12222 * Flush the D$ 12223 * 12224 * Even if the ctx is stolen, we need to flush the 12225 * cache. Our ctx stealer only flushes the TLBs. 12226 */ 12227 if (cache_flush_flag == CACHE_FLUSH) { 12228 if (cpu_flag & FLUSH_ALL_CPUS) { 12229 cpuset = cpu_ready_set; 12230 } else { 12231 cpuset = sfmmup->sfmmu_cpusran; 12232 CPUSET_AND(cpuset, cpu_ready_set); 12233 } 12234 CPUSET_DEL(cpuset, CPU->cpu_id); 12235 SFMMU_XCALL_STATS(sfmmup); 12236 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12237 vac_flushpage(pfnum, vcolor); 12238 } 12239 #endif /* VAC */ 12240 kpreempt_enable(); 12241 } 12242 12243 /* 12244 * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual 12245 * address and ctx. If noflush is set we do not currently do anything. 12246 * This function may or may not be called with the HAT lock held. 12247 */ 12248 static void 12249 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp, 12250 int tlb_noflush, int hat_lock_held) 12251 { 12252 cpuset_t cpuset; 12253 hatlock_t *hatlockp; 12254 12255 ASSERT(!hmeblkp->hblk_shared); 12256 12257 /* 12258 * If the process is exiting we have nothing to do. 12259 */ 12260 if (tlb_noflush) 12261 return; 12262 12263 /* 12264 * Flush TSB. 12265 */ 12266 if (!hat_lock_held) 12267 hatlockp = sfmmu_hat_enter(sfmmup); 12268 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0); 12269 12270 kpreempt_disable(); 12271 12272 cpuset = sfmmup->sfmmu_cpusran; 12273 CPUSET_AND(cpuset, cpu_ready_set); 12274 CPUSET_DEL(cpuset, CPU->cpu_id); 12275 12276 SFMMU_XCALL_STATS(sfmmup); 12277 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup); 12278 12279 vtag_flushpage(addr, (uint64_t)sfmmup); 12280 12281 if (!hat_lock_held) 12282 sfmmu_hat_exit(hatlockp); 12283 12284 kpreempt_enable(); 12285 12286 } 12287 12288 /* 12289 * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall 12290 * call handler that can flush a range of pages to save on xcalls. 12291 */ 12292 static int sfmmu_xcall_save; 12293 12294 /* 12295 * this routine is never used for demaping addresses backed by SRD hmeblks. 12296 */ 12297 static void 12298 sfmmu_tlb_range_demap(demap_range_t *dmrp) 12299 { 12300 sfmmu_t *sfmmup = dmrp->dmr_sfmmup; 12301 hatlock_t *hatlockp; 12302 cpuset_t cpuset; 12303 uint64_t sfmmu_pgcnt; 12304 pgcnt_t pgcnt = 0; 12305 int pgunload = 0; 12306 int dirtypg = 0; 12307 caddr_t addr = dmrp->dmr_addr; 12308 caddr_t eaddr; 12309 uint64_t bitvec = dmrp->dmr_bitvec; 12310 12311 ASSERT(bitvec & 1); 12312 12313 /* 12314 * Flush TSB and calculate number of pages to flush. 12315 */ 12316 while (bitvec != 0) { 12317 dirtypg = 0; 12318 /* 12319 * Find the first page to flush and then count how many 12320 * pages there are after it that also need to be flushed. 12321 * This way the number of TSB flushes is minimized. 12322 */ 12323 while ((bitvec & 1) == 0) { 12324 pgcnt++; 12325 addr += MMU_PAGESIZE; 12326 bitvec >>= 1; 12327 } 12328 while (bitvec & 1) { 12329 dirtypg++; 12330 bitvec >>= 1; 12331 } 12332 eaddr = addr + ptob(dirtypg); 12333 hatlockp = sfmmu_hat_enter(sfmmup); 12334 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K); 12335 sfmmu_hat_exit(hatlockp); 12336 pgunload += dirtypg; 12337 addr = eaddr; 12338 pgcnt += dirtypg; 12339 } 12340 12341 ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr); 12342 if (sfmmup->sfmmu_free == 0) { 12343 addr = dmrp->dmr_addr; 12344 bitvec = dmrp->dmr_bitvec; 12345 12346 /* 12347 * make sure it has SFMMU_PGCNT_SHIFT bits only, 12348 * as it will be used to pack argument for xt_some 12349 */ 12350 ASSERT((pgcnt > 0) && 12351 (pgcnt <= (1 << SFMMU_PGCNT_SHIFT))); 12352 12353 /* 12354 * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in 12355 * the low 6 bits of sfmmup. This is doable since pgcnt 12356 * always >= 1. 12357 */ 12358 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK)); 12359 sfmmu_pgcnt = (uint64_t)sfmmup | 12360 ((pgcnt - 1) & SFMMU_PGCNT_MASK); 12361 12362 /* 12363 * We must hold the hat lock during the flush of TLB, 12364 * to avoid a race with sfmmu_invalidate_ctx(), where 12365 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT, 12366 * causing TLB demap routine to skip flush on that MMU. 12367 * If the context on a MMU has already been set to 12368 * INVALID_CONTEXT, we just get an extra flush on 12369 * that MMU. 12370 */ 12371 hatlockp = sfmmu_hat_enter(sfmmup); 12372 kpreempt_disable(); 12373 12374 cpuset = sfmmup->sfmmu_cpusran; 12375 CPUSET_AND(cpuset, cpu_ready_set); 12376 CPUSET_DEL(cpuset, CPU->cpu_id); 12377 12378 SFMMU_XCALL_STATS(sfmmup); 12379 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr, 12380 sfmmu_pgcnt); 12381 12382 for (; bitvec != 0; bitvec >>= 1) { 12383 if (bitvec & 1) 12384 vtag_flushpage(addr, (uint64_t)sfmmup); 12385 addr += MMU_PAGESIZE; 12386 } 12387 kpreempt_enable(); 12388 sfmmu_hat_exit(hatlockp); 12389 12390 sfmmu_xcall_save += (pgunload-1); 12391 } 12392 dmrp->dmr_bitvec = 0; 12393 } 12394 12395 /* 12396 * In cases where we need to synchronize with TLB/TSB miss trap 12397 * handlers, _and_ need to flush the TLB, it's a lot easier to 12398 * throw away the context from the process than to do a 12399 * special song and dance to keep things consistent for the 12400 * handlers. 12401 * 12402 * Since the process suddenly ends up without a context and our caller 12403 * holds the hat lock, threads that fault after this function is called 12404 * will pile up on the lock. We can then do whatever we need to 12405 * atomically from the context of the caller. The first blocked thread 12406 * to resume executing will get the process a new context, and the 12407 * process will resume executing. 12408 * 12409 * One added advantage of this approach is that on MMUs that 12410 * support a "flush all" operation, we will delay the flush until 12411 * cnum wrap-around, and then flush the TLB one time. This 12412 * is rather rare, so it's a lot less expensive than making 8000 12413 * x-calls to flush the TLB 8000 times. 12414 * 12415 * A per-process (PP) lock is used to synchronize ctx allocations in 12416 * resume() and ctx invalidations here. 12417 */ 12418 static void 12419 sfmmu_invalidate_ctx(sfmmu_t *sfmmup) 12420 { 12421 cpuset_t cpuset; 12422 int cnum, currcnum; 12423 mmu_ctx_t *mmu_ctxp; 12424 int i; 12425 uint_t pstate_save; 12426 12427 SFMMU_STAT(sf_ctx_inv); 12428 12429 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12430 ASSERT(sfmmup != ksfmmup); 12431 12432 kpreempt_disable(); 12433 12434 mmu_ctxp = CPU_MMU_CTXP(CPU); 12435 ASSERT(mmu_ctxp); 12436 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms); 12437 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]); 12438 12439 currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum; 12440 12441 pstate_save = sfmmu_disable_intrs(); 12442 12443 lock_set(&sfmmup->sfmmu_ctx_lock); /* acquire PP lock */ 12444 /* set HAT cnum invalid across all context domains. */ 12445 for (i = 0; i < max_mmu_ctxdoms; i++) { 12446 12447 cnum = sfmmup->sfmmu_ctxs[i].cnum; 12448 if (cnum == INVALID_CONTEXT) { 12449 continue; 12450 } 12451 12452 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT; 12453 } 12454 membar_enter(); /* make sure globally visible to all CPUs */ 12455 lock_clear(&sfmmup->sfmmu_ctx_lock); /* release PP lock */ 12456 12457 sfmmu_enable_intrs(pstate_save); 12458 12459 cpuset = sfmmup->sfmmu_cpusran; 12460 CPUSET_DEL(cpuset, CPU->cpu_id); 12461 CPUSET_AND(cpuset, cpu_ready_set); 12462 if (!CPUSET_ISNULL(cpuset)) { 12463 SFMMU_XCALL_STATS(sfmmup); 12464 xt_some(cpuset, sfmmu_raise_tsb_exception, 12465 (uint64_t)sfmmup, INVALID_CONTEXT); 12466 xt_sync(cpuset); 12467 SFMMU_STAT(sf_tsb_raise_exception); 12468 SFMMU_MMU_STAT(mmu_tsb_raise_exception); 12469 } 12470 12471 /* 12472 * If the hat to-be-invalidated is the same as the current 12473 * process on local CPU we need to invalidate 12474 * this CPU context as well. 12475 */ 12476 if ((sfmmu_getctx_sec() == currcnum) && 12477 (currcnum != INVALID_CONTEXT)) { 12478 /* sets shared context to INVALID too */ 12479 sfmmu_setctx_sec(INVALID_CONTEXT); 12480 sfmmu_clear_utsbinfo(); 12481 } 12482 12483 SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID); 12484 12485 kpreempt_enable(); 12486 12487 /* 12488 * we hold the hat lock, so nobody should allocate a context 12489 * for us yet 12490 */ 12491 ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT); 12492 } 12493 12494 #ifdef VAC 12495 /* 12496 * We need to flush the cache in all cpus. It is possible that 12497 * a process referenced a page as cacheable but has sinced exited 12498 * and cleared the mapping list. We still to flush it but have no 12499 * state so all cpus is the only alternative. 12500 */ 12501 void 12502 sfmmu_cache_flush(pfn_t pfnum, int vcolor) 12503 { 12504 cpuset_t cpuset; 12505 12506 kpreempt_disable(); 12507 cpuset = cpu_ready_set; 12508 CPUSET_DEL(cpuset, CPU->cpu_id); 12509 SFMMU_XCALL_STATS(NULL); /* account to any ctx */ 12510 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor); 12511 xt_sync(cpuset); 12512 vac_flushpage(pfnum, vcolor); 12513 kpreempt_enable(); 12514 } 12515 12516 void 12517 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum) 12518 { 12519 cpuset_t cpuset; 12520 12521 ASSERT(vcolor >= 0); 12522 12523 kpreempt_disable(); 12524 cpuset = cpu_ready_set; 12525 CPUSET_DEL(cpuset, CPU->cpu_id); 12526 SFMMU_XCALL_STATS(NULL); /* account to any ctx */ 12527 xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum); 12528 xt_sync(cpuset); 12529 vac_flushcolor(vcolor, pfnum); 12530 kpreempt_enable(); 12531 } 12532 #endif /* VAC */ 12533 12534 /* 12535 * We need to prevent processes from accessing the TSB using a cached physical 12536 * address. It's alright if they try to access the TSB via virtual address 12537 * since they will just fault on that virtual address once the mapping has 12538 * been suspended. 12539 */ 12540 #pragma weak sendmondo_in_recover 12541 12542 /* ARGSUSED */ 12543 static int 12544 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo) 12545 { 12546 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo; 12547 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu; 12548 hatlock_t *hatlockp; 12549 sf_scd_t *scdp; 12550 12551 if (flags != HAT_PRESUSPEND) 12552 return (0); 12553 12554 /* 12555 * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must 12556 * be a shared hat, then set SCD's tsbinfo's flag. 12557 * If tsb is not shared, sfmmup is a private hat, then set 12558 * its private tsbinfo's flag. 12559 */ 12560 hatlockp = sfmmu_hat_enter(sfmmup); 12561 tsbinfop->tsb_flags |= TSB_RELOC_FLAG; 12562 12563 if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) { 12564 sfmmu_tsb_inv_ctx(sfmmup); 12565 sfmmu_hat_exit(hatlockp); 12566 } else { 12567 /* release lock on the shared hat */ 12568 sfmmu_hat_exit(hatlockp); 12569 /* sfmmup is a shared hat */ 12570 ASSERT(sfmmup->sfmmu_scdhat); 12571 scdp = sfmmup->sfmmu_scdp; 12572 ASSERT(scdp != NULL); 12573 /* get private hat from the scd list */ 12574 mutex_enter(&scdp->scd_mutex); 12575 sfmmup = scdp->scd_sf_list; 12576 while (sfmmup != NULL) { 12577 hatlockp = sfmmu_hat_enter(sfmmup); 12578 /* 12579 * We do not call sfmmu_tsb_inv_ctx here because 12580 * sendmondo_in_recover check is only needed for 12581 * sun4u. 12582 */ 12583 sfmmu_invalidate_ctx(sfmmup); 12584 sfmmu_hat_exit(hatlockp); 12585 sfmmup = sfmmup->sfmmu_scd_link.next; 12586 12587 } 12588 mutex_exit(&scdp->scd_mutex); 12589 } 12590 return (0); 12591 } 12592 12593 static void 12594 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup) 12595 { 12596 extern uint32_t sendmondo_in_recover; 12597 12598 ASSERT(sfmmu_hat_lock_held(sfmmup)); 12599 12600 /* 12601 * For Cheetah+ Erratum 25: 12602 * Wait for any active recovery to finish. We can't risk 12603 * relocating the TSB of the thread running mondo_recover_proc() 12604 * since, if we did that, we would deadlock. The scenario we are 12605 * trying to avoid is as follows: 12606 * 12607 * THIS CPU RECOVER CPU 12608 * -------- ----------- 12609 * Begins recovery, walking through TSB 12610 * hat_pagesuspend() TSB TTE 12611 * TLB miss on TSB TTE, spins at TL1 12612 * xt_sync() 12613 * send_mondo_timeout() 12614 * mondo_recover_proc() 12615 * ((deadlocked)) 12616 * 12617 * The second half of the workaround is that mondo_recover_proc() 12618 * checks to see if the tsb_info has the RELOC flag set, and if it 12619 * does, it skips over that TSB without ever touching tsbinfop->tsb_va 12620 * and hence avoiding the TLB miss that could result in a deadlock. 12621 */ 12622 if (&sendmondo_in_recover) { 12623 membar_enter(); /* make sure RELOC flag visible */ 12624 while (sendmondo_in_recover) { 12625 drv_usecwait(1); 12626 membar_consumer(); 12627 } 12628 } 12629 12630 sfmmu_invalidate_ctx(sfmmup); 12631 } 12632 12633 /* ARGSUSED */ 12634 static int 12635 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags, 12636 void *tsbinfo, pfn_t newpfn) 12637 { 12638 hatlock_t *hatlockp; 12639 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo; 12640 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu; 12641 12642 if (flags != HAT_POSTUNSUSPEND) 12643 return (0); 12644 12645 hatlockp = sfmmu_hat_enter(sfmmup); 12646 12647 SFMMU_STAT(sf_tsb_reloc); 12648 12649 /* 12650 * The process may have swapped out while we were relocating one 12651 * of its TSBs. If so, don't bother doing the setup since the 12652 * process can't be using the memory anymore. 12653 */ 12654 if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) { 12655 ASSERT(va == tsbinfop->tsb_va); 12656 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn); 12657 12658 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) { 12659 sfmmu_inv_tsb(tsbinfop->tsb_va, 12660 TSB_BYTES(tsbinfop->tsb_szc)); 12661 tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED; 12662 } 12663 } 12664 12665 membar_exit(); 12666 tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG; 12667 cv_broadcast(&sfmmup->sfmmu_tsb_cv); 12668 12669 sfmmu_hat_exit(hatlockp); 12670 12671 return (0); 12672 } 12673 12674 /* 12675 * Allocate and initialize a tsb_info structure. Note that we may or may not 12676 * allocate a TSB here, depending on the flags passed in. 12677 */ 12678 static int 12679 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask, 12680 uint_t flags, sfmmu_t *sfmmup) 12681 { 12682 int err; 12683 12684 *tsbinfopp = (struct tsb_info *)kmem_cache_alloc( 12685 sfmmu_tsbinfo_cache, KM_SLEEP); 12686 12687 if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask, 12688 tsb_szc, flags, sfmmup)) != 0) { 12689 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp); 12690 SFMMU_STAT(sf_tsb_allocfail); 12691 *tsbinfopp = NULL; 12692 return (err); 12693 } 12694 SFMMU_STAT(sf_tsb_alloc); 12695 12696 /* 12697 * Bump the TSB size counters for this TSB size. 12698 */ 12699 (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++; 12700 return (0); 12701 } 12702 12703 static void 12704 sfmmu_tsb_free(struct tsb_info *tsbinfo) 12705 { 12706 caddr_t tsbva = tsbinfo->tsb_va; 12707 uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc); 12708 struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache; 12709 vmem_t *vmp = tsbinfo->tsb_vmp; 12710 12711 /* 12712 * If we allocated this TSB from relocatable kernel memory, then we 12713 * need to uninstall the callback handler. 12714 */ 12715 if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) { 12716 uintptr_t slab_mask; 12717 caddr_t slab_vaddr; 12718 page_t **ppl; 12719 int ret; 12720 12721 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena); 12722 if (tsb_size > MMU_PAGESIZE4M) 12723 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT; 12724 else 12725 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT; 12726 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask); 12727 12728 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE); 12729 ASSERT(ret == 0); 12730 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo, 12731 0, NULL); 12732 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE); 12733 } 12734 12735 if (kmem_cachep != NULL) { 12736 kmem_cache_free(kmem_cachep, tsbva); 12737 } else { 12738 vmem_xfree(vmp, (void *)tsbva, tsb_size); 12739 } 12740 tsbinfo->tsb_va = (caddr_t)0xbad00bad; 12741 atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size); 12742 } 12743 12744 static void 12745 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo) 12746 { 12747 if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) { 12748 sfmmu_tsb_free(tsbinfo); 12749 } 12750 kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo); 12751 12752 } 12753 12754 /* 12755 * Setup all the references to physical memory for this tsbinfo. 12756 * The underlying page(s) must be locked. 12757 */ 12758 static void 12759 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn) 12760 { 12761 ASSERT(pfn != PFN_INVALID); 12762 ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va)); 12763 12764 #ifndef sun4v 12765 if (tsbinfo->tsb_szc == 0) { 12766 sfmmu_memtte(&tsbinfo->tsb_tte, pfn, 12767 PROT_WRITE|PROT_READ, TTE8K); 12768 } else { 12769 /* 12770 * Round down PA and use a large mapping; the handlers will 12771 * compute the TSB pointer at the correct offset into the 12772 * big virtual page. NOTE: this assumes all TSBs larger 12773 * than 8K must come from physically contiguous slabs of 12774 * size tsb_slab_size. 12775 */ 12776 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask, 12777 PROT_WRITE|PROT_READ, tsb_slab_ttesz); 12778 } 12779 tsbinfo->tsb_pa = ptob(pfn); 12780 12781 TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */ 12782 TTE_SET_MOD(&tsbinfo->tsb_tte); /* enable writes */ 12783 12784 ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte)); 12785 ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte)); 12786 #else /* sun4v */ 12787 tsbinfo->tsb_pa = ptob(pfn); 12788 #endif /* sun4v */ 12789 } 12790 12791 12792 /* 12793 * Returns zero on success, ENOMEM if over the high water mark, 12794 * or EAGAIN if the caller needs to retry with a smaller TSB 12795 * size (or specify TSB_FORCEALLOC if the allocation can't fail). 12796 * 12797 * This call cannot fail to allocate a TSB if TSB_FORCEALLOC 12798 * is specified and the TSB requested is PAGESIZE, though it 12799 * may sleep waiting for memory if sufficient memory is not 12800 * available. 12801 */ 12802 static int 12803 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask, 12804 int tsbcode, uint_t flags, sfmmu_t *sfmmup) 12805 { 12806 caddr_t vaddr = NULL; 12807 caddr_t slab_vaddr; 12808 uintptr_t slab_mask; 12809 int tsbbytes = TSB_BYTES(tsbcode); 12810 int lowmem = 0; 12811 struct kmem_cache *kmem_cachep = NULL; 12812 vmem_t *vmp = NULL; 12813 lgrp_id_t lgrpid = LGRP_NONE; 12814 pfn_t pfn; 12815 uint_t cbflags = HAC_SLEEP; 12816 page_t **pplist; 12817 int ret; 12818 12819 ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena); 12820 if (tsbbytes > MMU_PAGESIZE4M) 12821 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT; 12822 else 12823 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT; 12824 12825 if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK)) 12826 flags |= TSB_ALLOC; 12827 12828 ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE); 12829 12830 tsbinfo->tsb_sfmmu = sfmmup; 12831 12832 /* 12833 * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and 12834 * return. 12835 */ 12836 if ((flags & TSB_ALLOC) == 0) { 12837 tsbinfo->tsb_szc = tsbcode; 12838 tsbinfo->tsb_ttesz_mask = tteszmask; 12839 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef; 12840 tsbinfo->tsb_pa = -1; 12841 tsbinfo->tsb_tte.ll = 0; 12842 tsbinfo->tsb_next = NULL; 12843 tsbinfo->tsb_flags = TSB_SWAPPED; 12844 tsbinfo->tsb_cache = NULL; 12845 tsbinfo->tsb_vmp = NULL; 12846 return (0); 12847 } 12848 12849 #ifdef DEBUG 12850 /* 12851 * For debugging: 12852 * Randomly force allocation failures every tsb_alloc_mtbf 12853 * tries if TSB_FORCEALLOC is not specified. This will 12854 * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if 12855 * it is even, to allow testing of both failure paths... 12856 */ 12857 if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) && 12858 (tsb_alloc_count++ == tsb_alloc_mtbf)) { 12859 tsb_alloc_count = 0; 12860 tsb_alloc_fail_mtbf++; 12861 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN); 12862 } 12863 #endif /* DEBUG */ 12864 12865 /* 12866 * Enforce high water mark if we are not doing a forced allocation 12867 * and are not shrinking a process' TSB. 12868 */ 12869 if ((flags & TSB_SHRINK) == 0 && 12870 (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) { 12871 if ((flags & TSB_FORCEALLOC) == 0) 12872 return (ENOMEM); 12873 lowmem = 1; 12874 } 12875 12876 /* 12877 * Allocate from the correct location based upon the size of the TSB 12878 * compared to the base page size, and what memory conditions dictate. 12879 * Note we always do nonblocking allocations from the TSB arena since 12880 * we don't want memory fragmentation to cause processes to block 12881 * indefinitely waiting for memory; until the kernel algorithms that 12882 * coalesce large pages are improved this is our best option. 12883 * 12884 * Algorithm: 12885 * If allocating a "large" TSB (>8K), allocate from the 12886 * appropriate kmem_tsb_default_arena vmem arena 12887 * else if low on memory or the TSB_FORCEALLOC flag is set or 12888 * tsb_forceheap is set 12889 * Allocate from kernel heap via sfmmu_tsb8k_cache with 12890 * KM_SLEEP (never fails) 12891 * else 12892 * Allocate from appropriate sfmmu_tsb_cache with 12893 * KM_NOSLEEP 12894 * endif 12895 */ 12896 if (tsb_lgrp_affinity) 12897 lgrpid = lgrp_home_id(curthread); 12898 if (lgrpid == LGRP_NONE) 12899 lgrpid = 0; /* use lgrp of boot CPU */ 12900 12901 if (tsbbytes > MMU_PAGESIZE) { 12902 if (tsbbytes > MMU_PAGESIZE4M) { 12903 vmp = kmem_bigtsb_default_arena[lgrpid]; 12904 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes, 12905 0, 0, NULL, NULL, VM_NOSLEEP); 12906 } else { 12907 vmp = kmem_tsb_default_arena[lgrpid]; 12908 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes, 12909 0, 0, NULL, NULL, VM_NOSLEEP); 12910 } 12911 #ifdef DEBUG 12912 } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) { 12913 #else /* !DEBUG */ 12914 } else if (lowmem || (flags & TSB_FORCEALLOC)) { 12915 #endif /* DEBUG */ 12916 kmem_cachep = sfmmu_tsb8k_cache; 12917 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP); 12918 ASSERT(vaddr != NULL); 12919 } else { 12920 kmem_cachep = sfmmu_tsb_cache[lgrpid]; 12921 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP); 12922 } 12923 12924 tsbinfo->tsb_cache = kmem_cachep; 12925 tsbinfo->tsb_vmp = vmp; 12926 12927 if (vaddr == NULL) { 12928 return (EAGAIN); 12929 } 12930 12931 atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes); 12932 kmem_cachep = tsbinfo->tsb_cache; 12933 12934 /* 12935 * If we are allocating from outside the cage, then we need to 12936 * register a relocation callback handler. Note that for now 12937 * since pseudo mappings always hang off of the slab's root page, 12938 * we need only lock the first 8K of the TSB slab. This is a bit 12939 * hacky but it is good for performance. 12940 */ 12941 if (kmem_cachep != sfmmu_tsb8k_cache) { 12942 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask); 12943 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE); 12944 ASSERT(ret == 0); 12945 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes, 12946 cbflags, (void *)tsbinfo, &pfn, NULL); 12947 12948 /* 12949 * Need to free up resources if we could not successfully 12950 * add the callback function and return an error condition. 12951 */ 12952 if (ret != 0) { 12953 if (kmem_cachep) { 12954 kmem_cache_free(kmem_cachep, vaddr); 12955 } else { 12956 vmem_xfree(vmp, (void *)vaddr, tsbbytes); 12957 } 12958 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, 12959 S_WRITE); 12960 return (EAGAIN); 12961 } 12962 } else { 12963 /* 12964 * Since allocation of 8K TSBs from heap is rare and occurs 12965 * during memory pressure we allocate them from permanent 12966 * memory rather than using callbacks to get the PFN. 12967 */ 12968 pfn = hat_getpfnum(kas.a_hat, vaddr); 12969 } 12970 12971 tsbinfo->tsb_va = vaddr; 12972 tsbinfo->tsb_szc = tsbcode; 12973 tsbinfo->tsb_ttesz_mask = tteszmask; 12974 tsbinfo->tsb_next = NULL; 12975 tsbinfo->tsb_flags = 0; 12976 12977 sfmmu_tsbinfo_setup_phys(tsbinfo, pfn); 12978 12979 sfmmu_inv_tsb(vaddr, tsbbytes); 12980 12981 if (kmem_cachep != sfmmu_tsb8k_cache) { 12982 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE); 12983 } 12984 12985 return (0); 12986 } 12987 12988 /* 12989 * Initialize per cpu tsb and per cpu tsbmiss_area 12990 */ 12991 void 12992 sfmmu_init_tsbs(void) 12993 { 12994 int i; 12995 struct tsbmiss *tsbmissp; 12996 struct kpmtsbm *kpmtsbmp; 12997 #ifndef sun4v 12998 extern int dcache_line_mask; 12999 #endif /* sun4v */ 13000 extern uint_t vac_colors; 13001 13002 /* 13003 * Init. tsb miss area. 13004 */ 13005 tsbmissp = tsbmiss_area; 13006 13007 for (i = 0; i < NCPU; tsbmissp++, i++) { 13008 /* 13009 * initialize the tsbmiss area. 13010 * Do this for all possible CPUs as some may be added 13011 * while the system is running. There is no cost to this. 13012 */ 13013 tsbmissp->ksfmmup = ksfmmup; 13014 #ifndef sun4v 13015 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask; 13016 #endif /* sun4v */ 13017 tsbmissp->khashstart = 13018 (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash); 13019 tsbmissp->uhashstart = 13020 (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash); 13021 tsbmissp->khashsz = khmehash_num; 13022 tsbmissp->uhashsz = uhmehash_num; 13023 } 13024 13025 sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B', 13026 sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0); 13027 13028 if (kpm_enable == 0) 13029 return; 13030 13031 /* -- Begin KPM specific init -- */ 13032 13033 if (kpm_smallpages) { 13034 /* 13035 * If we're using base pagesize pages for seg_kpm 13036 * mappings, we use the kernel TSB since we can't afford 13037 * to allocate a second huge TSB for these mappings. 13038 */ 13039 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base; 13040 kpm_tsbsz = ktsb_szcode; 13041 kpmsm_tsbbase = kpm_tsbbase; 13042 kpmsm_tsbsz = kpm_tsbsz; 13043 } else { 13044 /* 13045 * In VAC conflict case, just put the entries in the 13046 * kernel 8K indexed TSB for now so we can find them. 13047 * This could really be changed in the future if we feel 13048 * the need... 13049 */ 13050 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base; 13051 kpmsm_tsbsz = ktsb_szcode; 13052 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base; 13053 kpm_tsbsz = ktsb4m_szcode; 13054 } 13055 13056 kpmtsbmp = kpmtsbm_area; 13057 for (i = 0; i < NCPU; kpmtsbmp++, i++) { 13058 /* 13059 * Initialize the kpmtsbm area. 13060 * Do this for all possible CPUs as some may be added 13061 * while the system is running. There is no cost to this. 13062 */ 13063 kpmtsbmp->vbase = kpm_vbase; 13064 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors; 13065 kpmtsbmp->sz_shift = kpm_size_shift; 13066 kpmtsbmp->kpmp_shift = kpmp_shift; 13067 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft; 13068 if (kpm_smallpages == 0) { 13069 kpmtsbmp->kpmp_table_sz = kpmp_table_sz; 13070 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table); 13071 } else { 13072 kpmtsbmp->kpmp_table_sz = kpmp_stable_sz; 13073 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable); 13074 } 13075 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash); 13076 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG; 13077 #ifdef DEBUG 13078 kpmtsbmp->flags |= (kpm_tsbmtl) ? KPMTSBM_TLTSBM_FLAG : 0; 13079 #endif /* DEBUG */ 13080 if (ktsb_phys) 13081 kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG; 13082 } 13083 13084 /* -- End KPM specific init -- */ 13085 } 13086 13087 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */ 13088 struct tsb_info ktsb_info[2]; 13089 13090 /* 13091 * Called from hat_kern_setup() to setup the tsb_info for ksfmmup. 13092 */ 13093 void 13094 sfmmu_init_ktsbinfo() 13095 { 13096 ASSERT(ksfmmup != NULL); 13097 ASSERT(ksfmmup->sfmmu_tsb == NULL); 13098 /* 13099 * Allocate tsbinfos for kernel and copy in data 13100 * to make debug easier and sun4v setup easier. 13101 */ 13102 ktsb_info[0].tsb_sfmmu = ksfmmup; 13103 ktsb_info[0].tsb_szc = ktsb_szcode; 13104 ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K; 13105 ktsb_info[0].tsb_va = ktsb_base; 13106 ktsb_info[0].tsb_pa = ktsb_pbase; 13107 ktsb_info[0].tsb_flags = 0; 13108 ktsb_info[0].tsb_tte.ll = 0; 13109 ktsb_info[0].tsb_cache = NULL; 13110 13111 ktsb_info[1].tsb_sfmmu = ksfmmup; 13112 ktsb_info[1].tsb_szc = ktsb4m_szcode; 13113 ktsb_info[1].tsb_ttesz_mask = TSB4M; 13114 ktsb_info[1].tsb_va = ktsb4m_base; 13115 ktsb_info[1].tsb_pa = ktsb4m_pbase; 13116 ktsb_info[1].tsb_flags = 0; 13117 ktsb_info[1].tsb_tte.ll = 0; 13118 ktsb_info[1].tsb_cache = NULL; 13119 13120 /* Link them into ksfmmup. */ 13121 ktsb_info[0].tsb_next = &ktsb_info[1]; 13122 ktsb_info[1].tsb_next = NULL; 13123 ksfmmup->sfmmu_tsb = &ktsb_info[0]; 13124 13125 sfmmu_setup_tsbinfo(ksfmmup); 13126 } 13127 13128 /* 13129 * Cache the last value returned from va_to_pa(). If the VA specified 13130 * in the current call to cached_va_to_pa() maps to the same Page (as the 13131 * previous call to cached_va_to_pa()), then compute the PA using 13132 * cached info, else call va_to_pa(). 13133 * 13134 * Note: this function is neither MT-safe nor consistent in the presence 13135 * of multiple, interleaved threads. This function was created to enable 13136 * an optimization used during boot (at a point when there's only one thread 13137 * executing on the "boot CPU", and before startup_vm() has been called). 13138 */ 13139 static uint64_t 13140 cached_va_to_pa(void *vaddr) 13141 { 13142 static uint64_t prev_vaddr_base = 0; 13143 static uint64_t prev_pfn = 0; 13144 13145 if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) { 13146 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET)); 13147 } else { 13148 uint64_t pa = va_to_pa(vaddr); 13149 13150 if (pa != ((uint64_t)-1)) { 13151 /* 13152 * Computed physical address is valid. Cache its 13153 * related info for the next cached_va_to_pa() call. 13154 */ 13155 prev_pfn = pa & MMU_PAGEMASK; 13156 prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK; 13157 } 13158 13159 return (pa); 13160 } 13161 } 13162 13163 /* 13164 * Carve up our nucleus hblk region. We may allocate more hblks than 13165 * asked due to rounding errors but we are guaranteed to have at least 13166 * enough space to allocate the requested number of hblk8's and hblk1's. 13167 */ 13168 void 13169 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1) 13170 { 13171 struct hme_blk *hmeblkp; 13172 size_t hme8blk_sz, hme1blk_sz; 13173 size_t i; 13174 size_t hblk8_bound; 13175 ulong_t j = 0, k = 0; 13176 13177 ASSERT(addr != NULL && size != 0); 13178 13179 /* Need to use proper structure alignment */ 13180 hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t)); 13181 hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t)); 13182 13183 nucleus_hblk8.list = (void *)addr; 13184 nucleus_hblk8.index = 0; 13185 13186 /* 13187 * Use as much memory as possible for hblk8's since we 13188 * expect all bop_alloc'ed memory to be allocated in 8k chunks. 13189 * We need to hold back enough space for the hblk1's which 13190 * we'll allocate next. 13191 */ 13192 hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz; 13193 for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) { 13194 hmeblkp = (struct hme_blk *)addr; 13195 addr += hme8blk_sz; 13196 hmeblkp->hblk_nuc_bit = 1; 13197 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp); 13198 } 13199 nucleus_hblk8.len = j; 13200 ASSERT(j >= nhblk8); 13201 SFMMU_STAT_ADD(sf_hblk8_ncreate, j); 13202 13203 nucleus_hblk1.list = (void *)addr; 13204 nucleus_hblk1.index = 0; 13205 for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) { 13206 hmeblkp = (struct hme_blk *)addr; 13207 addr += hme1blk_sz; 13208 hmeblkp->hblk_nuc_bit = 1; 13209 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp); 13210 } 13211 ASSERT(k >= nhblk1); 13212 nucleus_hblk1.len = k; 13213 SFMMU_STAT_ADD(sf_hblk1_ncreate, k); 13214 } 13215 13216 /* 13217 * This function is currently not supported on this platform. For what 13218 * it's supposed to do, see hat.c and hat_srmmu.c 13219 */ 13220 /* ARGSUSED */ 13221 faultcode_t 13222 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp, 13223 uint_t flags) 13224 { 13225 return (FC_NOSUPPORT); 13226 } 13227 13228 /* 13229 * Searchs the mapping list of the page for a mapping of the same size. If not 13230 * found the corresponding bit is cleared in the p_index field. When large 13231 * pages are more prevalent in the system, we can maintain the mapping list 13232 * in order and we don't have to traverse the list each time. Just check the 13233 * next and prev entries, and if both are of different size, we clear the bit. 13234 */ 13235 static void 13236 sfmmu_rm_large_mappings(page_t *pp, int ttesz) 13237 { 13238 struct sf_hment *sfhmep; 13239 struct hme_blk *hmeblkp; 13240 int index; 13241 pgcnt_t npgs; 13242 13243 ASSERT(ttesz > TTE8K); 13244 13245 ASSERT(sfmmu_mlist_held(pp)); 13246 13247 ASSERT(PP_ISMAPPED_LARGE(pp)); 13248 13249 /* 13250 * Traverse mapping list looking for another mapping of same size. 13251 * since we only want to clear index field if all mappings of 13252 * that size are gone. 13253 */ 13254 13255 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) { 13256 if (IS_PAHME(sfhmep)) 13257 continue; 13258 hmeblkp = sfmmu_hmetohblk(sfhmep); 13259 if (hme_size(sfhmep) == ttesz) { 13260 /* 13261 * another mapping of the same size. don't clear index. 13262 */ 13263 return; 13264 } 13265 } 13266 13267 /* 13268 * Clear the p_index bit for large page. 13269 */ 13270 index = PAGESZ_TO_INDEX(ttesz); 13271 npgs = TTEPAGES(ttesz); 13272 while (npgs-- > 0) { 13273 ASSERT(pp->p_index & index); 13274 pp->p_index &= ~index; 13275 pp = PP_PAGENEXT(pp); 13276 } 13277 } 13278 13279 /* 13280 * return supported features 13281 */ 13282 /* ARGSUSED */ 13283 int 13284 hat_supported(enum hat_features feature, void *arg) 13285 { 13286 switch (feature) { 13287 case HAT_SHARED_PT: 13288 case HAT_DYNAMIC_ISM_UNMAP: 13289 case HAT_VMODSORT: 13290 return (1); 13291 case HAT_SHARED_REGIONS: 13292 if (shctx_on) 13293 return (1); 13294 else 13295 return (0); 13296 default: 13297 return (0); 13298 } 13299 } 13300 13301 void 13302 hat_enter(struct hat *hat) 13303 { 13304 hatlock_t *hatlockp; 13305 13306 if (hat != ksfmmup) { 13307 hatlockp = TSB_HASH(hat); 13308 mutex_enter(HATLOCK_MUTEXP(hatlockp)); 13309 } 13310 } 13311 13312 void 13313 hat_exit(struct hat *hat) 13314 { 13315 hatlock_t *hatlockp; 13316 13317 if (hat != ksfmmup) { 13318 hatlockp = TSB_HASH(hat); 13319 mutex_exit(HATLOCK_MUTEXP(hatlockp)); 13320 } 13321 } 13322 13323 /*ARGSUSED*/ 13324 void 13325 hat_reserve(struct as *as, caddr_t addr, size_t len) 13326 { 13327 } 13328 13329 static void 13330 hat_kstat_init(void) 13331 { 13332 kstat_t *ksp; 13333 13334 ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat", 13335 KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat), 13336 KSTAT_FLAG_VIRTUAL); 13337 if (ksp) { 13338 ksp->ks_data = (void *) &sfmmu_global_stat; 13339 kstat_install(ksp); 13340 } 13341 ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat", 13342 KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat), 13343 KSTAT_FLAG_VIRTUAL); 13344 if (ksp) { 13345 ksp->ks_data = (void *) &sfmmu_tsbsize_stat; 13346 kstat_install(ksp); 13347 } 13348 ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat", 13349 KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU, 13350 KSTAT_FLAG_WRITABLE); 13351 if (ksp) { 13352 ksp->ks_update = sfmmu_kstat_percpu_update; 13353 kstat_install(ksp); 13354 } 13355 } 13356 13357 /* ARGSUSED */ 13358 static int 13359 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw) 13360 { 13361 struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data; 13362 struct tsbmiss *tsbm = tsbmiss_area; 13363 struct kpmtsbm *kpmtsbm = kpmtsbm_area; 13364 int i; 13365 13366 ASSERT(cpu_kstat); 13367 if (rw == KSTAT_READ) { 13368 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) { 13369 cpu_kstat->sf_itlb_misses = 0; 13370 cpu_kstat->sf_dtlb_misses = 0; 13371 cpu_kstat->sf_utsb_misses = tsbm->utsb_misses - 13372 tsbm->uprot_traps; 13373 cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses + 13374 kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps; 13375 cpu_kstat->sf_tsb_hits = 0; 13376 cpu_kstat->sf_umod_faults = tsbm->uprot_traps; 13377 cpu_kstat->sf_kmod_faults = tsbm->kprot_traps; 13378 } 13379 } else { 13380 /* KSTAT_WRITE is used to clear stats */ 13381 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) { 13382 tsbm->utsb_misses = 0; 13383 tsbm->ktsb_misses = 0; 13384 tsbm->uprot_traps = 0; 13385 tsbm->kprot_traps = 0; 13386 kpmtsbm->kpm_dtlb_misses = 0; 13387 kpmtsbm->kpm_tsb_misses = 0; 13388 } 13389 } 13390 return (0); 13391 } 13392 13393 #ifdef DEBUG 13394 13395 tte_t *gorig[NCPU], *gcur[NCPU], *gnew[NCPU]; 13396 13397 /* 13398 * A tte checker. *orig_old is the value we read before cas. 13399 * *cur is the value returned by cas. 13400 * *new is the desired value when we do the cas. 13401 * 13402 * *hmeblkp is currently unused. 13403 */ 13404 13405 /* ARGSUSED */ 13406 void 13407 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp) 13408 { 13409 pfn_t i, j, k; 13410 int cpuid = CPU->cpu_id; 13411 13412 gorig[cpuid] = orig_old; 13413 gcur[cpuid] = cur; 13414 gnew[cpuid] = new; 13415 13416 #ifdef lint 13417 hmeblkp = hmeblkp; 13418 #endif 13419 13420 if (TTE_IS_VALID(orig_old)) { 13421 if (TTE_IS_VALID(cur)) { 13422 i = TTE_TO_TTEPFN(orig_old); 13423 j = TTE_TO_TTEPFN(cur); 13424 k = TTE_TO_TTEPFN(new); 13425 if (i != j) { 13426 /* remap error? */ 13427 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j); 13428 } 13429 13430 if (i != k) { 13431 /* remap error? */ 13432 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k); 13433 } 13434 } else { 13435 if (TTE_IS_VALID(new)) { 13436 panic("chk_tte: invalid cur? "); 13437 } 13438 13439 i = TTE_TO_TTEPFN(orig_old); 13440 k = TTE_TO_TTEPFN(new); 13441 if (i != k) { 13442 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k); 13443 } 13444 } 13445 } else { 13446 if (TTE_IS_VALID(cur)) { 13447 j = TTE_TO_TTEPFN(cur); 13448 if (TTE_IS_VALID(new)) { 13449 k = TTE_TO_TTEPFN(new); 13450 if (j != k) { 13451 panic("chk_tte: bad pfn4, 0x%lx, 0x%lx", 13452 j, k); 13453 } 13454 } else { 13455 panic("chk_tte: why here?"); 13456 } 13457 } else { 13458 if (!TTE_IS_VALID(new)) { 13459 panic("chk_tte: why here2 ?"); 13460 } 13461 } 13462 } 13463 } 13464 13465 #endif /* DEBUG */ 13466 13467 extern void prefetch_tsbe_read(struct tsbe *); 13468 extern void prefetch_tsbe_write(struct tsbe *); 13469 13470 13471 /* 13472 * We want to prefetch 7 cache lines ahead for our read prefetch. This gives 13473 * us optimal performance on Cheetah+. You can only have 8 outstanding 13474 * prefetches at any one time, so we opted for 7 read prefetches and 1 write 13475 * prefetch to make the most utilization of the prefetch capability. 13476 */ 13477 #define TSBE_PREFETCH_STRIDE (7) 13478 13479 void 13480 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo) 13481 { 13482 int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc); 13483 int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc); 13484 int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc); 13485 int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc); 13486 struct tsbe *old; 13487 struct tsbe *new; 13488 struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va; 13489 uint64_t va; 13490 int new_offset; 13491 int i; 13492 int vpshift; 13493 int last_prefetch; 13494 13495 if (old_bytes == new_bytes) { 13496 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes); 13497 } else { 13498 13499 /* 13500 * A TSBE is 16 bytes which means there are four TSBE's per 13501 * P$ line (64 bytes), thus every 4 TSBE's we prefetch. 13502 */ 13503 old = (struct tsbe *)old_tsbinfo->tsb_va; 13504 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1)); 13505 for (i = 0; i < old_entries; i++, old++) { 13506 if (((i & (4-1)) == 0) && (i < last_prefetch)) 13507 prefetch_tsbe_read(old); 13508 if (!old->tte_tag.tag_invalid) { 13509 /* 13510 * We have a valid TTE to remap. Check the 13511 * size. We won't remap 64K or 512K TTEs 13512 * because they span more than one TSB entry 13513 * and are indexed using an 8K virt. page. 13514 * Ditto for 32M and 256M TTEs. 13515 */ 13516 if (TTE_CSZ(&old->tte_data) == TTE64K || 13517 TTE_CSZ(&old->tte_data) == TTE512K) 13518 continue; 13519 if (mmu_page_sizes == max_mmu_page_sizes) { 13520 if (TTE_CSZ(&old->tte_data) == TTE32M || 13521 TTE_CSZ(&old->tte_data) == TTE256M) 13522 continue; 13523 } 13524 13525 /* clear the lower 22 bits of the va */ 13526 va = *(uint64_t *)old << 22; 13527 /* turn va into a virtual pfn */ 13528 va >>= 22 - TSB_START_SIZE; 13529 /* 13530 * or in bits from the offset in the tsb 13531 * to get the real virtual pfn. These 13532 * correspond to bits [21:13] in the va 13533 */ 13534 vpshift = 13535 TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) & 13536 0x1ff; 13537 va |= (i << vpshift); 13538 va >>= vpshift; 13539 new_offset = va & (new_entries - 1); 13540 new = new_base + new_offset; 13541 prefetch_tsbe_write(new); 13542 *new = *old; 13543 } 13544 } 13545 } 13546 } 13547 13548 /* 13549 * unused in sfmmu 13550 */ 13551 void 13552 hat_dump(void) 13553 { 13554 } 13555 13556 /* 13557 * Called when a thread is exiting and we have switched to the kernel address 13558 * space. Perform the same VM initialization resume() uses when switching 13559 * processes. 13560 * 13561 * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but 13562 * we call it anyway in case the semantics change in the future. 13563 */ 13564 /*ARGSUSED*/ 13565 void 13566 hat_thread_exit(kthread_t *thd) 13567 { 13568 uint_t pgsz_cnum; 13569 uint_t pstate_save; 13570 13571 ASSERT(thd->t_procp->p_as == &kas); 13572 13573 pgsz_cnum = KCONTEXT; 13574 #ifdef sun4u 13575 pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT); 13576 #endif 13577 13578 /* 13579 * Note that sfmmu_load_mmustate() is currently a no-op for 13580 * kernel threads. We need to disable interrupts here, 13581 * simply because otherwise sfmmu_load_mmustate() would panic 13582 * if the caller does not disable interrupts. 13583 */ 13584 pstate_save = sfmmu_disable_intrs(); 13585 13586 /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */ 13587 sfmmu_setctx_sec(pgsz_cnum); 13588 sfmmu_load_mmustate(ksfmmup); 13589 sfmmu_enable_intrs(pstate_save); 13590 } 13591 13592 13593 /* 13594 * SRD support 13595 */ 13596 #define SRD_HASH_FUNCTION(vp) (((((uintptr_t)(vp)) >> 4) ^ \ 13597 (((uintptr_t)(vp)) >> 11)) & \ 13598 srd_hashmask) 13599 13600 /* 13601 * Attach the process to the srd struct associated with the exec vnode 13602 * from which the process is started. 13603 */ 13604 void 13605 hat_join_srd(struct hat *sfmmup, vnode_t *evp) 13606 { 13607 uint_t hash = SRD_HASH_FUNCTION(evp); 13608 sf_srd_t *srdp; 13609 sf_srd_t *newsrdp; 13610 13611 ASSERT(sfmmup != ksfmmup); 13612 ASSERT(sfmmup->sfmmu_srdp == NULL); 13613 13614 if (!shctx_on) { 13615 return; 13616 } 13617 13618 VN_HOLD(evp); 13619 13620 if (srd_buckets[hash].srdb_srdp != NULL) { 13621 mutex_enter(&srd_buckets[hash].srdb_lock); 13622 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL; 13623 srdp = srdp->srd_hash) { 13624 if (srdp->srd_evp == evp) { 13625 ASSERT(srdp->srd_refcnt >= 0); 13626 sfmmup->sfmmu_srdp = srdp; 13627 atomic_inc_32( 13628 (volatile uint_t *)&srdp->srd_refcnt); 13629 mutex_exit(&srd_buckets[hash].srdb_lock); 13630 return; 13631 } 13632 } 13633 mutex_exit(&srd_buckets[hash].srdb_lock); 13634 } 13635 newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP); 13636 ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0); 13637 13638 newsrdp->srd_evp = evp; 13639 newsrdp->srd_refcnt = 1; 13640 newsrdp->srd_hmergnfree = NULL; 13641 newsrdp->srd_ismrgnfree = NULL; 13642 13643 mutex_enter(&srd_buckets[hash].srdb_lock); 13644 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL; 13645 srdp = srdp->srd_hash) { 13646 if (srdp->srd_evp == evp) { 13647 ASSERT(srdp->srd_refcnt >= 0); 13648 sfmmup->sfmmu_srdp = srdp; 13649 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt); 13650 mutex_exit(&srd_buckets[hash].srdb_lock); 13651 kmem_cache_free(srd_cache, newsrdp); 13652 return; 13653 } 13654 } 13655 newsrdp->srd_hash = srd_buckets[hash].srdb_srdp; 13656 srd_buckets[hash].srdb_srdp = newsrdp; 13657 sfmmup->sfmmu_srdp = newsrdp; 13658 13659 mutex_exit(&srd_buckets[hash].srdb_lock); 13660 13661 } 13662 13663 static void 13664 sfmmu_leave_srd(sfmmu_t *sfmmup) 13665 { 13666 vnode_t *evp; 13667 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 13668 uint_t hash; 13669 sf_srd_t **prev_srdpp; 13670 sf_region_t *rgnp; 13671 sf_region_t *nrgnp; 13672 #ifdef DEBUG 13673 int rgns = 0; 13674 #endif 13675 int i; 13676 13677 ASSERT(sfmmup != ksfmmup); 13678 ASSERT(srdp != NULL); 13679 ASSERT(srdp->srd_refcnt > 0); 13680 ASSERT(sfmmup->sfmmu_scdp == NULL); 13681 ASSERT(sfmmup->sfmmu_free == 1); 13682 13683 sfmmup->sfmmu_srdp = NULL; 13684 evp = srdp->srd_evp; 13685 ASSERT(evp != NULL); 13686 if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) { 13687 VN_RELE(evp); 13688 return; 13689 } 13690 13691 hash = SRD_HASH_FUNCTION(evp); 13692 mutex_enter(&srd_buckets[hash].srdb_lock); 13693 for (prev_srdpp = &srd_buckets[hash].srdb_srdp; 13694 (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) { 13695 if (srdp->srd_evp == evp) { 13696 break; 13697 } 13698 } 13699 if (srdp == NULL || srdp->srd_refcnt) { 13700 mutex_exit(&srd_buckets[hash].srdb_lock); 13701 VN_RELE(evp); 13702 return; 13703 } 13704 *prev_srdpp = srdp->srd_hash; 13705 mutex_exit(&srd_buckets[hash].srdb_lock); 13706 13707 ASSERT(srdp->srd_refcnt == 0); 13708 VN_RELE(evp); 13709 13710 #ifdef DEBUG 13711 for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) { 13712 ASSERT(srdp->srd_rgnhash[i] == NULL); 13713 } 13714 #endif /* DEBUG */ 13715 13716 /* free each hme regions in the srd */ 13717 for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) { 13718 nrgnp = rgnp->rgn_next; 13719 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid); 13720 ASSERT(rgnp->rgn_refcnt == 0); 13721 ASSERT(rgnp->rgn_sfmmu_head == NULL); 13722 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 13723 ASSERT(rgnp->rgn_hmeflags == 0); 13724 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp); 13725 #ifdef DEBUG 13726 for (i = 0; i < MMU_PAGE_SIZES; i++) { 13727 ASSERT(rgnp->rgn_ttecnt[i] == 0); 13728 } 13729 rgns++; 13730 #endif /* DEBUG */ 13731 kmem_cache_free(region_cache, rgnp); 13732 } 13733 ASSERT(rgns == srdp->srd_next_hmerid); 13734 13735 #ifdef DEBUG 13736 rgns = 0; 13737 #endif 13738 /* free each ism rgns in the srd */ 13739 for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) { 13740 nrgnp = rgnp->rgn_next; 13741 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid); 13742 ASSERT(rgnp->rgn_refcnt == 0); 13743 ASSERT(rgnp->rgn_sfmmu_head == NULL); 13744 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 13745 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp); 13746 #ifdef DEBUG 13747 for (i = 0; i < MMU_PAGE_SIZES; i++) { 13748 ASSERT(rgnp->rgn_ttecnt[i] == 0); 13749 } 13750 rgns++; 13751 #endif /* DEBUG */ 13752 kmem_cache_free(region_cache, rgnp); 13753 } 13754 ASSERT(rgns == srdp->srd_next_ismrid); 13755 ASSERT(srdp->srd_ismbusyrgns == 0); 13756 ASSERT(srdp->srd_hmebusyrgns == 0); 13757 13758 srdp->srd_next_ismrid = 0; 13759 srdp->srd_next_hmerid = 0; 13760 13761 bzero((void *)srdp->srd_ismrgnp, 13762 sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS); 13763 bzero((void *)srdp->srd_hmergnp, 13764 sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS); 13765 13766 ASSERT(srdp->srd_scdp == NULL); 13767 kmem_cache_free(srd_cache, srdp); 13768 } 13769 13770 /* ARGSUSED */ 13771 static int 13772 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags) 13773 { 13774 sf_srd_t *srdp = (sf_srd_t *)buf; 13775 bzero(buf, sizeof (*srdp)); 13776 13777 mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL); 13778 mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL); 13779 return (0); 13780 } 13781 13782 /* ARGSUSED */ 13783 static void 13784 sfmmu_srdcache_destructor(void *buf, void *cdrarg) 13785 { 13786 sf_srd_t *srdp = (sf_srd_t *)buf; 13787 13788 mutex_destroy(&srdp->srd_mutex); 13789 mutex_destroy(&srdp->srd_scd_mutex); 13790 } 13791 13792 /* 13793 * The caller makes sure hat_join_region()/hat_leave_region() can't be called 13794 * at the same time for the same process and address range. This is ensured by 13795 * the fact that address space is locked as writer when a process joins the 13796 * regions. Therefore there's no need to hold an srd lock during the entire 13797 * execution of hat_join_region()/hat_leave_region(). 13798 */ 13799 13800 #define RGN_HASH_FUNCTION(obj) (((((uintptr_t)(obj)) >> 4) ^ \ 13801 (((uintptr_t)(obj)) >> 11)) & \ 13802 srd_rgn_hashmask) 13803 /* 13804 * This routine implements the shared context functionality required when 13805 * attaching a segment to an address space. It must be called from 13806 * hat_share() for D(ISM) segments and from segvn_create() for segments 13807 * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie 13808 * which is saved in the private segment data for hme segments and 13809 * the ism_map structure for ism segments. 13810 */ 13811 hat_region_cookie_t 13812 hat_join_region(struct hat *sfmmup, 13813 caddr_t r_saddr, 13814 size_t r_size, 13815 void *r_obj, 13816 u_offset_t r_objoff, 13817 uchar_t r_perm, 13818 uchar_t r_pgszc, 13819 hat_rgn_cb_func_t r_cb_function, 13820 uint_t flags) 13821 { 13822 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 13823 uint_t rhash; 13824 uint_t rid; 13825 hatlock_t *hatlockp; 13826 sf_region_t *rgnp; 13827 sf_region_t *new_rgnp = NULL; 13828 int i; 13829 uint16_t *nextidp; 13830 sf_region_t **freelistp; 13831 int maxids; 13832 sf_region_t **rarrp; 13833 uint16_t *busyrgnsp; 13834 ulong_t rttecnt; 13835 uchar_t tteflag; 13836 uchar_t r_type = flags & HAT_REGION_TYPE_MASK; 13837 int text = (r_type == HAT_REGION_TEXT); 13838 13839 if (srdp == NULL || r_size == 0) { 13840 return (HAT_INVALID_REGION_COOKIE); 13841 } 13842 13843 ASSERT(sfmmup != ksfmmup); 13844 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 13845 ASSERT(srdp->srd_refcnt > 0); 13846 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK)); 13847 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM); 13848 ASSERT(r_pgszc < mmu_page_sizes); 13849 if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) || 13850 !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) { 13851 panic("hat_join_region: region addr or size is not aligned\n"); 13852 } 13853 13854 13855 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM : 13856 SFMMU_REGION_HME; 13857 /* 13858 * Currently only support shared hmes for the read only main text 13859 * region. 13860 */ 13861 if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) || 13862 (r_perm & PROT_WRITE))) { 13863 return (HAT_INVALID_REGION_COOKIE); 13864 } 13865 13866 rhash = RGN_HASH_FUNCTION(r_obj); 13867 13868 if (r_type == SFMMU_REGION_ISM) { 13869 nextidp = &srdp->srd_next_ismrid; 13870 freelistp = &srdp->srd_ismrgnfree; 13871 maxids = SFMMU_MAX_ISM_REGIONS; 13872 rarrp = srdp->srd_ismrgnp; 13873 busyrgnsp = &srdp->srd_ismbusyrgns; 13874 } else { 13875 nextidp = &srdp->srd_next_hmerid; 13876 freelistp = &srdp->srd_hmergnfree; 13877 maxids = SFMMU_MAX_HME_REGIONS; 13878 rarrp = srdp->srd_hmergnp; 13879 busyrgnsp = &srdp->srd_hmebusyrgns; 13880 } 13881 13882 mutex_enter(&srdp->srd_mutex); 13883 13884 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL; 13885 rgnp = rgnp->rgn_hash) { 13886 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size && 13887 rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff && 13888 rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) { 13889 break; 13890 } 13891 } 13892 13893 rfound: 13894 if (rgnp != NULL) { 13895 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 13896 ASSERT(rgnp->rgn_cb_function == r_cb_function); 13897 ASSERT(rgnp->rgn_refcnt >= 0); 13898 rid = rgnp->rgn_id; 13899 ASSERT(rid < maxids); 13900 ASSERT(rarrp[rid] == rgnp); 13901 ASSERT(rid < *nextidp); 13902 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt); 13903 mutex_exit(&srdp->srd_mutex); 13904 if (new_rgnp != NULL) { 13905 kmem_cache_free(region_cache, new_rgnp); 13906 } 13907 if (r_type == SFMMU_REGION_HME) { 13908 int myjoin = 13909 (sfmmup == astosfmmu(curthread->t_procp->p_as)); 13910 13911 sfmmu_link_to_hmeregion(sfmmup, rgnp); 13912 /* 13913 * bitmap should be updated after linking sfmmu on 13914 * region list so that pageunload() doesn't skip 13915 * TSB/TLB flush. As soon as bitmap is updated another 13916 * thread in this process can already start accessing 13917 * this region. 13918 */ 13919 /* 13920 * Normally ttecnt accounting is done as part of 13921 * pagefault handling. But a process may not take any 13922 * pagefaults on shared hmeblks created by some other 13923 * process. To compensate for this assume that the 13924 * entire region will end up faulted in using 13925 * the region's pagesize. 13926 * 13927 */ 13928 if (r_pgszc > TTE8K) { 13929 tteflag = 1 << r_pgszc; 13930 if (disable_large_pages & tteflag) { 13931 tteflag = 0; 13932 } 13933 } else { 13934 tteflag = 0; 13935 } 13936 if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) { 13937 hatlockp = sfmmu_hat_enter(sfmmup); 13938 sfmmup->sfmmu_rtteflags |= tteflag; 13939 sfmmu_hat_exit(hatlockp); 13940 } 13941 hatlockp = sfmmu_hat_enter(sfmmup); 13942 13943 /* 13944 * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M 13945 * region to allow for large page allocation failure. 13946 */ 13947 if (r_pgszc >= TTE4M) { 13948 sfmmup->sfmmu_tsb0_4minflcnt += 13949 r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 13950 } 13951 13952 /* update sfmmu_ttecnt with the shme rgn ttecnt */ 13953 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 13954 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], 13955 rttecnt); 13956 13957 if (text && r_pgszc >= TTE4M && 13958 (tteflag || ((disable_large_pages >> TTE4M) & 13959 ((1 << (r_pgszc - TTE4M + 1)) - 1))) && 13960 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) { 13961 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG); 13962 } 13963 13964 sfmmu_hat_exit(hatlockp); 13965 /* 13966 * On Panther we need to make sure TLB is programmed 13967 * to accept 32M/256M pages. Call 13968 * sfmmu_check_page_sizes() now to make sure TLB is 13969 * setup before making hmeregions visible to other 13970 * threads. 13971 */ 13972 sfmmu_check_page_sizes(sfmmup, 1); 13973 hatlockp = sfmmu_hat_enter(sfmmup); 13974 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid); 13975 13976 /* 13977 * if context is invalid tsb miss exception code will 13978 * call sfmmu_check_page_sizes() and update tsbmiss 13979 * area later. 13980 */ 13981 kpreempt_disable(); 13982 if (myjoin && 13983 (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum 13984 != INVALID_CONTEXT)) { 13985 struct tsbmiss *tsbmp; 13986 13987 tsbmp = &tsbmiss_area[CPU->cpu_id]; 13988 ASSERT(sfmmup == tsbmp->usfmmup); 13989 BT_SET(tsbmp->shmermap, rid); 13990 if (r_pgszc > TTE64K) { 13991 tsbmp->uhat_rtteflags |= tteflag; 13992 } 13993 13994 } 13995 kpreempt_enable(); 13996 13997 sfmmu_hat_exit(hatlockp); 13998 ASSERT((hat_region_cookie_t)((uint64_t)rid) != 13999 HAT_INVALID_REGION_COOKIE); 14000 } else { 14001 hatlockp = sfmmu_hat_enter(sfmmup); 14002 SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid); 14003 sfmmu_hat_exit(hatlockp); 14004 } 14005 ASSERT(rid < maxids); 14006 14007 if (r_type == SFMMU_REGION_ISM) { 14008 sfmmu_find_scd(sfmmup); 14009 } 14010 return ((hat_region_cookie_t)((uint64_t)rid)); 14011 } 14012 14013 ASSERT(new_rgnp == NULL); 14014 14015 if (*busyrgnsp >= maxids) { 14016 mutex_exit(&srdp->srd_mutex); 14017 return (HAT_INVALID_REGION_COOKIE); 14018 } 14019 14020 ASSERT(MUTEX_HELD(&srdp->srd_mutex)); 14021 if (*freelistp != NULL) { 14022 rgnp = *freelistp; 14023 *freelistp = rgnp->rgn_next; 14024 ASSERT(rgnp->rgn_id < *nextidp); 14025 ASSERT(rgnp->rgn_id < maxids); 14026 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE); 14027 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) 14028 == r_type); 14029 ASSERT(rarrp[rgnp->rgn_id] == rgnp); 14030 ASSERT(rgnp->rgn_hmeflags == 0); 14031 } else { 14032 /* 14033 * release local locks before memory allocation. 14034 */ 14035 mutex_exit(&srdp->srd_mutex); 14036 14037 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP); 14038 14039 mutex_enter(&srdp->srd_mutex); 14040 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL; 14041 rgnp = rgnp->rgn_hash) { 14042 if (rgnp->rgn_saddr == r_saddr && 14043 rgnp->rgn_size == r_size && 14044 rgnp->rgn_obj == r_obj && 14045 rgnp->rgn_objoff == r_objoff && 14046 rgnp->rgn_perm == r_perm && 14047 rgnp->rgn_pgszc == r_pgszc) { 14048 break; 14049 } 14050 } 14051 if (rgnp != NULL) { 14052 goto rfound; 14053 } 14054 14055 if (*nextidp >= maxids) { 14056 mutex_exit(&srdp->srd_mutex); 14057 goto fail; 14058 } 14059 rgnp = new_rgnp; 14060 new_rgnp = NULL; 14061 rgnp->rgn_id = (*nextidp)++; 14062 ASSERT(rgnp->rgn_id < maxids); 14063 ASSERT(rarrp[rgnp->rgn_id] == NULL); 14064 rarrp[rgnp->rgn_id] = rgnp; 14065 } 14066 14067 ASSERT(rgnp->rgn_sfmmu_head == NULL); 14068 ASSERT(rgnp->rgn_hmeflags == 0); 14069 #ifdef DEBUG 14070 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14071 ASSERT(rgnp->rgn_ttecnt[i] == 0); 14072 } 14073 #endif 14074 rgnp->rgn_saddr = r_saddr; 14075 rgnp->rgn_size = r_size; 14076 rgnp->rgn_obj = r_obj; 14077 rgnp->rgn_objoff = r_objoff; 14078 rgnp->rgn_perm = r_perm; 14079 rgnp->rgn_pgszc = r_pgszc; 14080 rgnp->rgn_flags = r_type; 14081 rgnp->rgn_refcnt = 0; 14082 rgnp->rgn_cb_function = r_cb_function; 14083 rgnp->rgn_hash = srdp->srd_rgnhash[rhash]; 14084 srdp->srd_rgnhash[rhash] = rgnp; 14085 (*busyrgnsp)++; 14086 ASSERT(*busyrgnsp <= maxids); 14087 goto rfound; 14088 14089 fail: 14090 ASSERT(new_rgnp != NULL); 14091 kmem_cache_free(region_cache, new_rgnp); 14092 return (HAT_INVALID_REGION_COOKIE); 14093 } 14094 14095 /* 14096 * This function implements the shared context functionality required 14097 * when detaching a segment from an address space. It must be called 14098 * from hat_unshare() for all D(ISM) segments and from segvn_unmap(), 14099 * for segments with a valid region_cookie. 14100 * It will also be called from all seg_vn routines which change a 14101 * segment's attributes such as segvn_setprot(), segvn_setpagesize(), 14102 * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault 14103 * from segvn_fault(). 14104 */ 14105 void 14106 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags) 14107 { 14108 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14109 sf_scd_t *scdp; 14110 uint_t rhash; 14111 uint_t rid = (uint_t)((uint64_t)rcookie); 14112 hatlock_t *hatlockp = NULL; 14113 sf_region_t *rgnp; 14114 sf_region_t **prev_rgnpp; 14115 sf_region_t *cur_rgnp; 14116 void *r_obj; 14117 int i; 14118 caddr_t r_saddr; 14119 caddr_t r_eaddr; 14120 size_t r_size; 14121 uchar_t r_pgszc; 14122 uchar_t r_type = flags & HAT_REGION_TYPE_MASK; 14123 14124 ASSERT(sfmmup != ksfmmup); 14125 ASSERT(srdp != NULL); 14126 ASSERT(srdp->srd_refcnt > 0); 14127 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK)); 14128 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM); 14129 ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL); 14130 14131 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM : 14132 SFMMU_REGION_HME; 14133 14134 if (r_type == SFMMU_REGION_ISM) { 14135 ASSERT(SFMMU_IS_ISMRID_VALID(rid)); 14136 ASSERT(rid < SFMMU_MAX_ISM_REGIONS); 14137 rgnp = srdp->srd_ismrgnp[rid]; 14138 } else { 14139 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14140 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 14141 rgnp = srdp->srd_hmergnp[rid]; 14142 } 14143 ASSERT(rgnp != NULL); 14144 ASSERT(rgnp->rgn_id == rid); 14145 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 14146 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE)); 14147 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as)); 14148 14149 if (sfmmup->sfmmu_free) { 14150 ulong_t rttecnt; 14151 r_pgszc = rgnp->rgn_pgszc; 14152 r_size = rgnp->rgn_size; 14153 14154 ASSERT(sfmmup->sfmmu_scdp == NULL); 14155 if (r_type == SFMMU_REGION_ISM) { 14156 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid); 14157 } else { 14158 /* update shme rgns ttecnt in sfmmu_ttecnt */ 14159 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 14160 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt); 14161 14162 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], 14163 -rttecnt); 14164 14165 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid); 14166 } 14167 } else if (r_type == SFMMU_REGION_ISM) { 14168 hatlockp = sfmmu_hat_enter(sfmmup); 14169 ASSERT(rid < srdp->srd_next_ismrid); 14170 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid); 14171 scdp = sfmmup->sfmmu_scdp; 14172 if (scdp != NULL && 14173 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) { 14174 sfmmu_leave_scd(sfmmup, r_type); 14175 ASSERT(sfmmu_hat_lock_held(sfmmup)); 14176 } 14177 sfmmu_hat_exit(hatlockp); 14178 } else { 14179 ulong_t rttecnt; 14180 r_pgszc = rgnp->rgn_pgszc; 14181 r_saddr = rgnp->rgn_saddr; 14182 r_size = rgnp->rgn_size; 14183 r_eaddr = r_saddr + r_size; 14184 14185 ASSERT(r_type == SFMMU_REGION_HME); 14186 hatlockp = sfmmu_hat_enter(sfmmup); 14187 ASSERT(rid < srdp->srd_next_hmerid); 14188 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid); 14189 14190 /* 14191 * If region is part of an SCD call sfmmu_leave_scd(). 14192 * Otherwise if process is not exiting and has valid context 14193 * just drop the context on the floor to lose stale TLB 14194 * entries and force the update of tsb miss area to reflect 14195 * the new region map. After that clean our TSB entries. 14196 */ 14197 scdp = sfmmup->sfmmu_scdp; 14198 if (scdp != NULL && 14199 SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) { 14200 sfmmu_leave_scd(sfmmup, r_type); 14201 ASSERT(sfmmu_hat_lock_held(sfmmup)); 14202 } 14203 sfmmu_invalidate_ctx(sfmmup); 14204 14205 i = TTE8K; 14206 while (i < mmu_page_sizes) { 14207 if (rgnp->rgn_ttecnt[i] != 0) { 14208 sfmmu_unload_tsb_range(sfmmup, r_saddr, 14209 r_eaddr, i); 14210 if (i < TTE4M) { 14211 i = TTE4M; 14212 continue; 14213 } else { 14214 break; 14215 } 14216 } 14217 i++; 14218 } 14219 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */ 14220 if (r_pgszc >= TTE4M) { 14221 rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 14222 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >= 14223 rttecnt); 14224 sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt; 14225 } 14226 14227 /* update shme rgns ttecnt in sfmmu_ttecnt */ 14228 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc); 14229 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt); 14230 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt); 14231 14232 sfmmu_hat_exit(hatlockp); 14233 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) { 14234 /* sfmmup left the scd, grow private tsb */ 14235 sfmmu_check_page_sizes(sfmmup, 1); 14236 } else { 14237 sfmmu_check_page_sizes(sfmmup, 0); 14238 } 14239 } 14240 14241 if (r_type == SFMMU_REGION_HME) { 14242 sfmmu_unlink_from_hmeregion(sfmmup, rgnp); 14243 } 14244 14245 r_obj = rgnp->rgn_obj; 14246 if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) { 14247 return; 14248 } 14249 14250 /* 14251 * looks like nobody uses this region anymore. Free it. 14252 */ 14253 rhash = RGN_HASH_FUNCTION(r_obj); 14254 mutex_enter(&srdp->srd_mutex); 14255 for (prev_rgnpp = &srdp->srd_rgnhash[rhash]; 14256 (cur_rgnp = *prev_rgnpp) != NULL; 14257 prev_rgnpp = &cur_rgnp->rgn_hash) { 14258 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) { 14259 break; 14260 } 14261 } 14262 14263 if (cur_rgnp == NULL) { 14264 mutex_exit(&srdp->srd_mutex); 14265 return; 14266 } 14267 14268 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type); 14269 *prev_rgnpp = rgnp->rgn_hash; 14270 if (r_type == SFMMU_REGION_ISM) { 14271 rgnp->rgn_flags |= SFMMU_REGION_FREE; 14272 ASSERT(rid < srdp->srd_next_ismrid); 14273 rgnp->rgn_next = srdp->srd_ismrgnfree; 14274 srdp->srd_ismrgnfree = rgnp; 14275 ASSERT(srdp->srd_ismbusyrgns > 0); 14276 srdp->srd_ismbusyrgns--; 14277 mutex_exit(&srdp->srd_mutex); 14278 return; 14279 } 14280 mutex_exit(&srdp->srd_mutex); 14281 14282 /* 14283 * Destroy region's hmeblks. 14284 */ 14285 sfmmu_unload_hmeregion(srdp, rgnp); 14286 14287 rgnp->rgn_hmeflags = 0; 14288 14289 ASSERT(rgnp->rgn_sfmmu_head == NULL); 14290 ASSERT(rgnp->rgn_id == rid); 14291 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14292 rgnp->rgn_ttecnt[i] = 0; 14293 } 14294 rgnp->rgn_flags |= SFMMU_REGION_FREE; 14295 mutex_enter(&srdp->srd_mutex); 14296 ASSERT(rid < srdp->srd_next_hmerid); 14297 rgnp->rgn_next = srdp->srd_hmergnfree; 14298 srdp->srd_hmergnfree = rgnp; 14299 ASSERT(srdp->srd_hmebusyrgns > 0); 14300 srdp->srd_hmebusyrgns--; 14301 mutex_exit(&srdp->srd_mutex); 14302 } 14303 14304 /* 14305 * For now only called for hmeblk regions and not for ISM regions. 14306 */ 14307 void 14308 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie) 14309 { 14310 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14311 uint_t rid = (uint_t)((uint64_t)rcookie); 14312 sf_region_t *rgnp; 14313 sf_rgn_link_t *rlink; 14314 sf_rgn_link_t *hrlink; 14315 ulong_t rttecnt; 14316 14317 ASSERT(sfmmup != ksfmmup); 14318 ASSERT(srdp != NULL); 14319 ASSERT(srdp->srd_refcnt > 0); 14320 14321 ASSERT(rid < srdp->srd_next_hmerid); 14322 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14323 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 14324 14325 rgnp = srdp->srd_hmergnp[rid]; 14326 ASSERT(rgnp->rgn_refcnt > 0); 14327 ASSERT(rgnp->rgn_id == rid); 14328 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME); 14329 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE)); 14330 14331 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt); 14332 14333 /* LINTED: constant in conditional context */ 14334 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0); 14335 ASSERT(rlink != NULL); 14336 mutex_enter(&rgnp->rgn_mutex); 14337 ASSERT(rgnp->rgn_sfmmu_head != NULL); 14338 /* LINTED: constant in conditional context */ 14339 SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0); 14340 ASSERT(hrlink != NULL); 14341 ASSERT(hrlink->prev == NULL); 14342 rlink->next = rgnp->rgn_sfmmu_head; 14343 rlink->prev = NULL; 14344 hrlink->prev = sfmmup; 14345 /* 14346 * make sure rlink's next field is correct 14347 * before making this link visible. 14348 */ 14349 membar_stst(); 14350 rgnp->rgn_sfmmu_head = sfmmup; 14351 mutex_exit(&rgnp->rgn_mutex); 14352 14353 /* update sfmmu_ttecnt with the shme rgn ttecnt */ 14354 rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc); 14355 atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt); 14356 /* update tsb0 inflation count */ 14357 if (rgnp->rgn_pgszc >= TTE4M) { 14358 sfmmup->sfmmu_tsb0_4minflcnt += 14359 rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2); 14360 } 14361 /* 14362 * Update regionid bitmask without hat lock since no other thread 14363 * can update this region bitmask right now. 14364 */ 14365 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid); 14366 } 14367 14368 /* ARGSUSED */ 14369 static int 14370 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags) 14371 { 14372 sf_region_t *rgnp = (sf_region_t *)buf; 14373 bzero(buf, sizeof (*rgnp)); 14374 14375 mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL); 14376 14377 return (0); 14378 } 14379 14380 /* ARGSUSED */ 14381 static void 14382 sfmmu_rgncache_destructor(void *buf, void *cdrarg) 14383 { 14384 sf_region_t *rgnp = (sf_region_t *)buf; 14385 mutex_destroy(&rgnp->rgn_mutex); 14386 } 14387 14388 static int 14389 sfrgnmap_isnull(sf_region_map_t *map) 14390 { 14391 int i; 14392 14393 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14394 if (map->bitmap[i] != 0) { 14395 return (0); 14396 } 14397 } 14398 return (1); 14399 } 14400 14401 static int 14402 sfhmergnmap_isnull(sf_hmeregion_map_t *map) 14403 { 14404 int i; 14405 14406 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) { 14407 if (map->bitmap[i] != 0) { 14408 return (0); 14409 } 14410 } 14411 return (1); 14412 } 14413 14414 #ifdef DEBUG 14415 static void 14416 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist) 14417 { 14418 sfmmu_t *sp; 14419 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14420 14421 for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) { 14422 ASSERT(srdp == sp->sfmmu_srdp); 14423 if (sp == sfmmup) { 14424 if (onlist) { 14425 return; 14426 } else { 14427 panic("shctx: sfmmu 0x%p found on scd" 14428 "list 0x%p", (void *)sfmmup, 14429 (void *)*headp); 14430 } 14431 } 14432 } 14433 if (onlist) { 14434 panic("shctx: sfmmu 0x%p not found on scd list 0x%p", 14435 (void *)sfmmup, (void *)*headp); 14436 } else { 14437 return; 14438 } 14439 } 14440 #else /* DEBUG */ 14441 #define check_scd_sfmmu_list(headp, sfmmup, onlist) 14442 #endif /* DEBUG */ 14443 14444 /* 14445 * Removes an sfmmu from the SCD sfmmu list. 14446 */ 14447 static void 14448 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup) 14449 { 14450 ASSERT(sfmmup->sfmmu_srdp != NULL); 14451 check_scd_sfmmu_list(headp, sfmmup, 1); 14452 if (sfmmup->sfmmu_scd_link.prev != NULL) { 14453 ASSERT(*headp != sfmmup); 14454 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next = 14455 sfmmup->sfmmu_scd_link.next; 14456 } else { 14457 ASSERT(*headp == sfmmup); 14458 *headp = sfmmup->sfmmu_scd_link.next; 14459 } 14460 if (sfmmup->sfmmu_scd_link.next != NULL) { 14461 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev = 14462 sfmmup->sfmmu_scd_link.prev; 14463 } 14464 } 14465 14466 14467 /* 14468 * Adds an sfmmu to the start of the queue. 14469 */ 14470 static void 14471 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup) 14472 { 14473 check_scd_sfmmu_list(headp, sfmmup, 0); 14474 sfmmup->sfmmu_scd_link.prev = NULL; 14475 sfmmup->sfmmu_scd_link.next = *headp; 14476 if (*headp != NULL) 14477 (*headp)->sfmmu_scd_link.prev = sfmmup; 14478 *headp = sfmmup; 14479 } 14480 14481 /* 14482 * Remove an scd from the start of the queue. 14483 */ 14484 static void 14485 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp) 14486 { 14487 if (scdp->scd_prev != NULL) { 14488 ASSERT(*headp != scdp); 14489 scdp->scd_prev->scd_next = scdp->scd_next; 14490 } else { 14491 ASSERT(*headp == scdp); 14492 *headp = scdp->scd_next; 14493 } 14494 14495 if (scdp->scd_next != NULL) { 14496 scdp->scd_next->scd_prev = scdp->scd_prev; 14497 } 14498 } 14499 14500 /* 14501 * Add an scd to the start of the queue. 14502 */ 14503 static void 14504 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp) 14505 { 14506 scdp->scd_prev = NULL; 14507 scdp->scd_next = *headp; 14508 if (*headp != NULL) { 14509 (*headp)->scd_prev = scdp; 14510 } 14511 *headp = scdp; 14512 } 14513 14514 static int 14515 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp) 14516 { 14517 uint_t rid; 14518 uint_t i; 14519 uint_t j; 14520 ulong_t w; 14521 sf_region_t *rgnp; 14522 ulong_t tte8k_cnt = 0; 14523 ulong_t tte4m_cnt = 0; 14524 uint_t tsb_szc; 14525 sfmmu_t *scsfmmup = scdp->scd_sfmmup; 14526 sfmmu_t *ism_hatid; 14527 struct tsb_info *newtsb; 14528 int szc; 14529 14530 ASSERT(srdp != NULL); 14531 14532 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14533 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14534 continue; 14535 } 14536 j = 0; 14537 while (w) { 14538 if (!(w & 0x1)) { 14539 j++; 14540 w >>= 1; 14541 continue; 14542 } 14543 rid = (i << BT_ULSHIFT) | j; 14544 j++; 14545 w >>= 1; 14546 14547 if (rid < SFMMU_MAX_HME_REGIONS) { 14548 rgnp = srdp->srd_hmergnp[rid]; 14549 ASSERT(rgnp->rgn_id == rid); 14550 ASSERT(rgnp->rgn_refcnt > 0); 14551 14552 if (rgnp->rgn_pgszc < TTE4M) { 14553 tte8k_cnt += rgnp->rgn_size >> 14554 TTE_PAGE_SHIFT(TTE8K); 14555 } else { 14556 ASSERT(rgnp->rgn_pgszc >= TTE4M); 14557 tte4m_cnt += rgnp->rgn_size >> 14558 TTE_PAGE_SHIFT(TTE4M); 14559 /* 14560 * Inflate SCD tsb0 by preallocating 14561 * 1/4 8k ttecnt for 4M regions to 14562 * allow for lgpg alloc failure. 14563 */ 14564 tte8k_cnt += rgnp->rgn_size >> 14565 (TTE_PAGE_SHIFT(TTE8K) + 2); 14566 } 14567 } else { 14568 rid -= SFMMU_MAX_HME_REGIONS; 14569 rgnp = srdp->srd_ismrgnp[rid]; 14570 ASSERT(rgnp->rgn_id == rid); 14571 ASSERT(rgnp->rgn_refcnt > 0); 14572 14573 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14574 ASSERT(ism_hatid->sfmmu_ismhat); 14575 14576 for (szc = 0; szc < TTE4M; szc++) { 14577 tte8k_cnt += 14578 ism_hatid->sfmmu_ttecnt[szc] << 14579 TTE_BSZS_SHIFT(szc); 14580 } 14581 14582 ASSERT(rgnp->rgn_pgszc >= TTE4M); 14583 if (rgnp->rgn_pgszc >= TTE4M) { 14584 tte4m_cnt += rgnp->rgn_size >> 14585 TTE_PAGE_SHIFT(TTE4M); 14586 } 14587 } 14588 } 14589 } 14590 14591 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt); 14592 14593 /* Allocate both the SCD TSBs here. */ 14594 if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb, 14595 tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) && 14596 (tsb_szc <= TSB_4M_SZCODE || 14597 sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb, 14598 TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K, 14599 TSB_ALLOC, scsfmmup))) { 14600 14601 SFMMU_STAT(sf_scd_1sttsb_allocfail); 14602 return (TSB_ALLOCFAIL); 14603 } else { 14604 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX; 14605 14606 if (tte4m_cnt) { 14607 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt); 14608 if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, 14609 TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) && 14610 (tsb_szc <= TSB_4M_SZCODE || 14611 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE, 14612 TSB4M|TSB32M|TSB256M, 14613 TSB_ALLOC, scsfmmup))) { 14614 /* 14615 * If we fail to allocate the 2nd shared tsb, 14616 * just free the 1st tsb, return failure. 14617 */ 14618 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb); 14619 SFMMU_STAT(sf_scd_2ndtsb_allocfail); 14620 return (TSB_ALLOCFAIL); 14621 } else { 14622 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL); 14623 newtsb->tsb_flags |= TSB_SHAREDCTX; 14624 scsfmmup->sfmmu_tsb->tsb_next = newtsb; 14625 SFMMU_STAT(sf_scd_2ndtsb_alloc); 14626 } 14627 } 14628 SFMMU_STAT(sf_scd_1sttsb_alloc); 14629 } 14630 return (TSB_SUCCESS); 14631 } 14632 14633 static void 14634 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu) 14635 { 14636 while (scd_sfmmu->sfmmu_tsb != NULL) { 14637 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next; 14638 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb); 14639 scd_sfmmu->sfmmu_tsb = next; 14640 } 14641 } 14642 14643 /* 14644 * Link the sfmmu onto the hme region list. 14645 */ 14646 void 14647 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp) 14648 { 14649 uint_t rid; 14650 sf_rgn_link_t *rlink; 14651 sfmmu_t *head; 14652 sf_rgn_link_t *hrlink; 14653 14654 rid = rgnp->rgn_id; 14655 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14656 14657 /* LINTED: constant in conditional context */ 14658 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1); 14659 ASSERT(rlink != NULL); 14660 mutex_enter(&rgnp->rgn_mutex); 14661 if ((head = rgnp->rgn_sfmmu_head) == NULL) { 14662 rlink->next = NULL; 14663 rlink->prev = NULL; 14664 /* 14665 * make sure rlink's next field is NULL 14666 * before making this link visible. 14667 */ 14668 membar_stst(); 14669 rgnp->rgn_sfmmu_head = sfmmup; 14670 } else { 14671 /* LINTED: constant in conditional context */ 14672 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0); 14673 ASSERT(hrlink != NULL); 14674 ASSERT(hrlink->prev == NULL); 14675 rlink->next = head; 14676 rlink->prev = NULL; 14677 hrlink->prev = sfmmup; 14678 /* 14679 * make sure rlink's next field is correct 14680 * before making this link visible. 14681 */ 14682 membar_stst(); 14683 rgnp->rgn_sfmmu_head = sfmmup; 14684 } 14685 mutex_exit(&rgnp->rgn_mutex); 14686 } 14687 14688 /* 14689 * Unlink the sfmmu from the hme region list. 14690 */ 14691 void 14692 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp) 14693 { 14694 uint_t rid; 14695 sf_rgn_link_t *rlink; 14696 14697 rid = rgnp->rgn_id; 14698 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 14699 14700 /* LINTED: constant in conditional context */ 14701 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0); 14702 ASSERT(rlink != NULL); 14703 mutex_enter(&rgnp->rgn_mutex); 14704 if (rgnp->rgn_sfmmu_head == sfmmup) { 14705 sfmmu_t *next = rlink->next; 14706 rgnp->rgn_sfmmu_head = next; 14707 /* 14708 * if we are stopped by xc_attention() after this 14709 * point the forward link walking in 14710 * sfmmu_rgntlb_demap() will work correctly since the 14711 * head correctly points to the next element. 14712 */ 14713 membar_stst(); 14714 rlink->next = NULL; 14715 ASSERT(rlink->prev == NULL); 14716 if (next != NULL) { 14717 sf_rgn_link_t *nrlink; 14718 /* LINTED: constant in conditional context */ 14719 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0); 14720 ASSERT(nrlink != NULL); 14721 ASSERT(nrlink->prev == sfmmup); 14722 nrlink->prev = NULL; 14723 } 14724 } else { 14725 sfmmu_t *next = rlink->next; 14726 sfmmu_t *prev = rlink->prev; 14727 sf_rgn_link_t *prlink; 14728 14729 ASSERT(prev != NULL); 14730 /* LINTED: constant in conditional context */ 14731 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0); 14732 ASSERT(prlink != NULL); 14733 ASSERT(prlink->next == sfmmup); 14734 prlink->next = next; 14735 /* 14736 * if we are stopped by xc_attention() 14737 * after this point the forward link walking 14738 * will work correctly since the prev element 14739 * correctly points to the next element. 14740 */ 14741 membar_stst(); 14742 rlink->next = NULL; 14743 rlink->prev = NULL; 14744 if (next != NULL) { 14745 sf_rgn_link_t *nrlink; 14746 /* LINTED: constant in conditional context */ 14747 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0); 14748 ASSERT(nrlink != NULL); 14749 ASSERT(nrlink->prev == sfmmup); 14750 nrlink->prev = prev; 14751 } 14752 } 14753 mutex_exit(&rgnp->rgn_mutex); 14754 } 14755 14756 /* 14757 * Link scd sfmmu onto ism or hme region list for each region in the 14758 * scd region map. 14759 */ 14760 void 14761 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp) 14762 { 14763 uint_t rid; 14764 uint_t i; 14765 uint_t j; 14766 ulong_t w; 14767 sf_region_t *rgnp; 14768 sfmmu_t *scsfmmup; 14769 14770 scsfmmup = scdp->scd_sfmmup; 14771 ASSERT(scsfmmup->sfmmu_scdhat); 14772 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14773 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14774 continue; 14775 } 14776 j = 0; 14777 while (w) { 14778 if (!(w & 0x1)) { 14779 j++; 14780 w >>= 1; 14781 continue; 14782 } 14783 rid = (i << BT_ULSHIFT) | j; 14784 j++; 14785 w >>= 1; 14786 14787 if (rid < SFMMU_MAX_HME_REGIONS) { 14788 rgnp = srdp->srd_hmergnp[rid]; 14789 ASSERT(rgnp->rgn_id == rid); 14790 ASSERT(rgnp->rgn_refcnt > 0); 14791 sfmmu_link_to_hmeregion(scsfmmup, rgnp); 14792 } else { 14793 sfmmu_t *ism_hatid = NULL; 14794 ism_ment_t *ism_ment; 14795 rid -= SFMMU_MAX_HME_REGIONS; 14796 rgnp = srdp->srd_ismrgnp[rid]; 14797 ASSERT(rgnp->rgn_id == rid); 14798 ASSERT(rgnp->rgn_refcnt > 0); 14799 14800 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14801 ASSERT(ism_hatid->sfmmu_ismhat); 14802 ism_ment = &scdp->scd_ism_links[rid]; 14803 ism_ment->iment_hat = scsfmmup; 14804 ism_ment->iment_base_va = rgnp->rgn_saddr; 14805 mutex_enter(&ism_mlist_lock); 14806 iment_add(ism_ment, ism_hatid); 14807 mutex_exit(&ism_mlist_lock); 14808 14809 } 14810 } 14811 } 14812 } 14813 /* 14814 * Unlink scd sfmmu from ism or hme region list for each region in the 14815 * scd region map. 14816 */ 14817 void 14818 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp) 14819 { 14820 uint_t rid; 14821 uint_t i; 14822 uint_t j; 14823 ulong_t w; 14824 sf_region_t *rgnp; 14825 sfmmu_t *scsfmmup; 14826 14827 scsfmmup = scdp->scd_sfmmup; 14828 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) { 14829 if ((w = scdp->scd_region_map.bitmap[i]) == 0) { 14830 continue; 14831 } 14832 j = 0; 14833 while (w) { 14834 if (!(w & 0x1)) { 14835 j++; 14836 w >>= 1; 14837 continue; 14838 } 14839 rid = (i << BT_ULSHIFT) | j; 14840 j++; 14841 w >>= 1; 14842 14843 if (rid < SFMMU_MAX_HME_REGIONS) { 14844 rgnp = srdp->srd_hmergnp[rid]; 14845 ASSERT(rgnp->rgn_id == rid); 14846 ASSERT(rgnp->rgn_refcnt > 0); 14847 sfmmu_unlink_from_hmeregion(scsfmmup, 14848 rgnp); 14849 14850 } else { 14851 sfmmu_t *ism_hatid = NULL; 14852 ism_ment_t *ism_ment; 14853 rid -= SFMMU_MAX_HME_REGIONS; 14854 rgnp = srdp->srd_ismrgnp[rid]; 14855 ASSERT(rgnp->rgn_id == rid); 14856 ASSERT(rgnp->rgn_refcnt > 0); 14857 14858 ism_hatid = (sfmmu_t *)rgnp->rgn_obj; 14859 ASSERT(ism_hatid->sfmmu_ismhat); 14860 ism_ment = &scdp->scd_ism_links[rid]; 14861 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup); 14862 ASSERT(ism_ment->iment_base_va == 14863 rgnp->rgn_saddr); 14864 mutex_enter(&ism_mlist_lock); 14865 iment_sub(ism_ment, ism_hatid); 14866 mutex_exit(&ism_mlist_lock); 14867 14868 } 14869 } 14870 } 14871 } 14872 /* 14873 * Allocates and initialises a new SCD structure, this is called with 14874 * the srd_scd_mutex held and returns with the reference count 14875 * initialised to 1. 14876 */ 14877 static sf_scd_t * 14878 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map) 14879 { 14880 sf_scd_t *new_scdp; 14881 sfmmu_t *scsfmmup; 14882 int i; 14883 14884 ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex)); 14885 new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP); 14886 14887 scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP); 14888 new_scdp->scd_sfmmup = scsfmmup; 14889 scsfmmup->sfmmu_srdp = srdp; 14890 scsfmmup->sfmmu_scdp = new_scdp; 14891 scsfmmup->sfmmu_tsb0_4minflcnt = 0; 14892 scsfmmup->sfmmu_scdhat = 1; 14893 CPUSET_ALL(scsfmmup->sfmmu_cpusran); 14894 bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE); 14895 14896 ASSERT(max_mmu_ctxdoms > 0); 14897 for (i = 0; i < max_mmu_ctxdoms; i++) { 14898 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT; 14899 scsfmmup->sfmmu_ctxs[i].gnum = 0; 14900 } 14901 14902 for (i = 0; i < MMU_PAGE_SIZES; i++) { 14903 new_scdp->scd_rttecnt[i] = 0; 14904 } 14905 14906 new_scdp->scd_region_map = *new_map; 14907 new_scdp->scd_refcnt = 1; 14908 if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) { 14909 kmem_cache_free(scd_cache, new_scdp); 14910 kmem_cache_free(sfmmuid_cache, scsfmmup); 14911 return (NULL); 14912 } 14913 if (&mmu_init_scd) { 14914 mmu_init_scd(new_scdp); 14915 } 14916 return (new_scdp); 14917 } 14918 14919 /* 14920 * The first phase of a process joining an SCD. The hat structure is 14921 * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set 14922 * and a cross-call with context invalidation is used to cause the 14923 * remaining work to be carried out in the sfmmu_tsbmiss_exception() 14924 * routine. 14925 */ 14926 static void 14927 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup) 14928 { 14929 hatlock_t *hatlockp; 14930 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 14931 int i; 14932 sf_scd_t *old_scdp; 14933 14934 ASSERT(srdp != NULL); 14935 ASSERT(scdp != NULL); 14936 ASSERT(scdp->scd_refcnt > 0); 14937 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 14938 14939 if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) { 14940 ASSERT(old_scdp != scdp); 14941 14942 mutex_enter(&old_scdp->scd_mutex); 14943 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup); 14944 mutex_exit(&old_scdp->scd_mutex); 14945 /* 14946 * sfmmup leaves the old scd. Update sfmmu_ttecnt to 14947 * include the shme rgn ttecnt for rgns that 14948 * were in the old SCD 14949 */ 14950 for (i = 0; i < mmu_page_sizes; i++) { 14951 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 14952 old_scdp->scd_rttecnt[i]); 14953 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 14954 sfmmup->sfmmu_scdrttecnt[i]); 14955 } 14956 } 14957 14958 /* 14959 * Move sfmmu to the scd lists. 14960 */ 14961 mutex_enter(&scdp->scd_mutex); 14962 sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup); 14963 mutex_exit(&scdp->scd_mutex); 14964 SF_SCD_INCR_REF(scdp); 14965 14966 hatlockp = sfmmu_hat_enter(sfmmup); 14967 /* 14968 * For a multi-thread process, we must stop 14969 * all the other threads before joining the scd. 14970 */ 14971 14972 SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD); 14973 14974 sfmmu_invalidate_ctx(sfmmup); 14975 sfmmup->sfmmu_scdp = scdp; 14976 14977 /* 14978 * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update 14979 * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD. 14980 */ 14981 for (i = 0; i < mmu_page_sizes; i++) { 14982 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i]; 14983 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]); 14984 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 14985 -sfmmup->sfmmu_scdrttecnt[i]); 14986 } 14987 /* update tsb0 inflation count */ 14988 if (old_scdp != NULL) { 14989 sfmmup->sfmmu_tsb0_4minflcnt += 14990 old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 14991 } 14992 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >= 14993 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt); 14994 sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 14995 14996 sfmmu_hat_exit(hatlockp); 14997 14998 if (old_scdp != NULL) { 14999 SF_SCD_DECR_REF(srdp, old_scdp); 15000 } 15001 15002 } 15003 15004 /* 15005 * This routine is called by a process to become part of an SCD. It is called 15006 * from sfmmu_tsbmiss_exception() once most of the initial work has been 15007 * done by sfmmu_join_scd(). This routine must not drop the hat lock. 15008 */ 15009 static void 15010 sfmmu_finish_join_scd(sfmmu_t *sfmmup) 15011 { 15012 struct tsb_info *tsbinfop; 15013 15014 ASSERT(sfmmu_hat_lock_held(sfmmup)); 15015 ASSERT(sfmmup->sfmmu_scdp != NULL); 15016 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)); 15017 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15018 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)); 15019 15020 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; 15021 tsbinfop = tsbinfop->tsb_next) { 15022 if (tsbinfop->tsb_flags & TSB_SWAPPED) { 15023 continue; 15024 } 15025 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG)); 15026 15027 sfmmu_inv_tsb(tsbinfop->tsb_va, 15028 TSB_BYTES(tsbinfop->tsb_szc)); 15029 } 15030 15031 /* Set HAT_CTX1_FLAG for all SCD ISMs */ 15032 sfmmu_ism_hatflags(sfmmup, 1); 15033 15034 SFMMU_STAT(sf_join_scd); 15035 } 15036 15037 /* 15038 * This routine is called in order to check if there is an SCD which matches 15039 * the process's region map if not then a new SCD may be created. 15040 */ 15041 static void 15042 sfmmu_find_scd(sfmmu_t *sfmmup) 15043 { 15044 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 15045 sf_scd_t *scdp, *new_scdp; 15046 int ret; 15047 15048 ASSERT(srdp != NULL); 15049 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as)); 15050 15051 mutex_enter(&srdp->srd_scd_mutex); 15052 for (scdp = srdp->srd_scdp; scdp != NULL; 15053 scdp = scdp->scd_next) { 15054 SF_RGNMAP_EQUAL(&scdp->scd_region_map, 15055 &sfmmup->sfmmu_region_map, ret); 15056 if (ret == 1) { 15057 SF_SCD_INCR_REF(scdp); 15058 mutex_exit(&srdp->srd_scd_mutex); 15059 sfmmu_join_scd(scdp, sfmmup); 15060 ASSERT(scdp->scd_refcnt >= 2); 15061 atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt); 15062 return; 15063 } else { 15064 /* 15065 * If the sfmmu region map is a subset of the scd 15066 * region map, then the assumption is that this process 15067 * will continue attaching to ISM segments until the 15068 * region maps are equal. 15069 */ 15070 SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map, 15071 &sfmmup->sfmmu_region_map, ret); 15072 if (ret == 1) { 15073 mutex_exit(&srdp->srd_scd_mutex); 15074 return; 15075 } 15076 } 15077 } 15078 15079 ASSERT(scdp == NULL); 15080 /* 15081 * No matching SCD has been found, create a new one. 15082 */ 15083 if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) == 15084 NULL) { 15085 mutex_exit(&srdp->srd_scd_mutex); 15086 return; 15087 } 15088 15089 /* 15090 * sfmmu_alloc_scd() returns with a ref count of 1 on the scd. 15091 */ 15092 15093 /* Set scd_rttecnt for shme rgns in SCD */ 15094 sfmmu_set_scd_rttecnt(srdp, new_scdp); 15095 15096 /* 15097 * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists. 15098 */ 15099 sfmmu_link_scd_to_regions(srdp, new_scdp); 15100 sfmmu_add_scd(&srdp->srd_scdp, new_scdp); 15101 SFMMU_STAT_ADD(sf_create_scd, 1); 15102 15103 mutex_exit(&srdp->srd_scd_mutex); 15104 sfmmu_join_scd(new_scdp, sfmmup); 15105 ASSERT(new_scdp->scd_refcnt >= 2); 15106 atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt); 15107 } 15108 15109 /* 15110 * This routine is called by a process to remove itself from an SCD. It is 15111 * either called when the processes has detached from a segment or from 15112 * hat_free_start() as a result of calling exit. 15113 */ 15114 static void 15115 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type) 15116 { 15117 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 15118 sf_srd_t *srdp = sfmmup->sfmmu_srdp; 15119 hatlock_t *hatlockp = TSB_HASH(sfmmup); 15120 int i; 15121 15122 ASSERT(scdp != NULL); 15123 ASSERT(srdp != NULL); 15124 15125 if (sfmmup->sfmmu_free) { 15126 /* 15127 * If the process is part of an SCD the sfmmu is unlinked 15128 * from scd_sf_list. 15129 */ 15130 mutex_enter(&scdp->scd_mutex); 15131 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup); 15132 mutex_exit(&scdp->scd_mutex); 15133 /* 15134 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that 15135 * are about to leave the SCD 15136 */ 15137 for (i = 0; i < mmu_page_sizes; i++) { 15138 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 15139 scdp->scd_rttecnt[i]); 15140 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 15141 sfmmup->sfmmu_scdrttecnt[i]); 15142 sfmmup->sfmmu_scdrttecnt[i] = 0; 15143 } 15144 sfmmup->sfmmu_scdp = NULL; 15145 15146 SF_SCD_DECR_REF(srdp, scdp); 15147 return; 15148 } 15149 15150 ASSERT(r_type != SFMMU_REGION_ISM || 15151 SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15152 ASSERT(scdp->scd_refcnt); 15153 ASSERT(!sfmmup->sfmmu_free); 15154 ASSERT(sfmmu_hat_lock_held(sfmmup)); 15155 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as)); 15156 15157 /* 15158 * Wait for ISM maps to be updated. 15159 */ 15160 if (r_type != SFMMU_REGION_ISM) { 15161 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) && 15162 sfmmup->sfmmu_scdp != NULL) { 15163 cv_wait(&sfmmup->sfmmu_tsb_cv, 15164 HATLOCK_MUTEXP(hatlockp)); 15165 } 15166 15167 if (sfmmup->sfmmu_scdp == NULL) { 15168 sfmmu_hat_exit(hatlockp); 15169 return; 15170 } 15171 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY); 15172 } 15173 15174 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) { 15175 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD); 15176 /* 15177 * Since HAT_JOIN_SCD was set our context 15178 * is still invalid. 15179 */ 15180 } else { 15181 /* 15182 * For a multi-thread process, we must stop 15183 * all the other threads before leaving the scd. 15184 */ 15185 15186 sfmmu_invalidate_ctx(sfmmup); 15187 } 15188 15189 /* Clear all the rid's for ISM, delete flags, etc */ 15190 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)); 15191 sfmmu_ism_hatflags(sfmmup, 0); 15192 15193 /* 15194 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that 15195 * are in SCD before this sfmmup leaves the SCD. 15196 */ 15197 for (i = 0; i < mmu_page_sizes; i++) { 15198 ASSERT(sfmmup->sfmmu_scdrttecnt[i] == 15199 scdp->scd_rttecnt[i]); 15200 atomic_add_long(&sfmmup->sfmmu_ttecnt[i], 15201 sfmmup->sfmmu_scdrttecnt[i]); 15202 sfmmup->sfmmu_scdrttecnt[i] = 0; 15203 /* update ismttecnt to include SCD ism before hat leaves SCD */ 15204 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i]; 15205 sfmmup->sfmmu_scdismttecnt[i] = 0; 15206 } 15207 /* update tsb0 inflation count */ 15208 sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt; 15209 15210 if (r_type != SFMMU_REGION_ISM) { 15211 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY); 15212 } 15213 sfmmup->sfmmu_scdp = NULL; 15214 15215 sfmmu_hat_exit(hatlockp); 15216 15217 /* 15218 * Unlink sfmmu from scd_sf_list this can be done without holding 15219 * the hat lock as we hold the sfmmu_as lock which prevents 15220 * hat_join_region from adding this thread to the scd again. Other 15221 * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL 15222 * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp 15223 * while holding the hat lock. 15224 */ 15225 mutex_enter(&scdp->scd_mutex); 15226 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup); 15227 mutex_exit(&scdp->scd_mutex); 15228 SFMMU_STAT(sf_leave_scd); 15229 15230 SF_SCD_DECR_REF(srdp, scdp); 15231 hatlockp = sfmmu_hat_enter(sfmmup); 15232 15233 } 15234 15235 /* 15236 * Unlink and free up an SCD structure with a reference count of 0. 15237 */ 15238 static void 15239 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap) 15240 { 15241 sfmmu_t *scsfmmup; 15242 sf_scd_t *sp; 15243 hatlock_t *shatlockp; 15244 int i, ret; 15245 15246 mutex_enter(&srdp->srd_scd_mutex); 15247 for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) { 15248 if (sp == scdp) 15249 break; 15250 } 15251 if (sp == NULL || sp->scd_refcnt) { 15252 mutex_exit(&srdp->srd_scd_mutex); 15253 return; 15254 } 15255 15256 /* 15257 * It is possible that the scd has been freed and reallocated with a 15258 * different region map while we've been waiting for the srd_scd_mutex. 15259 */ 15260 SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret); 15261 if (ret != 1) { 15262 mutex_exit(&srdp->srd_scd_mutex); 15263 return; 15264 } 15265 15266 ASSERT(scdp->scd_sf_list == NULL); 15267 /* 15268 * Unlink scd from srd_scdp list. 15269 */ 15270 sfmmu_remove_scd(&srdp->srd_scdp, scdp); 15271 mutex_exit(&srdp->srd_scd_mutex); 15272 15273 sfmmu_unlink_scd_from_regions(srdp, scdp); 15274 15275 /* Clear shared context tsb and release ctx */ 15276 scsfmmup = scdp->scd_sfmmup; 15277 15278 /* 15279 * create a barrier so that scd will not be destroyed 15280 * if other thread still holds the same shared hat lock. 15281 * E.g., sfmmu_tsbmiss_exception() needs to acquire the 15282 * shared hat lock before checking the shared tsb reloc flag. 15283 */ 15284 shatlockp = sfmmu_hat_enter(scsfmmup); 15285 sfmmu_hat_exit(shatlockp); 15286 15287 sfmmu_free_scd_tsbs(scsfmmup); 15288 15289 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) { 15290 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) { 15291 kmem_free(scsfmmup->sfmmu_hmeregion_links[i], 15292 SFMMU_L2_HMERLINKS_SIZE); 15293 scsfmmup->sfmmu_hmeregion_links[i] = NULL; 15294 } 15295 } 15296 kmem_cache_free(sfmmuid_cache, scsfmmup); 15297 kmem_cache_free(scd_cache, scdp); 15298 SFMMU_STAT(sf_destroy_scd); 15299 } 15300 15301 /* 15302 * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to 15303 * bits which are set in the ism_region_map parameter. This flag indicates to 15304 * the tsbmiss handler that mapping for these segments should be loaded using 15305 * the shared context. 15306 */ 15307 static void 15308 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag) 15309 { 15310 sf_scd_t *scdp = sfmmup->sfmmu_scdp; 15311 ism_blk_t *ism_blkp; 15312 ism_map_t *ism_map; 15313 int i, rid; 15314 15315 ASSERT(sfmmup->sfmmu_iblk != NULL); 15316 ASSERT(scdp != NULL); 15317 /* 15318 * Note that the caller either set HAT_ISMBUSY flag or checked 15319 * under hat lock that HAT_ISMBUSY was not set by another thread. 15320 */ 15321 ASSERT(sfmmu_hat_lock_held(sfmmup)); 15322 15323 ism_blkp = sfmmup->sfmmu_iblk; 15324 while (ism_blkp != NULL) { 15325 ism_map = ism_blkp->iblk_maps; 15326 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) { 15327 rid = ism_map[i].imap_rid; 15328 if (rid == SFMMU_INVALID_ISMRID) { 15329 continue; 15330 } 15331 ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS); 15332 if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) && 15333 addflag) { 15334 ism_map[i].imap_hatflags |= 15335 HAT_CTX1_FLAG; 15336 } else { 15337 ism_map[i].imap_hatflags &= 15338 ~HAT_CTX1_FLAG; 15339 } 15340 } 15341 ism_blkp = ism_blkp->iblk_next; 15342 } 15343 } 15344 15345 static int 15346 sfmmu_srd_lock_held(sf_srd_t *srdp) 15347 { 15348 return (MUTEX_HELD(&srdp->srd_mutex)); 15349 } 15350 15351 /* ARGSUSED */ 15352 static int 15353 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags) 15354 { 15355 sf_scd_t *scdp = (sf_scd_t *)buf; 15356 15357 bzero(buf, sizeof (sf_scd_t)); 15358 mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL); 15359 return (0); 15360 } 15361 15362 /* ARGSUSED */ 15363 static void 15364 sfmmu_scdcache_destructor(void *buf, void *cdrarg) 15365 { 15366 sf_scd_t *scdp = (sf_scd_t *)buf; 15367 15368 mutex_destroy(&scdp->scd_mutex); 15369 } 15370 15371 /* 15372 * The listp parameter is a pointer to a list of hmeblks which are partially 15373 * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the 15374 * freeing process is to cross-call all cpus to ensure that there are no 15375 * remaining cached references. 15376 * 15377 * If the local generation number is less than the global then we can free 15378 * hmeblks which are already on the pending queue as another cpu has completed 15379 * the cross-call. 15380 * 15381 * We cross-call to make sure that there are no threads on other cpus accessing 15382 * these hmblks and then complete the process of freeing them under the 15383 * following conditions: 15384 * The total number of pending hmeblks is greater than the threshold 15385 * The reserve list has fewer than HBLK_RESERVE_CNT hmeblks 15386 * It is at least 1 second since the last time we cross-called 15387 * 15388 * Otherwise, we add the hmeblks to the per-cpu pending queue. 15389 */ 15390 static void 15391 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree) 15392 { 15393 struct hme_blk *hblkp, *pr_hblkp = NULL; 15394 int count = 0; 15395 cpuset_t cpuset = cpu_ready_set; 15396 cpu_hme_pend_t *cpuhp; 15397 timestruc_t now; 15398 int one_second_expired = 0; 15399 15400 gethrestime_lasttick(&now); 15401 15402 for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) { 15403 ASSERT(hblkp->hblk_shw_bit == 0); 15404 ASSERT(hblkp->hblk_shared == 0); 15405 count++; 15406 pr_hblkp = hblkp; 15407 } 15408 15409 cpuhp = &cpu_hme_pend[CPU->cpu_seqid]; 15410 mutex_enter(&cpuhp->chp_mutex); 15411 15412 if ((cpuhp->chp_count + count) == 0) { 15413 mutex_exit(&cpuhp->chp_mutex); 15414 return; 15415 } 15416 15417 if ((now.tv_sec - cpuhp->chp_timestamp) > 1) { 15418 one_second_expired = 1; 15419 } 15420 15421 if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT || 15422 (cpuhp->chp_count + count) > cpu_hme_pend_thresh || 15423 one_second_expired)) { 15424 /* Append global list to local */ 15425 if (pr_hblkp == NULL) { 15426 *listp = cpuhp->chp_listp; 15427 } else { 15428 pr_hblkp->hblk_next = cpuhp->chp_listp; 15429 } 15430 cpuhp->chp_listp = NULL; 15431 cpuhp->chp_count = 0; 15432 cpuhp->chp_timestamp = now.tv_sec; 15433 mutex_exit(&cpuhp->chp_mutex); 15434 15435 kpreempt_disable(); 15436 CPUSET_DEL(cpuset, CPU->cpu_id); 15437 xt_sync(cpuset); 15438 xt_sync(cpuset); 15439 kpreempt_enable(); 15440 15441 /* 15442 * At this stage we know that no trap handlers on other 15443 * cpus can have references to hmeblks on the list. 15444 */ 15445 sfmmu_hblk_free(listp); 15446 } else if (*listp != NULL) { 15447 pr_hblkp->hblk_next = cpuhp->chp_listp; 15448 cpuhp->chp_listp = *listp; 15449 cpuhp->chp_count += count; 15450 *listp = NULL; 15451 mutex_exit(&cpuhp->chp_mutex); 15452 } else { 15453 mutex_exit(&cpuhp->chp_mutex); 15454 } 15455 } 15456 15457 /* 15458 * Add an hmeblk to the the hash list. 15459 */ 15460 void 15461 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 15462 uint64_t hblkpa) 15463 { 15464 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 15465 #ifdef DEBUG 15466 if (hmebp->hmeblkp == NULL) { 15467 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA); 15468 } 15469 #endif /* DEBUG */ 15470 15471 hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa; 15472 /* 15473 * Since the TSB miss handler now does not lock the hash chain before 15474 * walking it, make sure that the hmeblks nextpa is globally visible 15475 * before we make the hmeblk globally visible by updating the chain root 15476 * pointer in the hash bucket. 15477 */ 15478 membar_producer(); 15479 hmebp->hmeh_nextpa = hblkpa; 15480 hmeblkp->hblk_next = hmebp->hmeblkp; 15481 hmebp->hmeblkp = hmeblkp; 15482 15483 } 15484 15485 /* 15486 * This function is the first part of a 2 part process to remove an hmeblk 15487 * from the hash chain. In this phase we unlink the hmeblk from the hash chain 15488 * but leave the next physical pointer unchanged. The hmeblk is then linked onto 15489 * a per-cpu pending list using the virtual address pointer. 15490 * 15491 * TSB miss trap handlers that start after this phase will no longer see 15492 * this hmeblk. TSB miss handlers that still cache this hmeblk in a register 15493 * can still use it for further chain traversal because we haven't yet modifed 15494 * the next physical pointer or freed it. 15495 * 15496 * In the second phase of hmeblk removal we'll issue a barrier xcall before 15497 * we reuse or free this hmeblk. This will make sure all lingering references to 15498 * the hmeblk after first phase disappear before we finally reclaim it. 15499 * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains 15500 * during their traversal. 15501 * 15502 * The hmehash_mutex must be held when calling this function. 15503 * 15504 * Input: 15505 * hmebp - hme hash bucket pointer 15506 * hmeblkp - address of hmeblk to be removed 15507 * pr_hblk - virtual address of previous hmeblkp 15508 * listp - pointer to list of hmeblks linked by virtual address 15509 * free_now flag - indicates that a complete removal from the hash chains 15510 * is necessary. 15511 * 15512 * It is inefficient to use the free_now flag as a cross-call is required to 15513 * remove a single hmeblk from the hash chain but is necessary when hmeblks are 15514 * in short supply. 15515 */ 15516 void 15517 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp, 15518 struct hme_blk *pr_hblk, struct hme_blk **listp, 15519 int free_now) 15520 { 15521 int shw_size, vshift; 15522 struct hme_blk *shw_hblkp; 15523 uint_t shw_mask, newshw_mask; 15524 caddr_t vaddr; 15525 int size; 15526 cpuset_t cpuset = cpu_ready_set; 15527 15528 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp)); 15529 15530 if (hmebp->hmeblkp == hmeblkp) { 15531 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa; 15532 hmebp->hmeblkp = hmeblkp->hblk_next; 15533 } else { 15534 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa; 15535 pr_hblk->hblk_next = hmeblkp->hblk_next; 15536 } 15537 15538 size = get_hblk_ttesz(hmeblkp); 15539 shw_hblkp = hmeblkp->hblk_shadow; 15540 if (shw_hblkp) { 15541 ASSERT(hblktosfmmu(hmeblkp) != KHATID); 15542 ASSERT(!hmeblkp->hblk_shared); 15543 #ifdef DEBUG 15544 if (mmu_page_sizes == max_mmu_page_sizes) { 15545 ASSERT(size < TTE256M); 15546 } else { 15547 ASSERT(size < TTE4M); 15548 } 15549 #endif /* DEBUG */ 15550 15551 shw_size = get_hblk_ttesz(shw_hblkp); 15552 vaddr = (caddr_t)get_hblk_base(hmeblkp); 15553 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size); 15554 ASSERT(vshift < 8); 15555 /* 15556 * Atomically clear shadow mask bit 15557 */ 15558 do { 15559 shw_mask = shw_hblkp->hblk_shw_mask; 15560 ASSERT(shw_mask & (1 << vshift)); 15561 newshw_mask = shw_mask & ~(1 << vshift); 15562 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask, 15563 shw_mask, newshw_mask); 15564 } while (newshw_mask != shw_mask); 15565 hmeblkp->hblk_shadow = NULL; 15566 } 15567 hmeblkp->hblk_shw_bit = 0; 15568 15569 if (hmeblkp->hblk_shared) { 15570 #ifdef DEBUG 15571 sf_srd_t *srdp; 15572 sf_region_t *rgnp; 15573 uint_t rid; 15574 15575 srdp = hblktosrd(hmeblkp); 15576 ASSERT(srdp != NULL && srdp->srd_refcnt != 0); 15577 rid = hmeblkp->hblk_tag.htag_rid; 15578 ASSERT(SFMMU_IS_SHMERID_VALID(rid)); 15579 ASSERT(rid < SFMMU_MAX_HME_REGIONS); 15580 rgnp = srdp->srd_hmergnp[rid]; 15581 ASSERT(rgnp != NULL); 15582 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid); 15583 #endif /* DEBUG */ 15584 hmeblkp->hblk_shared = 0; 15585 } 15586 if (free_now) { 15587 kpreempt_disable(); 15588 CPUSET_DEL(cpuset, CPU->cpu_id); 15589 xt_sync(cpuset); 15590 xt_sync(cpuset); 15591 kpreempt_enable(); 15592 15593 hmeblkp->hblk_nextpa = HMEBLK_ENDPA; 15594 hmeblkp->hblk_next = NULL; 15595 } else { 15596 /* Append hmeblkp to listp for processing later. */ 15597 hmeblkp->hblk_next = *listp; 15598 *listp = hmeblkp; 15599 } 15600 } 15601 15602 /* 15603 * This routine is called when memory is in short supply and returns a free 15604 * hmeblk of the requested size from the cpu pending lists. 15605 */ 15606 static struct hme_blk * 15607 sfmmu_check_pending_hblks(int size) 15608 { 15609 int i; 15610 struct hme_blk *hmeblkp = NULL, *last_hmeblkp; 15611 int found_hmeblk; 15612 cpuset_t cpuset = cpu_ready_set; 15613 cpu_hme_pend_t *cpuhp; 15614 15615 /* Flush cpu hblk pending queues */ 15616 for (i = 0; i < NCPU; i++) { 15617 cpuhp = &cpu_hme_pend[i]; 15618 if (cpuhp->chp_listp != NULL) { 15619 mutex_enter(&cpuhp->chp_mutex); 15620 if (cpuhp->chp_listp == NULL) { 15621 mutex_exit(&cpuhp->chp_mutex); 15622 continue; 15623 } 15624 found_hmeblk = 0; 15625 last_hmeblkp = NULL; 15626 for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL; 15627 hmeblkp = hmeblkp->hblk_next) { 15628 if (get_hblk_ttesz(hmeblkp) == size) { 15629 if (last_hmeblkp == NULL) { 15630 cpuhp->chp_listp = 15631 hmeblkp->hblk_next; 15632 } else { 15633 last_hmeblkp->hblk_next = 15634 hmeblkp->hblk_next; 15635 } 15636 ASSERT(cpuhp->chp_count > 0); 15637 cpuhp->chp_count--; 15638 found_hmeblk = 1; 15639 break; 15640 } else { 15641 last_hmeblkp = hmeblkp; 15642 } 15643 } 15644 mutex_exit(&cpuhp->chp_mutex); 15645 15646 if (found_hmeblk) { 15647 kpreempt_disable(); 15648 CPUSET_DEL(cpuset, CPU->cpu_id); 15649 xt_sync(cpuset); 15650 xt_sync(cpuset); 15651 kpreempt_enable(); 15652 return (hmeblkp); 15653 } 15654 } 15655 } 15656 return (NULL); 15657 } 15658