1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24 /*
25 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
26 * Copyright 2016 Gary Mills
27 */
28
29 /*
30 * VM - Hardware Address Translation management for Spitfire MMU.
31 *
32 * This file implements the machine specific hardware translation
33 * needed by the VM system. The machine independent interface is
34 * described in <vm/hat.h> while the machine dependent interface
35 * and data structures are described in <vm/hat_sfmmu.h>.
36 *
37 * The hat layer manages the address translation hardware as a cache
38 * driven by calls from the higher levels in the VM system.
39 */
40
41 #include <sys/types.h>
42 #include <sys/kstat.h>
43 #include <vm/hat.h>
44 #include <vm/hat_sfmmu.h>
45 #include <vm/page.h>
46 #include <sys/pte.h>
47 #include <sys/systm.h>
48 #include <sys/mman.h>
49 #include <sys/sysmacros.h>
50 #include <sys/machparam.h>
51 #include <sys/vtrace.h>
52 #include <sys/kmem.h>
53 #include <sys/mmu.h>
54 #include <sys/cmn_err.h>
55 #include <sys/cpu.h>
56 #include <sys/cpuvar.h>
57 #include <sys/debug.h>
58 #include <sys/lgrp.h>
59 #include <sys/archsystm.h>
60 #include <sys/machsystm.h>
61 #include <sys/vmsystm.h>
62 #include <vm/as.h>
63 #include <vm/seg.h>
64 #include <vm/seg_kp.h>
65 #include <vm/seg_kmem.h>
66 #include <vm/seg_kpm.h>
67 #include <vm/rm.h>
68 #include <sys/t_lock.h>
69 #include <sys/obpdefs.h>
70 #include <sys/vm_machparam.h>
71 #include <sys/var.h>
72 #include <sys/trap.h>
73 #include <sys/machtrap.h>
74 #include <sys/scb.h>
75 #include <sys/bitmap.h>
76 #include <sys/machlock.h>
77 #include <sys/membar.h>
78 #include <sys/atomic.h>
79 #include <sys/cpu_module.h>
80 #include <sys/prom_debug.h>
81 #include <sys/ksynch.h>
82 #include <sys/mem_config.h>
83 #include <sys/mem_cage.h>
84 #include <vm/vm_dep.h>
85 #include <sys/fpu/fpusystm.h>
86 #include <vm/mach_kpm.h>
87 #include <sys/callb.h>
88
89 #ifdef DEBUG
90 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len) \
91 if (SFMMU_IS_SHMERID_VALID(rid)) { \
92 caddr_t _eaddr = (saddr) + (len); \
93 sf_srd_t *_srdp; \
94 sf_region_t *_rgnp; \
95 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \
96 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid)); \
97 ASSERT((hat) != ksfmmup); \
98 _srdp = (hat)->sfmmu_srdp; \
99 ASSERT(_srdp != NULL); \
100 ASSERT(_srdp->srd_refcnt != 0); \
101 _rgnp = _srdp->srd_hmergnp[(rid)]; \
102 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid); \
103 ASSERT(_rgnp->rgn_refcnt != 0); \
104 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
105 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == \
106 SFMMU_REGION_HME); \
107 ASSERT((saddr) >= _rgnp->rgn_saddr); \
108 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size); \
109 ASSERT(_eaddr > _rgnp->rgn_saddr); \
110 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size); \
111 }
112
113 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) \
114 { \
115 caddr_t _hsva; \
116 caddr_t _heva; \
117 caddr_t _rsva; \
118 caddr_t _reva; \
119 int _ttesz = get_hblk_ttesz(hmeblkp); \
120 int _flagtte; \
121 ASSERT((srdp)->srd_refcnt != 0); \
122 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \
123 ASSERT((rgnp)->rgn_id == rid); \
124 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE)); \
125 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) == \
126 SFMMU_REGION_HME); \
127 ASSERT(_ttesz <= (rgnp)->rgn_pgszc); \
128 _hsva = (caddr_t)get_hblk_base(hmeblkp); \
129 _heva = get_hblk_endaddr(hmeblkp); \
130 _rsva = (caddr_t)P2ALIGN( \
131 (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES); \
132 _reva = (caddr_t)P2ROUNDUP( \
133 (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size), \
134 HBLK_MIN_BYTES); \
135 ASSERT(_hsva >= _rsva); \
136 ASSERT(_hsva < _reva); \
137 ASSERT(_heva > _rsva); \
138 ASSERT(_heva <= _reva); \
139 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : \
140 _ttesz; \
141 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte)); \
142 }
143
144 #else /* DEBUG */
145 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
146 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
147 #endif /* DEBUG */
148
149 #if defined(SF_ERRATA_57)
150 extern caddr_t errata57_limit;
151 #endif
152
153 #define HME8BLK_SZ_RND ((roundup(HME8BLK_SZ, sizeof (int64_t))) / \
154 (sizeof (int64_t)))
155 #define HBLK_RESERVE ((struct hme_blk *)hblk_reserve)
156
157 #define HBLK_RESERVE_CNT 128
158 #define HBLK_RESERVE_MIN 20
159
160 static struct hme_blk *freehblkp;
161 static kmutex_t freehblkp_lock;
162 static int freehblkcnt;
163
164 static int64_t hblk_reserve[HME8BLK_SZ_RND];
165 static kmutex_t hblk_reserve_lock;
166 static kthread_t *hblk_reserve_thread;
167
168 static nucleus_hblk8_info_t nucleus_hblk8;
169 static nucleus_hblk1_info_t nucleus_hblk1;
170
171 /*
172 * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
173 * after the initial phase of removing an hmeblk from the hash chain, see
174 * the detailed comment in sfmmu_hblk_hash_rm() for further details.
175 */
176 static cpu_hme_pend_t *cpu_hme_pend;
177 static uint_t cpu_hme_pend_thresh;
178 /*
179 * SFMMU specific hat functions
180 */
181 void hat_pagecachectl(struct page *, int);
182
183 /* flags for hat_pagecachectl */
184 #define HAT_CACHE 0x1
185 #define HAT_UNCACHE 0x2
186 #define HAT_TMPNC 0x4
187
188 /*
189 * Flag to allow the creation of non-cacheable translations
190 * to system memory. It is off by default. At the moment this
191 * flag is used by the ecache error injector. The error injector
192 * will turn it on when creating such a translation then shut it
193 * off when it's finished.
194 */
195
196 int sfmmu_allow_nc_trans = 0;
197
198 /*
199 * Flag to disable large page support.
200 * value of 1 => disable all large pages.
201 * bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
202 *
203 * For example, use the value 0x4 to disable 512K pages.
204 *
205 */
206 #define LARGE_PAGES_OFF 0x1
207
208 /*
209 * The disable_large_pages and disable_ism_large_pages variables control
210 * hat_memload_array and the page sizes to be used by ISM and the kernel.
211 *
212 * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
213 * are only used to control which OOB pages to use at upper VM segment creation
214 * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
215 * Their values may come from platform or CPU specific code to disable page
216 * sizes that should not be used.
217 *
218 * WARNING: 512K pages are currently not supported for ISM/DISM.
219 */
220 uint_t disable_large_pages = 0;
221 uint_t disable_ism_large_pages = (1 << TTE512K);
222 uint_t disable_auto_data_large_pages = 0;
223 uint_t disable_auto_text_large_pages = 0;
224
225 /*
226 * Private sfmmu data structures for hat management
227 */
228 static struct kmem_cache *sfmmuid_cache;
229 static struct kmem_cache *mmuctxdom_cache;
230
231 /*
232 * Private sfmmu data structures for tsb management
233 */
234 static struct kmem_cache *sfmmu_tsbinfo_cache;
235 static struct kmem_cache *sfmmu_tsb8k_cache;
236 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
237 static vmem_t *kmem_bigtsb_arena;
238 static vmem_t *kmem_tsb_arena;
239
240 /*
241 * sfmmu static variables for hmeblk resource management.
242 */
243 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
244 static struct kmem_cache *sfmmu8_cache;
245 static struct kmem_cache *sfmmu1_cache;
246 static struct kmem_cache *pa_hment_cache;
247
248 static kmutex_t ism_mlist_lock; /* mutex for ism mapping list */
249 /*
250 * private data for ism
251 */
252 static struct kmem_cache *ism_blk_cache;
253 static struct kmem_cache *ism_ment_cache;
254 #define ISMID_STARTADDR NULL
255
256 /*
257 * Region management data structures and function declarations.
258 */
259
260 static void sfmmu_leave_srd(sfmmu_t *);
261 static int sfmmu_srdcache_constructor(void *, void *, int);
262 static void sfmmu_srdcache_destructor(void *, void *);
263 static int sfmmu_rgncache_constructor(void *, void *, int);
264 static void sfmmu_rgncache_destructor(void *, void *);
265 static int sfrgnmap_isnull(sf_region_map_t *);
266 static int sfhmergnmap_isnull(sf_hmeregion_map_t *);
267 static int sfmmu_scdcache_constructor(void *, void *, int);
268 static void sfmmu_scdcache_destructor(void *, void *);
269 static void sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
270 size_t, void *, u_offset_t);
271
272 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
273 static sf_srd_bucket_t *srd_buckets;
274 static struct kmem_cache *srd_cache;
275 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
276 static struct kmem_cache *region_cache;
277 static struct kmem_cache *scd_cache;
278
279 #ifdef sun4v
280 int use_bigtsb_arena = 1;
281 #else
282 int use_bigtsb_arena = 0;
283 #endif
284
285 /* External /etc/system tunable, for turning on&off the shctx support */
286 int disable_shctx = 0;
287 /* Internal variable, set by MD if the HW supports shctx feature */
288 int shctx_on = 0;
289
290 #ifdef DEBUG
291 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
292 #endif
293 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
294 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
295
296 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
297 static void sfmmu_find_scd(sfmmu_t *);
298 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
299 static void sfmmu_finish_join_scd(sfmmu_t *);
300 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
301 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
302 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
303 static void sfmmu_free_scd_tsbs(sfmmu_t *);
304 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
305 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
306 static void sfmmu_ism_hatflags(sfmmu_t *, int);
307 static int sfmmu_srd_lock_held(sf_srd_t *);
308 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
309 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
310 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
311 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
312 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
313 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
314
315 /*
316 * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
317 * HAT flags, synchronizing TLB/TSB coherency, and context management.
318 * The lock is hashed on the sfmmup since the case where we need to lock
319 * all processes is rare but does occur (e.g. we need to unload a shared
320 * mapping from all processes using the mapping). We have a lot of buckets,
321 * and each slab of sfmmu_t's can use about a quarter of them, giving us
322 * a fairly good distribution without wasting too much space and overhead
323 * when we have to grab them all.
324 */
325 #define SFMMU_NUM_LOCK 128 /* must be power of two */
326 hatlock_t hat_lock[SFMMU_NUM_LOCK];
327
328 /*
329 * Hash algorithm optimized for a small number of slabs.
330 * 7 is (highbit((sizeof sfmmu_t)) - 1)
331 * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
332 * kmem_cache, and thus they will be sequential within that cache. In
333 * addition, each new slab will have a different "color" up to cache_maxcolor
334 * which will skew the hashing for each successive slab which is allocated.
335 * If the size of sfmmu_t changed to a larger size, this algorithm may need
336 * to be revisited.
337 */
338 #define TSB_HASH_SHIFT_BITS (7)
339 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
340
341 #ifdef DEBUG
342 int tsb_hash_debug = 0;
343 #define TSB_HASH(sfmmup) \
344 (tsb_hash_debug ? &hat_lock[0] : \
345 &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
346 #else /* DEBUG */
347 #define TSB_HASH(sfmmup) &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
348 #endif /* DEBUG */
349
350
351 /* sfmmu_replace_tsb() return codes. */
352 typedef enum tsb_replace_rc {
353 TSB_SUCCESS,
354 TSB_ALLOCFAIL,
355 TSB_LOSTRACE,
356 TSB_ALREADY_SWAPPED,
357 TSB_CANTGROW
358 } tsb_replace_rc_t;
359
360 /*
361 * Flags for TSB allocation routines.
362 */
363 #define TSB_ALLOC 0x01
364 #define TSB_FORCEALLOC 0x02
365 #define TSB_GROW 0x04
366 #define TSB_SHRINK 0x08
367 #define TSB_SWAPIN 0x10
368
369 /*
370 * Support for HAT callbacks.
371 */
372 #define SFMMU_MAX_RELOC_CALLBACKS 10
373 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
374 static id_t sfmmu_cb_nextid = 0;
375 static id_t sfmmu_tsb_cb_id;
376 struct sfmmu_callback *sfmmu_cb_table;
377
378 kmutex_t kpr_mutex;
379 kmutex_t kpr_suspendlock;
380 kthread_t *kreloc_thread;
381
382 /*
383 * Enable VA->PA translation sanity checking on DEBUG kernels.
384 * Disabled by default. This is incompatible with some
385 * drivers (error injector, RSM) so if it breaks you get
386 * to keep both pieces.
387 */
388 int hat_check_vtop = 0;
389
390 /*
391 * Private sfmmu routines (prototypes)
392 */
393 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
394 static struct hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
395 struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
396 uint_t);
397 static caddr_t sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
398 caddr_t, demap_range_t *, uint_t);
399 static caddr_t sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
400 caddr_t, int);
401 static void sfmmu_hblk_free(struct hme_blk **);
402 static void sfmmu_hblks_list_purge(struct hme_blk **, int);
403 static uint_t sfmmu_get_free_hblk(struct hme_blk **, uint_t);
404 static uint_t sfmmu_put_free_hblk(struct hme_blk *, uint_t);
405 static struct hme_blk *sfmmu_hblk_steal(int);
406 static int sfmmu_steal_this_hblk(struct hmehash_bucket *,
407 struct hme_blk *, uint64_t, struct hme_blk *);
408 static caddr_t sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
409
410 static void hat_do_memload_array(struct hat *, caddr_t, size_t,
411 struct page **, uint_t, uint_t, uint_t);
412 static void hat_do_memload(struct hat *, caddr_t, struct page *,
413 uint_t, uint_t, uint_t);
414 static void sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
415 uint_t, uint_t, pgcnt_t, uint_t);
416 void sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
417 uint_t);
418 static int sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
419 uint_t, uint_t);
420 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
421 caddr_t, int, uint_t);
422 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
423 struct hmehash_bucket *, caddr_t, uint_t, uint_t,
424 uint_t);
425 static int sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
426 caddr_t, page_t **, uint_t, uint_t);
427 static void sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
428
429 static int sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
430 static pfn_t sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
431 void sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
432 #ifdef VAC
433 static void sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
434 static int sfmmu_vacconflict_array(caddr_t, page_t *, int *);
435 int tst_tnc(page_t *pp, pgcnt_t);
436 void conv_tnc(page_t *pp, int);
437 #endif
438
439 static void sfmmu_get_ctx(sfmmu_t *);
440 static void sfmmu_free_sfmmu(sfmmu_t *);
441
442 static void sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
443 static void sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
444
445 cpuset_t sfmmu_pageunload(page_t *, struct sf_hment *, int);
446 static void hat_pagereload(struct page *, struct page *);
447 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
448 #ifdef VAC
449 void sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
450 static void sfmmu_page_cache(page_t *, int, int, int);
451 #endif
452
453 cpuset_t sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
454 struct hme_blk *, int);
455 static void sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
456 pfn_t, int, int, int, int);
457 static void sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
458 pfn_t, int);
459 static void sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
460 static void sfmmu_tlb_range_demap(demap_range_t *);
461 static void sfmmu_invalidate_ctx(sfmmu_t *);
462 static void sfmmu_sync_mmustate(sfmmu_t *);
463
464 static void sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
465 static int sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
466 sfmmu_t *);
467 static void sfmmu_tsb_free(struct tsb_info *);
468 static void sfmmu_tsbinfo_free(struct tsb_info *);
469 static int sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
470 sfmmu_t *);
471 static void sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
472 static void sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
473 static int sfmmu_select_tsb_szc(pgcnt_t);
474 static void sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
475 #define sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
476 sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
477 #define sfmmu_unload_tsb(sfmmup, vaddr, szc) \
478 sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
479 static void sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
480 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
481 hatlock_t *, uint_t);
482 static void sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
483
484 #ifdef VAC
485 void sfmmu_cache_flush(pfn_t, int);
486 void sfmmu_cache_flushcolor(int, pfn_t);
487 #endif
488 static caddr_t sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
489 caddr_t, demap_range_t *, uint_t, int);
490
491 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
492 static uint_t sfmmu_ptov_attr(tte_t *);
493 static caddr_t sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
494 caddr_t, demap_range_t *, uint_t);
495 static uint_t sfmmu_vtop_prot(uint_t, uint_t *);
496 static int sfmmu_idcache_constructor(void *, void *, int);
497 static void sfmmu_idcache_destructor(void *, void *);
498 static int sfmmu_hblkcache_constructor(void *, void *, int);
499 static void sfmmu_hblkcache_destructor(void *, void *);
500 static void sfmmu_hblkcache_reclaim(void *);
501 static void sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
502 struct hmehash_bucket *);
503 static void sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
504 struct hme_blk *, struct hme_blk **, int);
505 static void sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
506 uint64_t);
507 static struct hme_blk *sfmmu_check_pending_hblks(int);
508 static void sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
509 static void sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
510 static void sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
511 int, caddr_t *);
512 static void sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
513
514 static void sfmmu_rm_large_mappings(page_t *, int);
515
516 static void hat_lock_init(void);
517 static void hat_kstat_init(void);
518 static int sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
519 static void sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
520 static int sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
521 static void sfmmu_check_page_sizes(sfmmu_t *, int);
522 int fnd_mapping_sz(page_t *);
523 static void iment_add(struct ism_ment *, struct hat *);
524 static void iment_sub(struct ism_ment *, struct hat *);
525 static pgcnt_t ism_tsb_entries(sfmmu_t *, int szc);
526 extern void sfmmu_setup_tsbinfo(sfmmu_t *);
527 extern void sfmmu_clear_utsbinfo(void);
528
529 static void sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
530
531 extern int vpm_enable;
532
533 /* kpm globals */
534 #ifdef DEBUG
535 /*
536 * Enable trap level tsbmiss handling
537 */
538 int kpm_tsbmtl = 1;
539
540 /*
541 * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
542 * required TLB shootdowns in this case, so handle w/ care. Off by default.
543 */
544 int kpm_tlb_flush;
545 #endif /* DEBUG */
546
547 static void *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
548
549 #ifdef DEBUG
550 static void sfmmu_check_hblk_flist();
551 #endif
552
553 /*
554 * Semi-private sfmmu data structures. Some of them are initialize in
555 * startup or in hat_init. Some of them are private but accessed by
556 * assembly code or mach_sfmmu.c
557 */
558 struct hmehash_bucket *uhme_hash; /* user hmeblk hash table */
559 struct hmehash_bucket *khme_hash; /* kernel hmeblk hash table */
560 uint64_t uhme_hash_pa; /* PA of uhme_hash */
561 uint64_t khme_hash_pa; /* PA of khme_hash */
562 int uhmehash_num; /* # of buckets in user hash table */
563 int khmehash_num; /* # of buckets in kernel hash table */
564
565 uint_t max_mmu_ctxdoms = 0; /* max context domains in the system */
566 mmu_ctx_t **mmu_ctxs_tbl; /* global array of context domains */
567 uint64_t mmu_saved_gnum = 0; /* to init incoming MMUs' gnums */
568
569 #define DEFAULT_NUM_CTXS_PER_MMU 8192
570 static uint_t nctxs = DEFAULT_NUM_CTXS_PER_MMU;
571
572 int cache; /* describes system cache */
573
574 caddr_t ktsb_base; /* kernel 8k-indexed tsb base address */
575 uint64_t ktsb_pbase; /* kernel 8k-indexed tsb phys address */
576 int ktsb_szcode; /* kernel 8k-indexed tsb size code */
577 int ktsb_sz; /* kernel 8k-indexed tsb size */
578
579 caddr_t ktsb4m_base; /* kernel 4m-indexed tsb base address */
580 uint64_t ktsb4m_pbase; /* kernel 4m-indexed tsb phys address */
581 int ktsb4m_szcode; /* kernel 4m-indexed tsb size code */
582 int ktsb4m_sz; /* kernel 4m-indexed tsb size */
583
584 uint64_t kpm_tsbbase; /* kernel seg_kpm 4M TSB base address */
585 int kpm_tsbsz; /* kernel seg_kpm 4M TSB size code */
586 uint64_t kpmsm_tsbbase; /* kernel seg_kpm 8K TSB base address */
587 int kpmsm_tsbsz; /* kernel seg_kpm 8K TSB size code */
588
589 #ifndef sun4v
590 int utsb_dtlb_ttenum = -1; /* index in TLB for utsb locked TTE */
591 int utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
592 int dtlb_resv_ttenum; /* index in TLB of first reserved TTE */
593 caddr_t utsb_vabase; /* reserved kernel virtual memory */
594 caddr_t utsb4m_vabase; /* for trap handler TSB accesses */
595 #endif /* sun4v */
596 uint64_t tsb_alloc_bytes = 0; /* bytes allocated to TSBs */
597 vmem_t *kmem_tsb_default_arena[NLGRPS_MAX]; /* For dynamic TSBs */
598 vmem_t *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
599
600 /*
601 * Size to use for TSB slabs. Future platforms that support page sizes
602 * larger than 4M may wish to change these values, and provide their own
603 * assembly macros for building and decoding the TSB base register contents.
604 * Note disable_large_pages will override the value set here.
605 */
606 static uint_t tsb_slab_ttesz = TTE4M;
607 size_t tsb_slab_size = MMU_PAGESIZE4M;
608 uint_t tsb_slab_shift = MMU_PAGESHIFT4M;
609 /* PFN mask for TTE */
610 size_t tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
611
612 /*
613 * Size to use for TSB slabs. These are used only when 256M tsb arenas
614 * exist.
615 */
616 static uint_t bigtsb_slab_ttesz = TTE256M;
617 static size_t bigtsb_slab_size = MMU_PAGESIZE256M;
618 static uint_t bigtsb_slab_shift = MMU_PAGESHIFT256M;
619 /* 256M page alignment for 8K pfn */
620 static size_t bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
621
622 /* largest TSB size to grow to, will be smaller on smaller memory systems */
623 static int tsb_max_growsize = 0;
624
625 /*
626 * Tunable parameters dealing with TSB policies.
627 */
628
629 /*
630 * This undocumented tunable forces all 8K TSBs to be allocated from
631 * the kernel heap rather than from the kmem_tsb_default_arena arenas.
632 */
633 #ifdef DEBUG
634 int tsb_forceheap = 0;
635 #endif /* DEBUG */
636
637 /*
638 * Decide whether to use per-lgroup arenas, or one global set of
639 * TSB arenas. The default is not to break up per-lgroup, since
640 * most platforms don't recognize any tangible benefit from it.
641 */
642 int tsb_lgrp_affinity = 0;
643
644 /*
645 * Used for growing the TSB based on the process RSS.
646 * tsb_rss_factor is based on the smallest TSB, and is
647 * shifted by the TSB size to determine if we need to grow.
648 * The default will grow the TSB if the number of TTEs for
649 * this page size exceeds 75% of the number of TSB entries,
650 * which should _almost_ eliminate all conflict misses
651 * (at the expense of using up lots and lots of memory).
652 */
653 #define TSB_RSS_FACTOR (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
654 #define SFMMU_RSS_TSBSIZE(tsbszc) (tsb_rss_factor << tsbszc)
655 #define SELECT_TSB_SIZECODE(pgcnt) ( \
656 (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
657 default_tsb_size)
658 #define TSB_OK_SHRINK() \
659 (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
660 #define TSB_OK_GROW() \
661 (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
662
663 volatile int enable_tsb_rss_sizing = 1;
664 volatile int tsb_rss_factor = (int)TSB_RSS_FACTOR;
665
666 /* which TSB size code to use for new address spaces or if rss sizing off */
667 volatile int default_tsb_size = TSB_8K_SZCODE;
668
669 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
670 volatile uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = */
671 /* physmem / this */
672 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT 32
673
674 #ifdef DEBUG
675 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
676 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
677 static int tsb_alloc_mtbf = 0; /* fail allocation every n attempts */
678 static int tsb_alloc_fail_mtbf = 0;
679 static int tsb_alloc_count = 0;
680 #endif /* DEBUG */
681
682 /* if set to 1, will remap valid TTEs when growing TSB. */
683 int tsb_remap_ttes = 1;
684
685 /*
686 * If we have more than this many mappings, allocate a second TSB.
687 * This default is chosen because the I/D fully associative TLBs are
688 * assumed to have at least 8 available entries. Platforms with a
689 * larger fully-associative TLB could probably override the default.
690 */
691
692 #ifdef sun4v
693 int tsb_sectsb_threshold = 0;
694 #else
695 int tsb_sectsb_threshold = 8;
696 #endif
697
698 /*
699 * kstat data
700 */
701 struct sfmmu_global_stat sfmmu_global_stat;
702 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
703
704 /*
705 * Global data
706 */
707 sfmmu_t *ksfmmup; /* kernel's hat id */
708
709 #ifdef DEBUG
710 static void chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
711 #endif
712
713 /* sfmmu locking operations */
714 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
715 static int sfmmu_mlspl_held(struct page *, int);
716
717 kmutex_t *sfmmu_page_enter(page_t *);
718 void sfmmu_page_exit(kmutex_t *);
719 int sfmmu_page_spl_held(struct page *);
720
721 /* sfmmu internal locking operations - accessed directly */
722 static void sfmmu_mlist_reloc_enter(page_t *, page_t *,
723 kmutex_t **, kmutex_t **);
724 static void sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
725 static hatlock_t *
726 sfmmu_hat_enter(sfmmu_t *);
727 static hatlock_t *
728 sfmmu_hat_tryenter(sfmmu_t *);
729 static void sfmmu_hat_exit(hatlock_t *);
730 static void sfmmu_hat_lock_all(void);
731 static void sfmmu_hat_unlock_all(void);
732 static void sfmmu_ismhat_enter(sfmmu_t *, int);
733 static void sfmmu_ismhat_exit(sfmmu_t *, int);
734
735 kpm_hlk_t *kpmp_table;
736 uint_t kpmp_table_sz; /* must be a power of 2 */
737 uchar_t kpmp_shift;
738
739 kpm_shlk_t *kpmp_stable;
740 uint_t kpmp_stable_sz; /* must be a power of 2 */
741
742 /*
743 * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
744 * SPL_SHIFT is log2(SPL_TABLE_SIZE).
745 */
746 #if ((2*NCPU_P2) > 128)
747 #define SPL_SHIFT ((unsigned)(NCPU_LOG2 + 1))
748 #else
749 #define SPL_SHIFT 7U
750 #endif
751 #define SPL_TABLE_SIZE (1U << SPL_SHIFT)
752 #define SPL_MASK (SPL_TABLE_SIZE - 1)
753
754 /*
755 * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
756 * and by multiples of SPL_SHIFT to get as many varied bits as we can.
757 */
758 #define SPL_INDEX(pp) \
759 ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
760 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
761 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
762 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
763 SPL_MASK)
764
765 #define SPL_HASH(pp) \
766 (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
767
768 static pad_mutex_t sfmmu_page_lock[SPL_TABLE_SIZE];
769
770 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
771
772 #define MML_TABLE_SIZE SPL_TABLE_SIZE
773 #define MLIST_HASH(pp) (&mml_table[SPL_INDEX(pp)].pad_mutex)
774
775 static pad_mutex_t mml_table[MML_TABLE_SIZE];
776
777 /*
778 * hat_unload_callback() will group together callbacks in order
779 * to avoid xt_sync() calls. This is the maximum size of the group.
780 */
781 #define MAX_CB_ADDR 32
782
783 tte_t hw_tte;
784 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
785
786 static char *mmu_ctx_kstat_names[] = {
787 "mmu_ctx_tsb_exceptions",
788 "mmu_ctx_tsb_raise_exception",
789 "mmu_ctx_wrap_around",
790 };
791
792 /*
793 * Wrapper for vmem_xalloc since vmem_create only allows limited
794 * parameters for vm_source_alloc functions. This function allows us
795 * to specify alignment consistent with the size of the object being
796 * allocated.
797 */
798 static void *
799 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
800 {
801 return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
802 }
803
804 /* Common code for setting tsb_alloc_hiwater. */
805 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages) tsb_alloc_hiwater = \
806 ptob(pages) / tsb_alloc_hiwater_factor
807
808 /*
809 * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
810 * a single TSB. physmem is the number of physical pages so we need physmem 8K
811 * TTEs to represent all those physical pages. We round this up by using
812 * 1<<highbit(). To figure out which size code to use, remember that the size
813 * code is just an amount to shift the smallest TSB size to get the size of
814 * this TSB. So we subtract that size, TSB_START_SIZE, from highbit() (or
815 * highbit() - 1) to get the size code for the smallest TSB that can represent
816 * all of physical memory, while erring on the side of too much.
817 *
818 * Restrict tsb_max_growsize to make sure that:
819 * 1) TSBs can't grow larger than the TSB slab size
820 * 2) TSBs can't grow larger than UTSB_MAX_SZCODE.
821 */
822 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) { \
823 int _i, _szc, _slabszc, _tsbszc; \
824 \
825 _i = highbit(pages); \
826 if ((1 << (_i - 1)) == (pages)) \
827 _i--; /* 2^n case, round down */ \
828 _szc = _i - TSB_START_SIZE; \
829 _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
830 _tsbszc = MIN(_szc, _slabszc); \
831 tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE); \
832 }
833
834 /*
835 * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
836 * tsb_info which handles that TTE size.
837 */
838 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) { \
839 (tsbinfop) = (sfmmup)->sfmmu_tsb; \
840 ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) || \
841 sfmmu_hat_lock_held(sfmmup)); \
842 if ((tte_szc) >= TTE4M) { \
843 ASSERT((tsbinfop) != NULL); \
844 (tsbinfop) = (tsbinfop)->tsb_next; \
845 } \
846 }
847
848 /*
849 * Macro to use to unload entries from the TSB.
850 * It has knowledge of which page sizes get replicated in the TSB
851 * and will call the appropriate unload routine for the appropriate size.
852 */
853 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat) \
854 { \
855 int ttesz = get_hblk_ttesz(hmeblkp); \
856 if (ttesz == TTE8K || ttesz == TTE4M) { \
857 sfmmu_unload_tsb(sfmmup, addr, ttesz); \
858 } else { \
859 caddr_t sva = ismhat ? addr : \
860 (caddr_t)get_hblk_base(hmeblkp); \
861 caddr_t eva = sva + get_hblk_span(hmeblkp); \
862 ASSERT(addr >= sva && addr < eva); \
863 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz); \
864 } \
865 }
866
867
868 /* Update tsb_alloc_hiwater after memory is configured. */
869 /*ARGSUSED*/
870 static void
871 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
872 {
873 /* Assumes physmem has already been updated. */
874 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
875 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
876 }
877
878 /*
879 * Update tsb_alloc_hiwater before memory is deleted. We'll do nothing here
880 * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
881 * deleted.
882 */
883 /*ARGSUSED*/
884 static int
885 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
886 {
887 return (0);
888 }
889
890 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
891 /*ARGSUSED*/
892 static void
893 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
894 {
895 /*
896 * Whether the delete was cancelled or not, just go ahead and update
897 * tsb_alloc_hiwater and tsb_max_growsize.
898 */
899 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
900 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
901 }
902
903 static kphysm_setup_vector_t sfmmu_update_vec = {
904 KPHYSM_SETUP_VECTOR_VERSION, /* version */
905 sfmmu_update_post_add, /* post_add */
906 sfmmu_update_pre_del, /* pre_del */
907 sfmmu_update_post_del /* post_del */
908 };
909
910
911 /*
912 * HME_BLK HASH PRIMITIVES
913 */
914
915 /*
916 * Enter a hme on the mapping list for page pp.
917 * When large pages are more prevalent in the system we might want to
918 * keep the mapping list in ascending order by the hment size. For now,
919 * small pages are more frequent, so don't slow it down.
920 */
921 #define HME_ADD(hme, pp) \
922 { \
923 ASSERT(sfmmu_mlist_held(pp)); \
924 \
925 hme->hme_prev = NULL; \
926 hme->hme_next = pp->p_mapping; \
927 hme->hme_page = pp; \
928 if (pp->p_mapping) { \
929 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
930 ASSERT(pp->p_share > 0); \
931 } else { \
932 /* EMPTY */ \
933 ASSERT(pp->p_share == 0); \
934 } \
935 pp->p_mapping = hme; \
936 pp->p_share++; \
937 }
938
939 /*
940 * Enter a hme on the mapping list for page pp.
941 * If we are unmapping a large translation, we need to make sure that the
942 * change is reflect in the corresponding bit of the p_index field.
943 */
944 #define HME_SUB(hme, pp) \
945 { \
946 ASSERT(sfmmu_mlist_held(pp)); \
947 ASSERT(hme->hme_page == pp || IS_PAHME(hme)); \
948 \
949 if (pp->p_mapping == NULL) { \
950 panic("hme_remove - no mappings"); \
951 } \
952 \
953 membar_stst(); /* ensure previous stores finish */ \
954 \
955 ASSERT(pp->p_share > 0); \
956 pp->p_share--; \
957 \
958 if (hme->hme_prev) { \
959 ASSERT(pp->p_mapping != hme); \
960 ASSERT(hme->hme_prev->hme_page == pp || \
961 IS_PAHME(hme->hme_prev)); \
962 hme->hme_prev->hme_next = hme->hme_next; \
963 } else { \
964 ASSERT(pp->p_mapping == hme); \
965 pp->p_mapping = hme->hme_next; \
966 ASSERT((pp->p_mapping == NULL) ? \
967 (pp->p_share == 0) : 1); \
968 } \
969 \
970 if (hme->hme_next) { \
971 ASSERT(hme->hme_next->hme_page == pp || \
972 IS_PAHME(hme->hme_next)); \
973 hme->hme_next->hme_prev = hme->hme_prev; \
974 } \
975 \
976 /* zero out the entry */ \
977 hme->hme_next = NULL; \
978 hme->hme_prev = NULL; \
979 hme->hme_page = NULL; \
980 \
981 if (hme_size(hme) > TTE8K) { \
982 /* remove mappings for remainder of large pg */ \
983 sfmmu_rm_large_mappings(pp, hme_size(hme)); \
984 } \
985 }
986
987 /*
988 * This function returns the hment given the hme_blk and a vaddr.
989 * It assumes addr has already been checked to belong to hme_blk's
990 * range.
991 */
992 #define HBLKTOHME(hment, hmeblkp, addr) \
993 { \
994 int index; \
995 HBLKTOHME_IDX(hment, hmeblkp, addr, index) \
996 }
997
998 /*
999 * Version of HBLKTOHME that also returns the index in hmeblkp
1000 * of the hment.
1001 */
1002 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx) \
1003 { \
1004 ASSERT(in_hblk_range((hmeblkp), (addr))); \
1005 \
1006 if (get_hblk_ttesz(hmeblkp) == TTE8K) { \
1007 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1008 } else \
1009 idx = 0; \
1010 \
1011 (hment) = &(hmeblkp)->hblk_hme[idx]; \
1012 }
1013
1014 /*
1015 * Disable any page sizes not supported by the CPU
1016 */
1017 void
1018 hat_init_pagesizes()
1019 {
1020 int i;
1021
1022 mmu_exported_page_sizes = 0;
1023 for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1024
1025 szc_2_userszc[i] = (uint_t)-1;
1026 userszc_2_szc[i] = (uint_t)-1;
1027
1028 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1029 disable_large_pages |= (1 << i);
1030 } else {
1031 szc_2_userszc[i] = mmu_exported_page_sizes;
1032 userszc_2_szc[mmu_exported_page_sizes] = i;
1033 mmu_exported_page_sizes++;
1034 }
1035 }
1036
1037 disable_ism_large_pages |= disable_large_pages;
1038 disable_auto_data_large_pages = disable_large_pages;
1039 disable_auto_text_large_pages = disable_large_pages;
1040
1041 /*
1042 * Initialize mmu-specific large page sizes.
1043 */
1044 if (&mmu_large_pages_disabled) {
1045 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1046 disable_ism_large_pages |=
1047 mmu_large_pages_disabled(HAT_LOAD_SHARE);
1048 disable_auto_data_large_pages |=
1049 mmu_large_pages_disabled(HAT_AUTO_DATA);
1050 disable_auto_text_large_pages |=
1051 mmu_large_pages_disabled(HAT_AUTO_TEXT);
1052 }
1053 }
1054
1055 /*
1056 * Initialize the hardware address translation structures.
1057 */
1058 void
1059 hat_init(void)
1060 {
1061 int i;
1062 uint_t sz;
1063 size_t size;
1064
1065 hat_lock_init();
1066 hat_kstat_init();
1067
1068 /*
1069 * Hardware-only bits in a TTE
1070 */
1071 MAKE_TTE_MASK(&hw_tte);
1072
1073 hat_init_pagesizes();
1074
1075 /* Initialize the hash locks */
1076 for (i = 0; i < khmehash_num; i++) {
1077 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1078 MUTEX_DEFAULT, NULL);
1079 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1080 }
1081 for (i = 0; i < uhmehash_num; i++) {
1082 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1083 MUTEX_DEFAULT, NULL);
1084 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1085 }
1086 khmehash_num--; /* make sure counter starts from 0 */
1087 uhmehash_num--; /* make sure counter starts from 0 */
1088
1089 /*
1090 * Allocate context domain structures.
1091 *
1092 * A platform may choose to modify max_mmu_ctxdoms in
1093 * set_platform_defaults(). If a platform does not define
1094 * a set_platform_defaults() or does not choose to modify
1095 * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1096 *
1097 * For all platforms that have CPUs sharing MMUs, this
1098 * value must be defined.
1099 */
1100 if (max_mmu_ctxdoms == 0)
1101 max_mmu_ctxdoms = max_ncpus;
1102
1103 size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1104 mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1105
1106 /* mmu_ctx_t is 64 bytes aligned */
1107 mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1108 sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1109 /*
1110 * MMU context domain initialization for the Boot CPU.
1111 * This needs the context domains array allocated above.
1112 */
1113 mutex_enter(&cpu_lock);
1114 sfmmu_cpu_init(CPU);
1115 mutex_exit(&cpu_lock);
1116
1117 /*
1118 * Intialize ism mapping list lock.
1119 */
1120
1121 mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1122
1123 /*
1124 * Each sfmmu structure carries an array of MMU context info
1125 * structures, one per context domain. The size of this array depends
1126 * on the maximum number of context domains. So, the size of the
1127 * sfmmu structure varies per platform.
1128 *
1129 * sfmmu is allocated from static arena, because trap
1130 * handler at TL > 0 is not allowed to touch kernel relocatable
1131 * memory. sfmmu's alignment is changed to 64 bytes from
1132 * default 8 bytes, as the lower 6 bits will be used to pass
1133 * pgcnt to vtag_flush_pgcnt_tl1.
1134 */
1135 size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1136
1137 sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1138 64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1139 NULL, NULL, static_arena, 0);
1140
1141 sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1142 sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1143
1144 /*
1145 * Since we only use the tsb8k cache to "borrow" pages for TSBs
1146 * from the heap when low on memory or when TSB_FORCEALLOC is
1147 * specified, don't use magazines to cache them--we want to return
1148 * them to the system as quickly as possible.
1149 */
1150 sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1151 MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1152 static_arena, KMC_NOMAGAZINE);
1153
1154 /*
1155 * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1156 * memory, which corresponds to the old static reserve for TSBs.
1157 * tsb_alloc_hiwater_factor defaults to 32. This caps the amount of
1158 * memory we'll allocate for TSB slabs; beyond this point TSB
1159 * allocations will be taken from the kernel heap (via
1160 * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1161 * consumer.
1162 */
1163 if (tsb_alloc_hiwater_factor == 0) {
1164 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1165 }
1166 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1167
1168 for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1169 if (!(disable_large_pages & (1 << sz)))
1170 break;
1171 }
1172
1173 if (sz < tsb_slab_ttesz) {
1174 tsb_slab_ttesz = sz;
1175 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1176 tsb_slab_size = 1 << tsb_slab_shift;
1177 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1178 use_bigtsb_arena = 0;
1179 } else if (use_bigtsb_arena &&
1180 (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1181 use_bigtsb_arena = 0;
1182 }
1183
1184 if (!use_bigtsb_arena) {
1185 bigtsb_slab_shift = tsb_slab_shift;
1186 }
1187 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1188
1189 /*
1190 * On smaller memory systems, allocate TSB memory in smaller chunks
1191 * than the default 4M slab size. We also honor disable_large_pages
1192 * here.
1193 *
1194 * The trap handlers need to be patched with the final slab shift,
1195 * since they need to be able to construct the TSB pointer at runtime.
1196 */
1197 if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1198 !(disable_large_pages & (1 << TTE512K))) {
1199 tsb_slab_ttesz = TTE512K;
1200 tsb_slab_shift = MMU_PAGESHIFT512K;
1201 tsb_slab_size = MMU_PAGESIZE512K;
1202 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1203 use_bigtsb_arena = 0;
1204 }
1205
1206 if (!use_bigtsb_arena) {
1207 bigtsb_slab_ttesz = tsb_slab_ttesz;
1208 bigtsb_slab_shift = tsb_slab_shift;
1209 bigtsb_slab_size = tsb_slab_size;
1210 bigtsb_slab_mask = tsb_slab_mask;
1211 }
1212
1213
1214 /*
1215 * Set up memory callback to update tsb_alloc_hiwater and
1216 * tsb_max_growsize.
1217 */
1218 i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1219 ASSERT(i == 0);
1220
1221 /*
1222 * kmem_tsb_arena is the source from which large TSB slabs are
1223 * drawn. The quantum of this arena corresponds to the largest
1224 * TSB size we can dynamically allocate for user processes.
1225 * Currently it must also be a supported page size since we
1226 * use exactly one translation entry to map each slab page.
1227 *
1228 * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1229 * which most TSBs are allocated. Since most TSB allocations are
1230 * typically 8K we have a kmem cache we stack on top of each
1231 * kmem_tsb_default_arena to speed up those allocations.
1232 *
1233 * Note the two-level scheme of arenas is required only
1234 * because vmem_create doesn't allow us to specify alignment
1235 * requirements. If this ever changes the code could be
1236 * simplified to use only one level of arenas.
1237 *
1238 * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1239 * will be provided in addition to the 4M kmem_tsb_arena.
1240 */
1241 if (use_bigtsb_arena) {
1242 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1243 bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1244 vmem_xfree, heap_arena, 0, VM_SLEEP);
1245 }
1246
1247 kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1248 sfmmu_vmem_xalloc_aligned_wrapper,
1249 vmem_xfree, heap_arena, 0, VM_SLEEP);
1250
1251 if (tsb_lgrp_affinity) {
1252 char s[50];
1253 for (i = 0; i < NLGRPS_MAX; i++) {
1254 if (use_bigtsb_arena) {
1255 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1256 kmem_bigtsb_default_arena[i] = vmem_create(s,
1257 NULL, 0, 2 * tsb_slab_size,
1258 sfmmu_tsb_segkmem_alloc,
1259 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1260 0, VM_SLEEP | VM_BESTFIT);
1261 }
1262
1263 (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1264 kmem_tsb_default_arena[i] = vmem_create(s,
1265 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1266 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1267 VM_SLEEP | VM_BESTFIT);
1268
1269 (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1270 sfmmu_tsb_cache[i] = kmem_cache_create(s,
1271 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1272 kmem_tsb_default_arena[i], 0);
1273 }
1274 } else {
1275 if (use_bigtsb_arena) {
1276 kmem_bigtsb_default_arena[0] =
1277 vmem_create("kmem_bigtsb_default", NULL, 0,
1278 2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1279 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1280 VM_SLEEP | VM_BESTFIT);
1281 }
1282
1283 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1284 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1285 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1286 VM_SLEEP | VM_BESTFIT);
1287 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1288 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1289 kmem_tsb_default_arena[0], 0);
1290 }
1291
1292 sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1293 HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1294 sfmmu_hblkcache_destructor,
1295 sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1296 hat_memload_arena, KMC_NOHASH);
1297
1298 hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1299 segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1300 VMC_DUMPSAFE | VM_SLEEP);
1301
1302 sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1303 HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1304 sfmmu_hblkcache_destructor,
1305 NULL, (void *)HME1BLK_SZ,
1306 hat_memload1_arena, KMC_NOHASH);
1307
1308 pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1309 0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1310
1311 ism_blk_cache = kmem_cache_create("ism_blk_cache",
1312 sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1313 NULL, NULL, static_arena, KMC_NOHASH);
1314
1315 ism_ment_cache = kmem_cache_create("ism_ment_cache",
1316 sizeof (ism_ment_t), 0, NULL, NULL,
1317 NULL, NULL, NULL, 0);
1318
1319 /*
1320 * We grab the first hat for the kernel,
1321 */
1322 AS_LOCK_ENTER(&kas, RW_WRITER);
1323 kas.a_hat = hat_alloc(&kas);
1324 AS_LOCK_EXIT(&kas);
1325
1326 /*
1327 * Initialize hblk_reserve.
1328 */
1329 ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1330 va_to_pa((caddr_t)hblk_reserve);
1331
1332 #ifndef UTSB_PHYS
1333 /*
1334 * Reserve some kernel virtual address space for the locked TTEs
1335 * that allow us to probe the TSB from TL>0.
1336 */
1337 utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1338 0, 0, NULL, NULL, VM_SLEEP);
1339 utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1340 0, 0, NULL, NULL, VM_SLEEP);
1341 #endif
1342
1343 #ifdef VAC
1344 /*
1345 * The big page VAC handling code assumes VAC
1346 * will not be bigger than the smallest big
1347 * page- which is 64K.
1348 */
1349 if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1350 cmn_err(CE_PANIC, "VAC too big!");
1351 }
1352 #endif
1353
1354 uhme_hash_pa = va_to_pa(uhme_hash);
1355 khme_hash_pa = va_to_pa(khme_hash);
1356
1357 /*
1358 * Initialize relocation locks. kpr_suspendlock is held
1359 * at PIL_MAX to prevent interrupts from pinning the holder
1360 * of a suspended TTE which may access it leading to a
1361 * deadlock condition.
1362 */
1363 mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1364 mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1365
1366 /*
1367 * If Shared context support is disabled via /etc/system
1368 * set shctx_on to 0 here if it was set to 1 earlier in boot
1369 * sequence by cpu module initialization code.
1370 */
1371 if (shctx_on && disable_shctx) {
1372 shctx_on = 0;
1373 }
1374
1375 if (shctx_on) {
1376 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1377 sizeof (srd_buckets[0]), KM_SLEEP);
1378 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1379 mutex_init(&srd_buckets[i].srdb_lock, NULL,
1380 MUTEX_DEFAULT, NULL);
1381 }
1382
1383 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1384 0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1385 NULL, NULL, NULL, 0);
1386 region_cache = kmem_cache_create("region_cache",
1387 sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1388 sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1389 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1390 0, sfmmu_scdcache_constructor, sfmmu_scdcache_destructor,
1391 NULL, NULL, NULL, 0);
1392 }
1393
1394 /*
1395 * Pre-allocate hrm_hashtab before enabling the collection of
1396 * refmod statistics. Allocating on the fly would mean us
1397 * running the risk of suffering recursive mutex enters or
1398 * deadlocks.
1399 */
1400 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1401 KM_SLEEP);
1402
1403 /* Allocate per-cpu pending freelist of hmeblks */
1404 cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1405 KM_SLEEP);
1406 cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1407 (uintptr_t)cpu_hme_pend, 64);
1408
1409 for (i = 0; i < NCPU; i++) {
1410 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1411 NULL);
1412 }
1413
1414 if (cpu_hme_pend_thresh == 0) {
1415 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1416 }
1417 }
1418
1419 /*
1420 * Initialize locking for the hat layer, called early during boot.
1421 */
1422 static void
1423 hat_lock_init()
1424 {
1425 int i;
1426
1427 /*
1428 * initialize the array of mutexes protecting a page's mapping
1429 * list and p_nrm field.
1430 */
1431 for (i = 0; i < MML_TABLE_SIZE; i++)
1432 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1433
1434 if (kpm_enable) {
1435 for (i = 0; i < kpmp_table_sz; i++) {
1436 mutex_init(&kpmp_table[i].khl_mutex, NULL,
1437 MUTEX_DEFAULT, NULL);
1438 }
1439 }
1440
1441 /*
1442 * Initialize array of mutex locks that protects sfmmu fields and
1443 * TSB lists.
1444 */
1445 for (i = 0; i < SFMMU_NUM_LOCK; i++)
1446 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1447 NULL);
1448 }
1449
1450 #define SFMMU_KERNEL_MAXVA \
1451 (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1452
1453 /*
1454 * Allocate a hat structure.
1455 * Called when an address space first uses a hat.
1456 */
1457 struct hat *
1458 hat_alloc(struct as *as)
1459 {
1460 sfmmu_t *sfmmup;
1461 int i;
1462 uint64_t cnum;
1463 extern uint_t get_color_start(struct as *);
1464
1465 ASSERT(AS_WRITE_HELD(as));
1466 sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1467 sfmmup->sfmmu_as = as;
1468 sfmmup->sfmmu_flags = 0;
1469 sfmmup->sfmmu_tteflags = 0;
1470 sfmmup->sfmmu_rtteflags = 0;
1471 LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1472
1473 if (as == &kas) {
1474 ksfmmup = sfmmup;
1475 sfmmup->sfmmu_cext = 0;
1476 cnum = KCONTEXT;
1477
1478 sfmmup->sfmmu_clrstart = 0;
1479 sfmmup->sfmmu_tsb = NULL;
1480 /*
1481 * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1482 * to setup tsb_info for ksfmmup.
1483 */
1484 } else {
1485
1486 /*
1487 * Just set to invalid ctx. When it faults, it will
1488 * get a valid ctx. This would avoid the situation
1489 * where we get a ctx, but it gets stolen and then
1490 * we fault when we try to run and so have to get
1491 * another ctx.
1492 */
1493 sfmmup->sfmmu_cext = 0;
1494 cnum = INVALID_CONTEXT;
1495
1496 /* initialize original physical page coloring bin */
1497 sfmmup->sfmmu_clrstart = get_color_start(as);
1498 #ifdef DEBUG
1499 if (tsb_random_size) {
1500 uint32_t randval = (uint32_t)gettick() >> 4;
1501 int size = randval % (tsb_max_growsize + 1);
1502
1503 /* chose a random tsb size for stress testing */
1504 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1505 TSB8K|TSB64K|TSB512K, 0, sfmmup);
1506 } else
1507 #endif /* DEBUG */
1508 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1509 default_tsb_size,
1510 TSB8K|TSB64K|TSB512K, 0, sfmmup);
1511 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1512 ASSERT(sfmmup->sfmmu_tsb != NULL);
1513 }
1514
1515 ASSERT(max_mmu_ctxdoms > 0);
1516 for (i = 0; i < max_mmu_ctxdoms; i++) {
1517 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1518 sfmmup->sfmmu_ctxs[i].gnum = 0;
1519 }
1520
1521 for (i = 0; i < max_mmu_page_sizes; i++) {
1522 sfmmup->sfmmu_ttecnt[i] = 0;
1523 sfmmup->sfmmu_scdrttecnt[i] = 0;
1524 sfmmup->sfmmu_ismttecnt[i] = 0;
1525 sfmmup->sfmmu_scdismttecnt[i] = 0;
1526 sfmmup->sfmmu_pgsz[i] = TTE8K;
1527 }
1528 sfmmup->sfmmu_tsb0_4minflcnt = 0;
1529 sfmmup->sfmmu_iblk = NULL;
1530 sfmmup->sfmmu_ismhat = 0;
1531 sfmmup->sfmmu_scdhat = 0;
1532 sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1533 if (sfmmup == ksfmmup) {
1534 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1535 } else {
1536 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1537 }
1538 sfmmup->sfmmu_free = 0;
1539 sfmmup->sfmmu_rmstat = 0;
1540 sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1541 cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1542 sfmmup->sfmmu_srdp = NULL;
1543 SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1544 bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1545 sfmmup->sfmmu_scdp = NULL;
1546 sfmmup->sfmmu_scd_link.next = NULL;
1547 sfmmup->sfmmu_scd_link.prev = NULL;
1548 return (sfmmup);
1549 }
1550
1551 /*
1552 * Create per-MMU context domain kstats for a given MMU ctx.
1553 */
1554 static void
1555 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1556 {
1557 mmu_ctx_stat_t stat;
1558 kstat_t *mmu_kstat;
1559
1560 ASSERT(MUTEX_HELD(&cpu_lock));
1561 ASSERT(mmu_ctxp->mmu_kstat == NULL);
1562
1563 mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1564 "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1565
1566 if (mmu_kstat == NULL) {
1567 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1568 mmu_ctxp->mmu_idx);
1569 } else {
1570 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1571 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1572 kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1573 mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1574 mmu_ctxp->mmu_kstat = mmu_kstat;
1575 kstat_install(mmu_kstat);
1576 }
1577 }
1578
1579 /*
1580 * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1581 * context domain information for a given CPU. If a platform does not
1582 * specify that interface, then the function below is used instead to return
1583 * default information. The defaults are as follows:
1584 *
1585 * - The number of MMU context IDs supported on any CPU in the
1586 * system is 8K.
1587 * - There is one MMU context domain per CPU.
1588 */
1589 /*ARGSUSED*/
1590 static void
1591 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1592 {
1593 infop->mmu_nctxs = nctxs;
1594 infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1595 }
1596
1597 /*
1598 * Called during CPU initialization to set the MMU context-related information
1599 * for a CPU.
1600 *
1601 * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1602 */
1603 void
1604 sfmmu_cpu_init(cpu_t *cp)
1605 {
1606 mmu_ctx_info_t info;
1607 mmu_ctx_t *mmu_ctxp;
1608
1609 ASSERT(MUTEX_HELD(&cpu_lock));
1610
1611 if (&plat_cpuid_to_mmu_ctx_info == NULL)
1612 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1613 else
1614 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1615
1616 ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1617
1618 if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1619 /* Each mmu_ctx is cacheline aligned. */
1620 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1621 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1622
1623 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1624 (void *)ipltospl(DISP_LEVEL));
1625 mmu_ctxp->mmu_idx = info.mmu_idx;
1626 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1627 /*
1628 * Globally for lifetime of a system,
1629 * gnum must always increase.
1630 * mmu_saved_gnum is protected by the cpu_lock.
1631 */
1632 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1633 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1634
1635 sfmmu_mmu_kstat_create(mmu_ctxp);
1636
1637 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1638 } else {
1639 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1640 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1641 }
1642
1643 /*
1644 * The mmu_lock is acquired here to prevent races with
1645 * the wrap-around code.
1646 */
1647 mutex_enter(&mmu_ctxp->mmu_lock);
1648
1649
1650 mmu_ctxp->mmu_ncpus++;
1651 CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1652 CPU_MMU_IDX(cp) = info.mmu_idx;
1653 CPU_MMU_CTXP(cp) = mmu_ctxp;
1654
1655 mutex_exit(&mmu_ctxp->mmu_lock);
1656 }
1657
1658 static void
1659 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1660 {
1661 ASSERT(MUTEX_HELD(&cpu_lock));
1662 ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1663
1664 mutex_destroy(&mmu_ctxp->mmu_lock);
1665
1666 if (mmu_ctxp->mmu_kstat)
1667 kstat_delete(mmu_ctxp->mmu_kstat);
1668
1669 /* mmu_saved_gnum is protected by the cpu_lock. */
1670 if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1671 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1672
1673 kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1674 }
1675
1676 /*
1677 * Called to perform MMU context-related cleanup for a CPU.
1678 */
1679 void
1680 sfmmu_cpu_cleanup(cpu_t *cp)
1681 {
1682 mmu_ctx_t *mmu_ctxp;
1683
1684 ASSERT(MUTEX_HELD(&cpu_lock));
1685
1686 mmu_ctxp = CPU_MMU_CTXP(cp);
1687 ASSERT(mmu_ctxp != NULL);
1688
1689 /*
1690 * The mmu_lock is acquired here to prevent races with
1691 * the wrap-around code.
1692 */
1693 mutex_enter(&mmu_ctxp->mmu_lock);
1694
1695 CPU_MMU_CTXP(cp) = NULL;
1696
1697 CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1698 if (--mmu_ctxp->mmu_ncpus == 0) {
1699 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1700 mutex_exit(&mmu_ctxp->mmu_lock);
1701 sfmmu_ctxdom_free(mmu_ctxp);
1702 return;
1703 }
1704
1705 mutex_exit(&mmu_ctxp->mmu_lock);
1706 }
1707
1708 uint_t
1709 sfmmu_ctxdom_nctxs(int idx)
1710 {
1711 return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1712 }
1713
1714 #ifdef sun4v
1715 /*
1716 * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1717 * consistant after suspend/resume on system that can resume on a different
1718 * hardware than it was suspended.
1719 *
1720 * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1721 * from being allocated. It acquires all hat_locks, which blocks most access to
1722 * context data, except for a few cases that are handled separately or are
1723 * harmless. It wraps each domain to increment gnum and invalidate on-CPU
1724 * contexts, and forces cnum to its max. As a result of this call all user
1725 * threads that are running on CPUs trap and try to perform wrap around but
1726 * can't because hat_locks are taken. Threads that were not on CPUs but started
1727 * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1728 * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1729 * on hat_lock trying to wrap. sfmmu_ctxdom_lock() must be called before CPUs
1730 * are paused, else it could deadlock acquiring locks held by paused CPUs.
1731 *
1732 * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1733 * the CPUs that had them. It must be called after CPUs have been paused. This
1734 * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1735 * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1736 * runs with interrupts disabled. When CPUs are later resumed, they may enter
1737 * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1738 * return failure. Or, they will be blocked trying to acquire hat_lock. Thus
1739 * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1740 * accessing the old context domains.
1741 *
1742 * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1743 * allocates new context domains based on hardware layout. It initializes
1744 * every CPU that had context domain before migration to have one again.
1745 * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1746 * could deadlock acquiring locks held by paused CPUs.
1747 *
1748 * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1749 * acquire new context ids and continue execution.
1750 *
1751 * Therefore functions should be called in the following order:
1752 * suspend_routine()
1753 * sfmmu_ctxdom_lock()
1754 * pause_cpus()
1755 * suspend()
1756 * if (suspend failed)
1757 * sfmmu_ctxdom_unlock()
1758 * ...
1759 * sfmmu_ctxdom_remove()
1760 * resume_cpus()
1761 * sfmmu_ctxdom_update()
1762 * sfmmu_ctxdom_unlock()
1763 */
1764 static cpuset_t sfmmu_ctxdoms_pset;
1765
1766 void
1767 sfmmu_ctxdoms_remove()
1768 {
1769 processorid_t id;
1770 cpu_t *cp;
1771
1772 /*
1773 * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1774 * be restored post-migration. A CPU may be powered off and not have a
1775 * domain, for example.
1776 */
1777 CPUSET_ZERO(sfmmu_ctxdoms_pset);
1778
1779 for (id = 0; id < NCPU; id++) {
1780 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1781 CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1782 CPU_MMU_CTXP(cp) = NULL;
1783 }
1784 }
1785 }
1786
1787 void
1788 sfmmu_ctxdoms_lock(void)
1789 {
1790 int idx;
1791 mmu_ctx_t *mmu_ctxp;
1792
1793 sfmmu_hat_lock_all();
1794
1795 /*
1796 * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1797 * hat_lock is always taken before calling it.
1798 *
1799 * For each domain, set mmu_cnum to max so no more contexts can be
1800 * allocated, and wrap to flush on-CPU contexts and force threads to
1801 * acquire a new context when we later drop hat_lock after migration.
1802 * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1803 * but the latter uses CAS and will miscompare and not overwrite it.
1804 */
1805 kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1806 for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1807 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1808 mutex_enter(&mmu_ctxp->mmu_lock);
1809 mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1810 /* make sure updated cnum visible */
1811 membar_enter();
1812 mutex_exit(&mmu_ctxp->mmu_lock);
1813 sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1814 }
1815 }
1816 kpreempt_enable();
1817 }
1818
1819 void
1820 sfmmu_ctxdoms_unlock(void)
1821 {
1822 sfmmu_hat_unlock_all();
1823 }
1824
1825 void
1826 sfmmu_ctxdoms_update(void)
1827 {
1828 processorid_t id;
1829 cpu_t *cp;
1830 uint_t idx;
1831 mmu_ctx_t *mmu_ctxp;
1832
1833 /*
1834 * Free all context domains. As side effect, this increases
1835 * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1836 * init gnum in the new domains, which therefore will be larger than the
1837 * sfmmu gnum for any process, guaranteeing that every process will see
1838 * a new generation and allocate a new context regardless of what new
1839 * domain it runs in.
1840 */
1841 mutex_enter(&cpu_lock);
1842
1843 for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1844 if (mmu_ctxs_tbl[idx] != NULL) {
1845 mmu_ctxp = mmu_ctxs_tbl[idx];
1846 mmu_ctxs_tbl[idx] = NULL;
1847 sfmmu_ctxdom_free(mmu_ctxp);
1848 }
1849 }
1850
1851 for (id = 0; id < NCPU; id++) {
1852 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1853 (cp = cpu[id]) != NULL)
1854 sfmmu_cpu_init(cp);
1855 }
1856 mutex_exit(&cpu_lock);
1857 }
1858 #endif
1859
1860 /*
1861 * Hat_setup, makes an address space context the current active one.
1862 * In sfmmu this translates to setting the secondary context with the
1863 * corresponding context.
1864 */
1865 void
1866 hat_setup(struct hat *sfmmup, int allocflag)
1867 {
1868 hatlock_t *hatlockp;
1869
1870 /* Init needs some special treatment. */
1871 if (allocflag == HAT_INIT) {
1872 /*
1873 * Make sure that we have
1874 * 1. a TSB
1875 * 2. a valid ctx that doesn't get stolen after this point.
1876 */
1877 hatlockp = sfmmu_hat_enter(sfmmup);
1878
1879 /*
1880 * Swap in the TSB. hat_init() allocates tsbinfos without
1881 * TSBs, but we need one for init, since the kernel does some
1882 * special things to set up its stack and needs the TSB to
1883 * resolve page faults.
1884 */
1885 sfmmu_tsb_swapin(sfmmup, hatlockp);
1886
1887 sfmmu_get_ctx(sfmmup);
1888
1889 sfmmu_hat_exit(hatlockp);
1890 } else {
1891 ASSERT(allocflag == HAT_ALLOC);
1892
1893 hatlockp = sfmmu_hat_enter(sfmmup);
1894 kpreempt_disable();
1895
1896 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1897 /*
1898 * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1899 * pagesize bits don't matter in this case since we are passing
1900 * INVALID_CONTEXT to it.
1901 * Compatibility Note: hw takes care of MMU_SCONTEXT1
1902 */
1903 sfmmu_setctx_sec(INVALID_CONTEXT);
1904 sfmmu_clear_utsbinfo();
1905
1906 kpreempt_enable();
1907 sfmmu_hat_exit(hatlockp);
1908 }
1909 }
1910
1911 /*
1912 * Free all the translation resources for the specified address space.
1913 * Called from as_free when an address space is being destroyed.
1914 */
1915 void
1916 hat_free_start(struct hat *sfmmup)
1917 {
1918 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1919 ASSERT(sfmmup != ksfmmup);
1920
1921 sfmmup->sfmmu_free = 1;
1922 if (sfmmup->sfmmu_scdp != NULL) {
1923 sfmmu_leave_scd(sfmmup, 0);
1924 }
1925
1926 ASSERT(sfmmup->sfmmu_scdp == NULL);
1927 }
1928
1929 void
1930 hat_free_end(struct hat *sfmmup)
1931 {
1932 int i;
1933
1934 ASSERT(sfmmup->sfmmu_free == 1);
1935 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1936 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1937 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1938 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1939 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1940 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1941
1942 if (sfmmup->sfmmu_rmstat) {
1943 hat_freestat(sfmmup->sfmmu_as, NULL);
1944 }
1945
1946 while (sfmmup->sfmmu_tsb != NULL) {
1947 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1948 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1949 sfmmup->sfmmu_tsb = next;
1950 }
1951
1952 if (sfmmup->sfmmu_srdp != NULL) {
1953 sfmmu_leave_srd(sfmmup);
1954 ASSERT(sfmmup->sfmmu_srdp == NULL);
1955 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1956 if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1957 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1958 SFMMU_L2_HMERLINKS_SIZE);
1959 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1960 }
1961 }
1962 }
1963 sfmmu_free_sfmmu(sfmmup);
1964
1965 #ifdef DEBUG
1966 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1967 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1968 }
1969 #endif
1970
1971 kmem_cache_free(sfmmuid_cache, sfmmup);
1972 }
1973
1974 /*
1975 * Set up any translation structures, for the specified address space,
1976 * that are needed or preferred when the process is being swapped in.
1977 */
1978 /* ARGSUSED */
1979 void
1980 hat_swapin(struct hat *hat)
1981 {
1982 }
1983
1984 /*
1985 * Free all of the translation resources, for the specified address space,
1986 * that can be freed while the process is swapped out. Called from as_swapout.
1987 * Also, free up the ctx that this process was using.
1988 */
1989 void
1990 hat_swapout(struct hat *sfmmup)
1991 {
1992 struct hmehash_bucket *hmebp;
1993 struct hme_blk *hmeblkp;
1994 struct hme_blk *pr_hblk = NULL;
1995 struct hme_blk *nx_hblk;
1996 int i;
1997 struct hme_blk *list = NULL;
1998 hatlock_t *hatlockp;
1999 struct tsb_info *tsbinfop;
2000 struct free_tsb {
2001 struct free_tsb *next;
2002 struct tsb_info *tsbinfop;
2003 }; /* free list of TSBs */
2004 struct free_tsb *freelist, *last, *next;
2005
2006 SFMMU_STAT(sf_swapout);
2007
2008 /*
2009 * There is no way to go from an as to all its translations in sfmmu.
2010 * Here is one of the times when we take the big hit and traverse
2011 * the hash looking for hme_blks to free up. Not only do we free up
2012 * this as hme_blks but all those that are free. We are obviously
2013 * swapping because we need memory so let's free up as much
2014 * as we can.
2015 *
2016 * Note that we don't flush TLB/TSB here -- it's not necessary
2017 * because:
2018 * 1) we free the ctx we're using and throw away the TSB(s);
2019 * 2) processes aren't runnable while being swapped out.
2020 */
2021 ASSERT(sfmmup != KHATID);
2022 for (i = 0; i <= UHMEHASH_SZ; i++) {
2023 hmebp = &uhme_hash[i];
2024 SFMMU_HASH_LOCK(hmebp);
2025 hmeblkp = hmebp->hmeblkp;
2026 pr_hblk = NULL;
2027 while (hmeblkp) {
2028
2029 if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2030 !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2031 ASSERT(!hmeblkp->hblk_shared);
2032 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2033 (caddr_t)get_hblk_base(hmeblkp),
2034 get_hblk_endaddr(hmeblkp),
2035 NULL, HAT_UNLOAD);
2036 }
2037 nx_hblk = hmeblkp->hblk_next;
2038 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2039 ASSERT(!hmeblkp->hblk_lckcnt);
2040 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2041 &list, 0);
2042 } else {
2043 pr_hblk = hmeblkp;
2044 }
2045 hmeblkp = nx_hblk;
2046 }
2047 SFMMU_HASH_UNLOCK(hmebp);
2048 }
2049
2050 sfmmu_hblks_list_purge(&list, 0);
2051
2052 /*
2053 * Now free up the ctx so that others can reuse it.
2054 */
2055 hatlockp = sfmmu_hat_enter(sfmmup);
2056
2057 sfmmu_invalidate_ctx(sfmmup);
2058
2059 /*
2060 * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2061 * If TSBs were never swapped in, just return.
2062 * This implies that we don't support partial swapping
2063 * of TSBs -- either all are swapped out, or none are.
2064 *
2065 * We must hold the HAT lock here to prevent racing with another
2066 * thread trying to unmap TTEs from the TSB or running the post-
2067 * relocator after relocating the TSB's memory. Unfortunately, we
2068 * can't free memory while holding the HAT lock or we could
2069 * deadlock, so we build a list of TSBs to be freed after marking
2070 * the tsbinfos as swapped out and free them after dropping the
2071 * lock.
2072 */
2073 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2074 sfmmu_hat_exit(hatlockp);
2075 return;
2076 }
2077
2078 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2079 last = freelist = NULL;
2080 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2081 tsbinfop = tsbinfop->tsb_next) {
2082 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2083
2084 /*
2085 * Cast the TSB into a struct free_tsb and put it on the free
2086 * list.
2087 */
2088 if (freelist == NULL) {
2089 last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2090 } else {
2091 last->next = (struct free_tsb *)tsbinfop->tsb_va;
2092 last = last->next;
2093 }
2094 last->next = NULL;
2095 last->tsbinfop = tsbinfop;
2096 tsbinfop->tsb_flags |= TSB_SWAPPED;
2097 /*
2098 * Zero out the TTE to clear the valid bit.
2099 * Note we can't use a value like 0xbad because we want to
2100 * ensure diagnostic bits are NEVER set on TTEs that might
2101 * be loaded. The intent is to catch any invalid access
2102 * to the swapped TSB, such as a thread running with a valid
2103 * context without first calling sfmmu_tsb_swapin() to
2104 * allocate TSB memory.
2105 */
2106 tsbinfop->tsb_tte.ll = 0;
2107 }
2108
2109 /* Now we can drop the lock and free the TSB memory. */
2110 sfmmu_hat_exit(hatlockp);
2111 for (; freelist != NULL; freelist = next) {
2112 next = freelist->next;
2113 sfmmu_tsb_free(freelist->tsbinfop);
2114 }
2115 }
2116
2117 /*
2118 * Duplicate the translations of an as into another newas
2119 */
2120 /* ARGSUSED */
2121 int
2122 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2123 uint_t flag)
2124 {
2125 sf_srd_t *srdp;
2126 sf_scd_t *scdp;
2127 int i;
2128 extern uint_t get_color_start(struct as *);
2129
2130 ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2131 (flag == HAT_DUP_SRD));
2132 ASSERT(hat != ksfmmup);
2133 ASSERT(newhat != ksfmmup);
2134 ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2135
2136 if (flag == HAT_DUP_COW) {
2137 panic("hat_dup: HAT_DUP_COW not supported");
2138 }
2139
2140 if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2141 ASSERT(srdp->srd_evp != NULL);
2142 VN_HOLD(srdp->srd_evp);
2143 ASSERT(srdp->srd_refcnt > 0);
2144 newhat->sfmmu_srdp = srdp;
2145 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2146 }
2147
2148 /*
2149 * HAT_DUP_ALL flag is used after as duplication is done.
2150 */
2151 if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2152 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2153 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2154 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2155 newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2156 }
2157
2158 /* check if need to join scd */
2159 if ((scdp = hat->sfmmu_scdp) != NULL &&
2160 newhat->sfmmu_scdp != scdp) {
2161 int ret;
2162 SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2163 &scdp->scd_region_map, ret);
2164 ASSERT(ret);
2165 sfmmu_join_scd(scdp, newhat);
2166 ASSERT(newhat->sfmmu_scdp == scdp &&
2167 scdp->scd_refcnt >= 2);
2168 for (i = 0; i < max_mmu_page_sizes; i++) {
2169 newhat->sfmmu_ismttecnt[i] =
2170 hat->sfmmu_ismttecnt[i];
2171 newhat->sfmmu_scdismttecnt[i] =
2172 hat->sfmmu_scdismttecnt[i];
2173 }
2174 }
2175
2176 sfmmu_check_page_sizes(newhat, 1);
2177 }
2178
2179 if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2180 update_proc_pgcolorbase_after_fork != 0) {
2181 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2182 }
2183 return (0);
2184 }
2185
2186 void
2187 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2188 uint_t attr, uint_t flags)
2189 {
2190 hat_do_memload(hat, addr, pp, attr, flags,
2191 SFMMU_INVALID_SHMERID);
2192 }
2193
2194 void
2195 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2196 uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2197 {
2198 uint_t rid;
2199 if (rcookie == HAT_INVALID_REGION_COOKIE) {
2200 hat_do_memload(hat, addr, pp, attr, flags,
2201 SFMMU_INVALID_SHMERID);
2202 return;
2203 }
2204 rid = (uint_t)((uint64_t)rcookie);
2205 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2206 hat_do_memload(hat, addr, pp, attr, flags, rid);
2207 }
2208
2209 /*
2210 * Set up addr to map to page pp with protection prot.
2211 * As an optimization we also load the TSB with the
2212 * corresponding tte but it is no big deal if the tte gets kicked out.
2213 */
2214 static void
2215 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2216 uint_t attr, uint_t flags, uint_t rid)
2217 {
2218 tte_t tte;
2219
2220
2221 ASSERT(hat != NULL);
2222 ASSERT(PAGE_LOCKED(pp));
2223 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2224 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2225 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2226 SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2227
2228 if (PP_ISFREE(pp)) {
2229 panic("hat_memload: loading a mapping to free page %p",
2230 (void *)pp);
2231 }
2232
2233 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2234
2235 if (flags & ~SFMMU_LOAD_ALLFLAG)
2236 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2237 flags & ~SFMMU_LOAD_ALLFLAG);
2238
2239 if (hat->sfmmu_rmstat)
2240 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2241
2242 #if defined(SF_ERRATA_57)
2243 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2244 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2245 !(flags & HAT_LOAD_SHARE)) {
2246 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2247 " page executable");
2248 attr &= ~PROT_EXEC;
2249 }
2250 #endif
2251
2252 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2253 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2254
2255 /*
2256 * Check TSB and TLB page sizes.
2257 */
2258 if ((flags & HAT_LOAD_SHARE) == 0) {
2259 sfmmu_check_page_sizes(hat, 1);
2260 }
2261 }
2262
2263 /*
2264 * hat_devload can be called to map real memory (e.g.
2265 * /dev/kmem) and even though hat_devload will determine pf is
2266 * for memory, it will be unable to get a shared lock on the
2267 * page (because someone else has it exclusively) and will
2268 * pass dp = NULL. If tteload doesn't get a non-NULL
2269 * page pointer it can't cache memory.
2270 */
2271 void
2272 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2273 uint_t attr, int flags)
2274 {
2275 tte_t tte;
2276 struct page *pp = NULL;
2277 int use_lgpg = 0;
2278
2279 ASSERT(hat != NULL);
2280
2281 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2282 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2283 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2284 if (len == 0)
2285 panic("hat_devload: zero len");
2286 if (flags & ~SFMMU_LOAD_ALLFLAG)
2287 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2288 flags & ~SFMMU_LOAD_ALLFLAG);
2289
2290 #if defined(SF_ERRATA_57)
2291 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2292 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2293 !(flags & HAT_LOAD_SHARE)) {
2294 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2295 " page executable");
2296 attr &= ~PROT_EXEC;
2297 }
2298 #endif
2299
2300 /*
2301 * If it's a memory page find its pp
2302 */
2303 if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2304 pp = page_numtopp_nolock(pfn);
2305 if (pp == NULL) {
2306 flags |= HAT_LOAD_NOCONSIST;
2307 } else {
2308 if (PP_ISFREE(pp)) {
2309 panic("hat_memload: loading "
2310 "a mapping to free page %p",
2311 (void *)pp);
2312 }
2313 if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2314 panic("hat_memload: loading a mapping "
2315 "to unlocked relocatable page %p",
2316 (void *)pp);
2317 }
2318 ASSERT(len == MMU_PAGESIZE);
2319 }
2320 }
2321
2322 if (hat->sfmmu_rmstat)
2323 hat_resvstat(len, hat->sfmmu_as, addr);
2324
2325 if (flags & HAT_LOAD_NOCONSIST) {
2326 attr |= SFMMU_UNCACHEVTTE;
2327 use_lgpg = 1;
2328 }
2329 if (!pf_is_memory(pfn)) {
2330 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2331 use_lgpg = 1;
2332 switch (attr & HAT_ORDER_MASK) {
2333 case HAT_STRICTORDER:
2334 case HAT_UNORDERED_OK:
2335 /*
2336 * we set the side effect bit for all non
2337 * memory mappings unless merging is ok
2338 */
2339 attr |= SFMMU_SIDEFFECT;
2340 break;
2341 case HAT_MERGING_OK:
2342 case HAT_LOADCACHING_OK:
2343 case HAT_STORECACHING_OK:
2344 break;
2345 default:
2346 panic("hat_devload: bad attr");
2347 break;
2348 }
2349 }
2350 while (len) {
2351 if (!use_lgpg) {
2352 sfmmu_memtte(&tte, pfn, attr, TTE8K);
2353 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2354 flags, SFMMU_INVALID_SHMERID);
2355 len -= MMU_PAGESIZE;
2356 addr += MMU_PAGESIZE;
2357 pfn++;
2358 continue;
2359 }
2360 /*
2361 * try to use large pages, check va/pa alignments
2362 * Note that 32M/256M page sizes are not (yet) supported.
2363 */
2364 if ((len >= MMU_PAGESIZE4M) &&
2365 !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2366 !(disable_large_pages & (1 << TTE4M)) &&
2367 !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2368 sfmmu_memtte(&tte, pfn, attr, TTE4M);
2369 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2370 flags, SFMMU_INVALID_SHMERID);
2371 len -= MMU_PAGESIZE4M;
2372 addr += MMU_PAGESIZE4M;
2373 pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2374 } else if ((len >= MMU_PAGESIZE512K) &&
2375 !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2376 !(disable_large_pages & (1 << TTE512K)) &&
2377 !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2378 sfmmu_memtte(&tte, pfn, attr, TTE512K);
2379 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2380 flags, SFMMU_INVALID_SHMERID);
2381 len -= MMU_PAGESIZE512K;
2382 addr += MMU_PAGESIZE512K;
2383 pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2384 } else if ((len >= MMU_PAGESIZE64K) &&
2385 !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2386 !(disable_large_pages & (1 << TTE64K)) &&
2387 !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2388 sfmmu_memtte(&tte, pfn, attr, TTE64K);
2389 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2390 flags, SFMMU_INVALID_SHMERID);
2391 len -= MMU_PAGESIZE64K;
2392 addr += MMU_PAGESIZE64K;
2393 pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2394 } else {
2395 sfmmu_memtte(&tte, pfn, attr, TTE8K);
2396 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2397 flags, SFMMU_INVALID_SHMERID);
2398 len -= MMU_PAGESIZE;
2399 addr += MMU_PAGESIZE;
2400 pfn++;
2401 }
2402 }
2403
2404 /*
2405 * Check TSB and TLB page sizes.
2406 */
2407 if ((flags & HAT_LOAD_SHARE) == 0) {
2408 sfmmu_check_page_sizes(hat, 1);
2409 }
2410 }
2411
2412 void
2413 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2414 struct page **pps, uint_t attr, uint_t flags)
2415 {
2416 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2417 SFMMU_INVALID_SHMERID);
2418 }
2419
2420 void
2421 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2422 struct page **pps, uint_t attr, uint_t flags,
2423 hat_region_cookie_t rcookie)
2424 {
2425 uint_t rid;
2426 if (rcookie == HAT_INVALID_REGION_COOKIE) {
2427 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2428 SFMMU_INVALID_SHMERID);
2429 return;
2430 }
2431 rid = (uint_t)((uint64_t)rcookie);
2432 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2433 hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2434 }
2435
2436 /*
2437 * Map the largest extend possible out of the page array. The array may NOT
2438 * be in order. The largest possible mapping a page can have
2439 * is specified in the p_szc field. The p_szc field
2440 * cannot change as long as there any mappings (large or small)
2441 * to any of the pages that make up the large page. (ie. any
2442 * promotion/demotion of page size is not up to the hat but up to
2443 * the page free list manager). The array
2444 * should consist of properly aligned contigous pages that are
2445 * part of a big page for a large mapping to be created.
2446 */
2447 static void
2448 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2449 struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2450 {
2451 int ttesz;
2452 size_t mapsz;
2453 pgcnt_t numpg, npgs;
2454 tte_t tte;
2455 page_t *pp;
2456 uint_t large_pages_disable;
2457
2458 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2459 SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2460
2461 if (hat->sfmmu_rmstat)
2462 hat_resvstat(len, hat->sfmmu_as, addr);
2463
2464 #if defined(SF_ERRATA_57)
2465 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2466 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2467 !(flags & HAT_LOAD_SHARE)) {
2468 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2469 "user page executable");
2470 attr &= ~PROT_EXEC;
2471 }
2472 #endif
2473
2474 /* Get number of pages */
2475 npgs = len >> MMU_PAGESHIFT;
2476
2477 if (flags & HAT_LOAD_SHARE) {
2478 large_pages_disable = disable_ism_large_pages;
2479 } else {
2480 large_pages_disable = disable_large_pages;
2481 }
2482
2483 if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2484 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2485 rid);
2486 return;
2487 }
2488
2489 while (npgs >= NHMENTS) {
2490 pp = *pps;
2491 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2492 /*
2493 * Check if this page size is disabled.
2494 */
2495 if (large_pages_disable & (1 << ttesz))
2496 continue;
2497
2498 numpg = TTEPAGES(ttesz);
2499 mapsz = numpg << MMU_PAGESHIFT;
2500 if ((npgs >= numpg) &&
2501 IS_P2ALIGNED(addr, mapsz) &&
2502 IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2503 /*
2504 * At this point we have enough pages and
2505 * we know the virtual address and the pfn
2506 * are properly aligned. We still need
2507 * to check for physical contiguity but since
2508 * it is very likely that this is the case
2509 * we will assume they are so and undo
2510 * the request if necessary. It would
2511 * be great if we could get a hint flag
2512 * like HAT_CONTIG which would tell us
2513 * the pages are contigous for sure.
2514 */
2515 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2516 attr, ttesz);
2517 if (!sfmmu_tteload_array(hat, &tte, addr,
2518 pps, flags, rid)) {
2519 break;
2520 }
2521 }
2522 }
2523 if (ttesz == TTE8K) {
2524 /*
2525 * We were not able to map array using a large page
2526 * batch a hmeblk or fraction at a time.
2527 */
2528 numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2529 & (NHMENTS-1);
2530 numpg = NHMENTS - numpg;
2531 ASSERT(numpg <= npgs);
2532 mapsz = numpg * MMU_PAGESIZE;
2533 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2534 numpg, rid);
2535 }
2536 addr += mapsz;
2537 npgs -= numpg;
2538 pps += numpg;
2539 }
2540
2541 if (npgs) {
2542 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2543 rid);
2544 }
2545
2546 /*
2547 * Check TSB and TLB page sizes.
2548 */
2549 if ((flags & HAT_LOAD_SHARE) == 0) {
2550 sfmmu_check_page_sizes(hat, 1);
2551 }
2552 }
2553
2554 /*
2555 * Function tries to batch 8K pages into the same hme blk.
2556 */
2557 static void
2558 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2559 uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2560 {
2561 tte_t tte;
2562 page_t *pp;
2563 struct hmehash_bucket *hmebp;
2564 struct hme_blk *hmeblkp;
2565 int index;
2566
2567 while (npgs) {
2568 /*
2569 * Acquire the hash bucket.
2570 */
2571 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2572 rid);
2573 ASSERT(hmebp);
2574
2575 /*
2576 * Find the hment block.
2577 */
2578 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2579 TTE8K, flags, rid);
2580 ASSERT(hmeblkp);
2581
2582 do {
2583 /*
2584 * Make the tte.
2585 */
2586 pp = *pps;
2587 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2588
2589 /*
2590 * Add the translation.
2591 */
2592 (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2593 vaddr, pps, flags, rid);
2594
2595 /*
2596 * Goto next page.
2597 */
2598 pps++;
2599 npgs--;
2600
2601 /*
2602 * Goto next address.
2603 */
2604 vaddr += MMU_PAGESIZE;
2605
2606 /*
2607 * Don't crossover into a different hmentblk.
2608 */
2609 index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2610 (NHMENTS-1));
2611
2612 } while (index != 0 && npgs != 0);
2613
2614 /*
2615 * Release the hash bucket.
2616 */
2617
2618 sfmmu_tteload_release_hashbucket(hmebp);
2619 }
2620 }
2621
2622 /*
2623 * Construct a tte for a page:
2624 *
2625 * tte_valid = 1
2626 * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2627 * tte_size = size
2628 * tte_nfo = attr & HAT_NOFAULT
2629 * tte_ie = attr & HAT_STRUCTURE_LE
2630 * tte_hmenum = hmenum
2631 * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2632 * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2633 * tte_ref = 1 (optimization)
2634 * tte_wr_perm = attr & PROT_WRITE;
2635 * tte_no_sync = attr & HAT_NOSYNC
2636 * tte_lock = attr & SFMMU_LOCKTTE
2637 * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2638 * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2639 * tte_e = attr & SFMMU_SIDEFFECT
2640 * tte_priv = !(attr & PROT_USER)
2641 * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2642 * tte_glb = 0
2643 */
2644 void
2645 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2646 {
2647 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2648
2649 ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2650 ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2651
2652 if (TTE_IS_NOSYNC(ttep)) {
2653 TTE_SET_REF(ttep);
2654 if (TTE_IS_WRITABLE(ttep)) {
2655 TTE_SET_MOD(ttep);
2656 }
2657 }
2658 if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2659 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2660 }
2661 }
2662
2663 /*
2664 * This function will add a translation to the hme_blk and allocate the
2665 * hme_blk if one does not exist.
2666 * If a page structure is specified then it will add the
2667 * corresponding hment to the mapping list.
2668 * It will also update the hmenum field for the tte.
2669 *
2670 * Currently this function is only used for kernel mappings.
2671 * So pass invalid region to sfmmu_tteload_array().
2672 */
2673 void
2674 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2675 uint_t flags)
2676 {
2677 ASSERT(sfmmup == ksfmmup);
2678 (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2679 SFMMU_INVALID_SHMERID);
2680 }
2681
2682 /*
2683 * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2684 * Assumes that a particular page size may only be resident in one TSB.
2685 */
2686 static void
2687 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2688 {
2689 struct tsb_info *tsbinfop = NULL;
2690 uint64_t tag;
2691 struct tsbe *tsbe_addr;
2692 uint64_t tsb_base;
2693 uint_t tsb_size;
2694 int vpshift = MMU_PAGESHIFT;
2695 int phys = 0;
2696
2697 if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2698 phys = ktsb_phys;
2699 if (ttesz >= TTE4M) {
2700 #ifndef sun4v
2701 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2702 #endif
2703 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2704 tsb_size = ktsb4m_szcode;
2705 } else {
2706 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2707 tsb_size = ktsb_szcode;
2708 }
2709 } else {
2710 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2711
2712 /*
2713 * If there isn't a TSB for this page size, or the TSB is
2714 * swapped out, there is nothing to do. Note that the latter
2715 * case seems impossible but can occur if hat_pageunload()
2716 * is called on an ISM mapping while the process is swapped
2717 * out.
2718 */
2719 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2720 return;
2721
2722 /*
2723 * If another thread is in the middle of relocating a TSB
2724 * we can't unload the entry so set a flag so that the
2725 * TSB will be flushed before it can be accessed by the
2726 * process.
2727 */
2728 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2729 if (ttep == NULL)
2730 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2731 return;
2732 }
2733 #if defined(UTSB_PHYS)
2734 phys = 1;
2735 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2736 #else
2737 tsb_base = (uint64_t)tsbinfop->tsb_va;
2738 #endif
2739 tsb_size = tsbinfop->tsb_szc;
2740 }
2741 if (ttesz >= TTE4M)
2742 vpshift = MMU_PAGESHIFT4M;
2743
2744 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2745 tag = sfmmu_make_tsbtag(vaddr);
2746
2747 if (ttep == NULL) {
2748 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2749 } else {
2750 if (ttesz >= TTE4M) {
2751 SFMMU_STAT(sf_tsb_load4m);
2752 } else {
2753 SFMMU_STAT(sf_tsb_load8k);
2754 }
2755
2756 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2757 }
2758 }
2759
2760 /*
2761 * Unmap all entries from [start, end) matching the given page size.
2762 *
2763 * This function is used primarily to unmap replicated 64K or 512K entries
2764 * from the TSB that are inserted using the base page size TSB pointer, but
2765 * it may also be called to unmap a range of addresses from the TSB.
2766 */
2767 void
2768 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2769 {
2770 struct tsb_info *tsbinfop;
2771 uint64_t tag;
2772 struct tsbe *tsbe_addr;
2773 caddr_t vaddr;
2774 uint64_t tsb_base;
2775 int vpshift, vpgsz;
2776 uint_t tsb_size;
2777 int phys = 0;
2778
2779 /*
2780 * Assumptions:
2781 * If ttesz == 8K, 64K or 512K, we walk through the range 8K
2782 * at a time shooting down any valid entries we encounter.
2783 *
2784 * If ttesz >= 4M we walk the range 4M at a time shooting
2785 * down any valid mappings we find.
2786 */
2787 if (sfmmup == ksfmmup) {
2788 phys = ktsb_phys;
2789 if (ttesz >= TTE4M) {
2790 #ifndef sun4v
2791 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2792 #endif
2793 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2794 tsb_size = ktsb4m_szcode;
2795 } else {
2796 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2797 tsb_size = ktsb_szcode;
2798 }
2799 } else {
2800 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2801
2802 /*
2803 * If there isn't a TSB for this page size, or the TSB is
2804 * swapped out, there is nothing to do. Note that the latter
2805 * case seems impossible but can occur if hat_pageunload()
2806 * is called on an ISM mapping while the process is swapped
2807 * out.
2808 */
2809 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2810 return;
2811
2812 /*
2813 * If another thread is in the middle of relocating a TSB
2814 * we can't unload the entry so set a flag so that the
2815 * TSB will be flushed before it can be accessed by the
2816 * process.
2817 */
2818 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2819 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2820 return;
2821 }
2822 #if defined(UTSB_PHYS)
2823 phys = 1;
2824 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2825 #else
2826 tsb_base = (uint64_t)tsbinfop->tsb_va;
2827 #endif
2828 tsb_size = tsbinfop->tsb_szc;
2829 }
2830 if (ttesz >= TTE4M) {
2831 vpshift = MMU_PAGESHIFT4M;
2832 vpgsz = MMU_PAGESIZE4M;
2833 } else {
2834 vpshift = MMU_PAGESHIFT;
2835 vpgsz = MMU_PAGESIZE;
2836 }
2837
2838 for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2839 tag = sfmmu_make_tsbtag(vaddr);
2840 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2841 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2842 }
2843 }
2844
2845 /*
2846 * Select the optimum TSB size given the number of mappings
2847 * that need to be cached.
2848 */
2849 static int
2850 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2851 {
2852 int szc = 0;
2853
2854 #ifdef DEBUG
2855 if (tsb_grow_stress) {
2856 uint32_t randval = (uint32_t)gettick() >> 4;
2857 return (randval % (tsb_max_growsize + 1));
2858 }
2859 #endif /* DEBUG */
2860
2861 while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2862 szc++;
2863 return (szc);
2864 }
2865
2866 /*
2867 * This function will add a translation to the hme_blk and allocate the
2868 * hme_blk if one does not exist.
2869 * If a page structure is specified then it will add the
2870 * corresponding hment to the mapping list.
2871 * It will also update the hmenum field for the tte.
2872 * Furthermore, it attempts to create a large page translation
2873 * for <addr,hat> at page array pps. It assumes addr and first
2874 * pp is correctly aligned. It returns 0 if successful and 1 otherwise.
2875 */
2876 static int
2877 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2878 page_t **pps, uint_t flags, uint_t rid)
2879 {
2880 struct hmehash_bucket *hmebp;
2881 struct hme_blk *hmeblkp;
2882 int ret;
2883 uint_t size;
2884
2885 /*
2886 * Get mapping size.
2887 */
2888 size = TTE_CSZ(ttep);
2889 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2890
2891 /*
2892 * Acquire the hash bucket.
2893 */
2894 hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2895 ASSERT(hmebp);
2896
2897 /*
2898 * Find the hment block.
2899 */
2900 hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2901 rid);
2902 ASSERT(hmeblkp);
2903
2904 /*
2905 * Add the translation.
2906 */
2907 ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2908 rid);
2909
2910 /*
2911 * Release the hash bucket.
2912 */
2913 sfmmu_tteload_release_hashbucket(hmebp);
2914
2915 return (ret);
2916 }
2917
2918 /*
2919 * Function locks and returns a pointer to the hash bucket for vaddr and size.
2920 */
2921 static struct hmehash_bucket *
2922 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2923 uint_t rid)
2924 {
2925 struct hmehash_bucket *hmebp;
2926 int hmeshift;
2927 void *htagid = sfmmutohtagid(sfmmup, rid);
2928
2929 ASSERT(htagid != NULL);
2930
2931 hmeshift = HME_HASH_SHIFT(size);
2932
2933 hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2934
2935 SFMMU_HASH_LOCK(hmebp);
2936
2937 return (hmebp);
2938 }
2939
2940 /*
2941 * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2942 * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2943 * allocated.
2944 */
2945 static struct hme_blk *
2946 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2947 caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2948 {
2949 hmeblk_tag hblktag;
2950 int hmeshift;
2951 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2952
2953 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2954
2955 hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2956 ASSERT(hblktag.htag_id != NULL);
2957 hmeshift = HME_HASH_SHIFT(size);
2958 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2959 hblktag.htag_rehash = HME_HASH_REHASH(size);
2960 hblktag.htag_rid = rid;
2961
2962 ttearray_realloc:
2963
2964 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2965
2966 /*
2967 * We block until hblk_reserve_lock is released; it's held by
2968 * the thread, temporarily using hblk_reserve, until hblk_reserve is
2969 * replaced by a hblk from sfmmu8_cache.
2970 */
2971 if (hmeblkp == (struct hme_blk *)hblk_reserve &&
2972 hblk_reserve_thread != curthread) {
2973 SFMMU_HASH_UNLOCK(hmebp);
2974 mutex_enter(&hblk_reserve_lock);
2975 mutex_exit(&hblk_reserve_lock);
2976 SFMMU_STAT(sf_hblk_reserve_hit);
2977 SFMMU_HASH_LOCK(hmebp);
2978 goto ttearray_realloc;
2979 }
2980
2981 if (hmeblkp == NULL) {
2982 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
2983 hblktag, flags, rid);
2984 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2985 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2986 } else {
2987 /*
2988 * It is possible for 8k and 64k hblks to collide since they
2989 * have the same rehash value. This is because we
2990 * lazily free hblks and 8K/64K blks could be lingering.
2991 * If we find size mismatch we free the block and & try again.
2992 */
2993 if (get_hblk_ttesz(hmeblkp) != size) {
2994 ASSERT(!hmeblkp->hblk_vcnt);
2995 ASSERT(!hmeblkp->hblk_hmecnt);
2996 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2997 &list, 0);
2998 goto ttearray_realloc;
2999 }
3000 if (hmeblkp->hblk_shw_bit) {
3001 /*
3002 * if the hblk was previously used as a shadow hblk then
3003 * we will change it to a normal hblk
3004 */
3005 ASSERT(!hmeblkp->hblk_shared);
3006 if (hmeblkp->hblk_shw_mask) {
3007 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3008 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3009 goto ttearray_realloc;
3010 } else {
3011 hmeblkp->hblk_shw_bit = 0;
3012 }
3013 }
3014 SFMMU_STAT(sf_hblk_hit);
3015 }
3016
3017 /*
3018 * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3019 * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3020 * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3021 * just add these hmeblks to the per-cpu pending queue.
3022 */
3023 sfmmu_hblks_list_purge(&list, 1);
3024
3025 ASSERT(get_hblk_ttesz(hmeblkp) == size);
3026 ASSERT(!hmeblkp->hblk_shw_bit);
3027 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3028 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3029 ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3030
3031 return (hmeblkp);
3032 }
3033
3034 /*
3035 * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3036 * otherwise.
3037 */
3038 static int
3039 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3040 caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3041 {
3042 page_t *pp = *pps;
3043 int hmenum, size, remap;
3044 tte_t tteold, flush_tte;
3045 #ifdef DEBUG
3046 tte_t orig_old;
3047 #endif /* DEBUG */
3048 struct sf_hment *sfhme;
3049 kmutex_t *pml, *pmtx;
3050 hatlock_t *hatlockp;
3051 int myflt;
3052
3053 /*
3054 * remove this panic when we decide to let user virtual address
3055 * space be >= USERLIMIT.
3056 */
3057 if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3058 panic("user addr %p in kernel space", (void *)vaddr);
3059 #if defined(TTE_IS_GLOBAL)
3060 if (TTE_IS_GLOBAL(ttep))
3061 panic("sfmmu_tteload: creating global tte");
3062 #endif
3063
3064 #ifdef DEBUG
3065 if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3066 !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3067 panic("sfmmu_tteload: non cacheable memory tte");
3068 #endif /* DEBUG */
3069
3070 /* don't simulate dirty bit for writeable ISM/DISM mappings */
3071 if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3072 TTE_SET_REF(ttep);
3073 TTE_SET_MOD(ttep);
3074 }
3075
3076 if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3077 !TTE_IS_MOD(ttep)) {
3078 /*
3079 * Don't load TSB for dummy as in ISM. Also don't preload
3080 * the TSB if the TTE isn't writable since we're likely to
3081 * fault on it again -- preloading can be fairly expensive.
3082 */
3083 flags |= SFMMU_NO_TSBLOAD;
3084 }
3085
3086 size = TTE_CSZ(ttep);
3087 switch (size) {
3088 case TTE8K:
3089 SFMMU_STAT(sf_tteload8k);
3090 break;
3091 case TTE64K:
3092 SFMMU_STAT(sf_tteload64k);
3093 break;
3094 case TTE512K:
3095 SFMMU_STAT(sf_tteload512k);
3096 break;
3097 case TTE4M:
3098 SFMMU_STAT(sf_tteload4m);
3099 break;
3100 case (TTE32M):
3101 SFMMU_STAT(sf_tteload32m);
3102 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3103 break;
3104 case (TTE256M):
3105 SFMMU_STAT(sf_tteload256m);
3106 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3107 break;
3108 }
3109
3110 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3111 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3112 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3113 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3114
3115 HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3116
3117 /*
3118 * Need to grab mlist lock here so that pageunload
3119 * will not change tte behind us.
3120 */
3121 if (pp) {
3122 pml = sfmmu_mlist_enter(pp);
3123 }
3124
3125 sfmmu_copytte(&sfhme->hme_tte, &tteold);
3126 /*
3127 * Look for corresponding hment and if valid verify
3128 * pfns are equal.
3129 */
3130 remap = TTE_IS_VALID(&tteold);
3131 if (remap) {
3132 pfn_t new_pfn, old_pfn;
3133
3134 old_pfn = TTE_TO_PFN(vaddr, &tteold);
3135 new_pfn = TTE_TO_PFN(vaddr, ttep);
3136
3137 if (flags & HAT_LOAD_REMAP) {
3138 /* make sure we are remapping same type of pages */
3139 if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3140 panic("sfmmu_tteload - tte remap io<->memory");
3141 }
3142 if (old_pfn != new_pfn &&
3143 (pp != NULL || sfhme->hme_page != NULL)) {
3144 panic("sfmmu_tteload - tte remap pp != NULL");
3145 }
3146 } else if (old_pfn != new_pfn) {
3147 panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3148 (void *)hmeblkp);
3149 }
3150 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3151 }
3152
3153 if (pp) {
3154 if (size == TTE8K) {
3155 #ifdef VAC
3156 /*
3157 * Handle VAC consistency
3158 */
3159 if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3160 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3161 }
3162 #endif
3163
3164 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3165 pmtx = sfmmu_page_enter(pp);
3166 PP_CLRRO(pp);
3167 sfmmu_page_exit(pmtx);
3168 } else if (!PP_ISMAPPED(pp) &&
3169 (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3170 pmtx = sfmmu_page_enter(pp);
3171 if (!(PP_ISMOD(pp))) {
3172 PP_SETRO(pp);
3173 }
3174 sfmmu_page_exit(pmtx);
3175 }
3176
3177 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3178 /*
3179 * sfmmu_pagearray_setup failed so return
3180 */
3181 sfmmu_mlist_exit(pml);
3182 return (1);
3183 }
3184 }
3185
3186 /*
3187 * Make sure hment is not on a mapping list.
3188 */
3189 ASSERT(remap || (sfhme->hme_page == NULL));
3190
3191 /* if it is not a remap then hme->next better be NULL */
3192 ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3193
3194 if (flags & HAT_LOAD_LOCK) {
3195 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3196 panic("too high lckcnt-hmeblk %p",
3197 (void *)hmeblkp);
3198 }
3199 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3200
3201 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3202 }
3203
3204 #ifdef VAC
3205 if (pp && PP_ISNC(pp)) {
3206 /*
3207 * If the physical page is marked to be uncacheable, like
3208 * by a vac conflict, make sure the new mapping is also
3209 * uncacheable.
3210 */
3211 TTE_CLR_VCACHEABLE(ttep);
3212 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3213 }
3214 #endif
3215 ttep->tte_hmenum = hmenum;
3216
3217 #ifdef DEBUG
3218 orig_old = tteold;
3219 #endif /* DEBUG */
3220
3221 while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3222 if ((sfmmup == KHATID) &&
3223 (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3224 sfmmu_copytte(&sfhme->hme_tte, &tteold);
3225 }
3226 #ifdef DEBUG
3227 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3228 #endif /* DEBUG */
3229 }
3230 ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3231
3232 if (!TTE_IS_VALID(&tteold)) {
3233
3234 atomic_inc_16(&hmeblkp->hblk_vcnt);
3235 if (rid == SFMMU_INVALID_SHMERID) {
3236 atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3237 } else {
3238 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3239 sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3240 /*
3241 * We already accounted for region ttecnt's in sfmmu
3242 * during hat_join_region() processing. Here we
3243 * only update ttecnt's in region struture.
3244 */
3245 atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3246 }
3247 }
3248
3249 myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3250 if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3251 sfmmup != ksfmmup) {
3252 uchar_t tteflag = 1 << size;
3253 if (rid == SFMMU_INVALID_SHMERID) {
3254 if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3255 hatlockp = sfmmu_hat_enter(sfmmup);
3256 sfmmup->sfmmu_tteflags |= tteflag;
3257 sfmmu_hat_exit(hatlockp);
3258 }
3259 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3260 hatlockp = sfmmu_hat_enter(sfmmup);
3261 sfmmup->sfmmu_rtteflags |= tteflag;
3262 sfmmu_hat_exit(hatlockp);
3263 }
3264 /*
3265 * Update the current CPU tsbmiss area, so the current thread
3266 * won't need to take the tsbmiss for the new pagesize.
3267 * The other threads in the process will update their tsb
3268 * miss area lazily in sfmmu_tsbmiss_exception() when they
3269 * fail to find the translation for a newly added pagesize.
3270 */
3271 if (size > TTE64K && myflt) {
3272 struct tsbmiss *tsbmp;
3273 kpreempt_disable();
3274 tsbmp = &tsbmiss_area[CPU->cpu_id];
3275 if (rid == SFMMU_INVALID_SHMERID) {
3276 if (!(tsbmp->uhat_tteflags & tteflag)) {
3277 tsbmp->uhat_tteflags |= tteflag;
3278 }
3279 } else {
3280 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3281 tsbmp->uhat_rtteflags |= tteflag;
3282 }
3283 }
3284 kpreempt_enable();
3285 }
3286 }
3287
3288 if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3289 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3290 hatlockp = sfmmu_hat_enter(sfmmup);
3291 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3292 sfmmu_hat_exit(hatlockp);
3293 }
3294
3295 flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3296 hw_tte.tte_intlo;
3297 flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3298 hw_tte.tte_inthi;
3299
3300 if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3301 /*
3302 * If remap and new tte differs from old tte we need
3303 * to sync the mod bit and flush TLB/TSB. We don't
3304 * need to sync ref bit because we currently always set
3305 * ref bit in tteload.
3306 */
3307 ASSERT(TTE_IS_REF(ttep));
3308 if (TTE_IS_MOD(&tteold)) {
3309 sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3310 }
3311 /*
3312 * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3313 * hmes are only used for read only text. Adding this code for
3314 * completeness and future use of shared hmeblks with writable
3315 * mappings of VMODSORT vnodes.
3316 */
3317 if (hmeblkp->hblk_shared) {
3318 cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3319 sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3320 xt_sync(cpuset);
3321 SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3322 } else {
3323 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3324 xt_sync(sfmmup->sfmmu_cpusran);
3325 }
3326 }
3327
3328 if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3329 /*
3330 * We only preload 8K and 4M mappings into the TSB, since
3331 * 64K and 512K mappings are replicated and hence don't
3332 * have a single, unique TSB entry. Ditto for 32M/256M.
3333 */
3334 if (size == TTE8K || size == TTE4M) {
3335 sf_scd_t *scdp;
3336 hatlockp = sfmmu_hat_enter(sfmmup);
3337 /*
3338 * Don't preload private TSB if the mapping is used
3339 * by the shctx in the SCD.
3340 */
3341 scdp = sfmmup->sfmmu_scdp;
3342 if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3343 !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3344 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3345 size);
3346 }
3347 sfmmu_hat_exit(hatlockp);
3348 }
3349 }
3350 if (pp) {
3351 if (!remap) {
3352 HME_ADD(sfhme, pp);
3353 atomic_inc_16(&hmeblkp->hblk_hmecnt);
3354 ASSERT(hmeblkp->hblk_hmecnt > 0);
3355
3356 /*
3357 * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3358 * see pageunload() for comment.
3359 */
3360 }
3361 sfmmu_mlist_exit(pml);
3362 }
3363
3364 return (0);
3365 }
3366 /*
3367 * Function unlocks hash bucket.
3368 */
3369 static void
3370 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3371 {
3372 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3373 SFMMU_HASH_UNLOCK(hmebp);
3374 }
3375
3376 /*
3377 * function which checks and sets up page array for a large
3378 * translation. Will set p_vcolor, p_index, p_ro fields.
3379 * Assumes addr and pfnum of first page are properly aligned.
3380 * Will check for physical contiguity. If check fails it return
3381 * non null.
3382 */
3383 static int
3384 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3385 {
3386 int i, index, ttesz;
3387 pfn_t pfnum;
3388 pgcnt_t npgs;
3389 page_t *pp, *pp1;
3390 kmutex_t *pmtx;
3391 #ifdef VAC
3392 int osz;
3393 int cflags = 0;
3394 int vac_err = 0;
3395 #endif
3396 int newidx = 0;
3397
3398 ttesz = TTE_CSZ(ttep);
3399
3400 ASSERT(ttesz > TTE8K);
3401
3402 npgs = TTEPAGES(ttesz);
3403 index = PAGESZ_TO_INDEX(ttesz);
3404
3405 pfnum = (*pps)->p_pagenum;
3406 ASSERT(IS_P2ALIGNED(pfnum, npgs));
3407
3408 /*
3409 * Save the first pp so we can do HAT_TMPNC at the end.
3410 */
3411 pp1 = *pps;
3412 #ifdef VAC
3413 osz = fnd_mapping_sz(pp1);
3414 #endif
3415
3416 for (i = 0; i < npgs; i++, pps++) {
3417 pp = *pps;
3418 ASSERT(PAGE_LOCKED(pp));
3419 ASSERT(pp->p_szc >= ttesz);
3420 ASSERT(pp->p_szc == pp1->p_szc);
3421 ASSERT(sfmmu_mlist_held(pp));
3422
3423 /*
3424 * XXX is it possible to maintain P_RO on the root only?
3425 */
3426 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3427 pmtx = sfmmu_page_enter(pp);
3428 PP_CLRRO(pp);
3429 sfmmu_page_exit(pmtx);
3430 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3431 !PP_ISMOD(pp)) {
3432 pmtx = sfmmu_page_enter(pp);
3433 if (!(PP_ISMOD(pp))) {
3434 PP_SETRO(pp);
3435 }
3436 sfmmu_page_exit(pmtx);
3437 }
3438
3439 /*
3440 * If this is a remap we skip vac & contiguity checks.
3441 */
3442 if (remap)
3443 continue;
3444
3445 /*
3446 * set p_vcolor and detect any vac conflicts.
3447 */
3448 #ifdef VAC
3449 if (vac_err == 0) {
3450 vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3451
3452 }
3453 #endif
3454
3455 /*
3456 * Save current index in case we need to undo it.
3457 * Note: "PAGESZ_TO_INDEX(sz) (1 << (sz))"
3458 * "SFMMU_INDEX_SHIFT 6"
3459 * "SFMMU_INDEX_MASK ((1 << SFMMU_INDEX_SHIFT) - 1)"
3460 * "PP_MAPINDEX(p_index) (p_index & SFMMU_INDEX_MASK)"
3461 *
3462 * So: index = PAGESZ_TO_INDEX(ttesz);
3463 * if ttesz == 1 then index = 0x2
3464 * 2 then index = 0x4
3465 * 3 then index = 0x8
3466 * 4 then index = 0x10
3467 * 5 then index = 0x20
3468 * The code below checks if it's a new pagesize (ie, newidx)
3469 * in case we need to take it back out of p_index,
3470 * and then or's the new index into the existing index.
3471 */
3472 if ((PP_MAPINDEX(pp) & index) == 0)
3473 newidx = 1;
3474 pp->p_index = (PP_MAPINDEX(pp) | index);
3475
3476 /*
3477 * contiguity check
3478 */
3479 if (pp->p_pagenum != pfnum) {
3480 /*
3481 * If we fail the contiguity test then
3482 * the only thing we need to fix is the p_index field.
3483 * We might get a few extra flushes but since this
3484 * path is rare that is ok. The p_ro field will
3485 * get automatically fixed on the next tteload to
3486 * the page. NO TNC bit is set yet.
3487 */
3488 while (i >= 0) {
3489 pp = *pps;
3490 if (newidx)
3491 pp->p_index = (PP_MAPINDEX(pp) &
3492 ~index);
3493 pps--;
3494 i--;
3495 }
3496 return (1);
3497 }
3498 pfnum++;
3499 addr += MMU_PAGESIZE;
3500 }
3501
3502 #ifdef VAC
3503 if (vac_err) {
3504 if (ttesz > osz) {
3505 /*
3506 * There are some smaller mappings that causes vac
3507 * conflicts. Convert all existing small mappings to
3508 * TNC.
3509 */
3510 SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3511 sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3512 npgs);
3513 } else {
3514 /* EMPTY */
3515 /*
3516 * If there exists an big page mapping,
3517 * that means the whole existing big page
3518 * has TNC setting already. No need to covert to
3519 * TNC again.
3520 */
3521 ASSERT(PP_ISTNC(pp1));
3522 }
3523 }
3524 #endif /* VAC */
3525
3526 return (0);
3527 }
3528
3529 #ifdef VAC
3530 /*
3531 * Routine that detects vac consistency for a large page. It also
3532 * sets virtual color for all pp's for this big mapping.
3533 */
3534 static int
3535 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3536 {
3537 int vcolor, ocolor;
3538
3539 ASSERT(sfmmu_mlist_held(pp));
3540
3541 if (PP_ISNC(pp)) {
3542 return (HAT_TMPNC);
3543 }
3544
3545 vcolor = addr_to_vcolor(addr);
3546 if (PP_NEWPAGE(pp)) {
3547 PP_SET_VCOLOR(pp, vcolor);
3548 return (0);
3549 }
3550
3551 ocolor = PP_GET_VCOLOR(pp);
3552 if (ocolor == vcolor) {
3553 return (0);
3554 }
3555
3556 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3557 /*
3558 * Previous user of page had a differnet color
3559 * but since there are no current users
3560 * we just flush the cache and change the color.
3561 * As an optimization for large pages we flush the
3562 * entire cache of that color and set a flag.
3563 */
3564 SFMMU_STAT(sf_pgcolor_conflict);
3565 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3566 CacheColor_SetFlushed(*cflags, ocolor);
3567 sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3568 }
3569 PP_SET_VCOLOR(pp, vcolor);
3570 return (0);
3571 }
3572
3573 /*
3574 * We got a real conflict with a current mapping.
3575 * set flags to start unencaching all mappings
3576 * and return failure so we restart looping
3577 * the pp array from the beginning.
3578 */
3579 return (HAT_TMPNC);
3580 }
3581 #endif /* VAC */
3582
3583 /*
3584 * creates a large page shadow hmeblk for a tte.
3585 * The purpose of this routine is to allow us to do quick unloads because
3586 * the vm layer can easily pass a very large but sparsely populated range.
3587 */
3588 static struct hme_blk *
3589 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3590 {
3591 struct hmehash_bucket *hmebp;
3592 hmeblk_tag hblktag;
3593 int hmeshift, size, vshift;
3594 uint_t shw_mask, newshw_mask;
3595 struct hme_blk *hmeblkp;
3596
3597 ASSERT(sfmmup != KHATID);
3598 if (mmu_page_sizes == max_mmu_page_sizes) {
3599 ASSERT(ttesz < TTE256M);
3600 } else {
3601 ASSERT(ttesz < TTE4M);
3602 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3603 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3604 }
3605
3606 if (ttesz == TTE8K) {
3607 size = TTE512K;
3608 } else {
3609 size = ++ttesz;
3610 }
3611
3612 hblktag.htag_id = sfmmup;
3613 hmeshift = HME_HASH_SHIFT(size);
3614 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3615 hblktag.htag_rehash = HME_HASH_REHASH(size);
3616 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3617 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3618
3619 SFMMU_HASH_LOCK(hmebp);
3620
3621 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3622 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3623 if (hmeblkp == NULL) {
3624 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3625 hblktag, flags, SFMMU_INVALID_SHMERID);
3626 }
3627 ASSERT(hmeblkp);
3628 if (!hmeblkp->hblk_shw_mask) {
3629 /*
3630 * if this is a unused hblk it was just allocated or could
3631 * potentially be a previous large page hblk so we need to
3632 * set the shadow bit.
3633 */
3634 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3635 hmeblkp->hblk_shw_bit = 1;
3636 } else if (hmeblkp->hblk_shw_bit == 0) {
3637 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3638 (void *)hmeblkp);
3639 }
3640 ASSERT(hmeblkp->hblk_shw_bit == 1);
3641 ASSERT(!hmeblkp->hblk_shared);
3642 vshift = vaddr_to_vshift(hblktag, vaddr, size);
3643 ASSERT(vshift < 8);
3644 /*
3645 * Atomically set shw mask bit
3646 */
3647 do {
3648 shw_mask = hmeblkp->hblk_shw_mask;
3649 newshw_mask = shw_mask | (1 << vshift);
3650 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3651 newshw_mask);
3652 } while (newshw_mask != shw_mask);
3653
3654 SFMMU_HASH_UNLOCK(hmebp);
3655
3656 return (hmeblkp);
3657 }
3658
3659 /*
3660 * This routine cleanup a previous shadow hmeblk and changes it to
3661 * a regular hblk. This happens rarely but it is possible
3662 * when a process wants to use large pages and there are hblks still
3663 * lying around from the previous as that used these hmeblks.
3664 * The alternative was to cleanup the shadow hblks at unload time
3665 * but since so few user processes actually use large pages, it is
3666 * better to be lazy and cleanup at this time.
3667 */
3668 static void
3669 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3670 struct hmehash_bucket *hmebp)
3671 {
3672 caddr_t addr, endaddr;
3673 int hashno, size;
3674
3675 ASSERT(hmeblkp->hblk_shw_bit);
3676 ASSERT(!hmeblkp->hblk_shared);
3677
3678 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3679
3680 if (!hmeblkp->hblk_shw_mask) {
3681 hmeblkp->hblk_shw_bit = 0;
3682 return;
3683 }
3684 addr = (caddr_t)get_hblk_base(hmeblkp);
3685 endaddr = get_hblk_endaddr(hmeblkp);
3686 size = get_hblk_ttesz(hmeblkp);
3687 hashno = size - 1;
3688 ASSERT(hashno > 0);
3689 SFMMU_HASH_UNLOCK(hmebp);
3690
3691 sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3692
3693 SFMMU_HASH_LOCK(hmebp);
3694 }
3695
3696 static void
3697 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3698 int hashno)
3699 {
3700 int hmeshift, shadow = 0;
3701 hmeblk_tag hblktag;
3702 struct hmehash_bucket *hmebp;
3703 struct hme_blk *hmeblkp;
3704 struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3705
3706 ASSERT(hashno > 0);
3707 hblktag.htag_id = sfmmup;
3708 hblktag.htag_rehash = hashno;
3709 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3710
3711 hmeshift = HME_HASH_SHIFT(hashno);
3712
3713 while (addr < endaddr) {
3714 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3715 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3716 SFMMU_HASH_LOCK(hmebp);
3717 /* inline HME_HASH_SEARCH */
3718 hmeblkp = hmebp->hmeblkp;
3719 pr_hblk = NULL;
3720 while (hmeblkp) {
3721 if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3722 /* found hme_blk */
3723 ASSERT(!hmeblkp->hblk_shared);
3724 if (hmeblkp->hblk_shw_bit) {
3725 if (hmeblkp->hblk_shw_mask) {
3726 shadow = 1;
3727 sfmmu_shadow_hcleanup(sfmmup,
3728 hmeblkp, hmebp);
3729 break;
3730 } else {
3731 hmeblkp->hblk_shw_bit = 0;
3732 }
3733 }
3734
3735 /*
3736 * Hblk_hmecnt and hblk_vcnt could be non zero
3737 * since hblk_unload() does not gurantee that.
3738 *
3739 * XXX - this could cause tteload() to spin
3740 * where sfmmu_shadow_hcleanup() is called.
3741 */
3742 }
3743
3744 nx_hblk = hmeblkp->hblk_next;
3745 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3746 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3747 &list, 0);
3748 } else {
3749 pr_hblk = hmeblkp;
3750 }
3751 hmeblkp = nx_hblk;
3752 }
3753
3754 SFMMU_HASH_UNLOCK(hmebp);
3755
3756 if (shadow) {
3757 /*
3758 * We found another shadow hblk so cleaned its
3759 * children. We need to go back and cleanup
3760 * the original hblk so we don't change the
3761 * addr.
3762 */
3763 shadow = 0;
3764 } else {
3765 addr = (caddr_t)roundup((uintptr_t)addr + 1,
3766 (1 << hmeshift));
3767 }
3768 }
3769 sfmmu_hblks_list_purge(&list, 0);
3770 }
3771
3772 /*
3773 * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3774 * may still linger on after pageunload.
3775 */
3776 static void
3777 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3778 {
3779 int hmeshift;
3780 hmeblk_tag hblktag;
3781 struct hmehash_bucket *hmebp;
3782 struct hme_blk *hmeblkp;
3783 struct hme_blk *pr_hblk;
3784 struct hme_blk *list = NULL;
3785
3786 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3787 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3788
3789 hmeshift = HME_HASH_SHIFT(ttesz);
3790 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3791 hblktag.htag_rehash = ttesz;
3792 hblktag.htag_rid = rid;
3793 hblktag.htag_id = srdp;
3794 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3795
3796 SFMMU_HASH_LOCK(hmebp);
3797 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3798 if (hmeblkp != NULL) {
3799 ASSERT(hmeblkp->hblk_shared);
3800 ASSERT(!hmeblkp->hblk_shw_bit);
3801 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3802 panic("sfmmu_cleanup_rhblk: valid hmeblk");
3803 }
3804 ASSERT(!hmeblkp->hblk_lckcnt);
3805 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3806 &list, 0);
3807 }
3808 SFMMU_HASH_UNLOCK(hmebp);
3809 sfmmu_hblks_list_purge(&list, 0);
3810 }
3811
3812 /* ARGSUSED */
3813 static void
3814 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3815 size_t r_size, void *r_obj, u_offset_t r_objoff)
3816 {
3817 }
3818
3819 /*
3820 * Searches for an hmeblk which maps addr, then unloads this mapping
3821 * and updates *eaddrp, if the hmeblk is found.
3822 */
3823 static void
3824 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3825 caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3826 {
3827 int hmeshift;
3828 hmeblk_tag hblktag;
3829 struct hmehash_bucket *hmebp;
3830 struct hme_blk *hmeblkp;
3831 struct hme_blk *pr_hblk;
3832 struct hme_blk *list = NULL;
3833
3834 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3835 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3836 ASSERT(ttesz >= HBLK_MIN_TTESZ);
3837
3838 hmeshift = HME_HASH_SHIFT(ttesz);
3839 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3840 hblktag.htag_rehash = ttesz;
3841 hblktag.htag_rid = rid;
3842 hblktag.htag_id = srdp;
3843 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3844
3845 SFMMU_HASH_LOCK(hmebp);
3846 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3847 if (hmeblkp != NULL) {
3848 ASSERT(hmeblkp->hblk_shared);
3849 ASSERT(!hmeblkp->hblk_lckcnt);
3850 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3851 *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3852 eaddr, NULL, HAT_UNLOAD);
3853 ASSERT(*eaddrp > addr);
3854 }
3855 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3856 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3857 &list, 0);
3858 }
3859 SFMMU_HASH_UNLOCK(hmebp);
3860 sfmmu_hblks_list_purge(&list, 0);
3861 }
3862
3863 static void
3864 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3865 {
3866 int ttesz = rgnp->rgn_pgszc;
3867 size_t rsz = rgnp->rgn_size;
3868 caddr_t rsaddr = rgnp->rgn_saddr;
3869 caddr_t readdr = rsaddr + rsz;
3870 caddr_t rhsaddr;
3871 caddr_t va;
3872 uint_t rid = rgnp->rgn_id;
3873 caddr_t cbsaddr;
3874 caddr_t cbeaddr;
3875 hat_rgn_cb_func_t rcbfunc;
3876 ulong_t cnt;
3877
3878 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3879 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3880
3881 ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3882 ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3883 if (ttesz < HBLK_MIN_TTESZ) {
3884 ttesz = HBLK_MIN_TTESZ;
3885 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3886 } else {
3887 rhsaddr = rsaddr;
3888 }
3889
3890 if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3891 rcbfunc = sfmmu_rgn_cb_noop;
3892 }
3893
3894 while (ttesz >= HBLK_MIN_TTESZ) {
3895 cbsaddr = rsaddr;
3896 cbeaddr = rsaddr;
3897 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3898 ttesz--;
3899 continue;
3900 }
3901 cnt = 0;
3902 va = rsaddr;
3903 while (va < readdr) {
3904 ASSERT(va >= rhsaddr);
3905 if (va != cbeaddr) {
3906 if (cbeaddr != cbsaddr) {
3907 ASSERT(cbeaddr > cbsaddr);
3908 (*rcbfunc)(cbsaddr, cbeaddr,
3909 rsaddr, rsz, rgnp->rgn_obj,
3910 rgnp->rgn_objoff);
3911 }
3912 cbsaddr = va;
3913 cbeaddr = va;
3914 }
3915 sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3916 ttesz, &cbeaddr);
3917 cnt++;
3918 va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3919 }
3920 if (cbeaddr != cbsaddr) {
3921 ASSERT(cbeaddr > cbsaddr);
3922 (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3923 rsz, rgnp->rgn_obj,
3924 rgnp->rgn_objoff);
3925 }
3926 ttesz--;
3927 }
3928 }
3929
3930 /*
3931 * Release one hardware address translation lock on the given address range.
3932 */
3933 void
3934 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3935 {
3936 struct hmehash_bucket *hmebp;
3937 hmeblk_tag hblktag;
3938 int hmeshift, hashno = 1;
3939 struct hme_blk *hmeblkp, *list = NULL;
3940 caddr_t endaddr;
3941
3942 ASSERT(sfmmup != NULL);
3943
3944 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3945 ASSERT((len & MMU_PAGEOFFSET) == 0);
3946 endaddr = addr + len;
3947 hblktag.htag_id = sfmmup;
3948 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3949
3950 /*
3951 * Spitfire supports 4 page sizes.
3952 * Most pages are expected to be of the smallest page size (8K) and
3953 * these will not need to be rehashed. 64K pages also don't need to be
3954 * rehashed because an hmeblk spans 64K of address space. 512K pages
3955 * might need 1 rehash and and 4M pages might need 2 rehashes.
3956 */
3957 while (addr < endaddr) {
3958 hmeshift = HME_HASH_SHIFT(hashno);
3959 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3960 hblktag.htag_rehash = hashno;
3961 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3962
3963 SFMMU_HASH_LOCK(hmebp);
3964
3965 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3966 if (hmeblkp != NULL) {
3967 ASSERT(!hmeblkp->hblk_shared);
3968 /*
3969 * If we encounter a shadow hmeblk then
3970 * we know there are no valid hmeblks mapping
3971 * this address at this size or larger.
3972 * Just increment address by the smallest
3973 * page size.
3974 */
3975 if (hmeblkp->hblk_shw_bit) {
3976 addr += MMU_PAGESIZE;
3977 } else {
3978 addr = sfmmu_hblk_unlock(hmeblkp, addr,
3979 endaddr);
3980 }
3981 SFMMU_HASH_UNLOCK(hmebp);
3982 hashno = 1;
3983 continue;
3984 }
3985 SFMMU_HASH_UNLOCK(hmebp);
3986
3987 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
3988 /*
3989 * We have traversed the whole list and rehashed
3990 * if necessary without finding the address to unlock
3991 * which should never happen.
3992 */
3993 panic("sfmmu_unlock: addr not found. "
3994 "addr %p hat %p", (void *)addr, (void *)sfmmup);
3995 } else {
3996 hashno++;
3997 }
3998 }
3999
4000 sfmmu_hblks_list_purge(&list, 0);
4001 }
4002
4003 void
4004 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4005 hat_region_cookie_t rcookie)
4006 {
4007 sf_srd_t *srdp;
4008 sf_region_t *rgnp;
4009 int ttesz;
4010 uint_t rid;
4011 caddr_t eaddr;
4012 caddr_t va;
4013 int hmeshift;
4014 hmeblk_tag hblktag;
4015 struct hmehash_bucket *hmebp;
4016 struct hme_blk *hmeblkp;
4017 struct hme_blk *pr_hblk;
4018 struct hme_blk *list;
4019
4020 if (rcookie == HAT_INVALID_REGION_COOKIE) {
4021 hat_unlock(sfmmup, addr, len);
4022 return;
4023 }
4024
4025 ASSERT(sfmmup != NULL);
4026 ASSERT(sfmmup != ksfmmup);
4027
4028 srdp = sfmmup->sfmmu_srdp;
4029 rid = (uint_t)((uint64_t)rcookie);
4030 VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
4031 eaddr = addr + len;
4032 va = addr;
4033 list = NULL;
4034 rgnp = srdp->srd_hmergnp[rid];
4035 SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4036
4037 ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4038 ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4039 if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4040 ttesz = HBLK_MIN_TTESZ;
4041 } else {
4042 ttesz = rgnp->rgn_pgszc;
4043 }
4044 while (va < eaddr) {
4045 while (ttesz < rgnp->rgn_pgszc &&
4046 IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4047 ttesz++;
4048 }
4049 while (ttesz >= HBLK_MIN_TTESZ) {
4050 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4051 ttesz--;
4052 continue;
4053 }
4054 hmeshift = HME_HASH_SHIFT(ttesz);
4055 hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4056 hblktag.htag_rehash = ttesz;
4057 hblktag.htag_rid = rid;
4058 hblktag.htag_id = srdp;
4059 hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4060 SFMMU_HASH_LOCK(hmebp);
4061 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4062 &list);
4063 if (hmeblkp == NULL) {
4064 SFMMU_HASH_UNLOCK(hmebp);
4065 ttesz--;
4066 continue;
4067 }
4068 ASSERT(hmeblkp->hblk_shared);
4069 va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4070 ASSERT(va >= eaddr ||
4071 IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4072 SFMMU_HASH_UNLOCK(hmebp);
4073 break;
4074 }
4075 if (ttesz < HBLK_MIN_TTESZ) {
4076 panic("hat_unlock_region: addr not found "
4077 "addr %p hat %p", (void *)va, (void *)sfmmup);
4078 }
4079 }
4080 sfmmu_hblks_list_purge(&list, 0);
4081 }
4082
4083 /*
4084 * Function to unlock a range of addresses in an hmeblk. It returns the
4085 * next address that needs to be unlocked.
4086 * Should be called with the hash lock held.
4087 */
4088 static caddr_t
4089 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4090 {
4091 struct sf_hment *sfhme;
4092 tte_t tteold, ttemod;
4093 int ttesz, ret;
4094
4095 ASSERT(in_hblk_range(hmeblkp, addr));
4096 ASSERT(hmeblkp->hblk_shw_bit == 0);
4097
4098 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4099 ttesz = get_hblk_ttesz(hmeblkp);
4100
4101 HBLKTOHME(sfhme, hmeblkp, addr);
4102 while (addr < endaddr) {
4103 readtte:
4104 sfmmu_copytte(&sfhme->hme_tte, &tteold);
4105 if (TTE_IS_VALID(&tteold)) {
4106
4107 ttemod = tteold;
4108
4109 ret = sfmmu_modifytte_try(&tteold, &ttemod,
4110 &sfhme->hme_tte);
4111
4112 if (ret < 0)
4113 goto readtte;
4114
4115 if (hmeblkp->hblk_lckcnt == 0)
4116 panic("zero hblk lckcnt");
4117
4118 if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4119 (uintptr_t)endaddr)
4120 panic("can't unlock large tte");
4121
4122 ASSERT(hmeblkp->hblk_lckcnt > 0);
4123 atomic_dec_32(&hmeblkp->hblk_lckcnt);
4124 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4125 } else {
4126 panic("sfmmu_hblk_unlock: invalid tte");
4127 }
4128 addr += TTEBYTES(ttesz);
4129 sfhme++;
4130 }
4131 return (addr);
4132 }
4133
4134 /*
4135 * Physical Address Mapping Framework
4136 *
4137 * General rules:
4138 *
4139 * (1) Applies only to seg_kmem memory pages. To make things easier,
4140 * seg_kpm addresses are also accepted by the routines, but nothing
4141 * is done with them since by definition their PA mappings are static.
4142 * (2) hat_add_callback() may only be called while holding the page lock
4143 * SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4144 * or passing HAC_PAGELOCK flag.
4145 * (3) prehandler() and posthandler() may not call hat_add_callback() or
4146 * hat_delete_callback(), nor should they allocate memory. Post quiesce
4147 * callbacks may not sleep or acquire adaptive mutex locks.
4148 * (4) Either prehandler() or posthandler() (but not both) may be specified
4149 * as being NULL. Specifying an errhandler() is optional.
4150 *
4151 * Details of using the framework:
4152 *
4153 * registering a callback (hat_register_callback())
4154 *
4155 * Pass prehandler, posthandler, errhandler addresses
4156 * as described below. If capture_cpus argument is nonzero,
4157 * suspend callback to the prehandler will occur with CPUs
4158 * captured and executing xc_loop() and CPUs will remain
4159 * captured until after the posthandler suspend callback
4160 * occurs.
4161 *
4162 * adding a callback (hat_add_callback())
4163 *
4164 * as_pagelock();
4165 * hat_add_callback();
4166 * save returned pfn in private data structures or program registers;
4167 * as_pageunlock();
4168 *
4169 * prehandler()
4170 *
4171 * Stop all accesses by physical address to this memory page.
4172 * Called twice: the first, PRESUSPEND, is a context safe to acquire
4173 * adaptive locks. The second, SUSPEND, is called at high PIL with
4174 * CPUs captured so adaptive locks may NOT be acquired (and all spin
4175 * locks must be XCALL_PIL or higher locks).
4176 *
4177 * May return the following errors:
4178 * EIO: A fatal error has occurred. This will result in panic.
4179 * EAGAIN: The page cannot be suspended. This will fail the
4180 * relocation.
4181 * 0: Success.
4182 *
4183 * posthandler()
4184 *
4185 * Save new pfn in private data structures or program registers;
4186 * not allowed to fail (non-zero return values will result in panic).
4187 *
4188 * errhandler()
4189 *
4190 * called when an error occurs related to the callback. Currently
4191 * the only such error is HAT_CB_ERR_LEAKED which indicates that
4192 * a page is being freed, but there are still outstanding callback(s)
4193 * registered on the page.
4194 *
4195 * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4196 *
4197 * stop using physical address
4198 * hat_delete_callback();
4199 *
4200 */
4201
4202 /*
4203 * Register a callback class. Each subsystem should do this once and
4204 * cache the id_t returned for use in setting up and tearing down callbacks.
4205 *
4206 * There is no facility for removing callback IDs once they are created;
4207 * the "key" should be unique for each module, so in case a module is unloaded
4208 * and subsequently re-loaded, we can recycle the module's previous entry.
4209 */
4210 id_t
4211 hat_register_callback(int key,
4212 int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4213 int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4214 int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4215 int capture_cpus)
4216 {
4217 id_t id;
4218
4219 /*
4220 * Search the table for a pre-existing callback associated with
4221 * the identifier "key". If one exists, we re-use that entry in
4222 * the table for this instance, otherwise we assign the next
4223 * available table slot.
4224 */
4225 for (id = 0; id < sfmmu_max_cb_id; id++) {
4226 if (sfmmu_cb_table[id].key == key)
4227 break;
4228 }
4229
4230 if (id == sfmmu_max_cb_id) {
4231 id = sfmmu_cb_nextid++;
4232 if (id >= sfmmu_max_cb_id)
4233 panic("hat_register_callback: out of callback IDs");
4234 }
4235
4236 ASSERT(prehandler != NULL || posthandler != NULL);
4237
4238 sfmmu_cb_table[id].key = key;
4239 sfmmu_cb_table[id].prehandler = prehandler;
4240 sfmmu_cb_table[id].posthandler = posthandler;
4241 sfmmu_cb_table[id].errhandler = errhandler;
4242 sfmmu_cb_table[id].capture_cpus = capture_cpus;
4243
4244 return (id);
4245 }
4246
4247 #define HAC_COOKIE_NONE (void *)-1
4248
4249 /*
4250 * Add relocation callbacks to the specified addr/len which will be called
4251 * when relocating the associated page. See the description of pre and
4252 * posthandler above for more details.
4253 *
4254 * If HAC_PAGELOCK is included in flags, the underlying memory page is
4255 * locked internally so the caller must be able to deal with the callback
4256 * running even before this function has returned. If HAC_PAGELOCK is not
4257 * set, it is assumed that the underlying memory pages are locked.
4258 *
4259 * Since the caller must track the individual page boundaries anyway,
4260 * we only allow a callback to be added to a single page (large
4261 * or small). Thus [addr, addr + len) MUST be contained within a single
4262 * page.
4263 *
4264 * Registering multiple callbacks on the same [addr, addr+len) is supported,
4265 * _provided_that_ a unique parameter is specified for each callback.
4266 * If multiple callbacks are registered on the same range the callback will
4267 * be invoked with each unique parameter. Registering the same callback with
4268 * the same argument more than once will result in corrupted kernel state.
4269 *
4270 * Returns the pfn of the underlying kernel page in *rpfn
4271 * on success, or PFN_INVALID on failure.
4272 *
4273 * cookiep (if passed) provides storage space for an opaque cookie
4274 * to return later to hat_delete_callback(). This cookie makes the callback
4275 * deletion significantly quicker by avoiding a potentially lengthy hash
4276 * search.
4277 *
4278 * Returns values:
4279 * 0: success
4280 * ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4281 * EINVAL: callback ID is not valid
4282 * ENXIO: ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4283 * space
4284 * ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4285 */
4286 int
4287 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4288 void *pvt, pfn_t *rpfn, void **cookiep)
4289 {
4290 struct hmehash_bucket *hmebp;
4291 hmeblk_tag hblktag;
4292 struct hme_blk *hmeblkp;
4293 int hmeshift, hashno;
4294 caddr_t saddr, eaddr, baseaddr;
4295 struct pa_hment *pahmep;
4296 struct sf_hment *sfhmep, *osfhmep;
4297 kmutex_t *pml;
4298 tte_t tte;
4299 page_t *pp;
4300 vnode_t *vp;
4301 u_offset_t off;
4302 pfn_t pfn;
4303 int kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4304 int locked = 0;
4305
4306 /*
4307 * For KPM mappings, just return the physical address since we
4308 * don't need to register any callbacks.
4309 */
4310 if (IS_KPM_ADDR(vaddr)) {
4311 uint64_t paddr;
4312 SFMMU_KPM_VTOP(vaddr, paddr);
4313 *rpfn = btop(paddr);
4314 if (cookiep != NULL)
4315 *cookiep = HAC_COOKIE_NONE;
4316 return (0);
4317 }
4318
4319 if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4320 *rpfn = PFN_INVALID;
4321 return (EINVAL);
4322 }
4323
4324 if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4325 *rpfn = PFN_INVALID;
4326 return (ENOMEM);
4327 }
4328
4329 sfhmep = &pahmep->sfment;
4330
4331 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4332 eaddr = saddr + len;
4333
4334 rehash:
4335 /* Find the mapping(s) for this page */
4336 for (hashno = TTE64K, hmeblkp = NULL;
4337 hmeblkp == NULL && hashno <= mmu_hashcnt;
4338 hashno++) {
4339 hmeshift = HME_HASH_SHIFT(hashno);
4340 hblktag.htag_id = ksfmmup;
4341 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4342 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4343 hblktag.htag_rehash = hashno;
4344 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4345
4346 SFMMU_HASH_LOCK(hmebp);
4347
4348 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4349
4350 if (hmeblkp == NULL)
4351 SFMMU_HASH_UNLOCK(hmebp);
4352 }
4353
4354 if (hmeblkp == NULL) {
4355 kmem_cache_free(pa_hment_cache, pahmep);
4356 *rpfn = PFN_INVALID;
4357 return (ENXIO);
4358 }
4359
4360 ASSERT(!hmeblkp->hblk_shared);
4361
4362 HBLKTOHME(osfhmep, hmeblkp, saddr);
4363 sfmmu_copytte(&osfhmep->hme_tte, &tte);
4364
4365 if (!TTE_IS_VALID(&tte)) {
4366 SFMMU_HASH_UNLOCK(hmebp);
4367 kmem_cache_free(pa_hment_cache, pahmep);
4368 *rpfn = PFN_INVALID;
4369 return (ENXIO);
4370 }
4371
4372 /*
4373 * Make sure the boundaries for the callback fall within this
4374 * single mapping.
4375 */
4376 baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4377 ASSERT(saddr >= baseaddr);
4378 if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4379 SFMMU_HASH_UNLOCK(hmebp);
4380 kmem_cache_free(pa_hment_cache, pahmep);
4381 *rpfn = PFN_INVALID;
4382 return (ERANGE);
4383 }
4384
4385 pfn = sfmmu_ttetopfn(&tte, vaddr);
4386
4387 /*
4388 * The pfn may not have a page_t underneath in which case we
4389 * just return it. This can happen if we are doing I/O to a
4390 * static portion of the kernel's address space, for instance.
4391 */
4392 pp = osfhmep->hme_page;
4393 if (pp == NULL) {
4394 SFMMU_HASH_UNLOCK(hmebp);
4395 kmem_cache_free(pa_hment_cache, pahmep);
4396 *rpfn = pfn;
4397 if (cookiep)
4398 *cookiep = HAC_COOKIE_NONE;
4399 return (0);
4400 }
4401 ASSERT(pp == PP_PAGEROOT(pp));
4402
4403 vp = pp->p_vnode;
4404 off = pp->p_offset;
4405
4406 pml = sfmmu_mlist_enter(pp);
4407
4408 if (flags & HAC_PAGELOCK) {
4409 if (!page_trylock(pp, SE_SHARED)) {
4410 /*
4411 * Somebody is holding SE_EXCL lock. Might
4412 * even be hat_page_relocate(). Drop all
4413 * our locks, lookup the page in &kvp, and
4414 * retry. If it doesn't exist in &kvp and &zvp,
4415 * then we must be dealing with a kernel mapped
4416 * page which doesn't actually belong to
4417 * segkmem so we punt.
4418 */
4419 sfmmu_mlist_exit(pml);
4420 SFMMU_HASH_UNLOCK(hmebp);
4421 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4422
4423 /* check zvp before giving up */
4424 if (pp == NULL)
4425 pp = page_lookup(&zvp, (u_offset_t)saddr,
4426 SE_SHARED);
4427
4428 /* Okay, we didn't find it, give up */
4429 if (pp == NULL) {
4430 kmem_cache_free(pa_hment_cache, pahmep);
4431 *rpfn = pfn;
4432 if (cookiep)
4433 *cookiep = HAC_COOKIE_NONE;
4434 return (0);
4435 }
4436 page_unlock(pp);
4437 goto rehash;
4438 }
4439 locked = 1;
4440 }
4441
4442 if (!PAGE_LOCKED(pp) && !panicstr)
4443 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4444
4445 if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4446 pp->p_offset != off) {
4447 /*
4448 * The page moved before we got our hands on it. Drop
4449 * all the locks and try again.
4450 */
4451 ASSERT((flags & HAC_PAGELOCK) != 0);
4452 sfmmu_mlist_exit(pml);
4453 SFMMU_HASH_UNLOCK(hmebp);
4454 page_unlock(pp);
4455 locked = 0;
4456 goto rehash;
4457 }
4458
4459 if (!VN_ISKAS(vp)) {
4460 /*
4461 * This is not a segkmem page but another page which
4462 * has been kernel mapped. It had better have at least
4463 * a share lock on it. Return the pfn.
4464 */
4465 sfmmu_mlist_exit(pml);
4466 SFMMU_HASH_UNLOCK(hmebp);
4467 if (locked)
4468 page_unlock(pp);
4469 kmem_cache_free(pa_hment_cache, pahmep);
4470 ASSERT(PAGE_LOCKED(pp));
4471 *rpfn = pfn;
4472 if (cookiep)
4473 *cookiep = HAC_COOKIE_NONE;
4474 return (0);
4475 }
4476
4477 /*
4478 * Setup this pa_hment and link its embedded dummy sf_hment into
4479 * the mapping list.
4480 */
4481 pp->p_share++;
4482 pahmep->cb_id = callback_id;
4483 pahmep->addr = vaddr;
4484 pahmep->len = len;
4485 pahmep->refcnt = 1;
4486 pahmep->flags = 0;
4487 pahmep->pvt = pvt;
4488
4489 sfhmep->hme_tte.ll = 0;
4490 sfhmep->hme_data = pahmep;
4491 sfhmep->hme_prev = osfhmep;
4492 sfhmep->hme_next = osfhmep->hme_next;
4493
4494 if (osfhmep->hme_next)
4495 osfhmep->hme_next->hme_prev = sfhmep;
4496
4497 osfhmep->hme_next = sfhmep;
4498
4499 sfmmu_mlist_exit(pml);
4500 SFMMU_HASH_UNLOCK(hmebp);
4501
4502 if (locked)
4503 page_unlock(pp);
4504
4505 *rpfn = pfn;
4506 if (cookiep)
4507 *cookiep = (void *)pahmep;
4508
4509 return (0);
4510 }
4511
4512 /*
4513 * Remove the relocation callbacks from the specified addr/len.
4514 */
4515 void
4516 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4517 void *cookie)
4518 {
4519 struct hmehash_bucket *hmebp;
4520 hmeblk_tag hblktag;
4521 struct hme_blk *hmeblkp;
4522 int hmeshift, hashno;
4523 caddr_t saddr;
4524 struct pa_hment *pahmep;
4525 struct sf_hment *sfhmep, *osfhmep;
4526 kmutex_t *pml;
4527 tte_t tte;
4528 page_t *pp;
4529 vnode_t *vp;
4530 u_offset_t off;
4531 int locked = 0;
4532
4533 /*
4534 * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4535 * remove so just return.
4536 */
4537 if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4538 return;
4539
4540 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4541
4542 rehash:
4543 /* Find the mapping(s) for this page */
4544 for (hashno = TTE64K, hmeblkp = NULL;
4545 hmeblkp == NULL && hashno <= mmu_hashcnt;
4546 hashno++) {
4547 hmeshift = HME_HASH_SHIFT(hashno);
4548 hblktag.htag_id = ksfmmup;
4549 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4550 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4551 hblktag.htag_rehash = hashno;
4552 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4553
4554 SFMMU_HASH_LOCK(hmebp);
4555
4556 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4557
4558 if (hmeblkp == NULL)
4559 SFMMU_HASH_UNLOCK(hmebp);
4560 }
4561
4562 if (hmeblkp == NULL)
4563 return;
4564
4565 ASSERT(!hmeblkp->hblk_shared);
4566
4567 HBLKTOHME(osfhmep, hmeblkp, saddr);
4568
4569 sfmmu_copytte(&osfhmep->hme_tte, &tte);
4570 if (!TTE_IS_VALID(&tte)) {
4571 SFMMU_HASH_UNLOCK(hmebp);
4572 return;
4573 }
4574
4575 pp = osfhmep->hme_page;
4576 if (pp == NULL) {
4577 SFMMU_HASH_UNLOCK(hmebp);
4578 ASSERT(cookie == NULL);
4579 return;
4580 }
4581
4582 vp = pp->p_vnode;
4583 off = pp->p_offset;
4584
4585 pml = sfmmu_mlist_enter(pp);
4586
4587 if (flags & HAC_PAGELOCK) {
4588 if (!page_trylock(pp, SE_SHARED)) {
4589 /*
4590 * Somebody is holding SE_EXCL lock. Might
4591 * even be hat_page_relocate(). Drop all
4592 * our locks, lookup the page in &kvp, and
4593 * retry. If it doesn't exist in &kvp and &zvp,
4594 * then we must be dealing with a kernel mapped
4595 * page which doesn't actually belong to
4596 * segkmem so we punt.
4597 */
4598 sfmmu_mlist_exit(pml);
4599 SFMMU_HASH_UNLOCK(hmebp);
4600 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4601 /* check zvp before giving up */
4602 if (pp == NULL)
4603 pp = page_lookup(&zvp, (u_offset_t)saddr,
4604 SE_SHARED);
4605
4606 if (pp == NULL) {
4607 ASSERT(cookie == NULL);
4608 return;
4609 }
4610 page_unlock(pp);
4611 goto rehash;
4612 }
4613 locked = 1;
4614 }
4615
4616 ASSERT(PAGE_LOCKED(pp));
4617
4618 if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4619 pp->p_offset != off) {
4620 /*
4621 * The page moved before we got our hands on it. Drop
4622 * all the locks and try again.
4623 */
4624 ASSERT((flags & HAC_PAGELOCK) != 0);
4625 sfmmu_mlist_exit(pml);
4626 SFMMU_HASH_UNLOCK(hmebp);
4627 page_unlock(pp);
4628 locked = 0;
4629 goto rehash;
4630 }
4631
4632 if (!VN_ISKAS(vp)) {
4633 /*
4634 * This is not a segkmem page but another page which
4635 * has been kernel mapped.
4636 */
4637 sfmmu_mlist_exit(pml);
4638 SFMMU_HASH_UNLOCK(hmebp);
4639 if (locked)
4640 page_unlock(pp);
4641 ASSERT(cookie == NULL);
4642 return;
4643 }
4644
4645 if (cookie != NULL) {
4646 pahmep = (struct pa_hment *)cookie;
4647 sfhmep = &pahmep->sfment;
4648 } else {
4649 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4650 sfhmep = sfhmep->hme_next) {
4651
4652 /*
4653 * skip va<->pa mappings
4654 */
4655 if (!IS_PAHME(sfhmep))
4656 continue;
4657
4658 pahmep = sfhmep->hme_data;
4659 ASSERT(pahmep != NULL);
4660
4661 /*
4662 * if pa_hment matches, remove it
4663 */
4664 if ((pahmep->pvt == pvt) &&
4665 (pahmep->addr == vaddr) &&
4666 (pahmep->len == len)) {
4667 break;
4668 }
4669 }
4670 }
4671
4672 if (sfhmep == NULL) {
4673 if (!panicstr) {
4674 panic("hat_delete_callback: pa_hment not found, pp %p",
4675 (void *)pp);
4676 }
4677 return;
4678 }
4679
4680 /*
4681 * Note: at this point a valid kernel mapping must still be
4682 * present on this page.
4683 */
4684 pp->p_share--;
4685 if (pp->p_share <= 0)
4686 panic("hat_delete_callback: zero p_share");
4687
4688 if (--pahmep->refcnt == 0) {
4689 if (pahmep->flags != 0)
4690 panic("hat_delete_callback: pa_hment is busy");
4691
4692 /*
4693 * Remove sfhmep from the mapping list for the page.
4694 */
4695 if (sfhmep->hme_prev) {
4696 sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4697 } else {
4698 pp->p_mapping = sfhmep->hme_next;
4699 }
4700
4701 if (sfhmep->hme_next)
4702 sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4703
4704 sfmmu_mlist_exit(pml);
4705 SFMMU_HASH_UNLOCK(hmebp);
4706
4707 if (locked)
4708 page_unlock(pp);
4709
4710 kmem_cache_free(pa_hment_cache, pahmep);
4711 return;
4712 }
4713
4714 sfmmu_mlist_exit(pml);
4715 SFMMU_HASH_UNLOCK(hmebp);
4716 if (locked)
4717 page_unlock(pp);
4718 }
4719
4720 /*
4721 * hat_probe returns 1 if the translation for the address 'addr' is
4722 * loaded, zero otherwise.
4723 *
4724 * hat_probe should be used only for advisorary purposes because it may
4725 * occasionally return the wrong value. The implementation must guarantee that
4726 * returning the wrong value is a very rare event. hat_probe is used
4727 * to implement optimizations in the segment drivers.
4728 *
4729 */
4730 int
4731 hat_probe(struct hat *sfmmup, caddr_t addr)
4732 {
4733 pfn_t pfn;
4734 tte_t tte;
4735
4736 ASSERT(sfmmup != NULL);
4737
4738 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4739
4740 if (sfmmup == ksfmmup) {
4741 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4742 == PFN_SUSPENDED) {
4743 sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4744 }
4745 } else {
4746 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4747 }
4748
4749 if (pfn != PFN_INVALID)
4750 return (1);
4751 else
4752 return (0);
4753 }
4754
4755 ssize_t
4756 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4757 {
4758 tte_t tte;
4759
4760 if (sfmmup == ksfmmup) {
4761 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4762 return (-1);
4763 }
4764 } else {
4765 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4766 return (-1);
4767 }
4768 }
4769
4770 ASSERT(TTE_IS_VALID(&tte));
4771 return (TTEBYTES(TTE_CSZ(&tte)));
4772 }
4773
4774 uint_t
4775 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4776 {
4777 tte_t tte;
4778
4779 if (sfmmup == ksfmmup) {
4780 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4781 tte.ll = 0;
4782 }
4783 } else {
4784 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4785 tte.ll = 0;
4786 }
4787 }
4788 if (TTE_IS_VALID(&tte)) {
4789 *attr = sfmmu_ptov_attr(&tte);
4790 return (0);
4791 }
4792 *attr = 0;
4793 return ((uint_t)0xffffffff);
4794 }
4795
4796 /*
4797 * Enables more attributes on specified address range (ie. logical OR)
4798 */
4799 void
4800 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4801 {
4802 ASSERT(hat->sfmmu_as != NULL);
4803
4804 sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4805 }
4806
4807 /*
4808 * Assigns attributes to the specified address range. All the attributes
4809 * are specified.
4810 */
4811 void
4812 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4813 {
4814 ASSERT(hat->sfmmu_as != NULL);
4815
4816 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4817 }
4818
4819 /*
4820 * Remove attributes on the specified address range (ie. loginal NAND)
4821 */
4822 void
4823 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4824 {
4825 ASSERT(hat->sfmmu_as != NULL);
4826
4827 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4828 }
4829
4830 /*
4831 * Change attributes on an address range to that specified by attr and mode.
4832 */
4833 static void
4834 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4835 int mode)
4836 {
4837 struct hmehash_bucket *hmebp;
4838 hmeblk_tag hblktag;
4839 int hmeshift, hashno = 1;
4840 struct hme_blk *hmeblkp, *list = NULL;
4841 caddr_t endaddr;
4842 cpuset_t cpuset;
4843 demap_range_t dmr;
4844
4845 CPUSET_ZERO(cpuset);
4846
4847 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4848 ASSERT((len & MMU_PAGEOFFSET) == 0);
4849 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4850
4851 if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4852 ((addr + len) > (caddr_t)USERLIMIT)) {
4853 panic("user addr %p in kernel space",
4854 (void *)addr);
4855 }
4856
4857 endaddr = addr + len;
4858 hblktag.htag_id = sfmmup;
4859 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4860 DEMAP_RANGE_INIT(sfmmup, &dmr);
4861
4862 while (addr < endaddr) {
4863 hmeshift = HME_HASH_SHIFT(hashno);
4864 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4865 hblktag.htag_rehash = hashno;
4866 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4867
4868 SFMMU_HASH_LOCK(hmebp);
4869
4870 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4871 if (hmeblkp != NULL) {
4872 ASSERT(!hmeblkp->hblk_shared);
4873 /*
4874 * We've encountered a shadow hmeblk so skip the range
4875 * of the next smaller mapping size.
4876 */
4877 if (hmeblkp->hblk_shw_bit) {
4878 ASSERT(sfmmup != ksfmmup);
4879 ASSERT(hashno > 1);
4880 addr = (caddr_t)P2END((uintptr_t)addr,
4881 TTEBYTES(hashno - 1));
4882 } else {
4883 addr = sfmmu_hblk_chgattr(sfmmup,
4884 hmeblkp, addr, endaddr, &dmr, attr, mode);
4885 }
4886 SFMMU_HASH_UNLOCK(hmebp);
4887 hashno = 1;
4888 continue;
4889 }
4890 SFMMU_HASH_UNLOCK(hmebp);
4891
4892 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4893 /*
4894 * We have traversed the whole list and rehashed
4895 * if necessary without finding the address to chgattr.
4896 * This is ok, so we increment the address by the
4897 * smallest hmeblk range for kernel mappings or for
4898 * user mappings with no large pages, and the largest
4899 * hmeblk range, to account for shadow hmeblks, for
4900 * user mappings with large pages and continue.
4901 */
4902 if (sfmmup == ksfmmup)
4903 addr = (caddr_t)P2END((uintptr_t)addr,
4904 TTEBYTES(1));
4905 else
4906 addr = (caddr_t)P2END((uintptr_t)addr,
4907 TTEBYTES(hashno));
4908 hashno = 1;
4909 } else {
4910 hashno++;
4911 }
4912 }
4913
4914 sfmmu_hblks_list_purge(&list, 0);
4915 DEMAP_RANGE_FLUSH(&dmr);
4916 cpuset = sfmmup->sfmmu_cpusran;
4917 xt_sync(cpuset);
4918 }
4919
4920 /*
4921 * This function chgattr on a range of addresses in an hmeblk. It returns the
4922 * next addres that needs to be chgattr.
4923 * It should be called with the hash lock held.
4924 * XXX It should be possible to optimize chgattr by not flushing every time but
4925 * on the other hand:
4926 * 1. do one flush crosscall.
4927 * 2. only flush if we are increasing permissions (make sure this will work)
4928 */
4929 static caddr_t
4930 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
4931 caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
4932 {
4933 tte_t tte, tteattr, tteflags, ttemod;
4934 struct sf_hment *sfhmep;
4935 int ttesz;
4936 struct page *pp = NULL;
4937 kmutex_t *pml, *pmtx;
4938 int ret;
4939 int use_demap_range;
4940 #if defined(SF_ERRATA_57)
4941 int check_exec;
4942 #endif
4943
4944 ASSERT(in_hblk_range(hmeblkp, addr));
4945 ASSERT(hmeblkp->hblk_shw_bit == 0);
4946 ASSERT(!hmeblkp->hblk_shared);
4947
4948 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4949 ttesz = get_hblk_ttesz(hmeblkp);
4950
4951 /*
4952 * Flush the current demap region if addresses have been
4953 * skipped or the page size doesn't match.
4954 */
4955 use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
4956 if (use_demap_range) {
4957 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
4958 } else if (dmrp != NULL) {
4959 DEMAP_RANGE_FLUSH(dmrp);
4960 }
4961
4962 tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
4963 #if defined(SF_ERRATA_57)
4964 check_exec = (sfmmup != ksfmmup) &&
4965 AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
4966 TTE_IS_EXECUTABLE(&tteattr);
4967 #endif
4968 HBLKTOHME(sfhmep, hmeblkp, addr);
4969 while (addr < endaddr) {
4970 sfmmu_copytte(&sfhmep->hme_tte, &tte);
4971 if (TTE_IS_VALID(&tte)) {
4972 if ((tte.ll & tteflags.ll) == tteattr.ll) {
4973 /*
4974 * if the new attr is the same as old
4975 * continue
4976 */
4977 goto next_addr;
4978 }
4979 if (!TTE_IS_WRITABLE(&tteattr)) {
4980 /*
4981 * make sure we clear hw modify bit if we
4982 * removing write protections
4983 */
4984 tteflags.tte_intlo |= TTE_HWWR_INT;
4985 }
4986
4987 pml = NULL;
4988 pp = sfhmep->hme_page;
4989 if (pp) {
4990 pml = sfmmu_mlist_enter(pp);
4991 }
4992
4993 if (pp != sfhmep->hme_page) {
4994 /*
4995 * tte must have been unloaded.
4996 */
4997 ASSERT(pml);
4998 sfmmu_mlist_exit(pml);
4999 continue;
5000 }
5001
5002 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5003
5004 ttemod = tte;
5005 ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5006 ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5007
5008 #if defined(SF_ERRATA_57)
5009 if (check_exec && addr < errata57_limit)
5010 ttemod.tte_exec_perm = 0;
5011 #endif
5012 ret = sfmmu_modifytte_try(&tte, &ttemod,
5013 &sfhmep->hme_tte);
5014
5015 if (ret < 0) {
5016 /* tte changed underneath us */
5017 if (pml) {
5018 sfmmu_mlist_exit(pml);
5019 }
5020 continue;
5021 }
5022
5023 if (tteflags.tte_intlo & TTE_HWWR_INT) {
5024 /*
5025 * need to sync if we are clearing modify bit.
5026 */
5027 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5028 }
5029
5030 if (pp && PP_ISRO(pp)) {
5031 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5032 pmtx = sfmmu_page_enter(pp);
5033 PP_CLRRO(pp);
5034 sfmmu_page_exit(pmtx);
5035 }
5036 }
5037
5038 if (ret > 0 && use_demap_range) {
5039 DEMAP_RANGE_MARKPG(dmrp, addr);
5040 } else if (ret > 0) {
5041 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5042 }
5043
5044 if (pml) {
5045 sfmmu_mlist_exit(pml);
5046 }
5047 }
5048 next_addr:
5049 addr += TTEBYTES(ttesz);
5050 sfhmep++;
5051 DEMAP_RANGE_NEXTPG(dmrp);
5052 }
5053 return (addr);
5054 }
5055
5056 /*
5057 * This routine converts virtual attributes to physical ones. It will
5058 * update the tteflags field with the tte mask corresponding to the attributes
5059 * affected and it returns the new attributes. It will also clear the modify
5060 * bit if we are taking away write permission. This is necessary since the
5061 * modify bit is the hardware permission bit and we need to clear it in order
5062 * to detect write faults.
5063 */
5064 static uint64_t
5065 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5066 {
5067 tte_t ttevalue;
5068
5069 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5070
5071 switch (mode) {
5072 case SFMMU_CHGATTR:
5073 /* all attributes specified */
5074 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5075 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5076 ttemaskp->tte_inthi = TTEINTHI_ATTR;
5077 ttemaskp->tte_intlo = TTEINTLO_ATTR;
5078 break;
5079 case SFMMU_SETATTR:
5080 ASSERT(!(attr & ~HAT_PROT_MASK));
5081 ttemaskp->ll = 0;
5082 ttevalue.ll = 0;
5083 /*
5084 * a valid tte implies exec and read for sfmmu
5085 * so no need to do anything about them.
5086 * since priviledged access implies user access
5087 * PROT_USER doesn't make sense either.
5088 */
5089 if (attr & PROT_WRITE) {
5090 ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5091 ttevalue.tte_intlo |= TTE_WRPRM_INT;
5092 }
5093 break;
5094 case SFMMU_CLRATTR:
5095 /* attributes will be nand with current ones */
5096 if (attr & ~(PROT_WRITE | PROT_USER)) {
5097 panic("sfmmu: attr %x not supported", attr);
5098 }
5099 ttemaskp->ll = 0;
5100 ttevalue.ll = 0;
5101 if (attr & PROT_WRITE) {
5102 /* clear both writable and modify bit */
5103 ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5104 }
5105 if (attr & PROT_USER) {
5106 ttemaskp->tte_intlo |= TTE_PRIV_INT;
5107 ttevalue.tte_intlo |= TTE_PRIV_INT;
5108 }
5109 break;
5110 default:
5111 panic("sfmmu_vtop_attr: bad mode %x", mode);
5112 }
5113 ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5114 return (ttevalue.ll);
5115 }
5116
5117 static uint_t
5118 sfmmu_ptov_attr(tte_t *ttep)
5119 {
5120 uint_t attr;
5121
5122 ASSERT(TTE_IS_VALID(ttep));
5123
5124 attr = PROT_READ;
5125
5126 if (TTE_IS_WRITABLE(ttep)) {
5127 attr |= PROT_WRITE;
5128 }
5129 if (TTE_IS_EXECUTABLE(ttep)) {
5130 attr |= PROT_EXEC;
5131 }
5132 if (!TTE_IS_PRIVILEGED(ttep)) {
5133 attr |= PROT_USER;
5134 }
5135 if (TTE_IS_NFO(ttep)) {
5136 attr |= HAT_NOFAULT;
5137 }
5138 if (TTE_IS_NOSYNC(ttep)) {
5139 attr |= HAT_NOSYNC;
5140 }
5141 if (TTE_IS_SIDEFFECT(ttep)) {
5142 attr |= SFMMU_SIDEFFECT;
5143 }
5144 if (!TTE_IS_VCACHEABLE(ttep)) {
5145 attr |= SFMMU_UNCACHEVTTE;
5146 }
5147 if (!TTE_IS_PCACHEABLE(ttep)) {
5148 attr |= SFMMU_UNCACHEPTTE;
5149 }
5150 return (attr);
5151 }
5152
5153 /*
5154 * hat_chgprot is a deprecated hat call. New segment drivers
5155 * should store all attributes and use hat_*attr calls.
5156 *
5157 * Change the protections in the virtual address range
5158 * given to the specified virtual protection. If vprot is ~PROT_WRITE,
5159 * then remove write permission, leaving the other
5160 * permissions unchanged. If vprot is ~PROT_USER, remove user permissions.
5161 *
5162 */
5163 void
5164 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5165 {
5166 struct hmehash_bucket *hmebp;
5167 hmeblk_tag hblktag;
5168 int hmeshift, hashno = 1;
5169 struct hme_blk *hmeblkp, *list = NULL;
5170 caddr_t endaddr;
5171 cpuset_t cpuset;
5172 demap_range_t dmr;
5173
5174 ASSERT((len & MMU_PAGEOFFSET) == 0);
5175 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5176
5177 ASSERT(sfmmup->sfmmu_as != NULL);
5178
5179 CPUSET_ZERO(cpuset);
5180
5181 if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5182 ((addr + len) > (caddr_t)USERLIMIT)) {
5183 panic("user addr %p vprot %x in kernel space",
5184 (void *)addr, vprot);
5185 }
5186 endaddr = addr + len;
5187 hblktag.htag_id = sfmmup;
5188 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5189 DEMAP_RANGE_INIT(sfmmup, &dmr);
5190
5191 while (addr < endaddr) {
5192 hmeshift = HME_HASH_SHIFT(hashno);
5193 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5194 hblktag.htag_rehash = hashno;
5195 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5196
5197 SFMMU_HASH_LOCK(hmebp);
5198
5199 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5200 if (hmeblkp != NULL) {
5201 ASSERT(!hmeblkp->hblk_shared);
5202 /*
5203 * We've encountered a shadow hmeblk so skip the range
5204 * of the next smaller mapping size.
5205 */
5206 if (hmeblkp->hblk_shw_bit) {
5207 ASSERT(sfmmup != ksfmmup);
5208 ASSERT(hashno > 1);
5209 addr = (caddr_t)P2END((uintptr_t)addr,
5210 TTEBYTES(hashno - 1));
5211 } else {
5212 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5213 addr, endaddr, &dmr, vprot);
5214 }
5215 SFMMU_HASH_UNLOCK(hmebp);
5216 hashno = 1;
5217 continue;
5218 }
5219 SFMMU_HASH_UNLOCK(hmebp);
5220
5221 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5222 /*
5223 * We have traversed the whole list and rehashed
5224 * if necessary without finding the address to chgprot.
5225 * This is ok so we increment the address by the
5226 * smallest hmeblk range for kernel mappings and the
5227 * largest hmeblk range, to account for shadow hmeblks,
5228 * for user mappings and continue.
5229 */
5230 if (sfmmup == ksfmmup)
5231 addr = (caddr_t)P2END((uintptr_t)addr,
5232 TTEBYTES(1));
5233 else
5234 addr = (caddr_t)P2END((uintptr_t)addr,
5235 TTEBYTES(hashno));
5236 hashno = 1;
5237 } else {
5238 hashno++;
5239 }
5240 }
5241
5242 sfmmu_hblks_list_purge(&list, 0);
5243 DEMAP_RANGE_FLUSH(&dmr);
5244 cpuset = sfmmup->sfmmu_cpusran;
5245 xt_sync(cpuset);
5246 }
5247
5248 /*
5249 * This function chgprots a range of addresses in an hmeblk. It returns the
5250 * next addres that needs to be chgprot.
5251 * It should be called with the hash lock held.
5252 * XXX It shold be possible to optimize chgprot by not flushing every time but
5253 * on the other hand:
5254 * 1. do one flush crosscall.
5255 * 2. only flush if we are increasing permissions (make sure this will work)
5256 */
5257 static caddr_t
5258 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5259 caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5260 {
5261 uint_t pprot;
5262 tte_t tte, ttemod;
5263 struct sf_hment *sfhmep;
5264 uint_t tteflags;
5265 int ttesz;
5266 struct page *pp = NULL;
5267 kmutex_t *pml, *pmtx;
5268 int ret;
5269 int use_demap_range;
5270 #if defined(SF_ERRATA_57)
5271 int check_exec;
5272 #endif
5273
5274 ASSERT(in_hblk_range(hmeblkp, addr));
5275 ASSERT(hmeblkp->hblk_shw_bit == 0);
5276 ASSERT(!hmeblkp->hblk_shared);
5277
5278 #ifdef DEBUG
5279 if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5280 (endaddr < get_hblk_endaddr(hmeblkp))) {
5281 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5282 }
5283 #endif /* DEBUG */
5284
5285 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5286 ttesz = get_hblk_ttesz(hmeblkp);
5287
5288 pprot = sfmmu_vtop_prot(vprot, &tteflags);
5289 #if defined(SF_ERRATA_57)
5290 check_exec = (sfmmup != ksfmmup) &&
5291 AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5292 ((vprot & PROT_EXEC) == PROT_EXEC);
5293 #endif
5294 HBLKTOHME(sfhmep, hmeblkp, addr);
5295
5296 /*
5297 * Flush the current demap region if addresses have been
5298 * skipped or the page size doesn't match.
5299 */
5300 use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5301 if (use_demap_range) {
5302 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5303 } else if (dmrp != NULL) {
5304 DEMAP_RANGE_FLUSH(dmrp);
5305 }
5306
5307 while (addr < endaddr) {
5308 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5309 if (TTE_IS_VALID(&tte)) {
5310 if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5311 /*
5312 * if the new protection is the same as old
5313 * continue
5314 */
5315 goto next_addr;
5316 }
5317 pml = NULL;
5318 pp = sfhmep->hme_page;
5319 if (pp) {
5320 pml = sfmmu_mlist_enter(pp);
5321 }
5322 if (pp != sfhmep->hme_page) {
5323 /*
5324 * tte most have been unloaded
5325 * underneath us. Recheck
5326 */
5327 ASSERT(pml);
5328 sfmmu_mlist_exit(pml);
5329 continue;
5330 }
5331
5332 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5333
5334 ttemod = tte;
5335 TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5336 #if defined(SF_ERRATA_57)
5337 if (check_exec && addr < errata57_limit)
5338 ttemod.tte_exec_perm = 0;
5339 #endif
5340 ret = sfmmu_modifytte_try(&tte, &ttemod,
5341 &sfhmep->hme_tte);
5342
5343 if (ret < 0) {
5344 /* tte changed underneath us */
5345 if (pml) {
5346 sfmmu_mlist_exit(pml);
5347 }
5348 continue;
5349 }
5350
5351 if (tteflags & TTE_HWWR_INT) {
5352 /*
5353 * need to sync if we are clearing modify bit.
5354 */
5355 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5356 }
5357
5358 if (pp && PP_ISRO(pp)) {
5359 if (pprot & TTE_WRPRM_INT) {
5360 pmtx = sfmmu_page_enter(pp);
5361 PP_CLRRO(pp);
5362 sfmmu_page_exit(pmtx);
5363 }
5364 }
5365
5366 if (ret > 0 && use_demap_range) {
5367 DEMAP_RANGE_MARKPG(dmrp, addr);
5368 } else if (ret > 0) {
5369 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5370 }
5371
5372 if (pml) {
5373 sfmmu_mlist_exit(pml);
5374 }
5375 }
5376 next_addr:
5377 addr += TTEBYTES(ttesz);
5378 sfhmep++;
5379 DEMAP_RANGE_NEXTPG(dmrp);
5380 }
5381 return (addr);
5382 }
5383
5384 /*
5385 * This routine is deprecated and should only be used by hat_chgprot.
5386 * The correct routine is sfmmu_vtop_attr.
5387 * This routine converts virtual page protections to physical ones. It will
5388 * update the tteflags field with the tte mask corresponding to the protections
5389 * affected and it returns the new protections. It will also clear the modify
5390 * bit if we are taking away write permission. This is necessary since the
5391 * modify bit is the hardware permission bit and we need to clear it in order
5392 * to detect write faults.
5393 * It accepts the following special protections:
5394 * ~PROT_WRITE = remove write permissions.
5395 * ~PROT_USER = remove user permissions.
5396 */
5397 static uint_t
5398 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5399 {
5400 if (vprot == (uint_t)~PROT_WRITE) {
5401 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5402 return (0); /* will cause wrprm to be cleared */
5403 }
5404 if (vprot == (uint_t)~PROT_USER) {
5405 *tteflagsp = TTE_PRIV_INT;
5406 return (0); /* will cause privprm to be cleared */
5407 }
5408 if ((vprot == 0) || (vprot == PROT_USER) ||
5409 ((vprot & PROT_ALL) != vprot)) {
5410 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5411 }
5412
5413 switch (vprot) {
5414 case (PROT_READ):
5415 case (PROT_EXEC):
5416 case (PROT_EXEC | PROT_READ):
5417 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5418 return (TTE_PRIV_INT); /* set prv and clr wrt */
5419 case (PROT_WRITE):
5420 case (PROT_WRITE | PROT_READ):
5421 case (PROT_EXEC | PROT_WRITE):
5422 case (PROT_EXEC | PROT_WRITE | PROT_READ):
5423 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5424 return (TTE_PRIV_INT | TTE_WRPRM_INT); /* set prv and wrt */
5425 case (PROT_USER | PROT_READ):
5426 case (PROT_USER | PROT_EXEC):
5427 case (PROT_USER | PROT_EXEC | PROT_READ):
5428 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5429 return (0); /* clr prv and wrt */
5430 case (PROT_USER | PROT_WRITE):
5431 case (PROT_USER | PROT_WRITE | PROT_READ):
5432 case (PROT_USER | PROT_EXEC | PROT_WRITE):
5433 case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5434 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5435 return (TTE_WRPRM_INT); /* clr prv and set wrt */
5436 default:
5437 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5438 }
5439 return (0);
5440 }
5441
5442 /*
5443 * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5444 * the normal algorithm would take too long for a very large VA range with
5445 * few real mappings. This routine just walks thru all HMEs in the global
5446 * hash table to find and remove mappings.
5447 */
5448 static void
5449 hat_unload_large_virtual(
5450 struct hat *sfmmup,
5451 caddr_t startaddr,
5452 size_t len,
5453 uint_t flags,
5454 hat_callback_t *callback)
5455 {
5456 struct hmehash_bucket *hmebp;
5457 struct hme_blk *hmeblkp;
5458 struct hme_blk *pr_hblk = NULL;
5459 struct hme_blk *nx_hblk;
5460 struct hme_blk *list = NULL;
5461 int i;
5462 demap_range_t dmr, *dmrp;
5463 cpuset_t cpuset;
5464 caddr_t endaddr = startaddr + len;
5465 caddr_t sa;
5466 caddr_t ea;
5467 caddr_t cb_sa[MAX_CB_ADDR];
5468 caddr_t cb_ea[MAX_CB_ADDR];
5469 int addr_cnt = 0;
5470 int a = 0;
5471
5472 if (sfmmup->sfmmu_free) {
5473 dmrp = NULL;
5474 } else {
5475 dmrp = &dmr;
5476 DEMAP_RANGE_INIT(sfmmup, dmrp);
5477 }
5478
5479 /*
5480 * Loop through all the hash buckets of HME blocks looking for matches.
5481 */
5482 for (i = 0; i <= UHMEHASH_SZ; i++) {
5483 hmebp = &uhme_hash[i];
5484 SFMMU_HASH_LOCK(hmebp);
5485 hmeblkp = hmebp->hmeblkp;
5486 pr_hblk = NULL;
5487 while (hmeblkp) {
5488 nx_hblk = hmeblkp->hblk_next;
5489
5490 /*
5491 * skip if not this context, if a shadow block or
5492 * if the mapping is not in the requested range
5493 */
5494 if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5495 hmeblkp->hblk_shw_bit ||
5496 (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5497 (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5498 pr_hblk = hmeblkp;
5499 goto next_block;
5500 }
5501
5502 ASSERT(!hmeblkp->hblk_shared);
5503 /*
5504 * unload if there are any current valid mappings
5505 */
5506 if (hmeblkp->hblk_vcnt != 0 ||
5507 hmeblkp->hblk_hmecnt != 0)
5508 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5509 sa, ea, dmrp, flags);
5510
5511 /*
5512 * on unmap we also release the HME block itself, once
5513 * all mappings are gone.
5514 */
5515 if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5516 !hmeblkp->hblk_vcnt &&
5517 !hmeblkp->hblk_hmecnt) {
5518 ASSERT(!hmeblkp->hblk_lckcnt);
5519 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5520 &list, 0);
5521 } else {
5522 pr_hblk = hmeblkp;
5523 }
5524
5525 if (callback == NULL)
5526 goto next_block;
5527
5528 /*
5529 * HME blocks may span more than one page, but we may be
5530 * unmapping only one page, so check for a smaller range
5531 * for the callback
5532 */
5533 if (sa < startaddr)
5534 sa = startaddr;
5535 if (--ea > endaddr)
5536 ea = endaddr - 1;
5537
5538 cb_sa[addr_cnt] = sa;
5539 cb_ea[addr_cnt] = ea;
5540 if (++addr_cnt == MAX_CB_ADDR) {
5541 if (dmrp != NULL) {
5542 DEMAP_RANGE_FLUSH(dmrp);
5543 cpuset = sfmmup->sfmmu_cpusran;
5544 xt_sync(cpuset);
5545 }
5546
5547 for (a = 0; a < MAX_CB_ADDR; ++a) {
5548 callback->hcb_start_addr = cb_sa[a];
5549 callback->hcb_end_addr = cb_ea[a];
5550 callback->hcb_function(callback);
5551 }
5552 addr_cnt = 0;
5553 }
5554
5555 next_block:
5556 hmeblkp = nx_hblk;
5557 }
5558 SFMMU_HASH_UNLOCK(hmebp);
5559 }
5560
5561 sfmmu_hblks_list_purge(&list, 0);
5562 if (dmrp != NULL) {
5563 DEMAP_RANGE_FLUSH(dmrp);
5564 cpuset = sfmmup->sfmmu_cpusran;
5565 xt_sync(cpuset);
5566 }
5567
5568 for (a = 0; a < addr_cnt; ++a) {
5569 callback->hcb_start_addr = cb_sa[a];
5570 callback->hcb_end_addr = cb_ea[a];
5571 callback->hcb_function(callback);
5572 }
5573
5574 /*
5575 * Check TSB and TLB page sizes if the process isn't exiting.
5576 */
5577 if (!sfmmup->sfmmu_free)
5578 sfmmu_check_page_sizes(sfmmup, 0);
5579 }
5580
5581 /*
5582 * Unload all the mappings in the range [addr..addr+len). addr and len must
5583 * be MMU_PAGESIZE aligned.
5584 */
5585
5586 extern struct seg *segkmap;
5587 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5588 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5589
5590
5591 void
5592 hat_unload_callback(
5593 struct hat *sfmmup,
5594 caddr_t addr,
5595 size_t len,
5596 uint_t flags,
5597 hat_callback_t *callback)
5598 {
5599 struct hmehash_bucket *hmebp;
5600 hmeblk_tag hblktag;
5601 int hmeshift, hashno, iskernel;
5602 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5603 caddr_t endaddr;
5604 cpuset_t cpuset;
5605 int addr_count = 0;
5606 int a;
5607 caddr_t cb_start_addr[MAX_CB_ADDR];
5608 caddr_t cb_end_addr[MAX_CB_ADDR];
5609 int issegkmap = ISSEGKMAP(sfmmup, addr);
5610 demap_range_t dmr, *dmrp;
5611
5612 ASSERT(sfmmup->sfmmu_as != NULL);
5613
5614 ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5615 AS_LOCK_HELD(sfmmup->sfmmu_as));
5616
5617 ASSERT(sfmmup != NULL);
5618 ASSERT((len & MMU_PAGEOFFSET) == 0);
5619 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5620
5621 /*
5622 * Probing through a large VA range (say 63 bits) will be slow, even
5623 * at 4 Meg steps between the probes. So, when the virtual address range
5624 * is very large, search the HME entries for what to unload.
5625 *
5626 * len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5627 *
5628 * UHMEHASH_SZ is number of hash buckets to examine
5629 *
5630 */
5631 if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5632 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5633 return;
5634 }
5635
5636 CPUSET_ZERO(cpuset);
5637
5638 /*
5639 * If the process is exiting, we can save a lot of fuss since
5640 * we'll flush the TLB when we free the ctx anyway.
5641 */
5642 if (sfmmup->sfmmu_free) {
5643 dmrp = NULL;
5644 } else {
5645 dmrp = &dmr;
5646 DEMAP_RANGE_INIT(sfmmup, dmrp);
5647 }
5648
5649 endaddr = addr + len;
5650 hblktag.htag_id = sfmmup;
5651 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5652
5653 /*
5654 * It is likely for the vm to call unload over a wide range of
5655 * addresses that are actually very sparsely populated by
5656 * translations. In order to speed this up the sfmmu hat supports
5657 * the concept of shadow hmeblks. Dummy large page hmeblks that
5658 * correspond to actual small translations are allocated at tteload
5659 * time and are referred to as shadow hmeblks. Now, during unload
5660 * time, we first check if we have a shadow hmeblk for that
5661 * translation. The absence of one means the corresponding address
5662 * range is empty and can be skipped.
5663 *
5664 * The kernel is an exception to above statement and that is why
5665 * we don't use shadow hmeblks and hash starting from the smallest
5666 * page size.
5667 */
5668 if (sfmmup == KHATID) {
5669 iskernel = 1;
5670 hashno = TTE64K;
5671 } else {
5672 iskernel = 0;
5673 if (mmu_page_sizes == max_mmu_page_sizes) {
5674 hashno = TTE256M;
5675 } else {
5676 hashno = TTE4M;
5677 }
5678 }
5679 while (addr < endaddr) {
5680 hmeshift = HME_HASH_SHIFT(hashno);
5681 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5682 hblktag.htag_rehash = hashno;
5683 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5684
5685 SFMMU_HASH_LOCK(hmebp);
5686
5687 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5688 if (hmeblkp == NULL) {
5689 /*
5690 * didn't find an hmeblk. skip the appropiate
5691 * address range.
5692 */
5693 SFMMU_HASH_UNLOCK(hmebp);
5694 if (iskernel) {
5695 if (hashno < mmu_hashcnt) {
5696 hashno++;
5697 continue;
5698 } else {
5699 hashno = TTE64K;
5700 addr = (caddr_t)roundup((uintptr_t)addr
5701 + 1, MMU_PAGESIZE64K);
5702 continue;
5703 }
5704 }
5705 addr = (caddr_t)roundup((uintptr_t)addr + 1,
5706 (1 << hmeshift));
5707 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5708 ASSERT(hashno == TTE64K);
5709 continue;
5710 }
5711 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5712 hashno = TTE512K;
5713 continue;
5714 }
5715 if (mmu_page_sizes == max_mmu_page_sizes) {
5716 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5717 hashno = TTE4M;
5718 continue;
5719 }
5720 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5721 hashno = TTE32M;
5722 continue;
5723 }
5724 hashno = TTE256M;
5725 continue;
5726 } else {
5727 hashno = TTE4M;
5728 continue;
5729 }
5730 }
5731 ASSERT(hmeblkp);
5732 ASSERT(!hmeblkp->hblk_shared);
5733 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5734 /*
5735 * If the valid count is zero we can skip the range
5736 * mapped by this hmeblk.
5737 * We free hblks in the case of HAT_UNMAP. HAT_UNMAP
5738 * is used by segment drivers as a hint
5739 * that the mapping resource won't be used any longer.
5740 * The best example of this is during exit().
5741 */
5742 addr = (caddr_t)roundup((uintptr_t)addr + 1,
5743 get_hblk_span(hmeblkp));
5744 if ((flags & HAT_UNLOAD_UNMAP) ||
5745 (iskernel && !issegkmap)) {
5746 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5747 &list, 0);
5748 }
5749 SFMMU_HASH_UNLOCK(hmebp);
5750
5751 if (iskernel) {
5752 hashno = TTE64K;
5753 continue;
5754 }
5755 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5756 ASSERT(hashno == TTE64K);
5757 continue;
5758 }
5759 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5760 hashno = TTE512K;
5761 continue;
5762 }
5763 if (mmu_page_sizes == max_mmu_page_sizes) {
5764 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5765 hashno = TTE4M;
5766 continue;
5767 }
5768 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5769 hashno = TTE32M;
5770 continue;
5771 }
5772 hashno = TTE256M;
5773 continue;
5774 } else {
5775 hashno = TTE4M;
5776 continue;
5777 }
5778 }
5779 if (hmeblkp->hblk_shw_bit) {
5780 /*
5781 * If we encounter a shadow hmeblk we know there is
5782 * smaller sized hmeblks mapping the same address space.
5783 * Decrement the hash size and rehash.
5784 */
5785 ASSERT(sfmmup != KHATID);
5786 hashno--;
5787 SFMMU_HASH_UNLOCK(hmebp);
5788 continue;
5789 }
5790
5791 /*
5792 * track callback address ranges.
5793 * only start a new range when it's not contiguous
5794 */
5795 if (callback != NULL) {
5796 if (addr_count > 0 &&
5797 addr == cb_end_addr[addr_count - 1])
5798 --addr_count;
5799 else
5800 cb_start_addr[addr_count] = addr;
5801 }
5802
5803 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5804 dmrp, flags);
5805
5806 if (callback != NULL)
5807 cb_end_addr[addr_count++] = addr;
5808
5809 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5810 !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5811 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5812 }
5813 SFMMU_HASH_UNLOCK(hmebp);
5814
5815 /*
5816 * Notify our caller as to exactly which pages
5817 * have been unloaded. We do these in clumps,
5818 * to minimize the number of xt_sync()s that need to occur.
5819 */
5820 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5821 if (dmrp != NULL) {
5822 DEMAP_RANGE_FLUSH(dmrp);
5823 cpuset = sfmmup->sfmmu_cpusran;
5824 xt_sync(cpuset);
5825 }
5826
5827 for (a = 0; a < MAX_CB_ADDR; ++a) {
5828 callback->hcb_start_addr = cb_start_addr[a];
5829 callback->hcb_end_addr = cb_end_addr[a];
5830 callback->hcb_function(callback);
5831 }
5832 addr_count = 0;
5833 }
5834 if (iskernel) {
5835 hashno = TTE64K;
5836 continue;
5837 }
5838 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5839 ASSERT(hashno == TTE64K);
5840 continue;
5841 }
5842 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5843 hashno = TTE512K;
5844 continue;
5845 }
5846 if (mmu_page_sizes == max_mmu_page_sizes) {
5847 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5848 hashno = TTE4M;
5849 continue;
5850 }
5851 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5852 hashno = TTE32M;
5853 continue;
5854 }
5855 hashno = TTE256M;
5856 } else {
5857 hashno = TTE4M;
5858 }
5859 }
5860
5861 sfmmu_hblks_list_purge(&list, 0);
5862 if (dmrp != NULL) {
5863 DEMAP_RANGE_FLUSH(dmrp);
5864 cpuset = sfmmup->sfmmu_cpusran;
5865 xt_sync(cpuset);
5866 }
5867 if (callback && addr_count != 0) {
5868 for (a = 0; a < addr_count; ++a) {
5869 callback->hcb_start_addr = cb_start_addr[a];
5870 callback->hcb_end_addr = cb_end_addr[a];
5871 callback->hcb_function(callback);
5872 }
5873 }
5874
5875 /*
5876 * Check TSB and TLB page sizes if the process isn't exiting.
5877 */
5878 if (!sfmmup->sfmmu_free)
5879 sfmmu_check_page_sizes(sfmmup, 0);
5880 }
5881
5882 /*
5883 * Unload all the mappings in the range [addr..addr+len). addr and len must
5884 * be MMU_PAGESIZE aligned.
5885 */
5886 void
5887 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5888 {
5889 hat_unload_callback(sfmmup, addr, len, flags, NULL);
5890 }
5891
5892
5893 /*
5894 * Find the largest mapping size for this page.
5895 */
5896 int
5897 fnd_mapping_sz(page_t *pp)
5898 {
5899 int sz;
5900 int p_index;
5901
5902 p_index = PP_MAPINDEX(pp);
5903
5904 sz = 0;
5905 p_index >>= 1; /* don't care about 8K bit */
5906 for (; p_index; p_index >>= 1) {
5907 sz++;
5908 }
5909
5910 return (sz);
5911 }
5912
5913 /*
5914 * This function unloads a range of addresses for an hmeblk.
5915 * It returns the next address to be unloaded.
5916 * It should be called with the hash lock held.
5917 */
5918 static caddr_t
5919 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5920 caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
5921 {
5922 tte_t tte, ttemod;
5923 struct sf_hment *sfhmep;
5924 int ttesz;
5925 long ttecnt;
5926 page_t *pp;
5927 kmutex_t *pml;
5928 int ret;
5929 int use_demap_range;
5930
5931 ASSERT(in_hblk_range(hmeblkp, addr));
5932 ASSERT(!hmeblkp->hblk_shw_bit);
5933 ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
5934 ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
5935 ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
5936
5937 #ifdef DEBUG
5938 if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5939 (endaddr < get_hblk_endaddr(hmeblkp))) {
5940 panic("sfmmu_hblk_unload: partial unload of large page");
5941 }
5942 #endif /* DEBUG */
5943
5944 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5945 ttesz = get_hblk_ttesz(hmeblkp);
5946
5947 use_demap_range = ((dmrp == NULL) ||
5948 (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
5949
5950 if (use_demap_range) {
5951 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5952 } else if (dmrp != NULL) {
5953 DEMAP_RANGE_FLUSH(dmrp);
5954 }
5955 ttecnt = 0;
5956 HBLKTOHME(sfhmep, hmeblkp, addr);
5957
5958 while (addr < endaddr) {
5959 pml = NULL;
5960 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5961 if (TTE_IS_VALID(&tte)) {
5962 pp = sfhmep->hme_page;
5963 if (pp != NULL) {
5964 pml = sfmmu_mlist_enter(pp);
5965 }
5966
5967 /*
5968 * Verify if hme still points to 'pp' now that
5969 * we have p_mapping lock.
5970 */
5971 if (sfhmep->hme_page != pp) {
5972 if (pp != NULL && sfhmep->hme_page != NULL) {
5973 ASSERT(pml != NULL);
5974 sfmmu_mlist_exit(pml);
5975 /* Re-start this iteration. */
5976 continue;
5977 }
5978 ASSERT((pp != NULL) &&
5979 (sfhmep->hme_page == NULL));
5980 goto tte_unloaded;
5981 }
5982
5983 /*
5984 * This point on we have both HASH and p_mapping
5985 * lock.
5986 */
5987 ASSERT(pp == sfhmep->hme_page);
5988 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5989
5990 /*
5991 * We need to loop on modify tte because it is
5992 * possible for pagesync to come along and
5993 * change the software bits beneath us.
5994 *
5995 * Page_unload can also invalidate the tte after
5996 * we read tte outside of p_mapping lock.
5997 */
5998 again:
5999 ttemod = tte;
6000
6001 TTE_SET_INVALID(&ttemod);
6002 ret = sfmmu_modifytte_try(&tte, &ttemod,
6003 &sfhmep->hme_tte);
6004
6005 if (ret <= 0) {
6006 if (TTE_IS_VALID(&tte)) {
6007 ASSERT(ret < 0);
6008 goto again;
6009 }
6010 if (pp != NULL) {
6011 panic("sfmmu_hblk_unload: pp = 0x%p "
6012 "tte became invalid under mlist"
6013 " lock = 0x%p", (void *)pp,
6014 (void *)pml);
6015 }
6016 continue;
6017 }
6018
6019 if (!(flags & HAT_UNLOAD_NOSYNC)) {
6020 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6021 }
6022
6023 /*
6024 * Ok- we invalidated the tte. Do the rest of the job.
6025 */
6026 ttecnt++;
6027
6028 if (flags & HAT_UNLOAD_UNLOCK) {
6029 ASSERT(hmeblkp->hblk_lckcnt > 0);
6030 atomic_dec_32(&hmeblkp->hblk_lckcnt);
6031 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6032 }
6033
6034 /*
6035 * Normally we would need to flush the page
6036 * from the virtual cache at this point in
6037 * order to prevent a potential cache alias
6038 * inconsistency.
6039 * The particular scenario we need to worry
6040 * about is:
6041 * Given: va1 and va2 are two virtual address
6042 * that alias and map the same physical
6043 * address.
6044 * 1. mapping exists from va1 to pa and data
6045 * has been read into the cache.
6046 * 2. unload va1.
6047 * 3. load va2 and modify data using va2.
6048 * 4 unload va2.
6049 * 5. load va1 and reference data. Unless we
6050 * flush the data cache when we unload we will
6051 * get stale data.
6052 * Fortunately, page coloring eliminates the
6053 * above scenario by remembering the color a
6054 * physical page was last or is currently
6055 * mapped to. Now, we delay the flush until
6056 * the loading of translations. Only when the
6057 * new translation is of a different color
6058 * are we forced to flush.
6059 */
6060 if (use_demap_range) {
6061 /*
6062 * Mark this page as needing a demap.
6063 */
6064 DEMAP_RANGE_MARKPG(dmrp, addr);
6065 } else {
6066 ASSERT(sfmmup != NULL);
6067 ASSERT(!hmeblkp->hblk_shared);
6068 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6069 sfmmup->sfmmu_free, 0);
6070 }
6071
6072 if (pp) {
6073 /*
6074 * Remove the hment from the mapping list
6075 */
6076 ASSERT(hmeblkp->hblk_hmecnt > 0);
6077
6078 /*
6079 * Again, we cannot
6080 * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6081 */
6082 HME_SUB(sfhmep, pp);
6083 membar_stst();
6084 atomic_dec_16(&hmeblkp->hblk_hmecnt);
6085 }
6086
6087 ASSERT(hmeblkp->hblk_vcnt > 0);
6088 atomic_dec_16(&hmeblkp->hblk_vcnt);
6089
6090 ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6091 !hmeblkp->hblk_lckcnt);
6092
6093 #ifdef VAC
6094 if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6095 if (PP_ISTNC(pp)) {
6096 /*
6097 * If page was temporary
6098 * uncached, try to recache
6099 * it. Note that HME_SUB() was
6100 * called above so p_index and
6101 * mlist had been updated.
6102 */
6103 conv_tnc(pp, ttesz);
6104 } else if (pp->p_mapping == NULL) {
6105 ASSERT(kpm_enable);
6106 /*
6107 * Page is marked to be in VAC conflict
6108 * to an existing kpm mapping and/or is
6109 * kpm mapped using only the regular
6110 * pagesize.
6111 */
6112 sfmmu_kpm_hme_unload(pp);
6113 }
6114 }
6115 #endif /* VAC */
6116 } else if ((pp = sfhmep->hme_page) != NULL) {
6117 /*
6118 * TTE is invalid but the hme
6119 * still exists. let pageunload
6120 * complete its job.
6121 */
6122 ASSERT(pml == NULL);
6123 pml = sfmmu_mlist_enter(pp);
6124 if (sfhmep->hme_page != NULL) {
6125 sfmmu_mlist_exit(pml);
6126 continue;
6127 }
6128 ASSERT(sfhmep->hme_page == NULL);
6129 } else if (hmeblkp->hblk_hmecnt != 0) {
6130 /*
6131 * pageunload may have not finished decrementing
6132 * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6133 * wait for pageunload to finish. Rely on pageunload
6134 * to decrement hblk_hmecnt after hblk_vcnt.
6135 */
6136 pfn_t pfn = TTE_TO_TTEPFN(&tte);
6137 ASSERT(pml == NULL);
6138 if (pf_is_memory(pfn)) {
6139 pp = page_numtopp_nolock(pfn);
6140 if (pp != NULL) {
6141 pml = sfmmu_mlist_enter(pp);
6142 sfmmu_mlist_exit(pml);
6143 pml = NULL;
6144 }
6145 }
6146 }
6147
6148 tte_unloaded:
6149 /*
6150 * At this point, the tte we are looking at
6151 * should be unloaded, and hme has been unlinked
6152 * from page too. This is important because in
6153 * pageunload, it does ttesync() then HME_SUB.
6154 * We need to make sure HME_SUB has been completed
6155 * so we know ttesync() has been completed. Otherwise,
6156 * at exit time, after return from hat layer, VM will
6157 * release as structure which hat_setstat() (called
6158 * by ttesync()) needs.
6159 */
6160 #ifdef DEBUG
6161 {
6162 tte_t dtte;
6163
6164 ASSERT(sfhmep->hme_page == NULL);
6165
6166 sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6167 ASSERT(!TTE_IS_VALID(&dtte));
6168 }
6169 #endif
6170
6171 if (pml) {
6172 sfmmu_mlist_exit(pml);
6173 }
6174
6175 addr += TTEBYTES(ttesz);
6176 sfhmep++;
6177 DEMAP_RANGE_NEXTPG(dmrp);
6178 }
6179 /*
6180 * For shared hmeblks this routine is only called when region is freed
6181 * and no longer referenced. So no need to decrement ttecnt
6182 * in the region structure here.
6183 */
6184 if (ttecnt > 0 && sfmmup != NULL) {
6185 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6186 }
6187 return (addr);
6188 }
6189
6190 /*
6191 * Flush the TLB for the local CPU
6192 * Invoked from a slave CPU during panic() dumps.
6193 */
6194 void
6195 hat_flush(void)
6196 {
6197 vtag_flushall();
6198 }
6199
6200 /*
6201 * Synchronize all the mappings in the range [addr..addr+len).
6202 * Can be called with clearflag having two states:
6203 * HAT_SYNC_DONTZERO means just return the rm stats
6204 * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6205 */
6206 void
6207 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6208 {
6209 struct hmehash_bucket *hmebp;
6210 hmeblk_tag hblktag;
6211 int hmeshift, hashno = 1;
6212 struct hme_blk *hmeblkp, *list = NULL;
6213 caddr_t endaddr;
6214 cpuset_t cpuset;
6215
6216 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6217 ASSERT((len & MMU_PAGEOFFSET) == 0);
6218 ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6219 (clearflag == HAT_SYNC_ZERORM));
6220
6221 CPUSET_ZERO(cpuset);
6222
6223 endaddr = addr + len;
6224 hblktag.htag_id = sfmmup;
6225 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6226
6227 /*
6228 * Spitfire supports 4 page sizes.
6229 * Most pages are expected to be of the smallest page
6230 * size (8K) and these will not need to be rehashed. 64K
6231 * pages also don't need to be rehashed because the an hmeblk
6232 * spans 64K of address space. 512K pages might need 1 rehash and
6233 * and 4M pages 2 rehashes.
6234 */
6235 while (addr < endaddr) {
6236 hmeshift = HME_HASH_SHIFT(hashno);
6237 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6238 hblktag.htag_rehash = hashno;
6239 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6240
6241 SFMMU_HASH_LOCK(hmebp);
6242
6243 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6244 if (hmeblkp != NULL) {
6245 ASSERT(!hmeblkp->hblk_shared);
6246 /*
6247 * We've encountered a shadow hmeblk so skip the range
6248 * of the next smaller mapping size.
6249 */
6250 if (hmeblkp->hblk_shw_bit) {
6251 ASSERT(sfmmup != ksfmmup);
6252 ASSERT(hashno > 1);
6253 addr = (caddr_t)P2END((uintptr_t)addr,
6254 TTEBYTES(hashno - 1));
6255 } else {
6256 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6257 addr, endaddr, clearflag);
6258 }
6259 SFMMU_HASH_UNLOCK(hmebp);
6260 hashno = 1;
6261 continue;
6262 }
6263 SFMMU_HASH_UNLOCK(hmebp);
6264
6265 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6266 /*
6267 * We have traversed the whole list and rehashed
6268 * if necessary without finding the address to sync.
6269 * This is ok so we increment the address by the
6270 * smallest hmeblk range for kernel mappings and the
6271 * largest hmeblk range, to account for shadow hmeblks,
6272 * for user mappings and continue.
6273 */
6274 if (sfmmup == ksfmmup)
6275 addr = (caddr_t)P2END((uintptr_t)addr,
6276 TTEBYTES(1));
6277 else
6278 addr = (caddr_t)P2END((uintptr_t)addr,
6279 TTEBYTES(hashno));
6280 hashno = 1;
6281 } else {
6282 hashno++;
6283 }
6284 }
6285 sfmmu_hblks_list_purge(&list, 0);
6286 cpuset = sfmmup->sfmmu_cpusran;
6287 xt_sync(cpuset);
6288 }
6289
6290 static caddr_t
6291 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6292 caddr_t endaddr, int clearflag)
6293 {
6294 tte_t tte, ttemod;
6295 struct sf_hment *sfhmep;
6296 int ttesz;
6297 struct page *pp;
6298 kmutex_t *pml;
6299 int ret;
6300
6301 ASSERT(hmeblkp->hblk_shw_bit == 0);
6302 ASSERT(!hmeblkp->hblk_shared);
6303
6304 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6305
6306 ttesz = get_hblk_ttesz(hmeblkp);
6307 HBLKTOHME(sfhmep, hmeblkp, addr);
6308
6309 while (addr < endaddr) {
6310 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6311 if (TTE_IS_VALID(&tte)) {
6312 pml = NULL;
6313 pp = sfhmep->hme_page;
6314 if (pp) {
6315 pml = sfmmu_mlist_enter(pp);
6316 }
6317 if (pp != sfhmep->hme_page) {
6318 /*
6319 * tte most have been unloaded
6320 * underneath us. Recheck
6321 */
6322 ASSERT(pml);
6323 sfmmu_mlist_exit(pml);
6324 continue;
6325 }
6326
6327 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6328
6329 if (clearflag == HAT_SYNC_ZERORM) {
6330 ttemod = tte;
6331 TTE_CLR_RM(&ttemod);
6332 ret = sfmmu_modifytte_try(&tte, &ttemod,
6333 &sfhmep->hme_tte);
6334 if (ret < 0) {
6335 if (pml) {
6336 sfmmu_mlist_exit(pml);
6337 }
6338 continue;
6339 }
6340
6341 if (ret > 0) {
6342 sfmmu_tlb_demap(addr, sfmmup,
6343 hmeblkp, 0, 0);
6344 }
6345 }
6346 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6347 if (pml) {
6348 sfmmu_mlist_exit(pml);
6349 }
6350 }
6351 addr += TTEBYTES(ttesz);
6352 sfhmep++;
6353 }
6354 return (addr);
6355 }
6356
6357 /*
6358 * This function will sync a tte to the page struct and it will
6359 * update the hat stats. Currently it allows us to pass a NULL pp
6360 * and we will simply update the stats. We may want to change this
6361 * so we only keep stats for pages backed by pp's.
6362 */
6363 static void
6364 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6365 {
6366 uint_t rm = 0;
6367 int sz;
6368 pgcnt_t npgs;
6369
6370 ASSERT(TTE_IS_VALID(ttep));
6371
6372 if (TTE_IS_NOSYNC(ttep)) {
6373 return;
6374 }
6375
6376 if (TTE_IS_REF(ttep)) {
6377 rm = P_REF;
6378 }
6379 if (TTE_IS_MOD(ttep)) {
6380 rm |= P_MOD;
6381 }
6382
6383 if (rm == 0) {
6384 return;
6385 }
6386
6387 sz = TTE_CSZ(ttep);
6388 if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6389 int i;
6390 caddr_t vaddr = addr;
6391
6392 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6393 hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6394 }
6395
6396 }
6397
6398 /*
6399 * XXX I want to use cas to update nrm bits but they
6400 * currently belong in common/vm and not in hat where
6401 * they should be.
6402 * The nrm bits are protected by the same mutex as
6403 * the one that protects the page's mapping list.
6404 */
6405 if (!pp)
6406 return;
6407 ASSERT(sfmmu_mlist_held(pp));
6408 /*
6409 * If the tte is for a large page, we need to sync all the
6410 * pages covered by the tte.
6411 */
6412 if (sz != TTE8K) {
6413 ASSERT(pp->p_szc != 0);
6414 pp = PP_GROUPLEADER(pp, sz);
6415 ASSERT(sfmmu_mlist_held(pp));
6416 }
6417
6418 /* Get number of pages from tte size. */
6419 npgs = TTEPAGES(sz);
6420
6421 do {
6422 ASSERT(pp);
6423 ASSERT(sfmmu_mlist_held(pp));
6424 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6425 ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6426 hat_page_setattr(pp, rm);
6427
6428 /*
6429 * Are we done? If not, we must have a large mapping.
6430 * For large mappings we need to sync the rest of the pages
6431 * covered by this tte; goto the next page.
6432 */
6433 } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6434 }
6435
6436 /*
6437 * Execute pre-callback handler of each pa_hment linked to pp
6438 *
6439 * Inputs:
6440 * flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6441 * capture_cpus: pointer to return value (below)
6442 *
6443 * Returns:
6444 * Propagates the subsystem callback return values back to the caller;
6445 * returns 0 on success. If capture_cpus is non-NULL, the value returned
6446 * is zero if all of the pa_hments are of a type that do not require
6447 * capturing CPUs prior to suspending the mapping, else it is 1.
6448 */
6449 static int
6450 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6451 {
6452 struct sf_hment *sfhmep;
6453 struct pa_hment *pahmep;
6454 int (*f)(caddr_t, uint_t, uint_t, void *);
6455 int ret;
6456 id_t id;
6457 int locked = 0;
6458 kmutex_t *pml;
6459
6460 ASSERT(PAGE_EXCL(pp));
6461 if (!sfmmu_mlist_held(pp)) {
6462 pml = sfmmu_mlist_enter(pp);
6463 locked = 1;
6464 }
6465
6466 if (capture_cpus)
6467 *capture_cpus = 0;
6468
6469 top:
6470 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6471 /*
6472 * skip sf_hments corresponding to VA<->PA mappings;
6473 * for pa_hment's, hme_tte.ll is zero
6474 */
6475 if (!IS_PAHME(sfhmep))
6476 continue;
6477
6478 pahmep = sfhmep->hme_data;
6479 ASSERT(pahmep != NULL);
6480
6481 /*
6482 * skip if pre-handler has been called earlier in this loop
6483 */
6484 if (pahmep->flags & flag)
6485 continue;
6486
6487 id = pahmep->cb_id;
6488 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6489 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6490 *capture_cpus = 1;
6491 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6492 pahmep->flags |= flag;
6493 continue;
6494 }
6495
6496 /*
6497 * Drop the mapping list lock to avoid locking order issues.
6498 */
6499 if (locked)
6500 sfmmu_mlist_exit(pml);
6501
6502 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6503 if (ret != 0)
6504 return (ret); /* caller must do the cleanup */
6505
6506 if (locked) {
6507 pml = sfmmu_mlist_enter(pp);
6508 pahmep->flags |= flag;
6509 goto top;
6510 }
6511
6512 pahmep->flags |= flag;
6513 }
6514
6515 if (locked)
6516 sfmmu_mlist_exit(pml);
6517
6518 return (0);
6519 }
6520
6521 /*
6522 * Execute post-callback handler of each pa_hment linked to pp
6523 *
6524 * Same overall assumptions and restrictions apply as for
6525 * hat_pageprocess_precallbacks().
6526 */
6527 static void
6528 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6529 {
6530 pfn_t pgpfn = pp->p_pagenum;
6531 pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6532 pfn_t newpfn;
6533 struct sf_hment *sfhmep;
6534 struct pa_hment *pahmep;
6535 int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6536 id_t id;
6537 int locked = 0;
6538 kmutex_t *pml;
6539
6540 ASSERT(PAGE_EXCL(pp));
6541 if (!sfmmu_mlist_held(pp)) {
6542 pml = sfmmu_mlist_enter(pp);
6543 locked = 1;
6544 }
6545
6546 top:
6547 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6548 /*
6549 * skip sf_hments corresponding to VA<->PA mappings;
6550 * for pa_hment's, hme_tte.ll is zero
6551 */
6552 if (!IS_PAHME(sfhmep))
6553 continue;
6554
6555 pahmep = sfhmep->hme_data;
6556 ASSERT(pahmep != NULL);
6557
6558 if ((pahmep->flags & flag) == 0)
6559 continue;
6560
6561 pahmep->flags &= ~flag;
6562
6563 id = pahmep->cb_id;
6564 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6565 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6566 continue;
6567
6568 /*
6569 * Convert the base page PFN into the constituent PFN
6570 * which is needed by the callback handler.
6571 */
6572 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6573
6574 /*
6575 * Drop the mapping list lock to avoid locking order issues.
6576 */
6577 if (locked)
6578 sfmmu_mlist_exit(pml);
6579
6580 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6581 != 0)
6582 panic("sfmmu: posthandler failed");
6583
6584 if (locked) {
6585 pml = sfmmu_mlist_enter(pp);
6586 goto top;
6587 }
6588 }
6589
6590 if (locked)
6591 sfmmu_mlist_exit(pml);
6592 }
6593
6594 /*
6595 * Suspend locked kernel mapping
6596 */
6597 void
6598 hat_pagesuspend(struct page *pp)
6599 {
6600 struct sf_hment *sfhmep;
6601 sfmmu_t *sfmmup;
6602 tte_t tte, ttemod;
6603 struct hme_blk *hmeblkp;
6604 caddr_t addr;
6605 int index, cons;
6606 cpuset_t cpuset;
6607
6608 ASSERT(PAGE_EXCL(pp));
6609 ASSERT(sfmmu_mlist_held(pp));
6610
6611 mutex_enter(&kpr_suspendlock);
6612
6613 /*
6614 * We're about to suspend a kernel mapping so mark this thread as
6615 * non-traceable by DTrace. This prevents us from running into issues
6616 * with probe context trying to touch a suspended page
6617 * in the relocation codepath itself.
6618 */
6619 curthread->t_flag |= T_DONTDTRACE;
6620
6621 index = PP_MAPINDEX(pp);
6622 cons = TTE8K;
6623
6624 retry:
6625 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6626
6627 if (IS_PAHME(sfhmep))
6628 continue;
6629
6630 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6631 continue;
6632
6633 /*
6634 * Loop until we successfully set the suspend bit in
6635 * the TTE.
6636 */
6637 again:
6638 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6639 ASSERT(TTE_IS_VALID(&tte));
6640
6641 ttemod = tte;
6642 TTE_SET_SUSPEND(&ttemod);
6643 if (sfmmu_modifytte_try(&tte, &ttemod,
6644 &sfhmep->hme_tte) < 0)
6645 goto again;
6646
6647 /*
6648 * Invalidate TSB entry
6649 */
6650 hmeblkp = sfmmu_hmetohblk(sfhmep);
6651
6652 sfmmup = hblktosfmmu(hmeblkp);
6653 ASSERT(sfmmup == ksfmmup);
6654 ASSERT(!hmeblkp->hblk_shared);
6655
6656 addr = tte_to_vaddr(hmeblkp, tte);
6657
6658 /*
6659 * No need to make sure that the TSB for this sfmmu is
6660 * not being relocated since it is ksfmmup and thus it
6661 * will never be relocated.
6662 */
6663 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6664
6665 /*
6666 * Update xcall stats
6667 */
6668 cpuset = cpu_ready_set;
6669 CPUSET_DEL(cpuset, CPU->cpu_id);
6670
6671 /* LINTED: constant in conditional context */
6672 SFMMU_XCALL_STATS(ksfmmup);
6673
6674 /*
6675 * Flush TLB entry on remote CPU's
6676 */
6677 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6678 (uint64_t)ksfmmup);
6679 xt_sync(cpuset);
6680
6681 /*
6682 * Flush TLB entry on local CPU
6683 */
6684 vtag_flushpage(addr, (uint64_t)ksfmmup);
6685 }
6686
6687 while (index != 0) {
6688 index = index >> 1;
6689 if (index != 0)
6690 cons++;
6691 if (index & 0x1) {
6692 pp = PP_GROUPLEADER(pp, cons);
6693 goto retry;
6694 }
6695 }
6696 }
6697
6698 #ifdef DEBUG
6699
6700 #define N_PRLE 1024
6701 struct prle {
6702 page_t *targ;
6703 page_t *repl;
6704 int status;
6705 int pausecpus;
6706 hrtime_t whence;
6707 };
6708
6709 static struct prle page_relocate_log[N_PRLE];
6710 static int prl_entry;
6711 static kmutex_t prl_mutex;
6712
6713 #define PAGE_RELOCATE_LOG(t, r, s, p) \
6714 mutex_enter(&prl_mutex); \
6715 page_relocate_log[prl_entry].targ = *(t); \
6716 page_relocate_log[prl_entry].repl = *(r); \
6717 page_relocate_log[prl_entry].status = (s); \
6718 page_relocate_log[prl_entry].pausecpus = (p); \
6719 page_relocate_log[prl_entry].whence = gethrtime(); \
6720 prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1; \
6721 mutex_exit(&prl_mutex);
6722
6723 #else /* !DEBUG */
6724 #define PAGE_RELOCATE_LOG(t, r, s, p)
6725 #endif
6726
6727 /*
6728 * Core Kernel Page Relocation Algorithm
6729 *
6730 * Input:
6731 *
6732 * target : constituent pages are SE_EXCL locked.
6733 * replacement: constituent pages are SE_EXCL locked.
6734 *
6735 * Output:
6736 *
6737 * nrelocp: number of pages relocated
6738 */
6739 int
6740 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6741 {
6742 page_t *targ, *repl;
6743 page_t *tpp, *rpp;
6744 kmutex_t *low, *high;
6745 spgcnt_t npages, i;
6746 page_t *pl = NULL;
6747 int old_pil;
6748 cpuset_t cpuset;
6749 int cap_cpus;
6750 int ret;
6751 #ifdef VAC
6752 int cflags = 0;
6753 #endif
6754
6755 if (!kcage_on || PP_ISNORELOC(*target)) {
6756 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6757 return (EAGAIN);
6758 }
6759
6760 mutex_enter(&kpr_mutex);
6761 kreloc_thread = curthread;
6762
6763 targ = *target;
6764 repl = *replacement;
6765 ASSERT(repl != NULL);
6766 ASSERT(targ->p_szc == repl->p_szc);
6767
6768 npages = page_get_pagecnt(targ->p_szc);
6769
6770 /*
6771 * unload VA<->PA mappings that are not locked
6772 */
6773 tpp = targ;
6774 for (i = 0; i < npages; i++) {
6775 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6776 tpp++;
6777 }
6778
6779 /*
6780 * Do "presuspend" callbacks, in a context from which we can still
6781 * block as needed. Note that we don't hold the mapping list lock
6782 * of "targ" at this point due to potential locking order issues;
6783 * we assume that between the hat_pageunload() above and holding
6784 * the SE_EXCL lock that the mapping list *cannot* change at this
6785 * point.
6786 */
6787 ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6788 if (ret != 0) {
6789 /*
6790 * EIO translates to fatal error, for all others cleanup
6791 * and return EAGAIN.
6792 */
6793 ASSERT(ret != EIO);
6794 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6795 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6796 kreloc_thread = NULL;
6797 mutex_exit(&kpr_mutex);
6798 return (EAGAIN);
6799 }
6800
6801 /*
6802 * acquire p_mapping list lock for both the target and replacement
6803 * root pages.
6804 *
6805 * low and high refer to the need to grab the mlist locks in a
6806 * specific order in order to prevent race conditions. Thus the
6807 * lower lock must be grabbed before the higher lock.
6808 *
6809 * This will block hat_unload's accessing p_mapping list. Since
6810 * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6811 * blocked. Thus, no one else will be accessing the p_mapping list
6812 * while we suspend and reload the locked mapping below.
6813 */
6814 tpp = targ;
6815 rpp = repl;
6816 sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6817
6818 kpreempt_disable();
6819
6820 /*
6821 * We raise our PIL to 13 so that we don't get captured by
6822 * another CPU or pinned by an interrupt thread. We can't go to
6823 * PIL 14 since the nexus driver(s) may need to interrupt at
6824 * that level in the case of IOMMU pseudo mappings.
6825 */
6826 cpuset = cpu_ready_set;
6827 CPUSET_DEL(cpuset, CPU->cpu_id);
6828 if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6829 old_pil = splr(XCALL_PIL);
6830 } else {
6831 old_pil = -1;
6832 xc_attention(cpuset);
6833 }
6834 ASSERT(getpil() == XCALL_PIL);
6835
6836 /*
6837 * Now do suspend callbacks. In the case of an IOMMU mapping
6838 * this will suspend all DMA activity to the page while it is
6839 * being relocated. Since we are well above LOCK_LEVEL and CPUs
6840 * may be captured at this point we should have acquired any needed
6841 * locks in the presuspend callback.
6842 */
6843 ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6844 if (ret != 0) {
6845 repl = targ;
6846 goto suspend_fail;
6847 }
6848
6849 /*
6850 * Raise the PIL yet again, this time to block all high-level
6851 * interrupts on this CPU. This is necessary to prevent an
6852 * interrupt routine from pinning the thread which holds the
6853 * mapping suspended and then touching the suspended page.
6854 *
6855 * Once the page is suspended we also need to be careful to
6856 * avoid calling any functions which touch any seg_kmem memory
6857 * since that memory may be backed by the very page we are
6858 * relocating in here!
6859 */
6860 hat_pagesuspend(targ);
6861
6862 /*
6863 * Now that we are confident everybody has stopped using this page,
6864 * copy the page contents. Note we use a physical copy to prevent
6865 * locking issues and to avoid fpRAS because we can't handle it in
6866 * this context.
6867 */
6868 for (i = 0; i < npages; i++, tpp++, rpp++) {
6869 #ifdef VAC
6870 /*
6871 * If the replacement has a different vcolor than
6872 * the one being replacd, we need to handle VAC
6873 * consistency for it just as we were setting up
6874 * a new mapping to it.
6875 */
6876 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6877 (tpp->p_vcolor != rpp->p_vcolor) &&
6878 !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6879 CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6880 sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6881 rpp->p_pagenum);
6882 }
6883 #endif
6884 /*
6885 * Copy the contents of the page.
6886 */
6887 ppcopy_kernel(tpp, rpp);
6888 }
6889
6890 tpp = targ;
6891 rpp = repl;
6892 for (i = 0; i < npages; i++, tpp++, rpp++) {
6893 /*
6894 * Copy attributes. VAC consistency was handled above,
6895 * if required.
6896 */
6897 rpp->p_nrm = tpp->p_nrm;
6898 tpp->p_nrm = 0;
6899 rpp->p_index = tpp->p_index;
6900 tpp->p_index = 0;
6901 #ifdef VAC
6902 rpp->p_vcolor = tpp->p_vcolor;
6903 #endif
6904 }
6905
6906 /*
6907 * First, unsuspend the page, if we set the suspend bit, and transfer
6908 * the mapping list from the target page to the replacement page.
6909 * Next process postcallbacks; since pa_hment's are linked only to the
6910 * p_mapping list of root page, we don't iterate over the constituent
6911 * pages.
6912 */
6913 hat_pagereload(targ, repl);
6914
6915 suspend_fail:
6916 hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
6917
6918 /*
6919 * Now lower our PIL and release any captured CPUs since we
6920 * are out of the "danger zone". After this it will again be
6921 * safe to acquire adaptive mutex locks, or to drop them...
6922 */
6923 if (old_pil != -1) {
6924 splx(old_pil);
6925 } else {
6926 xc_dismissed(cpuset);
6927 }
6928
6929 kpreempt_enable();
6930
6931 sfmmu_mlist_reloc_exit(low, high);
6932
6933 /*
6934 * Postsuspend callbacks should drop any locks held across
6935 * the suspend callbacks. As before, we don't hold the mapping
6936 * list lock at this point.. our assumption is that the mapping
6937 * list still can't change due to our holding SE_EXCL lock and
6938 * there being no unlocked mappings left. Hence the restriction
6939 * on calling context to hat_delete_callback()
6940 */
6941 hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
6942 if (ret != 0) {
6943 /*
6944 * The second presuspend call failed: we got here through
6945 * the suspend_fail label above.
6946 */
6947 ASSERT(ret != EIO);
6948 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
6949 kreloc_thread = NULL;
6950 mutex_exit(&kpr_mutex);
6951 return (EAGAIN);
6952 }
6953
6954 /*
6955 * Now that we're out of the performance critical section we can
6956 * take care of updating the hash table, since we still
6957 * hold all the pages locked SE_EXCL at this point we
6958 * needn't worry about things changing out from under us.
6959 */
6960 tpp = targ;
6961 rpp = repl;
6962 for (i = 0; i < npages; i++, tpp++, rpp++) {
6963
6964 /*
6965 * replace targ with replacement in page_hash table
6966 */
6967 targ = tpp;
6968 page_relocate_hash(rpp, targ);
6969
6970 /*
6971 * concatenate target; caller of platform_page_relocate()
6972 * expects target to be concatenated after returning.
6973 */
6974 ASSERT(targ->p_next == targ);
6975 ASSERT(targ->p_prev == targ);
6976 page_list_concat(&pl, &targ);
6977 }
6978
6979 ASSERT(*target == pl);
6980 *nrelocp = npages;
6981 PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
6982 kreloc_thread = NULL;
6983 mutex_exit(&kpr_mutex);
6984 return (0);
6985 }
6986
6987 /*
6988 * Called when stray pa_hments are found attached to a page which is
6989 * being freed. Notify the subsystem which attached the pa_hment of
6990 * the error if it registered a suitable handler, else panic.
6991 */
6992 static void
6993 sfmmu_pahment_leaked(struct pa_hment *pahmep)
6994 {
6995 id_t cb_id = pahmep->cb_id;
6996
6997 ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
6998 if (sfmmu_cb_table[cb_id].errhandler != NULL) {
6999 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7000 HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7001 return; /* non-fatal */
7002 }
7003 panic("pa_hment leaked: 0x%p", (void *)pahmep);
7004 }
7005
7006 /*
7007 * Remove all mappings to page 'pp'.
7008 */
7009 int
7010 hat_pageunload(struct page *pp, uint_t forceflag)
7011 {
7012 struct page *origpp = pp;
7013 struct sf_hment *sfhme, *tmphme;
7014 struct hme_blk *hmeblkp;
7015 kmutex_t *pml;
7016 #ifdef VAC
7017 kmutex_t *pmtx;
7018 #endif
7019 cpuset_t cpuset, tset;
7020 int index, cons;
7021 int pa_hments;
7022
7023 ASSERT(PAGE_EXCL(pp));
7024
7025 tmphme = NULL;
7026 pa_hments = 0;
7027 CPUSET_ZERO(cpuset);
7028
7029 pml = sfmmu_mlist_enter(pp);
7030
7031 #ifdef VAC
7032 if (pp->p_kpmref)
7033 sfmmu_kpm_pageunload(pp);
7034 ASSERT(!PP_ISMAPPED_KPM(pp));
7035 #endif
7036 /*
7037 * Clear vpm reference. Since the page is exclusively locked
7038 * vpm cannot be referencing it.
7039 */
7040 if (vpm_enable) {
7041 pp->p_vpmref = 0;
7042 }
7043
7044 index = PP_MAPINDEX(pp);
7045 cons = TTE8K;
7046 retry:
7047 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7048 tmphme = sfhme->hme_next;
7049
7050 if (IS_PAHME(sfhme)) {
7051 ASSERT(sfhme->hme_data != NULL);
7052 pa_hments++;
7053 continue;
7054 }
7055
7056 hmeblkp = sfmmu_hmetohblk(sfhme);
7057
7058 /*
7059 * If there are kernel mappings don't unload them, they will
7060 * be suspended.
7061 */
7062 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7063 hmeblkp->hblk_tag.htag_id == ksfmmup)
7064 continue;
7065
7066 tset = sfmmu_pageunload(pp, sfhme, cons);
7067 CPUSET_OR(cpuset, tset);
7068 }
7069
7070 while (index != 0) {
7071 index = index >> 1;
7072 if (index != 0)
7073 cons++;
7074 if (index & 0x1) {
7075 /* Go to leading page */
7076 pp = PP_GROUPLEADER(pp, cons);
7077 ASSERT(sfmmu_mlist_held(pp));
7078 goto retry;
7079 }
7080 }
7081
7082 /*
7083 * cpuset may be empty if the page was only mapped by segkpm,
7084 * in which case we won't actually cross-trap.
7085 */
7086 xt_sync(cpuset);
7087
7088 /*
7089 * The page should have no mappings at this point, unless
7090 * we were called from hat_page_relocate() in which case we
7091 * leave the locked mappings which will be suspended later.
7092 */
7093 ASSERT(!PP_ISMAPPED(origpp) || pa_hments ||
7094 (forceflag == SFMMU_KERNEL_RELOC));
7095
7096 #ifdef VAC
7097 if (PP_ISTNC(pp)) {
7098 if (cons == TTE8K) {
7099 pmtx = sfmmu_page_enter(pp);
7100 PP_CLRTNC(pp);
7101 sfmmu_page_exit(pmtx);
7102 } else {
7103 conv_tnc(pp, cons);
7104 }
7105 }
7106 #endif /* VAC */
7107
7108 if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7109 /*
7110 * Unlink any pa_hments and free them, calling back
7111 * the responsible subsystem to notify it of the error.
7112 * This can occur in situations such as drivers leaking
7113 * DMA handles: naughty, but common enough that we'd like
7114 * to keep the system running rather than bringing it
7115 * down with an obscure error like "pa_hment leaked"
7116 * which doesn't aid the user in debugging their driver.
7117 */
7118 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7119 tmphme = sfhme->hme_next;
7120 if (IS_PAHME(sfhme)) {
7121 struct pa_hment *pahmep = sfhme->hme_data;
7122 sfmmu_pahment_leaked(pahmep);
7123 HME_SUB(sfhme, pp);
7124 kmem_cache_free(pa_hment_cache, pahmep);
7125 }
7126 }
7127
7128 ASSERT(!PP_ISMAPPED(origpp));
7129 }
7130
7131 sfmmu_mlist_exit(pml);
7132
7133 return (0);
7134 }
7135
7136 cpuset_t
7137 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7138 {
7139 struct hme_blk *hmeblkp;
7140 sfmmu_t *sfmmup;
7141 tte_t tte, ttemod;
7142 #ifdef DEBUG
7143 tte_t orig_old;
7144 #endif /* DEBUG */
7145 caddr_t addr;
7146 int ttesz;
7147 int ret;
7148 cpuset_t cpuset;
7149
7150 ASSERT(pp != NULL);
7151 ASSERT(sfmmu_mlist_held(pp));
7152 ASSERT(!PP_ISKAS(pp));
7153
7154 CPUSET_ZERO(cpuset);
7155
7156 hmeblkp = sfmmu_hmetohblk(sfhme);
7157
7158 readtte:
7159 sfmmu_copytte(&sfhme->hme_tte, &tte);
7160 if (TTE_IS_VALID(&tte)) {
7161 sfmmup = hblktosfmmu(hmeblkp);
7162 ttesz = get_hblk_ttesz(hmeblkp);
7163 /*
7164 * Only unload mappings of 'cons' size.
7165 */
7166 if (ttesz != cons)
7167 return (cpuset);
7168
7169 /*
7170 * Note that we have p_mapping lock, but no hash lock here.
7171 * hblk_unload() has to have both hash lock AND p_mapping
7172 * lock before it tries to modify tte. So, the tte could
7173 * not become invalid in the sfmmu_modifytte_try() below.
7174 */
7175 ttemod = tte;
7176 #ifdef DEBUG
7177 orig_old = tte;
7178 #endif /* DEBUG */
7179
7180 TTE_SET_INVALID(&ttemod);
7181 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7182 if (ret < 0) {
7183 #ifdef DEBUG
7184 /* only R/M bits can change. */
7185 chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7186 #endif /* DEBUG */
7187 goto readtte;
7188 }
7189
7190 if (ret == 0) {
7191 panic("pageunload: cas failed?");
7192 }
7193
7194 addr = tte_to_vaddr(hmeblkp, tte);
7195
7196 if (hmeblkp->hblk_shared) {
7197 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7198 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7199 sf_region_t *rgnp;
7200 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7201 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7202 ASSERT(srdp != NULL);
7203 rgnp = srdp->srd_hmergnp[rid];
7204 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7205 cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7206 sfmmu_ttesync(NULL, addr, &tte, pp);
7207 ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7208 atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7209 } else {
7210 sfmmu_ttesync(sfmmup, addr, &tte, pp);
7211 atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7212
7213 /*
7214 * We need to flush the page from the virtual cache
7215 * in order to prevent a virtual cache alias
7216 * inconsistency. The particular scenario we need
7217 * to worry about is:
7218 * Given: va1 and va2 are two virtual address that
7219 * alias and will map the same physical address.
7220 * 1. mapping exists from va1 to pa and data has
7221 * been read into the cache.
7222 * 2. unload va1.
7223 * 3. load va2 and modify data using va2.
7224 * 4 unload va2.
7225 * 5. load va1 and reference data. Unless we flush
7226 * the data cache when we unload we will get
7227 * stale data.
7228 * This scenario is taken care of by using virtual
7229 * page coloring.
7230 */
7231 if (sfmmup->sfmmu_ismhat) {
7232 /*
7233 * Flush TSBs, TLBs and caches
7234 * of every process
7235 * sharing this ism segment.
7236 */
7237 sfmmu_hat_lock_all();
7238 mutex_enter(&ism_mlist_lock);
7239 kpreempt_disable();
7240 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7241 pp->p_pagenum, CACHE_NO_FLUSH);
7242 kpreempt_enable();
7243 mutex_exit(&ism_mlist_lock);
7244 sfmmu_hat_unlock_all();
7245 cpuset = cpu_ready_set;
7246 } else {
7247 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7248 cpuset = sfmmup->sfmmu_cpusran;
7249 }
7250 }
7251
7252 /*
7253 * Hme_sub has to run after ttesync() and a_rss update.
7254 * See hblk_unload().
7255 */
7256 HME_SUB(sfhme, pp);
7257 membar_stst();
7258
7259 /*
7260 * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7261 * since pteload may have done a HME_ADD() right after
7262 * we did the HME_SUB() above. Hmecnt is now maintained
7263 * by cas only. no lock guranteed its value. The only
7264 * gurantee we have is the hmecnt should not be less than
7265 * what it should be so the hblk will not be taken away.
7266 * It's also important that we decremented the hmecnt after
7267 * we are done with hmeblkp so that this hmeblk won't be
7268 * stolen.
7269 */
7270 ASSERT(hmeblkp->hblk_hmecnt > 0);
7271 ASSERT(hmeblkp->hblk_vcnt > 0);
7272 atomic_dec_16(&hmeblkp->hblk_vcnt);
7273 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7274 /*
7275 * This is bug 4063182.
7276 * XXX: fixme
7277 * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7278 * !hmeblkp->hblk_lckcnt);
7279 */
7280 } else {
7281 panic("invalid tte? pp %p &tte %p",
7282 (void *)pp, (void *)&tte);
7283 }
7284
7285 return (cpuset);
7286 }
7287
7288 /*
7289 * While relocating a kernel page, this function will move the mappings
7290 * from tpp to dpp and modify any associated data with these mappings.
7291 * It also unsuspends the suspended kernel mapping.
7292 */
7293 static void
7294 hat_pagereload(struct page *tpp, struct page *dpp)
7295 {
7296 struct sf_hment *sfhme;
7297 tte_t tte, ttemod;
7298 int index, cons;
7299
7300 ASSERT(getpil() == PIL_MAX);
7301 ASSERT(sfmmu_mlist_held(tpp));
7302 ASSERT(sfmmu_mlist_held(dpp));
7303
7304 index = PP_MAPINDEX(tpp);
7305 cons = TTE8K;
7306
7307 /* Update real mappings to the page */
7308 retry:
7309 for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7310 if (IS_PAHME(sfhme))
7311 continue;
7312 sfmmu_copytte(&sfhme->hme_tte, &tte);
7313 ttemod = tte;
7314
7315 /*
7316 * replace old pfn with new pfn in TTE
7317 */
7318 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7319
7320 /*
7321 * clear suspend bit
7322 */
7323 ASSERT(TTE_IS_SUSPEND(&ttemod));
7324 TTE_CLR_SUSPEND(&ttemod);
7325
7326 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7327 panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7328
7329 /*
7330 * set hme_page point to new page
7331 */
7332 sfhme->hme_page = dpp;
7333 }
7334
7335 /*
7336 * move p_mapping list from old page to new page
7337 */
7338 dpp->p_mapping = tpp->p_mapping;
7339 tpp->p_mapping = NULL;
7340 dpp->p_share = tpp->p_share;
7341 tpp->p_share = 0;
7342
7343 while (index != 0) {
7344 index = index >> 1;
7345 if (index != 0)
7346 cons++;
7347 if (index & 0x1) {
7348 tpp = PP_GROUPLEADER(tpp, cons);
7349 dpp = PP_GROUPLEADER(dpp, cons);
7350 goto retry;
7351 }
7352 }
7353
7354 curthread->t_flag &= ~T_DONTDTRACE;
7355 mutex_exit(&kpr_suspendlock);
7356 }
7357
7358 uint_t
7359 hat_pagesync(struct page *pp, uint_t clearflag)
7360 {
7361 struct sf_hment *sfhme, *tmphme = NULL;
7362 struct hme_blk *hmeblkp;
7363 kmutex_t *pml;
7364 cpuset_t cpuset, tset;
7365 int index, cons;
7366 extern ulong_t po_share;
7367 page_t *save_pp = pp;
7368 int stop_on_sh = 0;
7369 uint_t shcnt;
7370
7371 CPUSET_ZERO(cpuset);
7372
7373 if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7374 return (PP_GENERIC_ATTR(pp));
7375 }
7376
7377 if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7378 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7379 return (PP_GENERIC_ATTR(pp));
7380 }
7381 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7382 return (PP_GENERIC_ATTR(pp));
7383 }
7384 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7385 if (pp->p_share > po_share) {
7386 hat_page_setattr(pp, P_REF);
7387 return (PP_GENERIC_ATTR(pp));
7388 }
7389 stop_on_sh = 1;
7390 shcnt = 0;
7391 }
7392 }
7393
7394 clearflag &= ~HAT_SYNC_STOPON_SHARED;
7395 pml = sfmmu_mlist_enter(pp);
7396 index = PP_MAPINDEX(pp);
7397 cons = TTE8K;
7398 retry:
7399 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7400 /*
7401 * We need to save the next hment on the list since
7402 * it is possible for pagesync to remove an invalid hment
7403 * from the list.
7404 */
7405 tmphme = sfhme->hme_next;
7406 if (IS_PAHME(sfhme))
7407 continue;
7408 /*
7409 * If we are looking for large mappings and this hme doesn't
7410 * reach the range we are seeking, just ignore it.
7411 */
7412 hmeblkp = sfmmu_hmetohblk(sfhme);
7413
7414 if (hme_size(sfhme) < cons)
7415 continue;
7416
7417 if (stop_on_sh) {
7418 if (hmeblkp->hblk_shared) {
7419 sf_srd_t *srdp = hblktosrd(hmeblkp);
7420 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7421 sf_region_t *rgnp;
7422 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7423 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7424 ASSERT(srdp != NULL);
7425 rgnp = srdp->srd_hmergnp[rid];
7426 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7427 rgnp, rid);
7428 shcnt += rgnp->rgn_refcnt;
7429 } else {
7430 shcnt++;
7431 }
7432 if (shcnt > po_share) {
7433 /*
7434 * tell the pager to spare the page this time
7435 * around.
7436 */
7437 hat_page_setattr(save_pp, P_REF);
7438 index = 0;
7439 break;
7440 }
7441 }
7442 tset = sfmmu_pagesync(pp, sfhme,
7443 clearflag & ~HAT_SYNC_STOPON_RM);
7444 CPUSET_OR(cpuset, tset);
7445
7446 /*
7447 * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7448 * as the "ref" or "mod" is set or share cnt exceeds po_share.
7449 */
7450 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7451 (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7452 ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7453 index = 0;
7454 break;
7455 }
7456 }
7457
7458 while (index) {
7459 index = index >> 1;
7460 cons++;
7461 if (index & 0x1) {
7462 /* Go to leading page */
7463 pp = PP_GROUPLEADER(pp, cons);
7464 goto retry;
7465 }
7466 }
7467
7468 xt_sync(cpuset);
7469 sfmmu_mlist_exit(pml);
7470 return (PP_GENERIC_ATTR(save_pp));
7471 }
7472
7473 /*
7474 * Get all the hardware dependent attributes for a page struct
7475 */
7476 static cpuset_t
7477 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7478 uint_t clearflag)
7479 {
7480 caddr_t addr;
7481 tte_t tte, ttemod;
7482 struct hme_blk *hmeblkp;
7483 int ret;
7484 sfmmu_t *sfmmup;
7485 cpuset_t cpuset;
7486
7487 ASSERT(pp != NULL);
7488 ASSERT(sfmmu_mlist_held(pp));
7489 ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7490 (clearflag == HAT_SYNC_ZERORM));
7491
7492 SFMMU_STAT(sf_pagesync);
7493
7494 CPUSET_ZERO(cpuset);
7495
7496 sfmmu_pagesync_retry:
7497
7498 sfmmu_copytte(&sfhme->hme_tte, &tte);
7499 if (TTE_IS_VALID(&tte)) {
7500 hmeblkp = sfmmu_hmetohblk(sfhme);
7501 sfmmup = hblktosfmmu(hmeblkp);
7502 addr = tte_to_vaddr(hmeblkp, tte);
7503 if (clearflag == HAT_SYNC_ZERORM) {
7504 ttemod = tte;
7505 TTE_CLR_RM(&ttemod);
7506 ret = sfmmu_modifytte_try(&tte, &ttemod,
7507 &sfhme->hme_tte);
7508 if (ret < 0) {
7509 /*
7510 * cas failed and the new value is not what
7511 * we want.
7512 */
7513 goto sfmmu_pagesync_retry;
7514 }
7515
7516 if (ret > 0) {
7517 /* we win the cas */
7518 if (hmeblkp->hblk_shared) {
7519 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7520 uint_t rid =
7521 hmeblkp->hblk_tag.htag_rid;
7522 sf_region_t *rgnp;
7523 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7524 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7525 ASSERT(srdp != NULL);
7526 rgnp = srdp->srd_hmergnp[rid];
7527 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7528 srdp, rgnp, rid);
7529 cpuset = sfmmu_rgntlb_demap(addr,
7530 rgnp, hmeblkp, 1);
7531 } else {
7532 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7533 0, 0);
7534 cpuset = sfmmup->sfmmu_cpusran;
7535 }
7536 }
7537 }
7538 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7539 &tte, pp);
7540 }
7541 return (cpuset);
7542 }
7543
7544 /*
7545 * Remove write permission from a mappings to a page, so that
7546 * we can detect the next modification of it. This requires modifying
7547 * the TTE then invalidating (demap) any TLB entry using that TTE.
7548 * This code is similar to sfmmu_pagesync().
7549 */
7550 static cpuset_t
7551 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7552 {
7553 caddr_t addr;
7554 tte_t tte;
7555 tte_t ttemod;
7556 struct hme_blk *hmeblkp;
7557 int ret;
7558 sfmmu_t *sfmmup;
7559 cpuset_t cpuset;
7560
7561 ASSERT(pp != NULL);
7562 ASSERT(sfmmu_mlist_held(pp));
7563
7564 CPUSET_ZERO(cpuset);
7565 SFMMU_STAT(sf_clrwrt);
7566
7567 retry:
7568
7569 sfmmu_copytte(&sfhme->hme_tte, &tte);
7570 if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7571 hmeblkp = sfmmu_hmetohblk(sfhme);
7572 sfmmup = hblktosfmmu(hmeblkp);
7573 addr = tte_to_vaddr(hmeblkp, tte);
7574
7575 ttemod = tte;
7576 TTE_CLR_WRT(&ttemod);
7577 TTE_CLR_MOD(&ttemod);
7578 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7579
7580 /*
7581 * if cas failed and the new value is not what
7582 * we want retry
7583 */
7584 if (ret < 0)
7585 goto retry;
7586
7587 /* we win the cas */
7588 if (ret > 0) {
7589 if (hmeblkp->hblk_shared) {
7590 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7591 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7592 sf_region_t *rgnp;
7593 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7594 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7595 ASSERT(srdp != NULL);
7596 rgnp = srdp->srd_hmergnp[rid];
7597 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7598 srdp, rgnp, rid);
7599 cpuset = sfmmu_rgntlb_demap(addr,
7600 rgnp, hmeblkp, 1);
7601 } else {
7602 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7603 cpuset = sfmmup->sfmmu_cpusran;
7604 }
7605 }
7606 }
7607
7608 return (cpuset);
7609 }
7610
7611 /*
7612 * Walk all mappings of a page, removing write permission and clearing the
7613 * ref/mod bits. This code is similar to hat_pagesync()
7614 */
7615 static void
7616 hat_page_clrwrt(page_t *pp)
7617 {
7618 struct sf_hment *sfhme;
7619 struct sf_hment *tmphme = NULL;
7620 kmutex_t *pml;
7621 cpuset_t cpuset;
7622 cpuset_t tset;
7623 int index;
7624 int cons;
7625
7626 CPUSET_ZERO(cpuset);
7627
7628 pml = sfmmu_mlist_enter(pp);
7629 index = PP_MAPINDEX(pp);
7630 cons = TTE8K;
7631 retry:
7632 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7633 tmphme = sfhme->hme_next;
7634
7635 /*
7636 * If we are looking for large mappings and this hme doesn't
7637 * reach the range we are seeking, just ignore its.
7638 */
7639
7640 if (hme_size(sfhme) < cons)
7641 continue;
7642
7643 tset = sfmmu_pageclrwrt(pp, sfhme);
7644 CPUSET_OR(cpuset, tset);
7645 }
7646
7647 while (index) {
7648 index = index >> 1;
7649 cons++;
7650 if (index & 0x1) {
7651 /* Go to leading page */
7652 pp = PP_GROUPLEADER(pp, cons);
7653 goto retry;
7654 }
7655 }
7656
7657 xt_sync(cpuset);
7658 sfmmu_mlist_exit(pml);
7659 }
7660
7661 /*
7662 * Set the given REF/MOD/RO bits for the given page.
7663 * For a vnode with a sorted v_pages list, we need to change
7664 * the attributes and the v_pages list together under page_vnode_mutex.
7665 */
7666 void
7667 hat_page_setattr(page_t *pp, uint_t flag)
7668 {
7669 vnode_t *vp = pp->p_vnode;
7670 page_t **listp;
7671 kmutex_t *pmtx;
7672 kmutex_t *vphm = NULL;
7673 int noshuffle;
7674
7675 noshuffle = flag & P_NSH;
7676 flag &= ~P_NSH;
7677
7678 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7679
7680 /*
7681 * nothing to do if attribute already set
7682 */
7683 if ((pp->p_nrm & flag) == flag)
7684 return;
7685
7686 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7687 !noshuffle) {
7688 vphm = page_vnode_mutex(vp);
7689 mutex_enter(vphm);
7690 }
7691
7692 pmtx = sfmmu_page_enter(pp);
7693 pp->p_nrm |= flag;
7694 sfmmu_page_exit(pmtx);
7695
7696 if (vphm != NULL) {
7697 /*
7698 * Some File Systems examine v_pages for NULL w/o
7699 * grabbing the vphm mutex. Must not let it become NULL when
7700 * pp is the only page on the list.
7701 */
7702 if (pp->p_vpnext != pp) {
7703 page_vpsub(&vp->v_pages, pp);
7704 if (vp->v_pages != NULL)
7705 listp = &vp->v_pages->p_vpprev->p_vpnext;
7706 else
7707 listp = &vp->v_pages;
7708 page_vpadd(listp, pp);
7709 }
7710 mutex_exit(vphm);
7711 }
7712 }
7713
7714 void
7715 hat_page_clrattr(page_t *pp, uint_t flag)
7716 {
7717 vnode_t *vp = pp->p_vnode;
7718 kmutex_t *pmtx;
7719
7720 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7721
7722 pmtx = sfmmu_page_enter(pp);
7723
7724 /*
7725 * Caller is expected to hold page's io lock for VMODSORT to work
7726 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7727 * bit is cleared.
7728 * We don't have assert to avoid tripping some existing third party
7729 * code. The dirty page is moved back to top of the v_page list
7730 * after IO is done in pvn_write_done().
7731 */
7732 pp->p_nrm &= ~flag;
7733 sfmmu_page_exit(pmtx);
7734
7735 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7736
7737 /*
7738 * VMODSORT works by removing write permissions and getting
7739 * a fault when a page is made dirty. At this point
7740 * we need to remove write permission from all mappings
7741 * to this page.
7742 */
7743 hat_page_clrwrt(pp);
7744 }
7745 }
7746
7747 uint_t
7748 hat_page_getattr(page_t *pp, uint_t flag)
7749 {
7750 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7751 return ((uint_t)(pp->p_nrm & flag));
7752 }
7753
7754 /*
7755 * DEBUG kernels: verify that a kernel va<->pa translation
7756 * is safe by checking the underlying page_t is in a page
7757 * relocation-safe state.
7758 */
7759 #ifdef DEBUG
7760 void
7761 sfmmu_check_kpfn(pfn_t pfn)
7762 {
7763 page_t *pp;
7764 int index, cons;
7765
7766 if (hat_check_vtop == 0)
7767 return;
7768
7769 if (kvseg.s_base == NULL || panicstr)
7770 return;
7771
7772 pp = page_numtopp_nolock(pfn);
7773 if (!pp)
7774 return;
7775
7776 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7777 return;
7778
7779 /*
7780 * Handed a large kernel page, we dig up the root page since we
7781 * know the root page might have the lock also.
7782 */
7783 if (pp->p_szc != 0) {
7784 index = PP_MAPINDEX(pp);
7785 cons = TTE8K;
7786 again:
7787 while (index != 0) {
7788 index >>= 1;
7789 if (index != 0)
7790 cons++;
7791 if (index & 0x1) {
7792 pp = PP_GROUPLEADER(pp, cons);
7793 goto again;
7794 }
7795 }
7796 }
7797
7798 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7799 return;
7800
7801 /*
7802 * Pages need to be locked or allocated "permanent" (either from
7803 * static_arena arena or explicitly setting PG_NORELOC when calling
7804 * page_create_va()) for VA->PA translations to be valid.
7805 */
7806 if (!PP_ISNORELOC(pp))
7807 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7808 (void *)pp);
7809 else
7810 panic("Illegal VA->PA translation, pp 0x%p not locked",
7811 (void *)pp);
7812 }
7813 #endif /* DEBUG */
7814
7815 /*
7816 * Returns a page frame number for a given virtual address.
7817 * Returns PFN_INVALID to indicate an invalid mapping
7818 */
7819 pfn_t
7820 hat_getpfnum(struct hat *hat, caddr_t addr)
7821 {
7822 pfn_t pfn;
7823 tte_t tte;
7824
7825 /*
7826 * We would like to
7827 * ASSERT(AS_LOCK_HELD(as));
7828 * but we can't because the iommu driver will call this
7829 * routine at interrupt time and it can't grab the as lock
7830 * or it will deadlock: A thread could have the as lock
7831 * and be waiting for io. The io can't complete
7832 * because the interrupt thread is blocked trying to grab
7833 * the as lock.
7834 */
7835
7836 if (hat == ksfmmup) {
7837 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7838 ASSERT(segkmem_lpszc > 0);
7839 pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7840 if (pfn != PFN_INVALID) {
7841 sfmmu_check_kpfn(pfn);
7842 return (pfn);
7843 }
7844 } else if (segkpm && IS_KPM_ADDR(addr)) {
7845 return (sfmmu_kpm_vatopfn(addr));
7846 }
7847 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7848 == PFN_SUSPENDED) {
7849 sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7850 }
7851 sfmmu_check_kpfn(pfn);
7852 return (pfn);
7853 } else {
7854 return (sfmmu_uvatopfn(addr, hat, NULL));
7855 }
7856 }
7857
7858 /*
7859 * This routine will return both pfn and tte for the vaddr.
7860 */
7861 static pfn_t
7862 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
7863 {
7864 struct hmehash_bucket *hmebp;
7865 hmeblk_tag hblktag;
7866 int hmeshift, hashno = 1;
7867 struct hme_blk *hmeblkp = NULL;
7868 tte_t tte;
7869
7870 struct sf_hment *sfhmep;
7871 pfn_t pfn;
7872
7873 /* support for ISM */
7874 ism_map_t *ism_map;
7875 ism_blk_t *ism_blkp;
7876 int i;
7877 sfmmu_t *ism_hatid = NULL;
7878 sfmmu_t *locked_hatid = NULL;
7879 sfmmu_t *sv_sfmmup = sfmmup;
7880 caddr_t sv_vaddr = vaddr;
7881 sf_srd_t *srdp;
7882
7883 if (ttep == NULL) {
7884 ttep = &tte;
7885 } else {
7886 ttep->ll = 0;
7887 }
7888
7889 ASSERT(sfmmup != ksfmmup);
7890 SFMMU_STAT(sf_user_vtop);
7891 /*
7892 * Set ism_hatid if vaddr falls in a ISM segment.
7893 */
7894 ism_blkp = sfmmup->sfmmu_iblk;
7895 if (ism_blkp != NULL) {
7896 sfmmu_ismhat_enter(sfmmup, 0);
7897 locked_hatid = sfmmup;
7898 }
7899 while (ism_blkp != NULL && ism_hatid == NULL) {
7900 ism_map = ism_blkp->iblk_maps;
7901 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
7902 if (vaddr >= ism_start(ism_map[i]) &&
7903 vaddr < ism_end(ism_map[i])) {
7904 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
7905 vaddr = (caddr_t)(vaddr -
7906 ism_start(ism_map[i]));
7907 break;
7908 }
7909 }
7910 ism_blkp = ism_blkp->iblk_next;
7911 }
7912 if (locked_hatid) {
7913 sfmmu_ismhat_exit(locked_hatid, 0);
7914 }
7915
7916 hblktag.htag_id = sfmmup;
7917 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
7918 do {
7919 hmeshift = HME_HASH_SHIFT(hashno);
7920 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
7921 hblktag.htag_rehash = hashno;
7922 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
7923
7924 SFMMU_HASH_LOCK(hmebp);
7925
7926 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
7927 if (hmeblkp != NULL) {
7928 ASSERT(!hmeblkp->hblk_shared);
7929 HBLKTOHME(sfhmep, hmeblkp, vaddr);
7930 sfmmu_copytte(&sfhmep->hme_tte, ttep);
7931 SFMMU_HASH_UNLOCK(hmebp);
7932 if (TTE_IS_VALID(ttep)) {
7933 pfn = TTE_TO_PFN(vaddr, ttep);
7934 return (pfn);
7935 }
7936 break;
7937 }
7938 SFMMU_HASH_UNLOCK(hmebp);
7939 hashno++;
7940 } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
7941
7942 if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
7943 return (PFN_INVALID);
7944 }
7945 srdp = sv_sfmmup->sfmmu_srdp;
7946 ASSERT(srdp != NULL);
7947 ASSERT(srdp->srd_refcnt != 0);
7948 hblktag.htag_id = srdp;
7949 hashno = 1;
7950 do {
7951 hmeshift = HME_HASH_SHIFT(hashno);
7952 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
7953 hblktag.htag_rehash = hashno;
7954 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
7955
7956 SFMMU_HASH_LOCK(hmebp);
7957 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
7958 hmeblkp = hmeblkp->hblk_next) {
7959 uint_t rid;
7960 sf_region_t *rgnp;
7961 caddr_t rsaddr;
7962 caddr_t readdr;
7963
7964 if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
7965 sv_sfmmup->sfmmu_hmeregion_map)) {
7966 continue;
7967 }
7968 ASSERT(hmeblkp->hblk_shared);
7969 rid = hmeblkp->hblk_tag.htag_rid;
7970 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7971 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7972 rgnp = srdp->srd_hmergnp[rid];
7973 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7974 HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
7975 sfmmu_copytte(&sfhmep->hme_tte, ttep);
7976 rsaddr = rgnp->rgn_saddr;
7977 readdr = rsaddr + rgnp->rgn_size;
7978 #ifdef DEBUG
7979 if (TTE_IS_VALID(ttep) ||
7980 get_hblk_ttesz(hmeblkp) > TTE8K) {
7981 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
7982 ASSERT(eva > sv_vaddr);
7983 ASSERT(sv_vaddr >= rsaddr);
7984 ASSERT(sv_vaddr < readdr);
7985 ASSERT(eva <= readdr);
7986 }
7987 #endif /* DEBUG */
7988 /*
7989 * Continue the search if we
7990 * found an invalid 8K tte outside of the area
7991 * covered by this hmeblk's region.
7992 */
7993 if (TTE_IS_VALID(ttep)) {
7994 SFMMU_HASH_UNLOCK(hmebp);
7995 pfn = TTE_TO_PFN(sv_vaddr, ttep);
7996 return (pfn);
7997 } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
7998 (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
7999 SFMMU_HASH_UNLOCK(hmebp);
8000 pfn = PFN_INVALID;
8001 return (pfn);
8002 }
8003 }
8004 SFMMU_HASH_UNLOCK(hmebp);
8005 hashno++;
8006 } while (hashno <= mmu_hashcnt);
8007 return (PFN_INVALID);
8008 }
8009
8010
8011 /*
8012 * For compatability with AT&T and later optimizations
8013 */
8014 /* ARGSUSED */
8015 void
8016 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8017 {
8018 ASSERT(hat != NULL);
8019 }
8020
8021 /*
8022 * Return the number of mappings to a particular page. This number is an
8023 * approximation of the number of people sharing the page.
8024 *
8025 * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8026 * hat_page_checkshare() can be used to compare threshold to share
8027 * count that reflects the number of region sharers albeit at higher cost.
8028 */
8029 ulong_t
8030 hat_page_getshare(page_t *pp)
8031 {
8032 page_t *spp = pp; /* start page */
8033 kmutex_t *pml;
8034 ulong_t cnt;
8035 int index, sz = TTE64K;
8036
8037 /*
8038 * We need to grab the mlist lock to make sure any outstanding
8039 * load/unloads complete. Otherwise we could return zero
8040 * even though the unload(s) hasn't finished yet.
8041 */
8042 pml = sfmmu_mlist_enter(spp);
8043 cnt = spp->p_share;
8044
8045 #ifdef VAC
8046 if (kpm_enable)
8047 cnt += spp->p_kpmref;
8048 #endif
8049 if (vpm_enable && pp->p_vpmref) {
8050 cnt += 1;
8051 }
8052
8053 /*
8054 * If we have any large mappings, we count the number of
8055 * mappings that this large page is part of.
8056 */
8057 index = PP_MAPINDEX(spp);
8058 index >>= 1;
8059 while (index) {
8060 pp = PP_GROUPLEADER(spp, sz);
8061 if ((index & 0x1) && pp != spp) {
8062 cnt += pp->p_share;
8063 spp = pp;
8064 }
8065 index >>= 1;
8066 sz++;
8067 }
8068 sfmmu_mlist_exit(pml);
8069 return (cnt);
8070 }
8071
8072 /*
8073 * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8074 * otherwise. Count shared hmeblks by region's refcnt.
8075 */
8076 int
8077 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8078 {
8079 kmutex_t *pml;
8080 ulong_t cnt = 0;
8081 int index, sz = TTE8K;
8082 struct sf_hment *sfhme, *tmphme = NULL;
8083 struct hme_blk *hmeblkp;
8084
8085 pml = sfmmu_mlist_enter(pp);
8086
8087 #ifdef VAC
8088 if (kpm_enable)
8089 cnt = pp->p_kpmref;
8090 #endif
8091
8092 if (vpm_enable && pp->p_vpmref) {
8093 cnt += 1;
8094 }
8095
8096 if (pp->p_share + cnt > sh_thresh) {
8097 sfmmu_mlist_exit(pml);
8098 return (1);
8099 }
8100
8101 index = PP_MAPINDEX(pp);
8102
8103 again:
8104 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8105 tmphme = sfhme->hme_next;
8106 if (IS_PAHME(sfhme)) {
8107 continue;
8108 }
8109
8110 hmeblkp = sfmmu_hmetohblk(sfhme);
8111 if (hme_size(sfhme) != sz) {
8112 continue;
8113 }
8114
8115 if (hmeblkp->hblk_shared) {
8116 sf_srd_t *srdp = hblktosrd(hmeblkp);
8117 uint_t rid = hmeblkp->hblk_tag.htag_rid;
8118 sf_region_t *rgnp;
8119 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8120 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8121 ASSERT(srdp != NULL);
8122 rgnp = srdp->srd_hmergnp[rid];
8123 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8124 rgnp, rid);
8125 cnt += rgnp->rgn_refcnt;
8126 } else {
8127 cnt++;
8128 }
8129 if (cnt > sh_thresh) {
8130 sfmmu_mlist_exit(pml);
8131 return (1);
8132 }
8133 }
8134
8135 index >>= 1;
8136 sz++;
8137 while (index) {
8138 pp = PP_GROUPLEADER(pp, sz);
8139 ASSERT(sfmmu_mlist_held(pp));
8140 if (index & 0x1) {
8141 goto again;
8142 }
8143 index >>= 1;
8144 sz++;
8145 }
8146 sfmmu_mlist_exit(pml);
8147 return (0);
8148 }
8149
8150 /*
8151 * Unload all large mappings to the pp and reset the p_szc field of every
8152 * constituent page according to the remaining mappings.
8153 *
8154 * pp must be locked SE_EXCL. Even though no other constituent pages are
8155 * locked it's legal to unload the large mappings to the pp because all
8156 * constituent pages of large locked mappings have to be locked SE_SHARED.
8157 * This means if we have SE_EXCL lock on one of constituent pages none of the
8158 * large mappings to pp are locked.
8159 *
8160 * Decrease p_szc field starting from the last constituent page and ending
8161 * with the root page. This method is used because other threads rely on the
8162 * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8163 * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8164 * ensures that p_szc changes of the constituent pages appears atomic for all
8165 * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8166 *
8167 * This mechanism is only used for file system pages where it's not always
8168 * possible to get SE_EXCL locks on all constituent pages to demote the size
8169 * code (as is done for anonymous or kernel large pages).
8170 *
8171 * See more comments in front of sfmmu_mlspl_enter().
8172 */
8173 void
8174 hat_page_demote(page_t *pp)
8175 {
8176 int index;
8177 int sz;
8178 cpuset_t cpuset;
8179 int sync = 0;
8180 page_t *rootpp;
8181 struct sf_hment *sfhme;
8182 struct sf_hment *tmphme = NULL;
8183 uint_t pszc;
8184 page_t *lastpp;
8185 cpuset_t tset;
8186 pgcnt_t npgs;
8187 kmutex_t *pml;
8188 kmutex_t *pmtx = NULL;
8189
8190 ASSERT(PAGE_EXCL(pp));
8191 ASSERT(!PP_ISFREE(pp));
8192 ASSERT(!PP_ISKAS(pp));
8193 ASSERT(page_szc_lock_assert(pp));
8194 pml = sfmmu_mlist_enter(pp);
8195
8196 pszc = pp->p_szc;
8197 if (pszc == 0) {
8198 goto out;
8199 }
8200
8201 index = PP_MAPINDEX(pp) >> 1;
8202
8203 if (index) {
8204 CPUSET_ZERO(cpuset);
8205 sz = TTE64K;
8206 sync = 1;
8207 }
8208
8209 while (index) {
8210 if (!(index & 0x1)) {
8211 index >>= 1;
8212 sz++;
8213 continue;
8214 }
8215 ASSERT(sz <= pszc);
8216 rootpp = PP_GROUPLEADER(pp, sz);
8217 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8218 tmphme = sfhme->hme_next;
8219 ASSERT(!IS_PAHME(sfhme));
8220 if (hme_size(sfhme) != sz) {
8221 continue;
8222 }
8223 tset = sfmmu_pageunload(rootpp, sfhme, sz);
8224 CPUSET_OR(cpuset, tset);
8225 }
8226 if (index >>= 1) {
8227 sz++;
8228 }
8229 }
8230
8231 ASSERT(!PP_ISMAPPED_LARGE(pp));
8232
8233 if (sync) {
8234 xt_sync(cpuset);
8235 #ifdef VAC
8236 if (PP_ISTNC(pp)) {
8237 conv_tnc(rootpp, sz);
8238 }
8239 #endif /* VAC */
8240 }
8241
8242 pmtx = sfmmu_page_enter(pp);
8243
8244 ASSERT(pp->p_szc == pszc);
8245 rootpp = PP_PAGEROOT(pp);
8246 ASSERT(rootpp->p_szc == pszc);
8247 lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8248
8249 while (lastpp != rootpp) {
8250 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8251 ASSERT(sz < pszc);
8252 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8253 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8254 while (--npgs > 0) {
8255 lastpp->p_szc = (uchar_t)sz;
8256 lastpp = PP_PAGEPREV(lastpp);
8257 }
8258 if (sz) {
8259 /*
8260 * make sure before current root's pszc
8261 * is updated all updates to constituent pages pszc
8262 * fields are globally visible.
8263 */
8264 membar_producer();
8265 }
8266 lastpp->p_szc = sz;
8267 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8268 if (lastpp != rootpp) {
8269 lastpp = PP_PAGEPREV(lastpp);
8270 }
8271 }
8272 if (sz == 0) {
8273 /* the loop above doesn't cover this case */
8274 rootpp->p_szc = 0;
8275 }
8276 out:
8277 ASSERT(pp->p_szc == 0);
8278 if (pmtx != NULL) {
8279 sfmmu_page_exit(pmtx);
8280 }
8281 sfmmu_mlist_exit(pml);
8282 }
8283
8284 /*
8285 * Refresh the HAT ismttecnt[] element for size szc.
8286 * Caller must have set ISM busy flag to prevent mapping
8287 * lists from changing while we're traversing them.
8288 */
8289 pgcnt_t
8290 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8291 {
8292 ism_blk_t *ism_blkp = sfmmup->sfmmu_iblk;
8293 ism_map_t *ism_map;
8294 pgcnt_t npgs = 0;
8295 pgcnt_t npgs_scd = 0;
8296 int j;
8297 sf_scd_t *scdp;
8298 uchar_t rid;
8299
8300 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8301 scdp = sfmmup->sfmmu_scdp;
8302
8303 for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8304 ism_map = ism_blkp->iblk_maps;
8305 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8306 rid = ism_map[j].imap_rid;
8307 ASSERT(rid == SFMMU_INVALID_ISMRID ||
8308 rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8309
8310 if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8311 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8312 /* ISM is in sfmmup's SCD */
8313 npgs_scd +=
8314 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8315 } else {
8316 /* ISMs is not in SCD */
8317 npgs +=
8318 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8319 }
8320 }
8321 }
8322 sfmmup->sfmmu_ismttecnt[szc] = npgs;
8323 sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8324 return (npgs);
8325 }
8326
8327 /*
8328 * Yield the memory claim requirement for an address space.
8329 *
8330 * This is currently implemented as the number of bytes that have active
8331 * hardware translations that have page structures. Therefore, it can
8332 * underestimate the traditional resident set size, eg, if the
8333 * physical page is present and the hardware translation is missing;
8334 * and it can overestimate the rss, eg, if there are active
8335 * translations to a frame buffer with page structs.
8336 * Also, it does not take sharing into account.
8337 *
8338 * Note that we don't acquire locks here since this function is most often
8339 * called from the clock thread.
8340 */
8341 size_t
8342 hat_get_mapped_size(struct hat *hat)
8343 {
8344 size_t assize = 0;
8345 int i;
8346
8347 if (hat == NULL)
8348 return (0);
8349
8350 for (i = 0; i < mmu_page_sizes; i++)
8351 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8352 (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8353
8354 if (hat->sfmmu_iblk == NULL)
8355 return (assize);
8356
8357 for (i = 0; i < mmu_page_sizes; i++)
8358 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8359 (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8360
8361 return (assize);
8362 }
8363
8364 int
8365 hat_stats_enable(struct hat *hat)
8366 {
8367 hatlock_t *hatlockp;
8368
8369 hatlockp = sfmmu_hat_enter(hat);
8370 hat->sfmmu_rmstat++;
8371 sfmmu_hat_exit(hatlockp);
8372 return (1);
8373 }
8374
8375 void
8376 hat_stats_disable(struct hat *hat)
8377 {
8378 hatlock_t *hatlockp;
8379
8380 hatlockp = sfmmu_hat_enter(hat);
8381 hat->sfmmu_rmstat--;
8382 sfmmu_hat_exit(hatlockp);
8383 }
8384
8385 /*
8386 * Routines for entering or removing ourselves from the
8387 * ism_hat's mapping list. This is used for both private and
8388 * SCD hats.
8389 */
8390 static void
8391 iment_add(struct ism_ment *iment, struct hat *ism_hat)
8392 {
8393 ASSERT(MUTEX_HELD(&ism_mlist_lock));
8394
8395 iment->iment_prev = NULL;
8396 iment->iment_next = ism_hat->sfmmu_iment;
8397 if (ism_hat->sfmmu_iment) {
8398 ism_hat->sfmmu_iment->iment_prev = iment;
8399 }
8400 ism_hat->sfmmu_iment = iment;
8401 }
8402
8403 static void
8404 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8405 {
8406 ASSERT(MUTEX_HELD(&ism_mlist_lock));
8407
8408 if (ism_hat->sfmmu_iment == NULL) {
8409 panic("ism map entry remove - no entries");
8410 }
8411
8412 if (iment->iment_prev) {
8413 ASSERT(ism_hat->sfmmu_iment != iment);
8414 iment->iment_prev->iment_next = iment->iment_next;
8415 } else {
8416 ASSERT(ism_hat->sfmmu_iment == iment);
8417 ism_hat->sfmmu_iment = iment->iment_next;
8418 }
8419
8420 if (iment->iment_next) {
8421 iment->iment_next->iment_prev = iment->iment_prev;
8422 }
8423
8424 /*
8425 * zero out the entry
8426 */
8427 iment->iment_next = NULL;
8428 iment->iment_prev = NULL;
8429 iment->iment_hat = NULL;
8430 iment->iment_base_va = 0;
8431 }
8432
8433 /*
8434 * Hat_share()/unshare() return an (non-zero) error
8435 * when saddr and daddr are not properly aligned.
8436 *
8437 * The top level mapping element determines the alignment
8438 * requirement for saddr and daddr, depending on different
8439 * architectures.
8440 *
8441 * When hat_share()/unshare() are not supported,
8442 * HATOP_SHARE()/UNSHARE() return 0
8443 */
8444 int
8445 hat_share(struct hat *sfmmup, caddr_t addr,
8446 struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8447 {
8448 ism_blk_t *ism_blkp;
8449 ism_blk_t *new_iblk;
8450 ism_map_t *ism_map;
8451 ism_ment_t *ism_ment;
8452 int i, added;
8453 hatlock_t *hatlockp;
8454 int reload_mmu = 0;
8455 uint_t ismshift = page_get_shift(ismszc);
8456 size_t ismpgsz = page_get_pagesize(ismszc);
8457 uint_t ismmask = (uint_t)ismpgsz - 1;
8458 size_t sh_size = ISM_SHIFT(ismshift, len);
8459 ushort_t ismhatflag;
8460 hat_region_cookie_t rcookie;
8461 sf_scd_t *old_scdp;
8462
8463 #ifdef DEBUG
8464 caddr_t eaddr = addr + len;
8465 #endif /* DEBUG */
8466
8467 ASSERT(ism_hatid != NULL && sfmmup != NULL);
8468 ASSERT(sptaddr == ISMID_STARTADDR);
8469 /*
8470 * Check the alignment.
8471 */
8472 if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8473 return (EINVAL);
8474
8475 /*
8476 * Check size alignment.
8477 */
8478 if (!ISM_ALIGNED(ismshift, len))
8479 return (EINVAL);
8480
8481 /*
8482 * Allocate ism_ment for the ism_hat's mapping list, and an
8483 * ism map blk in case we need one. We must do our
8484 * allocations before acquiring locks to prevent a deadlock
8485 * in the kmem allocator on the mapping list lock.
8486 */
8487 new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8488 ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8489
8490 /*
8491 * Serialize ISM mappings with the ISM busy flag, and also the
8492 * trap handlers.
8493 */
8494 sfmmu_ismhat_enter(sfmmup, 0);
8495
8496 /*
8497 * Allocate an ism map blk if necessary.
8498 */
8499 if (sfmmup->sfmmu_iblk == NULL) {
8500 sfmmup->sfmmu_iblk = new_iblk;
8501 bzero(new_iblk, sizeof (*new_iblk));
8502 new_iblk->iblk_nextpa = (uint64_t)-1;
8503 membar_stst(); /* make sure next ptr visible to all CPUs */
8504 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8505 reload_mmu = 1;
8506 new_iblk = NULL;
8507 }
8508
8509 #ifdef DEBUG
8510 /*
8511 * Make sure mapping does not already exist.
8512 */
8513 ism_blkp = sfmmup->sfmmu_iblk;
8514 while (ism_blkp != NULL) {
8515 ism_map = ism_blkp->iblk_maps;
8516 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8517 if ((addr >= ism_start(ism_map[i]) &&
8518 addr < ism_end(ism_map[i])) ||
8519 eaddr > ism_start(ism_map[i]) &&
8520 eaddr <= ism_end(ism_map[i])) {
8521 panic("sfmmu_share: Already mapped!");
8522 }
8523 }
8524 ism_blkp = ism_blkp->iblk_next;
8525 }
8526 #endif /* DEBUG */
8527
8528 ASSERT(ismszc >= TTE4M);
8529 if (ismszc == TTE4M) {
8530 ismhatflag = HAT_4M_FLAG;
8531 } else if (ismszc == TTE32M) {
8532 ismhatflag = HAT_32M_FLAG;
8533 } else if (ismszc == TTE256M) {
8534 ismhatflag = HAT_256M_FLAG;
8535 }
8536 /*
8537 * Add mapping to first available mapping slot.
8538 */
8539 ism_blkp = sfmmup->sfmmu_iblk;
8540 added = 0;
8541 while (!added) {
8542 ism_map = ism_blkp->iblk_maps;
8543 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8544 if (ism_map[i].imap_ismhat == NULL) {
8545
8546 ism_map[i].imap_ismhat = ism_hatid;
8547 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8548 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8549 ism_map[i].imap_hatflags = ismhatflag;
8550 ism_map[i].imap_sz_mask = ismmask;
8551 /*
8552 * imap_seg is checked in ISM_CHECK to see if
8553 * non-NULL, then other info assumed valid.
8554 */
8555 membar_stst();
8556 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8557 ism_map[i].imap_ment = ism_ment;
8558
8559 /*
8560 * Now add ourselves to the ism_hat's
8561 * mapping list.
8562 */
8563 ism_ment->iment_hat = sfmmup;
8564 ism_ment->iment_base_va = addr;
8565 ism_hatid->sfmmu_ismhat = 1;
8566 mutex_enter(&ism_mlist_lock);
8567 iment_add(ism_ment, ism_hatid);
8568 mutex_exit(&ism_mlist_lock);
8569 added = 1;
8570 break;
8571 }
8572 }
8573 if (!added && ism_blkp->iblk_next == NULL) {
8574 ism_blkp->iblk_next = new_iblk;
8575 new_iblk = NULL;
8576 bzero(ism_blkp->iblk_next,
8577 sizeof (*ism_blkp->iblk_next));
8578 ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8579 membar_stst();
8580 ism_blkp->iblk_nextpa =
8581 va_to_pa((caddr_t)ism_blkp->iblk_next);
8582 }
8583 ism_blkp = ism_blkp->iblk_next;
8584 }
8585
8586 /*
8587 * After calling hat_join_region, sfmmup may join a new SCD or
8588 * move from the old scd to a new scd, in which case, we want to
8589 * shrink the sfmmup's private tsb size, i.e., pass shrink to
8590 * sfmmu_check_page_sizes at the end of this routine.
8591 */
8592 old_scdp = sfmmup->sfmmu_scdp;
8593
8594 rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8595 PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8596 if (rcookie != HAT_INVALID_REGION_COOKIE) {
8597 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8598 }
8599 /*
8600 * Update our counters for this sfmmup's ism mappings.
8601 */
8602 for (i = 0; i <= ismszc; i++) {
8603 if (!(disable_ism_large_pages & (1 << i)))
8604 (void) ism_tsb_entries(sfmmup, i);
8605 }
8606
8607 /*
8608 * For ISM and DISM we do not support 512K pages, so we only only
8609 * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8610 * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8611 *
8612 * Need to set 32M/256M ISM flags to make sure
8613 * sfmmu_check_page_sizes() enables them on Panther.
8614 */
8615 ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8616
8617 switch (ismszc) {
8618 case TTE256M:
8619 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8620 hatlockp = sfmmu_hat_enter(sfmmup);
8621 SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8622 sfmmu_hat_exit(hatlockp);
8623 }
8624 break;
8625 case TTE32M:
8626 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8627 hatlockp = sfmmu_hat_enter(sfmmup);
8628 SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8629 sfmmu_hat_exit(hatlockp);
8630 }
8631 break;
8632 default:
8633 break;
8634 }
8635
8636 /*
8637 * If we updated the ismblkpa for this HAT we must make
8638 * sure all CPUs running this process reload their tsbmiss area.
8639 * Otherwise they will fail to load the mappings in the tsbmiss
8640 * handler and will loop calling pagefault().
8641 */
8642 if (reload_mmu) {
8643 hatlockp = sfmmu_hat_enter(sfmmup);
8644 sfmmu_sync_mmustate(sfmmup);
8645 sfmmu_hat_exit(hatlockp);
8646 }
8647
8648 sfmmu_ismhat_exit(sfmmup, 0);
8649
8650 /*
8651 * Free up ismblk if we didn't use it.
8652 */
8653 if (new_iblk != NULL)
8654 kmem_cache_free(ism_blk_cache, new_iblk);
8655
8656 /*
8657 * Check TSB and TLB page sizes.
8658 */
8659 if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8660 sfmmu_check_page_sizes(sfmmup, 0);
8661 } else {
8662 sfmmu_check_page_sizes(sfmmup, 1);
8663 }
8664 return (0);
8665 }
8666
8667 /*
8668 * hat_unshare removes exactly one ism_map from
8669 * this process's as. It expects multiple calls
8670 * to hat_unshare for multiple shm segments.
8671 */
8672 void
8673 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8674 {
8675 ism_map_t *ism_map;
8676 ism_ment_t *free_ment = NULL;
8677 ism_blk_t *ism_blkp;
8678 struct hat *ism_hatid;
8679 int found, i;
8680 hatlock_t *hatlockp;
8681 struct tsb_info *tsbinfo;
8682 uint_t ismshift = page_get_shift(ismszc);
8683 size_t sh_size = ISM_SHIFT(ismshift, len);
8684 uchar_t ism_rid;
8685 sf_scd_t *old_scdp;
8686
8687 ASSERT(ISM_ALIGNED(ismshift, addr));
8688 ASSERT(ISM_ALIGNED(ismshift, len));
8689 ASSERT(sfmmup != NULL);
8690 ASSERT(sfmmup != ksfmmup);
8691
8692 ASSERT(sfmmup->sfmmu_as != NULL);
8693
8694 /*
8695 * Make sure that during the entire time ISM mappings are removed,
8696 * the trap handlers serialize behind us, and that no one else
8697 * can be mucking with ISM mappings. This also lets us get away
8698 * with not doing expensive cross calls to flush the TLB -- we
8699 * just discard the context, flush the entire TSB, and call it
8700 * a day.
8701 */
8702 sfmmu_ismhat_enter(sfmmup, 0);
8703
8704 /*
8705 * Remove the mapping.
8706 *
8707 * We can't have any holes in the ism map.
8708 * The tsb miss code while searching the ism map will
8709 * stop on an empty map slot. So we must move
8710 * everyone past the hole up 1 if any.
8711 *
8712 * Also empty ism map blks are not freed until the
8713 * process exits. This is to prevent a MT race condition
8714 * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8715 */
8716 found = 0;
8717 ism_blkp = sfmmup->sfmmu_iblk;
8718 while (!found && ism_blkp != NULL) {
8719 ism_map = ism_blkp->iblk_maps;
8720 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8721 if (addr == ism_start(ism_map[i]) &&
8722 sh_size == (size_t)(ism_size(ism_map[i]))) {
8723 found = 1;
8724 break;
8725 }
8726 }
8727 if (!found)
8728 ism_blkp = ism_blkp->iblk_next;
8729 }
8730
8731 if (found) {
8732 ism_hatid = ism_map[i].imap_ismhat;
8733 ism_rid = ism_map[i].imap_rid;
8734 ASSERT(ism_hatid != NULL);
8735 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8736
8737 /*
8738 * After hat_leave_region, the sfmmup may leave SCD,
8739 * in which case, we want to grow the private tsb size when
8740 * calling sfmmu_check_page_sizes at the end of the routine.
8741 */
8742 old_scdp = sfmmup->sfmmu_scdp;
8743 /*
8744 * Then remove ourselves from the region.
8745 */
8746 if (ism_rid != SFMMU_INVALID_ISMRID) {
8747 hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8748 HAT_REGION_ISM);
8749 }
8750
8751 /*
8752 * And now guarantee that any other cpu
8753 * that tries to process an ISM miss
8754 * will go to tl=0.
8755 */
8756 hatlockp = sfmmu_hat_enter(sfmmup);
8757 sfmmu_invalidate_ctx(sfmmup);
8758 sfmmu_hat_exit(hatlockp);
8759
8760 /*
8761 * Remove ourselves from the ism mapping list.
8762 */
8763 mutex_enter(&ism_mlist_lock);
8764 iment_sub(ism_map[i].imap_ment, ism_hatid);
8765 mutex_exit(&ism_mlist_lock);
8766 free_ment = ism_map[i].imap_ment;
8767
8768 /*
8769 * We delete the ism map by copying
8770 * the next map over the current one.
8771 * We will take the next one in the maps
8772 * array or from the next ism_blk.
8773 */
8774 while (ism_blkp != NULL) {
8775 ism_map = ism_blkp->iblk_maps;
8776 while (i < (ISM_MAP_SLOTS - 1)) {
8777 ism_map[i] = ism_map[i + 1];
8778 i++;
8779 }
8780 /* i == (ISM_MAP_SLOTS - 1) */
8781 ism_blkp = ism_blkp->iblk_next;
8782 if (ism_blkp != NULL) {
8783 ism_map[i] = ism_blkp->iblk_maps[0];
8784 i = 0;
8785 } else {
8786 ism_map[i].imap_seg = 0;
8787 ism_map[i].imap_vb_shift = 0;
8788 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8789 ism_map[i].imap_hatflags = 0;
8790 ism_map[i].imap_sz_mask = 0;
8791 ism_map[i].imap_ismhat = NULL;
8792 ism_map[i].imap_ment = NULL;
8793 }
8794 }
8795
8796 /*
8797 * Now flush entire TSB for the process, since
8798 * demapping page by page can be too expensive.
8799 * We don't have to flush the TLB here anymore
8800 * since we switch to a new TLB ctx instead.
8801 * Also, there is no need to flush if the process
8802 * is exiting since the TSB will be freed later.
8803 */
8804 if (!sfmmup->sfmmu_free) {
8805 hatlockp = sfmmu_hat_enter(sfmmup);
8806 for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8807 tsbinfo = tsbinfo->tsb_next) {
8808 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8809 continue;
8810 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8811 tsbinfo->tsb_flags |=
8812 TSB_FLUSH_NEEDED;
8813 continue;
8814 }
8815
8816 sfmmu_inv_tsb(tsbinfo->tsb_va,
8817 TSB_BYTES(tsbinfo->tsb_szc));
8818 }
8819 sfmmu_hat_exit(hatlockp);
8820 }
8821 }
8822
8823 /*
8824 * Update our counters for this sfmmup's ism mappings.
8825 */
8826 for (i = 0; i <= ismszc; i++) {
8827 if (!(disable_ism_large_pages & (1 << i)))
8828 (void) ism_tsb_entries(sfmmup, i);
8829 }
8830
8831 sfmmu_ismhat_exit(sfmmup, 0);
8832
8833 /*
8834 * We must do our freeing here after dropping locks
8835 * to prevent a deadlock in the kmem allocator on the
8836 * mapping list lock.
8837 */
8838 if (free_ment != NULL)
8839 kmem_cache_free(ism_ment_cache, free_ment);
8840
8841 /*
8842 * Check TSB and TLB page sizes if the process isn't exiting.
8843 */
8844 if (!sfmmup->sfmmu_free) {
8845 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
8846 sfmmu_check_page_sizes(sfmmup, 1);
8847 } else {
8848 sfmmu_check_page_sizes(sfmmup, 0);
8849 }
8850 }
8851 }
8852
8853 /* ARGSUSED */
8854 static int
8855 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
8856 {
8857 /* void *buf is sfmmu_t pointer */
8858 bzero(buf, sizeof (sfmmu_t));
8859
8860 return (0);
8861 }
8862
8863 /* ARGSUSED */
8864 static void
8865 sfmmu_idcache_destructor(void *buf, void *cdrarg)
8866 {
8867 /* void *buf is sfmmu_t pointer */
8868 }
8869
8870 /*
8871 * setup kmem hmeblks by bzeroing all members and initializing the nextpa
8872 * field to be the pa of this hmeblk
8873 */
8874 /* ARGSUSED */
8875 static int
8876 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
8877 {
8878 struct hme_blk *hmeblkp;
8879
8880 bzero(buf, (size_t)cdrarg);
8881 hmeblkp = (struct hme_blk *)buf;
8882 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
8883
8884 #ifdef HBLK_TRACE
8885 mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
8886 #endif /* HBLK_TRACE */
8887
8888 return (0);
8889 }
8890
8891 /* ARGSUSED */
8892 static void
8893 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
8894 {
8895
8896 #ifdef HBLK_TRACE
8897
8898 struct hme_blk *hmeblkp;
8899
8900 hmeblkp = (struct hme_blk *)buf;
8901 mutex_destroy(&hmeblkp->hblk_audit_lock);
8902
8903 #endif /* HBLK_TRACE */
8904 }
8905
8906 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
8907 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
8908 /*
8909 * The kmem allocator will callback into our reclaim routine when the system
8910 * is running low in memory. We traverse the hash and free up all unused but
8911 * still cached hme_blks. We also traverse the free list and free them up
8912 * as well.
8913 */
8914 /*ARGSUSED*/
8915 static void
8916 sfmmu_hblkcache_reclaim(void *cdrarg)
8917 {
8918 int i;
8919 struct hmehash_bucket *hmebp;
8920 struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
8921 static struct hmehash_bucket *uhmehash_reclaim_hand;
8922 static struct hmehash_bucket *khmehash_reclaim_hand;
8923 struct hme_blk *list = NULL, *last_hmeblkp;
8924 cpuset_t cpuset = cpu_ready_set;
8925 cpu_hme_pend_t *cpuhp;
8926
8927 /* Free up hmeblks on the cpu pending lists */
8928 for (i = 0; i < NCPU; i++) {
8929 cpuhp = &cpu_hme_pend[i];
8930 if (cpuhp->chp_listp != NULL) {
8931 mutex_enter(&cpuhp->chp_mutex);
8932 if (cpuhp->chp_listp == NULL) {
8933 mutex_exit(&cpuhp->chp_mutex);
8934 continue;
8935 }
8936 for (last_hmeblkp = cpuhp->chp_listp;
8937 last_hmeblkp->hblk_next != NULL;
8938 last_hmeblkp = last_hmeblkp->hblk_next)
8939 ;
8940 last_hmeblkp->hblk_next = list;
8941 list = cpuhp->chp_listp;
8942 cpuhp->chp_listp = NULL;
8943 cpuhp->chp_count = 0;
8944 mutex_exit(&cpuhp->chp_mutex);
8945 }
8946
8947 }
8948
8949 if (list != NULL) {
8950 kpreempt_disable();
8951 CPUSET_DEL(cpuset, CPU->cpu_id);
8952 xt_sync(cpuset);
8953 xt_sync(cpuset);
8954 kpreempt_enable();
8955 sfmmu_hblk_free(&list);
8956 list = NULL;
8957 }
8958
8959 hmebp = uhmehash_reclaim_hand;
8960 if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
8961 uhmehash_reclaim_hand = hmebp = uhme_hash;
8962 uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8963
8964 for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8965 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8966 hmeblkp = hmebp->hmeblkp;
8967 pr_hblk = NULL;
8968 while (hmeblkp) {
8969 nx_hblk = hmeblkp->hblk_next;
8970 if (!hmeblkp->hblk_vcnt &&
8971 !hmeblkp->hblk_hmecnt) {
8972 sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8973 pr_hblk, &list, 0);
8974 } else {
8975 pr_hblk = hmeblkp;
8976 }
8977 hmeblkp = nx_hblk;
8978 }
8979 SFMMU_HASH_UNLOCK(hmebp);
8980 }
8981 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
8982 hmebp = uhme_hash;
8983 }
8984
8985 hmebp = khmehash_reclaim_hand;
8986 if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
8987 khmehash_reclaim_hand = hmebp = khme_hash;
8988 khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8989
8990 for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8991 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8992 hmeblkp = hmebp->hmeblkp;
8993 pr_hblk = NULL;
8994 while (hmeblkp) {
8995 nx_hblk = hmeblkp->hblk_next;
8996 if (!hmeblkp->hblk_vcnt &&
8997 !hmeblkp->hblk_hmecnt) {
8998 sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8999 pr_hblk, &list, 0);
9000 } else {
9001 pr_hblk = hmeblkp;
9002 }
9003 hmeblkp = nx_hblk;
9004 }
9005 SFMMU_HASH_UNLOCK(hmebp);
9006 }
9007 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9008 hmebp = khme_hash;
9009 }
9010 sfmmu_hblks_list_purge(&list, 0);
9011 }
9012
9013 /*
9014 * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9015 * same goes for sfmmu_get_addrvcolor().
9016 *
9017 * This function will return the virtual color for the specified page. The
9018 * virtual color corresponds to this page current mapping or its last mapping.
9019 * It is used by memory allocators to choose addresses with the correct
9020 * alignment so vac consistency is automatically maintained. If the page
9021 * has no color it returns -1.
9022 */
9023 /*ARGSUSED*/
9024 int
9025 sfmmu_get_ppvcolor(struct page *pp)
9026 {
9027 #ifdef VAC
9028 int color;
9029
9030 if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9031 return (-1);
9032 }
9033 color = PP_GET_VCOLOR(pp);
9034 ASSERT(color < mmu_btop(shm_alignment));
9035 return (color);
9036 #else
9037 return (-1);
9038 #endif /* VAC */
9039 }
9040
9041 /*
9042 * This function will return the desired alignment for vac consistency
9043 * (vac color) given a virtual address. If no vac is present it returns -1.
9044 */
9045 /*ARGSUSED*/
9046 int
9047 sfmmu_get_addrvcolor(caddr_t vaddr)
9048 {
9049 #ifdef VAC
9050 if (cache & CACHE_VAC) {
9051 return (addr_to_vcolor(vaddr));
9052 } else {
9053 return (-1);
9054 }
9055 #else
9056 return (-1);
9057 #endif /* VAC */
9058 }
9059
9060 #ifdef VAC
9061 /*
9062 * Check for conflicts.
9063 * A conflict exists if the new and existent mappings do not match in
9064 * their "shm_alignment fields. If conflicts exist, the existant mappings
9065 * are flushed unless one of them is locked. If one of them is locked, then
9066 * the mappings are flushed and converted to non-cacheable mappings.
9067 */
9068 static void
9069 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9070 {
9071 struct hat *tmphat;
9072 struct sf_hment *sfhmep, *tmphme = NULL;
9073 struct hme_blk *hmeblkp;
9074 int vcolor;
9075 tte_t tte;
9076
9077 ASSERT(sfmmu_mlist_held(pp));
9078 ASSERT(!PP_ISNC(pp)); /* page better be cacheable */
9079
9080 vcolor = addr_to_vcolor(addr);
9081 if (PP_NEWPAGE(pp)) {
9082 PP_SET_VCOLOR(pp, vcolor);
9083 return;
9084 }
9085
9086 if (PP_GET_VCOLOR(pp) == vcolor) {
9087 return;
9088 }
9089
9090 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9091 /*
9092 * Previous user of page had a different color
9093 * but since there are no current users
9094 * we just flush the cache and change the color.
9095 */
9096 SFMMU_STAT(sf_pgcolor_conflict);
9097 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9098 PP_SET_VCOLOR(pp, vcolor);
9099 return;
9100 }
9101
9102 /*
9103 * If we get here we have a vac conflict with a current
9104 * mapping. VAC conflict policy is as follows.
9105 * - The default is to unload the other mappings unless:
9106 * - If we have a large mapping we uncache the page.
9107 * We need to uncache the rest of the large page too.
9108 * - If any of the mappings are locked we uncache the page.
9109 * - If the requested mapping is inconsistent
9110 * with another mapping and that mapping
9111 * is in the same address space we have to
9112 * make it non-cached. The default thing
9113 * to do is unload the inconsistent mapping
9114 * but if they are in the same address space
9115 * we run the risk of unmapping the pc or the
9116 * stack which we will use as we return to the user,
9117 * in which case we can then fault on the thing
9118 * we just unloaded and get into an infinite loop.
9119 */
9120 if (PP_ISMAPPED_LARGE(pp)) {
9121 int sz;
9122
9123 /*
9124 * Existing mapping is for big pages. We don't unload
9125 * existing big mappings to satisfy new mappings.
9126 * Always convert all mappings to TNC.
9127 */
9128 sz = fnd_mapping_sz(pp);
9129 pp = PP_GROUPLEADER(pp, sz);
9130 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9131 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9132 TTEPAGES(sz));
9133
9134 return;
9135 }
9136
9137 /*
9138 * check if any mapping is in same as or if it is locked
9139 * since in that case we need to uncache.
9140 */
9141 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9142 tmphme = sfhmep->hme_next;
9143 if (IS_PAHME(sfhmep))
9144 continue;
9145 hmeblkp = sfmmu_hmetohblk(sfhmep);
9146 tmphat = hblktosfmmu(hmeblkp);
9147 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9148 ASSERT(TTE_IS_VALID(&tte));
9149 if (hmeblkp->hblk_shared || tmphat == hat ||
9150 hmeblkp->hblk_lckcnt) {
9151 /*
9152 * We have an uncache conflict
9153 */
9154 SFMMU_STAT(sf_uncache_conflict);
9155 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9156 return;
9157 }
9158 }
9159
9160 /*
9161 * We have an unload conflict
9162 * We have already checked for LARGE mappings, therefore
9163 * the remaining mapping(s) must be TTE8K.
9164 */
9165 SFMMU_STAT(sf_unload_conflict);
9166
9167 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9168 tmphme = sfhmep->hme_next;
9169 if (IS_PAHME(sfhmep))
9170 continue;
9171 hmeblkp = sfmmu_hmetohblk(sfhmep);
9172 ASSERT(!hmeblkp->hblk_shared);
9173 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9174 }
9175
9176 if (PP_ISMAPPED_KPM(pp))
9177 sfmmu_kpm_vac_unload(pp, addr);
9178
9179 /*
9180 * Unloads only do TLB flushes so we need to flush the
9181 * cache here.
9182 */
9183 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9184 PP_SET_VCOLOR(pp, vcolor);
9185 }
9186
9187 /*
9188 * Whenever a mapping is unloaded and the page is in TNC state,
9189 * we see if the page can be made cacheable again. 'pp' is
9190 * the page that we just unloaded a mapping from, the size
9191 * of mapping that was unloaded is 'ottesz'.
9192 * Remark:
9193 * The recache policy for mpss pages can leave a performance problem
9194 * under the following circumstances:
9195 * . A large page in uncached mode has just been unmapped.
9196 * . All constituent pages are TNC due to a conflicting small mapping.
9197 * . There are many other, non conflicting, small mappings around for
9198 * a lot of the constituent pages.
9199 * . We're called w/ the "old" groupleader page and the old ottesz,
9200 * but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9201 * we end up w/ TTE8K or npages == 1.
9202 * . We call tst_tnc w/ the old groupleader only, and if there is no
9203 * conflict, we re-cache only this page.
9204 * . All other small mappings are not checked and will be left in TNC mode.
9205 * The problem is not very serious because:
9206 * . mpss is actually only defined for heap and stack, so the probability
9207 * is not very high that a large page mapping exists in parallel to a small
9208 * one (this is possible, but seems to be bad programming style in the
9209 * appl).
9210 * . The problem gets a little bit more serious, when those TNC pages
9211 * have to be mapped into kernel space, e.g. for networking.
9212 * . When VAC alias conflicts occur in applications, this is regarded
9213 * as an application bug. So if kstat's show them, the appl should
9214 * be changed anyway.
9215 */
9216 void
9217 conv_tnc(page_t *pp, int ottesz)
9218 {
9219 int cursz, dosz;
9220 pgcnt_t curnpgs, dopgs;
9221 pgcnt_t pg64k;
9222 page_t *pp2;
9223
9224 /*
9225 * Determine how big a range we check for TNC and find
9226 * leader page. cursz is the size of the biggest
9227 * mapping that still exist on 'pp'.
9228 */
9229 if (PP_ISMAPPED_LARGE(pp)) {
9230 cursz = fnd_mapping_sz(pp);
9231 } else {
9232 cursz = TTE8K;
9233 }
9234
9235 if (ottesz >= cursz) {
9236 dosz = ottesz;
9237 pp2 = pp;
9238 } else {
9239 dosz = cursz;
9240 pp2 = PP_GROUPLEADER(pp, dosz);
9241 }
9242
9243 pg64k = TTEPAGES(TTE64K);
9244 dopgs = TTEPAGES(dosz);
9245
9246 ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9247
9248 while (dopgs != 0) {
9249 curnpgs = TTEPAGES(cursz);
9250 if (tst_tnc(pp2, curnpgs)) {
9251 SFMMU_STAT_ADD(sf_recache, curnpgs);
9252 sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9253 curnpgs);
9254 }
9255
9256 ASSERT(dopgs >= curnpgs);
9257 dopgs -= curnpgs;
9258
9259 if (dopgs == 0) {
9260 break;
9261 }
9262
9263 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9264 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9265 cursz = fnd_mapping_sz(pp2);
9266 } else {
9267 cursz = TTE8K;
9268 }
9269 }
9270 }
9271
9272 /*
9273 * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9274 * returns 0 otherwise. Note that oaddr argument is valid for only
9275 * 8k pages.
9276 */
9277 int
9278 tst_tnc(page_t *pp, pgcnt_t npages)
9279 {
9280 struct sf_hment *sfhme;
9281 struct hme_blk *hmeblkp;
9282 tte_t tte;
9283 caddr_t vaddr;
9284 int clr_valid = 0;
9285 int color, color1, bcolor;
9286 int i, ncolors;
9287
9288 ASSERT(pp != NULL);
9289 ASSERT(!(cache & CACHE_WRITEBACK));
9290
9291 if (npages > 1) {
9292 ncolors = CACHE_NUM_COLOR;
9293 }
9294
9295 for (i = 0; i < npages; i++) {
9296 ASSERT(sfmmu_mlist_held(pp));
9297 ASSERT(PP_ISTNC(pp));
9298 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9299
9300 if (PP_ISPNC(pp)) {
9301 return (0);
9302 }
9303
9304 clr_valid = 0;
9305 if (PP_ISMAPPED_KPM(pp)) {
9306 caddr_t kpmvaddr;
9307
9308 ASSERT(kpm_enable);
9309 kpmvaddr = hat_kpm_page2va(pp, 1);
9310 ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9311 color1 = addr_to_vcolor(kpmvaddr);
9312 clr_valid = 1;
9313 }
9314
9315 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9316 if (IS_PAHME(sfhme))
9317 continue;
9318 hmeblkp = sfmmu_hmetohblk(sfhme);
9319
9320 sfmmu_copytte(&sfhme->hme_tte, &tte);
9321 ASSERT(TTE_IS_VALID(&tte));
9322
9323 vaddr = tte_to_vaddr(hmeblkp, tte);
9324 color = addr_to_vcolor(vaddr);
9325
9326 if (npages > 1) {
9327 /*
9328 * If there is a big mapping, make sure
9329 * 8K mapping is consistent with the big
9330 * mapping.
9331 */
9332 bcolor = i % ncolors;
9333 if (color != bcolor) {
9334 return (0);
9335 }
9336 }
9337 if (!clr_valid) {
9338 clr_valid = 1;
9339 color1 = color;
9340 }
9341
9342 if (color1 != color) {
9343 return (0);
9344 }
9345 }
9346
9347 pp = PP_PAGENEXT(pp);
9348 }
9349
9350 return (1);
9351 }
9352
9353 void
9354 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9355 pgcnt_t npages)
9356 {
9357 kmutex_t *pmtx;
9358 int i, ncolors, bcolor;
9359 kpm_hlk_t *kpmp;
9360 cpuset_t cpuset;
9361
9362 ASSERT(pp != NULL);
9363 ASSERT(!(cache & CACHE_WRITEBACK));
9364
9365 kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9366 pmtx = sfmmu_page_enter(pp);
9367
9368 /*
9369 * Fast path caching single unmapped page
9370 */
9371 if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9372 flags == HAT_CACHE) {
9373 PP_CLRTNC(pp);
9374 PP_CLRPNC(pp);
9375 sfmmu_page_exit(pmtx);
9376 sfmmu_kpm_kpmp_exit(kpmp);
9377 return;
9378 }
9379
9380 /*
9381 * We need to capture all cpus in order to change cacheability
9382 * because we can't allow one cpu to access the same physical
9383 * page using a cacheable and a non-cachebale mapping at the same
9384 * time. Since we may end up walking the ism mapping list
9385 * have to grab it's lock now since we can't after all the
9386 * cpus have been captured.
9387 */
9388 sfmmu_hat_lock_all();
9389 mutex_enter(&ism_mlist_lock);
9390 kpreempt_disable();
9391 cpuset = cpu_ready_set;
9392 xc_attention(cpuset);
9393
9394 if (npages > 1) {
9395 /*
9396 * Make sure all colors are flushed since the
9397 * sfmmu_page_cache() only flushes one color-
9398 * it does not know big pages.
9399 */
9400 ncolors = CACHE_NUM_COLOR;
9401 if (flags & HAT_TMPNC) {
9402 for (i = 0; i < ncolors; i++) {
9403 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9404 }
9405 cache_flush_flag = CACHE_NO_FLUSH;
9406 }
9407 }
9408
9409 for (i = 0; i < npages; i++) {
9410
9411 ASSERT(sfmmu_mlist_held(pp));
9412
9413 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9414
9415 if (npages > 1) {
9416 bcolor = i % ncolors;
9417 } else {
9418 bcolor = NO_VCOLOR;
9419 }
9420
9421 sfmmu_page_cache(pp, flags, cache_flush_flag,
9422 bcolor);
9423 }
9424
9425 pp = PP_PAGENEXT(pp);
9426 }
9427
9428 xt_sync(cpuset);
9429 xc_dismissed(cpuset);
9430 mutex_exit(&ism_mlist_lock);
9431 sfmmu_hat_unlock_all();
9432 sfmmu_page_exit(pmtx);
9433 sfmmu_kpm_kpmp_exit(kpmp);
9434 kpreempt_enable();
9435 }
9436
9437 /*
9438 * This function changes the virtual cacheability of all mappings to a
9439 * particular page. When changing from uncache to cacheable the mappings will
9440 * only be changed if all of them have the same virtual color.
9441 * We need to flush the cache in all cpus. It is possible that
9442 * a process referenced a page as cacheable but has sinced exited
9443 * and cleared the mapping list. We still to flush it but have no
9444 * state so all cpus is the only alternative.
9445 */
9446 static void
9447 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9448 {
9449 struct sf_hment *sfhme;
9450 struct hme_blk *hmeblkp;
9451 sfmmu_t *sfmmup;
9452 tte_t tte, ttemod;
9453 caddr_t vaddr;
9454 int ret, color;
9455 pfn_t pfn;
9456
9457 color = bcolor;
9458 pfn = pp->p_pagenum;
9459
9460 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9461
9462 if (IS_PAHME(sfhme))
9463 continue;
9464 hmeblkp = sfmmu_hmetohblk(sfhme);
9465
9466 sfmmu_copytte(&sfhme->hme_tte, &tte);
9467 ASSERT(TTE_IS_VALID(&tte));
9468 vaddr = tte_to_vaddr(hmeblkp, tte);
9469 color = addr_to_vcolor(vaddr);
9470
9471 #ifdef DEBUG
9472 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9473 ASSERT(color == bcolor);
9474 }
9475 #endif
9476
9477 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9478
9479 ttemod = tte;
9480 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9481 TTE_CLR_VCACHEABLE(&ttemod);
9482 } else { /* flags & HAT_CACHE */
9483 TTE_SET_VCACHEABLE(&ttemod);
9484 }
9485 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9486 if (ret < 0) {
9487 /*
9488 * Since all cpus are captured modifytte should not
9489 * fail.
9490 */
9491 panic("sfmmu_page_cache: write to tte failed");
9492 }
9493
9494 sfmmup = hblktosfmmu(hmeblkp);
9495 if (cache_flush_flag == CACHE_FLUSH) {
9496 /*
9497 * Flush TSBs, TLBs and caches
9498 */
9499 if (hmeblkp->hblk_shared) {
9500 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9501 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9502 sf_region_t *rgnp;
9503 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9504 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9505 ASSERT(srdp != NULL);
9506 rgnp = srdp->srd_hmergnp[rid];
9507 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9508 srdp, rgnp, rid);
9509 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9510 hmeblkp, 0);
9511 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9512 } else if (sfmmup->sfmmu_ismhat) {
9513 if (flags & HAT_CACHE) {
9514 SFMMU_STAT(sf_ism_recache);
9515 } else {
9516 SFMMU_STAT(sf_ism_uncache);
9517 }
9518 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9519 pfn, CACHE_FLUSH);
9520 } else {
9521 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9522 pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9523 }
9524
9525 /*
9526 * all cache entries belonging to this pfn are
9527 * now flushed.
9528 */
9529 cache_flush_flag = CACHE_NO_FLUSH;
9530 } else {
9531 /*
9532 * Flush only TSBs and TLBs.
9533 */
9534 if (hmeblkp->hblk_shared) {
9535 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9536 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9537 sf_region_t *rgnp;
9538 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9539 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9540 ASSERT(srdp != NULL);
9541 rgnp = srdp->srd_hmergnp[rid];
9542 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9543 srdp, rgnp, rid);
9544 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9545 hmeblkp, 0);
9546 } else if (sfmmup->sfmmu_ismhat) {
9547 if (flags & HAT_CACHE) {
9548 SFMMU_STAT(sf_ism_recache);
9549 } else {
9550 SFMMU_STAT(sf_ism_uncache);
9551 }
9552 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9553 pfn, CACHE_NO_FLUSH);
9554 } else {
9555 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9556 }
9557 }
9558 }
9559
9560 if (PP_ISMAPPED_KPM(pp))
9561 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9562
9563 switch (flags) {
9564
9565 default:
9566 panic("sfmmu_pagecache: unknown flags");
9567 break;
9568
9569 case HAT_CACHE:
9570 PP_CLRTNC(pp);
9571 PP_CLRPNC(pp);
9572 PP_SET_VCOLOR(pp, color);
9573 break;
9574
9575 case HAT_TMPNC:
9576 PP_SETTNC(pp);
9577 PP_SET_VCOLOR(pp, NO_VCOLOR);
9578 break;
9579
9580 case HAT_UNCACHE:
9581 PP_SETPNC(pp);
9582 PP_CLRTNC(pp);
9583 PP_SET_VCOLOR(pp, NO_VCOLOR);
9584 break;
9585 }
9586 }
9587 #endif /* VAC */
9588
9589
9590 /*
9591 * Wrapper routine used to return a context.
9592 *
9593 * It's the responsibility of the caller to guarantee that the
9594 * process serializes on calls here by taking the HAT lock for
9595 * the hat.
9596 *
9597 */
9598 static void
9599 sfmmu_get_ctx(sfmmu_t *sfmmup)
9600 {
9601 mmu_ctx_t *mmu_ctxp;
9602 uint_t pstate_save;
9603 int ret;
9604
9605 ASSERT(sfmmu_hat_lock_held(sfmmup));
9606 ASSERT(sfmmup != ksfmmup);
9607
9608 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9609 sfmmu_setup_tsbinfo(sfmmup);
9610 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9611 }
9612
9613 kpreempt_disable();
9614
9615 mmu_ctxp = CPU_MMU_CTXP(CPU);
9616 ASSERT(mmu_ctxp);
9617 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9618 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9619
9620 /*
9621 * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9622 */
9623 if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9624 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9625
9626 /*
9627 * Let the MMU set up the page sizes to use for
9628 * this context in the TLB. Don't program 2nd dtlb for ism hat.
9629 */
9630 if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9631 mmu_set_ctx_page_sizes(sfmmup);
9632 }
9633
9634 /*
9635 * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9636 * interrupts disabled to prevent race condition with wrap-around
9637 * ctx invalidatation. In sun4v, ctx invalidation also involves
9638 * a HV call to set the number of TSBs to 0. If interrupts are not
9639 * disabled until after sfmmu_load_mmustate is complete TSBs may
9640 * become assigned to INVALID_CONTEXT. This is not allowed.
9641 */
9642 pstate_save = sfmmu_disable_intrs();
9643
9644 if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9645 sfmmup->sfmmu_scdp != NULL) {
9646 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9647 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9648 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9649 /* debug purpose only */
9650 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9651 != INVALID_CONTEXT);
9652 }
9653 sfmmu_load_mmustate(sfmmup);
9654
9655 sfmmu_enable_intrs(pstate_save);
9656
9657 kpreempt_enable();
9658 }
9659
9660 /*
9661 * When all cnums are used up in a MMU, cnum will wrap around to the
9662 * next generation and start from 2.
9663 */
9664 static void
9665 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9666 {
9667
9668 /* caller must have disabled the preemption */
9669 ASSERT(curthread->t_preempt >= 1);
9670 ASSERT(mmu_ctxp != NULL);
9671
9672 /* acquire Per-MMU (PM) spin lock */
9673 mutex_enter(&mmu_ctxp->mmu_lock);
9674
9675 /* re-check to see if wrap-around is needed */
9676 if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9677 goto done;
9678
9679 SFMMU_MMU_STAT(mmu_wrap_around);
9680
9681 /* update gnum */
9682 ASSERT(mmu_ctxp->mmu_gnum != 0);
9683 mmu_ctxp->mmu_gnum++;
9684 if (mmu_ctxp->mmu_gnum == 0 ||
9685 mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9686 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9687 (void *)mmu_ctxp);
9688 }
9689
9690 if (mmu_ctxp->mmu_ncpus > 1) {
9691 cpuset_t cpuset;
9692
9693 membar_enter(); /* make sure updated gnum visible */
9694
9695 SFMMU_XCALL_STATS(NULL);
9696
9697 /* xcall to others on the same MMU to invalidate ctx */
9698 cpuset = mmu_ctxp->mmu_cpuset;
9699 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9700 CPUSET_DEL(cpuset, CPU->cpu_id);
9701 CPUSET_AND(cpuset, cpu_ready_set);
9702
9703 /*
9704 * Pass in INVALID_CONTEXT as the first parameter to
9705 * sfmmu_raise_tsb_exception, which invalidates the context
9706 * of any process running on the CPUs in the MMU.
9707 */
9708 xt_some(cpuset, sfmmu_raise_tsb_exception,
9709 INVALID_CONTEXT, INVALID_CONTEXT);
9710 xt_sync(cpuset);
9711
9712 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9713 }
9714
9715 if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9716 sfmmu_setctx_sec(INVALID_CONTEXT);
9717 sfmmu_clear_utsbinfo();
9718 }
9719
9720 /*
9721 * No xcall is needed here. For sun4u systems all CPUs in context
9722 * domain share a single physical MMU therefore it's enough to flush
9723 * TLB on local CPU. On sun4v systems we use 1 global context
9724 * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9725 * handler. Note that vtag_flushall_uctxs() is called
9726 * for Ultra II machine, where the equivalent flushall functionality
9727 * is implemented in SW, and only user ctx TLB entries are flushed.
9728 */
9729 if (&vtag_flushall_uctxs != NULL) {
9730 vtag_flushall_uctxs();
9731 } else {
9732 vtag_flushall();
9733 }
9734
9735 /* reset mmu cnum, skips cnum 0 and 1 */
9736 if (reset_cnum == B_TRUE)
9737 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9738
9739 done:
9740 mutex_exit(&mmu_ctxp->mmu_lock);
9741 }
9742
9743
9744 /*
9745 * For multi-threaded process, set the process context to INVALID_CONTEXT
9746 * so that it faults and reloads the MMU state from TL=0. For single-threaded
9747 * process, we can just load the MMU state directly without having to
9748 * set context invalid. Caller must hold the hat lock since we don't
9749 * acquire it here.
9750 */
9751 static void
9752 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9753 {
9754 uint_t cnum;
9755 uint_t pstate_save;
9756
9757 ASSERT(sfmmup != ksfmmup);
9758 ASSERT(sfmmu_hat_lock_held(sfmmup));
9759
9760 kpreempt_disable();
9761
9762 /*
9763 * We check whether the pass'ed-in sfmmup is the same as the
9764 * current running proc. This is to makes sure the current proc
9765 * stays single-threaded if it already is.
9766 */
9767 if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9768 (curthread->t_procp->p_lwpcnt == 1)) {
9769 /* single-thread */
9770 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9771 if (cnum != INVALID_CONTEXT) {
9772 uint_t curcnum;
9773 /*
9774 * Disable interrupts to prevent race condition
9775 * with sfmmu_ctx_wrap_around ctx invalidation.
9776 * In sun4v, ctx invalidation involves setting
9777 * TSB to NULL, hence, interrupts should be disabled
9778 * untill after sfmmu_load_mmustate is completed.
9779 */
9780 pstate_save = sfmmu_disable_intrs();
9781 curcnum = sfmmu_getctx_sec();
9782 if (curcnum == cnum)
9783 sfmmu_load_mmustate(sfmmup);
9784 sfmmu_enable_intrs(pstate_save);
9785 ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9786 }
9787 } else {
9788 /*
9789 * multi-thread
9790 * or when sfmmup is not the same as the curproc.
9791 */
9792 sfmmu_invalidate_ctx(sfmmup);
9793 }
9794
9795 kpreempt_enable();
9796 }
9797
9798
9799 /*
9800 * Replace the specified TSB with a new TSB. This function gets called when
9801 * we grow, shrink or swapin a TSB. When swapping in a TSB (TSB_SWAPIN), the
9802 * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9803 * (8K).
9804 *
9805 * Caller must hold the HAT lock, but should assume any tsb_info
9806 * pointers it has are no longer valid after calling this function.
9807 *
9808 * Return values:
9809 * TSB_ALLOCFAIL Failed to allocate a TSB, due to memory constraints
9810 * TSB_LOSTRACE HAT is busy, i.e. another thread is already doing
9811 * something to this tsbinfo/TSB
9812 * TSB_SUCCESS Operation succeeded
9813 */
9814 static tsb_replace_rc_t
9815 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
9816 hatlock_t *hatlockp, uint_t flags)
9817 {
9818 struct tsb_info *new_tsbinfo = NULL;
9819 struct tsb_info *curtsb, *prevtsb;
9820 uint_t tte_sz_mask;
9821 int i;
9822
9823 ASSERT(sfmmup != ksfmmup);
9824 ASSERT(sfmmup->sfmmu_ismhat == 0);
9825 ASSERT(sfmmu_hat_lock_held(sfmmup));
9826 ASSERT(szc <= tsb_max_growsize);
9827
9828 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
9829 return (TSB_LOSTRACE);
9830
9831 /*
9832 * Find the tsb_info ahead of this one in the list, and
9833 * also make sure that the tsb_info passed in really
9834 * exists!
9835 */
9836 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9837 curtsb != old_tsbinfo && curtsb != NULL;
9838 prevtsb = curtsb, curtsb = curtsb->tsb_next)
9839 ;
9840 ASSERT(curtsb != NULL);
9841
9842 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9843 /*
9844 * The process is swapped out, so just set the new size
9845 * code. When it swaps back in, we'll allocate a new one
9846 * of the new chosen size.
9847 */
9848 curtsb->tsb_szc = szc;
9849 return (TSB_SUCCESS);
9850 }
9851 SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
9852
9853 tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
9854
9855 /*
9856 * All initialization is done inside of sfmmu_tsbinfo_alloc().
9857 * If we fail to allocate a TSB, exit.
9858 *
9859 * If tsb grows with new tsb size > 4M and old tsb size < 4M,
9860 * then try 4M slab after the initial alloc fails.
9861 *
9862 * If tsb swapin with tsb size > 4M, then try 4M after the
9863 * initial alloc fails.
9864 */
9865 sfmmu_hat_exit(hatlockp);
9866 if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
9867 tte_sz_mask, flags, sfmmup) &&
9868 (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
9869 (!(flags & TSB_SWAPIN) &&
9870 (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
9871 sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
9872 tte_sz_mask, flags, sfmmup))) {
9873 (void) sfmmu_hat_enter(sfmmup);
9874 if (!(flags & TSB_SWAPIN))
9875 SFMMU_STAT(sf_tsb_resize_failures);
9876 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9877 return (TSB_ALLOCFAIL);
9878 }
9879 (void) sfmmu_hat_enter(sfmmup);
9880
9881 /*
9882 * Re-check to make sure somebody else didn't muck with us while we
9883 * didn't hold the HAT lock. If the process swapped out, fine, just
9884 * exit; this can happen if we try to shrink the TSB from the context
9885 * of another process (such as on an ISM unmap), though it is rare.
9886 */
9887 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9888 SFMMU_STAT(sf_tsb_resize_failures);
9889 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9890 sfmmu_hat_exit(hatlockp);
9891 sfmmu_tsbinfo_free(new_tsbinfo);
9892 (void) sfmmu_hat_enter(sfmmup);
9893 return (TSB_LOSTRACE);
9894 }
9895
9896 #ifdef DEBUG
9897 /* Reverify that the tsb_info still exists.. for debugging only */
9898 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9899 curtsb != old_tsbinfo && curtsb != NULL;
9900 prevtsb = curtsb, curtsb = curtsb->tsb_next)
9901 ;
9902 ASSERT(curtsb != NULL);
9903 #endif /* DEBUG */
9904
9905 /*
9906 * Quiesce any CPUs running this process on their next TLB miss
9907 * so they atomically see the new tsb_info. We temporarily set the
9908 * context to invalid context so new threads that come on processor
9909 * after we do the xcall to cpusran will also serialize behind the
9910 * HAT lock on TLB miss and will see the new TSB. Since this short
9911 * race with a new thread coming on processor is relatively rare,
9912 * this synchronization mechanism should be cheaper than always
9913 * pausing all CPUs for the duration of the setup, which is what
9914 * the old implementation did. This is particuarly true if we are
9915 * copying a huge chunk of memory around during that window.
9916 *
9917 * The memory barriers are to make sure things stay consistent
9918 * with resume() since it does not hold the HAT lock while
9919 * walking the list of tsb_info structures.
9920 */
9921 if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
9922 /* The TSB is either growing or shrinking. */
9923 sfmmu_invalidate_ctx(sfmmup);
9924 } else {
9925 /*
9926 * It is illegal to swap in TSBs from a process other
9927 * than a process being swapped in. This in turn
9928 * implies we do not have a valid MMU context here
9929 * since a process needs one to resolve translation
9930 * misses.
9931 */
9932 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
9933 }
9934
9935 #ifdef DEBUG
9936 ASSERT(max_mmu_ctxdoms > 0);
9937
9938 /*
9939 * Process should have INVALID_CONTEXT on all MMUs
9940 */
9941 for (i = 0; i < max_mmu_ctxdoms; i++) {
9942
9943 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
9944 }
9945 #endif
9946
9947 new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
9948 membar_stst(); /* strict ordering required */
9949 if (prevtsb)
9950 prevtsb->tsb_next = new_tsbinfo;
9951 else
9952 sfmmup->sfmmu_tsb = new_tsbinfo;
9953 membar_enter(); /* make sure new TSB globally visible */
9954
9955 /*
9956 * We need to migrate TSB entries from the old TSB to the new TSB
9957 * if tsb_remap_ttes is set and the TSB is growing.
9958 */
9959 if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
9960 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
9961
9962 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9963
9964 /*
9965 * Drop the HAT lock to free our old tsb_info.
9966 */
9967 sfmmu_hat_exit(hatlockp);
9968
9969 if ((flags & TSB_GROW) == TSB_GROW) {
9970 SFMMU_STAT(sf_tsb_grow);
9971 } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
9972 SFMMU_STAT(sf_tsb_shrink);
9973 }
9974
9975 sfmmu_tsbinfo_free(old_tsbinfo);
9976
9977 (void) sfmmu_hat_enter(sfmmup);
9978 return (TSB_SUCCESS);
9979 }
9980
9981 /*
9982 * This function will re-program hat pgsz array, and invalidate the
9983 * process' context, forcing the process to switch to another
9984 * context on the next TLB miss, and therefore start using the
9985 * TLB that is reprogrammed for the new page sizes.
9986 */
9987 void
9988 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
9989 {
9990 int i;
9991 hatlock_t *hatlockp = NULL;
9992
9993 hatlockp = sfmmu_hat_enter(sfmmup);
9994 /* USIII+-IV+ optimization, requires hat lock */
9995 if (tmp_pgsz) {
9996 for (i = 0; i < mmu_page_sizes; i++)
9997 sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
9998 }
9999 SFMMU_STAT(sf_tlb_reprog_pgsz);
10000
10001 sfmmu_invalidate_ctx(sfmmup);
10002
10003 sfmmu_hat_exit(hatlockp);
10004 }
10005
10006 /*
10007 * The scd_rttecnt field in the SCD must be updated to take account of the
10008 * regions which it contains.
10009 */
10010 static void
10011 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10012 {
10013 uint_t rid;
10014 uint_t i, j;
10015 ulong_t w;
10016 sf_region_t *rgnp;
10017
10018 ASSERT(srdp != NULL);
10019
10020 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10021 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10022 continue;
10023 }
10024
10025 j = 0;
10026 while (w) {
10027 if (!(w & 0x1)) {
10028 j++;
10029 w >>= 1;
10030 continue;
10031 }
10032 rid = (i << BT_ULSHIFT) | j;
10033 j++;
10034 w >>= 1;
10035
10036 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10037 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10038 rgnp = srdp->srd_hmergnp[rid];
10039 ASSERT(rgnp->rgn_refcnt > 0);
10040 ASSERT(rgnp->rgn_id == rid);
10041
10042 scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10043 rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10044
10045 /*
10046 * Maintain the tsb0 inflation cnt for the regions
10047 * in the SCD.
10048 */
10049 if (rgnp->rgn_pgszc >= TTE4M) {
10050 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10051 rgnp->rgn_size >>
10052 (TTE_PAGE_SHIFT(TTE8K) + 2);
10053 }
10054 }
10055 }
10056 }
10057
10058 /*
10059 * This function assumes that there are either four or six supported page
10060 * sizes and at most two programmable TLBs, so we need to decide which
10061 * page sizes are most important and then tell the MMU layer so it
10062 * can adjust the TLB page sizes accordingly (if supported).
10063 *
10064 * If these assumptions change, this function will need to be
10065 * updated to support whatever the new limits are.
10066 *
10067 * The growing flag is nonzero if we are growing the address space,
10068 * and zero if it is shrinking. This allows us to decide whether
10069 * to grow or shrink our TSB, depending upon available memory
10070 * conditions.
10071 */
10072 static void
10073 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10074 {
10075 uint64_t ttecnt[MMU_PAGE_SIZES];
10076 uint64_t tte8k_cnt, tte4m_cnt;
10077 uint8_t i;
10078 int sectsb_thresh;
10079
10080 /*
10081 * Kernel threads, processes with small address spaces not using
10082 * large pages, and dummy ISM HATs need not apply.
10083 */
10084 if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10085 return;
10086
10087 if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10088 sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10089 return;
10090
10091 for (i = 0; i < mmu_page_sizes; i++) {
10092 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10093 sfmmup->sfmmu_ismttecnt[i];
10094 }
10095
10096 /* Check pagesizes in use, and possibly reprogram DTLB. */
10097 if (&mmu_check_page_sizes)
10098 mmu_check_page_sizes(sfmmup, ttecnt);
10099
10100 /*
10101 * Calculate the number of 8k ttes to represent the span of these
10102 * pages.
10103 */
10104 tte8k_cnt = ttecnt[TTE8K] +
10105 (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10106 (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10107 if (mmu_page_sizes == max_mmu_page_sizes) {
10108 tte4m_cnt = ttecnt[TTE4M] +
10109 (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10110 (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10111 } else {
10112 tte4m_cnt = ttecnt[TTE4M];
10113 }
10114
10115 /*
10116 * Inflate tte8k_cnt to allow for region large page allocation failure.
10117 */
10118 tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10119
10120 /*
10121 * Inflate TSB sizes by a factor of 2 if this process
10122 * uses 4M text pages to minimize extra conflict misses
10123 * in the first TSB since without counting text pages
10124 * 8K TSB may become too small.
10125 *
10126 * Also double the size of the second TSB to minimize
10127 * extra conflict misses due to competition between 4M text pages
10128 * and data pages.
10129 *
10130 * We need to adjust the second TSB allocation threshold by the
10131 * inflation factor, since there is no point in creating a second
10132 * TSB when we know all the mappings can fit in the I/D TLBs.
10133 */
10134 sectsb_thresh = tsb_sectsb_threshold;
10135 if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10136 tte8k_cnt <<= 1;
10137 tte4m_cnt <<= 1;
10138 sectsb_thresh <<= 1;
10139 }
10140
10141 /*
10142 * Check to see if our TSB is the right size; we may need to
10143 * grow or shrink it. If the process is small, our work is
10144 * finished at this point.
10145 */
10146 if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10147 return;
10148 }
10149 sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10150 }
10151
10152 static void
10153 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10154 uint64_t tte4m_cnt, int sectsb_thresh)
10155 {
10156 int tsb_bits;
10157 uint_t tsb_szc;
10158 struct tsb_info *tsbinfop;
10159 hatlock_t *hatlockp = NULL;
10160
10161 hatlockp = sfmmu_hat_enter(sfmmup);
10162 ASSERT(hatlockp != NULL);
10163 tsbinfop = sfmmup->sfmmu_tsb;
10164 ASSERT(tsbinfop != NULL);
10165
10166 /*
10167 * If we're growing, select the size based on RSS. If we're
10168 * shrinking, leave some room so we don't have to turn around and
10169 * grow again immediately.
10170 */
10171 if (growing)
10172 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10173 else
10174 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10175
10176 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10177 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10178 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10179 hatlockp, TSB_SHRINK);
10180 } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10181 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10182 hatlockp, TSB_GROW);
10183 }
10184 tsbinfop = sfmmup->sfmmu_tsb;
10185
10186 /*
10187 * With the TLB and first TSB out of the way, we need to see if
10188 * we need a second TSB for 4M pages. If we managed to reprogram
10189 * the TLB page sizes above, the process will start using this new
10190 * TSB right away; otherwise, it will start using it on the next
10191 * context switch. Either way, it's no big deal so there's no
10192 * synchronization with the trap handlers here unless we grow the
10193 * TSB (in which case it's required to prevent using the old one
10194 * after it's freed). Note: second tsb is required for 32M/256M
10195 * page sizes.
10196 */
10197 if (tte4m_cnt > sectsb_thresh) {
10198 /*
10199 * If we're growing, select the size based on RSS. If we're
10200 * shrinking, leave some room so we don't have to turn
10201 * around and grow again immediately.
10202 */
10203 if (growing)
10204 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10205 else
10206 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10207 if (tsbinfop->tsb_next == NULL) {
10208 struct tsb_info *newtsb;
10209 int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10210 0 : TSB_ALLOC;
10211
10212 sfmmu_hat_exit(hatlockp);
10213
10214 /*
10215 * Try to allocate a TSB for 4[32|256]M pages. If we
10216 * can't get the size we want, retry w/a minimum sized
10217 * TSB. If that still didn't work, give up; we can
10218 * still run without one.
10219 */
10220 tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10221 TSB4M|TSB32M|TSB256M:TSB4M;
10222 if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10223 allocflags, sfmmup)) &&
10224 (tsb_szc <= TSB_4M_SZCODE ||
10225 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10226 tsb_bits, allocflags, sfmmup)) &&
10227 sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10228 tsb_bits, allocflags, sfmmup)) {
10229 return;
10230 }
10231
10232 hatlockp = sfmmu_hat_enter(sfmmup);
10233
10234 sfmmu_invalidate_ctx(sfmmup);
10235
10236 if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10237 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10238 SFMMU_STAT(sf_tsb_sectsb_create);
10239 sfmmu_hat_exit(hatlockp);
10240 return;
10241 } else {
10242 /*
10243 * It's annoying, but possible for us
10244 * to get here.. we dropped the HAT lock
10245 * because of locking order in the kmem
10246 * allocator, and while we were off getting
10247 * our memory, some other thread decided to
10248 * do us a favor and won the race to get a
10249 * second TSB for this process. Sigh.
10250 */
10251 sfmmu_hat_exit(hatlockp);
10252 sfmmu_tsbinfo_free(newtsb);
10253 return;
10254 }
10255 }
10256
10257 /*
10258 * We have a second TSB, see if it's big enough.
10259 */
10260 tsbinfop = tsbinfop->tsb_next;
10261
10262 /*
10263 * Check to see if our second TSB is the right size;
10264 * we may need to grow or shrink it.
10265 * To prevent thrashing (e.g. growing the TSB on a
10266 * subsequent map operation), only try to shrink if
10267 * the TSB reach exceeds twice the virtual address
10268 * space size.
10269 */
10270 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10271 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10272 (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10273 tsb_szc, hatlockp, TSB_SHRINK);
10274 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10275 TSB_OK_GROW()) {
10276 (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10277 tsb_szc, hatlockp, TSB_GROW);
10278 }
10279 }
10280
10281 sfmmu_hat_exit(hatlockp);
10282 }
10283
10284 /*
10285 * Free up a sfmmu
10286 * Since the sfmmu is currently embedded in the hat struct we simply zero
10287 * out our fields and free up the ism map blk list if any.
10288 */
10289 static void
10290 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10291 {
10292 ism_blk_t *blkp, *nx_blkp;
10293 #ifdef DEBUG
10294 ism_map_t *map;
10295 int i;
10296 #endif
10297
10298 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10299 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10300 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10301 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10302 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10303 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10304 ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10305
10306 sfmmup->sfmmu_free = 0;
10307 sfmmup->sfmmu_ismhat = 0;
10308
10309 blkp = sfmmup->sfmmu_iblk;
10310 sfmmup->sfmmu_iblk = NULL;
10311
10312 while (blkp) {
10313 #ifdef DEBUG
10314 map = blkp->iblk_maps;
10315 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10316 ASSERT(map[i].imap_seg == 0);
10317 ASSERT(map[i].imap_ismhat == NULL);
10318 ASSERT(map[i].imap_ment == NULL);
10319 }
10320 #endif
10321 nx_blkp = blkp->iblk_next;
10322 blkp->iblk_next = NULL;
10323 blkp->iblk_nextpa = (uint64_t)-1;
10324 kmem_cache_free(ism_blk_cache, blkp);
10325 blkp = nx_blkp;
10326 }
10327 }
10328
10329 /*
10330 * Locking primitves accessed by HATLOCK macros
10331 */
10332
10333 #define SFMMU_SPL_MTX (0x0)
10334 #define SFMMU_ML_MTX (0x1)
10335
10336 #define SFMMU_MLSPL_MTX(type, pg) (((type) == SFMMU_SPL_MTX) ? \
10337 SPL_HASH(pg) : MLIST_HASH(pg))
10338
10339 kmutex_t *
10340 sfmmu_page_enter(struct page *pp)
10341 {
10342 return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10343 }
10344
10345 void
10346 sfmmu_page_exit(kmutex_t *spl)
10347 {
10348 mutex_exit(spl);
10349 }
10350
10351 int
10352 sfmmu_page_spl_held(struct page *pp)
10353 {
10354 return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10355 }
10356
10357 kmutex_t *
10358 sfmmu_mlist_enter(struct page *pp)
10359 {
10360 return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10361 }
10362
10363 void
10364 sfmmu_mlist_exit(kmutex_t *mml)
10365 {
10366 mutex_exit(mml);
10367 }
10368
10369 int
10370 sfmmu_mlist_held(struct page *pp)
10371 {
10372
10373 return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10374 }
10375
10376 /*
10377 * Common code for sfmmu_mlist_enter() and sfmmu_page_enter(). For
10378 * sfmmu_mlist_enter() case mml_table lock array is used and for
10379 * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10380 *
10381 * The lock is taken on a root page so that it protects an operation on all
10382 * constituent pages of a large page pp belongs to.
10383 *
10384 * The routine takes a lock from the appropriate array. The lock is determined
10385 * by hashing the root page. After taking the lock this routine checks if the
10386 * root page has the same size code that was used to determine the root (i.e
10387 * that root hasn't changed). If root page has the expected p_szc field we
10388 * have the right lock and it's returned to the caller. If root's p_szc
10389 * decreased we release the lock and retry from the beginning. This case can
10390 * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10391 * value and taking the lock. The number of retries due to p_szc decrease is
10392 * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10393 * determined by hashing pp itself.
10394 *
10395 * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10396 * possible that p_szc can increase. To increase p_szc a thread has to lock
10397 * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10398 * callers that don't hold a page locked recheck if hmeblk through which pp
10399 * was found still maps this pp. If it doesn't map it anymore returned lock
10400 * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10401 * p_szc increase after taking the lock it returns this lock without further
10402 * retries because in this case the caller doesn't care about which lock was
10403 * taken. The caller will drop it right away.
10404 *
10405 * After the routine returns it's guaranteed that hat_page_demote() can't
10406 * change p_szc field of any of constituent pages of a large page pp belongs
10407 * to as long as pp was either locked at least SHARED prior to this call or
10408 * the caller finds that hment that pointed to this pp still references this
10409 * pp (this also assumes that the caller holds hme hash bucket lock so that
10410 * the same pp can't be remapped into the same hmeblk after it was unmapped by
10411 * hat_pageunload()).
10412 */
10413 static kmutex_t *
10414 sfmmu_mlspl_enter(struct page *pp, int type)
10415 {
10416 kmutex_t *mtx;
10417 uint_t prev_rszc = UINT_MAX;
10418 page_t *rootpp;
10419 uint_t szc;
10420 uint_t rszc;
10421 uint_t pszc = pp->p_szc;
10422
10423 ASSERT(pp != NULL);
10424
10425 again:
10426 if (pszc == 0) {
10427 mtx = SFMMU_MLSPL_MTX(type, pp);
10428 mutex_enter(mtx);
10429 return (mtx);
10430 }
10431
10432 /* The lock lives in the root page */
10433 rootpp = PP_GROUPLEADER(pp, pszc);
10434 mtx = SFMMU_MLSPL_MTX(type, rootpp);
10435 mutex_enter(mtx);
10436
10437 /*
10438 * Return mml in the following 3 cases:
10439 *
10440 * 1) If pp itself is root since if its p_szc decreased before we took
10441 * the lock pp is still the root of smaller szc page. And if its p_szc
10442 * increased it doesn't matter what lock we return (see comment in
10443 * front of this routine).
10444 *
10445 * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10446 * large page we have the right lock since any previous potential
10447 * hat_page_demote() is done demoting from greater than current root's
10448 * p_szc because hat_page_demote() changes root's p_szc last. No
10449 * further hat_page_demote() can start or be in progress since it
10450 * would need the same lock we currently hold.
10451 *
10452 * 3) If rootpp's p_szc increased since previous iteration it doesn't
10453 * matter what lock we return (see comment in front of this routine).
10454 */
10455 if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10456 rszc >= prev_rszc) {
10457 return (mtx);
10458 }
10459
10460 /*
10461 * hat_page_demote() could have decreased root's p_szc.
10462 * In this case pp's p_szc must also be smaller than pszc.
10463 * Retry.
10464 */
10465 if (rszc < pszc) {
10466 szc = pp->p_szc;
10467 if (szc < pszc) {
10468 mutex_exit(mtx);
10469 pszc = szc;
10470 goto again;
10471 }
10472 /*
10473 * pp's p_szc increased after it was decreased.
10474 * page cannot be mapped. Return current lock. The caller
10475 * will drop it right away.
10476 */
10477 return (mtx);
10478 }
10479
10480 /*
10481 * root's p_szc is greater than pp's p_szc.
10482 * hat_page_demote() is not done with all pages
10483 * yet. Wait for it to complete.
10484 */
10485 mutex_exit(mtx);
10486 rootpp = PP_GROUPLEADER(rootpp, rszc);
10487 mtx = SFMMU_MLSPL_MTX(type, rootpp);
10488 mutex_enter(mtx);
10489 mutex_exit(mtx);
10490 prev_rszc = rszc;
10491 goto again;
10492 }
10493
10494 static int
10495 sfmmu_mlspl_held(struct page *pp, int type)
10496 {
10497 kmutex_t *mtx;
10498
10499 ASSERT(pp != NULL);
10500 /* The lock lives in the root page */
10501 pp = PP_PAGEROOT(pp);
10502 ASSERT(pp != NULL);
10503
10504 mtx = SFMMU_MLSPL_MTX(type, pp);
10505 return (MUTEX_HELD(mtx));
10506 }
10507
10508 static uint_t
10509 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10510 {
10511 struct hme_blk *hblkp;
10512
10513
10514 if (freehblkp != NULL) {
10515 mutex_enter(&freehblkp_lock);
10516 if (freehblkp != NULL) {
10517 /*
10518 * If the current thread is owning hblk_reserve OR
10519 * critical request from sfmmu_hblk_steal()
10520 * let it succeed even if freehblkcnt is really low.
10521 */
10522 if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10523 SFMMU_STAT(sf_get_free_throttle);
10524 mutex_exit(&freehblkp_lock);
10525 return (0);
10526 }
10527 freehblkcnt--;
10528 *hmeblkpp = freehblkp;
10529 hblkp = *hmeblkpp;
10530 freehblkp = hblkp->hblk_next;
10531 mutex_exit(&freehblkp_lock);
10532 hblkp->hblk_next = NULL;
10533 SFMMU_STAT(sf_get_free_success);
10534
10535 ASSERT(hblkp->hblk_hmecnt == 0);
10536 ASSERT(hblkp->hblk_vcnt == 0);
10537 ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10538
10539 return (1);
10540 }
10541 mutex_exit(&freehblkp_lock);
10542 }
10543
10544 /* Check cpu hblk pending queues */
10545 if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10546 hblkp = *hmeblkpp;
10547 hblkp->hblk_next = NULL;
10548 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10549
10550 ASSERT(hblkp->hblk_hmecnt == 0);
10551 ASSERT(hblkp->hblk_vcnt == 0);
10552
10553 return (1);
10554 }
10555
10556 SFMMU_STAT(sf_get_free_fail);
10557 return (0);
10558 }
10559
10560 static uint_t
10561 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10562 {
10563 struct hme_blk *hblkp;
10564
10565 ASSERT(hmeblkp->hblk_hmecnt == 0);
10566 ASSERT(hmeblkp->hblk_vcnt == 0);
10567 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10568
10569 /*
10570 * If the current thread is mapping into kernel space,
10571 * let it succede even if freehblkcnt is max
10572 * so that it will avoid freeing it to kmem.
10573 * This will prevent stack overflow due to
10574 * possible recursion since kmem_cache_free()
10575 * might require creation of a slab which
10576 * in turn needs an hmeblk to map that slab;
10577 * let's break this vicious chain at the first
10578 * opportunity.
10579 */
10580 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10581 mutex_enter(&freehblkp_lock);
10582 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10583 SFMMU_STAT(sf_put_free_success);
10584 freehblkcnt++;
10585 hmeblkp->hblk_next = freehblkp;
10586 freehblkp = hmeblkp;
10587 mutex_exit(&freehblkp_lock);
10588 return (1);
10589 }
10590 mutex_exit(&freehblkp_lock);
10591 }
10592
10593 /*
10594 * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10595 * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10596 * we are not in the process of mapping into kernel space.
10597 */
10598 ASSERT(!critical);
10599 while (freehblkcnt > HBLK_RESERVE_CNT) {
10600 mutex_enter(&freehblkp_lock);
10601 if (freehblkcnt > HBLK_RESERVE_CNT) {
10602 freehblkcnt--;
10603 hblkp = freehblkp;
10604 freehblkp = hblkp->hblk_next;
10605 mutex_exit(&freehblkp_lock);
10606 ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10607 kmem_cache_free(sfmmu8_cache, hblkp);
10608 continue;
10609 }
10610 mutex_exit(&freehblkp_lock);
10611 }
10612 SFMMU_STAT(sf_put_free_fail);
10613 return (0);
10614 }
10615
10616 static void
10617 sfmmu_hblk_swap(struct hme_blk *new)
10618 {
10619 struct hme_blk *old, *hblkp, *prev;
10620 uint64_t newpa;
10621 caddr_t base, vaddr, endaddr;
10622 struct hmehash_bucket *hmebp;
10623 struct sf_hment *osfhme, *nsfhme;
10624 page_t *pp;
10625 kmutex_t *pml;
10626 tte_t tte;
10627 struct hme_blk *list = NULL;
10628
10629 #ifdef DEBUG
10630 hmeblk_tag hblktag;
10631 struct hme_blk *found;
10632 #endif
10633 old = HBLK_RESERVE;
10634 ASSERT(!old->hblk_shared);
10635
10636 /*
10637 * save pa before bcopy clobbers it
10638 */
10639 newpa = new->hblk_nextpa;
10640
10641 base = (caddr_t)get_hblk_base(old);
10642 endaddr = base + get_hblk_span(old);
10643
10644 /*
10645 * acquire hash bucket lock.
10646 */
10647 hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10648 SFMMU_INVALID_SHMERID);
10649
10650 /*
10651 * copy contents from old to new
10652 */
10653 bcopy((void *)old, (void *)new, HME8BLK_SZ);
10654
10655 /*
10656 * add new to hash chain
10657 */
10658 sfmmu_hblk_hash_add(hmebp, new, newpa);
10659
10660 /*
10661 * search hash chain for hblk_reserve; this needs to be performed
10662 * after adding new, otherwise prev won't correspond to the hblk which
10663 * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10664 * remove old later.
10665 */
10666 for (prev = NULL,
10667 hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10668 prev = hblkp, hblkp = hblkp->hblk_next)
10669 ;
10670
10671 if (hblkp != old)
10672 panic("sfmmu_hblk_swap: hblk_reserve not found");
10673
10674 /*
10675 * p_mapping list is still pointing to hments in hblk_reserve;
10676 * fix up p_mapping list so that they point to hments in new.
10677 *
10678 * Since all these mappings are created by hblk_reserve_thread
10679 * on the way and it's using at least one of the buffers from each of
10680 * the newly minted slabs, there is no danger of any of these
10681 * mappings getting unloaded by another thread.
10682 *
10683 * tsbmiss could only modify ref/mod bits of hments in old/new.
10684 * Since all of these hments hold mappings established by segkmem
10685 * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10686 * have no meaning for the mappings in hblk_reserve. hments in
10687 * old and new are identical except for ref/mod bits.
10688 */
10689 for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10690
10691 HBLKTOHME(osfhme, old, vaddr);
10692 sfmmu_copytte(&osfhme->hme_tte, &tte);
10693
10694 if (TTE_IS_VALID(&tte)) {
10695 if ((pp = osfhme->hme_page) == NULL)
10696 panic("sfmmu_hblk_swap: page not mapped");
10697
10698 pml = sfmmu_mlist_enter(pp);
10699
10700 if (pp != osfhme->hme_page)
10701 panic("sfmmu_hblk_swap: mapping changed");
10702
10703 HBLKTOHME(nsfhme, new, vaddr);
10704
10705 HME_ADD(nsfhme, pp);
10706 HME_SUB(osfhme, pp);
10707
10708 sfmmu_mlist_exit(pml);
10709 }
10710 }
10711
10712 /*
10713 * remove old from hash chain
10714 */
10715 sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10716
10717 #ifdef DEBUG
10718
10719 hblktag.htag_id = ksfmmup;
10720 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10721 hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10722 hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10723 HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10724
10725 if (found != new)
10726 panic("sfmmu_hblk_swap: new hblk not found");
10727 #endif
10728
10729 SFMMU_HASH_UNLOCK(hmebp);
10730
10731 /*
10732 * Reset hblk_reserve
10733 */
10734 bzero((void *)old, HME8BLK_SZ);
10735 old->hblk_nextpa = va_to_pa((caddr_t)old);
10736 }
10737
10738 /*
10739 * Grab the mlist mutex for both pages passed in.
10740 *
10741 * low and high will be returned as pointers to the mutexes for these pages.
10742 * low refers to the mutex residing in the lower bin of the mlist hash, while
10743 * high refers to the mutex residing in the higher bin of the mlist hash. This
10744 * is due to the locking order restrictions on the same thread grabbing
10745 * multiple mlist mutexes. The low lock must be acquired before the high lock.
10746 *
10747 * If both pages hash to the same mutex, only grab that single mutex, and
10748 * high will be returned as NULL
10749 * If the pages hash to different bins in the hash, grab the lower addressed
10750 * lock first and then the higher addressed lock in order to follow the locking
10751 * rules involved with the same thread grabbing multiple mlist mutexes.
10752 * low and high will both have non-NULL values.
10753 */
10754 static void
10755 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10756 kmutex_t **low, kmutex_t **high)
10757 {
10758 kmutex_t *mml_targ, *mml_repl;
10759
10760 /*
10761 * no need to do the dance around szc as in sfmmu_mlist_enter()
10762 * because this routine is only called by hat_page_relocate() and all
10763 * targ and repl pages are already locked EXCL so szc can't change.
10764 */
10765
10766 mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10767 mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10768
10769 if (mml_targ == mml_repl) {
10770 *low = mml_targ;
10771 *high = NULL;
10772 } else {
10773 if (mml_targ < mml_repl) {
10774 *low = mml_targ;
10775 *high = mml_repl;
10776 } else {
10777 *low = mml_repl;
10778 *high = mml_targ;
10779 }
10780 }
10781
10782 mutex_enter(*low);
10783 if (*high)
10784 mutex_enter(*high);
10785 }
10786
10787 static void
10788 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10789 {
10790 if (high)
10791 mutex_exit(high);
10792 mutex_exit(low);
10793 }
10794
10795 static hatlock_t *
10796 sfmmu_hat_enter(sfmmu_t *sfmmup)
10797 {
10798 hatlock_t *hatlockp;
10799
10800 if (sfmmup != ksfmmup) {
10801 hatlockp = TSB_HASH(sfmmup);
10802 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10803 return (hatlockp);
10804 }
10805 return (NULL);
10806 }
10807
10808 static hatlock_t *
10809 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
10810 {
10811 hatlock_t *hatlockp;
10812
10813 if (sfmmup != ksfmmup) {
10814 hatlockp = TSB_HASH(sfmmup);
10815 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
10816 return (NULL);
10817 return (hatlockp);
10818 }
10819 return (NULL);
10820 }
10821
10822 static void
10823 sfmmu_hat_exit(hatlock_t *hatlockp)
10824 {
10825 if (hatlockp != NULL)
10826 mutex_exit(HATLOCK_MUTEXP(hatlockp));
10827 }
10828
10829 static void
10830 sfmmu_hat_lock_all(void)
10831 {
10832 int i;
10833 for (i = 0; i < SFMMU_NUM_LOCK; i++)
10834 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
10835 }
10836
10837 static void
10838 sfmmu_hat_unlock_all(void)
10839 {
10840 int i;
10841 for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
10842 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
10843 }
10844
10845 int
10846 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
10847 {
10848 ASSERT(sfmmup != ksfmmup);
10849 return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
10850 }
10851
10852 /*
10853 * Locking primitives to provide consistency between ISM unmap
10854 * and other operations. Since ISM unmap can take a long time, we
10855 * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
10856 * contention on the hatlock buckets while ISM segments are being
10857 * unmapped. The tradeoff is that the flags don't prevent priority
10858 * inversion from occurring, so we must request kernel priority in
10859 * case we have to sleep to keep from getting buried while holding
10860 * the HAT_ISMBUSY flag set, which in turn could block other kernel
10861 * threads from running (for example, in sfmmu_uvatopfn()).
10862 */
10863 static void
10864 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
10865 {
10866 hatlock_t *hatlockp;
10867
10868 THREAD_KPRI_REQUEST();
10869 if (!hatlock_held)
10870 hatlockp = sfmmu_hat_enter(sfmmup);
10871 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
10872 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
10873 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
10874 if (!hatlock_held)
10875 sfmmu_hat_exit(hatlockp);
10876 }
10877
10878 static void
10879 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
10880 {
10881 hatlock_t *hatlockp;
10882
10883 if (!hatlock_held)
10884 hatlockp = sfmmu_hat_enter(sfmmup);
10885 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
10886 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
10887 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
10888 if (!hatlock_held)
10889 sfmmu_hat_exit(hatlockp);
10890 THREAD_KPRI_RELEASE();
10891 }
10892
10893 /*
10894 *
10895 * Algorithm:
10896 *
10897 * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
10898 * hblks.
10899 *
10900 * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
10901 *
10902 * (a) try to return an hblk from reserve pool of free hblks;
10903 * (b) if the reserve pool is empty, acquire hblk_reserve_lock
10904 * and return hblk_reserve.
10905 *
10906 * (3) call kmem_cache_alloc() to allocate hblk;
10907 *
10908 * (a) if hblk_reserve_lock is held by the current thread,
10909 * atomically replace hblk_reserve by the hblk that is
10910 * returned by kmem_cache_alloc; release hblk_reserve_lock
10911 * and call kmem_cache_alloc() again.
10912 * (b) if reserve pool is not full, add the hblk that is
10913 * returned by kmem_cache_alloc to reserve pool and
10914 * call kmem_cache_alloc again.
10915 *
10916 */
10917 static struct hme_blk *
10918 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
10919 struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
10920 uint_t flags, uint_t rid)
10921 {
10922 struct hme_blk *hmeblkp = NULL;
10923 struct hme_blk *newhblkp;
10924 struct hme_blk *shw_hblkp = NULL;
10925 struct kmem_cache *sfmmu_cache = NULL;
10926 uint64_t hblkpa;
10927 ulong_t index;
10928 uint_t owner; /* set to 1 if using hblk_reserve */
10929 uint_t forcefree;
10930 int sleep;
10931 sf_srd_t *srdp;
10932 sf_region_t *rgnp;
10933
10934 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
10935 ASSERT(hblktag.htag_rid == rid);
10936 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
10937 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
10938 IS_P2ALIGNED(vaddr, TTEBYTES(size)));
10939
10940 /*
10941 * If segkmem is not created yet, allocate from static hmeblks
10942 * created at the end of startup_modules(). See the block comment
10943 * in startup_modules() describing how we estimate the number of
10944 * static hmeblks that will be needed during re-map.
10945 */
10946 if (!hblk_alloc_dynamic) {
10947
10948 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10949
10950 if (size == TTE8K) {
10951 index = nucleus_hblk8.index;
10952 if (index >= nucleus_hblk8.len) {
10953 /*
10954 * If we panic here, see startup_modules() to
10955 * make sure that we are calculating the
10956 * number of hblk8's that we need correctly.
10957 */
10958 prom_panic("no nucleus hblk8 to allocate");
10959 }
10960 hmeblkp =
10961 (struct hme_blk *)&nucleus_hblk8.list[index];
10962 nucleus_hblk8.index++;
10963 SFMMU_STAT(sf_hblk8_nalloc);
10964 } else {
10965 index = nucleus_hblk1.index;
10966 if (nucleus_hblk1.index >= nucleus_hblk1.len) {
10967 /*
10968 * If we panic here, see startup_modules().
10969 * Most likely you need to update the
10970 * calculation of the number of hblk1 elements
10971 * that the kernel needs to boot.
10972 */
10973 prom_panic("no nucleus hblk1 to allocate");
10974 }
10975 hmeblkp =
10976 (struct hme_blk *)&nucleus_hblk1.list[index];
10977 nucleus_hblk1.index++;
10978 SFMMU_STAT(sf_hblk1_nalloc);
10979 }
10980
10981 goto hblk_init;
10982 }
10983
10984 SFMMU_HASH_UNLOCK(hmebp);
10985
10986 if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
10987 if (mmu_page_sizes == max_mmu_page_sizes) {
10988 if (size < TTE256M)
10989 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10990 size, flags);
10991 } else {
10992 if (size < TTE4M)
10993 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10994 size, flags);
10995 }
10996 } else if (SFMMU_IS_SHMERID_VALID(rid)) {
10997 /*
10998 * Shared hmes use per region bitmaps in rgn_hmeflag
10999 * rather than shadow hmeblks to keep track of the
11000 * mapping sizes which have been allocated for the region.
11001 * Here we cleanup old invalid hmeblks with this rid,
11002 * which may be left around by pageunload().
11003 */
11004 int ttesz;
11005 caddr_t va;
11006 caddr_t eva = vaddr + TTEBYTES(size);
11007
11008 ASSERT(sfmmup != KHATID);
11009
11010 srdp = sfmmup->sfmmu_srdp;
11011 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11012 rgnp = srdp->srd_hmergnp[rid];
11013 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11014 ASSERT(rgnp->rgn_refcnt != 0);
11015 ASSERT(size <= rgnp->rgn_pgszc);
11016
11017 ttesz = HBLK_MIN_TTESZ;
11018 do {
11019 if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11020 continue;
11021 }
11022
11023 if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11024 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11025 } else if (ttesz < size) {
11026 for (va = vaddr; va < eva;
11027 va += TTEBYTES(ttesz)) {
11028 sfmmu_cleanup_rhblk(srdp, va, rid,
11029 ttesz);
11030 }
11031 }
11032 } while (++ttesz <= rgnp->rgn_pgszc);
11033 }
11034
11035 fill_hblk:
11036 owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11037
11038 if (owner && size == TTE8K) {
11039
11040 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11041 /*
11042 * We are really in a tight spot. We already own
11043 * hblk_reserve and we need another hblk. In anticipation
11044 * of this kind of scenario, we specifically set aside
11045 * HBLK_RESERVE_MIN number of hblks to be used exclusively
11046 * by owner of hblk_reserve.
11047 */
11048 SFMMU_STAT(sf_hblk_recurse_cnt);
11049
11050 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11051 panic("sfmmu_hblk_alloc: reserve list is empty");
11052
11053 goto hblk_verify;
11054 }
11055
11056 ASSERT(!owner);
11057
11058 if ((flags & HAT_NO_KALLOC) == 0) {
11059
11060 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11061 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11062
11063 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11064 hmeblkp = sfmmu_hblk_steal(size);
11065 } else {
11066 /*
11067 * if we are the owner of hblk_reserve,
11068 * swap hblk_reserve with hmeblkp and
11069 * start a fresh life. Hope things go
11070 * better this time.
11071 */
11072 if (hblk_reserve_thread == curthread) {
11073 ASSERT(sfmmu_cache == sfmmu8_cache);
11074 sfmmu_hblk_swap(hmeblkp);
11075 hblk_reserve_thread = NULL;
11076 mutex_exit(&hblk_reserve_lock);
11077 goto fill_hblk;
11078 }
11079 /*
11080 * let's donate this hblk to our reserve list if
11081 * we are not mapping kernel range
11082 */
11083 if (size == TTE8K && sfmmup != KHATID) {
11084 if (sfmmu_put_free_hblk(hmeblkp, 0))
11085 goto fill_hblk;
11086 }
11087 }
11088 } else {
11089 /*
11090 * We are here to map the slab in sfmmu8_cache; let's
11091 * check if we could tap our reserve list; if successful,
11092 * this will avoid the pain of going thru sfmmu_hblk_swap
11093 */
11094 SFMMU_STAT(sf_hblk_slab_cnt);
11095 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11096 /*
11097 * let's start hblk_reserve dance
11098 */
11099 SFMMU_STAT(sf_hblk_reserve_cnt);
11100 owner = 1;
11101 mutex_enter(&hblk_reserve_lock);
11102 hmeblkp = HBLK_RESERVE;
11103 hblk_reserve_thread = curthread;
11104 }
11105 }
11106
11107 hblk_verify:
11108 ASSERT(hmeblkp != NULL);
11109 set_hblk_sz(hmeblkp, size);
11110 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11111 SFMMU_HASH_LOCK(hmebp);
11112 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11113 if (newhblkp != NULL) {
11114 SFMMU_HASH_UNLOCK(hmebp);
11115 if (hmeblkp != HBLK_RESERVE) {
11116 /*
11117 * This is really tricky!
11118 *
11119 * vmem_alloc(vmem_seg_arena)
11120 * vmem_alloc(vmem_internal_arena)
11121 * segkmem_alloc(heap_arena)
11122 * vmem_alloc(heap_arena)
11123 * page_create()
11124 * hat_memload()
11125 * kmem_cache_free()
11126 * kmem_cache_alloc()
11127 * kmem_slab_create()
11128 * vmem_alloc(kmem_internal_arena)
11129 * segkmem_alloc(heap_arena)
11130 * vmem_alloc(heap_arena)
11131 * page_create()
11132 * hat_memload()
11133 * kmem_cache_free()
11134 * ...
11135 *
11136 * Thus, hat_memload() could call kmem_cache_free
11137 * for enough number of times that we could easily
11138 * hit the bottom of the stack or run out of reserve
11139 * list of vmem_seg structs. So, we must donate
11140 * this hblk to reserve list if it's allocated
11141 * from sfmmu8_cache *and* mapping kernel range.
11142 * We don't need to worry about freeing hmeblk1's
11143 * to kmem since they don't map any kmem slabs.
11144 *
11145 * Note: When segkmem supports largepages, we must
11146 * free hmeblk1's to reserve list as well.
11147 */
11148 forcefree = (sfmmup == KHATID) ? 1 : 0;
11149 if (size == TTE8K &&
11150 sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11151 goto re_verify;
11152 }
11153 ASSERT(sfmmup != KHATID);
11154 kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11155 } else {
11156 /*
11157 * Hey! we don't need hblk_reserve any more.
11158 */
11159 ASSERT(owner);
11160 hblk_reserve_thread = NULL;
11161 mutex_exit(&hblk_reserve_lock);
11162 owner = 0;
11163 }
11164 re_verify:
11165 /*
11166 * let's check if the goodies are still present
11167 */
11168 SFMMU_HASH_LOCK(hmebp);
11169 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11170 if (newhblkp != NULL) {
11171 /*
11172 * return newhblkp if it's not hblk_reserve;
11173 * if newhblkp is hblk_reserve, return it
11174 * _only if_ we are the owner of hblk_reserve.
11175 */
11176 if (newhblkp != HBLK_RESERVE || owner) {
11177 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11178 newhblkp->hblk_shared);
11179 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11180 !newhblkp->hblk_shared);
11181 return (newhblkp);
11182 } else {
11183 /*
11184 * we just hit hblk_reserve in the hash and
11185 * we are not the owner of that;
11186 *
11187 * block until hblk_reserve_thread completes
11188 * swapping hblk_reserve and try the dance
11189 * once again.
11190 */
11191 SFMMU_HASH_UNLOCK(hmebp);
11192 mutex_enter(&hblk_reserve_lock);
11193 mutex_exit(&hblk_reserve_lock);
11194 SFMMU_STAT(sf_hblk_reserve_hit);
11195 goto fill_hblk;
11196 }
11197 } else {
11198 /*
11199 * it's no more! try the dance once again.
11200 */
11201 SFMMU_HASH_UNLOCK(hmebp);
11202 goto fill_hblk;
11203 }
11204 }
11205
11206 hblk_init:
11207 if (SFMMU_IS_SHMERID_VALID(rid)) {
11208 uint16_t tteflag = 0x1 <<
11209 ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11210
11211 if (!(rgnp->rgn_hmeflags & tteflag)) {
11212 atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11213 }
11214 hmeblkp->hblk_shared = 1;
11215 } else {
11216 hmeblkp->hblk_shared = 0;
11217 }
11218 set_hblk_sz(hmeblkp, size);
11219 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11220 hmeblkp->hblk_next = (struct hme_blk *)NULL;
11221 hmeblkp->hblk_tag = hblktag;
11222 hmeblkp->hblk_shadow = shw_hblkp;
11223 hblkpa = hmeblkp->hblk_nextpa;
11224 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11225
11226 ASSERT(get_hblk_ttesz(hmeblkp) == size);
11227 ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11228 ASSERT(hmeblkp->hblk_hmecnt == 0);
11229 ASSERT(hmeblkp->hblk_vcnt == 0);
11230 ASSERT(hmeblkp->hblk_lckcnt == 0);
11231 ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11232 sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11233 return (hmeblkp);
11234 }
11235
11236 /*
11237 * This function cleans up the hme_blk and returns it to the free list.
11238 */
11239 /* ARGSUSED */
11240 static void
11241 sfmmu_hblk_free(struct hme_blk **listp)
11242 {
11243 struct hme_blk *hmeblkp, *next_hmeblkp;
11244 int size;
11245 uint_t critical;
11246 uint64_t hblkpa;
11247
11248 ASSERT(*listp != NULL);
11249
11250 hmeblkp = *listp;
11251 while (hmeblkp != NULL) {
11252 next_hmeblkp = hmeblkp->hblk_next;
11253 ASSERT(!hmeblkp->hblk_hmecnt);
11254 ASSERT(!hmeblkp->hblk_vcnt);
11255 ASSERT(!hmeblkp->hblk_lckcnt);
11256 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11257 ASSERT(hmeblkp->hblk_shared == 0);
11258 ASSERT(hmeblkp->hblk_shw_bit == 0);
11259 ASSERT(hmeblkp->hblk_shadow == NULL);
11260
11261 hblkpa = va_to_pa((caddr_t)hmeblkp);
11262 ASSERT(hblkpa != (uint64_t)-1);
11263 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11264
11265 size = get_hblk_ttesz(hmeblkp);
11266 hmeblkp->hblk_next = NULL;
11267 hmeblkp->hblk_nextpa = hblkpa;
11268
11269 if (hmeblkp->hblk_nuc_bit == 0) {
11270
11271 if (size != TTE8K ||
11272 !sfmmu_put_free_hblk(hmeblkp, critical))
11273 kmem_cache_free(get_hblk_cache(hmeblkp),
11274 hmeblkp);
11275 }
11276 hmeblkp = next_hmeblkp;
11277 }
11278 }
11279
11280 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11281 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11282
11283 static uint_t sfmmu_hblk_steal_twice;
11284 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11285
11286 /*
11287 * Steal a hmeblk from user or kernel hme hash lists.
11288 * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11289 * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11290 * tap into critical reserve of freehblkp.
11291 * Note: We remain looping in this routine until we find one.
11292 */
11293 static struct hme_blk *
11294 sfmmu_hblk_steal(int size)
11295 {
11296 static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11297 struct hmehash_bucket *hmebp;
11298 struct hme_blk *hmeblkp = NULL, *pr_hblk;
11299 uint64_t hblkpa;
11300 int i;
11301 uint_t loop_cnt = 0, critical;
11302
11303 for (;;) {
11304 /* Check cpu hblk pending queues */
11305 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11306 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11307 ASSERT(hmeblkp->hblk_hmecnt == 0);
11308 ASSERT(hmeblkp->hblk_vcnt == 0);
11309 return (hmeblkp);
11310 }
11311
11312 if (size == TTE8K) {
11313 critical =
11314 (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11315 if (sfmmu_get_free_hblk(&hmeblkp, critical))
11316 return (hmeblkp);
11317 }
11318
11319 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11320 uhmehash_steal_hand;
11321 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11322
11323 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11324 BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11325 SFMMU_HASH_LOCK(hmebp);
11326 hmeblkp = hmebp->hmeblkp;
11327 hblkpa = hmebp->hmeh_nextpa;
11328 pr_hblk = NULL;
11329 while (hmeblkp) {
11330 /*
11331 * check if it is a hmeblk that is not locked
11332 * and not shared. skip shadow hmeblks with
11333 * shadow_mask set i.e valid count non zero.
11334 */
11335 if ((get_hblk_ttesz(hmeblkp) == size) &&
11336 (hmeblkp->hblk_shw_bit == 0 ||
11337 hmeblkp->hblk_vcnt == 0) &&
11338 (hmeblkp->hblk_lckcnt == 0)) {
11339 /*
11340 * there is a high probability that we
11341 * will find a free one. search some
11342 * buckets for a free hmeblk initially
11343 * before unloading a valid hmeblk.
11344 */
11345 if ((hmeblkp->hblk_vcnt == 0 &&
11346 hmeblkp->hblk_hmecnt == 0) || (i >=
11347 BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11348 if (sfmmu_steal_this_hblk(hmebp,
11349 hmeblkp, hblkpa, pr_hblk)) {
11350 /*
11351 * Hblk is unloaded
11352 * successfully
11353 */
11354 break;
11355 }
11356 }
11357 }
11358 pr_hblk = hmeblkp;
11359 hblkpa = hmeblkp->hblk_nextpa;
11360 hmeblkp = hmeblkp->hblk_next;
11361 }
11362
11363 SFMMU_HASH_UNLOCK(hmebp);
11364 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11365 hmebp = uhme_hash;
11366 }
11367 uhmehash_steal_hand = hmebp;
11368
11369 if (hmeblkp != NULL)
11370 break;
11371
11372 /*
11373 * in the worst case, look for a free one in the kernel
11374 * hash table.
11375 */
11376 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11377 SFMMU_HASH_LOCK(hmebp);
11378 hmeblkp = hmebp->hmeblkp;
11379 hblkpa = hmebp->hmeh_nextpa;
11380 pr_hblk = NULL;
11381 while (hmeblkp) {
11382 /*
11383 * check if it is free hmeblk
11384 */
11385 if ((get_hblk_ttesz(hmeblkp) == size) &&
11386 (hmeblkp->hblk_lckcnt == 0) &&
11387 (hmeblkp->hblk_vcnt == 0) &&
11388 (hmeblkp->hblk_hmecnt == 0)) {
11389 if (sfmmu_steal_this_hblk(hmebp,
11390 hmeblkp, hblkpa, pr_hblk)) {
11391 break;
11392 } else {
11393 /*
11394 * Cannot fail since we have
11395 * hash lock.
11396 */
11397 panic("fail to steal?");
11398 }
11399 }
11400
11401 pr_hblk = hmeblkp;
11402 hblkpa = hmeblkp->hblk_nextpa;
11403 hmeblkp = hmeblkp->hblk_next;
11404 }
11405
11406 SFMMU_HASH_UNLOCK(hmebp);
11407 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11408 hmebp = khme_hash;
11409 }
11410
11411 if (hmeblkp != NULL)
11412 break;
11413 sfmmu_hblk_steal_twice++;
11414 }
11415 return (hmeblkp);
11416 }
11417
11418 /*
11419 * This routine does real work to prepare a hblk to be "stolen" by
11420 * unloading the mappings, updating shadow counts ....
11421 * It returns 1 if the block is ready to be reused (stolen), or 0
11422 * means the block cannot be stolen yet- pageunload is still working
11423 * on this hblk.
11424 */
11425 static int
11426 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11427 uint64_t hblkpa, struct hme_blk *pr_hblk)
11428 {
11429 int shw_size, vshift;
11430 struct hme_blk *shw_hblkp;
11431 caddr_t vaddr;
11432 uint_t shw_mask, newshw_mask;
11433 struct hme_blk *list = NULL;
11434
11435 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11436
11437 /*
11438 * check if the hmeblk is free, unload if necessary
11439 */
11440 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11441 sfmmu_t *sfmmup;
11442 demap_range_t dmr;
11443
11444 sfmmup = hblktosfmmu(hmeblkp);
11445 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11446 return (0);
11447 }
11448 DEMAP_RANGE_INIT(sfmmup, &dmr);
11449 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11450 (caddr_t)get_hblk_base(hmeblkp),
11451 get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11452 DEMAP_RANGE_FLUSH(&dmr);
11453 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11454 /*
11455 * Pageunload is working on the same hblk.
11456 */
11457 return (0);
11458 }
11459
11460 sfmmu_hblk_steal_unload_count++;
11461 }
11462
11463 ASSERT(hmeblkp->hblk_lckcnt == 0);
11464 ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11465
11466 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11467 hmeblkp->hblk_nextpa = hblkpa;
11468
11469 shw_hblkp = hmeblkp->hblk_shadow;
11470 if (shw_hblkp) {
11471 ASSERT(!hmeblkp->hblk_shared);
11472 shw_size = get_hblk_ttesz(shw_hblkp);
11473 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11474 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11475 ASSERT(vshift < 8);
11476 /*
11477 * Atomically clear shadow mask bit
11478 */
11479 do {
11480 shw_mask = shw_hblkp->hblk_shw_mask;
11481 ASSERT(shw_mask & (1 << vshift));
11482 newshw_mask = shw_mask & ~(1 << vshift);
11483 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11484 shw_mask, newshw_mask);
11485 } while (newshw_mask != shw_mask);
11486 hmeblkp->hblk_shadow = NULL;
11487 }
11488
11489 /*
11490 * remove shadow bit if we are stealing an unused shadow hmeblk.
11491 * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11492 * we are indeed allocating a shadow hmeblk.
11493 */
11494 hmeblkp->hblk_shw_bit = 0;
11495
11496 if (hmeblkp->hblk_shared) {
11497 sf_srd_t *srdp;
11498 sf_region_t *rgnp;
11499 uint_t rid;
11500
11501 srdp = hblktosrd(hmeblkp);
11502 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11503 rid = hmeblkp->hblk_tag.htag_rid;
11504 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11505 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11506 rgnp = srdp->srd_hmergnp[rid];
11507 ASSERT(rgnp != NULL);
11508 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11509 hmeblkp->hblk_shared = 0;
11510 }
11511
11512 sfmmu_hblk_steal_count++;
11513 SFMMU_STAT(sf_steal_count);
11514
11515 return (1);
11516 }
11517
11518 struct hme_blk *
11519 sfmmu_hmetohblk(struct sf_hment *sfhme)
11520 {
11521 struct hme_blk *hmeblkp;
11522 struct sf_hment *sfhme0;
11523 struct hme_blk *hblk_dummy = 0;
11524
11525 /*
11526 * No dummy sf_hments, please.
11527 */
11528 ASSERT(sfhme->hme_tte.ll != 0);
11529
11530 sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11531 hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11532 (uintptr_t)&hblk_dummy->hblk_hme[0]);
11533
11534 return (hmeblkp);
11535 }
11536
11537 /*
11538 * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11539 * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11540 * KM_SLEEP allocation.
11541 *
11542 * Return 0 on success, -1 otherwise.
11543 */
11544 static void
11545 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11546 {
11547 struct tsb_info *tsbinfop, *next;
11548 tsb_replace_rc_t rc;
11549 boolean_t gotfirst = B_FALSE;
11550
11551 ASSERT(sfmmup != ksfmmup);
11552 ASSERT(sfmmu_hat_lock_held(sfmmup));
11553
11554 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11555 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11556 }
11557
11558 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11559 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11560 } else {
11561 return;
11562 }
11563
11564 ASSERT(sfmmup->sfmmu_tsb != NULL);
11565
11566 /*
11567 * Loop over all tsbinfo's replacing them with ones that actually have
11568 * a TSB. If any of the replacements ever fail, bail out of the loop.
11569 */
11570 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11571 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11572 next = tsbinfop->tsb_next;
11573 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11574 hatlockp, TSB_SWAPIN);
11575 if (rc != TSB_SUCCESS) {
11576 break;
11577 }
11578 gotfirst = B_TRUE;
11579 }
11580
11581 switch (rc) {
11582 case TSB_SUCCESS:
11583 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11584 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11585 return;
11586 case TSB_LOSTRACE:
11587 break;
11588 case TSB_ALLOCFAIL:
11589 break;
11590 default:
11591 panic("sfmmu_replace_tsb returned unrecognized failure code "
11592 "%d", rc);
11593 }
11594
11595 /*
11596 * In this case, we failed to get one of our TSBs. If we failed to
11597 * get the first TSB, get one of minimum size (8KB). Walk the list
11598 * and throw away the tsbinfos, starting where the allocation failed;
11599 * we can get by with just one TSB as long as we don't leave the
11600 * SWAPPED tsbinfo structures lying around.
11601 */
11602 tsbinfop = sfmmup->sfmmu_tsb;
11603 next = tsbinfop->tsb_next;
11604 tsbinfop->tsb_next = NULL;
11605
11606 sfmmu_hat_exit(hatlockp);
11607 for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11608 next = tsbinfop->tsb_next;
11609 sfmmu_tsbinfo_free(tsbinfop);
11610 }
11611 hatlockp = sfmmu_hat_enter(sfmmup);
11612
11613 /*
11614 * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11615 * pages.
11616 */
11617 if (!gotfirst) {
11618 tsbinfop = sfmmup->sfmmu_tsb;
11619 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11620 hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11621 ASSERT(rc == TSB_SUCCESS);
11622 }
11623
11624 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11625 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11626 }
11627
11628 static int
11629 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11630 {
11631 ulong_t bix = 0;
11632 uint_t rid;
11633 sf_region_t *rgnp;
11634
11635 ASSERT(srdp != NULL);
11636 ASSERT(srdp->srd_refcnt != 0);
11637
11638 w <<= BT_ULSHIFT;
11639 while (bmw) {
11640 if (!(bmw & 0x1)) {
11641 bix++;
11642 bmw >>= 1;
11643 continue;
11644 }
11645 rid = w | bix;
11646 rgnp = srdp->srd_hmergnp[rid];
11647 ASSERT(rgnp->rgn_refcnt > 0);
11648 ASSERT(rgnp->rgn_id == rid);
11649 if (addr < rgnp->rgn_saddr ||
11650 addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11651 bix++;
11652 bmw >>= 1;
11653 } else {
11654 return (1);
11655 }
11656 }
11657 return (0);
11658 }
11659
11660 /*
11661 * Handle exceptions for low level tsb_handler.
11662 *
11663 * There are many scenarios that could land us here:
11664 *
11665 * If the context is invalid we land here. The context can be invalid
11666 * for 3 reasons: 1) we couldn't allocate a new context and now need to
11667 * perform a wrap around operation in order to allocate a new context.
11668 * 2) Context was invalidated to change pagesize programming 3) ISMs or
11669 * TSBs configuration is changeing for this process and we are forced into
11670 * here to do a syncronization operation. If the context is valid we can
11671 * be here from window trap hanlder. In this case just call trap to handle
11672 * the fault.
11673 *
11674 * Note that the process will run in INVALID_CONTEXT before
11675 * faulting into here and subsequently loading the MMU registers
11676 * (including the TSB base register) associated with this process.
11677 * For this reason, the trap handlers must all test for
11678 * INVALID_CONTEXT before attempting to access any registers other
11679 * than the context registers.
11680 */
11681 void
11682 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11683 {
11684 sfmmu_t *sfmmup, *shsfmmup;
11685 uint_t ctxtype;
11686 klwp_id_t lwp;
11687 char lwp_save_state;
11688 hatlock_t *hatlockp, *shatlockp;
11689 struct tsb_info *tsbinfop;
11690 struct tsbmiss *tsbmp;
11691 sf_scd_t *scdp;
11692
11693 SFMMU_STAT(sf_tsb_exceptions);
11694 SFMMU_MMU_STAT(mmu_tsb_exceptions);
11695 sfmmup = astosfmmu(curthread->t_procp->p_as);
11696 /*
11697 * note that in sun4u, tagacces register contains ctxnum
11698 * while sun4v passes ctxtype in the tagaccess register.
11699 */
11700 ctxtype = tagaccess & TAGACC_CTX_MASK;
11701
11702 ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11703 ASSERT(sfmmup->sfmmu_ismhat == 0);
11704 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11705 ctxtype == INVALID_CONTEXT);
11706
11707 if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11708 /*
11709 * We may land here because shme bitmap and pagesize
11710 * flags are updated lazily in tsbmiss area on other cpus.
11711 * If we detect here that tsbmiss area is out of sync with
11712 * sfmmu update it and retry the trapped instruction.
11713 * Otherwise call trap().
11714 */
11715 int ret = 0;
11716 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11717 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11718
11719 /*
11720 * Must set lwp state to LWP_SYS before
11721 * trying to acquire any adaptive lock
11722 */
11723 lwp = ttolwp(curthread);
11724 ASSERT(lwp);
11725 lwp_save_state = lwp->lwp_state;
11726 lwp->lwp_state = LWP_SYS;
11727
11728 hatlockp = sfmmu_hat_enter(sfmmup);
11729 kpreempt_disable();
11730 tsbmp = &tsbmiss_area[CPU->cpu_id];
11731 ASSERT(sfmmup == tsbmp->usfmmup);
11732 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11733 ~tteflag_mask) ||
11734 ((tsbmp->uhat_rtteflags ^ sfmmup->sfmmu_rtteflags) &
11735 ~tteflag_mask)) {
11736 tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11737 tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11738 ret = 1;
11739 }
11740 if (sfmmup->sfmmu_srdp != NULL) {
11741 ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11742 ulong_t *tm = tsbmp->shmermap;
11743 ulong_t i;
11744 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11745 ulong_t d = tm[i] ^ sm[i];
11746 if (d) {
11747 if (d & sm[i]) {
11748 if (!ret && sfmmu_is_rgnva(
11749 sfmmup->sfmmu_srdp,
11750 addr, i, d & sm[i])) {
11751 ret = 1;
11752 }
11753 }
11754 tm[i] = sm[i];
11755 }
11756 }
11757 }
11758 kpreempt_enable();
11759 sfmmu_hat_exit(hatlockp);
11760 lwp->lwp_state = lwp_save_state;
11761 if (ret) {
11762 return;
11763 }
11764 } else if (ctxtype == INVALID_CONTEXT) {
11765 /*
11766 * First, make sure we come out of here with a valid ctx,
11767 * since if we don't get one we'll simply loop on the
11768 * faulting instruction.
11769 *
11770 * If the ISM mappings are changing, the TSB is relocated,
11771 * the process is swapped, the process is joining SCD or
11772 * leaving SCD or shared regions we serialize behind the
11773 * controlling thread with hat lock, sfmmu_flags and
11774 * sfmmu_tsb_cv condition variable.
11775 */
11776
11777 /*
11778 * Must set lwp state to LWP_SYS before
11779 * trying to acquire any adaptive lock
11780 */
11781 lwp = ttolwp(curthread);
11782 ASSERT(lwp);
11783 lwp_save_state = lwp->lwp_state;
11784 lwp->lwp_state = LWP_SYS;
11785
11786 hatlockp = sfmmu_hat_enter(sfmmup);
11787 retry:
11788 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11789 shsfmmup = scdp->scd_sfmmup;
11790 ASSERT(shsfmmup != NULL);
11791
11792 for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11793 tsbinfop = tsbinfop->tsb_next) {
11794 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11795 /* drop the private hat lock */
11796 sfmmu_hat_exit(hatlockp);
11797 /* acquire the shared hat lock */
11798 shatlockp = sfmmu_hat_enter(shsfmmup);
11799 /*
11800 * recheck to see if anything changed
11801 * after we drop the private hat lock.
11802 */
11803 if (sfmmup->sfmmu_scdp == scdp &&
11804 shsfmmup == scdp->scd_sfmmup) {
11805 sfmmu_tsb_chk_reloc(shsfmmup,
11806 shatlockp);
11807 }
11808 sfmmu_hat_exit(shatlockp);
11809 hatlockp = sfmmu_hat_enter(sfmmup);
11810 goto retry;
11811 }
11812 }
11813 }
11814
11815 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
11816 tsbinfop = tsbinfop->tsb_next) {
11817 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11818 cv_wait(&sfmmup->sfmmu_tsb_cv,
11819 HATLOCK_MUTEXP(hatlockp));
11820 goto retry;
11821 }
11822 }
11823
11824 /*
11825 * Wait for ISM maps to be updated.
11826 */
11827 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11828 cv_wait(&sfmmup->sfmmu_tsb_cv,
11829 HATLOCK_MUTEXP(hatlockp));
11830 goto retry;
11831 }
11832
11833 /* Is this process joining an SCD? */
11834 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11835 /*
11836 * Flush private TSB and setup shared TSB.
11837 * sfmmu_finish_join_scd() does not drop the
11838 * hat lock.
11839 */
11840 sfmmu_finish_join_scd(sfmmup);
11841 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
11842 }
11843
11844 /*
11845 * If we're swapping in, get TSB(s). Note that we must do
11846 * this before we get a ctx or load the MMU state. Once
11847 * we swap in we have to recheck to make sure the TSB(s) and
11848 * ISM mappings didn't change while we slept.
11849 */
11850 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11851 sfmmu_tsb_swapin(sfmmup, hatlockp);
11852 goto retry;
11853 }
11854
11855 sfmmu_get_ctx(sfmmup);
11856
11857 sfmmu_hat_exit(hatlockp);
11858 /*
11859 * Must restore lwp_state if not calling
11860 * trap() for further processing. Restore
11861 * it anyway.
11862 */
11863 lwp->lwp_state = lwp_save_state;
11864 return;
11865 }
11866 trap(rp, (caddr_t)tagaccess, traptype, 0);
11867 }
11868
11869 static void
11870 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11871 {
11872 struct tsb_info *tp;
11873
11874 ASSERT(sfmmu_hat_lock_held(sfmmup));
11875
11876 for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
11877 if (tp->tsb_flags & TSB_RELOC_FLAG) {
11878 cv_wait(&sfmmup->sfmmu_tsb_cv,
11879 HATLOCK_MUTEXP(hatlockp));
11880 break;
11881 }
11882 }
11883 }
11884
11885 /*
11886 * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
11887 * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
11888 * rather than spinning to avoid send mondo timeouts with
11889 * interrupts enabled. When the lock is acquired it is immediately
11890 * released and we return back to sfmmu_vatopfn just after
11891 * the GET_TTE call.
11892 */
11893 void
11894 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
11895 {
11896 struct page **pp;
11897
11898 (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11899 as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11900 }
11901
11902 /*
11903 * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
11904 * TTE_SUSPENDED bit set in tte. We do this so that we can handle
11905 * cross traps which cannot be handled while spinning in the
11906 * trap handlers. Simply enter and exit the kpr_suspendlock spin
11907 * mutex, which is held by the holder of the suspend bit, and then
11908 * retry the trapped instruction after unwinding.
11909 */
11910 /*ARGSUSED*/
11911 void
11912 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
11913 {
11914 ASSERT(curthread != kreloc_thread);
11915 mutex_enter(&kpr_suspendlock);
11916 mutex_exit(&kpr_suspendlock);
11917 }
11918
11919 /*
11920 * This routine could be optimized to reduce the number of xcalls by flushing
11921 * the entire TLBs if region reference count is above some threshold but the
11922 * tradeoff will depend on the size of the TLB. So for now flush the specific
11923 * page a context at a time.
11924 *
11925 * If uselocks is 0 then it's called after all cpus were captured and all the
11926 * hat locks were taken. In this case don't take the region lock by relying on
11927 * the order of list region update operations in hat_join_region(),
11928 * hat_leave_region() and hat_dup_region(). The ordering in those routines
11929 * guarantees that list is always forward walkable and reaches active sfmmus
11930 * regardless of where xc_attention() captures a cpu.
11931 */
11932 cpuset_t
11933 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
11934 struct hme_blk *hmeblkp, int uselocks)
11935 {
11936 sfmmu_t *sfmmup;
11937 cpuset_t cpuset;
11938 cpuset_t rcpuset;
11939 hatlock_t *hatlockp;
11940 uint_t rid = rgnp->rgn_id;
11941 sf_rgn_link_t *rlink;
11942 sf_scd_t *scdp;
11943
11944 ASSERT(hmeblkp->hblk_shared);
11945 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11946 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11947
11948 CPUSET_ZERO(rcpuset);
11949 if (uselocks) {
11950 mutex_enter(&rgnp->rgn_mutex);
11951 }
11952 sfmmup = rgnp->rgn_sfmmu_head;
11953 while (sfmmup != NULL) {
11954 if (uselocks) {
11955 hatlockp = sfmmu_hat_enter(sfmmup);
11956 }
11957
11958 /*
11959 * When an SCD is created the SCD hat is linked on the sfmmu
11960 * region lists for each hme region which is part of the
11961 * SCD. If we find an SCD hat, when walking these lists,
11962 * then we flush the shared TSBs, if we find a private hat,
11963 * which is part of an SCD, but where the region
11964 * is not part of the SCD then we flush the private TSBs.
11965 */
11966 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11967 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11968 scdp = sfmmup->sfmmu_scdp;
11969 if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
11970 if (uselocks) {
11971 sfmmu_hat_exit(hatlockp);
11972 }
11973 goto next;
11974 }
11975 }
11976
11977 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
11978
11979 kpreempt_disable();
11980 cpuset = sfmmup->sfmmu_cpusran;
11981 CPUSET_AND(cpuset, cpu_ready_set);
11982 CPUSET_DEL(cpuset, CPU->cpu_id);
11983 SFMMU_XCALL_STATS(sfmmup);
11984 xt_some(cpuset, vtag_flushpage_tl1,
11985 (uint64_t)addr, (uint64_t)sfmmup);
11986 vtag_flushpage(addr, (uint64_t)sfmmup);
11987 if (uselocks) {
11988 sfmmu_hat_exit(hatlockp);
11989 }
11990 kpreempt_enable();
11991 CPUSET_OR(rcpuset, cpuset);
11992
11993 next:
11994 /* LINTED: constant in conditional context */
11995 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
11996 ASSERT(rlink != NULL);
11997 sfmmup = rlink->next;
11998 }
11999 if (uselocks) {
12000 mutex_exit(&rgnp->rgn_mutex);
12001 }
12002 return (rcpuset);
12003 }
12004
12005 /*
12006 * This routine takes an sfmmu pointer and the va for an adddress in an
12007 * ISM region as input and returns the corresponding region id in ism_rid.
12008 * The return value of 1 indicates that a region has been found and ism_rid
12009 * is valid, otherwise 0 is returned.
12010 */
12011 static int
12012 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12013 {
12014 ism_blk_t *ism_blkp;
12015 int i;
12016 ism_map_t *ism_map;
12017 #ifdef DEBUG
12018 struct hat *ism_hatid;
12019 #endif
12020 ASSERT(sfmmu_hat_lock_held(sfmmup));
12021
12022 ism_blkp = sfmmup->sfmmu_iblk;
12023 while (ism_blkp != NULL) {
12024 ism_map = ism_blkp->iblk_maps;
12025 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12026 if ((va >= ism_start(ism_map[i])) &&
12027 (va < ism_end(ism_map[i]))) {
12028
12029 *ism_rid = ism_map[i].imap_rid;
12030 #ifdef DEBUG
12031 ism_hatid = ism_map[i].imap_ismhat;
12032 ASSERT(ism_hatid == ism_sfmmup);
12033 ASSERT(ism_hatid->sfmmu_ismhat);
12034 #endif
12035 return (1);
12036 }
12037 }
12038 ism_blkp = ism_blkp->iblk_next;
12039 }
12040 return (0);
12041 }
12042
12043 /*
12044 * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12045 * This routine may be called with all cpu's captured. Therefore, the
12046 * caller is responsible for holding all locks and disabling kernel
12047 * preemption.
12048 */
12049 /* ARGSUSED */
12050 static void
12051 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12052 struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12053 {
12054 cpuset_t cpuset;
12055 caddr_t va;
12056 ism_ment_t *ment;
12057 sfmmu_t *sfmmup;
12058 #ifdef VAC
12059 int vcolor;
12060 #endif
12061
12062 sf_scd_t *scdp;
12063 uint_t ism_rid;
12064
12065 ASSERT(!hmeblkp->hblk_shared);
12066 /*
12067 * Walk the ism_hat's mapping list and flush the page
12068 * from every hat sharing this ism_hat. This routine
12069 * may be called while all cpu's have been captured.
12070 * Therefore we can't attempt to grab any locks. For now
12071 * this means we will protect the ism mapping list under
12072 * a single lock which will be grabbed by the caller.
12073 * If hat_share/unshare scalibility becomes a performance
12074 * problem then we may need to re-think ism mapping list locking.
12075 */
12076 ASSERT(ism_sfmmup->sfmmu_ismhat);
12077 ASSERT(MUTEX_HELD(&ism_mlist_lock));
12078 addr = addr - ISMID_STARTADDR;
12079
12080 for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12081
12082 sfmmup = ment->iment_hat;
12083
12084 va = ment->iment_base_va;
12085 va = (caddr_t)((uintptr_t)va + (uintptr_t)addr);
12086
12087 /*
12088 * When an SCD is created the SCD hat is linked on the ism
12089 * mapping lists for each ISM segment which is part of the
12090 * SCD. If we find an SCD hat, when walking these lists,
12091 * then we flush the shared TSBs, if we find a private hat,
12092 * which is part of an SCD, but where the region
12093 * corresponding to this va is not part of the SCD then we
12094 * flush the private TSBs.
12095 */
12096 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12097 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12098 !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12099 if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12100 &ism_rid)) {
12101 cmn_err(CE_PANIC,
12102 "can't find matching ISM rid!");
12103 }
12104
12105 scdp = sfmmup->sfmmu_scdp;
12106 if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12107 SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12108 ism_rid)) {
12109 continue;
12110 }
12111 }
12112 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12113
12114 cpuset = sfmmup->sfmmu_cpusran;
12115 CPUSET_AND(cpuset, cpu_ready_set);
12116 CPUSET_DEL(cpuset, CPU->cpu_id);
12117 SFMMU_XCALL_STATS(sfmmup);
12118 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12119 (uint64_t)sfmmup);
12120 vtag_flushpage(va, (uint64_t)sfmmup);
12121
12122 #ifdef VAC
12123 /*
12124 * Flush D$
12125 * When flushing D$ we must flush all
12126 * cpu's. See sfmmu_cache_flush().
12127 */
12128 if (cache_flush_flag == CACHE_FLUSH) {
12129 cpuset = cpu_ready_set;
12130 CPUSET_DEL(cpuset, CPU->cpu_id);
12131
12132 SFMMU_XCALL_STATS(sfmmup);
12133 vcolor = addr_to_vcolor(va);
12134 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12135 vac_flushpage(pfnum, vcolor);
12136 }
12137 #endif /* VAC */
12138 }
12139 }
12140
12141 /*
12142 * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12143 * a particular virtual address and ctx. If noflush is set we do not
12144 * flush the TLB/TSB. This function may or may not be called with the
12145 * HAT lock held.
12146 */
12147 static void
12148 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12149 pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12150 int hat_lock_held)
12151 {
12152 #ifdef VAC
12153 int vcolor;
12154 #endif
12155 cpuset_t cpuset;
12156 hatlock_t *hatlockp;
12157
12158 ASSERT(!hmeblkp->hblk_shared);
12159
12160 #if defined(lint) && !defined(VAC)
12161 pfnum = pfnum;
12162 cpu_flag = cpu_flag;
12163 cache_flush_flag = cache_flush_flag;
12164 #endif
12165
12166 /*
12167 * There is no longer a need to protect against ctx being
12168 * stolen here since we don't store the ctx in the TSB anymore.
12169 */
12170 #ifdef VAC
12171 vcolor = addr_to_vcolor(addr);
12172 #endif
12173
12174 /*
12175 * We must hold the hat lock during the flush of TLB,
12176 * to avoid a race with sfmmu_invalidate_ctx(), where
12177 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12178 * causing TLB demap routine to skip flush on that MMU.
12179 * If the context on a MMU has already been set to
12180 * INVALID_CONTEXT, we just get an extra flush on
12181 * that MMU.
12182 */
12183 if (!hat_lock_held && !tlb_noflush)
12184 hatlockp = sfmmu_hat_enter(sfmmup);
12185
12186 kpreempt_disable();
12187 if (!tlb_noflush) {
12188 /*
12189 * Flush the TSB and TLB.
12190 */
12191 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12192
12193 cpuset = sfmmup->sfmmu_cpusran;
12194 CPUSET_AND(cpuset, cpu_ready_set);
12195 CPUSET_DEL(cpuset, CPU->cpu_id);
12196
12197 SFMMU_XCALL_STATS(sfmmup);
12198
12199 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12200 (uint64_t)sfmmup);
12201
12202 vtag_flushpage(addr, (uint64_t)sfmmup);
12203 }
12204
12205 if (!hat_lock_held && !tlb_noflush)
12206 sfmmu_hat_exit(hatlockp);
12207
12208 #ifdef VAC
12209 /*
12210 * Flush the D$
12211 *
12212 * Even if the ctx is stolen, we need to flush the
12213 * cache. Our ctx stealer only flushes the TLBs.
12214 */
12215 if (cache_flush_flag == CACHE_FLUSH) {
12216 if (cpu_flag & FLUSH_ALL_CPUS) {
12217 cpuset = cpu_ready_set;
12218 } else {
12219 cpuset = sfmmup->sfmmu_cpusran;
12220 CPUSET_AND(cpuset, cpu_ready_set);
12221 }
12222 CPUSET_DEL(cpuset, CPU->cpu_id);
12223 SFMMU_XCALL_STATS(sfmmup);
12224 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12225 vac_flushpage(pfnum, vcolor);
12226 }
12227 #endif /* VAC */
12228 kpreempt_enable();
12229 }
12230
12231 /*
12232 * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12233 * address and ctx. If noflush is set we do not currently do anything.
12234 * This function may or may not be called with the HAT lock held.
12235 */
12236 static void
12237 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12238 int tlb_noflush, int hat_lock_held)
12239 {
12240 cpuset_t cpuset;
12241 hatlock_t *hatlockp;
12242
12243 ASSERT(!hmeblkp->hblk_shared);
12244
12245 /*
12246 * If the process is exiting we have nothing to do.
12247 */
12248 if (tlb_noflush)
12249 return;
12250
12251 /*
12252 * Flush TSB.
12253 */
12254 if (!hat_lock_held)
12255 hatlockp = sfmmu_hat_enter(sfmmup);
12256 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12257
12258 kpreempt_disable();
12259
12260 cpuset = sfmmup->sfmmu_cpusran;
12261 CPUSET_AND(cpuset, cpu_ready_set);
12262 CPUSET_DEL(cpuset, CPU->cpu_id);
12263
12264 SFMMU_XCALL_STATS(sfmmup);
12265 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12266
12267 vtag_flushpage(addr, (uint64_t)sfmmup);
12268
12269 if (!hat_lock_held)
12270 sfmmu_hat_exit(hatlockp);
12271
12272 kpreempt_enable();
12273
12274 }
12275
12276 /*
12277 * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12278 * call handler that can flush a range of pages to save on xcalls.
12279 */
12280 static int sfmmu_xcall_save;
12281
12282 /*
12283 * this routine is never used for demaping addresses backed by SRD hmeblks.
12284 */
12285 static void
12286 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12287 {
12288 sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12289 hatlock_t *hatlockp;
12290 cpuset_t cpuset;
12291 uint64_t sfmmu_pgcnt;
12292 pgcnt_t pgcnt = 0;
12293 int pgunload = 0;
12294 int dirtypg = 0;
12295 caddr_t addr = dmrp->dmr_addr;
12296 caddr_t eaddr;
12297 uint64_t bitvec = dmrp->dmr_bitvec;
12298
12299 ASSERT(bitvec & 1);
12300
12301 /*
12302 * Flush TSB and calculate number of pages to flush.
12303 */
12304 while (bitvec != 0) {
12305 dirtypg = 0;
12306 /*
12307 * Find the first page to flush and then count how many
12308 * pages there are after it that also need to be flushed.
12309 * This way the number of TSB flushes is minimized.
12310 */
12311 while ((bitvec & 1) == 0) {
12312 pgcnt++;
12313 addr += MMU_PAGESIZE;
12314 bitvec >>= 1;
12315 }
12316 while (bitvec & 1) {
12317 dirtypg++;
12318 bitvec >>= 1;
12319 }
12320 eaddr = addr + ptob(dirtypg);
12321 hatlockp = sfmmu_hat_enter(sfmmup);
12322 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12323 sfmmu_hat_exit(hatlockp);
12324 pgunload += dirtypg;
12325 addr = eaddr;
12326 pgcnt += dirtypg;
12327 }
12328
12329 ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12330 if (sfmmup->sfmmu_free == 0) {
12331 addr = dmrp->dmr_addr;
12332 bitvec = dmrp->dmr_bitvec;
12333
12334 /*
12335 * make sure it has SFMMU_PGCNT_SHIFT bits only,
12336 * as it will be used to pack argument for xt_some
12337 */
12338 ASSERT((pgcnt > 0) &&
12339 (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12340
12341 /*
12342 * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12343 * the low 6 bits of sfmmup. This is doable since pgcnt
12344 * always >= 1.
12345 */
12346 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12347 sfmmu_pgcnt = (uint64_t)sfmmup |
12348 ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12349
12350 /*
12351 * We must hold the hat lock during the flush of TLB,
12352 * to avoid a race with sfmmu_invalidate_ctx(), where
12353 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12354 * causing TLB demap routine to skip flush on that MMU.
12355 * If the context on a MMU has already been set to
12356 * INVALID_CONTEXT, we just get an extra flush on
12357 * that MMU.
12358 */
12359 hatlockp = sfmmu_hat_enter(sfmmup);
12360 kpreempt_disable();
12361
12362 cpuset = sfmmup->sfmmu_cpusran;
12363 CPUSET_AND(cpuset, cpu_ready_set);
12364 CPUSET_DEL(cpuset, CPU->cpu_id);
12365
12366 SFMMU_XCALL_STATS(sfmmup);
12367 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12368 sfmmu_pgcnt);
12369
12370 for (; bitvec != 0; bitvec >>= 1) {
12371 if (bitvec & 1)
12372 vtag_flushpage(addr, (uint64_t)sfmmup);
12373 addr += MMU_PAGESIZE;
12374 }
12375 kpreempt_enable();
12376 sfmmu_hat_exit(hatlockp);
12377
12378 sfmmu_xcall_save += (pgunload-1);
12379 }
12380 dmrp->dmr_bitvec = 0;
12381 }
12382
12383 /*
12384 * In cases where we need to synchronize with TLB/TSB miss trap
12385 * handlers, _and_ need to flush the TLB, it's a lot easier to
12386 * throw away the context from the process than to do a
12387 * special song and dance to keep things consistent for the
12388 * handlers.
12389 *
12390 * Since the process suddenly ends up without a context and our caller
12391 * holds the hat lock, threads that fault after this function is called
12392 * will pile up on the lock. We can then do whatever we need to
12393 * atomically from the context of the caller. The first blocked thread
12394 * to resume executing will get the process a new context, and the
12395 * process will resume executing.
12396 *
12397 * One added advantage of this approach is that on MMUs that
12398 * support a "flush all" operation, we will delay the flush until
12399 * cnum wrap-around, and then flush the TLB one time. This
12400 * is rather rare, so it's a lot less expensive than making 8000
12401 * x-calls to flush the TLB 8000 times.
12402 *
12403 * A per-process (PP) lock is used to synchronize ctx allocations in
12404 * resume() and ctx invalidations here.
12405 */
12406 static void
12407 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12408 {
12409 cpuset_t cpuset;
12410 int cnum, currcnum;
12411 mmu_ctx_t *mmu_ctxp;
12412 int i;
12413 uint_t pstate_save;
12414
12415 SFMMU_STAT(sf_ctx_inv);
12416
12417 ASSERT(sfmmu_hat_lock_held(sfmmup));
12418 ASSERT(sfmmup != ksfmmup);
12419
12420 kpreempt_disable();
12421
12422 mmu_ctxp = CPU_MMU_CTXP(CPU);
12423 ASSERT(mmu_ctxp);
12424 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12425 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12426
12427 currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12428
12429 pstate_save = sfmmu_disable_intrs();
12430
12431 lock_set(&sfmmup->sfmmu_ctx_lock); /* acquire PP lock */
12432 /* set HAT cnum invalid across all context domains. */
12433 for (i = 0; i < max_mmu_ctxdoms; i++) {
12434
12435 cnum = sfmmup->sfmmu_ctxs[i].cnum;
12436 if (cnum == INVALID_CONTEXT) {
12437 continue;
12438 }
12439
12440 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12441 }
12442 membar_enter(); /* make sure globally visible to all CPUs */
12443 lock_clear(&sfmmup->sfmmu_ctx_lock); /* release PP lock */
12444
12445 sfmmu_enable_intrs(pstate_save);
12446
12447 cpuset = sfmmup->sfmmu_cpusran;
12448 CPUSET_DEL(cpuset, CPU->cpu_id);
12449 CPUSET_AND(cpuset, cpu_ready_set);
12450 if (!CPUSET_ISNULL(cpuset)) {
12451 SFMMU_XCALL_STATS(sfmmup);
12452 xt_some(cpuset, sfmmu_raise_tsb_exception,
12453 (uint64_t)sfmmup, INVALID_CONTEXT);
12454 xt_sync(cpuset);
12455 SFMMU_STAT(sf_tsb_raise_exception);
12456 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12457 }
12458
12459 /*
12460 * If the hat to-be-invalidated is the same as the current
12461 * process on local CPU we need to invalidate
12462 * this CPU context as well.
12463 */
12464 if ((sfmmu_getctx_sec() == currcnum) &&
12465 (currcnum != INVALID_CONTEXT)) {
12466 /* sets shared context to INVALID too */
12467 sfmmu_setctx_sec(INVALID_CONTEXT);
12468 sfmmu_clear_utsbinfo();
12469 }
12470
12471 SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12472
12473 kpreempt_enable();
12474
12475 /*
12476 * we hold the hat lock, so nobody should allocate a context
12477 * for us yet
12478 */
12479 ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12480 }
12481
12482 #ifdef VAC
12483 /*
12484 * We need to flush the cache in all cpus. It is possible that
12485 * a process referenced a page as cacheable but has sinced exited
12486 * and cleared the mapping list. We still to flush it but have no
12487 * state so all cpus is the only alternative.
12488 */
12489 void
12490 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12491 {
12492 cpuset_t cpuset;
12493
12494 kpreempt_disable();
12495 cpuset = cpu_ready_set;
12496 CPUSET_DEL(cpuset, CPU->cpu_id);
12497 SFMMU_XCALL_STATS(NULL); /* account to any ctx */
12498 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12499 xt_sync(cpuset);
12500 vac_flushpage(pfnum, vcolor);
12501 kpreempt_enable();
12502 }
12503
12504 void
12505 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12506 {
12507 cpuset_t cpuset;
12508
12509 ASSERT(vcolor >= 0);
12510
12511 kpreempt_disable();
12512 cpuset = cpu_ready_set;
12513 CPUSET_DEL(cpuset, CPU->cpu_id);
12514 SFMMU_XCALL_STATS(NULL); /* account to any ctx */
12515 xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12516 xt_sync(cpuset);
12517 vac_flushcolor(vcolor, pfnum);
12518 kpreempt_enable();
12519 }
12520 #endif /* VAC */
12521
12522 /*
12523 * We need to prevent processes from accessing the TSB using a cached physical
12524 * address. It's alright if they try to access the TSB via virtual address
12525 * since they will just fault on that virtual address once the mapping has
12526 * been suspended.
12527 */
12528 #pragma weak sendmondo_in_recover
12529
12530 /* ARGSUSED */
12531 static int
12532 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12533 {
12534 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12535 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12536 hatlock_t *hatlockp;
12537 sf_scd_t *scdp;
12538
12539 if (flags != HAT_PRESUSPEND)
12540 return (0);
12541
12542 /*
12543 * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12544 * be a shared hat, then set SCD's tsbinfo's flag.
12545 * If tsb is not shared, sfmmup is a private hat, then set
12546 * its private tsbinfo's flag.
12547 */
12548 hatlockp = sfmmu_hat_enter(sfmmup);
12549 tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12550
12551 if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12552 sfmmu_tsb_inv_ctx(sfmmup);
12553 sfmmu_hat_exit(hatlockp);
12554 } else {
12555 /* release lock on the shared hat */
12556 sfmmu_hat_exit(hatlockp);
12557 /* sfmmup is a shared hat */
12558 ASSERT(sfmmup->sfmmu_scdhat);
12559 scdp = sfmmup->sfmmu_scdp;
12560 ASSERT(scdp != NULL);
12561 /* get private hat from the scd list */
12562 mutex_enter(&scdp->scd_mutex);
12563 sfmmup = scdp->scd_sf_list;
12564 while (sfmmup != NULL) {
12565 hatlockp = sfmmu_hat_enter(sfmmup);
12566 /*
12567 * We do not call sfmmu_tsb_inv_ctx here because
12568 * sendmondo_in_recover check is only needed for
12569 * sun4u.
12570 */
12571 sfmmu_invalidate_ctx(sfmmup);
12572 sfmmu_hat_exit(hatlockp);
12573 sfmmup = sfmmup->sfmmu_scd_link.next;
12574
12575 }
12576 mutex_exit(&scdp->scd_mutex);
12577 }
12578 return (0);
12579 }
12580
12581 static void
12582 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12583 {
12584 extern uint32_t sendmondo_in_recover;
12585
12586 ASSERT(sfmmu_hat_lock_held(sfmmup));
12587
12588 /*
12589 * For Cheetah+ Erratum 25:
12590 * Wait for any active recovery to finish. We can't risk
12591 * relocating the TSB of the thread running mondo_recover_proc()
12592 * since, if we did that, we would deadlock. The scenario we are
12593 * trying to avoid is as follows:
12594 *
12595 * THIS CPU RECOVER CPU
12596 * -------- -----------
12597 * Begins recovery, walking through TSB
12598 * hat_pagesuspend() TSB TTE
12599 * TLB miss on TSB TTE, spins at TL1
12600 * xt_sync()
12601 * send_mondo_timeout()
12602 * mondo_recover_proc()
12603 * ((deadlocked))
12604 *
12605 * The second half of the workaround is that mondo_recover_proc()
12606 * checks to see if the tsb_info has the RELOC flag set, and if it
12607 * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12608 * and hence avoiding the TLB miss that could result in a deadlock.
12609 */
12610 if (&sendmondo_in_recover) {
12611 membar_enter(); /* make sure RELOC flag visible */
12612 while (sendmondo_in_recover) {
12613 drv_usecwait(1);
12614 membar_consumer();
12615 }
12616 }
12617
12618 sfmmu_invalidate_ctx(sfmmup);
12619 }
12620
12621 /* ARGSUSED */
12622 static int
12623 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12624 void *tsbinfo, pfn_t newpfn)
12625 {
12626 hatlock_t *hatlockp;
12627 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12628 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12629
12630 if (flags != HAT_POSTUNSUSPEND)
12631 return (0);
12632
12633 hatlockp = sfmmu_hat_enter(sfmmup);
12634
12635 SFMMU_STAT(sf_tsb_reloc);
12636
12637 /*
12638 * The process may have swapped out while we were relocating one
12639 * of its TSBs. If so, don't bother doing the setup since the
12640 * process can't be using the memory anymore.
12641 */
12642 if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12643 ASSERT(va == tsbinfop->tsb_va);
12644 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12645
12646 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12647 sfmmu_inv_tsb(tsbinfop->tsb_va,
12648 TSB_BYTES(tsbinfop->tsb_szc));
12649 tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12650 }
12651 }
12652
12653 membar_exit();
12654 tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12655 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12656
12657 sfmmu_hat_exit(hatlockp);
12658
12659 return (0);
12660 }
12661
12662 /*
12663 * Allocate and initialize a tsb_info structure. Note that we may or may not
12664 * allocate a TSB here, depending on the flags passed in.
12665 */
12666 static int
12667 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12668 uint_t flags, sfmmu_t *sfmmup)
12669 {
12670 int err;
12671
12672 *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12673 sfmmu_tsbinfo_cache, KM_SLEEP);
12674
12675 if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12676 tsb_szc, flags, sfmmup)) != 0) {
12677 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12678 SFMMU_STAT(sf_tsb_allocfail);
12679 *tsbinfopp = NULL;
12680 return (err);
12681 }
12682 SFMMU_STAT(sf_tsb_alloc);
12683
12684 /*
12685 * Bump the TSB size counters for this TSB size.
12686 */
12687 (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12688 return (0);
12689 }
12690
12691 static void
12692 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12693 {
12694 caddr_t tsbva = tsbinfo->tsb_va;
12695 uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12696 struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12697 vmem_t *vmp = tsbinfo->tsb_vmp;
12698
12699 /*
12700 * If we allocated this TSB from relocatable kernel memory, then we
12701 * need to uninstall the callback handler.
12702 */
12703 if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12704 uintptr_t slab_mask;
12705 caddr_t slab_vaddr;
12706 page_t **ppl;
12707 int ret;
12708
12709 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12710 if (tsb_size > MMU_PAGESIZE4M)
12711 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12712 else
12713 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12714 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12715
12716 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12717 ASSERT(ret == 0);
12718 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12719 0, NULL);
12720 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12721 }
12722
12723 if (kmem_cachep != NULL) {
12724 kmem_cache_free(kmem_cachep, tsbva);
12725 } else {
12726 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12727 }
12728 tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12729 atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12730 }
12731
12732 static void
12733 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12734 {
12735 if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12736 sfmmu_tsb_free(tsbinfo);
12737 }
12738 kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12739
12740 }
12741
12742 /*
12743 * Setup all the references to physical memory for this tsbinfo.
12744 * The underlying page(s) must be locked.
12745 */
12746 static void
12747 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12748 {
12749 ASSERT(pfn != PFN_INVALID);
12750 ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12751
12752 #ifndef sun4v
12753 if (tsbinfo->tsb_szc == 0) {
12754 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12755 PROT_WRITE|PROT_READ, TTE8K);
12756 } else {
12757 /*
12758 * Round down PA and use a large mapping; the handlers will
12759 * compute the TSB pointer at the correct offset into the
12760 * big virtual page. NOTE: this assumes all TSBs larger
12761 * than 8K must come from physically contiguous slabs of
12762 * size tsb_slab_size.
12763 */
12764 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12765 PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12766 }
12767 tsbinfo->tsb_pa = ptob(pfn);
12768
12769 TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12770 TTE_SET_MOD(&tsbinfo->tsb_tte); /* enable writes */
12771
12772 ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12773 ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12774 #else /* sun4v */
12775 tsbinfo->tsb_pa = ptob(pfn);
12776 #endif /* sun4v */
12777 }
12778
12779
12780 /*
12781 * Returns zero on success, ENOMEM if over the high water mark,
12782 * or EAGAIN if the caller needs to retry with a smaller TSB
12783 * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12784 *
12785 * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12786 * is specified and the TSB requested is PAGESIZE, though it
12787 * may sleep waiting for memory if sufficient memory is not
12788 * available.
12789 */
12790 static int
12791 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12792 int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12793 {
12794 caddr_t vaddr = NULL;
12795 caddr_t slab_vaddr;
12796 uintptr_t slab_mask;
12797 int tsbbytes = TSB_BYTES(tsbcode);
12798 int lowmem = 0;
12799 struct kmem_cache *kmem_cachep = NULL;
12800 vmem_t *vmp = NULL;
12801 lgrp_id_t lgrpid = LGRP_NONE;
12802 pfn_t pfn;
12803 uint_t cbflags = HAC_SLEEP;
12804 page_t **pplist;
12805 int ret;
12806
12807 ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
12808 if (tsbbytes > MMU_PAGESIZE4M)
12809 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12810 else
12811 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12812
12813 if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
12814 flags |= TSB_ALLOC;
12815
12816 ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
12817
12818 tsbinfo->tsb_sfmmu = sfmmup;
12819
12820 /*
12821 * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
12822 * return.
12823 */
12824 if ((flags & TSB_ALLOC) == 0) {
12825 tsbinfo->tsb_szc = tsbcode;
12826 tsbinfo->tsb_ttesz_mask = tteszmask;
12827 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
12828 tsbinfo->tsb_pa = -1;
12829 tsbinfo->tsb_tte.ll = 0;
12830 tsbinfo->tsb_next = NULL;
12831 tsbinfo->tsb_flags = TSB_SWAPPED;
12832 tsbinfo->tsb_cache = NULL;
12833 tsbinfo->tsb_vmp = NULL;
12834 return (0);
12835 }
12836
12837 #ifdef DEBUG
12838 /*
12839 * For debugging:
12840 * Randomly force allocation failures every tsb_alloc_mtbf
12841 * tries if TSB_FORCEALLOC is not specified. This will
12842 * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
12843 * it is even, to allow testing of both failure paths...
12844 */
12845 if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
12846 (tsb_alloc_count++ == tsb_alloc_mtbf)) {
12847 tsb_alloc_count = 0;
12848 tsb_alloc_fail_mtbf++;
12849 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
12850 }
12851 #endif /* DEBUG */
12852
12853 /*
12854 * Enforce high water mark if we are not doing a forced allocation
12855 * and are not shrinking a process' TSB.
12856 */
12857 if ((flags & TSB_SHRINK) == 0 &&
12858 (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
12859 if ((flags & TSB_FORCEALLOC) == 0)
12860 return (ENOMEM);
12861 lowmem = 1;
12862 }
12863
12864 /*
12865 * Allocate from the correct location based upon the size of the TSB
12866 * compared to the base page size, and what memory conditions dictate.
12867 * Note we always do nonblocking allocations from the TSB arena since
12868 * we don't want memory fragmentation to cause processes to block
12869 * indefinitely waiting for memory; until the kernel algorithms that
12870 * coalesce large pages are improved this is our best option.
12871 *
12872 * Algorithm:
12873 * If allocating a "large" TSB (>8K), allocate from the
12874 * appropriate kmem_tsb_default_arena vmem arena
12875 * else if low on memory or the TSB_FORCEALLOC flag is set or
12876 * tsb_forceheap is set
12877 * Allocate from kernel heap via sfmmu_tsb8k_cache with
12878 * KM_SLEEP (never fails)
12879 * else
12880 * Allocate from appropriate sfmmu_tsb_cache with
12881 * KM_NOSLEEP
12882 * endif
12883 */
12884 if (tsb_lgrp_affinity)
12885 lgrpid = lgrp_home_id(curthread);
12886 if (lgrpid == LGRP_NONE)
12887 lgrpid = 0; /* use lgrp of boot CPU */
12888
12889 if (tsbbytes > MMU_PAGESIZE) {
12890 if (tsbbytes > MMU_PAGESIZE4M) {
12891 vmp = kmem_bigtsb_default_arena[lgrpid];
12892 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12893 0, 0, NULL, NULL, VM_NOSLEEP);
12894 } else {
12895 vmp = kmem_tsb_default_arena[lgrpid];
12896 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12897 0, 0, NULL, NULL, VM_NOSLEEP);
12898 }
12899 #ifdef DEBUG
12900 } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
12901 #else /* !DEBUG */
12902 } else if (lowmem || (flags & TSB_FORCEALLOC)) {
12903 #endif /* DEBUG */
12904 kmem_cachep = sfmmu_tsb8k_cache;
12905 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
12906 ASSERT(vaddr != NULL);
12907 } else {
12908 kmem_cachep = sfmmu_tsb_cache[lgrpid];
12909 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
12910 }
12911
12912 tsbinfo->tsb_cache = kmem_cachep;
12913 tsbinfo->tsb_vmp = vmp;
12914
12915 if (vaddr == NULL) {
12916 return (EAGAIN);
12917 }
12918
12919 atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
12920 kmem_cachep = tsbinfo->tsb_cache;
12921
12922 /*
12923 * If we are allocating from outside the cage, then we need to
12924 * register a relocation callback handler. Note that for now
12925 * since pseudo mappings always hang off of the slab's root page,
12926 * we need only lock the first 8K of the TSB slab. This is a bit
12927 * hacky but it is good for performance.
12928 */
12929 if (kmem_cachep != sfmmu_tsb8k_cache) {
12930 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
12931 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
12932 ASSERT(ret == 0);
12933 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
12934 cbflags, (void *)tsbinfo, &pfn, NULL);
12935
12936 /*
12937 * Need to free up resources if we could not successfully
12938 * add the callback function and return an error condition.
12939 */
12940 if (ret != 0) {
12941 if (kmem_cachep) {
12942 kmem_cache_free(kmem_cachep, vaddr);
12943 } else {
12944 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
12945 }
12946 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
12947 S_WRITE);
12948 return (EAGAIN);
12949 }
12950 } else {
12951 /*
12952 * Since allocation of 8K TSBs from heap is rare and occurs
12953 * during memory pressure we allocate them from permanent
12954 * memory rather than using callbacks to get the PFN.
12955 */
12956 pfn = hat_getpfnum(kas.a_hat, vaddr);
12957 }
12958
12959 tsbinfo->tsb_va = vaddr;
12960 tsbinfo->tsb_szc = tsbcode;
12961 tsbinfo->tsb_ttesz_mask = tteszmask;
12962 tsbinfo->tsb_next = NULL;
12963 tsbinfo->tsb_flags = 0;
12964
12965 sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
12966
12967 sfmmu_inv_tsb(vaddr, tsbbytes);
12968
12969 if (kmem_cachep != sfmmu_tsb8k_cache) {
12970 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
12971 }
12972
12973 return (0);
12974 }
12975
12976 /*
12977 * Initialize per cpu tsb and per cpu tsbmiss_area
12978 */
12979 void
12980 sfmmu_init_tsbs(void)
12981 {
12982 int i;
12983 struct tsbmiss *tsbmissp;
12984 struct kpmtsbm *kpmtsbmp;
12985 #ifndef sun4v
12986 extern int dcache_line_mask;
12987 #endif /* sun4v */
12988 extern uint_t vac_colors;
12989
12990 /*
12991 * Init. tsb miss area.
12992 */
12993 tsbmissp = tsbmiss_area;
12994
12995 for (i = 0; i < NCPU; tsbmissp++, i++) {
12996 /*
12997 * initialize the tsbmiss area.
12998 * Do this for all possible CPUs as some may be added
12999 * while the system is running. There is no cost to this.
13000 */
13001 tsbmissp->ksfmmup = ksfmmup;
13002 #ifndef sun4v
13003 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13004 #endif /* sun4v */
13005 tsbmissp->khashstart =
13006 (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13007 tsbmissp->uhashstart =
13008 (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13009 tsbmissp->khashsz = khmehash_num;
13010 tsbmissp->uhashsz = uhmehash_num;
13011 }
13012
13013 sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13014 sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13015
13016 if (kpm_enable == 0)
13017 return;
13018
13019 /* -- Begin KPM specific init -- */
13020
13021 if (kpm_smallpages) {
13022 /*
13023 * If we're using base pagesize pages for seg_kpm
13024 * mappings, we use the kernel TSB since we can't afford
13025 * to allocate a second huge TSB for these mappings.
13026 */
13027 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13028 kpm_tsbsz = ktsb_szcode;
13029 kpmsm_tsbbase = kpm_tsbbase;
13030 kpmsm_tsbsz = kpm_tsbsz;
13031 } else {
13032 /*
13033 * In VAC conflict case, just put the entries in the
13034 * kernel 8K indexed TSB for now so we can find them.
13035 * This could really be changed in the future if we feel
13036 * the need...
13037 */
13038 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13039 kpmsm_tsbsz = ktsb_szcode;
13040 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13041 kpm_tsbsz = ktsb4m_szcode;
13042 }
13043
13044 kpmtsbmp = kpmtsbm_area;
13045 for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13046 /*
13047 * Initialize the kpmtsbm area.
13048 * Do this for all possible CPUs as some may be added
13049 * while the system is running. There is no cost to this.
13050 */
13051 kpmtsbmp->vbase = kpm_vbase;
13052 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13053 kpmtsbmp->sz_shift = kpm_size_shift;
13054 kpmtsbmp->kpmp_shift = kpmp_shift;
13055 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13056 if (kpm_smallpages == 0) {
13057 kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13058 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13059 } else {
13060 kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13061 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13062 }
13063 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13064 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13065 #ifdef DEBUG
13066 kpmtsbmp->flags |= (kpm_tsbmtl) ? KPMTSBM_TLTSBM_FLAG : 0;
13067 #endif /* DEBUG */
13068 if (ktsb_phys)
13069 kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13070 }
13071
13072 /* -- End KPM specific init -- */
13073 }
13074
13075 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13076 struct tsb_info ktsb_info[2];
13077
13078 /*
13079 * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13080 */
13081 void
13082 sfmmu_init_ktsbinfo()
13083 {
13084 ASSERT(ksfmmup != NULL);
13085 ASSERT(ksfmmup->sfmmu_tsb == NULL);
13086 /*
13087 * Allocate tsbinfos for kernel and copy in data
13088 * to make debug easier and sun4v setup easier.
13089 */
13090 ktsb_info[0].tsb_sfmmu = ksfmmup;
13091 ktsb_info[0].tsb_szc = ktsb_szcode;
13092 ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13093 ktsb_info[0].tsb_va = ktsb_base;
13094 ktsb_info[0].tsb_pa = ktsb_pbase;
13095 ktsb_info[0].tsb_flags = 0;
13096 ktsb_info[0].tsb_tte.ll = 0;
13097 ktsb_info[0].tsb_cache = NULL;
13098
13099 ktsb_info[1].tsb_sfmmu = ksfmmup;
13100 ktsb_info[1].tsb_szc = ktsb4m_szcode;
13101 ktsb_info[1].tsb_ttesz_mask = TSB4M;
13102 ktsb_info[1].tsb_va = ktsb4m_base;
13103 ktsb_info[1].tsb_pa = ktsb4m_pbase;
13104 ktsb_info[1].tsb_flags = 0;
13105 ktsb_info[1].tsb_tte.ll = 0;
13106 ktsb_info[1].tsb_cache = NULL;
13107
13108 /* Link them into ksfmmup. */
13109 ktsb_info[0].tsb_next = &ktsb_info[1];
13110 ktsb_info[1].tsb_next = NULL;
13111 ksfmmup->sfmmu_tsb = &ktsb_info[0];
13112
13113 sfmmu_setup_tsbinfo(ksfmmup);
13114 }
13115
13116 /*
13117 * Cache the last value returned from va_to_pa(). If the VA specified
13118 * in the current call to cached_va_to_pa() maps to the same Page (as the
13119 * previous call to cached_va_to_pa()), then compute the PA using
13120 * cached info, else call va_to_pa().
13121 *
13122 * Note: this function is neither MT-safe nor consistent in the presence
13123 * of multiple, interleaved threads. This function was created to enable
13124 * an optimization used during boot (at a point when there's only one thread
13125 * executing on the "boot CPU", and before startup_vm() has been called).
13126 */
13127 static uint64_t
13128 cached_va_to_pa(void *vaddr)
13129 {
13130 static uint64_t prev_vaddr_base = 0;
13131 static uint64_t prev_pfn = 0;
13132
13133 if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13134 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13135 } else {
13136 uint64_t pa = va_to_pa(vaddr);
13137
13138 if (pa != ((uint64_t)-1)) {
13139 /*
13140 * Computed physical address is valid. Cache its
13141 * related info for the next cached_va_to_pa() call.
13142 */
13143 prev_pfn = pa & MMU_PAGEMASK;
13144 prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13145 }
13146
13147 return (pa);
13148 }
13149 }
13150
13151 /*
13152 * Carve up our nucleus hblk region. We may allocate more hblks than
13153 * asked due to rounding errors but we are guaranteed to have at least
13154 * enough space to allocate the requested number of hblk8's and hblk1's.
13155 */
13156 void
13157 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13158 {
13159 struct hme_blk *hmeblkp;
13160 size_t hme8blk_sz, hme1blk_sz;
13161 size_t i;
13162 size_t hblk8_bound;
13163 ulong_t j = 0, k = 0;
13164
13165 ASSERT(addr != NULL && size != 0);
13166
13167 /* Need to use proper structure alignment */
13168 hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13169 hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13170
13171 nucleus_hblk8.list = (void *)addr;
13172 nucleus_hblk8.index = 0;
13173
13174 /*
13175 * Use as much memory as possible for hblk8's since we
13176 * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13177 * We need to hold back enough space for the hblk1's which
13178 * we'll allocate next.
13179 */
13180 hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13181 for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13182 hmeblkp = (struct hme_blk *)addr;
13183 addr += hme8blk_sz;
13184 hmeblkp->hblk_nuc_bit = 1;
13185 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13186 }
13187 nucleus_hblk8.len = j;
13188 ASSERT(j >= nhblk8);
13189 SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13190
13191 nucleus_hblk1.list = (void *)addr;
13192 nucleus_hblk1.index = 0;
13193 for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13194 hmeblkp = (struct hme_blk *)addr;
13195 addr += hme1blk_sz;
13196 hmeblkp->hblk_nuc_bit = 1;
13197 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13198 }
13199 ASSERT(k >= nhblk1);
13200 nucleus_hblk1.len = k;
13201 SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13202 }
13203
13204 /*
13205 * This function is currently not supported on this platform. For what
13206 * it's supposed to do, see hat.c and hat_srmmu.c
13207 */
13208 /* ARGSUSED */
13209 faultcode_t
13210 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13211 uint_t flags)
13212 {
13213 return (FC_NOSUPPORT);
13214 }
13215
13216 /*
13217 * Searchs the mapping list of the page for a mapping of the same size. If not
13218 * found the corresponding bit is cleared in the p_index field. When large
13219 * pages are more prevalent in the system, we can maintain the mapping list
13220 * in order and we don't have to traverse the list each time. Just check the
13221 * next and prev entries, and if both are of different size, we clear the bit.
13222 */
13223 static void
13224 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13225 {
13226 struct sf_hment *sfhmep;
13227 int index;
13228 pgcnt_t npgs;
13229
13230 ASSERT(ttesz > TTE8K);
13231
13232 ASSERT(sfmmu_mlist_held(pp));
13233
13234 ASSERT(PP_ISMAPPED_LARGE(pp));
13235
13236 /*
13237 * Traverse mapping list looking for another mapping of same size.
13238 * since we only want to clear index field if all mappings of
13239 * that size are gone.
13240 */
13241
13242 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13243 if (IS_PAHME(sfhmep))
13244 continue;
13245 if (hme_size(sfhmep) == ttesz) {
13246 /*
13247 * another mapping of the same size. don't clear index.
13248 */
13249 return;
13250 }
13251 }
13252
13253 /*
13254 * Clear the p_index bit for large page.
13255 */
13256 index = PAGESZ_TO_INDEX(ttesz);
13257 npgs = TTEPAGES(ttesz);
13258 while (npgs-- > 0) {
13259 ASSERT(pp->p_index & index);
13260 pp->p_index &= ~index;
13261 pp = PP_PAGENEXT(pp);
13262 }
13263 }
13264
13265 /*
13266 * return supported features
13267 */
13268 /* ARGSUSED */
13269 int
13270 hat_supported(enum hat_features feature, void *arg)
13271 {
13272 switch (feature) {
13273 case HAT_SHARED_PT:
13274 case HAT_DYNAMIC_ISM_UNMAP:
13275 case HAT_VMODSORT:
13276 return (1);
13277 case HAT_SHARED_REGIONS:
13278 if (shctx_on)
13279 return (1);
13280 else
13281 return (0);
13282 default:
13283 return (0);
13284 }
13285 }
13286
13287 void
13288 hat_enter(struct hat *hat)
13289 {
13290 hatlock_t *hatlockp;
13291
13292 if (hat != ksfmmup) {
13293 hatlockp = TSB_HASH(hat);
13294 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13295 }
13296 }
13297
13298 void
13299 hat_exit(struct hat *hat)
13300 {
13301 hatlock_t *hatlockp;
13302
13303 if (hat != ksfmmup) {
13304 hatlockp = TSB_HASH(hat);
13305 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13306 }
13307 }
13308
13309 /*ARGSUSED*/
13310 void
13311 hat_reserve(struct as *as, caddr_t addr, size_t len)
13312 {
13313 }
13314
13315 static void
13316 hat_kstat_init(void)
13317 {
13318 kstat_t *ksp;
13319
13320 ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13321 KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13322 KSTAT_FLAG_VIRTUAL);
13323 if (ksp) {
13324 ksp->ks_data = (void *) &sfmmu_global_stat;
13325 kstat_install(ksp);
13326 }
13327 ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13328 KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13329 KSTAT_FLAG_VIRTUAL);
13330 if (ksp) {
13331 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13332 kstat_install(ksp);
13333 }
13334 ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13335 KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13336 KSTAT_FLAG_WRITABLE);
13337 if (ksp) {
13338 ksp->ks_update = sfmmu_kstat_percpu_update;
13339 kstat_install(ksp);
13340 }
13341 }
13342
13343 /* ARGSUSED */
13344 static int
13345 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13346 {
13347 struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13348 struct tsbmiss *tsbm = tsbmiss_area;
13349 struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13350 int i;
13351
13352 ASSERT(cpu_kstat);
13353 if (rw == KSTAT_READ) {
13354 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13355 cpu_kstat->sf_itlb_misses = 0;
13356 cpu_kstat->sf_dtlb_misses = 0;
13357 cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13358 tsbm->uprot_traps;
13359 cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13360 kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13361 cpu_kstat->sf_tsb_hits = 0;
13362 cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13363 cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13364 }
13365 } else {
13366 /* KSTAT_WRITE is used to clear stats */
13367 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13368 tsbm->utsb_misses = 0;
13369 tsbm->ktsb_misses = 0;
13370 tsbm->uprot_traps = 0;
13371 tsbm->kprot_traps = 0;
13372 kpmtsbm->kpm_dtlb_misses = 0;
13373 kpmtsbm->kpm_tsb_misses = 0;
13374 }
13375 }
13376 return (0);
13377 }
13378
13379 #ifdef DEBUG
13380
13381 tte_t *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13382
13383 /*
13384 * A tte checker. *orig_old is the value we read before cas.
13385 * *cur is the value returned by cas.
13386 * *new is the desired value when we do the cas.
13387 *
13388 * *hmeblkp is currently unused.
13389 */
13390
13391 /* ARGSUSED */
13392 void
13393 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13394 {
13395 pfn_t i, j, k;
13396 int cpuid = CPU->cpu_id;
13397
13398 gorig[cpuid] = orig_old;
13399 gcur[cpuid] = cur;
13400 gnew[cpuid] = new;
13401
13402 #ifdef lint
13403 hmeblkp = hmeblkp;
13404 #endif
13405
13406 if (TTE_IS_VALID(orig_old)) {
13407 if (TTE_IS_VALID(cur)) {
13408 i = TTE_TO_TTEPFN(orig_old);
13409 j = TTE_TO_TTEPFN(cur);
13410 k = TTE_TO_TTEPFN(new);
13411 if (i != j) {
13412 /* remap error? */
13413 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13414 }
13415
13416 if (i != k) {
13417 /* remap error? */
13418 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13419 }
13420 } else {
13421 if (TTE_IS_VALID(new)) {
13422 panic("chk_tte: invalid cur? ");
13423 }
13424
13425 i = TTE_TO_TTEPFN(orig_old);
13426 k = TTE_TO_TTEPFN(new);
13427 if (i != k) {
13428 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13429 }
13430 }
13431 } else {
13432 if (TTE_IS_VALID(cur)) {
13433 j = TTE_TO_TTEPFN(cur);
13434 if (TTE_IS_VALID(new)) {
13435 k = TTE_TO_TTEPFN(new);
13436 if (j != k) {
13437 panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13438 j, k);
13439 }
13440 } else {
13441 panic("chk_tte: why here?");
13442 }
13443 } else {
13444 if (!TTE_IS_VALID(new)) {
13445 panic("chk_tte: why here2 ?");
13446 }
13447 }
13448 }
13449 }
13450
13451 #endif /* DEBUG */
13452
13453 extern void prefetch_tsbe_read(struct tsbe *);
13454 extern void prefetch_tsbe_write(struct tsbe *);
13455
13456
13457 /*
13458 * We want to prefetch 7 cache lines ahead for our read prefetch. This gives
13459 * us optimal performance on Cheetah+. You can only have 8 outstanding
13460 * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13461 * prefetch to make the most utilization of the prefetch capability.
13462 */
13463 #define TSBE_PREFETCH_STRIDE (7)
13464
13465 void
13466 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13467 {
13468 int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13469 int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13470 int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13471 int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13472 struct tsbe *old;
13473 struct tsbe *new;
13474 struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13475 uint64_t va;
13476 int new_offset;
13477 int i;
13478 int vpshift;
13479 int last_prefetch;
13480
13481 if (old_bytes == new_bytes) {
13482 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13483 } else {
13484
13485 /*
13486 * A TSBE is 16 bytes which means there are four TSBE's per
13487 * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13488 */
13489 old = (struct tsbe *)old_tsbinfo->tsb_va;
13490 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13491 for (i = 0; i < old_entries; i++, old++) {
13492 if (((i & (4-1)) == 0) && (i < last_prefetch))
13493 prefetch_tsbe_read(old);
13494 if (!old->tte_tag.tag_invalid) {
13495 /*
13496 * We have a valid TTE to remap. Check the
13497 * size. We won't remap 64K or 512K TTEs
13498 * because they span more than one TSB entry
13499 * and are indexed using an 8K virt. page.
13500 * Ditto for 32M and 256M TTEs.
13501 */
13502 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13503 TTE_CSZ(&old->tte_data) == TTE512K)
13504 continue;
13505 if (mmu_page_sizes == max_mmu_page_sizes) {
13506 if (TTE_CSZ(&old->tte_data) == TTE32M ||
13507 TTE_CSZ(&old->tte_data) == TTE256M)
13508 continue;
13509 }
13510
13511 /* clear the lower 22 bits of the va */
13512 va = *(uint64_t *)old << 22;
13513 /* turn va into a virtual pfn */
13514 va >>= 22 - TSB_START_SIZE;
13515 /*
13516 * or in bits from the offset in the tsb
13517 * to get the real virtual pfn. These
13518 * correspond to bits [21:13] in the va
13519 */
13520 vpshift =
13521 TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13522 0x1ff;
13523 va |= (i << vpshift);
13524 va >>= vpshift;
13525 new_offset = va & (new_entries - 1);
13526 new = new_base + new_offset;
13527 prefetch_tsbe_write(new);
13528 *new = *old;
13529 }
13530 }
13531 }
13532 }
13533
13534 /*
13535 * unused in sfmmu
13536 */
13537 void
13538 hat_dump(void)
13539 {
13540 }
13541
13542 /*
13543 * Called when a thread is exiting and we have switched to the kernel address
13544 * space. Perform the same VM initialization resume() uses when switching
13545 * processes.
13546 *
13547 * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13548 * we call it anyway in case the semantics change in the future.
13549 */
13550 /*ARGSUSED*/
13551 void
13552 hat_thread_exit(kthread_t *thd)
13553 {
13554 uint_t pgsz_cnum;
13555 uint_t pstate_save;
13556
13557 ASSERT(thd->t_procp->p_as == &kas);
13558
13559 pgsz_cnum = KCONTEXT;
13560 #ifdef sun4u
13561 pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13562 #endif
13563
13564 /*
13565 * Note that sfmmu_load_mmustate() is currently a no-op for
13566 * kernel threads. We need to disable interrupts here,
13567 * simply because otherwise sfmmu_load_mmustate() would panic
13568 * if the caller does not disable interrupts.
13569 */
13570 pstate_save = sfmmu_disable_intrs();
13571
13572 /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13573 sfmmu_setctx_sec(pgsz_cnum);
13574 sfmmu_load_mmustate(ksfmmup);
13575 sfmmu_enable_intrs(pstate_save);
13576 }
13577
13578
13579 /*
13580 * SRD support
13581 */
13582 #define SRD_HASH_FUNCTION(vp) (((((uintptr_t)(vp)) >> 4) ^ \
13583 (((uintptr_t)(vp)) >> 11)) & \
13584 srd_hashmask)
13585
13586 /*
13587 * Attach the process to the srd struct associated with the exec vnode
13588 * from which the process is started.
13589 */
13590 void
13591 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13592 {
13593 uint_t hash = SRD_HASH_FUNCTION(evp);
13594 sf_srd_t *srdp;
13595 sf_srd_t *newsrdp;
13596
13597 ASSERT(sfmmup != ksfmmup);
13598 ASSERT(sfmmup->sfmmu_srdp == NULL);
13599
13600 if (!shctx_on) {
13601 return;
13602 }
13603
13604 VN_HOLD(evp);
13605
13606 if (srd_buckets[hash].srdb_srdp != NULL) {
13607 mutex_enter(&srd_buckets[hash].srdb_lock);
13608 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13609 srdp = srdp->srd_hash) {
13610 if (srdp->srd_evp == evp) {
13611 ASSERT(srdp->srd_refcnt >= 0);
13612 sfmmup->sfmmu_srdp = srdp;
13613 atomic_inc_32(
13614 (volatile uint_t *)&srdp->srd_refcnt);
13615 mutex_exit(&srd_buckets[hash].srdb_lock);
13616 return;
13617 }
13618 }
13619 mutex_exit(&srd_buckets[hash].srdb_lock);
13620 }
13621 newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13622 ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13623
13624 newsrdp->srd_evp = evp;
13625 newsrdp->srd_refcnt = 1;
13626 newsrdp->srd_hmergnfree = NULL;
13627 newsrdp->srd_ismrgnfree = NULL;
13628
13629 mutex_enter(&srd_buckets[hash].srdb_lock);
13630 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13631 srdp = srdp->srd_hash) {
13632 if (srdp->srd_evp == evp) {
13633 ASSERT(srdp->srd_refcnt >= 0);
13634 sfmmup->sfmmu_srdp = srdp;
13635 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13636 mutex_exit(&srd_buckets[hash].srdb_lock);
13637 kmem_cache_free(srd_cache, newsrdp);
13638 return;
13639 }
13640 }
13641 newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13642 srd_buckets[hash].srdb_srdp = newsrdp;
13643 sfmmup->sfmmu_srdp = newsrdp;
13644
13645 mutex_exit(&srd_buckets[hash].srdb_lock);
13646
13647 }
13648
13649 static void
13650 sfmmu_leave_srd(sfmmu_t *sfmmup)
13651 {
13652 vnode_t *evp;
13653 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13654 uint_t hash;
13655 sf_srd_t **prev_srdpp;
13656 sf_region_t *rgnp;
13657 sf_region_t *nrgnp;
13658 #ifdef DEBUG
13659 int rgns = 0;
13660 #endif
13661 int i;
13662
13663 ASSERT(sfmmup != ksfmmup);
13664 ASSERT(srdp != NULL);
13665 ASSERT(srdp->srd_refcnt > 0);
13666 ASSERT(sfmmup->sfmmu_scdp == NULL);
13667 ASSERT(sfmmup->sfmmu_free == 1);
13668
13669 sfmmup->sfmmu_srdp = NULL;
13670 evp = srdp->srd_evp;
13671 ASSERT(evp != NULL);
13672 if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13673 VN_RELE(evp);
13674 return;
13675 }
13676
13677 hash = SRD_HASH_FUNCTION(evp);
13678 mutex_enter(&srd_buckets[hash].srdb_lock);
13679 for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13680 (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13681 if (srdp->srd_evp == evp) {
13682 break;
13683 }
13684 }
13685 if (srdp == NULL || srdp->srd_refcnt) {
13686 mutex_exit(&srd_buckets[hash].srdb_lock);
13687 VN_RELE(evp);
13688 return;
13689 }
13690 *prev_srdpp = srdp->srd_hash;
13691 mutex_exit(&srd_buckets[hash].srdb_lock);
13692
13693 ASSERT(srdp->srd_refcnt == 0);
13694 VN_RELE(evp);
13695
13696 #ifdef DEBUG
13697 for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13698 ASSERT(srdp->srd_rgnhash[i] == NULL);
13699 }
13700 #endif /* DEBUG */
13701
13702 /* free each hme regions in the srd */
13703 for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13704 nrgnp = rgnp->rgn_next;
13705 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13706 ASSERT(rgnp->rgn_refcnt == 0);
13707 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13708 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13709 ASSERT(rgnp->rgn_hmeflags == 0);
13710 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13711 #ifdef DEBUG
13712 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13713 ASSERT(rgnp->rgn_ttecnt[i] == 0);
13714 }
13715 rgns++;
13716 #endif /* DEBUG */
13717 kmem_cache_free(region_cache, rgnp);
13718 }
13719 ASSERT(rgns == srdp->srd_next_hmerid);
13720
13721 #ifdef DEBUG
13722 rgns = 0;
13723 #endif
13724 /* free each ism rgns in the srd */
13725 for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13726 nrgnp = rgnp->rgn_next;
13727 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13728 ASSERT(rgnp->rgn_refcnt == 0);
13729 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13730 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13731 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13732 #ifdef DEBUG
13733 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13734 ASSERT(rgnp->rgn_ttecnt[i] == 0);
13735 }
13736 rgns++;
13737 #endif /* DEBUG */
13738 kmem_cache_free(region_cache, rgnp);
13739 }
13740 ASSERT(rgns == srdp->srd_next_ismrid);
13741 ASSERT(srdp->srd_ismbusyrgns == 0);
13742 ASSERT(srdp->srd_hmebusyrgns == 0);
13743
13744 srdp->srd_next_ismrid = 0;
13745 srdp->srd_next_hmerid = 0;
13746
13747 bzero((void *)srdp->srd_ismrgnp,
13748 sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13749 bzero((void *)srdp->srd_hmergnp,
13750 sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13751
13752 ASSERT(srdp->srd_scdp == NULL);
13753 kmem_cache_free(srd_cache, srdp);
13754 }
13755
13756 /* ARGSUSED */
13757 static int
13758 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13759 {
13760 sf_srd_t *srdp = (sf_srd_t *)buf;
13761 bzero(buf, sizeof (*srdp));
13762
13763 mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13764 mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13765 return (0);
13766 }
13767
13768 /* ARGSUSED */
13769 static void
13770 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13771 {
13772 sf_srd_t *srdp = (sf_srd_t *)buf;
13773
13774 mutex_destroy(&srdp->srd_mutex);
13775 mutex_destroy(&srdp->srd_scd_mutex);
13776 }
13777
13778 /*
13779 * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13780 * at the same time for the same process and address range. This is ensured by
13781 * the fact that address space is locked as writer when a process joins the
13782 * regions. Therefore there's no need to hold an srd lock during the entire
13783 * execution of hat_join_region()/hat_leave_region().
13784 */
13785
13786 #define RGN_HASH_FUNCTION(obj) (((((uintptr_t)(obj)) >> 4) ^ \
13787 (((uintptr_t)(obj)) >> 11)) & \
13788 srd_rgn_hashmask)
13789 /*
13790 * This routine implements the shared context functionality required when
13791 * attaching a segment to an address space. It must be called from
13792 * hat_share() for D(ISM) segments and from segvn_create() for segments
13793 * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13794 * which is saved in the private segment data for hme segments and
13795 * the ism_map structure for ism segments.
13796 */
13797 hat_region_cookie_t
13798 hat_join_region(struct hat *sfmmup,
13799 caddr_t r_saddr,
13800 size_t r_size,
13801 void *r_obj,
13802 u_offset_t r_objoff,
13803 uchar_t r_perm,
13804 uchar_t r_pgszc,
13805 hat_rgn_cb_func_t r_cb_function,
13806 uint_t flags)
13807 {
13808 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13809 uint_t rhash;
13810 uint_t rid;
13811 hatlock_t *hatlockp;
13812 sf_region_t *rgnp;
13813 sf_region_t *new_rgnp = NULL;
13814 int i;
13815 uint16_t *nextidp;
13816 sf_region_t **freelistp;
13817 int maxids;
13818 sf_region_t **rarrp;
13819 uint16_t *busyrgnsp;
13820 ulong_t rttecnt;
13821 uchar_t tteflag;
13822 uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13823 int text = (r_type == HAT_REGION_TEXT);
13824
13825 if (srdp == NULL || r_size == 0) {
13826 return (HAT_INVALID_REGION_COOKIE);
13827 }
13828
13829 ASSERT(sfmmup != ksfmmup);
13830 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
13831 ASSERT(srdp->srd_refcnt > 0);
13832 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13833 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13834 ASSERT(r_pgszc < mmu_page_sizes);
13835 if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
13836 !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
13837 panic("hat_join_region: region addr or size is not aligned\n");
13838 }
13839
13840
13841 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13842 SFMMU_REGION_HME;
13843 /*
13844 * Currently only support shared hmes for the read only main text
13845 * region.
13846 */
13847 if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
13848 (r_perm & PROT_WRITE))) {
13849 return (HAT_INVALID_REGION_COOKIE);
13850 }
13851
13852 rhash = RGN_HASH_FUNCTION(r_obj);
13853
13854 if (r_type == SFMMU_REGION_ISM) {
13855 nextidp = &srdp->srd_next_ismrid;
13856 freelistp = &srdp->srd_ismrgnfree;
13857 maxids = SFMMU_MAX_ISM_REGIONS;
13858 rarrp = srdp->srd_ismrgnp;
13859 busyrgnsp = &srdp->srd_ismbusyrgns;
13860 } else {
13861 nextidp = &srdp->srd_next_hmerid;
13862 freelistp = &srdp->srd_hmergnfree;
13863 maxids = SFMMU_MAX_HME_REGIONS;
13864 rarrp = srdp->srd_hmergnp;
13865 busyrgnsp = &srdp->srd_hmebusyrgns;
13866 }
13867
13868 mutex_enter(&srdp->srd_mutex);
13869
13870 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13871 rgnp = rgnp->rgn_hash) {
13872 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
13873 rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
13874 rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
13875 break;
13876 }
13877 }
13878
13879 rfound:
13880 if (rgnp != NULL) {
13881 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
13882 ASSERT(rgnp->rgn_cb_function == r_cb_function);
13883 ASSERT(rgnp->rgn_refcnt >= 0);
13884 rid = rgnp->rgn_id;
13885 ASSERT(rid < maxids);
13886 ASSERT(rarrp[rid] == rgnp);
13887 ASSERT(rid < *nextidp);
13888 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
13889 mutex_exit(&srdp->srd_mutex);
13890 if (new_rgnp != NULL) {
13891 kmem_cache_free(region_cache, new_rgnp);
13892 }
13893 if (r_type == SFMMU_REGION_HME) {
13894 int myjoin =
13895 (sfmmup == astosfmmu(curthread->t_procp->p_as));
13896
13897 sfmmu_link_to_hmeregion(sfmmup, rgnp);
13898 /*
13899 * bitmap should be updated after linking sfmmu on
13900 * region list so that pageunload() doesn't skip
13901 * TSB/TLB flush. As soon as bitmap is updated another
13902 * thread in this process can already start accessing
13903 * this region.
13904 */
13905 /*
13906 * Normally ttecnt accounting is done as part of
13907 * pagefault handling. But a process may not take any
13908 * pagefaults on shared hmeblks created by some other
13909 * process. To compensate for this assume that the
13910 * entire region will end up faulted in using
13911 * the region's pagesize.
13912 *
13913 */
13914 if (r_pgszc > TTE8K) {
13915 tteflag = 1 << r_pgszc;
13916 if (disable_large_pages & tteflag) {
13917 tteflag = 0;
13918 }
13919 } else {
13920 tteflag = 0;
13921 }
13922 if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
13923 hatlockp = sfmmu_hat_enter(sfmmup);
13924 sfmmup->sfmmu_rtteflags |= tteflag;
13925 sfmmu_hat_exit(hatlockp);
13926 }
13927 hatlockp = sfmmu_hat_enter(sfmmup);
13928
13929 /*
13930 * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
13931 * region to allow for large page allocation failure.
13932 */
13933 if (r_pgszc >= TTE4M) {
13934 sfmmup->sfmmu_tsb0_4minflcnt +=
13935 r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
13936 }
13937
13938 /* update sfmmu_ttecnt with the shme rgn ttecnt */
13939 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
13940 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
13941 rttecnt);
13942
13943 if (text && r_pgszc >= TTE4M &&
13944 (tteflag || ((disable_large_pages >> TTE4M) &
13945 ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
13946 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
13947 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
13948 }
13949
13950 sfmmu_hat_exit(hatlockp);
13951 /*
13952 * On Panther we need to make sure TLB is programmed
13953 * to accept 32M/256M pages. Call
13954 * sfmmu_check_page_sizes() now to make sure TLB is
13955 * setup before making hmeregions visible to other
13956 * threads.
13957 */
13958 sfmmu_check_page_sizes(sfmmup, 1);
13959 hatlockp = sfmmu_hat_enter(sfmmup);
13960 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
13961
13962 /*
13963 * if context is invalid tsb miss exception code will
13964 * call sfmmu_check_page_sizes() and update tsbmiss
13965 * area later.
13966 */
13967 kpreempt_disable();
13968 if (myjoin &&
13969 (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
13970 != INVALID_CONTEXT)) {
13971 struct tsbmiss *tsbmp;
13972
13973 tsbmp = &tsbmiss_area[CPU->cpu_id];
13974 ASSERT(sfmmup == tsbmp->usfmmup);
13975 BT_SET(tsbmp->shmermap, rid);
13976 if (r_pgszc > TTE64K) {
13977 tsbmp->uhat_rtteflags |= tteflag;
13978 }
13979
13980 }
13981 kpreempt_enable();
13982
13983 sfmmu_hat_exit(hatlockp);
13984 ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
13985 HAT_INVALID_REGION_COOKIE);
13986 } else {
13987 hatlockp = sfmmu_hat_enter(sfmmup);
13988 SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
13989 sfmmu_hat_exit(hatlockp);
13990 }
13991 ASSERT(rid < maxids);
13992
13993 if (r_type == SFMMU_REGION_ISM) {
13994 sfmmu_find_scd(sfmmup);
13995 }
13996 return ((hat_region_cookie_t)((uint64_t)rid));
13997 }
13998
13999 ASSERT(new_rgnp == NULL);
14000
14001 if (*busyrgnsp >= maxids) {
14002 mutex_exit(&srdp->srd_mutex);
14003 return (HAT_INVALID_REGION_COOKIE);
14004 }
14005
14006 ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14007 if (*freelistp != NULL) {
14008 rgnp = *freelistp;
14009 *freelistp = rgnp->rgn_next;
14010 ASSERT(rgnp->rgn_id < *nextidp);
14011 ASSERT(rgnp->rgn_id < maxids);
14012 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14013 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14014 == r_type);
14015 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14016 ASSERT(rgnp->rgn_hmeflags == 0);
14017 } else {
14018 /*
14019 * release local locks before memory allocation.
14020 */
14021 mutex_exit(&srdp->srd_mutex);
14022
14023 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14024
14025 mutex_enter(&srdp->srd_mutex);
14026 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14027 rgnp = rgnp->rgn_hash) {
14028 if (rgnp->rgn_saddr == r_saddr &&
14029 rgnp->rgn_size == r_size &&
14030 rgnp->rgn_obj == r_obj &&
14031 rgnp->rgn_objoff == r_objoff &&
14032 rgnp->rgn_perm == r_perm &&
14033 rgnp->rgn_pgszc == r_pgszc) {
14034 break;
14035 }
14036 }
14037 if (rgnp != NULL) {
14038 goto rfound;
14039 }
14040
14041 if (*nextidp >= maxids) {
14042 mutex_exit(&srdp->srd_mutex);
14043 goto fail;
14044 }
14045 rgnp = new_rgnp;
14046 new_rgnp = NULL;
14047 rgnp->rgn_id = (*nextidp)++;
14048 ASSERT(rgnp->rgn_id < maxids);
14049 ASSERT(rarrp[rgnp->rgn_id] == NULL);
14050 rarrp[rgnp->rgn_id] = rgnp;
14051 }
14052
14053 ASSERT(rgnp->rgn_sfmmu_head == NULL);
14054 ASSERT(rgnp->rgn_hmeflags == 0);
14055 #ifdef DEBUG
14056 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14057 ASSERT(rgnp->rgn_ttecnt[i] == 0);
14058 }
14059 #endif
14060 rgnp->rgn_saddr = r_saddr;
14061 rgnp->rgn_size = r_size;
14062 rgnp->rgn_obj = r_obj;
14063 rgnp->rgn_objoff = r_objoff;
14064 rgnp->rgn_perm = r_perm;
14065 rgnp->rgn_pgszc = r_pgszc;
14066 rgnp->rgn_flags = r_type;
14067 rgnp->rgn_refcnt = 0;
14068 rgnp->rgn_cb_function = r_cb_function;
14069 rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14070 srdp->srd_rgnhash[rhash] = rgnp;
14071 (*busyrgnsp)++;
14072 ASSERT(*busyrgnsp <= maxids);
14073 goto rfound;
14074
14075 fail:
14076 ASSERT(new_rgnp != NULL);
14077 kmem_cache_free(region_cache, new_rgnp);
14078 return (HAT_INVALID_REGION_COOKIE);
14079 }
14080
14081 /*
14082 * This function implements the shared context functionality required
14083 * when detaching a segment from an address space. It must be called
14084 * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14085 * for segments with a valid region_cookie.
14086 * It will also be called from all seg_vn routines which change a
14087 * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14088 * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14089 * from segvn_fault().
14090 */
14091 void
14092 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14093 {
14094 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14095 sf_scd_t *scdp;
14096 uint_t rhash;
14097 uint_t rid = (uint_t)((uint64_t)rcookie);
14098 hatlock_t *hatlockp = NULL;
14099 sf_region_t *rgnp;
14100 sf_region_t **prev_rgnpp;
14101 sf_region_t *cur_rgnp;
14102 void *r_obj;
14103 int i;
14104 caddr_t r_saddr;
14105 caddr_t r_eaddr;
14106 size_t r_size;
14107 uchar_t r_pgszc;
14108 uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14109
14110 ASSERT(sfmmup != ksfmmup);
14111 ASSERT(srdp != NULL);
14112 ASSERT(srdp->srd_refcnt > 0);
14113 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14114 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14115 ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14116
14117 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14118 SFMMU_REGION_HME;
14119
14120 if (r_type == SFMMU_REGION_ISM) {
14121 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14122 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14123 rgnp = srdp->srd_ismrgnp[rid];
14124 } else {
14125 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14126 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14127 rgnp = srdp->srd_hmergnp[rid];
14128 }
14129 ASSERT(rgnp != NULL);
14130 ASSERT(rgnp->rgn_id == rid);
14131 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14132 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14133 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14134
14135 if (sfmmup->sfmmu_free) {
14136 ulong_t rttecnt;
14137 r_pgszc = rgnp->rgn_pgszc;
14138 r_size = rgnp->rgn_size;
14139
14140 ASSERT(sfmmup->sfmmu_scdp == NULL);
14141 if (r_type == SFMMU_REGION_ISM) {
14142 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14143 } else {
14144 /* update shme rgns ttecnt in sfmmu_ttecnt */
14145 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14146 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14147
14148 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14149 -rttecnt);
14150
14151 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14152 }
14153 } else if (r_type == SFMMU_REGION_ISM) {
14154 hatlockp = sfmmu_hat_enter(sfmmup);
14155 ASSERT(rid < srdp->srd_next_ismrid);
14156 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14157 scdp = sfmmup->sfmmu_scdp;
14158 if (scdp != NULL &&
14159 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14160 sfmmu_leave_scd(sfmmup, r_type);
14161 ASSERT(sfmmu_hat_lock_held(sfmmup));
14162 }
14163 sfmmu_hat_exit(hatlockp);
14164 } else {
14165 ulong_t rttecnt;
14166 r_pgszc = rgnp->rgn_pgszc;
14167 r_saddr = rgnp->rgn_saddr;
14168 r_size = rgnp->rgn_size;
14169 r_eaddr = r_saddr + r_size;
14170
14171 ASSERT(r_type == SFMMU_REGION_HME);
14172 hatlockp = sfmmu_hat_enter(sfmmup);
14173 ASSERT(rid < srdp->srd_next_hmerid);
14174 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14175
14176 /*
14177 * If region is part of an SCD call sfmmu_leave_scd().
14178 * Otherwise if process is not exiting and has valid context
14179 * just drop the context on the floor to lose stale TLB
14180 * entries and force the update of tsb miss area to reflect
14181 * the new region map. After that clean our TSB entries.
14182 */
14183 scdp = sfmmup->sfmmu_scdp;
14184 if (scdp != NULL &&
14185 SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14186 sfmmu_leave_scd(sfmmup, r_type);
14187 ASSERT(sfmmu_hat_lock_held(sfmmup));
14188 }
14189 sfmmu_invalidate_ctx(sfmmup);
14190
14191 i = TTE8K;
14192 while (i < mmu_page_sizes) {
14193 if (rgnp->rgn_ttecnt[i] != 0) {
14194 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14195 r_eaddr, i);
14196 if (i < TTE4M) {
14197 i = TTE4M;
14198 continue;
14199 } else {
14200 break;
14201 }
14202 }
14203 i++;
14204 }
14205 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14206 if (r_pgszc >= TTE4M) {
14207 rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14208 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14209 rttecnt);
14210 sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14211 }
14212
14213 /* update shme rgns ttecnt in sfmmu_ttecnt */
14214 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14215 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14216 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14217
14218 sfmmu_hat_exit(hatlockp);
14219 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14220 /* sfmmup left the scd, grow private tsb */
14221 sfmmu_check_page_sizes(sfmmup, 1);
14222 } else {
14223 sfmmu_check_page_sizes(sfmmup, 0);
14224 }
14225 }
14226
14227 if (r_type == SFMMU_REGION_HME) {
14228 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14229 }
14230
14231 r_obj = rgnp->rgn_obj;
14232 if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14233 return;
14234 }
14235
14236 /*
14237 * looks like nobody uses this region anymore. Free it.
14238 */
14239 rhash = RGN_HASH_FUNCTION(r_obj);
14240 mutex_enter(&srdp->srd_mutex);
14241 for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14242 (cur_rgnp = *prev_rgnpp) != NULL;
14243 prev_rgnpp = &cur_rgnp->rgn_hash) {
14244 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14245 break;
14246 }
14247 }
14248
14249 if (cur_rgnp == NULL) {
14250 mutex_exit(&srdp->srd_mutex);
14251 return;
14252 }
14253
14254 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14255 *prev_rgnpp = rgnp->rgn_hash;
14256 if (r_type == SFMMU_REGION_ISM) {
14257 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14258 ASSERT(rid < srdp->srd_next_ismrid);
14259 rgnp->rgn_next = srdp->srd_ismrgnfree;
14260 srdp->srd_ismrgnfree = rgnp;
14261 ASSERT(srdp->srd_ismbusyrgns > 0);
14262 srdp->srd_ismbusyrgns--;
14263 mutex_exit(&srdp->srd_mutex);
14264 return;
14265 }
14266 mutex_exit(&srdp->srd_mutex);
14267
14268 /*
14269 * Destroy region's hmeblks.
14270 */
14271 sfmmu_unload_hmeregion(srdp, rgnp);
14272
14273 rgnp->rgn_hmeflags = 0;
14274
14275 ASSERT(rgnp->rgn_sfmmu_head == NULL);
14276 ASSERT(rgnp->rgn_id == rid);
14277 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14278 rgnp->rgn_ttecnt[i] = 0;
14279 }
14280 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14281 mutex_enter(&srdp->srd_mutex);
14282 ASSERT(rid < srdp->srd_next_hmerid);
14283 rgnp->rgn_next = srdp->srd_hmergnfree;
14284 srdp->srd_hmergnfree = rgnp;
14285 ASSERT(srdp->srd_hmebusyrgns > 0);
14286 srdp->srd_hmebusyrgns--;
14287 mutex_exit(&srdp->srd_mutex);
14288 }
14289
14290 /*
14291 * For now only called for hmeblk regions and not for ISM regions.
14292 */
14293 void
14294 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14295 {
14296 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14297 uint_t rid = (uint_t)((uint64_t)rcookie);
14298 sf_region_t *rgnp;
14299 sf_rgn_link_t *rlink;
14300 sf_rgn_link_t *hrlink;
14301 ulong_t rttecnt;
14302
14303 ASSERT(sfmmup != ksfmmup);
14304 ASSERT(srdp != NULL);
14305 ASSERT(srdp->srd_refcnt > 0);
14306
14307 ASSERT(rid < srdp->srd_next_hmerid);
14308 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14309 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14310
14311 rgnp = srdp->srd_hmergnp[rid];
14312 ASSERT(rgnp->rgn_refcnt > 0);
14313 ASSERT(rgnp->rgn_id == rid);
14314 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14315 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14316
14317 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14318
14319 /* LINTED: constant in conditional context */
14320 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14321 ASSERT(rlink != NULL);
14322 mutex_enter(&rgnp->rgn_mutex);
14323 ASSERT(rgnp->rgn_sfmmu_head != NULL);
14324 /* LINTED: constant in conditional context */
14325 SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14326 ASSERT(hrlink != NULL);
14327 ASSERT(hrlink->prev == NULL);
14328 rlink->next = rgnp->rgn_sfmmu_head;
14329 rlink->prev = NULL;
14330 hrlink->prev = sfmmup;
14331 /*
14332 * make sure rlink's next field is correct
14333 * before making this link visible.
14334 */
14335 membar_stst();
14336 rgnp->rgn_sfmmu_head = sfmmup;
14337 mutex_exit(&rgnp->rgn_mutex);
14338
14339 /* update sfmmu_ttecnt with the shme rgn ttecnt */
14340 rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14341 atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14342 /* update tsb0 inflation count */
14343 if (rgnp->rgn_pgszc >= TTE4M) {
14344 sfmmup->sfmmu_tsb0_4minflcnt +=
14345 rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14346 }
14347 /*
14348 * Update regionid bitmask without hat lock since no other thread
14349 * can update this region bitmask right now.
14350 */
14351 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14352 }
14353
14354 /* ARGSUSED */
14355 static int
14356 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14357 {
14358 sf_region_t *rgnp = (sf_region_t *)buf;
14359 bzero(buf, sizeof (*rgnp));
14360
14361 mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14362
14363 return (0);
14364 }
14365
14366 /* ARGSUSED */
14367 static void
14368 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14369 {
14370 sf_region_t *rgnp = (sf_region_t *)buf;
14371 mutex_destroy(&rgnp->rgn_mutex);
14372 }
14373
14374 static int
14375 sfrgnmap_isnull(sf_region_map_t *map)
14376 {
14377 int i;
14378
14379 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14380 if (map->bitmap[i] != 0) {
14381 return (0);
14382 }
14383 }
14384 return (1);
14385 }
14386
14387 static int
14388 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14389 {
14390 int i;
14391
14392 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14393 if (map->bitmap[i] != 0) {
14394 return (0);
14395 }
14396 }
14397 return (1);
14398 }
14399
14400 #ifdef DEBUG
14401 static void
14402 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14403 {
14404 sfmmu_t *sp;
14405 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14406
14407 for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14408 ASSERT(srdp == sp->sfmmu_srdp);
14409 if (sp == sfmmup) {
14410 if (onlist) {
14411 return;
14412 } else {
14413 panic("shctx: sfmmu 0x%p found on scd"
14414 "list 0x%p", (void *)sfmmup,
14415 (void *)*headp);
14416 }
14417 }
14418 }
14419 if (onlist) {
14420 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14421 (void *)sfmmup, (void *)*headp);
14422 } else {
14423 return;
14424 }
14425 }
14426 #else /* DEBUG */
14427 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14428 #endif /* DEBUG */
14429
14430 /*
14431 * Removes an sfmmu from the SCD sfmmu list.
14432 */
14433 static void
14434 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14435 {
14436 ASSERT(sfmmup->sfmmu_srdp != NULL);
14437 check_scd_sfmmu_list(headp, sfmmup, 1);
14438 if (sfmmup->sfmmu_scd_link.prev != NULL) {
14439 ASSERT(*headp != sfmmup);
14440 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14441 sfmmup->sfmmu_scd_link.next;
14442 } else {
14443 ASSERT(*headp == sfmmup);
14444 *headp = sfmmup->sfmmu_scd_link.next;
14445 }
14446 if (sfmmup->sfmmu_scd_link.next != NULL) {
14447 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14448 sfmmup->sfmmu_scd_link.prev;
14449 }
14450 }
14451
14452
14453 /*
14454 * Adds an sfmmu to the start of the queue.
14455 */
14456 static void
14457 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14458 {
14459 check_scd_sfmmu_list(headp, sfmmup, 0);
14460 sfmmup->sfmmu_scd_link.prev = NULL;
14461 sfmmup->sfmmu_scd_link.next = *headp;
14462 if (*headp != NULL)
14463 (*headp)->sfmmu_scd_link.prev = sfmmup;
14464 *headp = sfmmup;
14465 }
14466
14467 /*
14468 * Remove an scd from the start of the queue.
14469 */
14470 static void
14471 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14472 {
14473 if (scdp->scd_prev != NULL) {
14474 ASSERT(*headp != scdp);
14475 scdp->scd_prev->scd_next = scdp->scd_next;
14476 } else {
14477 ASSERT(*headp == scdp);
14478 *headp = scdp->scd_next;
14479 }
14480
14481 if (scdp->scd_next != NULL) {
14482 scdp->scd_next->scd_prev = scdp->scd_prev;
14483 }
14484 }
14485
14486 /*
14487 * Add an scd to the start of the queue.
14488 */
14489 static void
14490 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14491 {
14492 scdp->scd_prev = NULL;
14493 scdp->scd_next = *headp;
14494 if (*headp != NULL) {
14495 (*headp)->scd_prev = scdp;
14496 }
14497 *headp = scdp;
14498 }
14499
14500 static int
14501 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14502 {
14503 uint_t rid;
14504 uint_t i;
14505 uint_t j;
14506 ulong_t w;
14507 sf_region_t *rgnp;
14508 ulong_t tte8k_cnt = 0;
14509 ulong_t tte4m_cnt = 0;
14510 uint_t tsb_szc;
14511 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14512 sfmmu_t *ism_hatid;
14513 struct tsb_info *newtsb;
14514 int szc;
14515
14516 ASSERT(srdp != NULL);
14517
14518 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14519 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14520 continue;
14521 }
14522 j = 0;
14523 while (w) {
14524 if (!(w & 0x1)) {
14525 j++;
14526 w >>= 1;
14527 continue;
14528 }
14529 rid = (i << BT_ULSHIFT) | j;
14530 j++;
14531 w >>= 1;
14532
14533 if (rid < SFMMU_MAX_HME_REGIONS) {
14534 rgnp = srdp->srd_hmergnp[rid];
14535 ASSERT(rgnp->rgn_id == rid);
14536 ASSERT(rgnp->rgn_refcnt > 0);
14537
14538 if (rgnp->rgn_pgszc < TTE4M) {
14539 tte8k_cnt += rgnp->rgn_size >>
14540 TTE_PAGE_SHIFT(TTE8K);
14541 } else {
14542 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14543 tte4m_cnt += rgnp->rgn_size >>
14544 TTE_PAGE_SHIFT(TTE4M);
14545 /*
14546 * Inflate SCD tsb0 by preallocating
14547 * 1/4 8k ttecnt for 4M regions to
14548 * allow for lgpg alloc failure.
14549 */
14550 tte8k_cnt += rgnp->rgn_size >>
14551 (TTE_PAGE_SHIFT(TTE8K) + 2);
14552 }
14553 } else {
14554 rid -= SFMMU_MAX_HME_REGIONS;
14555 rgnp = srdp->srd_ismrgnp[rid];
14556 ASSERT(rgnp->rgn_id == rid);
14557 ASSERT(rgnp->rgn_refcnt > 0);
14558
14559 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14560 ASSERT(ism_hatid->sfmmu_ismhat);
14561
14562 for (szc = 0; szc < TTE4M; szc++) {
14563 tte8k_cnt +=
14564 ism_hatid->sfmmu_ttecnt[szc] <<
14565 TTE_BSZS_SHIFT(szc);
14566 }
14567
14568 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14569 if (rgnp->rgn_pgszc >= TTE4M) {
14570 tte4m_cnt += rgnp->rgn_size >>
14571 TTE_PAGE_SHIFT(TTE4M);
14572 }
14573 }
14574 }
14575 }
14576
14577 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14578
14579 /* Allocate both the SCD TSBs here. */
14580 if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14581 tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14582 (tsb_szc <= TSB_4M_SZCODE ||
14583 sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14584 TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14585 TSB_ALLOC, scsfmmup))) {
14586
14587 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14588 return (TSB_ALLOCFAIL);
14589 } else {
14590 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14591
14592 if (tte4m_cnt) {
14593 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14594 if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14595 TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14596 (tsb_szc <= TSB_4M_SZCODE ||
14597 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14598 TSB4M|TSB32M|TSB256M,
14599 TSB_ALLOC, scsfmmup))) {
14600 /*
14601 * If we fail to allocate the 2nd shared tsb,
14602 * just free the 1st tsb, return failure.
14603 */
14604 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14605 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14606 return (TSB_ALLOCFAIL);
14607 } else {
14608 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14609 newtsb->tsb_flags |= TSB_SHAREDCTX;
14610 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14611 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14612 }
14613 }
14614 SFMMU_STAT(sf_scd_1sttsb_alloc);
14615 }
14616 return (TSB_SUCCESS);
14617 }
14618
14619 static void
14620 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14621 {
14622 while (scd_sfmmu->sfmmu_tsb != NULL) {
14623 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14624 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14625 scd_sfmmu->sfmmu_tsb = next;
14626 }
14627 }
14628
14629 /*
14630 * Link the sfmmu onto the hme region list.
14631 */
14632 void
14633 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14634 {
14635 uint_t rid;
14636 sf_rgn_link_t *rlink;
14637 sfmmu_t *head;
14638 sf_rgn_link_t *hrlink;
14639
14640 rid = rgnp->rgn_id;
14641 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14642
14643 /* LINTED: constant in conditional context */
14644 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14645 ASSERT(rlink != NULL);
14646 mutex_enter(&rgnp->rgn_mutex);
14647 if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14648 rlink->next = NULL;
14649 rlink->prev = NULL;
14650 /*
14651 * make sure rlink's next field is NULL
14652 * before making this link visible.
14653 */
14654 membar_stst();
14655 rgnp->rgn_sfmmu_head = sfmmup;
14656 } else {
14657 /* LINTED: constant in conditional context */
14658 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14659 ASSERT(hrlink != NULL);
14660 ASSERT(hrlink->prev == NULL);
14661 rlink->next = head;
14662 rlink->prev = NULL;
14663 hrlink->prev = sfmmup;
14664 /*
14665 * make sure rlink's next field is correct
14666 * before making this link visible.
14667 */
14668 membar_stst();
14669 rgnp->rgn_sfmmu_head = sfmmup;
14670 }
14671 mutex_exit(&rgnp->rgn_mutex);
14672 }
14673
14674 /*
14675 * Unlink the sfmmu from the hme region list.
14676 */
14677 void
14678 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14679 {
14680 uint_t rid;
14681 sf_rgn_link_t *rlink;
14682
14683 rid = rgnp->rgn_id;
14684 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14685
14686 /* LINTED: constant in conditional context */
14687 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14688 ASSERT(rlink != NULL);
14689 mutex_enter(&rgnp->rgn_mutex);
14690 if (rgnp->rgn_sfmmu_head == sfmmup) {
14691 sfmmu_t *next = rlink->next;
14692 rgnp->rgn_sfmmu_head = next;
14693 /*
14694 * if we are stopped by xc_attention() after this
14695 * point the forward link walking in
14696 * sfmmu_rgntlb_demap() will work correctly since the
14697 * head correctly points to the next element.
14698 */
14699 membar_stst();
14700 rlink->next = NULL;
14701 ASSERT(rlink->prev == NULL);
14702 if (next != NULL) {
14703 sf_rgn_link_t *nrlink;
14704 /* LINTED: constant in conditional context */
14705 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14706 ASSERT(nrlink != NULL);
14707 ASSERT(nrlink->prev == sfmmup);
14708 nrlink->prev = NULL;
14709 }
14710 } else {
14711 sfmmu_t *next = rlink->next;
14712 sfmmu_t *prev = rlink->prev;
14713 sf_rgn_link_t *prlink;
14714
14715 ASSERT(prev != NULL);
14716 /* LINTED: constant in conditional context */
14717 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14718 ASSERT(prlink != NULL);
14719 ASSERT(prlink->next == sfmmup);
14720 prlink->next = next;
14721 /*
14722 * if we are stopped by xc_attention()
14723 * after this point the forward link walking
14724 * will work correctly since the prev element
14725 * correctly points to the next element.
14726 */
14727 membar_stst();
14728 rlink->next = NULL;
14729 rlink->prev = NULL;
14730 if (next != NULL) {
14731 sf_rgn_link_t *nrlink;
14732 /* LINTED: constant in conditional context */
14733 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14734 ASSERT(nrlink != NULL);
14735 ASSERT(nrlink->prev == sfmmup);
14736 nrlink->prev = prev;
14737 }
14738 }
14739 mutex_exit(&rgnp->rgn_mutex);
14740 }
14741
14742 /*
14743 * Link scd sfmmu onto ism or hme region list for each region in the
14744 * scd region map.
14745 */
14746 void
14747 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14748 {
14749 uint_t rid;
14750 uint_t i;
14751 uint_t j;
14752 ulong_t w;
14753 sf_region_t *rgnp;
14754 sfmmu_t *scsfmmup;
14755
14756 scsfmmup = scdp->scd_sfmmup;
14757 ASSERT(scsfmmup->sfmmu_scdhat);
14758 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14759 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14760 continue;
14761 }
14762 j = 0;
14763 while (w) {
14764 if (!(w & 0x1)) {
14765 j++;
14766 w >>= 1;
14767 continue;
14768 }
14769 rid = (i << BT_ULSHIFT) | j;
14770 j++;
14771 w >>= 1;
14772
14773 if (rid < SFMMU_MAX_HME_REGIONS) {
14774 rgnp = srdp->srd_hmergnp[rid];
14775 ASSERT(rgnp->rgn_id == rid);
14776 ASSERT(rgnp->rgn_refcnt > 0);
14777 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14778 } else {
14779 sfmmu_t *ism_hatid = NULL;
14780 ism_ment_t *ism_ment;
14781 rid -= SFMMU_MAX_HME_REGIONS;
14782 rgnp = srdp->srd_ismrgnp[rid];
14783 ASSERT(rgnp->rgn_id == rid);
14784 ASSERT(rgnp->rgn_refcnt > 0);
14785
14786 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14787 ASSERT(ism_hatid->sfmmu_ismhat);
14788 ism_ment = &scdp->scd_ism_links[rid];
14789 ism_ment->iment_hat = scsfmmup;
14790 ism_ment->iment_base_va = rgnp->rgn_saddr;
14791 mutex_enter(&ism_mlist_lock);
14792 iment_add(ism_ment, ism_hatid);
14793 mutex_exit(&ism_mlist_lock);
14794
14795 }
14796 }
14797 }
14798 }
14799 /*
14800 * Unlink scd sfmmu from ism or hme region list for each region in the
14801 * scd region map.
14802 */
14803 void
14804 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14805 {
14806 uint_t rid;
14807 uint_t i;
14808 uint_t j;
14809 ulong_t w;
14810 sf_region_t *rgnp;
14811 sfmmu_t *scsfmmup;
14812
14813 scsfmmup = scdp->scd_sfmmup;
14814 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14815 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14816 continue;
14817 }
14818 j = 0;
14819 while (w) {
14820 if (!(w & 0x1)) {
14821 j++;
14822 w >>= 1;
14823 continue;
14824 }
14825 rid = (i << BT_ULSHIFT) | j;
14826 j++;
14827 w >>= 1;
14828
14829 if (rid < SFMMU_MAX_HME_REGIONS) {
14830 rgnp = srdp->srd_hmergnp[rid];
14831 ASSERT(rgnp->rgn_id == rid);
14832 ASSERT(rgnp->rgn_refcnt > 0);
14833 sfmmu_unlink_from_hmeregion(scsfmmup,
14834 rgnp);
14835
14836 } else {
14837 sfmmu_t *ism_hatid = NULL;
14838 ism_ment_t *ism_ment;
14839 rid -= SFMMU_MAX_HME_REGIONS;
14840 rgnp = srdp->srd_ismrgnp[rid];
14841 ASSERT(rgnp->rgn_id == rid);
14842 ASSERT(rgnp->rgn_refcnt > 0);
14843
14844 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14845 ASSERT(ism_hatid->sfmmu_ismhat);
14846 ism_ment = &scdp->scd_ism_links[rid];
14847 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
14848 ASSERT(ism_ment->iment_base_va ==
14849 rgnp->rgn_saddr);
14850 mutex_enter(&ism_mlist_lock);
14851 iment_sub(ism_ment, ism_hatid);
14852 mutex_exit(&ism_mlist_lock);
14853
14854 }
14855 }
14856 }
14857 }
14858 /*
14859 * Allocates and initialises a new SCD structure, this is called with
14860 * the srd_scd_mutex held and returns with the reference count
14861 * initialised to 1.
14862 */
14863 static sf_scd_t *
14864 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
14865 {
14866 sf_scd_t *new_scdp;
14867 sfmmu_t *scsfmmup;
14868 int i;
14869
14870 ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
14871 new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
14872
14873 scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
14874 new_scdp->scd_sfmmup = scsfmmup;
14875 scsfmmup->sfmmu_srdp = srdp;
14876 scsfmmup->sfmmu_scdp = new_scdp;
14877 scsfmmup->sfmmu_tsb0_4minflcnt = 0;
14878 scsfmmup->sfmmu_scdhat = 1;
14879 CPUSET_ALL(scsfmmup->sfmmu_cpusran);
14880 bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
14881
14882 ASSERT(max_mmu_ctxdoms > 0);
14883 for (i = 0; i < max_mmu_ctxdoms; i++) {
14884 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
14885 scsfmmup->sfmmu_ctxs[i].gnum = 0;
14886 }
14887
14888 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14889 new_scdp->scd_rttecnt[i] = 0;
14890 }
14891
14892 new_scdp->scd_region_map = *new_map;
14893 new_scdp->scd_refcnt = 1;
14894 if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
14895 kmem_cache_free(scd_cache, new_scdp);
14896 kmem_cache_free(sfmmuid_cache, scsfmmup);
14897 return (NULL);
14898 }
14899 if (&mmu_init_scd) {
14900 mmu_init_scd(new_scdp);
14901 }
14902 return (new_scdp);
14903 }
14904
14905 /*
14906 * The first phase of a process joining an SCD. The hat structure is
14907 * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
14908 * and a cross-call with context invalidation is used to cause the
14909 * remaining work to be carried out in the sfmmu_tsbmiss_exception()
14910 * routine.
14911 */
14912 static void
14913 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
14914 {
14915 hatlock_t *hatlockp;
14916 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14917 int i;
14918 sf_scd_t *old_scdp;
14919
14920 ASSERT(srdp != NULL);
14921 ASSERT(scdp != NULL);
14922 ASSERT(scdp->scd_refcnt > 0);
14923 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14924
14925 if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
14926 ASSERT(old_scdp != scdp);
14927
14928 mutex_enter(&old_scdp->scd_mutex);
14929 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
14930 mutex_exit(&old_scdp->scd_mutex);
14931 /*
14932 * sfmmup leaves the old scd. Update sfmmu_ttecnt to
14933 * include the shme rgn ttecnt for rgns that
14934 * were in the old SCD
14935 */
14936 for (i = 0; i < mmu_page_sizes; i++) {
14937 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14938 old_scdp->scd_rttecnt[i]);
14939 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14940 sfmmup->sfmmu_scdrttecnt[i]);
14941 }
14942 }
14943
14944 /*
14945 * Move sfmmu to the scd lists.
14946 */
14947 mutex_enter(&scdp->scd_mutex);
14948 sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
14949 mutex_exit(&scdp->scd_mutex);
14950 SF_SCD_INCR_REF(scdp);
14951
14952 hatlockp = sfmmu_hat_enter(sfmmup);
14953 /*
14954 * For a multi-thread process, we must stop
14955 * all the other threads before joining the scd.
14956 */
14957
14958 SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
14959
14960 sfmmu_invalidate_ctx(sfmmup);
14961 sfmmup->sfmmu_scdp = scdp;
14962
14963 /*
14964 * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
14965 * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
14966 */
14967 for (i = 0; i < mmu_page_sizes; i++) {
14968 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
14969 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
14970 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14971 -sfmmup->sfmmu_scdrttecnt[i]);
14972 }
14973 /* update tsb0 inflation count */
14974 if (old_scdp != NULL) {
14975 sfmmup->sfmmu_tsb0_4minflcnt +=
14976 old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14977 }
14978 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14979 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
14980 sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14981
14982 sfmmu_hat_exit(hatlockp);
14983
14984 if (old_scdp != NULL) {
14985 SF_SCD_DECR_REF(srdp, old_scdp);
14986 }
14987
14988 }
14989
14990 /*
14991 * This routine is called by a process to become part of an SCD. It is called
14992 * from sfmmu_tsbmiss_exception() once most of the initial work has been
14993 * done by sfmmu_join_scd(). This routine must not drop the hat lock.
14994 */
14995 static void
14996 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
14997 {
14998 struct tsb_info *tsbinfop;
14999
15000 ASSERT(sfmmu_hat_lock_held(sfmmup));
15001 ASSERT(sfmmup->sfmmu_scdp != NULL);
15002 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
15003 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15004 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15005
15006 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15007 tsbinfop = tsbinfop->tsb_next) {
15008 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15009 continue;
15010 }
15011 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15012
15013 sfmmu_inv_tsb(tsbinfop->tsb_va,
15014 TSB_BYTES(tsbinfop->tsb_szc));
15015 }
15016
15017 /* Set HAT_CTX1_FLAG for all SCD ISMs */
15018 sfmmu_ism_hatflags(sfmmup, 1);
15019
15020 SFMMU_STAT(sf_join_scd);
15021 }
15022
15023 /*
15024 * This routine is called in order to check if there is an SCD which matches
15025 * the process's region map if not then a new SCD may be created.
15026 */
15027 static void
15028 sfmmu_find_scd(sfmmu_t *sfmmup)
15029 {
15030 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15031 sf_scd_t *scdp, *new_scdp;
15032 int ret;
15033
15034 ASSERT(srdp != NULL);
15035 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15036
15037 mutex_enter(&srdp->srd_scd_mutex);
15038 for (scdp = srdp->srd_scdp; scdp != NULL;
15039 scdp = scdp->scd_next) {
15040 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15041 &sfmmup->sfmmu_region_map, ret);
15042 if (ret == 1) {
15043 SF_SCD_INCR_REF(scdp);
15044 mutex_exit(&srdp->srd_scd_mutex);
15045 sfmmu_join_scd(scdp, sfmmup);
15046 ASSERT(scdp->scd_refcnt >= 2);
15047 atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
15048 return;
15049 } else {
15050 /*
15051 * If the sfmmu region map is a subset of the scd
15052 * region map, then the assumption is that this process
15053 * will continue attaching to ISM segments until the
15054 * region maps are equal.
15055 */
15056 SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15057 &sfmmup->sfmmu_region_map, ret);
15058 if (ret == 1) {
15059 mutex_exit(&srdp->srd_scd_mutex);
15060 return;
15061 }
15062 }
15063 }
15064
15065 ASSERT(scdp == NULL);
15066 /*
15067 * No matching SCD has been found, create a new one.
15068 */
15069 if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15070 NULL) {
15071 mutex_exit(&srdp->srd_scd_mutex);
15072 return;
15073 }
15074
15075 /*
15076 * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15077 */
15078
15079 /* Set scd_rttecnt for shme rgns in SCD */
15080 sfmmu_set_scd_rttecnt(srdp, new_scdp);
15081
15082 /*
15083 * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15084 */
15085 sfmmu_link_scd_to_regions(srdp, new_scdp);
15086 sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15087 SFMMU_STAT_ADD(sf_create_scd, 1);
15088
15089 mutex_exit(&srdp->srd_scd_mutex);
15090 sfmmu_join_scd(new_scdp, sfmmup);
15091 ASSERT(new_scdp->scd_refcnt >= 2);
15092 atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
15093 }
15094
15095 /*
15096 * This routine is called by a process to remove itself from an SCD. It is
15097 * either called when the processes has detached from a segment or from
15098 * hat_free_start() as a result of calling exit.
15099 */
15100 static void
15101 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15102 {
15103 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15104 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15105 hatlock_t *hatlockp = TSB_HASH(sfmmup);
15106 int i;
15107
15108 ASSERT(scdp != NULL);
15109 ASSERT(srdp != NULL);
15110
15111 if (sfmmup->sfmmu_free) {
15112 /*
15113 * If the process is part of an SCD the sfmmu is unlinked
15114 * from scd_sf_list.
15115 */
15116 mutex_enter(&scdp->scd_mutex);
15117 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15118 mutex_exit(&scdp->scd_mutex);
15119 /*
15120 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15121 * are about to leave the SCD
15122 */
15123 for (i = 0; i < mmu_page_sizes; i++) {
15124 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15125 scdp->scd_rttecnt[i]);
15126 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15127 sfmmup->sfmmu_scdrttecnt[i]);
15128 sfmmup->sfmmu_scdrttecnt[i] = 0;
15129 }
15130 sfmmup->sfmmu_scdp = NULL;
15131
15132 SF_SCD_DECR_REF(srdp, scdp);
15133 return;
15134 }
15135
15136 ASSERT(r_type != SFMMU_REGION_ISM ||
15137 SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15138 ASSERT(scdp->scd_refcnt);
15139 ASSERT(!sfmmup->sfmmu_free);
15140 ASSERT(sfmmu_hat_lock_held(sfmmup));
15141 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15142
15143 /*
15144 * Wait for ISM maps to be updated.
15145 */
15146 if (r_type != SFMMU_REGION_ISM) {
15147 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15148 sfmmup->sfmmu_scdp != NULL) {
15149 cv_wait(&sfmmup->sfmmu_tsb_cv,
15150 HATLOCK_MUTEXP(hatlockp));
15151 }
15152
15153 if (sfmmup->sfmmu_scdp == NULL) {
15154 sfmmu_hat_exit(hatlockp);
15155 return;
15156 }
15157 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15158 }
15159
15160 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15161 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15162 /*
15163 * Since HAT_JOIN_SCD was set our context
15164 * is still invalid.
15165 */
15166 } else {
15167 /*
15168 * For a multi-thread process, we must stop
15169 * all the other threads before leaving the scd.
15170 */
15171
15172 sfmmu_invalidate_ctx(sfmmup);
15173 }
15174
15175 /* Clear all the rid's for ISM, delete flags, etc */
15176 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15177 sfmmu_ism_hatflags(sfmmup, 0);
15178
15179 /*
15180 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15181 * are in SCD before this sfmmup leaves the SCD.
15182 */
15183 for (i = 0; i < mmu_page_sizes; i++) {
15184 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15185 scdp->scd_rttecnt[i]);
15186 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15187 sfmmup->sfmmu_scdrttecnt[i]);
15188 sfmmup->sfmmu_scdrttecnt[i] = 0;
15189 /* update ismttecnt to include SCD ism before hat leaves SCD */
15190 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15191 sfmmup->sfmmu_scdismttecnt[i] = 0;
15192 }
15193 /* update tsb0 inflation count */
15194 sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15195
15196 if (r_type != SFMMU_REGION_ISM) {
15197 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15198 }
15199 sfmmup->sfmmu_scdp = NULL;
15200
15201 sfmmu_hat_exit(hatlockp);
15202
15203 /*
15204 * Unlink sfmmu from scd_sf_list this can be done without holding
15205 * the hat lock as we hold the sfmmu_as lock which prevents
15206 * hat_join_region from adding this thread to the scd again. Other
15207 * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15208 * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15209 * while holding the hat lock.
15210 */
15211 mutex_enter(&scdp->scd_mutex);
15212 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15213 mutex_exit(&scdp->scd_mutex);
15214 SFMMU_STAT(sf_leave_scd);
15215
15216 SF_SCD_DECR_REF(srdp, scdp);
15217 hatlockp = sfmmu_hat_enter(sfmmup);
15218
15219 }
15220
15221 /*
15222 * Unlink and free up an SCD structure with a reference count of 0.
15223 */
15224 static void
15225 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15226 {
15227 sfmmu_t *scsfmmup;
15228 sf_scd_t *sp;
15229 hatlock_t *shatlockp;
15230 int i, ret;
15231
15232 mutex_enter(&srdp->srd_scd_mutex);
15233 for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15234 if (sp == scdp)
15235 break;
15236 }
15237 if (sp == NULL || sp->scd_refcnt) {
15238 mutex_exit(&srdp->srd_scd_mutex);
15239 return;
15240 }
15241
15242 /*
15243 * It is possible that the scd has been freed and reallocated with a
15244 * different region map while we've been waiting for the srd_scd_mutex.
15245 */
15246 SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15247 if (ret != 1) {
15248 mutex_exit(&srdp->srd_scd_mutex);
15249 return;
15250 }
15251
15252 ASSERT(scdp->scd_sf_list == NULL);
15253 /*
15254 * Unlink scd from srd_scdp list.
15255 */
15256 sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15257 mutex_exit(&srdp->srd_scd_mutex);
15258
15259 sfmmu_unlink_scd_from_regions(srdp, scdp);
15260
15261 /* Clear shared context tsb and release ctx */
15262 scsfmmup = scdp->scd_sfmmup;
15263
15264 /*
15265 * create a barrier so that scd will not be destroyed
15266 * if other thread still holds the same shared hat lock.
15267 * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15268 * shared hat lock before checking the shared tsb reloc flag.
15269 */
15270 shatlockp = sfmmu_hat_enter(scsfmmup);
15271 sfmmu_hat_exit(shatlockp);
15272
15273 sfmmu_free_scd_tsbs(scsfmmup);
15274
15275 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15276 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15277 kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15278 SFMMU_L2_HMERLINKS_SIZE);
15279 scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15280 }
15281 }
15282 kmem_cache_free(sfmmuid_cache, scsfmmup);
15283 kmem_cache_free(scd_cache, scdp);
15284 SFMMU_STAT(sf_destroy_scd);
15285 }
15286
15287 /*
15288 * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15289 * bits which are set in the ism_region_map parameter. This flag indicates to
15290 * the tsbmiss handler that mapping for these segments should be loaded using
15291 * the shared context.
15292 */
15293 static void
15294 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15295 {
15296 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15297 ism_blk_t *ism_blkp;
15298 ism_map_t *ism_map;
15299 int i, rid;
15300
15301 ASSERT(sfmmup->sfmmu_iblk != NULL);
15302 ASSERT(scdp != NULL);
15303 /*
15304 * Note that the caller either set HAT_ISMBUSY flag or checked
15305 * under hat lock that HAT_ISMBUSY was not set by another thread.
15306 */
15307 ASSERT(sfmmu_hat_lock_held(sfmmup));
15308
15309 ism_blkp = sfmmup->sfmmu_iblk;
15310 while (ism_blkp != NULL) {
15311 ism_map = ism_blkp->iblk_maps;
15312 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15313 rid = ism_map[i].imap_rid;
15314 if (rid == SFMMU_INVALID_ISMRID) {
15315 continue;
15316 }
15317 ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15318 if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15319 addflag) {
15320 ism_map[i].imap_hatflags |=
15321 HAT_CTX1_FLAG;
15322 } else {
15323 ism_map[i].imap_hatflags &=
15324 ~HAT_CTX1_FLAG;
15325 }
15326 }
15327 ism_blkp = ism_blkp->iblk_next;
15328 }
15329 }
15330
15331 static int
15332 sfmmu_srd_lock_held(sf_srd_t *srdp)
15333 {
15334 return (MUTEX_HELD(&srdp->srd_mutex));
15335 }
15336
15337 /* ARGSUSED */
15338 static int
15339 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15340 {
15341 sf_scd_t *scdp = (sf_scd_t *)buf;
15342
15343 bzero(buf, sizeof (sf_scd_t));
15344 mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15345 return (0);
15346 }
15347
15348 /* ARGSUSED */
15349 static void
15350 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15351 {
15352 sf_scd_t *scdp = (sf_scd_t *)buf;
15353
15354 mutex_destroy(&scdp->scd_mutex);
15355 }
15356
15357 /*
15358 * The listp parameter is a pointer to a list of hmeblks which are partially
15359 * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15360 * freeing process is to cross-call all cpus to ensure that there are no
15361 * remaining cached references.
15362 *
15363 * If the local generation number is less than the global then we can free
15364 * hmeblks which are already on the pending queue as another cpu has completed
15365 * the cross-call.
15366 *
15367 * We cross-call to make sure that there are no threads on other cpus accessing
15368 * these hmblks and then complete the process of freeing them under the
15369 * following conditions:
15370 * The total number of pending hmeblks is greater than the threshold
15371 * The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15372 * It is at least 1 second since the last time we cross-called
15373 *
15374 * Otherwise, we add the hmeblks to the per-cpu pending queue.
15375 */
15376 static void
15377 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15378 {
15379 struct hme_blk *hblkp, *pr_hblkp = NULL;
15380 int count = 0;
15381 cpuset_t cpuset = cpu_ready_set;
15382 cpu_hme_pend_t *cpuhp;
15383 timestruc_t now;
15384 int one_second_expired = 0;
15385
15386 gethrestime_lasttick(&now);
15387
15388 for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15389 ASSERT(hblkp->hblk_shw_bit == 0);
15390 ASSERT(hblkp->hblk_shared == 0);
15391 count++;
15392 pr_hblkp = hblkp;
15393 }
15394
15395 cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15396 mutex_enter(&cpuhp->chp_mutex);
15397
15398 if ((cpuhp->chp_count + count) == 0) {
15399 mutex_exit(&cpuhp->chp_mutex);
15400 return;
15401 }
15402
15403 if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15404 one_second_expired = 1;
15405 }
15406
15407 if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15408 (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15409 one_second_expired)) {
15410 /* Append global list to local */
15411 if (pr_hblkp == NULL) {
15412 *listp = cpuhp->chp_listp;
15413 } else {
15414 pr_hblkp->hblk_next = cpuhp->chp_listp;
15415 }
15416 cpuhp->chp_listp = NULL;
15417 cpuhp->chp_count = 0;
15418 cpuhp->chp_timestamp = now.tv_sec;
15419 mutex_exit(&cpuhp->chp_mutex);
15420
15421 kpreempt_disable();
15422 CPUSET_DEL(cpuset, CPU->cpu_id);
15423 xt_sync(cpuset);
15424 xt_sync(cpuset);
15425 kpreempt_enable();
15426
15427 /*
15428 * At this stage we know that no trap handlers on other
15429 * cpus can have references to hmeblks on the list.
15430 */
15431 sfmmu_hblk_free(listp);
15432 } else if (*listp != NULL) {
15433 pr_hblkp->hblk_next = cpuhp->chp_listp;
15434 cpuhp->chp_listp = *listp;
15435 cpuhp->chp_count += count;
15436 *listp = NULL;
15437 mutex_exit(&cpuhp->chp_mutex);
15438 } else {
15439 mutex_exit(&cpuhp->chp_mutex);
15440 }
15441 }
15442
15443 /*
15444 * Add an hmeblk to the the hash list.
15445 */
15446 void
15447 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15448 uint64_t hblkpa)
15449 {
15450 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15451 #ifdef DEBUG
15452 if (hmebp->hmeblkp == NULL) {
15453 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15454 }
15455 #endif /* DEBUG */
15456
15457 hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15458 /*
15459 * Since the TSB miss handler now does not lock the hash chain before
15460 * walking it, make sure that the hmeblks nextpa is globally visible
15461 * before we make the hmeblk globally visible by updating the chain root
15462 * pointer in the hash bucket.
15463 */
15464 membar_producer();
15465 hmebp->hmeh_nextpa = hblkpa;
15466 hmeblkp->hblk_next = hmebp->hmeblkp;
15467 hmebp->hmeblkp = hmeblkp;
15468
15469 }
15470
15471 /*
15472 * This function is the first part of a 2 part process to remove an hmeblk
15473 * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15474 * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15475 * a per-cpu pending list using the virtual address pointer.
15476 *
15477 * TSB miss trap handlers that start after this phase will no longer see
15478 * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15479 * can still use it for further chain traversal because we haven't yet modifed
15480 * the next physical pointer or freed it.
15481 *
15482 * In the second phase of hmeblk removal we'll issue a barrier xcall before
15483 * we reuse or free this hmeblk. This will make sure all lingering references to
15484 * the hmeblk after first phase disappear before we finally reclaim it.
15485 * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15486 * during their traversal.
15487 *
15488 * The hmehash_mutex must be held when calling this function.
15489 *
15490 * Input:
15491 * hmebp - hme hash bucket pointer
15492 * hmeblkp - address of hmeblk to be removed
15493 * pr_hblk - virtual address of previous hmeblkp
15494 * listp - pointer to list of hmeblks linked by virtual address
15495 * free_now flag - indicates that a complete removal from the hash chains
15496 * is necessary.
15497 *
15498 * It is inefficient to use the free_now flag as a cross-call is required to
15499 * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15500 * in short supply.
15501 */
15502 void
15503 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15504 struct hme_blk *pr_hblk, struct hme_blk **listp,
15505 int free_now)
15506 {
15507 int shw_size, vshift;
15508 struct hme_blk *shw_hblkp;
15509 uint_t shw_mask, newshw_mask;
15510 caddr_t vaddr;
15511 int size;
15512 cpuset_t cpuset = cpu_ready_set;
15513
15514 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15515
15516 if (hmebp->hmeblkp == hmeblkp) {
15517 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15518 hmebp->hmeblkp = hmeblkp->hblk_next;
15519 } else {
15520 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15521 pr_hblk->hblk_next = hmeblkp->hblk_next;
15522 }
15523
15524 size = get_hblk_ttesz(hmeblkp);
15525 shw_hblkp = hmeblkp->hblk_shadow;
15526 if (shw_hblkp) {
15527 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15528 ASSERT(!hmeblkp->hblk_shared);
15529 #ifdef DEBUG
15530 if (mmu_page_sizes == max_mmu_page_sizes) {
15531 ASSERT(size < TTE256M);
15532 } else {
15533 ASSERT(size < TTE4M);
15534 }
15535 #endif /* DEBUG */
15536
15537 shw_size = get_hblk_ttesz(shw_hblkp);
15538 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15539 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15540 ASSERT(vshift < 8);
15541 /*
15542 * Atomically clear shadow mask bit
15543 */
15544 do {
15545 shw_mask = shw_hblkp->hblk_shw_mask;
15546 ASSERT(shw_mask & (1 << vshift));
15547 newshw_mask = shw_mask & ~(1 << vshift);
15548 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15549 shw_mask, newshw_mask);
15550 } while (newshw_mask != shw_mask);
15551 hmeblkp->hblk_shadow = NULL;
15552 }
15553 hmeblkp->hblk_shw_bit = 0;
15554
15555 if (hmeblkp->hblk_shared) {
15556 #ifdef DEBUG
15557 sf_srd_t *srdp;
15558 sf_region_t *rgnp;
15559 uint_t rid;
15560
15561 srdp = hblktosrd(hmeblkp);
15562 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15563 rid = hmeblkp->hblk_tag.htag_rid;
15564 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15565 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15566 rgnp = srdp->srd_hmergnp[rid];
15567 ASSERT(rgnp != NULL);
15568 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15569 #endif /* DEBUG */
15570 hmeblkp->hblk_shared = 0;
15571 }
15572 if (free_now) {
15573 kpreempt_disable();
15574 CPUSET_DEL(cpuset, CPU->cpu_id);
15575 xt_sync(cpuset);
15576 xt_sync(cpuset);
15577 kpreempt_enable();
15578
15579 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15580 hmeblkp->hblk_next = NULL;
15581 } else {
15582 /* Append hmeblkp to listp for processing later. */
15583 hmeblkp->hblk_next = *listp;
15584 *listp = hmeblkp;
15585 }
15586 }
15587
15588 /*
15589 * This routine is called when memory is in short supply and returns a free
15590 * hmeblk of the requested size from the cpu pending lists.
15591 */
15592 static struct hme_blk *
15593 sfmmu_check_pending_hblks(int size)
15594 {
15595 int i;
15596 struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15597 int found_hmeblk;
15598 cpuset_t cpuset = cpu_ready_set;
15599 cpu_hme_pend_t *cpuhp;
15600
15601 /* Flush cpu hblk pending queues */
15602 for (i = 0; i < NCPU; i++) {
15603 cpuhp = &cpu_hme_pend[i];
15604 if (cpuhp->chp_listp != NULL) {
15605 mutex_enter(&cpuhp->chp_mutex);
15606 if (cpuhp->chp_listp == NULL) {
15607 mutex_exit(&cpuhp->chp_mutex);
15608 continue;
15609 }
15610 found_hmeblk = 0;
15611 last_hmeblkp = NULL;
15612 for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15613 hmeblkp = hmeblkp->hblk_next) {
15614 if (get_hblk_ttesz(hmeblkp) == size) {
15615 if (last_hmeblkp == NULL) {
15616 cpuhp->chp_listp =
15617 hmeblkp->hblk_next;
15618 } else {
15619 last_hmeblkp->hblk_next =
15620 hmeblkp->hblk_next;
15621 }
15622 ASSERT(cpuhp->chp_count > 0);
15623 cpuhp->chp_count--;
15624 found_hmeblk = 1;
15625 break;
15626 } else {
15627 last_hmeblkp = hmeblkp;
15628 }
15629 }
15630 mutex_exit(&cpuhp->chp_mutex);
15631
15632 if (found_hmeblk) {
15633 kpreempt_disable();
15634 CPUSET_DEL(cpuset, CPU->cpu_id);
15635 xt_sync(cpuset);
15636 xt_sync(cpuset);
15637 kpreempt_enable();
15638 return (hmeblkp);
15639 }
15640 }
15641 }
15642 return (NULL);
15643 }