1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24 /*
25 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
26 */
27
28 /*
29 * VM - Hardware Address Translation management for Spitfire MMU.
30 *
31 * This file implements the machine specific hardware translation
32 * needed by the VM system. The machine independent interface is
33 * described in <vm/hat.h> while the machine dependent interface
34 * and data structures are described in <vm/hat_sfmmu.h>.
35 *
36 * The hat layer manages the address translation hardware as a cache
37 * driven by calls from the higher levels in the VM system.
38 */
39
40 #include <sys/types.h>
41 #include <sys/kstat.h>
42 #include <vm/hat.h>
43 #include <vm/hat_sfmmu.h>
44 #include <vm/page.h>
45 #include <sys/pte.h>
46 #include <sys/systm.h>
47 #include <sys/mman.h>
48 #include <sys/sysmacros.h>
49 #include <sys/machparam.h>
50 #include <sys/vtrace.h>
51 #include <sys/kmem.h>
52 #include <sys/mmu.h>
53 #include <sys/cmn_err.h>
54 #include <sys/cpu.h>
55 #include <sys/cpuvar.h>
56 #include <sys/debug.h>
57 #include <sys/lgrp.h>
58 #include <sys/archsystm.h>
59 #include <sys/machsystm.h>
60 #include <sys/vmsystm.h>
61 #include <vm/as.h>
62 #include <vm/seg.h>
63 #include <vm/seg_kp.h>
64 #include <vm/seg_kmem.h>
65 #include <vm/seg_kpm.h>
66 #include <vm/rm.h>
67 #include <sys/t_lock.h>
68 #include <sys/obpdefs.h>
69 #include <sys/vm_machparam.h>
70 #include <sys/var.h>
71 #include <sys/trap.h>
72 #include <sys/machtrap.h>
73 #include <sys/scb.h>
74 #include <sys/bitmap.h>
75 #include <sys/machlock.h>
76 #include <sys/membar.h>
77 #include <sys/atomic.h>
78 #include <sys/cpu_module.h>
79 #include <sys/prom_debug.h>
80 #include <sys/ksynch.h>
81 #include <sys/mem_config.h>
82 #include <sys/mem_cage.h>
83 #include <vm/vm_dep.h>
84 #include <sys/fpu/fpusystm.h>
85 #include <vm/mach_kpm.h>
86 #include <sys/callb.h>
87
88 #ifdef DEBUG
89 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len) \
90 if (SFMMU_IS_SHMERID_VALID(rid)) { \
91 caddr_t _eaddr = (saddr) + (len); \
92 sf_srd_t *_srdp; \
93 sf_region_t *_rgnp; \
94 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \
95 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid)); \
96 ASSERT((hat) != ksfmmup); \
97 _srdp = (hat)->sfmmu_srdp; \
98 ASSERT(_srdp != NULL); \
99 ASSERT(_srdp->srd_refcnt != 0); \
100 _rgnp = _srdp->srd_hmergnp[(rid)]; \
101 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid); \
102 ASSERT(_rgnp->rgn_refcnt != 0); \
103 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
104 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == \
105 SFMMU_REGION_HME); \
106 ASSERT((saddr) >= _rgnp->rgn_saddr); \
107 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size); \
108 ASSERT(_eaddr > _rgnp->rgn_saddr); \
109 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size); \
110 }
111
112 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid) \
113 { \
114 caddr_t _hsva; \
115 caddr_t _heva; \
116 caddr_t _rsva; \
117 caddr_t _reva; \
118 int _ttesz = get_hblk_ttesz(hmeblkp); \
119 int _flagtte; \
120 ASSERT((srdp)->srd_refcnt != 0); \
121 ASSERT((rid) < SFMMU_MAX_HME_REGIONS); \
122 ASSERT((rgnp)->rgn_id == rid); \
123 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE)); \
124 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) == \
125 SFMMU_REGION_HME); \
126 ASSERT(_ttesz <= (rgnp)->rgn_pgszc); \
127 _hsva = (caddr_t)get_hblk_base(hmeblkp); \
128 _heva = get_hblk_endaddr(hmeblkp); \
129 _rsva = (caddr_t)P2ALIGN( \
130 (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES); \
131 _reva = (caddr_t)P2ROUNDUP( \
132 (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size), \
133 HBLK_MIN_BYTES); \
134 ASSERT(_hsva >= _rsva); \
135 ASSERT(_hsva < _reva); \
136 ASSERT(_heva > _rsva); \
137 ASSERT(_heva <= _reva); \
138 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : \
139 _ttesz; \
140 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte)); \
141 }
142
143 #else /* DEBUG */
144 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
145 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
146 #endif /* DEBUG */
147
148 #if defined(SF_ERRATA_57)
149 extern caddr_t errata57_limit;
150 #endif
151
152 #define HME8BLK_SZ_RND ((roundup(HME8BLK_SZ, sizeof (int64_t))) / \
153 (sizeof (int64_t)))
154 #define HBLK_RESERVE ((struct hme_blk *)hblk_reserve)
155
156 #define HBLK_RESERVE_CNT 128
157 #define HBLK_RESERVE_MIN 20
158
159 static struct hme_blk *freehblkp;
160 static kmutex_t freehblkp_lock;
161 static int freehblkcnt;
162
163 static int64_t hblk_reserve[HME8BLK_SZ_RND];
164 static kmutex_t hblk_reserve_lock;
165 static kthread_t *hblk_reserve_thread;
166
167 static nucleus_hblk8_info_t nucleus_hblk8;
168 static nucleus_hblk1_info_t nucleus_hblk1;
169
170 /*
171 * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
172 * after the initial phase of removing an hmeblk from the hash chain, see
173 * the detailed comment in sfmmu_hblk_hash_rm() for further details.
174 */
175 static cpu_hme_pend_t *cpu_hme_pend;
176 static uint_t cpu_hme_pend_thresh;
177 /*
178 * SFMMU specific hat functions
179 */
180 void hat_pagecachectl(struct page *, int);
181
182 /* flags for hat_pagecachectl */
183 #define HAT_CACHE 0x1
184 #define HAT_UNCACHE 0x2
185 #define HAT_TMPNC 0x4
186
187 /*
188 * Flag to allow the creation of non-cacheable translations
189 * to system memory. It is off by default. At the moment this
190 * flag is used by the ecache error injector. The error injector
191 * will turn it on when creating such a translation then shut it
192 * off when it's finished.
193 */
194
195 int sfmmu_allow_nc_trans = 0;
196
197 /*
198 * Flag to disable large page support.
199 * value of 1 => disable all large pages.
200 * bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
201 *
202 * For example, use the value 0x4 to disable 512K pages.
203 *
204 */
205 #define LARGE_PAGES_OFF 0x1
206
207 /*
208 * The disable_large_pages and disable_ism_large_pages variables control
209 * hat_memload_array and the page sizes to be used by ISM and the kernel.
210 *
211 * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
212 * are only used to control which OOB pages to use at upper VM segment creation
213 * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
214 * Their values may come from platform or CPU specific code to disable page
215 * sizes that should not be used.
216 *
217 * WARNING: 512K pages are currently not supported for ISM/DISM.
218 */
219 uint_t disable_large_pages = 0;
220 uint_t disable_ism_large_pages = (1 << TTE512K);
221 uint_t disable_auto_data_large_pages = 0;
222 uint_t disable_auto_text_large_pages = 0;
223
224 /*
225 * Private sfmmu data structures for hat management
226 */
227 static struct kmem_cache *sfmmuid_cache;
228 static struct kmem_cache *mmuctxdom_cache;
229
230 /*
231 * Private sfmmu data structures for tsb management
232 */
233 static struct kmem_cache *sfmmu_tsbinfo_cache;
234 static struct kmem_cache *sfmmu_tsb8k_cache;
235 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
236 static vmem_t *kmem_bigtsb_arena;
237 static vmem_t *kmem_tsb_arena;
238
239 /*
240 * sfmmu static variables for hmeblk resource management.
241 */
242 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
243 static struct kmem_cache *sfmmu8_cache;
244 static struct kmem_cache *sfmmu1_cache;
245 static struct kmem_cache *pa_hment_cache;
246
247 static kmutex_t ism_mlist_lock; /* mutex for ism mapping list */
248 /*
249 * private data for ism
250 */
251 static struct kmem_cache *ism_blk_cache;
252 static struct kmem_cache *ism_ment_cache;
253 #define ISMID_STARTADDR NULL
254
255 /*
256 * Region management data structures and function declarations.
257 */
258
259 static void sfmmu_leave_srd(sfmmu_t *);
260 static int sfmmu_srdcache_constructor(void *, void *, int);
261 static void sfmmu_srdcache_destructor(void *, void *);
262 static int sfmmu_rgncache_constructor(void *, void *, int);
263 static void sfmmu_rgncache_destructor(void *, void *);
264 static int sfrgnmap_isnull(sf_region_map_t *);
265 static int sfhmergnmap_isnull(sf_hmeregion_map_t *);
266 static int sfmmu_scdcache_constructor(void *, void *, int);
267 static void sfmmu_scdcache_destructor(void *, void *);
268 static void sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
269 size_t, void *, u_offset_t);
270
271 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
272 static sf_srd_bucket_t *srd_buckets;
273 static struct kmem_cache *srd_cache;
274 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
275 static struct kmem_cache *region_cache;
276 static struct kmem_cache *scd_cache;
277
278 #ifdef sun4v
279 int use_bigtsb_arena = 1;
280 #else
281 int use_bigtsb_arena = 0;
282 #endif
283
284 /* External /etc/system tunable, for turning on&off the shctx support */
285 int disable_shctx = 0;
286 /* Internal variable, set by MD if the HW supports shctx feature */
287 int shctx_on = 0;
288
289 #ifdef DEBUG
290 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
291 #endif
292 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
293 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
294
295 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
296 static void sfmmu_find_scd(sfmmu_t *);
297 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
298 static void sfmmu_finish_join_scd(sfmmu_t *);
299 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
300 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
301 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
302 static void sfmmu_free_scd_tsbs(sfmmu_t *);
303 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
304 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
305 static void sfmmu_ism_hatflags(sfmmu_t *, int);
306 static int sfmmu_srd_lock_held(sf_srd_t *);
307 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
308 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
309 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
310 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
311 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
312 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
313
314 /*
315 * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
316 * HAT flags, synchronizing TLB/TSB coherency, and context management.
317 * The lock is hashed on the sfmmup since the case where we need to lock
318 * all processes is rare but does occur (e.g. we need to unload a shared
319 * mapping from all processes using the mapping). We have a lot of buckets,
320 * and each slab of sfmmu_t's can use about a quarter of them, giving us
321 * a fairly good distribution without wasting too much space and overhead
322 * when we have to grab them all.
323 */
324 #define SFMMU_NUM_LOCK 128 /* must be power of two */
325 hatlock_t hat_lock[SFMMU_NUM_LOCK];
326
327 /*
328 * Hash algorithm optimized for a small number of slabs.
329 * 7 is (highbit((sizeof sfmmu_t)) - 1)
330 * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
331 * kmem_cache, and thus they will be sequential within that cache. In
332 * addition, each new slab will have a different "color" up to cache_maxcolor
333 * which will skew the hashing for each successive slab which is allocated.
334 * If the size of sfmmu_t changed to a larger size, this algorithm may need
335 * to be revisited.
336 */
337 #define TSB_HASH_SHIFT_BITS (7)
338 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
339
340 #ifdef DEBUG
341 int tsb_hash_debug = 0;
342 #define TSB_HASH(sfmmup) \
343 (tsb_hash_debug ? &hat_lock[0] : \
344 &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
345 #else /* DEBUG */
346 #define TSB_HASH(sfmmup) &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
347 #endif /* DEBUG */
348
349
350 /* sfmmu_replace_tsb() return codes. */
351 typedef enum tsb_replace_rc {
352 TSB_SUCCESS,
353 TSB_ALLOCFAIL,
354 TSB_LOSTRACE,
355 TSB_ALREADY_SWAPPED,
356 TSB_CANTGROW
357 } tsb_replace_rc_t;
358
359 /*
360 * Flags for TSB allocation routines.
361 */
362 #define TSB_ALLOC 0x01
363 #define TSB_FORCEALLOC 0x02
364 #define TSB_GROW 0x04
365 #define TSB_SHRINK 0x08
366 #define TSB_SWAPIN 0x10
367
368 /*
369 * Support for HAT callbacks.
370 */
371 #define SFMMU_MAX_RELOC_CALLBACKS 10
372 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
373 static id_t sfmmu_cb_nextid = 0;
374 static id_t sfmmu_tsb_cb_id;
375 struct sfmmu_callback *sfmmu_cb_table;
376
377 kmutex_t kpr_mutex;
378 kmutex_t kpr_suspendlock;
379 kthread_t *kreloc_thread;
380
381 /*
382 * Enable VA->PA translation sanity checking on DEBUG kernels.
383 * Disabled by default. This is incompatible with some
384 * drivers (error injector, RSM) so if it breaks you get
385 * to keep both pieces.
386 */
387 int hat_check_vtop = 0;
388
389 /*
390 * Private sfmmu routines (prototypes)
391 */
392 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
393 static struct hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
394 struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
395 uint_t);
396 static caddr_t sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
397 caddr_t, demap_range_t *, uint_t);
398 static caddr_t sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
399 caddr_t, int);
400 static void sfmmu_hblk_free(struct hme_blk **);
401 static void sfmmu_hblks_list_purge(struct hme_blk **, int);
402 static uint_t sfmmu_get_free_hblk(struct hme_blk **, uint_t);
403 static uint_t sfmmu_put_free_hblk(struct hme_blk *, uint_t);
404 static struct hme_blk *sfmmu_hblk_steal(int);
405 static int sfmmu_steal_this_hblk(struct hmehash_bucket *,
406 struct hme_blk *, uint64_t, struct hme_blk *);
407 static caddr_t sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
408
409 static void hat_do_memload_array(struct hat *, caddr_t, size_t,
410 struct page **, uint_t, uint_t, uint_t);
411 static void hat_do_memload(struct hat *, caddr_t, struct page *,
412 uint_t, uint_t, uint_t);
413 static void sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
414 uint_t, uint_t, pgcnt_t, uint_t);
415 void sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
416 uint_t);
417 static int sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
418 uint_t, uint_t);
419 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
420 caddr_t, int, uint_t);
421 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
422 struct hmehash_bucket *, caddr_t, uint_t, uint_t,
423 uint_t);
424 static int sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
425 caddr_t, page_t **, uint_t, uint_t);
426 static void sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
427
428 static int sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
429 static pfn_t sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
430 void sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
431 #ifdef VAC
432 static void sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
433 static int sfmmu_vacconflict_array(caddr_t, page_t *, int *);
434 int tst_tnc(page_t *pp, pgcnt_t);
435 void conv_tnc(page_t *pp, int);
436 #endif
437
438 static void sfmmu_get_ctx(sfmmu_t *);
439 static void sfmmu_free_sfmmu(sfmmu_t *);
440
441 static void sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
442 static void sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
443
444 cpuset_t sfmmu_pageunload(page_t *, struct sf_hment *, int);
445 static void hat_pagereload(struct page *, struct page *);
446 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
447 #ifdef VAC
448 void sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
449 static void sfmmu_page_cache(page_t *, int, int, int);
450 #endif
451
452 cpuset_t sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
453 struct hme_blk *, int);
454 static void sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
455 pfn_t, int, int, int, int);
456 static void sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
457 pfn_t, int);
458 static void sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
459 static void sfmmu_tlb_range_demap(demap_range_t *);
460 static void sfmmu_invalidate_ctx(sfmmu_t *);
461 static void sfmmu_sync_mmustate(sfmmu_t *);
462
463 static void sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
464 static int sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
465 sfmmu_t *);
466 static void sfmmu_tsb_free(struct tsb_info *);
467 static void sfmmu_tsbinfo_free(struct tsb_info *);
468 static int sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
469 sfmmu_t *);
470 static void sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
471 static void sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
472 static int sfmmu_select_tsb_szc(pgcnt_t);
473 static void sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
474 #define sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
475 sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
476 #define sfmmu_unload_tsb(sfmmup, vaddr, szc) \
477 sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
478 static void sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
479 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
480 hatlock_t *, uint_t);
481 static void sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
482
483 #ifdef VAC
484 void sfmmu_cache_flush(pfn_t, int);
485 void sfmmu_cache_flushcolor(int, pfn_t);
486 #endif
487 static caddr_t sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
488 caddr_t, demap_range_t *, uint_t, int);
489
490 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
491 static uint_t sfmmu_ptov_attr(tte_t *);
492 static caddr_t sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
493 caddr_t, demap_range_t *, uint_t);
494 static uint_t sfmmu_vtop_prot(uint_t, uint_t *);
495 static int sfmmu_idcache_constructor(void *, void *, int);
496 static void sfmmu_idcache_destructor(void *, void *);
497 static int sfmmu_hblkcache_constructor(void *, void *, int);
498 static void sfmmu_hblkcache_destructor(void *, void *);
499 static void sfmmu_hblkcache_reclaim(void *);
500 static void sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
501 struct hmehash_bucket *);
502 static void sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
503 struct hme_blk *, struct hme_blk **, int);
504 static void sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
505 uint64_t);
506 static struct hme_blk *sfmmu_check_pending_hblks(int);
507 static void sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
508 static void sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
509 static void sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
510 int, caddr_t *);
511 static void sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
512
513 static void sfmmu_rm_large_mappings(page_t *, int);
514
515 static void hat_lock_init(void);
516 static void hat_kstat_init(void);
517 static int sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
518 static void sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
519 static int sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
520 static void sfmmu_check_page_sizes(sfmmu_t *, int);
521 int fnd_mapping_sz(page_t *);
522 static void iment_add(struct ism_ment *, struct hat *);
523 static void iment_sub(struct ism_ment *, struct hat *);
524 static pgcnt_t ism_tsb_entries(sfmmu_t *, int szc);
525 extern void sfmmu_setup_tsbinfo(sfmmu_t *);
526 extern void sfmmu_clear_utsbinfo(void);
527
528 static void sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
529
530 extern int vpm_enable;
531
532 /* kpm globals */
533 #ifdef DEBUG
534 /*
535 * Enable trap level tsbmiss handling
536 */
537 int kpm_tsbmtl = 1;
538
539 /*
540 * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
541 * required TLB shootdowns in this case, so handle w/ care. Off by default.
542 */
543 int kpm_tlb_flush;
544 #endif /* DEBUG */
545
546 static void *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
547
548 #ifdef DEBUG
549 static void sfmmu_check_hblk_flist();
550 #endif
551
552 /*
553 * Semi-private sfmmu data structures. Some of them are initialize in
554 * startup or in hat_init. Some of them are private but accessed by
555 * assembly code or mach_sfmmu.c
556 */
557 struct hmehash_bucket *uhme_hash; /* user hmeblk hash table */
558 struct hmehash_bucket *khme_hash; /* kernel hmeblk hash table */
559 uint64_t uhme_hash_pa; /* PA of uhme_hash */
560 uint64_t khme_hash_pa; /* PA of khme_hash */
561 int uhmehash_num; /* # of buckets in user hash table */
562 int khmehash_num; /* # of buckets in kernel hash table */
563
564 uint_t max_mmu_ctxdoms = 0; /* max context domains in the system */
565 mmu_ctx_t **mmu_ctxs_tbl; /* global array of context domains */
566 uint64_t mmu_saved_gnum = 0; /* to init incoming MMUs' gnums */
567
568 #define DEFAULT_NUM_CTXS_PER_MMU 8192
569 static uint_t nctxs = DEFAULT_NUM_CTXS_PER_MMU;
570
571 int cache; /* describes system cache */
572
573 caddr_t ktsb_base; /* kernel 8k-indexed tsb base address */
574 uint64_t ktsb_pbase; /* kernel 8k-indexed tsb phys address */
575 int ktsb_szcode; /* kernel 8k-indexed tsb size code */
576 int ktsb_sz; /* kernel 8k-indexed tsb size */
577
578 caddr_t ktsb4m_base; /* kernel 4m-indexed tsb base address */
579 uint64_t ktsb4m_pbase; /* kernel 4m-indexed tsb phys address */
580 int ktsb4m_szcode; /* kernel 4m-indexed tsb size code */
581 int ktsb4m_sz; /* kernel 4m-indexed tsb size */
582
583 uint64_t kpm_tsbbase; /* kernel seg_kpm 4M TSB base address */
584 int kpm_tsbsz; /* kernel seg_kpm 4M TSB size code */
585 uint64_t kpmsm_tsbbase; /* kernel seg_kpm 8K TSB base address */
586 int kpmsm_tsbsz; /* kernel seg_kpm 8K TSB size code */
587
588 #ifndef sun4v
589 int utsb_dtlb_ttenum = -1; /* index in TLB for utsb locked TTE */
590 int utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
591 int dtlb_resv_ttenum; /* index in TLB of first reserved TTE */
592 caddr_t utsb_vabase; /* reserved kernel virtual memory */
593 caddr_t utsb4m_vabase; /* for trap handler TSB accesses */
594 #endif /* sun4v */
595 uint64_t tsb_alloc_bytes = 0; /* bytes allocated to TSBs */
596 vmem_t *kmem_tsb_default_arena[NLGRPS_MAX]; /* For dynamic TSBs */
597 vmem_t *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
598
599 /*
600 * Size to use for TSB slabs. Future platforms that support page sizes
601 * larger than 4M may wish to change these values, and provide their own
602 * assembly macros for building and decoding the TSB base register contents.
603 * Note disable_large_pages will override the value set here.
604 */
605 static uint_t tsb_slab_ttesz = TTE4M;
606 size_t tsb_slab_size = MMU_PAGESIZE4M;
607 uint_t tsb_slab_shift = MMU_PAGESHIFT4M;
608 /* PFN mask for TTE */
609 size_t tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
610
611 /*
612 * Size to use for TSB slabs. These are used only when 256M tsb arenas
613 * exist.
614 */
615 static uint_t bigtsb_slab_ttesz = TTE256M;
616 static size_t bigtsb_slab_size = MMU_PAGESIZE256M;
617 static uint_t bigtsb_slab_shift = MMU_PAGESHIFT256M;
618 /* 256M page alignment for 8K pfn */
619 static size_t bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
620
621 /* largest TSB size to grow to, will be smaller on smaller memory systems */
622 static int tsb_max_growsize = 0;
623
624 /*
625 * Tunable parameters dealing with TSB policies.
626 */
627
628 /*
629 * This undocumented tunable forces all 8K TSBs to be allocated from
630 * the kernel heap rather than from the kmem_tsb_default_arena arenas.
631 */
632 #ifdef DEBUG
633 int tsb_forceheap = 0;
634 #endif /* DEBUG */
635
636 /*
637 * Decide whether to use per-lgroup arenas, or one global set of
638 * TSB arenas. The default is not to break up per-lgroup, since
639 * most platforms don't recognize any tangible benefit from it.
640 */
641 int tsb_lgrp_affinity = 0;
642
643 /*
644 * Used for growing the TSB based on the process RSS.
645 * tsb_rss_factor is based on the smallest TSB, and is
646 * shifted by the TSB size to determine if we need to grow.
647 * The default will grow the TSB if the number of TTEs for
648 * this page size exceeds 75% of the number of TSB entries,
649 * which should _almost_ eliminate all conflict misses
650 * (at the expense of using up lots and lots of memory).
651 */
652 #define TSB_RSS_FACTOR (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
653 #define SFMMU_RSS_TSBSIZE(tsbszc) (tsb_rss_factor << tsbszc)
654 #define SELECT_TSB_SIZECODE(pgcnt) ( \
655 (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
656 default_tsb_size)
657 #define TSB_OK_SHRINK() \
658 (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
659 #define TSB_OK_GROW() \
660 (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
661
662 int enable_tsb_rss_sizing = 1;
663 int tsb_rss_factor = (int)TSB_RSS_FACTOR;
664
665 /* which TSB size code to use for new address spaces or if rss sizing off */
666 int default_tsb_size = TSB_8K_SZCODE;
667
668 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
669 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
670 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT 32
671
672 #ifdef DEBUG
673 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
674 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
675 static int tsb_alloc_mtbf = 0; /* fail allocation every n attempts */
676 static int tsb_alloc_fail_mtbf = 0;
677 static int tsb_alloc_count = 0;
678 #endif /* DEBUG */
679
680 /* if set to 1, will remap valid TTEs when growing TSB. */
681 int tsb_remap_ttes = 1;
682
683 /*
684 * If we have more than this many mappings, allocate a second TSB.
685 * This default is chosen because the I/D fully associative TLBs are
686 * assumed to have at least 8 available entries. Platforms with a
687 * larger fully-associative TLB could probably override the default.
688 */
689
690 #ifdef sun4v
691 int tsb_sectsb_threshold = 0;
692 #else
693 int tsb_sectsb_threshold = 8;
694 #endif
695
696 /*
697 * kstat data
698 */
699 struct sfmmu_global_stat sfmmu_global_stat;
700 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
701
702 /*
703 * Global data
704 */
705 sfmmu_t *ksfmmup; /* kernel's hat id */
706
707 #ifdef DEBUG
708 static void chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
709 #endif
710
711 /* sfmmu locking operations */
712 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
713 static int sfmmu_mlspl_held(struct page *, int);
714
715 kmutex_t *sfmmu_page_enter(page_t *);
716 void sfmmu_page_exit(kmutex_t *);
717 int sfmmu_page_spl_held(struct page *);
718
719 /* sfmmu internal locking operations - accessed directly */
720 static void sfmmu_mlist_reloc_enter(page_t *, page_t *,
721 kmutex_t **, kmutex_t **);
722 static void sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
723 static hatlock_t *
724 sfmmu_hat_enter(sfmmu_t *);
725 static hatlock_t *
726 sfmmu_hat_tryenter(sfmmu_t *);
727 static void sfmmu_hat_exit(hatlock_t *);
728 static void sfmmu_hat_lock_all(void);
729 static void sfmmu_hat_unlock_all(void);
730 static void sfmmu_ismhat_enter(sfmmu_t *, int);
731 static void sfmmu_ismhat_exit(sfmmu_t *, int);
732
733 kpm_hlk_t *kpmp_table;
734 uint_t kpmp_table_sz; /* must be a power of 2 */
735 uchar_t kpmp_shift;
736
737 kpm_shlk_t *kpmp_stable;
738 uint_t kpmp_stable_sz; /* must be a power of 2 */
739
740 /*
741 * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
742 * SPL_SHIFT is log2(SPL_TABLE_SIZE).
743 */
744 #if ((2*NCPU_P2) > 128)
745 #define SPL_SHIFT ((unsigned)(NCPU_LOG2 + 1))
746 #else
747 #define SPL_SHIFT 7U
748 #endif
749 #define SPL_TABLE_SIZE (1U << SPL_SHIFT)
750 #define SPL_MASK (SPL_TABLE_SIZE - 1)
751
752 /*
753 * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
754 * and by multiples of SPL_SHIFT to get as many varied bits as we can.
755 */
756 #define SPL_INDEX(pp) \
757 ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
758 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
759 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
760 ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
761 SPL_MASK)
762
763 #define SPL_HASH(pp) \
764 (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
765
766 static pad_mutex_t sfmmu_page_lock[SPL_TABLE_SIZE];
767
768 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
769
770 #define MML_TABLE_SIZE SPL_TABLE_SIZE
771 #define MLIST_HASH(pp) (&mml_table[SPL_INDEX(pp)].pad_mutex)
772
773 static pad_mutex_t mml_table[MML_TABLE_SIZE];
774
775 /*
776 * hat_unload_callback() will group together callbacks in order
777 * to avoid xt_sync() calls. This is the maximum size of the group.
778 */
779 #define MAX_CB_ADDR 32
780
781 tte_t hw_tte;
782 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
783
784 static char *mmu_ctx_kstat_names[] = {
785 "mmu_ctx_tsb_exceptions",
786 "mmu_ctx_tsb_raise_exception",
787 "mmu_ctx_wrap_around",
788 };
789
790 /*
791 * Wrapper for vmem_xalloc since vmem_create only allows limited
792 * parameters for vm_source_alloc functions. This function allows us
793 * to specify alignment consistent with the size of the object being
794 * allocated.
795 */
796 static void *
797 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
798 {
799 return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
800 }
801
802 /* Common code for setting tsb_alloc_hiwater. */
803 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages) tsb_alloc_hiwater = \
804 ptob(pages) / tsb_alloc_hiwater_factor
805
806 /*
807 * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
808 * a single TSB. physmem is the number of physical pages so we need physmem 8K
809 * TTEs to represent all those physical pages. We round this up by using
810 * 1<<highbit(). To figure out which size code to use, remember that the size
811 * code is just an amount to shift the smallest TSB size to get the size of
812 * this TSB. So we subtract that size, TSB_START_SIZE, from highbit() (or
813 * highbit() - 1) to get the size code for the smallest TSB that can represent
814 * all of physical memory, while erring on the side of too much.
815 *
816 * Restrict tsb_max_growsize to make sure that:
817 * 1) TSBs can't grow larger than the TSB slab size
818 * 2) TSBs can't grow larger than UTSB_MAX_SZCODE.
819 */
820 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) { \
821 int _i, _szc, _slabszc, _tsbszc; \
822 \
823 _i = highbit(pages); \
824 if ((1 << (_i - 1)) == (pages)) \
825 _i--; /* 2^n case, round down */ \
826 _szc = _i - TSB_START_SIZE; \
827 _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
828 _tsbszc = MIN(_szc, _slabszc); \
829 tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE); \
830 }
831
832 /*
833 * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
834 * tsb_info which handles that TTE size.
835 */
836 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) { \
837 (tsbinfop) = (sfmmup)->sfmmu_tsb; \
838 ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) || \
839 sfmmu_hat_lock_held(sfmmup)); \
840 if ((tte_szc) >= TTE4M) { \
841 ASSERT((tsbinfop) != NULL); \
842 (tsbinfop) = (tsbinfop)->tsb_next; \
843 } \
844 }
845
846 /*
847 * Macro to use to unload entries from the TSB.
848 * It has knowledge of which page sizes get replicated in the TSB
849 * and will call the appropriate unload routine for the appropriate size.
850 */
851 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat) \
852 { \
853 int ttesz = get_hblk_ttesz(hmeblkp); \
854 if (ttesz == TTE8K || ttesz == TTE4M) { \
855 sfmmu_unload_tsb(sfmmup, addr, ttesz); \
856 } else { \
857 caddr_t sva = ismhat ? addr : \
858 (caddr_t)get_hblk_base(hmeblkp); \
859 caddr_t eva = sva + get_hblk_span(hmeblkp); \
860 ASSERT(addr >= sva && addr < eva); \
861 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz); \
862 } \
863 }
864
865
866 /* Update tsb_alloc_hiwater after memory is configured. */
867 /*ARGSUSED*/
868 static void
869 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
870 {
871 /* Assumes physmem has already been updated. */
872 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
873 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
874 }
875
876 /*
877 * Update tsb_alloc_hiwater before memory is deleted. We'll do nothing here
878 * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
879 * deleted.
880 */
881 /*ARGSUSED*/
882 static int
883 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
884 {
885 return (0);
886 }
887
888 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
889 /*ARGSUSED*/
890 static void
891 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
892 {
893 /*
894 * Whether the delete was cancelled or not, just go ahead and update
895 * tsb_alloc_hiwater and tsb_max_growsize.
896 */
897 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
898 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
899 }
900
901 static kphysm_setup_vector_t sfmmu_update_vec = {
902 KPHYSM_SETUP_VECTOR_VERSION, /* version */
903 sfmmu_update_post_add, /* post_add */
904 sfmmu_update_pre_del, /* pre_del */
905 sfmmu_update_post_del /* post_del */
906 };
907
908
909 /*
910 * HME_BLK HASH PRIMITIVES
911 */
912
913 /*
914 * Enter a hme on the mapping list for page pp.
915 * When large pages are more prevalent in the system we might want to
916 * keep the mapping list in ascending order by the hment size. For now,
917 * small pages are more frequent, so don't slow it down.
918 */
919 #define HME_ADD(hme, pp) \
920 { \
921 ASSERT(sfmmu_mlist_held(pp)); \
922 \
923 hme->hme_prev = NULL; \
924 hme->hme_next = pp->p_mapping; \
925 hme->hme_page = pp; \
926 if (pp->p_mapping) { \
927 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
928 ASSERT(pp->p_share > 0); \
929 } else { \
930 /* EMPTY */ \
931 ASSERT(pp->p_share == 0); \
932 } \
933 pp->p_mapping = hme; \
934 pp->p_share++; \
935 }
936
937 /*
938 * Enter a hme on the mapping list for page pp.
939 * If we are unmapping a large translation, we need to make sure that the
940 * change is reflect in the corresponding bit of the p_index field.
941 */
942 #define HME_SUB(hme, pp) \
943 { \
944 ASSERT(sfmmu_mlist_held(pp)); \
945 ASSERT(hme->hme_page == pp || IS_PAHME(hme)); \
946 \
947 if (pp->p_mapping == NULL) { \
948 panic("hme_remove - no mappings"); \
949 } \
950 \
951 membar_stst(); /* ensure previous stores finish */ \
952 \
953 ASSERT(pp->p_share > 0); \
954 pp->p_share--; \
955 \
956 if (hme->hme_prev) { \
957 ASSERT(pp->p_mapping != hme); \
958 ASSERT(hme->hme_prev->hme_page == pp || \
959 IS_PAHME(hme->hme_prev)); \
960 hme->hme_prev->hme_next = hme->hme_next; \
961 } else { \
962 ASSERT(pp->p_mapping == hme); \
963 pp->p_mapping = hme->hme_next; \
964 ASSERT((pp->p_mapping == NULL) ? \
965 (pp->p_share == 0) : 1); \
966 } \
967 \
968 if (hme->hme_next) { \
969 ASSERT(hme->hme_next->hme_page == pp || \
970 IS_PAHME(hme->hme_next)); \
971 hme->hme_next->hme_prev = hme->hme_prev; \
972 } \
973 \
974 /* zero out the entry */ \
975 hme->hme_next = NULL; \
976 hme->hme_prev = NULL; \
977 hme->hme_page = NULL; \
978 \
979 if (hme_size(hme) > TTE8K) { \
980 /* remove mappings for remainder of large pg */ \
981 sfmmu_rm_large_mappings(pp, hme_size(hme)); \
982 } \
983 }
984
985 /*
986 * This function returns the hment given the hme_blk and a vaddr.
987 * It assumes addr has already been checked to belong to hme_blk's
988 * range.
989 */
990 #define HBLKTOHME(hment, hmeblkp, addr) \
991 { \
992 int index; \
993 HBLKTOHME_IDX(hment, hmeblkp, addr, index) \
994 }
995
996 /*
997 * Version of HBLKTOHME that also returns the index in hmeblkp
998 * of the hment.
999 */
1000 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx) \
1001 { \
1002 ASSERT(in_hblk_range((hmeblkp), (addr))); \
1003 \
1004 if (get_hblk_ttesz(hmeblkp) == TTE8K) { \
1005 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1006 } else \
1007 idx = 0; \
1008 \
1009 (hment) = &(hmeblkp)->hblk_hme[idx]; \
1010 }
1011
1012 /*
1013 * Disable any page sizes not supported by the CPU
1014 */
1015 void
1016 hat_init_pagesizes()
1017 {
1018 int i;
1019
1020 mmu_exported_page_sizes = 0;
1021 for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1022
1023 szc_2_userszc[i] = (uint_t)-1;
1024 userszc_2_szc[i] = (uint_t)-1;
1025
1026 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1027 disable_large_pages |= (1 << i);
1028 } else {
1029 szc_2_userszc[i] = mmu_exported_page_sizes;
1030 userszc_2_szc[mmu_exported_page_sizes] = i;
1031 mmu_exported_page_sizes++;
1032 }
1033 }
1034
1035 disable_ism_large_pages |= disable_large_pages;
1036 disable_auto_data_large_pages = disable_large_pages;
1037 disable_auto_text_large_pages = disable_large_pages;
1038
1039 /*
1040 * Initialize mmu-specific large page sizes.
1041 */
1042 if (&mmu_large_pages_disabled) {
1043 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1044 disable_ism_large_pages |=
1045 mmu_large_pages_disabled(HAT_LOAD_SHARE);
1046 disable_auto_data_large_pages |=
1047 mmu_large_pages_disabled(HAT_AUTO_DATA);
1048 disable_auto_text_large_pages |=
1049 mmu_large_pages_disabled(HAT_AUTO_TEXT);
1050 }
1051 }
1052
1053 /*
1054 * Initialize the hardware address translation structures.
1055 */
1056 void
1057 hat_init(void)
1058 {
1059 int i;
1060 uint_t sz;
1061 size_t size;
1062
1063 hat_lock_init();
1064 hat_kstat_init();
1065
1066 /*
1067 * Hardware-only bits in a TTE
1068 */
1069 MAKE_TTE_MASK(&hw_tte);
1070
1071 hat_init_pagesizes();
1072
1073 /* Initialize the hash locks */
1074 for (i = 0; i < khmehash_num; i++) {
1075 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1076 MUTEX_DEFAULT, NULL);
1077 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1078 }
1079 for (i = 0; i < uhmehash_num; i++) {
1080 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1081 MUTEX_DEFAULT, NULL);
1082 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1083 }
1084 khmehash_num--; /* make sure counter starts from 0 */
1085 uhmehash_num--; /* make sure counter starts from 0 */
1086
1087 /*
1088 * Allocate context domain structures.
1089 *
1090 * A platform may choose to modify max_mmu_ctxdoms in
1091 * set_platform_defaults(). If a platform does not define
1092 * a set_platform_defaults() or does not choose to modify
1093 * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1094 *
1095 * For all platforms that have CPUs sharing MMUs, this
1096 * value must be defined.
1097 */
1098 if (max_mmu_ctxdoms == 0)
1099 max_mmu_ctxdoms = max_ncpus;
1100
1101 size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1102 mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1103
1104 /* mmu_ctx_t is 64 bytes aligned */
1105 mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1106 sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1107 /*
1108 * MMU context domain initialization for the Boot CPU.
1109 * This needs the context domains array allocated above.
1110 */
1111 mutex_enter(&cpu_lock);
1112 sfmmu_cpu_init(CPU);
1113 mutex_exit(&cpu_lock);
1114
1115 /*
1116 * Intialize ism mapping list lock.
1117 */
1118
1119 mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1120
1121 /*
1122 * Each sfmmu structure carries an array of MMU context info
1123 * structures, one per context domain. The size of this array depends
1124 * on the maximum number of context domains. So, the size of the
1125 * sfmmu structure varies per platform.
1126 *
1127 * sfmmu is allocated from static arena, because trap
1128 * handler at TL > 0 is not allowed to touch kernel relocatable
1129 * memory. sfmmu's alignment is changed to 64 bytes from
1130 * default 8 bytes, as the lower 6 bits will be used to pass
1131 * pgcnt to vtag_flush_pgcnt_tl1.
1132 */
1133 size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1134
1135 sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1136 64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1137 NULL, NULL, static_arena, 0);
1138
1139 sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1140 sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1141
1142 /*
1143 * Since we only use the tsb8k cache to "borrow" pages for TSBs
1144 * from the heap when low on memory or when TSB_FORCEALLOC is
1145 * specified, don't use magazines to cache them--we want to return
1146 * them to the system as quickly as possible.
1147 */
1148 sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1149 MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1150 static_arena, KMC_NOMAGAZINE);
1151
1152 /*
1153 * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1154 * memory, which corresponds to the old static reserve for TSBs.
1155 * tsb_alloc_hiwater_factor defaults to 32. This caps the amount of
1156 * memory we'll allocate for TSB slabs; beyond this point TSB
1157 * allocations will be taken from the kernel heap (via
1158 * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1159 * consumer.
1160 */
1161 if (tsb_alloc_hiwater_factor == 0) {
1162 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1163 }
1164 SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1165
1166 for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1167 if (!(disable_large_pages & (1 << sz)))
1168 break;
1169 }
1170
1171 if (sz < tsb_slab_ttesz) {
1172 tsb_slab_ttesz = sz;
1173 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1174 tsb_slab_size = 1 << tsb_slab_shift;
1175 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1176 use_bigtsb_arena = 0;
1177 } else if (use_bigtsb_arena &&
1178 (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1179 use_bigtsb_arena = 0;
1180 }
1181
1182 if (!use_bigtsb_arena) {
1183 bigtsb_slab_shift = tsb_slab_shift;
1184 }
1185 SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1186
1187 /*
1188 * On smaller memory systems, allocate TSB memory in smaller chunks
1189 * than the default 4M slab size. We also honor disable_large_pages
1190 * here.
1191 *
1192 * The trap handlers need to be patched with the final slab shift,
1193 * since they need to be able to construct the TSB pointer at runtime.
1194 */
1195 if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1196 !(disable_large_pages & (1 << TTE512K))) {
1197 tsb_slab_ttesz = TTE512K;
1198 tsb_slab_shift = MMU_PAGESHIFT512K;
1199 tsb_slab_size = MMU_PAGESIZE512K;
1200 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1201 use_bigtsb_arena = 0;
1202 }
1203
1204 if (!use_bigtsb_arena) {
1205 bigtsb_slab_ttesz = tsb_slab_ttesz;
1206 bigtsb_slab_shift = tsb_slab_shift;
1207 bigtsb_slab_size = tsb_slab_size;
1208 bigtsb_slab_mask = tsb_slab_mask;
1209 }
1210
1211
1212 /*
1213 * Set up memory callback to update tsb_alloc_hiwater and
1214 * tsb_max_growsize.
1215 */
1216 i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1217 ASSERT(i == 0);
1218
1219 /*
1220 * kmem_tsb_arena is the source from which large TSB slabs are
1221 * drawn. The quantum of this arena corresponds to the largest
1222 * TSB size we can dynamically allocate for user processes.
1223 * Currently it must also be a supported page size since we
1224 * use exactly one translation entry to map each slab page.
1225 *
1226 * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1227 * which most TSBs are allocated. Since most TSB allocations are
1228 * typically 8K we have a kmem cache we stack on top of each
1229 * kmem_tsb_default_arena to speed up those allocations.
1230 *
1231 * Note the two-level scheme of arenas is required only
1232 * because vmem_create doesn't allow us to specify alignment
1233 * requirements. If this ever changes the code could be
1234 * simplified to use only one level of arenas.
1235 *
1236 * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1237 * will be provided in addition to the 4M kmem_tsb_arena.
1238 */
1239 if (use_bigtsb_arena) {
1240 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1241 bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1242 vmem_xfree, heap_arena, 0, VM_SLEEP);
1243 }
1244
1245 kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1246 sfmmu_vmem_xalloc_aligned_wrapper,
1247 vmem_xfree, heap_arena, 0, VM_SLEEP);
1248
1249 if (tsb_lgrp_affinity) {
1250 char s[50];
1251 for (i = 0; i < NLGRPS_MAX; i++) {
1252 if (use_bigtsb_arena) {
1253 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1254 kmem_bigtsb_default_arena[i] = vmem_create(s,
1255 NULL, 0, 2 * tsb_slab_size,
1256 sfmmu_tsb_segkmem_alloc,
1257 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1258 0, VM_SLEEP | VM_BESTFIT);
1259 }
1260
1261 (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1262 kmem_tsb_default_arena[i] = vmem_create(s,
1263 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1264 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1265 VM_SLEEP | VM_BESTFIT);
1266
1267 (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1268 sfmmu_tsb_cache[i] = kmem_cache_create(s,
1269 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1270 kmem_tsb_default_arena[i], 0);
1271 }
1272 } else {
1273 if (use_bigtsb_arena) {
1274 kmem_bigtsb_default_arena[0] =
1275 vmem_create("kmem_bigtsb_default", NULL, 0,
1276 2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1277 sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1278 VM_SLEEP | VM_BESTFIT);
1279 }
1280
1281 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1282 NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1283 sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1284 VM_SLEEP | VM_BESTFIT);
1285 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1286 PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1287 kmem_tsb_default_arena[0], 0);
1288 }
1289
1290 sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1291 HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1292 sfmmu_hblkcache_destructor,
1293 sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1294 hat_memload_arena, KMC_NOHASH);
1295
1296 hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1297 segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1298 VMC_DUMPSAFE | VM_SLEEP);
1299
1300 sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1301 HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1302 sfmmu_hblkcache_destructor,
1303 NULL, (void *)HME1BLK_SZ,
1304 hat_memload1_arena, KMC_NOHASH);
1305
1306 pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1307 0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1308
1309 ism_blk_cache = kmem_cache_create("ism_blk_cache",
1310 sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1311 NULL, NULL, static_arena, KMC_NOHASH);
1312
1313 ism_ment_cache = kmem_cache_create("ism_ment_cache",
1314 sizeof (ism_ment_t), 0, NULL, NULL,
1315 NULL, NULL, NULL, 0);
1316
1317 /*
1318 * We grab the first hat for the kernel,
1319 */
1320 AS_LOCK_ENTER(&kas, RW_WRITER);
1321 kas.a_hat = hat_alloc(&kas);
1322 AS_LOCK_EXIT(&kas);
1323
1324 /*
1325 * Initialize hblk_reserve.
1326 */
1327 ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1328 va_to_pa((caddr_t)hblk_reserve);
1329
1330 #ifndef UTSB_PHYS
1331 /*
1332 * Reserve some kernel virtual address space for the locked TTEs
1333 * that allow us to probe the TSB from TL>0.
1334 */
1335 utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1336 0, 0, NULL, NULL, VM_SLEEP);
1337 utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1338 0, 0, NULL, NULL, VM_SLEEP);
1339 #endif
1340
1341 #ifdef VAC
1342 /*
1343 * The big page VAC handling code assumes VAC
1344 * will not be bigger than the smallest big
1345 * page- which is 64K.
1346 */
1347 if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1348 cmn_err(CE_PANIC, "VAC too big!");
1349 }
1350 #endif
1351
1352 uhme_hash_pa = va_to_pa(uhme_hash);
1353 khme_hash_pa = va_to_pa(khme_hash);
1354
1355 /*
1356 * Initialize relocation locks. kpr_suspendlock is held
1357 * at PIL_MAX to prevent interrupts from pinning the holder
1358 * of a suspended TTE which may access it leading to a
1359 * deadlock condition.
1360 */
1361 mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1362 mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1363
1364 /*
1365 * If Shared context support is disabled via /etc/system
1366 * set shctx_on to 0 here if it was set to 1 earlier in boot
1367 * sequence by cpu module initialization code.
1368 */
1369 if (shctx_on && disable_shctx) {
1370 shctx_on = 0;
1371 }
1372
1373 if (shctx_on) {
1374 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1375 sizeof (srd_buckets[0]), KM_SLEEP);
1376 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1377 mutex_init(&srd_buckets[i].srdb_lock, NULL,
1378 MUTEX_DEFAULT, NULL);
1379 }
1380
1381 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1382 0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1383 NULL, NULL, NULL, 0);
1384 region_cache = kmem_cache_create("region_cache",
1385 sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1386 sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1387 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1388 0, sfmmu_scdcache_constructor, sfmmu_scdcache_destructor,
1389 NULL, NULL, NULL, 0);
1390 }
1391
1392 /*
1393 * Pre-allocate hrm_hashtab before enabling the collection of
1394 * refmod statistics. Allocating on the fly would mean us
1395 * running the risk of suffering recursive mutex enters or
1396 * deadlocks.
1397 */
1398 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1399 KM_SLEEP);
1400
1401 /* Allocate per-cpu pending freelist of hmeblks */
1402 cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1403 KM_SLEEP);
1404 cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1405 (uintptr_t)cpu_hme_pend, 64);
1406
1407 for (i = 0; i < NCPU; i++) {
1408 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1409 NULL);
1410 }
1411
1412 if (cpu_hme_pend_thresh == 0) {
1413 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1414 }
1415 }
1416
1417 /*
1418 * Initialize locking for the hat layer, called early during boot.
1419 */
1420 static void
1421 hat_lock_init()
1422 {
1423 int i;
1424
1425 /*
1426 * initialize the array of mutexes protecting a page's mapping
1427 * list and p_nrm field.
1428 */
1429 for (i = 0; i < MML_TABLE_SIZE; i++)
1430 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1431
1432 if (kpm_enable) {
1433 for (i = 0; i < kpmp_table_sz; i++) {
1434 mutex_init(&kpmp_table[i].khl_mutex, NULL,
1435 MUTEX_DEFAULT, NULL);
1436 }
1437 }
1438
1439 /*
1440 * Initialize array of mutex locks that protects sfmmu fields and
1441 * TSB lists.
1442 */
1443 for (i = 0; i < SFMMU_NUM_LOCK; i++)
1444 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1445 NULL);
1446 }
1447
1448 #define SFMMU_KERNEL_MAXVA \
1449 (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1450
1451 /*
1452 * Allocate a hat structure.
1453 * Called when an address space first uses a hat.
1454 */
1455 struct hat *
1456 hat_alloc(struct as *as)
1457 {
1458 sfmmu_t *sfmmup;
1459 int i;
1460 uint64_t cnum;
1461 extern uint_t get_color_start(struct as *);
1462
1463 ASSERT(AS_WRITE_HELD(as));
1464 sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1465 sfmmup->sfmmu_as = as;
1466 sfmmup->sfmmu_flags = 0;
1467 sfmmup->sfmmu_tteflags = 0;
1468 sfmmup->sfmmu_rtteflags = 0;
1469 LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1470
1471 if (as == &kas) {
1472 ksfmmup = sfmmup;
1473 sfmmup->sfmmu_cext = 0;
1474 cnum = KCONTEXT;
1475
1476 sfmmup->sfmmu_clrstart = 0;
1477 sfmmup->sfmmu_tsb = NULL;
1478 /*
1479 * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1480 * to setup tsb_info for ksfmmup.
1481 */
1482 } else {
1483
1484 /*
1485 * Just set to invalid ctx. When it faults, it will
1486 * get a valid ctx. This would avoid the situation
1487 * where we get a ctx, but it gets stolen and then
1488 * we fault when we try to run and so have to get
1489 * another ctx.
1490 */
1491 sfmmup->sfmmu_cext = 0;
1492 cnum = INVALID_CONTEXT;
1493
1494 /* initialize original physical page coloring bin */
1495 sfmmup->sfmmu_clrstart = get_color_start(as);
1496 #ifdef DEBUG
1497 if (tsb_random_size) {
1498 uint32_t randval = (uint32_t)gettick() >> 4;
1499 int size = randval % (tsb_max_growsize + 1);
1500
1501 /* chose a random tsb size for stress testing */
1502 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1503 TSB8K|TSB64K|TSB512K, 0, sfmmup);
1504 } else
1505 #endif /* DEBUG */
1506 (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1507 default_tsb_size,
1508 TSB8K|TSB64K|TSB512K, 0, sfmmup);
1509 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1510 ASSERT(sfmmup->sfmmu_tsb != NULL);
1511 }
1512
1513 ASSERT(max_mmu_ctxdoms > 0);
1514 for (i = 0; i < max_mmu_ctxdoms; i++) {
1515 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1516 sfmmup->sfmmu_ctxs[i].gnum = 0;
1517 }
1518
1519 for (i = 0; i < max_mmu_page_sizes; i++) {
1520 sfmmup->sfmmu_ttecnt[i] = 0;
1521 sfmmup->sfmmu_scdrttecnt[i] = 0;
1522 sfmmup->sfmmu_ismttecnt[i] = 0;
1523 sfmmup->sfmmu_scdismttecnt[i] = 0;
1524 sfmmup->sfmmu_pgsz[i] = TTE8K;
1525 }
1526 sfmmup->sfmmu_tsb0_4minflcnt = 0;
1527 sfmmup->sfmmu_iblk = NULL;
1528 sfmmup->sfmmu_ismhat = 0;
1529 sfmmup->sfmmu_scdhat = 0;
1530 sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1531 if (sfmmup == ksfmmup) {
1532 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1533 } else {
1534 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1535 }
1536 sfmmup->sfmmu_free = 0;
1537 sfmmup->sfmmu_rmstat = 0;
1538 sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1539 cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1540 sfmmup->sfmmu_srdp = NULL;
1541 SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1542 bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1543 sfmmup->sfmmu_scdp = NULL;
1544 sfmmup->sfmmu_scd_link.next = NULL;
1545 sfmmup->sfmmu_scd_link.prev = NULL;
1546 return (sfmmup);
1547 }
1548
1549 /*
1550 * Create per-MMU context domain kstats for a given MMU ctx.
1551 */
1552 static void
1553 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1554 {
1555 mmu_ctx_stat_t stat;
1556 kstat_t *mmu_kstat;
1557
1558 ASSERT(MUTEX_HELD(&cpu_lock));
1559 ASSERT(mmu_ctxp->mmu_kstat == NULL);
1560
1561 mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1562 "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1563
1564 if (mmu_kstat == NULL) {
1565 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1566 mmu_ctxp->mmu_idx);
1567 } else {
1568 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1569 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1570 kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1571 mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1572 mmu_ctxp->mmu_kstat = mmu_kstat;
1573 kstat_install(mmu_kstat);
1574 }
1575 }
1576
1577 /*
1578 * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1579 * context domain information for a given CPU. If a platform does not
1580 * specify that interface, then the function below is used instead to return
1581 * default information. The defaults are as follows:
1582 *
1583 * - The number of MMU context IDs supported on any CPU in the
1584 * system is 8K.
1585 * - There is one MMU context domain per CPU.
1586 */
1587 /*ARGSUSED*/
1588 static void
1589 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1590 {
1591 infop->mmu_nctxs = nctxs;
1592 infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1593 }
1594
1595 /*
1596 * Called during CPU initialization to set the MMU context-related information
1597 * for a CPU.
1598 *
1599 * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1600 */
1601 void
1602 sfmmu_cpu_init(cpu_t *cp)
1603 {
1604 mmu_ctx_info_t info;
1605 mmu_ctx_t *mmu_ctxp;
1606
1607 ASSERT(MUTEX_HELD(&cpu_lock));
1608
1609 if (&plat_cpuid_to_mmu_ctx_info == NULL)
1610 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1611 else
1612 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1613
1614 ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1615
1616 if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1617 /* Each mmu_ctx is cacheline aligned. */
1618 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1619 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1620
1621 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1622 (void *)ipltospl(DISP_LEVEL));
1623 mmu_ctxp->mmu_idx = info.mmu_idx;
1624 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1625 /*
1626 * Globally for lifetime of a system,
1627 * gnum must always increase.
1628 * mmu_saved_gnum is protected by the cpu_lock.
1629 */
1630 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1631 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1632
1633 sfmmu_mmu_kstat_create(mmu_ctxp);
1634
1635 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1636 } else {
1637 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1638 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1639 }
1640
1641 /*
1642 * The mmu_lock is acquired here to prevent races with
1643 * the wrap-around code.
1644 */
1645 mutex_enter(&mmu_ctxp->mmu_lock);
1646
1647
1648 mmu_ctxp->mmu_ncpus++;
1649 CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1650 CPU_MMU_IDX(cp) = info.mmu_idx;
1651 CPU_MMU_CTXP(cp) = mmu_ctxp;
1652
1653 mutex_exit(&mmu_ctxp->mmu_lock);
1654 }
1655
1656 static void
1657 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1658 {
1659 ASSERT(MUTEX_HELD(&cpu_lock));
1660 ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1661
1662 mutex_destroy(&mmu_ctxp->mmu_lock);
1663
1664 if (mmu_ctxp->mmu_kstat)
1665 kstat_delete(mmu_ctxp->mmu_kstat);
1666
1667 /* mmu_saved_gnum is protected by the cpu_lock. */
1668 if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1669 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1670
1671 kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1672 }
1673
1674 /*
1675 * Called to perform MMU context-related cleanup for a CPU.
1676 */
1677 void
1678 sfmmu_cpu_cleanup(cpu_t *cp)
1679 {
1680 mmu_ctx_t *mmu_ctxp;
1681
1682 ASSERT(MUTEX_HELD(&cpu_lock));
1683
1684 mmu_ctxp = CPU_MMU_CTXP(cp);
1685 ASSERT(mmu_ctxp != NULL);
1686
1687 /*
1688 * The mmu_lock is acquired here to prevent races with
1689 * the wrap-around code.
1690 */
1691 mutex_enter(&mmu_ctxp->mmu_lock);
1692
1693 CPU_MMU_CTXP(cp) = NULL;
1694
1695 CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1696 if (--mmu_ctxp->mmu_ncpus == 0) {
1697 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1698 mutex_exit(&mmu_ctxp->mmu_lock);
1699 sfmmu_ctxdom_free(mmu_ctxp);
1700 return;
1701 }
1702
1703 mutex_exit(&mmu_ctxp->mmu_lock);
1704 }
1705
1706 uint_t
1707 sfmmu_ctxdom_nctxs(int idx)
1708 {
1709 return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1710 }
1711
1712 #ifdef sun4v
1713 /*
1714 * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1715 * consistant after suspend/resume on system that can resume on a different
1716 * hardware than it was suspended.
1717 *
1718 * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1719 * from being allocated. It acquires all hat_locks, which blocks most access to
1720 * context data, except for a few cases that are handled separately or are
1721 * harmless. It wraps each domain to increment gnum and invalidate on-CPU
1722 * contexts, and forces cnum to its max. As a result of this call all user
1723 * threads that are running on CPUs trap and try to perform wrap around but
1724 * can't because hat_locks are taken. Threads that were not on CPUs but started
1725 * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1726 * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1727 * on hat_lock trying to wrap. sfmmu_ctxdom_lock() must be called before CPUs
1728 * are paused, else it could deadlock acquiring locks held by paused CPUs.
1729 *
1730 * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1731 * the CPUs that had them. It must be called after CPUs have been paused. This
1732 * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1733 * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1734 * runs with interrupts disabled. When CPUs are later resumed, they may enter
1735 * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1736 * return failure. Or, they will be blocked trying to acquire hat_lock. Thus
1737 * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1738 * accessing the old context domains.
1739 *
1740 * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1741 * allocates new context domains based on hardware layout. It initializes
1742 * every CPU that had context domain before migration to have one again.
1743 * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1744 * could deadlock acquiring locks held by paused CPUs.
1745 *
1746 * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1747 * acquire new context ids and continue execution.
1748 *
1749 * Therefore functions should be called in the following order:
1750 * suspend_routine()
1751 * sfmmu_ctxdom_lock()
1752 * pause_cpus()
1753 * suspend()
1754 * if (suspend failed)
1755 * sfmmu_ctxdom_unlock()
1756 * ...
1757 * sfmmu_ctxdom_remove()
1758 * resume_cpus()
1759 * sfmmu_ctxdom_update()
1760 * sfmmu_ctxdom_unlock()
1761 */
1762 static cpuset_t sfmmu_ctxdoms_pset;
1763
1764 void
1765 sfmmu_ctxdoms_remove()
1766 {
1767 processorid_t id;
1768 cpu_t *cp;
1769
1770 /*
1771 * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1772 * be restored post-migration. A CPU may be powered off and not have a
1773 * domain, for example.
1774 */
1775 CPUSET_ZERO(sfmmu_ctxdoms_pset);
1776
1777 for (id = 0; id < NCPU; id++) {
1778 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1779 CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1780 CPU_MMU_CTXP(cp) = NULL;
1781 }
1782 }
1783 }
1784
1785 void
1786 sfmmu_ctxdoms_lock(void)
1787 {
1788 int idx;
1789 mmu_ctx_t *mmu_ctxp;
1790
1791 sfmmu_hat_lock_all();
1792
1793 /*
1794 * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1795 * hat_lock is always taken before calling it.
1796 *
1797 * For each domain, set mmu_cnum to max so no more contexts can be
1798 * allocated, and wrap to flush on-CPU contexts and force threads to
1799 * acquire a new context when we later drop hat_lock after migration.
1800 * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1801 * but the latter uses CAS and will miscompare and not overwrite it.
1802 */
1803 kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1804 for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1805 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1806 mutex_enter(&mmu_ctxp->mmu_lock);
1807 mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1808 /* make sure updated cnum visible */
1809 membar_enter();
1810 mutex_exit(&mmu_ctxp->mmu_lock);
1811 sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1812 }
1813 }
1814 kpreempt_enable();
1815 }
1816
1817 void
1818 sfmmu_ctxdoms_unlock(void)
1819 {
1820 sfmmu_hat_unlock_all();
1821 }
1822
1823 void
1824 sfmmu_ctxdoms_update(void)
1825 {
1826 processorid_t id;
1827 cpu_t *cp;
1828 uint_t idx;
1829 mmu_ctx_t *mmu_ctxp;
1830
1831 /*
1832 * Free all context domains. As side effect, this increases
1833 * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1834 * init gnum in the new domains, which therefore will be larger than the
1835 * sfmmu gnum for any process, guaranteeing that every process will see
1836 * a new generation and allocate a new context regardless of what new
1837 * domain it runs in.
1838 */
1839 mutex_enter(&cpu_lock);
1840
1841 for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1842 if (mmu_ctxs_tbl[idx] != NULL) {
1843 mmu_ctxp = mmu_ctxs_tbl[idx];
1844 mmu_ctxs_tbl[idx] = NULL;
1845 sfmmu_ctxdom_free(mmu_ctxp);
1846 }
1847 }
1848
1849 for (id = 0; id < NCPU; id++) {
1850 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1851 (cp = cpu[id]) != NULL)
1852 sfmmu_cpu_init(cp);
1853 }
1854 mutex_exit(&cpu_lock);
1855 }
1856 #endif
1857
1858 /*
1859 * Hat_setup, makes an address space context the current active one.
1860 * In sfmmu this translates to setting the secondary context with the
1861 * corresponding context.
1862 */
1863 void
1864 hat_setup(struct hat *sfmmup, int allocflag)
1865 {
1866 hatlock_t *hatlockp;
1867
1868 /* Init needs some special treatment. */
1869 if (allocflag == HAT_INIT) {
1870 /*
1871 * Make sure that we have
1872 * 1. a TSB
1873 * 2. a valid ctx that doesn't get stolen after this point.
1874 */
1875 hatlockp = sfmmu_hat_enter(sfmmup);
1876
1877 /*
1878 * Swap in the TSB. hat_init() allocates tsbinfos without
1879 * TSBs, but we need one for init, since the kernel does some
1880 * special things to set up its stack and needs the TSB to
1881 * resolve page faults.
1882 */
1883 sfmmu_tsb_swapin(sfmmup, hatlockp);
1884
1885 sfmmu_get_ctx(sfmmup);
1886
1887 sfmmu_hat_exit(hatlockp);
1888 } else {
1889 ASSERT(allocflag == HAT_ALLOC);
1890
1891 hatlockp = sfmmu_hat_enter(sfmmup);
1892 kpreempt_disable();
1893
1894 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1895 /*
1896 * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1897 * pagesize bits don't matter in this case since we are passing
1898 * INVALID_CONTEXT to it.
1899 * Compatibility Note: hw takes care of MMU_SCONTEXT1
1900 */
1901 sfmmu_setctx_sec(INVALID_CONTEXT);
1902 sfmmu_clear_utsbinfo();
1903
1904 kpreempt_enable();
1905 sfmmu_hat_exit(hatlockp);
1906 }
1907 }
1908
1909 /*
1910 * Free all the translation resources for the specified address space.
1911 * Called from as_free when an address space is being destroyed.
1912 */
1913 void
1914 hat_free_start(struct hat *sfmmup)
1915 {
1916 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1917 ASSERT(sfmmup != ksfmmup);
1918
1919 sfmmup->sfmmu_free = 1;
1920 if (sfmmup->sfmmu_scdp != NULL) {
1921 sfmmu_leave_scd(sfmmup, 0);
1922 }
1923
1924 ASSERT(sfmmup->sfmmu_scdp == NULL);
1925 }
1926
1927 void
1928 hat_free_end(struct hat *sfmmup)
1929 {
1930 int i;
1931
1932 ASSERT(sfmmup->sfmmu_free == 1);
1933 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1934 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1935 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1936 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1937 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1938 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1939
1940 if (sfmmup->sfmmu_rmstat) {
1941 hat_freestat(sfmmup->sfmmu_as, NULL);
1942 }
1943
1944 while (sfmmup->sfmmu_tsb != NULL) {
1945 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1946 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1947 sfmmup->sfmmu_tsb = next;
1948 }
1949
1950 if (sfmmup->sfmmu_srdp != NULL) {
1951 sfmmu_leave_srd(sfmmup);
1952 ASSERT(sfmmup->sfmmu_srdp == NULL);
1953 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1954 if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1955 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1956 SFMMU_L2_HMERLINKS_SIZE);
1957 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1958 }
1959 }
1960 }
1961 sfmmu_free_sfmmu(sfmmup);
1962
1963 #ifdef DEBUG
1964 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1965 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1966 }
1967 #endif
1968
1969 kmem_cache_free(sfmmuid_cache, sfmmup);
1970 }
1971
1972 /*
1973 * Set up any translation structures, for the specified address space,
1974 * that are needed or preferred when the process is being swapped in.
1975 */
1976 /* ARGSUSED */
1977 void
1978 hat_swapin(struct hat *hat)
1979 {
1980 }
1981
1982 /*
1983 * Free all of the translation resources, for the specified address space,
1984 * that can be freed while the process is swapped out. Called from as_swapout.
1985 * Also, free up the ctx that this process was using.
1986 */
1987 void
1988 hat_swapout(struct hat *sfmmup)
1989 {
1990 struct hmehash_bucket *hmebp;
1991 struct hme_blk *hmeblkp;
1992 struct hme_blk *pr_hblk = NULL;
1993 struct hme_blk *nx_hblk;
1994 int i;
1995 struct hme_blk *list = NULL;
1996 hatlock_t *hatlockp;
1997 struct tsb_info *tsbinfop;
1998 struct free_tsb {
1999 struct free_tsb *next;
2000 struct tsb_info *tsbinfop;
2001 }; /* free list of TSBs */
2002 struct free_tsb *freelist, *last, *next;
2003
2004 SFMMU_STAT(sf_swapout);
2005
2006 /*
2007 * There is no way to go from an as to all its translations in sfmmu.
2008 * Here is one of the times when we take the big hit and traverse
2009 * the hash looking for hme_blks to free up. Not only do we free up
2010 * this as hme_blks but all those that are free. We are obviously
2011 * swapping because we need memory so let's free up as much
2012 * as we can.
2013 *
2014 * Note that we don't flush TLB/TSB here -- it's not necessary
2015 * because:
2016 * 1) we free the ctx we're using and throw away the TSB(s);
2017 * 2) processes aren't runnable while being swapped out.
2018 */
2019 ASSERT(sfmmup != KHATID);
2020 for (i = 0; i <= UHMEHASH_SZ; i++) {
2021 hmebp = &uhme_hash[i];
2022 SFMMU_HASH_LOCK(hmebp);
2023 hmeblkp = hmebp->hmeblkp;
2024 pr_hblk = NULL;
2025 while (hmeblkp) {
2026
2027 if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2028 !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2029 ASSERT(!hmeblkp->hblk_shared);
2030 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2031 (caddr_t)get_hblk_base(hmeblkp),
2032 get_hblk_endaddr(hmeblkp),
2033 NULL, HAT_UNLOAD);
2034 }
2035 nx_hblk = hmeblkp->hblk_next;
2036 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2037 ASSERT(!hmeblkp->hblk_lckcnt);
2038 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2039 &list, 0);
2040 } else {
2041 pr_hblk = hmeblkp;
2042 }
2043 hmeblkp = nx_hblk;
2044 }
2045 SFMMU_HASH_UNLOCK(hmebp);
2046 }
2047
2048 sfmmu_hblks_list_purge(&list, 0);
2049
2050 /*
2051 * Now free up the ctx so that others can reuse it.
2052 */
2053 hatlockp = sfmmu_hat_enter(sfmmup);
2054
2055 sfmmu_invalidate_ctx(sfmmup);
2056
2057 /*
2058 * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2059 * If TSBs were never swapped in, just return.
2060 * This implies that we don't support partial swapping
2061 * of TSBs -- either all are swapped out, or none are.
2062 *
2063 * We must hold the HAT lock here to prevent racing with another
2064 * thread trying to unmap TTEs from the TSB or running the post-
2065 * relocator after relocating the TSB's memory. Unfortunately, we
2066 * can't free memory while holding the HAT lock or we could
2067 * deadlock, so we build a list of TSBs to be freed after marking
2068 * the tsbinfos as swapped out and free them after dropping the
2069 * lock.
2070 */
2071 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2072 sfmmu_hat_exit(hatlockp);
2073 return;
2074 }
2075
2076 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2077 last = freelist = NULL;
2078 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2079 tsbinfop = tsbinfop->tsb_next) {
2080 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2081
2082 /*
2083 * Cast the TSB into a struct free_tsb and put it on the free
2084 * list.
2085 */
2086 if (freelist == NULL) {
2087 last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2088 } else {
2089 last->next = (struct free_tsb *)tsbinfop->tsb_va;
2090 last = last->next;
2091 }
2092 last->next = NULL;
2093 last->tsbinfop = tsbinfop;
2094 tsbinfop->tsb_flags |= TSB_SWAPPED;
2095 /*
2096 * Zero out the TTE to clear the valid bit.
2097 * Note we can't use a value like 0xbad because we want to
2098 * ensure diagnostic bits are NEVER set on TTEs that might
2099 * be loaded. The intent is to catch any invalid access
2100 * to the swapped TSB, such as a thread running with a valid
2101 * context without first calling sfmmu_tsb_swapin() to
2102 * allocate TSB memory.
2103 */
2104 tsbinfop->tsb_tte.ll = 0;
2105 }
2106
2107 /* Now we can drop the lock and free the TSB memory. */
2108 sfmmu_hat_exit(hatlockp);
2109 for (; freelist != NULL; freelist = next) {
2110 next = freelist->next;
2111 sfmmu_tsb_free(freelist->tsbinfop);
2112 }
2113 }
2114
2115 /*
2116 * Duplicate the translations of an as into another newas
2117 */
2118 /* ARGSUSED */
2119 int
2120 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2121 uint_t flag)
2122 {
2123 sf_srd_t *srdp;
2124 sf_scd_t *scdp;
2125 int i;
2126 extern uint_t get_color_start(struct as *);
2127
2128 ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2129 (flag == HAT_DUP_SRD));
2130 ASSERT(hat != ksfmmup);
2131 ASSERT(newhat != ksfmmup);
2132 ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2133
2134 if (flag == HAT_DUP_COW) {
2135 panic("hat_dup: HAT_DUP_COW not supported");
2136 }
2137
2138 if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2139 ASSERT(srdp->srd_evp != NULL);
2140 VN_HOLD(srdp->srd_evp);
2141 ASSERT(srdp->srd_refcnt > 0);
2142 newhat->sfmmu_srdp = srdp;
2143 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2144 }
2145
2146 /*
2147 * HAT_DUP_ALL flag is used after as duplication is done.
2148 */
2149 if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2150 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2151 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2152 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2153 newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2154 }
2155
2156 /* check if need to join scd */
2157 if ((scdp = hat->sfmmu_scdp) != NULL &&
2158 newhat->sfmmu_scdp != scdp) {
2159 int ret;
2160 SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2161 &scdp->scd_region_map, ret);
2162 ASSERT(ret);
2163 sfmmu_join_scd(scdp, newhat);
2164 ASSERT(newhat->sfmmu_scdp == scdp &&
2165 scdp->scd_refcnt >= 2);
2166 for (i = 0; i < max_mmu_page_sizes; i++) {
2167 newhat->sfmmu_ismttecnt[i] =
2168 hat->sfmmu_ismttecnt[i];
2169 newhat->sfmmu_scdismttecnt[i] =
2170 hat->sfmmu_scdismttecnt[i];
2171 }
2172 }
2173
2174 sfmmu_check_page_sizes(newhat, 1);
2175 }
2176
2177 if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2178 update_proc_pgcolorbase_after_fork != 0) {
2179 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2180 }
2181 return (0);
2182 }
2183
2184 void
2185 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2186 uint_t attr, uint_t flags)
2187 {
2188 hat_do_memload(hat, addr, pp, attr, flags,
2189 SFMMU_INVALID_SHMERID);
2190 }
2191
2192 void
2193 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2194 uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2195 {
2196 uint_t rid;
2197 if (rcookie == HAT_INVALID_REGION_COOKIE) {
2198 hat_do_memload(hat, addr, pp, attr, flags,
2199 SFMMU_INVALID_SHMERID);
2200 return;
2201 }
2202 rid = (uint_t)((uint64_t)rcookie);
2203 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2204 hat_do_memload(hat, addr, pp, attr, flags, rid);
2205 }
2206
2207 /*
2208 * Set up addr to map to page pp with protection prot.
2209 * As an optimization we also load the TSB with the
2210 * corresponding tte but it is no big deal if the tte gets kicked out.
2211 */
2212 static void
2213 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2214 uint_t attr, uint_t flags, uint_t rid)
2215 {
2216 tte_t tte;
2217
2218
2219 ASSERT(hat != NULL);
2220 ASSERT(PAGE_LOCKED(pp));
2221 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2222 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2223 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2224 SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2225
2226 if (PP_ISFREE(pp)) {
2227 panic("hat_memload: loading a mapping to free page %p",
2228 (void *)pp);
2229 }
2230
2231 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2232
2233 if (flags & ~SFMMU_LOAD_ALLFLAG)
2234 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2235 flags & ~SFMMU_LOAD_ALLFLAG);
2236
2237 if (hat->sfmmu_rmstat)
2238 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2239
2240 #if defined(SF_ERRATA_57)
2241 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2242 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2243 !(flags & HAT_LOAD_SHARE)) {
2244 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2245 " page executable");
2246 attr &= ~PROT_EXEC;
2247 }
2248 #endif
2249
2250 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2251 (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2252
2253 /*
2254 * Check TSB and TLB page sizes.
2255 */
2256 if ((flags & HAT_LOAD_SHARE) == 0) {
2257 sfmmu_check_page_sizes(hat, 1);
2258 }
2259 }
2260
2261 /*
2262 * hat_devload can be called to map real memory (e.g.
2263 * /dev/kmem) and even though hat_devload will determine pf is
2264 * for memory, it will be unable to get a shared lock on the
2265 * page (because someone else has it exclusively) and will
2266 * pass dp = NULL. If tteload doesn't get a non-NULL
2267 * page pointer it can't cache memory.
2268 */
2269 void
2270 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2271 uint_t attr, int flags)
2272 {
2273 tte_t tte;
2274 struct page *pp = NULL;
2275 int use_lgpg = 0;
2276
2277 ASSERT(hat != NULL);
2278
2279 ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2280 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2281 ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2282 if (len == 0)
2283 panic("hat_devload: zero len");
2284 if (flags & ~SFMMU_LOAD_ALLFLAG)
2285 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2286 flags & ~SFMMU_LOAD_ALLFLAG);
2287
2288 #if defined(SF_ERRATA_57)
2289 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2290 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2291 !(flags & HAT_LOAD_SHARE)) {
2292 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2293 " page executable");
2294 attr &= ~PROT_EXEC;
2295 }
2296 #endif
2297
2298 /*
2299 * If it's a memory page find its pp
2300 */
2301 if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2302 pp = page_numtopp_nolock(pfn);
2303 if (pp == NULL) {
2304 flags |= HAT_LOAD_NOCONSIST;
2305 } else {
2306 if (PP_ISFREE(pp)) {
2307 panic("hat_memload: loading "
2308 "a mapping to free page %p",
2309 (void *)pp);
2310 }
2311 if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2312 panic("hat_memload: loading a mapping "
2313 "to unlocked relocatable page %p",
2314 (void *)pp);
2315 }
2316 ASSERT(len == MMU_PAGESIZE);
2317 }
2318 }
2319
2320 if (hat->sfmmu_rmstat)
2321 hat_resvstat(len, hat->sfmmu_as, addr);
2322
2323 if (flags & HAT_LOAD_NOCONSIST) {
2324 attr |= SFMMU_UNCACHEVTTE;
2325 use_lgpg = 1;
2326 }
2327 if (!pf_is_memory(pfn)) {
2328 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2329 use_lgpg = 1;
2330 switch (attr & HAT_ORDER_MASK) {
2331 case HAT_STRICTORDER:
2332 case HAT_UNORDERED_OK:
2333 /*
2334 * we set the side effect bit for all non
2335 * memory mappings unless merging is ok
2336 */
2337 attr |= SFMMU_SIDEFFECT;
2338 break;
2339 case HAT_MERGING_OK:
2340 case HAT_LOADCACHING_OK:
2341 case HAT_STORECACHING_OK:
2342 break;
2343 default:
2344 panic("hat_devload: bad attr");
2345 break;
2346 }
2347 }
2348 while (len) {
2349 if (!use_lgpg) {
2350 sfmmu_memtte(&tte, pfn, attr, TTE8K);
2351 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2352 flags, SFMMU_INVALID_SHMERID);
2353 len -= MMU_PAGESIZE;
2354 addr += MMU_PAGESIZE;
2355 pfn++;
2356 continue;
2357 }
2358 /*
2359 * try to use large pages, check va/pa alignments
2360 * Note that 32M/256M page sizes are not (yet) supported.
2361 */
2362 if ((len >= MMU_PAGESIZE4M) &&
2363 !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2364 !(disable_large_pages & (1 << TTE4M)) &&
2365 !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2366 sfmmu_memtte(&tte, pfn, attr, TTE4M);
2367 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2368 flags, SFMMU_INVALID_SHMERID);
2369 len -= MMU_PAGESIZE4M;
2370 addr += MMU_PAGESIZE4M;
2371 pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2372 } else if ((len >= MMU_PAGESIZE512K) &&
2373 !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2374 !(disable_large_pages & (1 << TTE512K)) &&
2375 !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2376 sfmmu_memtte(&tte, pfn, attr, TTE512K);
2377 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2378 flags, SFMMU_INVALID_SHMERID);
2379 len -= MMU_PAGESIZE512K;
2380 addr += MMU_PAGESIZE512K;
2381 pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2382 } else if ((len >= MMU_PAGESIZE64K) &&
2383 !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2384 !(disable_large_pages & (1 << TTE64K)) &&
2385 !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2386 sfmmu_memtte(&tte, pfn, attr, TTE64K);
2387 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2388 flags, SFMMU_INVALID_SHMERID);
2389 len -= MMU_PAGESIZE64K;
2390 addr += MMU_PAGESIZE64K;
2391 pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2392 } else {
2393 sfmmu_memtte(&tte, pfn, attr, TTE8K);
2394 (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2395 flags, SFMMU_INVALID_SHMERID);
2396 len -= MMU_PAGESIZE;
2397 addr += MMU_PAGESIZE;
2398 pfn++;
2399 }
2400 }
2401
2402 /*
2403 * Check TSB and TLB page sizes.
2404 */
2405 if ((flags & HAT_LOAD_SHARE) == 0) {
2406 sfmmu_check_page_sizes(hat, 1);
2407 }
2408 }
2409
2410 void
2411 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2412 struct page **pps, uint_t attr, uint_t flags)
2413 {
2414 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2415 SFMMU_INVALID_SHMERID);
2416 }
2417
2418 void
2419 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2420 struct page **pps, uint_t attr, uint_t flags,
2421 hat_region_cookie_t rcookie)
2422 {
2423 uint_t rid;
2424 if (rcookie == HAT_INVALID_REGION_COOKIE) {
2425 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2426 SFMMU_INVALID_SHMERID);
2427 return;
2428 }
2429 rid = (uint_t)((uint64_t)rcookie);
2430 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2431 hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2432 }
2433
2434 /*
2435 * Map the largest extend possible out of the page array. The array may NOT
2436 * be in order. The largest possible mapping a page can have
2437 * is specified in the p_szc field. The p_szc field
2438 * cannot change as long as there any mappings (large or small)
2439 * to any of the pages that make up the large page. (ie. any
2440 * promotion/demotion of page size is not up to the hat but up to
2441 * the page free list manager). The array
2442 * should consist of properly aligned contigous pages that are
2443 * part of a big page for a large mapping to be created.
2444 */
2445 static void
2446 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2447 struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2448 {
2449 int ttesz;
2450 size_t mapsz;
2451 pgcnt_t numpg, npgs;
2452 tte_t tte;
2453 page_t *pp;
2454 uint_t large_pages_disable;
2455
2456 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2457 SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2458
2459 if (hat->sfmmu_rmstat)
2460 hat_resvstat(len, hat->sfmmu_as, addr);
2461
2462 #if defined(SF_ERRATA_57)
2463 if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2464 (addr < errata57_limit) && (attr & PROT_EXEC) &&
2465 !(flags & HAT_LOAD_SHARE)) {
2466 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2467 "user page executable");
2468 attr &= ~PROT_EXEC;
2469 }
2470 #endif
2471
2472 /* Get number of pages */
2473 npgs = len >> MMU_PAGESHIFT;
2474
2475 if (flags & HAT_LOAD_SHARE) {
2476 large_pages_disable = disable_ism_large_pages;
2477 } else {
2478 large_pages_disable = disable_large_pages;
2479 }
2480
2481 if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2482 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2483 rid);
2484 return;
2485 }
2486
2487 while (npgs >= NHMENTS) {
2488 pp = *pps;
2489 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2490 /*
2491 * Check if this page size is disabled.
2492 */
2493 if (large_pages_disable & (1 << ttesz))
2494 continue;
2495
2496 numpg = TTEPAGES(ttesz);
2497 mapsz = numpg << MMU_PAGESHIFT;
2498 if ((npgs >= numpg) &&
2499 IS_P2ALIGNED(addr, mapsz) &&
2500 IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2501 /*
2502 * At this point we have enough pages and
2503 * we know the virtual address and the pfn
2504 * are properly aligned. We still need
2505 * to check for physical contiguity but since
2506 * it is very likely that this is the case
2507 * we will assume they are so and undo
2508 * the request if necessary. It would
2509 * be great if we could get a hint flag
2510 * like HAT_CONTIG which would tell us
2511 * the pages are contigous for sure.
2512 */
2513 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2514 attr, ttesz);
2515 if (!sfmmu_tteload_array(hat, &tte, addr,
2516 pps, flags, rid)) {
2517 break;
2518 }
2519 }
2520 }
2521 if (ttesz == TTE8K) {
2522 /*
2523 * We were not able to map array using a large page
2524 * batch a hmeblk or fraction at a time.
2525 */
2526 numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2527 & (NHMENTS-1);
2528 numpg = NHMENTS - numpg;
2529 ASSERT(numpg <= npgs);
2530 mapsz = numpg * MMU_PAGESIZE;
2531 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2532 numpg, rid);
2533 }
2534 addr += mapsz;
2535 npgs -= numpg;
2536 pps += numpg;
2537 }
2538
2539 if (npgs) {
2540 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2541 rid);
2542 }
2543
2544 /*
2545 * Check TSB and TLB page sizes.
2546 */
2547 if ((flags & HAT_LOAD_SHARE) == 0) {
2548 sfmmu_check_page_sizes(hat, 1);
2549 }
2550 }
2551
2552 /*
2553 * Function tries to batch 8K pages into the same hme blk.
2554 */
2555 static void
2556 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2557 uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2558 {
2559 tte_t tte;
2560 page_t *pp;
2561 struct hmehash_bucket *hmebp;
2562 struct hme_blk *hmeblkp;
2563 int index;
2564
2565 while (npgs) {
2566 /*
2567 * Acquire the hash bucket.
2568 */
2569 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2570 rid);
2571 ASSERT(hmebp);
2572
2573 /*
2574 * Find the hment block.
2575 */
2576 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2577 TTE8K, flags, rid);
2578 ASSERT(hmeblkp);
2579
2580 do {
2581 /*
2582 * Make the tte.
2583 */
2584 pp = *pps;
2585 sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2586
2587 /*
2588 * Add the translation.
2589 */
2590 (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2591 vaddr, pps, flags, rid);
2592
2593 /*
2594 * Goto next page.
2595 */
2596 pps++;
2597 npgs--;
2598
2599 /*
2600 * Goto next address.
2601 */
2602 vaddr += MMU_PAGESIZE;
2603
2604 /*
2605 * Don't crossover into a different hmentblk.
2606 */
2607 index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2608 (NHMENTS-1));
2609
2610 } while (index != 0 && npgs != 0);
2611
2612 /*
2613 * Release the hash bucket.
2614 */
2615
2616 sfmmu_tteload_release_hashbucket(hmebp);
2617 }
2618 }
2619
2620 /*
2621 * Construct a tte for a page:
2622 *
2623 * tte_valid = 1
2624 * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2625 * tte_size = size
2626 * tte_nfo = attr & HAT_NOFAULT
2627 * tte_ie = attr & HAT_STRUCTURE_LE
2628 * tte_hmenum = hmenum
2629 * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2630 * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2631 * tte_ref = 1 (optimization)
2632 * tte_wr_perm = attr & PROT_WRITE;
2633 * tte_no_sync = attr & HAT_NOSYNC
2634 * tte_lock = attr & SFMMU_LOCKTTE
2635 * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2636 * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2637 * tte_e = attr & SFMMU_SIDEFFECT
2638 * tte_priv = !(attr & PROT_USER)
2639 * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2640 * tte_glb = 0
2641 */
2642 void
2643 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2644 {
2645 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2646
2647 ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2648 ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2649
2650 if (TTE_IS_NOSYNC(ttep)) {
2651 TTE_SET_REF(ttep);
2652 if (TTE_IS_WRITABLE(ttep)) {
2653 TTE_SET_MOD(ttep);
2654 }
2655 }
2656 if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2657 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2658 }
2659 }
2660
2661 /*
2662 * This function will add a translation to the hme_blk and allocate the
2663 * hme_blk if one does not exist.
2664 * If a page structure is specified then it will add the
2665 * corresponding hment to the mapping list.
2666 * It will also update the hmenum field for the tte.
2667 *
2668 * Currently this function is only used for kernel mappings.
2669 * So pass invalid region to sfmmu_tteload_array().
2670 */
2671 void
2672 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2673 uint_t flags)
2674 {
2675 ASSERT(sfmmup == ksfmmup);
2676 (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2677 SFMMU_INVALID_SHMERID);
2678 }
2679
2680 /*
2681 * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2682 * Assumes that a particular page size may only be resident in one TSB.
2683 */
2684 static void
2685 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2686 {
2687 struct tsb_info *tsbinfop = NULL;
2688 uint64_t tag;
2689 struct tsbe *tsbe_addr;
2690 uint64_t tsb_base;
2691 uint_t tsb_size;
2692 int vpshift = MMU_PAGESHIFT;
2693 int phys = 0;
2694
2695 if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2696 phys = ktsb_phys;
2697 if (ttesz >= TTE4M) {
2698 #ifndef sun4v
2699 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2700 #endif
2701 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2702 tsb_size = ktsb4m_szcode;
2703 } else {
2704 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2705 tsb_size = ktsb_szcode;
2706 }
2707 } else {
2708 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2709
2710 /*
2711 * If there isn't a TSB for this page size, or the TSB is
2712 * swapped out, there is nothing to do. Note that the latter
2713 * case seems impossible but can occur if hat_pageunload()
2714 * is called on an ISM mapping while the process is swapped
2715 * out.
2716 */
2717 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2718 return;
2719
2720 /*
2721 * If another thread is in the middle of relocating a TSB
2722 * we can't unload the entry so set a flag so that the
2723 * TSB will be flushed before it can be accessed by the
2724 * process.
2725 */
2726 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2727 if (ttep == NULL)
2728 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2729 return;
2730 }
2731 #if defined(UTSB_PHYS)
2732 phys = 1;
2733 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2734 #else
2735 tsb_base = (uint64_t)tsbinfop->tsb_va;
2736 #endif
2737 tsb_size = tsbinfop->tsb_szc;
2738 }
2739 if (ttesz >= TTE4M)
2740 vpshift = MMU_PAGESHIFT4M;
2741
2742 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2743 tag = sfmmu_make_tsbtag(vaddr);
2744
2745 if (ttep == NULL) {
2746 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2747 } else {
2748 if (ttesz >= TTE4M) {
2749 SFMMU_STAT(sf_tsb_load4m);
2750 } else {
2751 SFMMU_STAT(sf_tsb_load8k);
2752 }
2753
2754 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2755 }
2756 }
2757
2758 /*
2759 * Unmap all entries from [start, end) matching the given page size.
2760 *
2761 * This function is used primarily to unmap replicated 64K or 512K entries
2762 * from the TSB that are inserted using the base page size TSB pointer, but
2763 * it may also be called to unmap a range of addresses from the TSB.
2764 */
2765 void
2766 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2767 {
2768 struct tsb_info *tsbinfop;
2769 uint64_t tag;
2770 struct tsbe *tsbe_addr;
2771 caddr_t vaddr;
2772 uint64_t tsb_base;
2773 int vpshift, vpgsz;
2774 uint_t tsb_size;
2775 int phys = 0;
2776
2777 /*
2778 * Assumptions:
2779 * If ttesz == 8K, 64K or 512K, we walk through the range 8K
2780 * at a time shooting down any valid entries we encounter.
2781 *
2782 * If ttesz >= 4M we walk the range 4M at a time shooting
2783 * down any valid mappings we find.
2784 */
2785 if (sfmmup == ksfmmup) {
2786 phys = ktsb_phys;
2787 if (ttesz >= TTE4M) {
2788 #ifndef sun4v
2789 ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2790 #endif
2791 tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2792 tsb_size = ktsb4m_szcode;
2793 } else {
2794 tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2795 tsb_size = ktsb_szcode;
2796 }
2797 } else {
2798 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2799
2800 /*
2801 * If there isn't a TSB for this page size, or the TSB is
2802 * swapped out, there is nothing to do. Note that the latter
2803 * case seems impossible but can occur if hat_pageunload()
2804 * is called on an ISM mapping while the process is swapped
2805 * out.
2806 */
2807 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2808 return;
2809
2810 /*
2811 * If another thread is in the middle of relocating a TSB
2812 * we can't unload the entry so set a flag so that the
2813 * TSB will be flushed before it can be accessed by the
2814 * process.
2815 */
2816 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2817 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2818 return;
2819 }
2820 #if defined(UTSB_PHYS)
2821 phys = 1;
2822 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2823 #else
2824 tsb_base = (uint64_t)tsbinfop->tsb_va;
2825 #endif
2826 tsb_size = tsbinfop->tsb_szc;
2827 }
2828 if (ttesz >= TTE4M) {
2829 vpshift = MMU_PAGESHIFT4M;
2830 vpgsz = MMU_PAGESIZE4M;
2831 } else {
2832 vpshift = MMU_PAGESHIFT;
2833 vpgsz = MMU_PAGESIZE;
2834 }
2835
2836 for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2837 tag = sfmmu_make_tsbtag(vaddr);
2838 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2839 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2840 }
2841 }
2842
2843 /*
2844 * Select the optimum TSB size given the number of mappings
2845 * that need to be cached.
2846 */
2847 static int
2848 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2849 {
2850 int szc = 0;
2851
2852 #ifdef DEBUG
2853 if (tsb_grow_stress) {
2854 uint32_t randval = (uint32_t)gettick() >> 4;
2855 return (randval % (tsb_max_growsize + 1));
2856 }
2857 #endif /* DEBUG */
2858
2859 while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2860 szc++;
2861 return (szc);
2862 }
2863
2864 /*
2865 * This function will add a translation to the hme_blk and allocate the
2866 * hme_blk if one does not exist.
2867 * If a page structure is specified then it will add the
2868 * corresponding hment to the mapping list.
2869 * It will also update the hmenum field for the tte.
2870 * Furthermore, it attempts to create a large page translation
2871 * for <addr,hat> at page array pps. It assumes addr and first
2872 * pp is correctly aligned. It returns 0 if successful and 1 otherwise.
2873 */
2874 static int
2875 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2876 page_t **pps, uint_t flags, uint_t rid)
2877 {
2878 struct hmehash_bucket *hmebp;
2879 struct hme_blk *hmeblkp;
2880 int ret;
2881 uint_t size;
2882
2883 /*
2884 * Get mapping size.
2885 */
2886 size = TTE_CSZ(ttep);
2887 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2888
2889 /*
2890 * Acquire the hash bucket.
2891 */
2892 hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2893 ASSERT(hmebp);
2894
2895 /*
2896 * Find the hment block.
2897 */
2898 hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2899 rid);
2900 ASSERT(hmeblkp);
2901
2902 /*
2903 * Add the translation.
2904 */
2905 ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2906 rid);
2907
2908 /*
2909 * Release the hash bucket.
2910 */
2911 sfmmu_tteload_release_hashbucket(hmebp);
2912
2913 return (ret);
2914 }
2915
2916 /*
2917 * Function locks and returns a pointer to the hash bucket for vaddr and size.
2918 */
2919 static struct hmehash_bucket *
2920 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2921 uint_t rid)
2922 {
2923 struct hmehash_bucket *hmebp;
2924 int hmeshift;
2925 void *htagid = sfmmutohtagid(sfmmup, rid);
2926
2927 ASSERT(htagid != NULL);
2928
2929 hmeshift = HME_HASH_SHIFT(size);
2930
2931 hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2932
2933 SFMMU_HASH_LOCK(hmebp);
2934
2935 return (hmebp);
2936 }
2937
2938 /*
2939 * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2940 * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2941 * allocated.
2942 */
2943 static struct hme_blk *
2944 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2945 caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2946 {
2947 hmeblk_tag hblktag;
2948 int hmeshift;
2949 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2950
2951 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2952
2953 hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2954 ASSERT(hblktag.htag_id != NULL);
2955 hmeshift = HME_HASH_SHIFT(size);
2956 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2957 hblktag.htag_rehash = HME_HASH_REHASH(size);
2958 hblktag.htag_rid = rid;
2959
2960 ttearray_realloc:
2961
2962 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2963
2964 /*
2965 * We block until hblk_reserve_lock is released; it's held by
2966 * the thread, temporarily using hblk_reserve, until hblk_reserve is
2967 * replaced by a hblk from sfmmu8_cache.
2968 */
2969 if (hmeblkp == (struct hme_blk *)hblk_reserve &&
2970 hblk_reserve_thread != curthread) {
2971 SFMMU_HASH_UNLOCK(hmebp);
2972 mutex_enter(&hblk_reserve_lock);
2973 mutex_exit(&hblk_reserve_lock);
2974 SFMMU_STAT(sf_hblk_reserve_hit);
2975 SFMMU_HASH_LOCK(hmebp);
2976 goto ttearray_realloc;
2977 }
2978
2979 if (hmeblkp == NULL) {
2980 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
2981 hblktag, flags, rid);
2982 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2983 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2984 } else {
2985 /*
2986 * It is possible for 8k and 64k hblks to collide since they
2987 * have the same rehash value. This is because we
2988 * lazily free hblks and 8K/64K blks could be lingering.
2989 * If we find size mismatch we free the block and & try again.
2990 */
2991 if (get_hblk_ttesz(hmeblkp) != size) {
2992 ASSERT(!hmeblkp->hblk_vcnt);
2993 ASSERT(!hmeblkp->hblk_hmecnt);
2994 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2995 &list, 0);
2996 goto ttearray_realloc;
2997 }
2998 if (hmeblkp->hblk_shw_bit) {
2999 /*
3000 * if the hblk was previously used as a shadow hblk then
3001 * we will change it to a normal hblk
3002 */
3003 ASSERT(!hmeblkp->hblk_shared);
3004 if (hmeblkp->hblk_shw_mask) {
3005 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3006 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3007 goto ttearray_realloc;
3008 } else {
3009 hmeblkp->hblk_shw_bit = 0;
3010 }
3011 }
3012 SFMMU_STAT(sf_hblk_hit);
3013 }
3014
3015 /*
3016 * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3017 * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3018 * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3019 * just add these hmeblks to the per-cpu pending queue.
3020 */
3021 sfmmu_hblks_list_purge(&list, 1);
3022
3023 ASSERT(get_hblk_ttesz(hmeblkp) == size);
3024 ASSERT(!hmeblkp->hblk_shw_bit);
3025 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3026 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3027 ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3028
3029 return (hmeblkp);
3030 }
3031
3032 /*
3033 * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3034 * otherwise.
3035 */
3036 static int
3037 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3038 caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3039 {
3040 page_t *pp = *pps;
3041 int hmenum, size, remap;
3042 tte_t tteold, flush_tte;
3043 #ifdef DEBUG
3044 tte_t orig_old;
3045 #endif /* DEBUG */
3046 struct sf_hment *sfhme;
3047 kmutex_t *pml, *pmtx;
3048 hatlock_t *hatlockp;
3049 int myflt;
3050
3051 /*
3052 * remove this panic when we decide to let user virtual address
3053 * space be >= USERLIMIT.
3054 */
3055 if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3056 panic("user addr %p in kernel space", (void *)vaddr);
3057 #if defined(TTE_IS_GLOBAL)
3058 if (TTE_IS_GLOBAL(ttep))
3059 panic("sfmmu_tteload: creating global tte");
3060 #endif
3061
3062 #ifdef DEBUG
3063 if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3064 !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3065 panic("sfmmu_tteload: non cacheable memory tte");
3066 #endif /* DEBUG */
3067
3068 /* don't simulate dirty bit for writeable ISM/DISM mappings */
3069 if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3070 TTE_SET_REF(ttep);
3071 TTE_SET_MOD(ttep);
3072 }
3073
3074 if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3075 !TTE_IS_MOD(ttep)) {
3076 /*
3077 * Don't load TSB for dummy as in ISM. Also don't preload
3078 * the TSB if the TTE isn't writable since we're likely to
3079 * fault on it again -- preloading can be fairly expensive.
3080 */
3081 flags |= SFMMU_NO_TSBLOAD;
3082 }
3083
3084 size = TTE_CSZ(ttep);
3085 switch (size) {
3086 case TTE8K:
3087 SFMMU_STAT(sf_tteload8k);
3088 break;
3089 case TTE64K:
3090 SFMMU_STAT(sf_tteload64k);
3091 break;
3092 case TTE512K:
3093 SFMMU_STAT(sf_tteload512k);
3094 break;
3095 case TTE4M:
3096 SFMMU_STAT(sf_tteload4m);
3097 break;
3098 case (TTE32M):
3099 SFMMU_STAT(sf_tteload32m);
3100 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3101 break;
3102 case (TTE256M):
3103 SFMMU_STAT(sf_tteload256m);
3104 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3105 break;
3106 }
3107
3108 ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3109 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3110 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3111 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3112
3113 HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3114
3115 /*
3116 * Need to grab mlist lock here so that pageunload
3117 * will not change tte behind us.
3118 */
3119 if (pp) {
3120 pml = sfmmu_mlist_enter(pp);
3121 }
3122
3123 sfmmu_copytte(&sfhme->hme_tte, &tteold);
3124 /*
3125 * Look for corresponding hment and if valid verify
3126 * pfns are equal.
3127 */
3128 remap = TTE_IS_VALID(&tteold);
3129 if (remap) {
3130 pfn_t new_pfn, old_pfn;
3131
3132 old_pfn = TTE_TO_PFN(vaddr, &tteold);
3133 new_pfn = TTE_TO_PFN(vaddr, ttep);
3134
3135 if (flags & HAT_LOAD_REMAP) {
3136 /* make sure we are remapping same type of pages */
3137 if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3138 panic("sfmmu_tteload - tte remap io<->memory");
3139 }
3140 if (old_pfn != new_pfn &&
3141 (pp != NULL || sfhme->hme_page != NULL)) {
3142 panic("sfmmu_tteload - tte remap pp != NULL");
3143 }
3144 } else if (old_pfn != new_pfn) {
3145 panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3146 (void *)hmeblkp);
3147 }
3148 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3149 }
3150
3151 if (pp) {
3152 if (size == TTE8K) {
3153 #ifdef VAC
3154 /*
3155 * Handle VAC consistency
3156 */
3157 if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3158 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3159 }
3160 #endif
3161
3162 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3163 pmtx = sfmmu_page_enter(pp);
3164 PP_CLRRO(pp);
3165 sfmmu_page_exit(pmtx);
3166 } else if (!PP_ISMAPPED(pp) &&
3167 (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3168 pmtx = sfmmu_page_enter(pp);
3169 if (!(PP_ISMOD(pp))) {
3170 PP_SETRO(pp);
3171 }
3172 sfmmu_page_exit(pmtx);
3173 }
3174
3175 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3176 /*
3177 * sfmmu_pagearray_setup failed so return
3178 */
3179 sfmmu_mlist_exit(pml);
3180 return (1);
3181 }
3182 }
3183
3184 /*
3185 * Make sure hment is not on a mapping list.
3186 */
3187 ASSERT(remap || (sfhme->hme_page == NULL));
3188
3189 /* if it is not a remap then hme->next better be NULL */
3190 ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3191
3192 if (flags & HAT_LOAD_LOCK) {
3193 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3194 panic("too high lckcnt-hmeblk %p",
3195 (void *)hmeblkp);
3196 }
3197 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3198
3199 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3200 }
3201
3202 #ifdef VAC
3203 if (pp && PP_ISNC(pp)) {
3204 /*
3205 * If the physical page is marked to be uncacheable, like
3206 * by a vac conflict, make sure the new mapping is also
3207 * uncacheable.
3208 */
3209 TTE_CLR_VCACHEABLE(ttep);
3210 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3211 }
3212 #endif
3213 ttep->tte_hmenum = hmenum;
3214
3215 #ifdef DEBUG
3216 orig_old = tteold;
3217 #endif /* DEBUG */
3218
3219 while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3220 if ((sfmmup == KHATID) &&
3221 (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3222 sfmmu_copytte(&sfhme->hme_tte, &tteold);
3223 }
3224 #ifdef DEBUG
3225 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3226 #endif /* DEBUG */
3227 }
3228 ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3229
3230 if (!TTE_IS_VALID(&tteold)) {
3231
3232 atomic_inc_16(&hmeblkp->hblk_vcnt);
3233 if (rid == SFMMU_INVALID_SHMERID) {
3234 atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3235 } else {
3236 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3237 sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3238 /*
3239 * We already accounted for region ttecnt's in sfmmu
3240 * during hat_join_region() processing. Here we
3241 * only update ttecnt's in region struture.
3242 */
3243 atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3244 }
3245 }
3246
3247 myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3248 if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3249 sfmmup != ksfmmup) {
3250 uchar_t tteflag = 1 << size;
3251 if (rid == SFMMU_INVALID_SHMERID) {
3252 if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3253 hatlockp = sfmmu_hat_enter(sfmmup);
3254 sfmmup->sfmmu_tteflags |= tteflag;
3255 sfmmu_hat_exit(hatlockp);
3256 }
3257 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3258 hatlockp = sfmmu_hat_enter(sfmmup);
3259 sfmmup->sfmmu_rtteflags |= tteflag;
3260 sfmmu_hat_exit(hatlockp);
3261 }
3262 /*
3263 * Update the current CPU tsbmiss area, so the current thread
3264 * won't need to take the tsbmiss for the new pagesize.
3265 * The other threads in the process will update their tsb
3266 * miss area lazily in sfmmu_tsbmiss_exception() when they
3267 * fail to find the translation for a newly added pagesize.
3268 */
3269 if (size > TTE64K && myflt) {
3270 struct tsbmiss *tsbmp;
3271 kpreempt_disable();
3272 tsbmp = &tsbmiss_area[CPU->cpu_id];
3273 if (rid == SFMMU_INVALID_SHMERID) {
3274 if (!(tsbmp->uhat_tteflags & tteflag)) {
3275 tsbmp->uhat_tteflags |= tteflag;
3276 }
3277 } else {
3278 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3279 tsbmp->uhat_rtteflags |= tteflag;
3280 }
3281 }
3282 kpreempt_enable();
3283 }
3284 }
3285
3286 if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3287 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3288 hatlockp = sfmmu_hat_enter(sfmmup);
3289 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3290 sfmmu_hat_exit(hatlockp);
3291 }
3292
3293 flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3294 hw_tte.tte_intlo;
3295 flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3296 hw_tte.tte_inthi;
3297
3298 if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3299 /*
3300 * If remap and new tte differs from old tte we need
3301 * to sync the mod bit and flush TLB/TSB. We don't
3302 * need to sync ref bit because we currently always set
3303 * ref bit in tteload.
3304 */
3305 ASSERT(TTE_IS_REF(ttep));
3306 if (TTE_IS_MOD(&tteold)) {
3307 sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3308 }
3309 /*
3310 * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3311 * hmes are only used for read only text. Adding this code for
3312 * completeness and future use of shared hmeblks with writable
3313 * mappings of VMODSORT vnodes.
3314 */
3315 if (hmeblkp->hblk_shared) {
3316 cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3317 sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3318 xt_sync(cpuset);
3319 SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3320 } else {
3321 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3322 xt_sync(sfmmup->sfmmu_cpusran);
3323 }
3324 }
3325
3326 if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3327 /*
3328 * We only preload 8K and 4M mappings into the TSB, since
3329 * 64K and 512K mappings are replicated and hence don't
3330 * have a single, unique TSB entry. Ditto for 32M/256M.
3331 */
3332 if (size == TTE8K || size == TTE4M) {
3333 sf_scd_t *scdp;
3334 hatlockp = sfmmu_hat_enter(sfmmup);
3335 /*
3336 * Don't preload private TSB if the mapping is used
3337 * by the shctx in the SCD.
3338 */
3339 scdp = sfmmup->sfmmu_scdp;
3340 if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3341 !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3342 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3343 size);
3344 }
3345 sfmmu_hat_exit(hatlockp);
3346 }
3347 }
3348 if (pp) {
3349 if (!remap) {
3350 HME_ADD(sfhme, pp);
3351 atomic_inc_16(&hmeblkp->hblk_hmecnt);
3352 ASSERT(hmeblkp->hblk_hmecnt > 0);
3353
3354 /*
3355 * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3356 * see pageunload() for comment.
3357 */
3358 }
3359 sfmmu_mlist_exit(pml);
3360 }
3361
3362 return (0);
3363 }
3364 /*
3365 * Function unlocks hash bucket.
3366 */
3367 static void
3368 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3369 {
3370 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3371 SFMMU_HASH_UNLOCK(hmebp);
3372 }
3373
3374 /*
3375 * function which checks and sets up page array for a large
3376 * translation. Will set p_vcolor, p_index, p_ro fields.
3377 * Assumes addr and pfnum of first page are properly aligned.
3378 * Will check for physical contiguity. If check fails it return
3379 * non null.
3380 */
3381 static int
3382 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3383 {
3384 int i, index, ttesz;
3385 pfn_t pfnum;
3386 pgcnt_t npgs;
3387 page_t *pp, *pp1;
3388 kmutex_t *pmtx;
3389 #ifdef VAC
3390 int osz;
3391 int cflags = 0;
3392 int vac_err = 0;
3393 #endif
3394 int newidx = 0;
3395
3396 ttesz = TTE_CSZ(ttep);
3397
3398 ASSERT(ttesz > TTE8K);
3399
3400 npgs = TTEPAGES(ttesz);
3401 index = PAGESZ_TO_INDEX(ttesz);
3402
3403 pfnum = (*pps)->p_pagenum;
3404 ASSERT(IS_P2ALIGNED(pfnum, npgs));
3405
3406 /*
3407 * Save the first pp so we can do HAT_TMPNC at the end.
3408 */
3409 pp1 = *pps;
3410 #ifdef VAC
3411 osz = fnd_mapping_sz(pp1);
3412 #endif
3413
3414 for (i = 0; i < npgs; i++, pps++) {
3415 pp = *pps;
3416 ASSERT(PAGE_LOCKED(pp));
3417 ASSERT(pp->p_szc >= ttesz);
3418 ASSERT(pp->p_szc == pp1->p_szc);
3419 ASSERT(sfmmu_mlist_held(pp));
3420
3421 /*
3422 * XXX is it possible to maintain P_RO on the root only?
3423 */
3424 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3425 pmtx = sfmmu_page_enter(pp);
3426 PP_CLRRO(pp);
3427 sfmmu_page_exit(pmtx);
3428 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3429 !PP_ISMOD(pp)) {
3430 pmtx = sfmmu_page_enter(pp);
3431 if (!(PP_ISMOD(pp))) {
3432 PP_SETRO(pp);
3433 }
3434 sfmmu_page_exit(pmtx);
3435 }
3436
3437 /*
3438 * If this is a remap we skip vac & contiguity checks.
3439 */
3440 if (remap)
3441 continue;
3442
3443 /*
3444 * set p_vcolor and detect any vac conflicts.
3445 */
3446 #ifdef VAC
3447 if (vac_err == 0) {
3448 vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3449
3450 }
3451 #endif
3452
3453 /*
3454 * Save current index in case we need to undo it.
3455 * Note: "PAGESZ_TO_INDEX(sz) (1 << (sz))"
3456 * "SFMMU_INDEX_SHIFT 6"
3457 * "SFMMU_INDEX_MASK ((1 << SFMMU_INDEX_SHIFT) - 1)"
3458 * "PP_MAPINDEX(p_index) (p_index & SFMMU_INDEX_MASK)"
3459 *
3460 * So: index = PAGESZ_TO_INDEX(ttesz);
3461 * if ttesz == 1 then index = 0x2
3462 * 2 then index = 0x4
3463 * 3 then index = 0x8
3464 * 4 then index = 0x10
3465 * 5 then index = 0x20
3466 * The code below checks if it's a new pagesize (ie, newidx)
3467 * in case we need to take it back out of p_index,
3468 * and then or's the new index into the existing index.
3469 */
3470 if ((PP_MAPINDEX(pp) & index) == 0)
3471 newidx = 1;
3472 pp->p_index = (PP_MAPINDEX(pp) | index);
3473
3474 /*
3475 * contiguity check
3476 */
3477 if (pp->p_pagenum != pfnum) {
3478 /*
3479 * If we fail the contiguity test then
3480 * the only thing we need to fix is the p_index field.
3481 * We might get a few extra flushes but since this
3482 * path is rare that is ok. The p_ro field will
3483 * get automatically fixed on the next tteload to
3484 * the page. NO TNC bit is set yet.
3485 */
3486 while (i >= 0) {
3487 pp = *pps;
3488 if (newidx)
3489 pp->p_index = (PP_MAPINDEX(pp) &
3490 ~index);
3491 pps--;
3492 i--;
3493 }
3494 return (1);
3495 }
3496 pfnum++;
3497 addr += MMU_PAGESIZE;
3498 }
3499
3500 #ifdef VAC
3501 if (vac_err) {
3502 if (ttesz > osz) {
3503 /*
3504 * There are some smaller mappings that causes vac
3505 * conflicts. Convert all existing small mappings to
3506 * TNC.
3507 */
3508 SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3509 sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3510 npgs);
3511 } else {
3512 /* EMPTY */
3513 /*
3514 * If there exists an big page mapping,
3515 * that means the whole existing big page
3516 * has TNC setting already. No need to covert to
3517 * TNC again.
3518 */
3519 ASSERT(PP_ISTNC(pp1));
3520 }
3521 }
3522 #endif /* VAC */
3523
3524 return (0);
3525 }
3526
3527 #ifdef VAC
3528 /*
3529 * Routine that detects vac consistency for a large page. It also
3530 * sets virtual color for all pp's for this big mapping.
3531 */
3532 static int
3533 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3534 {
3535 int vcolor, ocolor;
3536
3537 ASSERT(sfmmu_mlist_held(pp));
3538
3539 if (PP_ISNC(pp)) {
3540 return (HAT_TMPNC);
3541 }
3542
3543 vcolor = addr_to_vcolor(addr);
3544 if (PP_NEWPAGE(pp)) {
3545 PP_SET_VCOLOR(pp, vcolor);
3546 return (0);
3547 }
3548
3549 ocolor = PP_GET_VCOLOR(pp);
3550 if (ocolor == vcolor) {
3551 return (0);
3552 }
3553
3554 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3555 /*
3556 * Previous user of page had a differnet color
3557 * but since there are no current users
3558 * we just flush the cache and change the color.
3559 * As an optimization for large pages we flush the
3560 * entire cache of that color and set a flag.
3561 */
3562 SFMMU_STAT(sf_pgcolor_conflict);
3563 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3564 CacheColor_SetFlushed(*cflags, ocolor);
3565 sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3566 }
3567 PP_SET_VCOLOR(pp, vcolor);
3568 return (0);
3569 }
3570
3571 /*
3572 * We got a real conflict with a current mapping.
3573 * set flags to start unencaching all mappings
3574 * and return failure so we restart looping
3575 * the pp array from the beginning.
3576 */
3577 return (HAT_TMPNC);
3578 }
3579 #endif /* VAC */
3580
3581 /*
3582 * creates a large page shadow hmeblk for a tte.
3583 * The purpose of this routine is to allow us to do quick unloads because
3584 * the vm layer can easily pass a very large but sparsely populated range.
3585 */
3586 static struct hme_blk *
3587 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3588 {
3589 struct hmehash_bucket *hmebp;
3590 hmeblk_tag hblktag;
3591 int hmeshift, size, vshift;
3592 uint_t shw_mask, newshw_mask;
3593 struct hme_blk *hmeblkp;
3594
3595 ASSERT(sfmmup != KHATID);
3596 if (mmu_page_sizes == max_mmu_page_sizes) {
3597 ASSERT(ttesz < TTE256M);
3598 } else {
3599 ASSERT(ttesz < TTE4M);
3600 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3601 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3602 }
3603
3604 if (ttesz == TTE8K) {
3605 size = TTE512K;
3606 } else {
3607 size = ++ttesz;
3608 }
3609
3610 hblktag.htag_id = sfmmup;
3611 hmeshift = HME_HASH_SHIFT(size);
3612 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3613 hblktag.htag_rehash = HME_HASH_REHASH(size);
3614 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3615 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3616
3617 SFMMU_HASH_LOCK(hmebp);
3618
3619 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3620 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3621 if (hmeblkp == NULL) {
3622 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3623 hblktag, flags, SFMMU_INVALID_SHMERID);
3624 }
3625 ASSERT(hmeblkp);
3626 if (!hmeblkp->hblk_shw_mask) {
3627 /*
3628 * if this is a unused hblk it was just allocated or could
3629 * potentially be a previous large page hblk so we need to
3630 * set the shadow bit.
3631 */
3632 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3633 hmeblkp->hblk_shw_bit = 1;
3634 } else if (hmeblkp->hblk_shw_bit == 0) {
3635 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3636 (void *)hmeblkp);
3637 }
3638 ASSERT(hmeblkp->hblk_shw_bit == 1);
3639 ASSERT(!hmeblkp->hblk_shared);
3640 vshift = vaddr_to_vshift(hblktag, vaddr, size);
3641 ASSERT(vshift < 8);
3642 /*
3643 * Atomically set shw mask bit
3644 */
3645 do {
3646 shw_mask = hmeblkp->hblk_shw_mask;
3647 newshw_mask = shw_mask | (1 << vshift);
3648 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3649 newshw_mask);
3650 } while (newshw_mask != shw_mask);
3651
3652 SFMMU_HASH_UNLOCK(hmebp);
3653
3654 return (hmeblkp);
3655 }
3656
3657 /*
3658 * This routine cleanup a previous shadow hmeblk and changes it to
3659 * a regular hblk. This happens rarely but it is possible
3660 * when a process wants to use large pages and there are hblks still
3661 * lying around from the previous as that used these hmeblks.
3662 * The alternative was to cleanup the shadow hblks at unload time
3663 * but since so few user processes actually use large pages, it is
3664 * better to be lazy and cleanup at this time.
3665 */
3666 static void
3667 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3668 struct hmehash_bucket *hmebp)
3669 {
3670 caddr_t addr, endaddr;
3671 int hashno, size;
3672
3673 ASSERT(hmeblkp->hblk_shw_bit);
3674 ASSERT(!hmeblkp->hblk_shared);
3675
3676 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3677
3678 if (!hmeblkp->hblk_shw_mask) {
3679 hmeblkp->hblk_shw_bit = 0;
3680 return;
3681 }
3682 addr = (caddr_t)get_hblk_base(hmeblkp);
3683 endaddr = get_hblk_endaddr(hmeblkp);
3684 size = get_hblk_ttesz(hmeblkp);
3685 hashno = size - 1;
3686 ASSERT(hashno > 0);
3687 SFMMU_HASH_UNLOCK(hmebp);
3688
3689 sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3690
3691 SFMMU_HASH_LOCK(hmebp);
3692 }
3693
3694 static void
3695 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3696 int hashno)
3697 {
3698 int hmeshift, shadow = 0;
3699 hmeblk_tag hblktag;
3700 struct hmehash_bucket *hmebp;
3701 struct hme_blk *hmeblkp;
3702 struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3703
3704 ASSERT(hashno > 0);
3705 hblktag.htag_id = sfmmup;
3706 hblktag.htag_rehash = hashno;
3707 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3708
3709 hmeshift = HME_HASH_SHIFT(hashno);
3710
3711 while (addr < endaddr) {
3712 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3713 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3714 SFMMU_HASH_LOCK(hmebp);
3715 /* inline HME_HASH_SEARCH */
3716 hmeblkp = hmebp->hmeblkp;
3717 pr_hblk = NULL;
3718 while (hmeblkp) {
3719 if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3720 /* found hme_blk */
3721 ASSERT(!hmeblkp->hblk_shared);
3722 if (hmeblkp->hblk_shw_bit) {
3723 if (hmeblkp->hblk_shw_mask) {
3724 shadow = 1;
3725 sfmmu_shadow_hcleanup(sfmmup,
3726 hmeblkp, hmebp);
3727 break;
3728 } else {
3729 hmeblkp->hblk_shw_bit = 0;
3730 }
3731 }
3732
3733 /*
3734 * Hblk_hmecnt and hblk_vcnt could be non zero
3735 * since hblk_unload() does not gurantee that.
3736 *
3737 * XXX - this could cause tteload() to spin
3738 * where sfmmu_shadow_hcleanup() is called.
3739 */
3740 }
3741
3742 nx_hblk = hmeblkp->hblk_next;
3743 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3744 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3745 &list, 0);
3746 } else {
3747 pr_hblk = hmeblkp;
3748 }
3749 hmeblkp = nx_hblk;
3750 }
3751
3752 SFMMU_HASH_UNLOCK(hmebp);
3753
3754 if (shadow) {
3755 /*
3756 * We found another shadow hblk so cleaned its
3757 * children. We need to go back and cleanup
3758 * the original hblk so we don't change the
3759 * addr.
3760 */
3761 shadow = 0;
3762 } else {
3763 addr = (caddr_t)roundup((uintptr_t)addr + 1,
3764 (1 << hmeshift));
3765 }
3766 }
3767 sfmmu_hblks_list_purge(&list, 0);
3768 }
3769
3770 /*
3771 * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3772 * may still linger on after pageunload.
3773 */
3774 static void
3775 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3776 {
3777 int hmeshift;
3778 hmeblk_tag hblktag;
3779 struct hmehash_bucket *hmebp;
3780 struct hme_blk *hmeblkp;
3781 struct hme_blk *pr_hblk;
3782 struct hme_blk *list = NULL;
3783
3784 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3785 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3786
3787 hmeshift = HME_HASH_SHIFT(ttesz);
3788 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3789 hblktag.htag_rehash = ttesz;
3790 hblktag.htag_rid = rid;
3791 hblktag.htag_id = srdp;
3792 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3793
3794 SFMMU_HASH_LOCK(hmebp);
3795 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3796 if (hmeblkp != NULL) {
3797 ASSERT(hmeblkp->hblk_shared);
3798 ASSERT(!hmeblkp->hblk_shw_bit);
3799 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3800 panic("sfmmu_cleanup_rhblk: valid hmeblk");
3801 }
3802 ASSERT(!hmeblkp->hblk_lckcnt);
3803 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3804 &list, 0);
3805 }
3806 SFMMU_HASH_UNLOCK(hmebp);
3807 sfmmu_hblks_list_purge(&list, 0);
3808 }
3809
3810 /* ARGSUSED */
3811 static void
3812 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3813 size_t r_size, void *r_obj, u_offset_t r_objoff)
3814 {
3815 }
3816
3817 /*
3818 * Searches for an hmeblk which maps addr, then unloads this mapping
3819 * and updates *eaddrp, if the hmeblk is found.
3820 */
3821 static void
3822 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3823 caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3824 {
3825 int hmeshift;
3826 hmeblk_tag hblktag;
3827 struct hmehash_bucket *hmebp;
3828 struct hme_blk *hmeblkp;
3829 struct hme_blk *pr_hblk;
3830 struct hme_blk *list = NULL;
3831
3832 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3833 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3834 ASSERT(ttesz >= HBLK_MIN_TTESZ);
3835
3836 hmeshift = HME_HASH_SHIFT(ttesz);
3837 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3838 hblktag.htag_rehash = ttesz;
3839 hblktag.htag_rid = rid;
3840 hblktag.htag_id = srdp;
3841 hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3842
3843 SFMMU_HASH_LOCK(hmebp);
3844 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3845 if (hmeblkp != NULL) {
3846 ASSERT(hmeblkp->hblk_shared);
3847 ASSERT(!hmeblkp->hblk_lckcnt);
3848 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3849 *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3850 eaddr, NULL, HAT_UNLOAD);
3851 ASSERT(*eaddrp > addr);
3852 }
3853 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3854 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3855 &list, 0);
3856 }
3857 SFMMU_HASH_UNLOCK(hmebp);
3858 sfmmu_hblks_list_purge(&list, 0);
3859 }
3860
3861 static void
3862 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3863 {
3864 int ttesz = rgnp->rgn_pgszc;
3865 size_t rsz = rgnp->rgn_size;
3866 caddr_t rsaddr = rgnp->rgn_saddr;
3867 caddr_t readdr = rsaddr + rsz;
3868 caddr_t rhsaddr;
3869 caddr_t va;
3870 uint_t rid = rgnp->rgn_id;
3871 caddr_t cbsaddr;
3872 caddr_t cbeaddr;
3873 hat_rgn_cb_func_t rcbfunc;
3874 ulong_t cnt;
3875
3876 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3877 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3878
3879 ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3880 ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3881 if (ttesz < HBLK_MIN_TTESZ) {
3882 ttesz = HBLK_MIN_TTESZ;
3883 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3884 } else {
3885 rhsaddr = rsaddr;
3886 }
3887
3888 if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3889 rcbfunc = sfmmu_rgn_cb_noop;
3890 }
3891
3892 while (ttesz >= HBLK_MIN_TTESZ) {
3893 cbsaddr = rsaddr;
3894 cbeaddr = rsaddr;
3895 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3896 ttesz--;
3897 continue;
3898 }
3899 cnt = 0;
3900 va = rsaddr;
3901 while (va < readdr) {
3902 ASSERT(va >= rhsaddr);
3903 if (va != cbeaddr) {
3904 if (cbeaddr != cbsaddr) {
3905 ASSERT(cbeaddr > cbsaddr);
3906 (*rcbfunc)(cbsaddr, cbeaddr,
3907 rsaddr, rsz, rgnp->rgn_obj,
3908 rgnp->rgn_objoff);
3909 }
3910 cbsaddr = va;
3911 cbeaddr = va;
3912 }
3913 sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3914 ttesz, &cbeaddr);
3915 cnt++;
3916 va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3917 }
3918 if (cbeaddr != cbsaddr) {
3919 ASSERT(cbeaddr > cbsaddr);
3920 (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3921 rsz, rgnp->rgn_obj,
3922 rgnp->rgn_objoff);
3923 }
3924 ttesz--;
3925 }
3926 }
3927
3928 /*
3929 * Release one hardware address translation lock on the given address range.
3930 */
3931 void
3932 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3933 {
3934 struct hmehash_bucket *hmebp;
3935 hmeblk_tag hblktag;
3936 int hmeshift, hashno = 1;
3937 struct hme_blk *hmeblkp, *list = NULL;
3938 caddr_t endaddr;
3939
3940 ASSERT(sfmmup != NULL);
3941
3942 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3943 ASSERT((len & MMU_PAGEOFFSET) == 0);
3944 endaddr = addr + len;
3945 hblktag.htag_id = sfmmup;
3946 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3947
3948 /*
3949 * Spitfire supports 4 page sizes.
3950 * Most pages are expected to be of the smallest page size (8K) and
3951 * these will not need to be rehashed. 64K pages also don't need to be
3952 * rehashed because an hmeblk spans 64K of address space. 512K pages
3953 * might need 1 rehash and and 4M pages might need 2 rehashes.
3954 */
3955 while (addr < endaddr) {
3956 hmeshift = HME_HASH_SHIFT(hashno);
3957 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3958 hblktag.htag_rehash = hashno;
3959 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3960
3961 SFMMU_HASH_LOCK(hmebp);
3962
3963 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3964 if (hmeblkp != NULL) {
3965 ASSERT(!hmeblkp->hblk_shared);
3966 /*
3967 * If we encounter a shadow hmeblk then
3968 * we know there are no valid hmeblks mapping
3969 * this address at this size or larger.
3970 * Just increment address by the smallest
3971 * page size.
3972 */
3973 if (hmeblkp->hblk_shw_bit) {
3974 addr += MMU_PAGESIZE;
3975 } else {
3976 addr = sfmmu_hblk_unlock(hmeblkp, addr,
3977 endaddr);
3978 }
3979 SFMMU_HASH_UNLOCK(hmebp);
3980 hashno = 1;
3981 continue;
3982 }
3983 SFMMU_HASH_UNLOCK(hmebp);
3984
3985 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
3986 /*
3987 * We have traversed the whole list and rehashed
3988 * if necessary without finding the address to unlock
3989 * which should never happen.
3990 */
3991 panic("sfmmu_unlock: addr not found. "
3992 "addr %p hat %p", (void *)addr, (void *)sfmmup);
3993 } else {
3994 hashno++;
3995 }
3996 }
3997
3998 sfmmu_hblks_list_purge(&list, 0);
3999 }
4000
4001 void
4002 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4003 hat_region_cookie_t rcookie)
4004 {
4005 sf_srd_t *srdp;
4006 sf_region_t *rgnp;
4007 int ttesz;
4008 uint_t rid;
4009 caddr_t eaddr;
4010 caddr_t va;
4011 int hmeshift;
4012 hmeblk_tag hblktag;
4013 struct hmehash_bucket *hmebp;
4014 struct hme_blk *hmeblkp;
4015 struct hme_blk *pr_hblk;
4016 struct hme_blk *list;
4017
4018 if (rcookie == HAT_INVALID_REGION_COOKIE) {
4019 hat_unlock(sfmmup, addr, len);
4020 return;
4021 }
4022
4023 ASSERT(sfmmup != NULL);
4024 ASSERT(sfmmup != ksfmmup);
4025
4026 srdp = sfmmup->sfmmu_srdp;
4027 rid = (uint_t)((uint64_t)rcookie);
4028 VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
4029 eaddr = addr + len;
4030 va = addr;
4031 list = NULL;
4032 rgnp = srdp->srd_hmergnp[rid];
4033 SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4034
4035 ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4036 ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4037 if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4038 ttesz = HBLK_MIN_TTESZ;
4039 } else {
4040 ttesz = rgnp->rgn_pgszc;
4041 }
4042 while (va < eaddr) {
4043 while (ttesz < rgnp->rgn_pgszc &&
4044 IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4045 ttesz++;
4046 }
4047 while (ttesz >= HBLK_MIN_TTESZ) {
4048 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4049 ttesz--;
4050 continue;
4051 }
4052 hmeshift = HME_HASH_SHIFT(ttesz);
4053 hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4054 hblktag.htag_rehash = ttesz;
4055 hblktag.htag_rid = rid;
4056 hblktag.htag_id = srdp;
4057 hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4058 SFMMU_HASH_LOCK(hmebp);
4059 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4060 &list);
4061 if (hmeblkp == NULL) {
4062 SFMMU_HASH_UNLOCK(hmebp);
4063 ttesz--;
4064 continue;
4065 }
4066 ASSERT(hmeblkp->hblk_shared);
4067 va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4068 ASSERT(va >= eaddr ||
4069 IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4070 SFMMU_HASH_UNLOCK(hmebp);
4071 break;
4072 }
4073 if (ttesz < HBLK_MIN_TTESZ) {
4074 panic("hat_unlock_region: addr not found "
4075 "addr %p hat %p", (void *)va, (void *)sfmmup);
4076 }
4077 }
4078 sfmmu_hblks_list_purge(&list, 0);
4079 }
4080
4081 /*
4082 * Function to unlock a range of addresses in an hmeblk. It returns the
4083 * next address that needs to be unlocked.
4084 * Should be called with the hash lock held.
4085 */
4086 static caddr_t
4087 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4088 {
4089 struct sf_hment *sfhme;
4090 tte_t tteold, ttemod;
4091 int ttesz, ret;
4092
4093 ASSERT(in_hblk_range(hmeblkp, addr));
4094 ASSERT(hmeblkp->hblk_shw_bit == 0);
4095
4096 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4097 ttesz = get_hblk_ttesz(hmeblkp);
4098
4099 HBLKTOHME(sfhme, hmeblkp, addr);
4100 while (addr < endaddr) {
4101 readtte:
4102 sfmmu_copytte(&sfhme->hme_tte, &tteold);
4103 if (TTE_IS_VALID(&tteold)) {
4104
4105 ttemod = tteold;
4106
4107 ret = sfmmu_modifytte_try(&tteold, &ttemod,
4108 &sfhme->hme_tte);
4109
4110 if (ret < 0)
4111 goto readtte;
4112
4113 if (hmeblkp->hblk_lckcnt == 0)
4114 panic("zero hblk lckcnt");
4115
4116 if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4117 (uintptr_t)endaddr)
4118 panic("can't unlock large tte");
4119
4120 ASSERT(hmeblkp->hblk_lckcnt > 0);
4121 atomic_dec_32(&hmeblkp->hblk_lckcnt);
4122 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4123 } else {
4124 panic("sfmmu_hblk_unlock: invalid tte");
4125 }
4126 addr += TTEBYTES(ttesz);
4127 sfhme++;
4128 }
4129 return (addr);
4130 }
4131
4132 /*
4133 * Physical Address Mapping Framework
4134 *
4135 * General rules:
4136 *
4137 * (1) Applies only to seg_kmem memory pages. To make things easier,
4138 * seg_kpm addresses are also accepted by the routines, but nothing
4139 * is done with them since by definition their PA mappings are static.
4140 * (2) hat_add_callback() may only be called while holding the page lock
4141 * SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4142 * or passing HAC_PAGELOCK flag.
4143 * (3) prehandler() and posthandler() may not call hat_add_callback() or
4144 * hat_delete_callback(), nor should they allocate memory. Post quiesce
4145 * callbacks may not sleep or acquire adaptive mutex locks.
4146 * (4) Either prehandler() or posthandler() (but not both) may be specified
4147 * as being NULL. Specifying an errhandler() is optional.
4148 *
4149 * Details of using the framework:
4150 *
4151 * registering a callback (hat_register_callback())
4152 *
4153 * Pass prehandler, posthandler, errhandler addresses
4154 * as described below. If capture_cpus argument is nonzero,
4155 * suspend callback to the prehandler will occur with CPUs
4156 * captured and executing xc_loop() and CPUs will remain
4157 * captured until after the posthandler suspend callback
4158 * occurs.
4159 *
4160 * adding a callback (hat_add_callback())
4161 *
4162 * as_pagelock();
4163 * hat_add_callback();
4164 * save returned pfn in private data structures or program registers;
4165 * as_pageunlock();
4166 *
4167 * prehandler()
4168 *
4169 * Stop all accesses by physical address to this memory page.
4170 * Called twice: the first, PRESUSPEND, is a context safe to acquire
4171 * adaptive locks. The second, SUSPEND, is called at high PIL with
4172 * CPUs captured so adaptive locks may NOT be acquired (and all spin
4173 * locks must be XCALL_PIL or higher locks).
4174 *
4175 * May return the following errors:
4176 * EIO: A fatal error has occurred. This will result in panic.
4177 * EAGAIN: The page cannot be suspended. This will fail the
4178 * relocation.
4179 * 0: Success.
4180 *
4181 * posthandler()
4182 *
4183 * Save new pfn in private data structures or program registers;
4184 * not allowed to fail (non-zero return values will result in panic).
4185 *
4186 * errhandler()
4187 *
4188 * called when an error occurs related to the callback. Currently
4189 * the only such error is HAT_CB_ERR_LEAKED which indicates that
4190 * a page is being freed, but there are still outstanding callback(s)
4191 * registered on the page.
4192 *
4193 * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4194 *
4195 * stop using physical address
4196 * hat_delete_callback();
4197 *
4198 */
4199
4200 /*
4201 * Register a callback class. Each subsystem should do this once and
4202 * cache the id_t returned for use in setting up and tearing down callbacks.
4203 *
4204 * There is no facility for removing callback IDs once they are created;
4205 * the "key" should be unique for each module, so in case a module is unloaded
4206 * and subsequently re-loaded, we can recycle the module's previous entry.
4207 */
4208 id_t
4209 hat_register_callback(int key,
4210 int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4211 int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4212 int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4213 int capture_cpus)
4214 {
4215 id_t id;
4216
4217 /*
4218 * Search the table for a pre-existing callback associated with
4219 * the identifier "key". If one exists, we re-use that entry in
4220 * the table for this instance, otherwise we assign the next
4221 * available table slot.
4222 */
4223 for (id = 0; id < sfmmu_max_cb_id; id++) {
4224 if (sfmmu_cb_table[id].key == key)
4225 break;
4226 }
4227
4228 if (id == sfmmu_max_cb_id) {
4229 id = sfmmu_cb_nextid++;
4230 if (id >= sfmmu_max_cb_id)
4231 panic("hat_register_callback: out of callback IDs");
4232 }
4233
4234 ASSERT(prehandler != NULL || posthandler != NULL);
4235
4236 sfmmu_cb_table[id].key = key;
4237 sfmmu_cb_table[id].prehandler = prehandler;
4238 sfmmu_cb_table[id].posthandler = posthandler;
4239 sfmmu_cb_table[id].errhandler = errhandler;
4240 sfmmu_cb_table[id].capture_cpus = capture_cpus;
4241
4242 return (id);
4243 }
4244
4245 #define HAC_COOKIE_NONE (void *)-1
4246
4247 /*
4248 * Add relocation callbacks to the specified addr/len which will be called
4249 * when relocating the associated page. See the description of pre and
4250 * posthandler above for more details.
4251 *
4252 * If HAC_PAGELOCK is included in flags, the underlying memory page is
4253 * locked internally so the caller must be able to deal with the callback
4254 * running even before this function has returned. If HAC_PAGELOCK is not
4255 * set, it is assumed that the underlying memory pages are locked.
4256 *
4257 * Since the caller must track the individual page boundaries anyway,
4258 * we only allow a callback to be added to a single page (large
4259 * or small). Thus [addr, addr + len) MUST be contained within a single
4260 * page.
4261 *
4262 * Registering multiple callbacks on the same [addr, addr+len) is supported,
4263 * _provided_that_ a unique parameter is specified for each callback.
4264 * If multiple callbacks are registered on the same range the callback will
4265 * be invoked with each unique parameter. Registering the same callback with
4266 * the same argument more than once will result in corrupted kernel state.
4267 *
4268 * Returns the pfn of the underlying kernel page in *rpfn
4269 * on success, or PFN_INVALID on failure.
4270 *
4271 * cookiep (if passed) provides storage space for an opaque cookie
4272 * to return later to hat_delete_callback(). This cookie makes the callback
4273 * deletion significantly quicker by avoiding a potentially lengthy hash
4274 * search.
4275 *
4276 * Returns values:
4277 * 0: success
4278 * ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4279 * EINVAL: callback ID is not valid
4280 * ENXIO: ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4281 * space
4282 * ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4283 */
4284 int
4285 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4286 void *pvt, pfn_t *rpfn, void **cookiep)
4287 {
4288 struct hmehash_bucket *hmebp;
4289 hmeblk_tag hblktag;
4290 struct hme_blk *hmeblkp;
4291 int hmeshift, hashno;
4292 caddr_t saddr, eaddr, baseaddr;
4293 struct pa_hment *pahmep;
4294 struct sf_hment *sfhmep, *osfhmep;
4295 kmutex_t *pml;
4296 tte_t tte;
4297 page_t *pp;
4298 vnode_t *vp;
4299 u_offset_t off;
4300 pfn_t pfn;
4301 int kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4302 int locked = 0;
4303
4304 /*
4305 * For KPM mappings, just return the physical address since we
4306 * don't need to register any callbacks.
4307 */
4308 if (IS_KPM_ADDR(vaddr)) {
4309 uint64_t paddr;
4310 SFMMU_KPM_VTOP(vaddr, paddr);
4311 *rpfn = btop(paddr);
4312 if (cookiep != NULL)
4313 *cookiep = HAC_COOKIE_NONE;
4314 return (0);
4315 }
4316
4317 if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4318 *rpfn = PFN_INVALID;
4319 return (EINVAL);
4320 }
4321
4322 if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4323 *rpfn = PFN_INVALID;
4324 return (ENOMEM);
4325 }
4326
4327 sfhmep = &pahmep->sfment;
4328
4329 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4330 eaddr = saddr + len;
4331
4332 rehash:
4333 /* Find the mapping(s) for this page */
4334 for (hashno = TTE64K, hmeblkp = NULL;
4335 hmeblkp == NULL && hashno <= mmu_hashcnt;
4336 hashno++) {
4337 hmeshift = HME_HASH_SHIFT(hashno);
4338 hblktag.htag_id = ksfmmup;
4339 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4340 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4341 hblktag.htag_rehash = hashno;
4342 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4343
4344 SFMMU_HASH_LOCK(hmebp);
4345
4346 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4347
4348 if (hmeblkp == NULL)
4349 SFMMU_HASH_UNLOCK(hmebp);
4350 }
4351
4352 if (hmeblkp == NULL) {
4353 kmem_cache_free(pa_hment_cache, pahmep);
4354 *rpfn = PFN_INVALID;
4355 return (ENXIO);
4356 }
4357
4358 ASSERT(!hmeblkp->hblk_shared);
4359
4360 HBLKTOHME(osfhmep, hmeblkp, saddr);
4361 sfmmu_copytte(&osfhmep->hme_tte, &tte);
4362
4363 if (!TTE_IS_VALID(&tte)) {
4364 SFMMU_HASH_UNLOCK(hmebp);
4365 kmem_cache_free(pa_hment_cache, pahmep);
4366 *rpfn = PFN_INVALID;
4367 return (ENXIO);
4368 }
4369
4370 /*
4371 * Make sure the boundaries for the callback fall within this
4372 * single mapping.
4373 */
4374 baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4375 ASSERT(saddr >= baseaddr);
4376 if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4377 SFMMU_HASH_UNLOCK(hmebp);
4378 kmem_cache_free(pa_hment_cache, pahmep);
4379 *rpfn = PFN_INVALID;
4380 return (ERANGE);
4381 }
4382
4383 pfn = sfmmu_ttetopfn(&tte, vaddr);
4384
4385 /*
4386 * The pfn may not have a page_t underneath in which case we
4387 * just return it. This can happen if we are doing I/O to a
4388 * static portion of the kernel's address space, for instance.
4389 */
4390 pp = osfhmep->hme_page;
4391 if (pp == NULL) {
4392 SFMMU_HASH_UNLOCK(hmebp);
4393 kmem_cache_free(pa_hment_cache, pahmep);
4394 *rpfn = pfn;
4395 if (cookiep)
4396 *cookiep = HAC_COOKIE_NONE;
4397 return (0);
4398 }
4399 ASSERT(pp == PP_PAGEROOT(pp));
4400
4401 vp = pp->p_vnode;
4402 off = pp->p_offset;
4403
4404 pml = sfmmu_mlist_enter(pp);
4405
4406 if (flags & HAC_PAGELOCK) {
4407 if (!page_trylock(pp, SE_SHARED)) {
4408 /*
4409 * Somebody is holding SE_EXCL lock. Might
4410 * even be hat_page_relocate(). Drop all
4411 * our locks, lookup the page in &kvp, and
4412 * retry. If it doesn't exist in &kvp and &zvp,
4413 * then we must be dealing with a kernel mapped
4414 * page which doesn't actually belong to
4415 * segkmem so we punt.
4416 */
4417 sfmmu_mlist_exit(pml);
4418 SFMMU_HASH_UNLOCK(hmebp);
4419 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4420
4421 /* check zvp before giving up */
4422 if (pp == NULL)
4423 pp = page_lookup(&zvp, (u_offset_t)saddr,
4424 SE_SHARED);
4425
4426 /* Okay, we didn't find it, give up */
4427 if (pp == NULL) {
4428 kmem_cache_free(pa_hment_cache, pahmep);
4429 *rpfn = pfn;
4430 if (cookiep)
4431 *cookiep = HAC_COOKIE_NONE;
4432 return (0);
4433 }
4434 page_unlock(pp);
4435 goto rehash;
4436 }
4437 locked = 1;
4438 }
4439
4440 if (!PAGE_LOCKED(pp) && !panicstr)
4441 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4442
4443 if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4444 pp->p_offset != off) {
4445 /*
4446 * The page moved before we got our hands on it. Drop
4447 * all the locks and try again.
4448 */
4449 ASSERT((flags & HAC_PAGELOCK) != 0);
4450 sfmmu_mlist_exit(pml);
4451 SFMMU_HASH_UNLOCK(hmebp);
4452 page_unlock(pp);
4453 locked = 0;
4454 goto rehash;
4455 }
4456
4457 if (!VN_ISKAS(vp)) {
4458 /*
4459 * This is not a segkmem page but another page which
4460 * has been kernel mapped. It had better have at least
4461 * a share lock on it. Return the pfn.
4462 */
4463 sfmmu_mlist_exit(pml);
4464 SFMMU_HASH_UNLOCK(hmebp);
4465 if (locked)
4466 page_unlock(pp);
4467 kmem_cache_free(pa_hment_cache, pahmep);
4468 ASSERT(PAGE_LOCKED(pp));
4469 *rpfn = pfn;
4470 if (cookiep)
4471 *cookiep = HAC_COOKIE_NONE;
4472 return (0);
4473 }
4474
4475 /*
4476 * Setup this pa_hment and link its embedded dummy sf_hment into
4477 * the mapping list.
4478 */
4479 pp->p_share++;
4480 pahmep->cb_id = callback_id;
4481 pahmep->addr = vaddr;
4482 pahmep->len = len;
4483 pahmep->refcnt = 1;
4484 pahmep->flags = 0;
4485 pahmep->pvt = pvt;
4486
4487 sfhmep->hme_tte.ll = 0;
4488 sfhmep->hme_data = pahmep;
4489 sfhmep->hme_prev = osfhmep;
4490 sfhmep->hme_next = osfhmep->hme_next;
4491
4492 if (osfhmep->hme_next)
4493 osfhmep->hme_next->hme_prev = sfhmep;
4494
4495 osfhmep->hme_next = sfhmep;
4496
4497 sfmmu_mlist_exit(pml);
4498 SFMMU_HASH_UNLOCK(hmebp);
4499
4500 if (locked)
4501 page_unlock(pp);
4502
4503 *rpfn = pfn;
4504 if (cookiep)
4505 *cookiep = (void *)pahmep;
4506
4507 return (0);
4508 }
4509
4510 /*
4511 * Remove the relocation callbacks from the specified addr/len.
4512 */
4513 void
4514 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4515 void *cookie)
4516 {
4517 struct hmehash_bucket *hmebp;
4518 hmeblk_tag hblktag;
4519 struct hme_blk *hmeblkp;
4520 int hmeshift, hashno;
4521 caddr_t saddr;
4522 struct pa_hment *pahmep;
4523 struct sf_hment *sfhmep, *osfhmep;
4524 kmutex_t *pml;
4525 tte_t tte;
4526 page_t *pp;
4527 vnode_t *vp;
4528 u_offset_t off;
4529 int locked = 0;
4530
4531 /*
4532 * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4533 * remove so just return.
4534 */
4535 if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4536 return;
4537
4538 saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4539
4540 rehash:
4541 /* Find the mapping(s) for this page */
4542 for (hashno = TTE64K, hmeblkp = NULL;
4543 hmeblkp == NULL && hashno <= mmu_hashcnt;
4544 hashno++) {
4545 hmeshift = HME_HASH_SHIFT(hashno);
4546 hblktag.htag_id = ksfmmup;
4547 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4548 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4549 hblktag.htag_rehash = hashno;
4550 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4551
4552 SFMMU_HASH_LOCK(hmebp);
4553
4554 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4555
4556 if (hmeblkp == NULL)
4557 SFMMU_HASH_UNLOCK(hmebp);
4558 }
4559
4560 if (hmeblkp == NULL)
4561 return;
4562
4563 ASSERT(!hmeblkp->hblk_shared);
4564
4565 HBLKTOHME(osfhmep, hmeblkp, saddr);
4566
4567 sfmmu_copytte(&osfhmep->hme_tte, &tte);
4568 if (!TTE_IS_VALID(&tte)) {
4569 SFMMU_HASH_UNLOCK(hmebp);
4570 return;
4571 }
4572
4573 pp = osfhmep->hme_page;
4574 if (pp == NULL) {
4575 SFMMU_HASH_UNLOCK(hmebp);
4576 ASSERT(cookie == NULL);
4577 return;
4578 }
4579
4580 vp = pp->p_vnode;
4581 off = pp->p_offset;
4582
4583 pml = sfmmu_mlist_enter(pp);
4584
4585 if (flags & HAC_PAGELOCK) {
4586 if (!page_trylock(pp, SE_SHARED)) {
4587 /*
4588 * Somebody is holding SE_EXCL lock. Might
4589 * even be hat_page_relocate(). Drop all
4590 * our locks, lookup the page in &kvp, and
4591 * retry. If it doesn't exist in &kvp and &zvp,
4592 * then we must be dealing with a kernel mapped
4593 * page which doesn't actually belong to
4594 * segkmem so we punt.
4595 */
4596 sfmmu_mlist_exit(pml);
4597 SFMMU_HASH_UNLOCK(hmebp);
4598 pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4599 /* check zvp before giving up */
4600 if (pp == NULL)
4601 pp = page_lookup(&zvp, (u_offset_t)saddr,
4602 SE_SHARED);
4603
4604 if (pp == NULL) {
4605 ASSERT(cookie == NULL);
4606 return;
4607 }
4608 page_unlock(pp);
4609 goto rehash;
4610 }
4611 locked = 1;
4612 }
4613
4614 ASSERT(PAGE_LOCKED(pp));
4615
4616 if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4617 pp->p_offset != off) {
4618 /*
4619 * The page moved before we got our hands on it. Drop
4620 * all the locks and try again.
4621 */
4622 ASSERT((flags & HAC_PAGELOCK) != 0);
4623 sfmmu_mlist_exit(pml);
4624 SFMMU_HASH_UNLOCK(hmebp);
4625 page_unlock(pp);
4626 locked = 0;
4627 goto rehash;
4628 }
4629
4630 if (!VN_ISKAS(vp)) {
4631 /*
4632 * This is not a segkmem page but another page which
4633 * has been kernel mapped.
4634 */
4635 sfmmu_mlist_exit(pml);
4636 SFMMU_HASH_UNLOCK(hmebp);
4637 if (locked)
4638 page_unlock(pp);
4639 ASSERT(cookie == NULL);
4640 return;
4641 }
4642
4643 if (cookie != NULL) {
4644 pahmep = (struct pa_hment *)cookie;
4645 sfhmep = &pahmep->sfment;
4646 } else {
4647 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4648 sfhmep = sfhmep->hme_next) {
4649
4650 /*
4651 * skip va<->pa mappings
4652 */
4653 if (!IS_PAHME(sfhmep))
4654 continue;
4655
4656 pahmep = sfhmep->hme_data;
4657 ASSERT(pahmep != NULL);
4658
4659 /*
4660 * if pa_hment matches, remove it
4661 */
4662 if ((pahmep->pvt == pvt) &&
4663 (pahmep->addr == vaddr) &&
4664 (pahmep->len == len)) {
4665 break;
4666 }
4667 }
4668 }
4669
4670 if (sfhmep == NULL) {
4671 if (!panicstr) {
4672 panic("hat_delete_callback: pa_hment not found, pp %p",
4673 (void *)pp);
4674 }
4675 return;
4676 }
4677
4678 /*
4679 * Note: at this point a valid kernel mapping must still be
4680 * present on this page.
4681 */
4682 pp->p_share--;
4683 if (pp->p_share <= 0)
4684 panic("hat_delete_callback: zero p_share");
4685
4686 if (--pahmep->refcnt == 0) {
4687 if (pahmep->flags != 0)
4688 panic("hat_delete_callback: pa_hment is busy");
4689
4690 /*
4691 * Remove sfhmep from the mapping list for the page.
4692 */
4693 if (sfhmep->hme_prev) {
4694 sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4695 } else {
4696 pp->p_mapping = sfhmep->hme_next;
4697 }
4698
4699 if (sfhmep->hme_next)
4700 sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4701
4702 sfmmu_mlist_exit(pml);
4703 SFMMU_HASH_UNLOCK(hmebp);
4704
4705 if (locked)
4706 page_unlock(pp);
4707
4708 kmem_cache_free(pa_hment_cache, pahmep);
4709 return;
4710 }
4711
4712 sfmmu_mlist_exit(pml);
4713 SFMMU_HASH_UNLOCK(hmebp);
4714 if (locked)
4715 page_unlock(pp);
4716 }
4717
4718 /*
4719 * hat_probe returns 1 if the translation for the address 'addr' is
4720 * loaded, zero otherwise.
4721 *
4722 * hat_probe should be used only for advisorary purposes because it may
4723 * occasionally return the wrong value. The implementation must guarantee that
4724 * returning the wrong value is a very rare event. hat_probe is used
4725 * to implement optimizations in the segment drivers.
4726 *
4727 */
4728 int
4729 hat_probe(struct hat *sfmmup, caddr_t addr)
4730 {
4731 pfn_t pfn;
4732 tte_t tte;
4733
4734 ASSERT(sfmmup != NULL);
4735
4736 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4737
4738 if (sfmmup == ksfmmup) {
4739 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4740 == PFN_SUSPENDED) {
4741 sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4742 }
4743 } else {
4744 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4745 }
4746
4747 if (pfn != PFN_INVALID)
4748 return (1);
4749 else
4750 return (0);
4751 }
4752
4753 ssize_t
4754 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4755 {
4756 tte_t tte;
4757
4758 if (sfmmup == ksfmmup) {
4759 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4760 return (-1);
4761 }
4762 } else {
4763 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4764 return (-1);
4765 }
4766 }
4767
4768 ASSERT(TTE_IS_VALID(&tte));
4769 return (TTEBYTES(TTE_CSZ(&tte)));
4770 }
4771
4772 uint_t
4773 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4774 {
4775 tte_t tte;
4776
4777 if (sfmmup == ksfmmup) {
4778 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4779 tte.ll = 0;
4780 }
4781 } else {
4782 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4783 tte.ll = 0;
4784 }
4785 }
4786 if (TTE_IS_VALID(&tte)) {
4787 *attr = sfmmu_ptov_attr(&tte);
4788 return (0);
4789 }
4790 *attr = 0;
4791 return ((uint_t)0xffffffff);
4792 }
4793
4794 /*
4795 * Enables more attributes on specified address range (ie. logical OR)
4796 */
4797 void
4798 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4799 {
4800 ASSERT(hat->sfmmu_as != NULL);
4801
4802 sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4803 }
4804
4805 /*
4806 * Assigns attributes to the specified address range. All the attributes
4807 * are specified.
4808 */
4809 void
4810 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4811 {
4812 ASSERT(hat->sfmmu_as != NULL);
4813
4814 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4815 }
4816
4817 /*
4818 * Remove attributes on the specified address range (ie. loginal NAND)
4819 */
4820 void
4821 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4822 {
4823 ASSERT(hat->sfmmu_as != NULL);
4824
4825 sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4826 }
4827
4828 /*
4829 * Change attributes on an address range to that specified by attr and mode.
4830 */
4831 static void
4832 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4833 int mode)
4834 {
4835 struct hmehash_bucket *hmebp;
4836 hmeblk_tag hblktag;
4837 int hmeshift, hashno = 1;
4838 struct hme_blk *hmeblkp, *list = NULL;
4839 caddr_t endaddr;
4840 cpuset_t cpuset;
4841 demap_range_t dmr;
4842
4843 CPUSET_ZERO(cpuset);
4844
4845 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4846 ASSERT((len & MMU_PAGEOFFSET) == 0);
4847 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4848
4849 if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4850 ((addr + len) > (caddr_t)USERLIMIT)) {
4851 panic("user addr %p in kernel space",
4852 (void *)addr);
4853 }
4854
4855 endaddr = addr + len;
4856 hblktag.htag_id = sfmmup;
4857 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4858 DEMAP_RANGE_INIT(sfmmup, &dmr);
4859
4860 while (addr < endaddr) {
4861 hmeshift = HME_HASH_SHIFT(hashno);
4862 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4863 hblktag.htag_rehash = hashno;
4864 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4865
4866 SFMMU_HASH_LOCK(hmebp);
4867
4868 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4869 if (hmeblkp != NULL) {
4870 ASSERT(!hmeblkp->hblk_shared);
4871 /*
4872 * We've encountered a shadow hmeblk so skip the range
4873 * of the next smaller mapping size.
4874 */
4875 if (hmeblkp->hblk_shw_bit) {
4876 ASSERT(sfmmup != ksfmmup);
4877 ASSERT(hashno > 1);
4878 addr = (caddr_t)P2END((uintptr_t)addr,
4879 TTEBYTES(hashno - 1));
4880 } else {
4881 addr = sfmmu_hblk_chgattr(sfmmup,
4882 hmeblkp, addr, endaddr, &dmr, attr, mode);
4883 }
4884 SFMMU_HASH_UNLOCK(hmebp);
4885 hashno = 1;
4886 continue;
4887 }
4888 SFMMU_HASH_UNLOCK(hmebp);
4889
4890 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4891 /*
4892 * We have traversed the whole list and rehashed
4893 * if necessary without finding the address to chgattr.
4894 * This is ok, so we increment the address by the
4895 * smallest hmeblk range for kernel mappings or for
4896 * user mappings with no large pages, and the largest
4897 * hmeblk range, to account for shadow hmeblks, for
4898 * user mappings with large pages and continue.
4899 */
4900 if (sfmmup == ksfmmup)
4901 addr = (caddr_t)P2END((uintptr_t)addr,
4902 TTEBYTES(1));
4903 else
4904 addr = (caddr_t)P2END((uintptr_t)addr,
4905 TTEBYTES(hashno));
4906 hashno = 1;
4907 } else {
4908 hashno++;
4909 }
4910 }
4911
4912 sfmmu_hblks_list_purge(&list, 0);
4913 DEMAP_RANGE_FLUSH(&dmr);
4914 cpuset = sfmmup->sfmmu_cpusran;
4915 xt_sync(cpuset);
4916 }
4917
4918 /*
4919 * This function chgattr on a range of addresses in an hmeblk. It returns the
4920 * next addres that needs to be chgattr.
4921 * It should be called with the hash lock held.
4922 * XXX It should be possible to optimize chgattr by not flushing every time but
4923 * on the other hand:
4924 * 1. do one flush crosscall.
4925 * 2. only flush if we are increasing permissions (make sure this will work)
4926 */
4927 static caddr_t
4928 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
4929 caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
4930 {
4931 tte_t tte, tteattr, tteflags, ttemod;
4932 struct sf_hment *sfhmep;
4933 int ttesz;
4934 struct page *pp = NULL;
4935 kmutex_t *pml, *pmtx;
4936 int ret;
4937 int use_demap_range;
4938 #if defined(SF_ERRATA_57)
4939 int check_exec;
4940 #endif
4941
4942 ASSERT(in_hblk_range(hmeblkp, addr));
4943 ASSERT(hmeblkp->hblk_shw_bit == 0);
4944 ASSERT(!hmeblkp->hblk_shared);
4945
4946 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4947 ttesz = get_hblk_ttesz(hmeblkp);
4948
4949 /*
4950 * Flush the current demap region if addresses have been
4951 * skipped or the page size doesn't match.
4952 */
4953 use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
4954 if (use_demap_range) {
4955 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
4956 } else if (dmrp != NULL) {
4957 DEMAP_RANGE_FLUSH(dmrp);
4958 }
4959
4960 tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
4961 #if defined(SF_ERRATA_57)
4962 check_exec = (sfmmup != ksfmmup) &&
4963 AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
4964 TTE_IS_EXECUTABLE(&tteattr);
4965 #endif
4966 HBLKTOHME(sfhmep, hmeblkp, addr);
4967 while (addr < endaddr) {
4968 sfmmu_copytte(&sfhmep->hme_tte, &tte);
4969 if (TTE_IS_VALID(&tte)) {
4970 if ((tte.ll & tteflags.ll) == tteattr.ll) {
4971 /*
4972 * if the new attr is the same as old
4973 * continue
4974 */
4975 goto next_addr;
4976 }
4977 if (!TTE_IS_WRITABLE(&tteattr)) {
4978 /*
4979 * make sure we clear hw modify bit if we
4980 * removing write protections
4981 */
4982 tteflags.tte_intlo |= TTE_HWWR_INT;
4983 }
4984
4985 pml = NULL;
4986 pp = sfhmep->hme_page;
4987 if (pp) {
4988 pml = sfmmu_mlist_enter(pp);
4989 }
4990
4991 if (pp != sfhmep->hme_page) {
4992 /*
4993 * tte must have been unloaded.
4994 */
4995 ASSERT(pml);
4996 sfmmu_mlist_exit(pml);
4997 continue;
4998 }
4999
5000 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5001
5002 ttemod = tte;
5003 ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5004 ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5005
5006 #if defined(SF_ERRATA_57)
5007 if (check_exec && addr < errata57_limit)
5008 ttemod.tte_exec_perm = 0;
5009 #endif
5010 ret = sfmmu_modifytte_try(&tte, &ttemod,
5011 &sfhmep->hme_tte);
5012
5013 if (ret < 0) {
5014 /* tte changed underneath us */
5015 if (pml) {
5016 sfmmu_mlist_exit(pml);
5017 }
5018 continue;
5019 }
5020
5021 if (tteflags.tte_intlo & TTE_HWWR_INT) {
5022 /*
5023 * need to sync if we are clearing modify bit.
5024 */
5025 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5026 }
5027
5028 if (pp && PP_ISRO(pp)) {
5029 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5030 pmtx = sfmmu_page_enter(pp);
5031 PP_CLRRO(pp);
5032 sfmmu_page_exit(pmtx);
5033 }
5034 }
5035
5036 if (ret > 0 && use_demap_range) {
5037 DEMAP_RANGE_MARKPG(dmrp, addr);
5038 } else if (ret > 0) {
5039 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5040 }
5041
5042 if (pml) {
5043 sfmmu_mlist_exit(pml);
5044 }
5045 }
5046 next_addr:
5047 addr += TTEBYTES(ttesz);
5048 sfhmep++;
5049 DEMAP_RANGE_NEXTPG(dmrp);
5050 }
5051 return (addr);
5052 }
5053
5054 /*
5055 * This routine converts virtual attributes to physical ones. It will
5056 * update the tteflags field with the tte mask corresponding to the attributes
5057 * affected and it returns the new attributes. It will also clear the modify
5058 * bit if we are taking away write permission. This is necessary since the
5059 * modify bit is the hardware permission bit and we need to clear it in order
5060 * to detect write faults.
5061 */
5062 static uint64_t
5063 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5064 {
5065 tte_t ttevalue;
5066
5067 ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5068
5069 switch (mode) {
5070 case SFMMU_CHGATTR:
5071 /* all attributes specified */
5072 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5073 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5074 ttemaskp->tte_inthi = TTEINTHI_ATTR;
5075 ttemaskp->tte_intlo = TTEINTLO_ATTR;
5076 break;
5077 case SFMMU_SETATTR:
5078 ASSERT(!(attr & ~HAT_PROT_MASK));
5079 ttemaskp->ll = 0;
5080 ttevalue.ll = 0;
5081 /*
5082 * a valid tte implies exec and read for sfmmu
5083 * so no need to do anything about them.
5084 * since priviledged access implies user access
5085 * PROT_USER doesn't make sense either.
5086 */
5087 if (attr & PROT_WRITE) {
5088 ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5089 ttevalue.tte_intlo |= TTE_WRPRM_INT;
5090 }
5091 break;
5092 case SFMMU_CLRATTR:
5093 /* attributes will be nand with current ones */
5094 if (attr & ~(PROT_WRITE | PROT_USER)) {
5095 panic("sfmmu: attr %x not supported", attr);
5096 }
5097 ttemaskp->ll = 0;
5098 ttevalue.ll = 0;
5099 if (attr & PROT_WRITE) {
5100 /* clear both writable and modify bit */
5101 ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5102 }
5103 if (attr & PROT_USER) {
5104 ttemaskp->tte_intlo |= TTE_PRIV_INT;
5105 ttevalue.tte_intlo |= TTE_PRIV_INT;
5106 }
5107 break;
5108 default:
5109 panic("sfmmu_vtop_attr: bad mode %x", mode);
5110 }
5111 ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5112 return (ttevalue.ll);
5113 }
5114
5115 static uint_t
5116 sfmmu_ptov_attr(tte_t *ttep)
5117 {
5118 uint_t attr;
5119
5120 ASSERT(TTE_IS_VALID(ttep));
5121
5122 attr = PROT_READ;
5123
5124 if (TTE_IS_WRITABLE(ttep)) {
5125 attr |= PROT_WRITE;
5126 }
5127 if (TTE_IS_EXECUTABLE(ttep)) {
5128 attr |= PROT_EXEC;
5129 }
5130 if (!TTE_IS_PRIVILEGED(ttep)) {
5131 attr |= PROT_USER;
5132 }
5133 if (TTE_IS_NFO(ttep)) {
5134 attr |= HAT_NOFAULT;
5135 }
5136 if (TTE_IS_NOSYNC(ttep)) {
5137 attr |= HAT_NOSYNC;
5138 }
5139 if (TTE_IS_SIDEFFECT(ttep)) {
5140 attr |= SFMMU_SIDEFFECT;
5141 }
5142 if (!TTE_IS_VCACHEABLE(ttep)) {
5143 attr |= SFMMU_UNCACHEVTTE;
5144 }
5145 if (!TTE_IS_PCACHEABLE(ttep)) {
5146 attr |= SFMMU_UNCACHEPTTE;
5147 }
5148 return (attr);
5149 }
5150
5151 /*
5152 * hat_chgprot is a deprecated hat call. New segment drivers
5153 * should store all attributes and use hat_*attr calls.
5154 *
5155 * Change the protections in the virtual address range
5156 * given to the specified virtual protection. If vprot is ~PROT_WRITE,
5157 * then remove write permission, leaving the other
5158 * permissions unchanged. If vprot is ~PROT_USER, remove user permissions.
5159 *
5160 */
5161 void
5162 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5163 {
5164 struct hmehash_bucket *hmebp;
5165 hmeblk_tag hblktag;
5166 int hmeshift, hashno = 1;
5167 struct hme_blk *hmeblkp, *list = NULL;
5168 caddr_t endaddr;
5169 cpuset_t cpuset;
5170 demap_range_t dmr;
5171
5172 ASSERT((len & MMU_PAGEOFFSET) == 0);
5173 ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5174
5175 ASSERT(sfmmup->sfmmu_as != NULL);
5176
5177 CPUSET_ZERO(cpuset);
5178
5179 if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5180 ((addr + len) > (caddr_t)USERLIMIT)) {
5181 panic("user addr %p vprot %x in kernel space",
5182 (void *)addr, vprot);
5183 }
5184 endaddr = addr + len;
5185 hblktag.htag_id = sfmmup;
5186 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5187 DEMAP_RANGE_INIT(sfmmup, &dmr);
5188
5189 while (addr < endaddr) {
5190 hmeshift = HME_HASH_SHIFT(hashno);
5191 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5192 hblktag.htag_rehash = hashno;
5193 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5194
5195 SFMMU_HASH_LOCK(hmebp);
5196
5197 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5198 if (hmeblkp != NULL) {
5199 ASSERT(!hmeblkp->hblk_shared);
5200 /*
5201 * We've encountered a shadow hmeblk so skip the range
5202 * of the next smaller mapping size.
5203 */
5204 if (hmeblkp->hblk_shw_bit) {
5205 ASSERT(sfmmup != ksfmmup);
5206 ASSERT(hashno > 1);
5207 addr = (caddr_t)P2END((uintptr_t)addr,
5208 TTEBYTES(hashno - 1));
5209 } else {
5210 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5211 addr, endaddr, &dmr, vprot);
5212 }
5213 SFMMU_HASH_UNLOCK(hmebp);
5214 hashno = 1;
5215 continue;
5216 }
5217 SFMMU_HASH_UNLOCK(hmebp);
5218
5219 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5220 /*
5221 * We have traversed the whole list and rehashed
5222 * if necessary without finding the address to chgprot.
5223 * This is ok so we increment the address by the
5224 * smallest hmeblk range for kernel mappings and the
5225 * largest hmeblk range, to account for shadow hmeblks,
5226 * for user mappings and continue.
5227 */
5228 if (sfmmup == ksfmmup)
5229 addr = (caddr_t)P2END((uintptr_t)addr,
5230 TTEBYTES(1));
5231 else
5232 addr = (caddr_t)P2END((uintptr_t)addr,
5233 TTEBYTES(hashno));
5234 hashno = 1;
5235 } else {
5236 hashno++;
5237 }
5238 }
5239
5240 sfmmu_hblks_list_purge(&list, 0);
5241 DEMAP_RANGE_FLUSH(&dmr);
5242 cpuset = sfmmup->sfmmu_cpusran;
5243 xt_sync(cpuset);
5244 }
5245
5246 /*
5247 * This function chgprots a range of addresses in an hmeblk. It returns the
5248 * next addres that needs to be chgprot.
5249 * It should be called with the hash lock held.
5250 * XXX It shold be possible to optimize chgprot by not flushing every time but
5251 * on the other hand:
5252 * 1. do one flush crosscall.
5253 * 2. only flush if we are increasing permissions (make sure this will work)
5254 */
5255 static caddr_t
5256 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5257 caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5258 {
5259 uint_t pprot;
5260 tte_t tte, ttemod;
5261 struct sf_hment *sfhmep;
5262 uint_t tteflags;
5263 int ttesz;
5264 struct page *pp = NULL;
5265 kmutex_t *pml, *pmtx;
5266 int ret;
5267 int use_demap_range;
5268 #if defined(SF_ERRATA_57)
5269 int check_exec;
5270 #endif
5271
5272 ASSERT(in_hblk_range(hmeblkp, addr));
5273 ASSERT(hmeblkp->hblk_shw_bit == 0);
5274 ASSERT(!hmeblkp->hblk_shared);
5275
5276 #ifdef DEBUG
5277 if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5278 (endaddr < get_hblk_endaddr(hmeblkp))) {
5279 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5280 }
5281 #endif /* DEBUG */
5282
5283 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5284 ttesz = get_hblk_ttesz(hmeblkp);
5285
5286 pprot = sfmmu_vtop_prot(vprot, &tteflags);
5287 #if defined(SF_ERRATA_57)
5288 check_exec = (sfmmup != ksfmmup) &&
5289 AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5290 ((vprot & PROT_EXEC) == PROT_EXEC);
5291 #endif
5292 HBLKTOHME(sfhmep, hmeblkp, addr);
5293
5294 /*
5295 * Flush the current demap region if addresses have been
5296 * skipped or the page size doesn't match.
5297 */
5298 use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5299 if (use_demap_range) {
5300 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5301 } else if (dmrp != NULL) {
5302 DEMAP_RANGE_FLUSH(dmrp);
5303 }
5304
5305 while (addr < endaddr) {
5306 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5307 if (TTE_IS_VALID(&tte)) {
5308 if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5309 /*
5310 * if the new protection is the same as old
5311 * continue
5312 */
5313 goto next_addr;
5314 }
5315 pml = NULL;
5316 pp = sfhmep->hme_page;
5317 if (pp) {
5318 pml = sfmmu_mlist_enter(pp);
5319 }
5320 if (pp != sfhmep->hme_page) {
5321 /*
5322 * tte most have been unloaded
5323 * underneath us. Recheck
5324 */
5325 ASSERT(pml);
5326 sfmmu_mlist_exit(pml);
5327 continue;
5328 }
5329
5330 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5331
5332 ttemod = tte;
5333 TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5334 #if defined(SF_ERRATA_57)
5335 if (check_exec && addr < errata57_limit)
5336 ttemod.tte_exec_perm = 0;
5337 #endif
5338 ret = sfmmu_modifytte_try(&tte, &ttemod,
5339 &sfhmep->hme_tte);
5340
5341 if (ret < 0) {
5342 /* tte changed underneath us */
5343 if (pml) {
5344 sfmmu_mlist_exit(pml);
5345 }
5346 continue;
5347 }
5348
5349 if (tteflags & TTE_HWWR_INT) {
5350 /*
5351 * need to sync if we are clearing modify bit.
5352 */
5353 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5354 }
5355
5356 if (pp && PP_ISRO(pp)) {
5357 if (pprot & TTE_WRPRM_INT) {
5358 pmtx = sfmmu_page_enter(pp);
5359 PP_CLRRO(pp);
5360 sfmmu_page_exit(pmtx);
5361 }
5362 }
5363
5364 if (ret > 0 && use_demap_range) {
5365 DEMAP_RANGE_MARKPG(dmrp, addr);
5366 } else if (ret > 0) {
5367 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5368 }
5369
5370 if (pml) {
5371 sfmmu_mlist_exit(pml);
5372 }
5373 }
5374 next_addr:
5375 addr += TTEBYTES(ttesz);
5376 sfhmep++;
5377 DEMAP_RANGE_NEXTPG(dmrp);
5378 }
5379 return (addr);
5380 }
5381
5382 /*
5383 * This routine is deprecated and should only be used by hat_chgprot.
5384 * The correct routine is sfmmu_vtop_attr.
5385 * This routine converts virtual page protections to physical ones. It will
5386 * update the tteflags field with the tte mask corresponding to the protections
5387 * affected and it returns the new protections. It will also clear the modify
5388 * bit if we are taking away write permission. This is necessary since the
5389 * modify bit is the hardware permission bit and we need to clear it in order
5390 * to detect write faults.
5391 * It accepts the following special protections:
5392 * ~PROT_WRITE = remove write permissions.
5393 * ~PROT_USER = remove user permissions.
5394 */
5395 static uint_t
5396 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5397 {
5398 if (vprot == (uint_t)~PROT_WRITE) {
5399 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5400 return (0); /* will cause wrprm to be cleared */
5401 }
5402 if (vprot == (uint_t)~PROT_USER) {
5403 *tteflagsp = TTE_PRIV_INT;
5404 return (0); /* will cause privprm to be cleared */
5405 }
5406 if ((vprot == 0) || (vprot == PROT_USER) ||
5407 ((vprot & PROT_ALL) != vprot)) {
5408 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5409 }
5410
5411 switch (vprot) {
5412 case (PROT_READ):
5413 case (PROT_EXEC):
5414 case (PROT_EXEC | PROT_READ):
5415 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5416 return (TTE_PRIV_INT); /* set prv and clr wrt */
5417 case (PROT_WRITE):
5418 case (PROT_WRITE | PROT_READ):
5419 case (PROT_EXEC | PROT_WRITE):
5420 case (PROT_EXEC | PROT_WRITE | PROT_READ):
5421 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5422 return (TTE_PRIV_INT | TTE_WRPRM_INT); /* set prv and wrt */
5423 case (PROT_USER | PROT_READ):
5424 case (PROT_USER | PROT_EXEC):
5425 case (PROT_USER | PROT_EXEC | PROT_READ):
5426 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5427 return (0); /* clr prv and wrt */
5428 case (PROT_USER | PROT_WRITE):
5429 case (PROT_USER | PROT_WRITE | PROT_READ):
5430 case (PROT_USER | PROT_EXEC | PROT_WRITE):
5431 case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5432 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5433 return (TTE_WRPRM_INT); /* clr prv and set wrt */
5434 default:
5435 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5436 }
5437 return (0);
5438 }
5439
5440 /*
5441 * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5442 * the normal algorithm would take too long for a very large VA range with
5443 * few real mappings. This routine just walks thru all HMEs in the global
5444 * hash table to find and remove mappings.
5445 */
5446 static void
5447 hat_unload_large_virtual(
5448 struct hat *sfmmup,
5449 caddr_t startaddr,
5450 size_t len,
5451 uint_t flags,
5452 hat_callback_t *callback)
5453 {
5454 struct hmehash_bucket *hmebp;
5455 struct hme_blk *hmeblkp;
5456 struct hme_blk *pr_hblk = NULL;
5457 struct hme_blk *nx_hblk;
5458 struct hme_blk *list = NULL;
5459 int i;
5460 demap_range_t dmr, *dmrp;
5461 cpuset_t cpuset;
5462 caddr_t endaddr = startaddr + len;
5463 caddr_t sa;
5464 caddr_t ea;
5465 caddr_t cb_sa[MAX_CB_ADDR];
5466 caddr_t cb_ea[MAX_CB_ADDR];
5467 int addr_cnt = 0;
5468 int a = 0;
5469
5470 if (sfmmup->sfmmu_free) {
5471 dmrp = NULL;
5472 } else {
5473 dmrp = &dmr;
5474 DEMAP_RANGE_INIT(sfmmup, dmrp);
5475 }
5476
5477 /*
5478 * Loop through all the hash buckets of HME blocks looking for matches.
5479 */
5480 for (i = 0; i <= UHMEHASH_SZ; i++) {
5481 hmebp = &uhme_hash[i];
5482 SFMMU_HASH_LOCK(hmebp);
5483 hmeblkp = hmebp->hmeblkp;
5484 pr_hblk = NULL;
5485 while (hmeblkp) {
5486 nx_hblk = hmeblkp->hblk_next;
5487
5488 /*
5489 * skip if not this context, if a shadow block or
5490 * if the mapping is not in the requested range
5491 */
5492 if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5493 hmeblkp->hblk_shw_bit ||
5494 (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5495 (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5496 pr_hblk = hmeblkp;
5497 goto next_block;
5498 }
5499
5500 ASSERT(!hmeblkp->hblk_shared);
5501 /*
5502 * unload if there are any current valid mappings
5503 */
5504 if (hmeblkp->hblk_vcnt != 0 ||
5505 hmeblkp->hblk_hmecnt != 0)
5506 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5507 sa, ea, dmrp, flags);
5508
5509 /*
5510 * on unmap we also release the HME block itself, once
5511 * all mappings are gone.
5512 */
5513 if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5514 !hmeblkp->hblk_vcnt &&
5515 !hmeblkp->hblk_hmecnt) {
5516 ASSERT(!hmeblkp->hblk_lckcnt);
5517 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5518 &list, 0);
5519 } else {
5520 pr_hblk = hmeblkp;
5521 }
5522
5523 if (callback == NULL)
5524 goto next_block;
5525
5526 /*
5527 * HME blocks may span more than one page, but we may be
5528 * unmapping only one page, so check for a smaller range
5529 * for the callback
5530 */
5531 if (sa < startaddr)
5532 sa = startaddr;
5533 if (--ea > endaddr)
5534 ea = endaddr - 1;
5535
5536 cb_sa[addr_cnt] = sa;
5537 cb_ea[addr_cnt] = ea;
5538 if (++addr_cnt == MAX_CB_ADDR) {
5539 if (dmrp != NULL) {
5540 DEMAP_RANGE_FLUSH(dmrp);
5541 cpuset = sfmmup->sfmmu_cpusran;
5542 xt_sync(cpuset);
5543 }
5544
5545 for (a = 0; a < MAX_CB_ADDR; ++a) {
5546 callback->hcb_start_addr = cb_sa[a];
5547 callback->hcb_end_addr = cb_ea[a];
5548 callback->hcb_function(callback);
5549 }
5550 addr_cnt = 0;
5551 }
5552
5553 next_block:
5554 hmeblkp = nx_hblk;
5555 }
5556 SFMMU_HASH_UNLOCK(hmebp);
5557 }
5558
5559 sfmmu_hblks_list_purge(&list, 0);
5560 if (dmrp != NULL) {
5561 DEMAP_RANGE_FLUSH(dmrp);
5562 cpuset = sfmmup->sfmmu_cpusran;
5563 xt_sync(cpuset);
5564 }
5565
5566 for (a = 0; a < addr_cnt; ++a) {
5567 callback->hcb_start_addr = cb_sa[a];
5568 callback->hcb_end_addr = cb_ea[a];
5569 callback->hcb_function(callback);
5570 }
5571
5572 /*
5573 * Check TSB and TLB page sizes if the process isn't exiting.
5574 */
5575 if (!sfmmup->sfmmu_free)
5576 sfmmu_check_page_sizes(sfmmup, 0);
5577 }
5578
5579 /*
5580 * Unload all the mappings in the range [addr..addr+len). addr and len must
5581 * be MMU_PAGESIZE aligned.
5582 */
5583
5584 extern struct seg *segkmap;
5585 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5586 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5587
5588
5589 void
5590 hat_unload_callback(
5591 struct hat *sfmmup,
5592 caddr_t addr,
5593 size_t len,
5594 uint_t flags,
5595 hat_callback_t *callback)
5596 {
5597 struct hmehash_bucket *hmebp;
5598 hmeblk_tag hblktag;
5599 int hmeshift, hashno, iskernel;
5600 struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5601 caddr_t endaddr;
5602 cpuset_t cpuset;
5603 int addr_count = 0;
5604 int a;
5605 caddr_t cb_start_addr[MAX_CB_ADDR];
5606 caddr_t cb_end_addr[MAX_CB_ADDR];
5607 int issegkmap = ISSEGKMAP(sfmmup, addr);
5608 demap_range_t dmr, *dmrp;
5609
5610 ASSERT(sfmmup->sfmmu_as != NULL);
5611
5612 ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5613 AS_LOCK_HELD(sfmmup->sfmmu_as));
5614
5615 ASSERT(sfmmup != NULL);
5616 ASSERT((len & MMU_PAGEOFFSET) == 0);
5617 ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5618
5619 /*
5620 * Probing through a large VA range (say 63 bits) will be slow, even
5621 * at 4 Meg steps between the probes. So, when the virtual address range
5622 * is very large, search the HME entries for what to unload.
5623 *
5624 * len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5625 *
5626 * UHMEHASH_SZ is number of hash buckets to examine
5627 *
5628 */
5629 if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5630 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5631 return;
5632 }
5633
5634 CPUSET_ZERO(cpuset);
5635
5636 /*
5637 * If the process is exiting, we can save a lot of fuss since
5638 * we'll flush the TLB when we free the ctx anyway.
5639 */
5640 if (sfmmup->sfmmu_free) {
5641 dmrp = NULL;
5642 } else {
5643 dmrp = &dmr;
5644 DEMAP_RANGE_INIT(sfmmup, dmrp);
5645 }
5646
5647 endaddr = addr + len;
5648 hblktag.htag_id = sfmmup;
5649 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5650
5651 /*
5652 * It is likely for the vm to call unload over a wide range of
5653 * addresses that are actually very sparsely populated by
5654 * translations. In order to speed this up the sfmmu hat supports
5655 * the concept of shadow hmeblks. Dummy large page hmeblks that
5656 * correspond to actual small translations are allocated at tteload
5657 * time and are referred to as shadow hmeblks. Now, during unload
5658 * time, we first check if we have a shadow hmeblk for that
5659 * translation. The absence of one means the corresponding address
5660 * range is empty and can be skipped.
5661 *
5662 * The kernel is an exception to above statement and that is why
5663 * we don't use shadow hmeblks and hash starting from the smallest
5664 * page size.
5665 */
5666 if (sfmmup == KHATID) {
5667 iskernel = 1;
5668 hashno = TTE64K;
5669 } else {
5670 iskernel = 0;
5671 if (mmu_page_sizes == max_mmu_page_sizes) {
5672 hashno = TTE256M;
5673 } else {
5674 hashno = TTE4M;
5675 }
5676 }
5677 while (addr < endaddr) {
5678 hmeshift = HME_HASH_SHIFT(hashno);
5679 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5680 hblktag.htag_rehash = hashno;
5681 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5682
5683 SFMMU_HASH_LOCK(hmebp);
5684
5685 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5686 if (hmeblkp == NULL) {
5687 /*
5688 * didn't find an hmeblk. skip the appropiate
5689 * address range.
5690 */
5691 SFMMU_HASH_UNLOCK(hmebp);
5692 if (iskernel) {
5693 if (hashno < mmu_hashcnt) {
5694 hashno++;
5695 continue;
5696 } else {
5697 hashno = TTE64K;
5698 addr = (caddr_t)roundup((uintptr_t)addr
5699 + 1, MMU_PAGESIZE64K);
5700 continue;
5701 }
5702 }
5703 addr = (caddr_t)roundup((uintptr_t)addr + 1,
5704 (1 << hmeshift));
5705 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5706 ASSERT(hashno == TTE64K);
5707 continue;
5708 }
5709 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5710 hashno = TTE512K;
5711 continue;
5712 }
5713 if (mmu_page_sizes == max_mmu_page_sizes) {
5714 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5715 hashno = TTE4M;
5716 continue;
5717 }
5718 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5719 hashno = TTE32M;
5720 continue;
5721 }
5722 hashno = TTE256M;
5723 continue;
5724 } else {
5725 hashno = TTE4M;
5726 continue;
5727 }
5728 }
5729 ASSERT(hmeblkp);
5730 ASSERT(!hmeblkp->hblk_shared);
5731 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5732 /*
5733 * If the valid count is zero we can skip the range
5734 * mapped by this hmeblk.
5735 * We free hblks in the case of HAT_UNMAP. HAT_UNMAP
5736 * is used by segment drivers as a hint
5737 * that the mapping resource won't be used any longer.
5738 * The best example of this is during exit().
5739 */
5740 addr = (caddr_t)roundup((uintptr_t)addr + 1,
5741 get_hblk_span(hmeblkp));
5742 if ((flags & HAT_UNLOAD_UNMAP) ||
5743 (iskernel && !issegkmap)) {
5744 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5745 &list, 0);
5746 }
5747 SFMMU_HASH_UNLOCK(hmebp);
5748
5749 if (iskernel) {
5750 hashno = TTE64K;
5751 continue;
5752 }
5753 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5754 ASSERT(hashno == TTE64K);
5755 continue;
5756 }
5757 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5758 hashno = TTE512K;
5759 continue;
5760 }
5761 if (mmu_page_sizes == max_mmu_page_sizes) {
5762 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5763 hashno = TTE4M;
5764 continue;
5765 }
5766 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5767 hashno = TTE32M;
5768 continue;
5769 }
5770 hashno = TTE256M;
5771 continue;
5772 } else {
5773 hashno = TTE4M;
5774 continue;
5775 }
5776 }
5777 if (hmeblkp->hblk_shw_bit) {
5778 /*
5779 * If we encounter a shadow hmeblk we know there is
5780 * smaller sized hmeblks mapping the same address space.
5781 * Decrement the hash size and rehash.
5782 */
5783 ASSERT(sfmmup != KHATID);
5784 hashno--;
5785 SFMMU_HASH_UNLOCK(hmebp);
5786 continue;
5787 }
5788
5789 /*
5790 * track callback address ranges.
5791 * only start a new range when it's not contiguous
5792 */
5793 if (callback != NULL) {
5794 if (addr_count > 0 &&
5795 addr == cb_end_addr[addr_count - 1])
5796 --addr_count;
5797 else
5798 cb_start_addr[addr_count] = addr;
5799 }
5800
5801 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5802 dmrp, flags);
5803
5804 if (callback != NULL)
5805 cb_end_addr[addr_count++] = addr;
5806
5807 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5808 !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5809 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5810 }
5811 SFMMU_HASH_UNLOCK(hmebp);
5812
5813 /*
5814 * Notify our caller as to exactly which pages
5815 * have been unloaded. We do these in clumps,
5816 * to minimize the number of xt_sync()s that need to occur.
5817 */
5818 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5819 if (dmrp != NULL) {
5820 DEMAP_RANGE_FLUSH(dmrp);
5821 cpuset = sfmmup->sfmmu_cpusran;
5822 xt_sync(cpuset);
5823 }
5824
5825 for (a = 0; a < MAX_CB_ADDR; ++a) {
5826 callback->hcb_start_addr = cb_start_addr[a];
5827 callback->hcb_end_addr = cb_end_addr[a];
5828 callback->hcb_function(callback);
5829 }
5830 addr_count = 0;
5831 }
5832 if (iskernel) {
5833 hashno = TTE64K;
5834 continue;
5835 }
5836 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5837 ASSERT(hashno == TTE64K);
5838 continue;
5839 }
5840 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5841 hashno = TTE512K;
5842 continue;
5843 }
5844 if (mmu_page_sizes == max_mmu_page_sizes) {
5845 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5846 hashno = TTE4M;
5847 continue;
5848 }
5849 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5850 hashno = TTE32M;
5851 continue;
5852 }
5853 hashno = TTE256M;
5854 } else {
5855 hashno = TTE4M;
5856 }
5857 }
5858
5859 sfmmu_hblks_list_purge(&list, 0);
5860 if (dmrp != NULL) {
5861 DEMAP_RANGE_FLUSH(dmrp);
5862 cpuset = sfmmup->sfmmu_cpusran;
5863 xt_sync(cpuset);
5864 }
5865 if (callback && addr_count != 0) {
5866 for (a = 0; a < addr_count; ++a) {
5867 callback->hcb_start_addr = cb_start_addr[a];
5868 callback->hcb_end_addr = cb_end_addr[a];
5869 callback->hcb_function(callback);
5870 }
5871 }
5872
5873 /*
5874 * Check TSB and TLB page sizes if the process isn't exiting.
5875 */
5876 if (!sfmmup->sfmmu_free)
5877 sfmmu_check_page_sizes(sfmmup, 0);
5878 }
5879
5880 /*
5881 * Unload all the mappings in the range [addr..addr+len). addr and len must
5882 * be MMU_PAGESIZE aligned.
5883 */
5884 void
5885 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5886 {
5887 hat_unload_callback(sfmmup, addr, len, flags, NULL);
5888 }
5889
5890
5891 /*
5892 * Find the largest mapping size for this page.
5893 */
5894 int
5895 fnd_mapping_sz(page_t *pp)
5896 {
5897 int sz;
5898 int p_index;
5899
5900 p_index = PP_MAPINDEX(pp);
5901
5902 sz = 0;
5903 p_index >>= 1; /* don't care about 8K bit */
5904 for (; p_index; p_index >>= 1) {
5905 sz++;
5906 }
5907
5908 return (sz);
5909 }
5910
5911 /*
5912 * This function unloads a range of addresses for an hmeblk.
5913 * It returns the next address to be unloaded.
5914 * It should be called with the hash lock held.
5915 */
5916 static caddr_t
5917 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5918 caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
5919 {
5920 tte_t tte, ttemod;
5921 struct sf_hment *sfhmep;
5922 int ttesz;
5923 long ttecnt;
5924 page_t *pp;
5925 kmutex_t *pml;
5926 int ret;
5927 int use_demap_range;
5928
5929 ASSERT(in_hblk_range(hmeblkp, addr));
5930 ASSERT(!hmeblkp->hblk_shw_bit);
5931 ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
5932 ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
5933 ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
5934
5935 #ifdef DEBUG
5936 if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5937 (endaddr < get_hblk_endaddr(hmeblkp))) {
5938 panic("sfmmu_hblk_unload: partial unload of large page");
5939 }
5940 #endif /* DEBUG */
5941
5942 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5943 ttesz = get_hblk_ttesz(hmeblkp);
5944
5945 use_demap_range = ((dmrp == NULL) ||
5946 (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
5947
5948 if (use_demap_range) {
5949 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5950 } else if (dmrp != NULL) {
5951 DEMAP_RANGE_FLUSH(dmrp);
5952 }
5953 ttecnt = 0;
5954 HBLKTOHME(sfhmep, hmeblkp, addr);
5955
5956 while (addr < endaddr) {
5957 pml = NULL;
5958 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5959 if (TTE_IS_VALID(&tte)) {
5960 pp = sfhmep->hme_page;
5961 if (pp != NULL) {
5962 pml = sfmmu_mlist_enter(pp);
5963 }
5964
5965 /*
5966 * Verify if hme still points to 'pp' now that
5967 * we have p_mapping lock.
5968 */
5969 if (sfhmep->hme_page != pp) {
5970 if (pp != NULL && sfhmep->hme_page != NULL) {
5971 ASSERT(pml != NULL);
5972 sfmmu_mlist_exit(pml);
5973 /* Re-start this iteration. */
5974 continue;
5975 }
5976 ASSERT((pp != NULL) &&
5977 (sfhmep->hme_page == NULL));
5978 goto tte_unloaded;
5979 }
5980
5981 /*
5982 * This point on we have both HASH and p_mapping
5983 * lock.
5984 */
5985 ASSERT(pp == sfhmep->hme_page);
5986 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5987
5988 /*
5989 * We need to loop on modify tte because it is
5990 * possible for pagesync to come along and
5991 * change the software bits beneath us.
5992 *
5993 * Page_unload can also invalidate the tte after
5994 * we read tte outside of p_mapping lock.
5995 */
5996 again:
5997 ttemod = tte;
5998
5999 TTE_SET_INVALID(&ttemod);
6000 ret = sfmmu_modifytte_try(&tte, &ttemod,
6001 &sfhmep->hme_tte);
6002
6003 if (ret <= 0) {
6004 if (TTE_IS_VALID(&tte)) {
6005 ASSERT(ret < 0);
6006 goto again;
6007 }
6008 if (pp != NULL) {
6009 panic("sfmmu_hblk_unload: pp = 0x%p "
6010 "tte became invalid under mlist"
6011 " lock = 0x%p", (void *)pp,
6012 (void *)pml);
6013 }
6014 continue;
6015 }
6016
6017 if (!(flags & HAT_UNLOAD_NOSYNC)) {
6018 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6019 }
6020
6021 /*
6022 * Ok- we invalidated the tte. Do the rest of the job.
6023 */
6024 ttecnt++;
6025
6026 if (flags & HAT_UNLOAD_UNLOCK) {
6027 ASSERT(hmeblkp->hblk_lckcnt > 0);
6028 atomic_dec_32(&hmeblkp->hblk_lckcnt);
6029 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6030 }
6031
6032 /*
6033 * Normally we would need to flush the page
6034 * from the virtual cache at this point in
6035 * order to prevent a potential cache alias
6036 * inconsistency.
6037 * The particular scenario we need to worry
6038 * about is:
6039 * Given: va1 and va2 are two virtual address
6040 * that alias and map the same physical
6041 * address.
6042 * 1. mapping exists from va1 to pa and data
6043 * has been read into the cache.
6044 * 2. unload va1.
6045 * 3. load va2 and modify data using va2.
6046 * 4 unload va2.
6047 * 5. load va1 and reference data. Unless we
6048 * flush the data cache when we unload we will
6049 * get stale data.
6050 * Fortunately, page coloring eliminates the
6051 * above scenario by remembering the color a
6052 * physical page was last or is currently
6053 * mapped to. Now, we delay the flush until
6054 * the loading of translations. Only when the
6055 * new translation is of a different color
6056 * are we forced to flush.
6057 */
6058 if (use_demap_range) {
6059 /*
6060 * Mark this page as needing a demap.
6061 */
6062 DEMAP_RANGE_MARKPG(dmrp, addr);
6063 } else {
6064 ASSERT(sfmmup != NULL);
6065 ASSERT(!hmeblkp->hblk_shared);
6066 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6067 sfmmup->sfmmu_free, 0);
6068 }
6069
6070 if (pp) {
6071 /*
6072 * Remove the hment from the mapping list
6073 */
6074 ASSERT(hmeblkp->hblk_hmecnt > 0);
6075
6076 /*
6077 * Again, we cannot
6078 * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6079 */
6080 HME_SUB(sfhmep, pp);
6081 membar_stst();
6082 atomic_dec_16(&hmeblkp->hblk_hmecnt);
6083 }
6084
6085 ASSERT(hmeblkp->hblk_vcnt > 0);
6086 atomic_dec_16(&hmeblkp->hblk_vcnt);
6087
6088 ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6089 !hmeblkp->hblk_lckcnt);
6090
6091 #ifdef VAC
6092 if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6093 if (PP_ISTNC(pp)) {
6094 /*
6095 * If page was temporary
6096 * uncached, try to recache
6097 * it. Note that HME_SUB() was
6098 * called above so p_index and
6099 * mlist had been updated.
6100 */
6101 conv_tnc(pp, ttesz);
6102 } else if (pp->p_mapping == NULL) {
6103 ASSERT(kpm_enable);
6104 /*
6105 * Page is marked to be in VAC conflict
6106 * to an existing kpm mapping and/or is
6107 * kpm mapped using only the regular
6108 * pagesize.
6109 */
6110 sfmmu_kpm_hme_unload(pp);
6111 }
6112 }
6113 #endif /* VAC */
6114 } else if ((pp = sfhmep->hme_page) != NULL) {
6115 /*
6116 * TTE is invalid but the hme
6117 * still exists. let pageunload
6118 * complete its job.
6119 */
6120 ASSERT(pml == NULL);
6121 pml = sfmmu_mlist_enter(pp);
6122 if (sfhmep->hme_page != NULL) {
6123 sfmmu_mlist_exit(pml);
6124 continue;
6125 }
6126 ASSERT(sfhmep->hme_page == NULL);
6127 } else if (hmeblkp->hblk_hmecnt != 0) {
6128 /*
6129 * pageunload may have not finished decrementing
6130 * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6131 * wait for pageunload to finish. Rely on pageunload
6132 * to decrement hblk_hmecnt after hblk_vcnt.
6133 */
6134 pfn_t pfn = TTE_TO_TTEPFN(&tte);
6135 ASSERT(pml == NULL);
6136 if (pf_is_memory(pfn)) {
6137 pp = page_numtopp_nolock(pfn);
6138 if (pp != NULL) {
6139 pml = sfmmu_mlist_enter(pp);
6140 sfmmu_mlist_exit(pml);
6141 pml = NULL;
6142 }
6143 }
6144 }
6145
6146 tte_unloaded:
6147 /*
6148 * At this point, the tte we are looking at
6149 * should be unloaded, and hme has been unlinked
6150 * from page too. This is important because in
6151 * pageunload, it does ttesync() then HME_SUB.
6152 * We need to make sure HME_SUB has been completed
6153 * so we know ttesync() has been completed. Otherwise,
6154 * at exit time, after return from hat layer, VM will
6155 * release as structure which hat_setstat() (called
6156 * by ttesync()) needs.
6157 */
6158 #ifdef DEBUG
6159 {
6160 tte_t dtte;
6161
6162 ASSERT(sfhmep->hme_page == NULL);
6163
6164 sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6165 ASSERT(!TTE_IS_VALID(&dtte));
6166 }
6167 #endif
6168
6169 if (pml) {
6170 sfmmu_mlist_exit(pml);
6171 }
6172
6173 addr += TTEBYTES(ttesz);
6174 sfhmep++;
6175 DEMAP_RANGE_NEXTPG(dmrp);
6176 }
6177 /*
6178 * For shared hmeblks this routine is only called when region is freed
6179 * and no longer referenced. So no need to decrement ttecnt
6180 * in the region structure here.
6181 */
6182 if (ttecnt > 0 && sfmmup != NULL) {
6183 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6184 }
6185 return (addr);
6186 }
6187
6188 /*
6189 * Invalidate a virtual address range for the local CPU.
6190 * For best performance ensure that the va range is completely
6191 * mapped, otherwise the entire TLB will be flushed.
6192 */
6193 void
6194 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6195 {
6196 ssize_t sz;
6197 caddr_t endva = va + size;
6198
6199 while (va < endva) {
6200 sz = hat_getpagesize(sfmmup, va);
6201 if (sz < 0) {
6202 vtag_flushall();
6203 break;
6204 }
6205 vtag_flushpage(va, (uint64_t)sfmmup);
6206 va += sz;
6207 }
6208 }
6209
6210 /*
6211 * Synchronize all the mappings in the range [addr..addr+len).
6212 * Can be called with clearflag having two states:
6213 * HAT_SYNC_DONTZERO means just return the rm stats
6214 * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6215 */
6216 void
6217 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6218 {
6219 struct hmehash_bucket *hmebp;
6220 hmeblk_tag hblktag;
6221 int hmeshift, hashno = 1;
6222 struct hme_blk *hmeblkp, *list = NULL;
6223 caddr_t endaddr;
6224 cpuset_t cpuset;
6225
6226 ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6227 ASSERT((len & MMU_PAGEOFFSET) == 0);
6228 ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6229 (clearflag == HAT_SYNC_ZERORM));
6230
6231 CPUSET_ZERO(cpuset);
6232
6233 endaddr = addr + len;
6234 hblktag.htag_id = sfmmup;
6235 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6236
6237 /*
6238 * Spitfire supports 4 page sizes.
6239 * Most pages are expected to be of the smallest page
6240 * size (8K) and these will not need to be rehashed. 64K
6241 * pages also don't need to be rehashed because the an hmeblk
6242 * spans 64K of address space. 512K pages might need 1 rehash and
6243 * and 4M pages 2 rehashes.
6244 */
6245 while (addr < endaddr) {
6246 hmeshift = HME_HASH_SHIFT(hashno);
6247 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6248 hblktag.htag_rehash = hashno;
6249 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6250
6251 SFMMU_HASH_LOCK(hmebp);
6252
6253 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6254 if (hmeblkp != NULL) {
6255 ASSERT(!hmeblkp->hblk_shared);
6256 /*
6257 * We've encountered a shadow hmeblk so skip the range
6258 * of the next smaller mapping size.
6259 */
6260 if (hmeblkp->hblk_shw_bit) {
6261 ASSERT(sfmmup != ksfmmup);
6262 ASSERT(hashno > 1);
6263 addr = (caddr_t)P2END((uintptr_t)addr,
6264 TTEBYTES(hashno - 1));
6265 } else {
6266 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6267 addr, endaddr, clearflag);
6268 }
6269 SFMMU_HASH_UNLOCK(hmebp);
6270 hashno = 1;
6271 continue;
6272 }
6273 SFMMU_HASH_UNLOCK(hmebp);
6274
6275 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6276 /*
6277 * We have traversed the whole list and rehashed
6278 * if necessary without finding the address to sync.
6279 * This is ok so we increment the address by the
6280 * smallest hmeblk range for kernel mappings and the
6281 * largest hmeblk range, to account for shadow hmeblks,
6282 * for user mappings and continue.
6283 */
6284 if (sfmmup == ksfmmup)
6285 addr = (caddr_t)P2END((uintptr_t)addr,
6286 TTEBYTES(1));
6287 else
6288 addr = (caddr_t)P2END((uintptr_t)addr,
6289 TTEBYTES(hashno));
6290 hashno = 1;
6291 } else {
6292 hashno++;
6293 }
6294 }
6295 sfmmu_hblks_list_purge(&list, 0);
6296 cpuset = sfmmup->sfmmu_cpusran;
6297 xt_sync(cpuset);
6298 }
6299
6300 static caddr_t
6301 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6302 caddr_t endaddr, int clearflag)
6303 {
6304 tte_t tte, ttemod;
6305 struct sf_hment *sfhmep;
6306 int ttesz;
6307 struct page *pp;
6308 kmutex_t *pml;
6309 int ret;
6310
6311 ASSERT(hmeblkp->hblk_shw_bit == 0);
6312 ASSERT(!hmeblkp->hblk_shared);
6313
6314 endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6315
6316 ttesz = get_hblk_ttesz(hmeblkp);
6317 HBLKTOHME(sfhmep, hmeblkp, addr);
6318
6319 while (addr < endaddr) {
6320 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6321 if (TTE_IS_VALID(&tte)) {
6322 pml = NULL;
6323 pp = sfhmep->hme_page;
6324 if (pp) {
6325 pml = sfmmu_mlist_enter(pp);
6326 }
6327 if (pp != sfhmep->hme_page) {
6328 /*
6329 * tte most have been unloaded
6330 * underneath us. Recheck
6331 */
6332 ASSERT(pml);
6333 sfmmu_mlist_exit(pml);
6334 continue;
6335 }
6336
6337 ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6338
6339 if (clearflag == HAT_SYNC_ZERORM) {
6340 ttemod = tte;
6341 TTE_CLR_RM(&ttemod);
6342 ret = sfmmu_modifytte_try(&tte, &ttemod,
6343 &sfhmep->hme_tte);
6344 if (ret < 0) {
6345 if (pml) {
6346 sfmmu_mlist_exit(pml);
6347 }
6348 continue;
6349 }
6350
6351 if (ret > 0) {
6352 sfmmu_tlb_demap(addr, sfmmup,
6353 hmeblkp, 0, 0);
6354 }
6355 }
6356 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6357 if (pml) {
6358 sfmmu_mlist_exit(pml);
6359 }
6360 }
6361 addr += TTEBYTES(ttesz);
6362 sfhmep++;
6363 }
6364 return (addr);
6365 }
6366
6367 /*
6368 * This function will sync a tte to the page struct and it will
6369 * update the hat stats. Currently it allows us to pass a NULL pp
6370 * and we will simply update the stats. We may want to change this
6371 * so we only keep stats for pages backed by pp's.
6372 */
6373 static void
6374 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6375 {
6376 uint_t rm = 0;
6377 int sz;
6378 pgcnt_t npgs;
6379
6380 ASSERT(TTE_IS_VALID(ttep));
6381
6382 if (TTE_IS_NOSYNC(ttep)) {
6383 return;
6384 }
6385
6386 if (TTE_IS_REF(ttep)) {
6387 rm = P_REF;
6388 }
6389 if (TTE_IS_MOD(ttep)) {
6390 rm |= P_MOD;
6391 }
6392
6393 if (rm == 0) {
6394 return;
6395 }
6396
6397 sz = TTE_CSZ(ttep);
6398 if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6399 int i;
6400 caddr_t vaddr = addr;
6401
6402 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6403 hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6404 }
6405
6406 }
6407
6408 /*
6409 * XXX I want to use cas to update nrm bits but they
6410 * currently belong in common/vm and not in hat where
6411 * they should be.
6412 * The nrm bits are protected by the same mutex as
6413 * the one that protects the page's mapping list.
6414 */
6415 if (!pp)
6416 return;
6417 ASSERT(sfmmu_mlist_held(pp));
6418 /*
6419 * If the tte is for a large page, we need to sync all the
6420 * pages covered by the tte.
6421 */
6422 if (sz != TTE8K) {
6423 ASSERT(pp->p_szc != 0);
6424 pp = PP_GROUPLEADER(pp, sz);
6425 ASSERT(sfmmu_mlist_held(pp));
6426 }
6427
6428 /* Get number of pages from tte size. */
6429 npgs = TTEPAGES(sz);
6430
6431 do {
6432 ASSERT(pp);
6433 ASSERT(sfmmu_mlist_held(pp));
6434 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6435 ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6436 hat_page_setattr(pp, rm);
6437
6438 /*
6439 * Are we done? If not, we must have a large mapping.
6440 * For large mappings we need to sync the rest of the pages
6441 * covered by this tte; goto the next page.
6442 */
6443 } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6444 }
6445
6446 /*
6447 * Execute pre-callback handler of each pa_hment linked to pp
6448 *
6449 * Inputs:
6450 * flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6451 * capture_cpus: pointer to return value (below)
6452 *
6453 * Returns:
6454 * Propagates the subsystem callback return values back to the caller;
6455 * returns 0 on success. If capture_cpus is non-NULL, the value returned
6456 * is zero if all of the pa_hments are of a type that do not require
6457 * capturing CPUs prior to suspending the mapping, else it is 1.
6458 */
6459 static int
6460 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6461 {
6462 struct sf_hment *sfhmep;
6463 struct pa_hment *pahmep;
6464 int (*f)(caddr_t, uint_t, uint_t, void *);
6465 int ret;
6466 id_t id;
6467 int locked = 0;
6468 kmutex_t *pml;
6469
6470 ASSERT(PAGE_EXCL(pp));
6471 if (!sfmmu_mlist_held(pp)) {
6472 pml = sfmmu_mlist_enter(pp);
6473 locked = 1;
6474 }
6475
6476 if (capture_cpus)
6477 *capture_cpus = 0;
6478
6479 top:
6480 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6481 /*
6482 * skip sf_hments corresponding to VA<->PA mappings;
6483 * for pa_hment's, hme_tte.ll is zero
6484 */
6485 if (!IS_PAHME(sfhmep))
6486 continue;
6487
6488 pahmep = sfhmep->hme_data;
6489 ASSERT(pahmep != NULL);
6490
6491 /*
6492 * skip if pre-handler has been called earlier in this loop
6493 */
6494 if (pahmep->flags & flag)
6495 continue;
6496
6497 id = pahmep->cb_id;
6498 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6499 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6500 *capture_cpus = 1;
6501 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6502 pahmep->flags |= flag;
6503 continue;
6504 }
6505
6506 /*
6507 * Drop the mapping list lock to avoid locking order issues.
6508 */
6509 if (locked)
6510 sfmmu_mlist_exit(pml);
6511
6512 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6513 if (ret != 0)
6514 return (ret); /* caller must do the cleanup */
6515
6516 if (locked) {
6517 pml = sfmmu_mlist_enter(pp);
6518 pahmep->flags |= flag;
6519 goto top;
6520 }
6521
6522 pahmep->flags |= flag;
6523 }
6524
6525 if (locked)
6526 sfmmu_mlist_exit(pml);
6527
6528 return (0);
6529 }
6530
6531 /*
6532 * Execute post-callback handler of each pa_hment linked to pp
6533 *
6534 * Same overall assumptions and restrictions apply as for
6535 * hat_pageprocess_precallbacks().
6536 */
6537 static void
6538 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6539 {
6540 pfn_t pgpfn = pp->p_pagenum;
6541 pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6542 pfn_t newpfn;
6543 struct sf_hment *sfhmep;
6544 struct pa_hment *pahmep;
6545 int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6546 id_t id;
6547 int locked = 0;
6548 kmutex_t *pml;
6549
6550 ASSERT(PAGE_EXCL(pp));
6551 if (!sfmmu_mlist_held(pp)) {
6552 pml = sfmmu_mlist_enter(pp);
6553 locked = 1;
6554 }
6555
6556 top:
6557 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6558 /*
6559 * skip sf_hments corresponding to VA<->PA mappings;
6560 * for pa_hment's, hme_tte.ll is zero
6561 */
6562 if (!IS_PAHME(sfhmep))
6563 continue;
6564
6565 pahmep = sfhmep->hme_data;
6566 ASSERT(pahmep != NULL);
6567
6568 if ((pahmep->flags & flag) == 0)
6569 continue;
6570
6571 pahmep->flags &= ~flag;
6572
6573 id = pahmep->cb_id;
6574 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6575 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6576 continue;
6577
6578 /*
6579 * Convert the base page PFN into the constituent PFN
6580 * which is needed by the callback handler.
6581 */
6582 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6583
6584 /*
6585 * Drop the mapping list lock to avoid locking order issues.
6586 */
6587 if (locked)
6588 sfmmu_mlist_exit(pml);
6589
6590 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6591 != 0)
6592 panic("sfmmu: posthandler failed");
6593
6594 if (locked) {
6595 pml = sfmmu_mlist_enter(pp);
6596 goto top;
6597 }
6598 }
6599
6600 if (locked)
6601 sfmmu_mlist_exit(pml);
6602 }
6603
6604 /*
6605 * Suspend locked kernel mapping
6606 */
6607 void
6608 hat_pagesuspend(struct page *pp)
6609 {
6610 struct sf_hment *sfhmep;
6611 sfmmu_t *sfmmup;
6612 tte_t tte, ttemod;
6613 struct hme_blk *hmeblkp;
6614 caddr_t addr;
6615 int index, cons;
6616 cpuset_t cpuset;
6617
6618 ASSERT(PAGE_EXCL(pp));
6619 ASSERT(sfmmu_mlist_held(pp));
6620
6621 mutex_enter(&kpr_suspendlock);
6622
6623 /*
6624 * We're about to suspend a kernel mapping so mark this thread as
6625 * non-traceable by DTrace. This prevents us from running into issues
6626 * with probe context trying to touch a suspended page
6627 * in the relocation codepath itself.
6628 */
6629 curthread->t_flag |= T_DONTDTRACE;
6630
6631 index = PP_MAPINDEX(pp);
6632 cons = TTE8K;
6633
6634 retry:
6635 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6636
6637 if (IS_PAHME(sfhmep))
6638 continue;
6639
6640 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6641 continue;
6642
6643 /*
6644 * Loop until we successfully set the suspend bit in
6645 * the TTE.
6646 */
6647 again:
6648 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6649 ASSERT(TTE_IS_VALID(&tte));
6650
6651 ttemod = tte;
6652 TTE_SET_SUSPEND(&ttemod);
6653 if (sfmmu_modifytte_try(&tte, &ttemod,
6654 &sfhmep->hme_tte) < 0)
6655 goto again;
6656
6657 /*
6658 * Invalidate TSB entry
6659 */
6660 hmeblkp = sfmmu_hmetohblk(sfhmep);
6661
6662 sfmmup = hblktosfmmu(hmeblkp);
6663 ASSERT(sfmmup == ksfmmup);
6664 ASSERT(!hmeblkp->hblk_shared);
6665
6666 addr = tte_to_vaddr(hmeblkp, tte);
6667
6668 /*
6669 * No need to make sure that the TSB for this sfmmu is
6670 * not being relocated since it is ksfmmup and thus it
6671 * will never be relocated.
6672 */
6673 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6674
6675 /*
6676 * Update xcall stats
6677 */
6678 cpuset = cpu_ready_set;
6679 CPUSET_DEL(cpuset, CPU->cpu_id);
6680
6681 /* LINTED: constant in conditional context */
6682 SFMMU_XCALL_STATS(ksfmmup);
6683
6684 /*
6685 * Flush TLB entry on remote CPU's
6686 */
6687 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6688 (uint64_t)ksfmmup);
6689 xt_sync(cpuset);
6690
6691 /*
6692 * Flush TLB entry on local CPU
6693 */
6694 vtag_flushpage(addr, (uint64_t)ksfmmup);
6695 }
6696
6697 while (index != 0) {
6698 index = index >> 1;
6699 if (index != 0)
6700 cons++;
6701 if (index & 0x1) {
6702 pp = PP_GROUPLEADER(pp, cons);
6703 goto retry;
6704 }
6705 }
6706 }
6707
6708 #ifdef DEBUG
6709
6710 #define N_PRLE 1024
6711 struct prle {
6712 page_t *targ;
6713 page_t *repl;
6714 int status;
6715 int pausecpus;
6716 hrtime_t whence;
6717 };
6718
6719 static struct prle page_relocate_log[N_PRLE];
6720 static int prl_entry;
6721 static kmutex_t prl_mutex;
6722
6723 #define PAGE_RELOCATE_LOG(t, r, s, p) \
6724 mutex_enter(&prl_mutex); \
6725 page_relocate_log[prl_entry].targ = *(t); \
6726 page_relocate_log[prl_entry].repl = *(r); \
6727 page_relocate_log[prl_entry].status = (s); \
6728 page_relocate_log[prl_entry].pausecpus = (p); \
6729 page_relocate_log[prl_entry].whence = gethrtime(); \
6730 prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1; \
6731 mutex_exit(&prl_mutex);
6732
6733 #else /* !DEBUG */
6734 #define PAGE_RELOCATE_LOG(t, r, s, p)
6735 #endif
6736
6737 /*
6738 * Core Kernel Page Relocation Algorithm
6739 *
6740 * Input:
6741 *
6742 * target : constituent pages are SE_EXCL locked.
6743 * replacement: constituent pages are SE_EXCL locked.
6744 *
6745 * Output:
6746 *
6747 * nrelocp: number of pages relocated
6748 */
6749 int
6750 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6751 {
6752 page_t *targ, *repl;
6753 page_t *tpp, *rpp;
6754 kmutex_t *low, *high;
6755 spgcnt_t npages, i;
6756 page_t *pl = NULL;
6757 int old_pil;
6758 cpuset_t cpuset;
6759 int cap_cpus;
6760 int ret;
6761 #ifdef VAC
6762 int cflags = 0;
6763 #endif
6764
6765 if (!kcage_on || PP_ISNORELOC(*target)) {
6766 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6767 return (EAGAIN);
6768 }
6769
6770 mutex_enter(&kpr_mutex);
6771 kreloc_thread = curthread;
6772
6773 targ = *target;
6774 repl = *replacement;
6775 ASSERT(repl != NULL);
6776 ASSERT(targ->p_szc == repl->p_szc);
6777
6778 npages = page_get_pagecnt(targ->p_szc);
6779
6780 /*
6781 * unload VA<->PA mappings that are not locked
6782 */
6783 tpp = targ;
6784 for (i = 0; i < npages; i++) {
6785 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6786 tpp++;
6787 }
6788
6789 /*
6790 * Do "presuspend" callbacks, in a context from which we can still
6791 * block as needed. Note that we don't hold the mapping list lock
6792 * of "targ" at this point due to potential locking order issues;
6793 * we assume that between the hat_pageunload() above and holding
6794 * the SE_EXCL lock that the mapping list *cannot* change at this
6795 * point.
6796 */
6797 ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6798 if (ret != 0) {
6799 /*
6800 * EIO translates to fatal error, for all others cleanup
6801 * and return EAGAIN.
6802 */
6803 ASSERT(ret != EIO);
6804 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6805 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6806 kreloc_thread = NULL;
6807 mutex_exit(&kpr_mutex);
6808 return (EAGAIN);
6809 }
6810
6811 /*
6812 * acquire p_mapping list lock for both the target and replacement
6813 * root pages.
6814 *
6815 * low and high refer to the need to grab the mlist locks in a
6816 * specific order in order to prevent race conditions. Thus the
6817 * lower lock must be grabbed before the higher lock.
6818 *
6819 * This will block hat_unload's accessing p_mapping list. Since
6820 * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6821 * blocked. Thus, no one else will be accessing the p_mapping list
6822 * while we suspend and reload the locked mapping below.
6823 */
6824 tpp = targ;
6825 rpp = repl;
6826 sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6827
6828 kpreempt_disable();
6829
6830 /*
6831 * We raise our PIL to 13 so that we don't get captured by
6832 * another CPU or pinned by an interrupt thread. We can't go to
6833 * PIL 14 since the nexus driver(s) may need to interrupt at
6834 * that level in the case of IOMMU pseudo mappings.
6835 */
6836 cpuset = cpu_ready_set;
6837 CPUSET_DEL(cpuset, CPU->cpu_id);
6838 if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6839 old_pil = splr(XCALL_PIL);
6840 } else {
6841 old_pil = -1;
6842 xc_attention(cpuset);
6843 }
6844 ASSERT(getpil() == XCALL_PIL);
6845
6846 /*
6847 * Now do suspend callbacks. In the case of an IOMMU mapping
6848 * this will suspend all DMA activity to the page while it is
6849 * being relocated. Since we are well above LOCK_LEVEL and CPUs
6850 * may be captured at this point we should have acquired any needed
6851 * locks in the presuspend callback.
6852 */
6853 ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6854 if (ret != 0) {
6855 repl = targ;
6856 goto suspend_fail;
6857 }
6858
6859 /*
6860 * Raise the PIL yet again, this time to block all high-level
6861 * interrupts on this CPU. This is necessary to prevent an
6862 * interrupt routine from pinning the thread which holds the
6863 * mapping suspended and then touching the suspended page.
6864 *
6865 * Once the page is suspended we also need to be careful to
6866 * avoid calling any functions which touch any seg_kmem memory
6867 * since that memory may be backed by the very page we are
6868 * relocating in here!
6869 */
6870 hat_pagesuspend(targ);
6871
6872 /*
6873 * Now that we are confident everybody has stopped using this page,
6874 * copy the page contents. Note we use a physical copy to prevent
6875 * locking issues and to avoid fpRAS because we can't handle it in
6876 * this context.
6877 */
6878 for (i = 0; i < npages; i++, tpp++, rpp++) {
6879 #ifdef VAC
6880 /*
6881 * If the replacement has a different vcolor than
6882 * the one being replacd, we need to handle VAC
6883 * consistency for it just as we were setting up
6884 * a new mapping to it.
6885 */
6886 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6887 (tpp->p_vcolor != rpp->p_vcolor) &&
6888 !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6889 CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6890 sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6891 rpp->p_pagenum);
6892 }
6893 #endif
6894 /*
6895 * Copy the contents of the page.
6896 */
6897 ppcopy_kernel(tpp, rpp);
6898 }
6899
6900 tpp = targ;
6901 rpp = repl;
6902 for (i = 0; i < npages; i++, tpp++, rpp++) {
6903 /*
6904 * Copy attributes. VAC consistency was handled above,
6905 * if required.
6906 */
6907 rpp->p_nrm = tpp->p_nrm;
6908 tpp->p_nrm = 0;
6909 rpp->p_index = tpp->p_index;
6910 tpp->p_index = 0;
6911 #ifdef VAC
6912 rpp->p_vcolor = tpp->p_vcolor;
6913 #endif
6914 }
6915
6916 /*
6917 * First, unsuspend the page, if we set the suspend bit, and transfer
6918 * the mapping list from the target page to the replacement page.
6919 * Next process postcallbacks; since pa_hment's are linked only to the
6920 * p_mapping list of root page, we don't iterate over the constituent
6921 * pages.
6922 */
6923 hat_pagereload(targ, repl);
6924
6925 suspend_fail:
6926 hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
6927
6928 /*
6929 * Now lower our PIL and release any captured CPUs since we
6930 * are out of the "danger zone". After this it will again be
6931 * safe to acquire adaptive mutex locks, or to drop them...
6932 */
6933 if (old_pil != -1) {
6934 splx(old_pil);
6935 } else {
6936 xc_dismissed(cpuset);
6937 }
6938
6939 kpreempt_enable();
6940
6941 sfmmu_mlist_reloc_exit(low, high);
6942
6943 /*
6944 * Postsuspend callbacks should drop any locks held across
6945 * the suspend callbacks. As before, we don't hold the mapping
6946 * list lock at this point.. our assumption is that the mapping
6947 * list still can't change due to our holding SE_EXCL lock and
6948 * there being no unlocked mappings left. Hence the restriction
6949 * on calling context to hat_delete_callback()
6950 */
6951 hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
6952 if (ret != 0) {
6953 /*
6954 * The second presuspend call failed: we got here through
6955 * the suspend_fail label above.
6956 */
6957 ASSERT(ret != EIO);
6958 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
6959 kreloc_thread = NULL;
6960 mutex_exit(&kpr_mutex);
6961 return (EAGAIN);
6962 }
6963
6964 /*
6965 * Now that we're out of the performance critical section we can
6966 * take care of updating the hash table, since we still
6967 * hold all the pages locked SE_EXCL at this point we
6968 * needn't worry about things changing out from under us.
6969 */
6970 tpp = targ;
6971 rpp = repl;
6972 for (i = 0; i < npages; i++, tpp++, rpp++) {
6973
6974 /*
6975 * replace targ with replacement in page_hash table
6976 */
6977 targ = tpp;
6978 page_relocate_hash(rpp, targ);
6979
6980 /*
6981 * concatenate target; caller of platform_page_relocate()
6982 * expects target to be concatenated after returning.
6983 */
6984 ASSERT(targ->p_next == targ);
6985 ASSERT(targ->p_prev == targ);
6986 page_list_concat(&pl, &targ);
6987 }
6988
6989 ASSERT(*target == pl);
6990 *nrelocp = npages;
6991 PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
6992 kreloc_thread = NULL;
6993 mutex_exit(&kpr_mutex);
6994 return (0);
6995 }
6996
6997 /*
6998 * Called when stray pa_hments are found attached to a page which is
6999 * being freed. Notify the subsystem which attached the pa_hment of
7000 * the error if it registered a suitable handler, else panic.
7001 */
7002 static void
7003 sfmmu_pahment_leaked(struct pa_hment *pahmep)
7004 {
7005 id_t cb_id = pahmep->cb_id;
7006
7007 ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
7008 if (sfmmu_cb_table[cb_id].errhandler != NULL) {
7009 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7010 HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7011 return; /* non-fatal */
7012 }
7013 panic("pa_hment leaked: 0x%p", (void *)pahmep);
7014 }
7015
7016 /*
7017 * Remove all mappings to page 'pp'.
7018 */
7019 int
7020 hat_pageunload(struct page *pp, uint_t forceflag)
7021 {
7022 struct page *origpp = pp;
7023 struct sf_hment *sfhme, *tmphme;
7024 struct hme_blk *hmeblkp;
7025 kmutex_t *pml;
7026 #ifdef VAC
7027 kmutex_t *pmtx;
7028 #endif
7029 cpuset_t cpuset, tset;
7030 int index, cons;
7031 int pa_hments;
7032
7033 ASSERT(PAGE_EXCL(pp));
7034
7035 tmphme = NULL;
7036 pa_hments = 0;
7037 CPUSET_ZERO(cpuset);
7038
7039 pml = sfmmu_mlist_enter(pp);
7040
7041 #ifdef VAC
7042 if (pp->p_kpmref)
7043 sfmmu_kpm_pageunload(pp);
7044 ASSERT(!PP_ISMAPPED_KPM(pp));
7045 #endif
7046 /*
7047 * Clear vpm reference. Since the page is exclusively locked
7048 * vpm cannot be referencing it.
7049 */
7050 if (vpm_enable) {
7051 pp->p_vpmref = 0;
7052 }
7053
7054 index = PP_MAPINDEX(pp);
7055 cons = TTE8K;
7056 retry:
7057 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7058 tmphme = sfhme->hme_next;
7059
7060 if (IS_PAHME(sfhme)) {
7061 ASSERT(sfhme->hme_data != NULL);
7062 pa_hments++;
7063 continue;
7064 }
7065
7066 hmeblkp = sfmmu_hmetohblk(sfhme);
7067
7068 /*
7069 * If there are kernel mappings don't unload them, they will
7070 * be suspended.
7071 */
7072 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7073 hmeblkp->hblk_tag.htag_id == ksfmmup)
7074 continue;
7075
7076 tset = sfmmu_pageunload(pp, sfhme, cons);
7077 CPUSET_OR(cpuset, tset);
7078 }
7079
7080 while (index != 0) {
7081 index = index >> 1;
7082 if (index != 0)
7083 cons++;
7084 if (index & 0x1) {
7085 /* Go to leading page */
7086 pp = PP_GROUPLEADER(pp, cons);
7087 ASSERT(sfmmu_mlist_held(pp));
7088 goto retry;
7089 }
7090 }
7091
7092 /*
7093 * cpuset may be empty if the page was only mapped by segkpm,
7094 * in which case we won't actually cross-trap.
7095 */
7096 xt_sync(cpuset);
7097
7098 /*
7099 * The page should have no mappings at this point, unless
7100 * we were called from hat_page_relocate() in which case we
7101 * leave the locked mappings which will be suspended later.
7102 */
7103 ASSERT(!PP_ISMAPPED(origpp) || pa_hments ||
7104 (forceflag == SFMMU_KERNEL_RELOC));
7105
7106 #ifdef VAC
7107 if (PP_ISTNC(pp)) {
7108 if (cons == TTE8K) {
7109 pmtx = sfmmu_page_enter(pp);
7110 PP_CLRTNC(pp);
7111 sfmmu_page_exit(pmtx);
7112 } else {
7113 conv_tnc(pp, cons);
7114 }
7115 }
7116 #endif /* VAC */
7117
7118 if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7119 /*
7120 * Unlink any pa_hments and free them, calling back
7121 * the responsible subsystem to notify it of the error.
7122 * This can occur in situations such as drivers leaking
7123 * DMA handles: naughty, but common enough that we'd like
7124 * to keep the system running rather than bringing it
7125 * down with an obscure error like "pa_hment leaked"
7126 * which doesn't aid the user in debugging their driver.
7127 */
7128 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7129 tmphme = sfhme->hme_next;
7130 if (IS_PAHME(sfhme)) {
7131 struct pa_hment *pahmep = sfhme->hme_data;
7132 sfmmu_pahment_leaked(pahmep);
7133 HME_SUB(sfhme, pp);
7134 kmem_cache_free(pa_hment_cache, pahmep);
7135 }
7136 }
7137
7138 ASSERT(!PP_ISMAPPED(origpp));
7139 }
7140
7141 sfmmu_mlist_exit(pml);
7142
7143 return (0);
7144 }
7145
7146 cpuset_t
7147 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7148 {
7149 struct hme_blk *hmeblkp;
7150 sfmmu_t *sfmmup;
7151 tte_t tte, ttemod;
7152 #ifdef DEBUG
7153 tte_t orig_old;
7154 #endif /* DEBUG */
7155 caddr_t addr;
7156 int ttesz;
7157 int ret;
7158 cpuset_t cpuset;
7159
7160 ASSERT(pp != NULL);
7161 ASSERT(sfmmu_mlist_held(pp));
7162 ASSERT(!PP_ISKAS(pp));
7163
7164 CPUSET_ZERO(cpuset);
7165
7166 hmeblkp = sfmmu_hmetohblk(sfhme);
7167
7168 readtte:
7169 sfmmu_copytte(&sfhme->hme_tte, &tte);
7170 if (TTE_IS_VALID(&tte)) {
7171 sfmmup = hblktosfmmu(hmeblkp);
7172 ttesz = get_hblk_ttesz(hmeblkp);
7173 /*
7174 * Only unload mappings of 'cons' size.
7175 */
7176 if (ttesz != cons)
7177 return (cpuset);
7178
7179 /*
7180 * Note that we have p_mapping lock, but no hash lock here.
7181 * hblk_unload() has to have both hash lock AND p_mapping
7182 * lock before it tries to modify tte. So, the tte could
7183 * not become invalid in the sfmmu_modifytte_try() below.
7184 */
7185 ttemod = tte;
7186 #ifdef DEBUG
7187 orig_old = tte;
7188 #endif /* DEBUG */
7189
7190 TTE_SET_INVALID(&ttemod);
7191 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7192 if (ret < 0) {
7193 #ifdef DEBUG
7194 /* only R/M bits can change. */
7195 chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7196 #endif /* DEBUG */
7197 goto readtte;
7198 }
7199
7200 if (ret == 0) {
7201 panic("pageunload: cas failed?");
7202 }
7203
7204 addr = tte_to_vaddr(hmeblkp, tte);
7205
7206 if (hmeblkp->hblk_shared) {
7207 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7208 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7209 sf_region_t *rgnp;
7210 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7211 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7212 ASSERT(srdp != NULL);
7213 rgnp = srdp->srd_hmergnp[rid];
7214 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7215 cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7216 sfmmu_ttesync(NULL, addr, &tte, pp);
7217 ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7218 atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7219 } else {
7220 sfmmu_ttesync(sfmmup, addr, &tte, pp);
7221 atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7222
7223 /*
7224 * We need to flush the page from the virtual cache
7225 * in order to prevent a virtual cache alias
7226 * inconsistency. The particular scenario we need
7227 * to worry about is:
7228 * Given: va1 and va2 are two virtual address that
7229 * alias and will map the same physical address.
7230 * 1. mapping exists from va1 to pa and data has
7231 * been read into the cache.
7232 * 2. unload va1.
7233 * 3. load va2 and modify data using va2.
7234 * 4 unload va2.
7235 * 5. load va1 and reference data. Unless we flush
7236 * the data cache when we unload we will get
7237 * stale data.
7238 * This scenario is taken care of by using virtual
7239 * page coloring.
7240 */
7241 if (sfmmup->sfmmu_ismhat) {
7242 /*
7243 * Flush TSBs, TLBs and caches
7244 * of every process
7245 * sharing this ism segment.
7246 */
7247 sfmmu_hat_lock_all();
7248 mutex_enter(&ism_mlist_lock);
7249 kpreempt_disable();
7250 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7251 pp->p_pagenum, CACHE_NO_FLUSH);
7252 kpreempt_enable();
7253 mutex_exit(&ism_mlist_lock);
7254 sfmmu_hat_unlock_all();
7255 cpuset = cpu_ready_set;
7256 } else {
7257 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7258 cpuset = sfmmup->sfmmu_cpusran;
7259 }
7260 }
7261
7262 /*
7263 * Hme_sub has to run after ttesync() and a_rss update.
7264 * See hblk_unload().
7265 */
7266 HME_SUB(sfhme, pp);
7267 membar_stst();
7268
7269 /*
7270 * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7271 * since pteload may have done a HME_ADD() right after
7272 * we did the HME_SUB() above. Hmecnt is now maintained
7273 * by cas only. no lock guranteed its value. The only
7274 * gurantee we have is the hmecnt should not be less than
7275 * what it should be so the hblk will not be taken away.
7276 * It's also important that we decremented the hmecnt after
7277 * we are done with hmeblkp so that this hmeblk won't be
7278 * stolen.
7279 */
7280 ASSERT(hmeblkp->hblk_hmecnt > 0);
7281 ASSERT(hmeblkp->hblk_vcnt > 0);
7282 atomic_dec_16(&hmeblkp->hblk_vcnt);
7283 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7284 /*
7285 * This is bug 4063182.
7286 * XXX: fixme
7287 * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7288 * !hmeblkp->hblk_lckcnt);
7289 */
7290 } else {
7291 panic("invalid tte? pp %p &tte %p",
7292 (void *)pp, (void *)&tte);
7293 }
7294
7295 return (cpuset);
7296 }
7297
7298 /*
7299 * While relocating a kernel page, this function will move the mappings
7300 * from tpp to dpp and modify any associated data with these mappings.
7301 * It also unsuspends the suspended kernel mapping.
7302 */
7303 static void
7304 hat_pagereload(struct page *tpp, struct page *dpp)
7305 {
7306 struct sf_hment *sfhme;
7307 tte_t tte, ttemod;
7308 int index, cons;
7309
7310 ASSERT(getpil() == PIL_MAX);
7311 ASSERT(sfmmu_mlist_held(tpp));
7312 ASSERT(sfmmu_mlist_held(dpp));
7313
7314 index = PP_MAPINDEX(tpp);
7315 cons = TTE8K;
7316
7317 /* Update real mappings to the page */
7318 retry:
7319 for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7320 if (IS_PAHME(sfhme))
7321 continue;
7322 sfmmu_copytte(&sfhme->hme_tte, &tte);
7323 ttemod = tte;
7324
7325 /*
7326 * replace old pfn with new pfn in TTE
7327 */
7328 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7329
7330 /*
7331 * clear suspend bit
7332 */
7333 ASSERT(TTE_IS_SUSPEND(&ttemod));
7334 TTE_CLR_SUSPEND(&ttemod);
7335
7336 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7337 panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7338
7339 /*
7340 * set hme_page point to new page
7341 */
7342 sfhme->hme_page = dpp;
7343 }
7344
7345 /*
7346 * move p_mapping list from old page to new page
7347 */
7348 dpp->p_mapping = tpp->p_mapping;
7349 tpp->p_mapping = NULL;
7350 dpp->p_share = tpp->p_share;
7351 tpp->p_share = 0;
7352
7353 while (index != 0) {
7354 index = index >> 1;
7355 if (index != 0)
7356 cons++;
7357 if (index & 0x1) {
7358 tpp = PP_GROUPLEADER(tpp, cons);
7359 dpp = PP_GROUPLEADER(dpp, cons);
7360 goto retry;
7361 }
7362 }
7363
7364 curthread->t_flag &= ~T_DONTDTRACE;
7365 mutex_exit(&kpr_suspendlock);
7366 }
7367
7368 uint_t
7369 hat_pagesync(struct page *pp, uint_t clearflag)
7370 {
7371 struct sf_hment *sfhme, *tmphme = NULL;
7372 struct hme_blk *hmeblkp;
7373 kmutex_t *pml;
7374 cpuset_t cpuset, tset;
7375 int index, cons;
7376 extern ulong_t po_share;
7377 page_t *save_pp = pp;
7378 int stop_on_sh = 0;
7379 uint_t shcnt;
7380
7381 CPUSET_ZERO(cpuset);
7382
7383 if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7384 return (PP_GENERIC_ATTR(pp));
7385 }
7386
7387 if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7388 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7389 return (PP_GENERIC_ATTR(pp));
7390 }
7391 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7392 return (PP_GENERIC_ATTR(pp));
7393 }
7394 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7395 if (pp->p_share > po_share) {
7396 hat_page_setattr(pp, P_REF);
7397 return (PP_GENERIC_ATTR(pp));
7398 }
7399 stop_on_sh = 1;
7400 shcnt = 0;
7401 }
7402 }
7403
7404 clearflag &= ~HAT_SYNC_STOPON_SHARED;
7405 pml = sfmmu_mlist_enter(pp);
7406 index = PP_MAPINDEX(pp);
7407 cons = TTE8K;
7408 retry:
7409 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7410 /*
7411 * We need to save the next hment on the list since
7412 * it is possible for pagesync to remove an invalid hment
7413 * from the list.
7414 */
7415 tmphme = sfhme->hme_next;
7416 if (IS_PAHME(sfhme))
7417 continue;
7418 /*
7419 * If we are looking for large mappings and this hme doesn't
7420 * reach the range we are seeking, just ignore it.
7421 */
7422 hmeblkp = sfmmu_hmetohblk(sfhme);
7423
7424 if (hme_size(sfhme) < cons)
7425 continue;
7426
7427 if (stop_on_sh) {
7428 if (hmeblkp->hblk_shared) {
7429 sf_srd_t *srdp = hblktosrd(hmeblkp);
7430 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7431 sf_region_t *rgnp;
7432 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7433 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7434 ASSERT(srdp != NULL);
7435 rgnp = srdp->srd_hmergnp[rid];
7436 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7437 rgnp, rid);
7438 shcnt += rgnp->rgn_refcnt;
7439 } else {
7440 shcnt++;
7441 }
7442 if (shcnt > po_share) {
7443 /*
7444 * tell the pager to spare the page this time
7445 * around.
7446 */
7447 hat_page_setattr(save_pp, P_REF);
7448 index = 0;
7449 break;
7450 }
7451 }
7452 tset = sfmmu_pagesync(pp, sfhme,
7453 clearflag & ~HAT_SYNC_STOPON_RM);
7454 CPUSET_OR(cpuset, tset);
7455
7456 /*
7457 * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7458 * as the "ref" or "mod" is set or share cnt exceeds po_share.
7459 */
7460 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7461 (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7462 ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7463 index = 0;
7464 break;
7465 }
7466 }
7467
7468 while (index) {
7469 index = index >> 1;
7470 cons++;
7471 if (index & 0x1) {
7472 /* Go to leading page */
7473 pp = PP_GROUPLEADER(pp, cons);
7474 goto retry;
7475 }
7476 }
7477
7478 xt_sync(cpuset);
7479 sfmmu_mlist_exit(pml);
7480 return (PP_GENERIC_ATTR(save_pp));
7481 }
7482
7483 /*
7484 * Get all the hardware dependent attributes for a page struct
7485 */
7486 static cpuset_t
7487 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7488 uint_t clearflag)
7489 {
7490 caddr_t addr;
7491 tte_t tte, ttemod;
7492 struct hme_blk *hmeblkp;
7493 int ret;
7494 sfmmu_t *sfmmup;
7495 cpuset_t cpuset;
7496
7497 ASSERT(pp != NULL);
7498 ASSERT(sfmmu_mlist_held(pp));
7499 ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7500 (clearflag == HAT_SYNC_ZERORM));
7501
7502 SFMMU_STAT(sf_pagesync);
7503
7504 CPUSET_ZERO(cpuset);
7505
7506 sfmmu_pagesync_retry:
7507
7508 sfmmu_copytte(&sfhme->hme_tte, &tte);
7509 if (TTE_IS_VALID(&tte)) {
7510 hmeblkp = sfmmu_hmetohblk(sfhme);
7511 sfmmup = hblktosfmmu(hmeblkp);
7512 addr = tte_to_vaddr(hmeblkp, tte);
7513 if (clearflag == HAT_SYNC_ZERORM) {
7514 ttemod = tte;
7515 TTE_CLR_RM(&ttemod);
7516 ret = sfmmu_modifytte_try(&tte, &ttemod,
7517 &sfhme->hme_tte);
7518 if (ret < 0) {
7519 /*
7520 * cas failed and the new value is not what
7521 * we want.
7522 */
7523 goto sfmmu_pagesync_retry;
7524 }
7525
7526 if (ret > 0) {
7527 /* we win the cas */
7528 if (hmeblkp->hblk_shared) {
7529 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7530 uint_t rid =
7531 hmeblkp->hblk_tag.htag_rid;
7532 sf_region_t *rgnp;
7533 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7534 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7535 ASSERT(srdp != NULL);
7536 rgnp = srdp->srd_hmergnp[rid];
7537 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7538 srdp, rgnp, rid);
7539 cpuset = sfmmu_rgntlb_demap(addr,
7540 rgnp, hmeblkp, 1);
7541 } else {
7542 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7543 0, 0);
7544 cpuset = sfmmup->sfmmu_cpusran;
7545 }
7546 }
7547 }
7548 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7549 &tte, pp);
7550 }
7551 return (cpuset);
7552 }
7553
7554 /*
7555 * Remove write permission from a mappings to a page, so that
7556 * we can detect the next modification of it. This requires modifying
7557 * the TTE then invalidating (demap) any TLB entry using that TTE.
7558 * This code is similar to sfmmu_pagesync().
7559 */
7560 static cpuset_t
7561 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7562 {
7563 caddr_t addr;
7564 tte_t tte;
7565 tte_t ttemod;
7566 struct hme_blk *hmeblkp;
7567 int ret;
7568 sfmmu_t *sfmmup;
7569 cpuset_t cpuset;
7570
7571 ASSERT(pp != NULL);
7572 ASSERT(sfmmu_mlist_held(pp));
7573
7574 CPUSET_ZERO(cpuset);
7575 SFMMU_STAT(sf_clrwrt);
7576
7577 retry:
7578
7579 sfmmu_copytte(&sfhme->hme_tte, &tte);
7580 if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7581 hmeblkp = sfmmu_hmetohblk(sfhme);
7582 sfmmup = hblktosfmmu(hmeblkp);
7583 addr = tte_to_vaddr(hmeblkp, tte);
7584
7585 ttemod = tte;
7586 TTE_CLR_WRT(&ttemod);
7587 TTE_CLR_MOD(&ttemod);
7588 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7589
7590 /*
7591 * if cas failed and the new value is not what
7592 * we want retry
7593 */
7594 if (ret < 0)
7595 goto retry;
7596
7597 /* we win the cas */
7598 if (ret > 0) {
7599 if (hmeblkp->hblk_shared) {
7600 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7601 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7602 sf_region_t *rgnp;
7603 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7604 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7605 ASSERT(srdp != NULL);
7606 rgnp = srdp->srd_hmergnp[rid];
7607 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7608 srdp, rgnp, rid);
7609 cpuset = sfmmu_rgntlb_demap(addr,
7610 rgnp, hmeblkp, 1);
7611 } else {
7612 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7613 cpuset = sfmmup->sfmmu_cpusran;
7614 }
7615 }
7616 }
7617
7618 return (cpuset);
7619 }
7620
7621 /*
7622 * Walk all mappings of a page, removing write permission and clearing the
7623 * ref/mod bits. This code is similar to hat_pagesync()
7624 */
7625 static void
7626 hat_page_clrwrt(page_t *pp)
7627 {
7628 struct sf_hment *sfhme;
7629 struct sf_hment *tmphme = NULL;
7630 kmutex_t *pml;
7631 cpuset_t cpuset;
7632 cpuset_t tset;
7633 int index;
7634 int cons;
7635
7636 CPUSET_ZERO(cpuset);
7637
7638 pml = sfmmu_mlist_enter(pp);
7639 index = PP_MAPINDEX(pp);
7640 cons = TTE8K;
7641 retry:
7642 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7643 tmphme = sfhme->hme_next;
7644
7645 /*
7646 * If we are looking for large mappings and this hme doesn't
7647 * reach the range we are seeking, just ignore its.
7648 */
7649
7650 if (hme_size(sfhme) < cons)
7651 continue;
7652
7653 tset = sfmmu_pageclrwrt(pp, sfhme);
7654 CPUSET_OR(cpuset, tset);
7655 }
7656
7657 while (index) {
7658 index = index >> 1;
7659 cons++;
7660 if (index & 0x1) {
7661 /* Go to leading page */
7662 pp = PP_GROUPLEADER(pp, cons);
7663 goto retry;
7664 }
7665 }
7666
7667 xt_sync(cpuset);
7668 sfmmu_mlist_exit(pml);
7669 }
7670
7671 /*
7672 * Set the given REF/MOD/RO bits for the given page.
7673 * For a vnode with a sorted v_pages list, we need to change
7674 * the attributes and the v_pages list together under page_vnode_mutex.
7675 */
7676 void
7677 hat_page_setattr(page_t *pp, uint_t flag)
7678 {
7679 vnode_t *vp = pp->p_vnode;
7680 page_t **listp;
7681 kmutex_t *pmtx;
7682 kmutex_t *vphm = NULL;
7683 int noshuffle;
7684
7685 noshuffle = flag & P_NSH;
7686 flag &= ~P_NSH;
7687
7688 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7689
7690 /*
7691 * nothing to do if attribute already set
7692 */
7693 if ((pp->p_nrm & flag) == flag)
7694 return;
7695
7696 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7697 !noshuffle) {
7698 vphm = page_vnode_mutex(vp);
7699 mutex_enter(vphm);
7700 }
7701
7702 pmtx = sfmmu_page_enter(pp);
7703 pp->p_nrm |= flag;
7704 sfmmu_page_exit(pmtx);
7705
7706 if (vphm != NULL) {
7707 /*
7708 * Some File Systems examine v_pages for NULL w/o
7709 * grabbing the vphm mutex. Must not let it become NULL when
7710 * pp is the only page on the list.
7711 */
7712 if (pp->p_vpnext != pp) {
7713 page_vpsub(&vp->v_pages, pp);
7714 if (vp->v_pages != NULL)
7715 listp = &vp->v_pages->p_vpprev->p_vpnext;
7716 else
7717 listp = &vp->v_pages;
7718 page_vpadd(listp, pp);
7719 }
7720 mutex_exit(vphm);
7721 }
7722 }
7723
7724 void
7725 hat_page_clrattr(page_t *pp, uint_t flag)
7726 {
7727 vnode_t *vp = pp->p_vnode;
7728 kmutex_t *pmtx;
7729
7730 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7731
7732 pmtx = sfmmu_page_enter(pp);
7733
7734 /*
7735 * Caller is expected to hold page's io lock for VMODSORT to work
7736 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7737 * bit is cleared.
7738 * We don't have assert to avoid tripping some existing third party
7739 * code. The dirty page is moved back to top of the v_page list
7740 * after IO is done in pvn_write_done().
7741 */
7742 pp->p_nrm &= ~flag;
7743 sfmmu_page_exit(pmtx);
7744
7745 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7746
7747 /*
7748 * VMODSORT works by removing write permissions and getting
7749 * a fault when a page is made dirty. At this point
7750 * we need to remove write permission from all mappings
7751 * to this page.
7752 */
7753 hat_page_clrwrt(pp);
7754 }
7755 }
7756
7757 uint_t
7758 hat_page_getattr(page_t *pp, uint_t flag)
7759 {
7760 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7761 return ((uint_t)(pp->p_nrm & flag));
7762 }
7763
7764 /*
7765 * DEBUG kernels: verify that a kernel va<->pa translation
7766 * is safe by checking the underlying page_t is in a page
7767 * relocation-safe state.
7768 */
7769 #ifdef DEBUG
7770 void
7771 sfmmu_check_kpfn(pfn_t pfn)
7772 {
7773 page_t *pp;
7774 int index, cons;
7775
7776 if (hat_check_vtop == 0)
7777 return;
7778
7779 if (kvseg.s_base == NULL || panicstr)
7780 return;
7781
7782 pp = page_numtopp_nolock(pfn);
7783 if (!pp)
7784 return;
7785
7786 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7787 return;
7788
7789 /*
7790 * Handed a large kernel page, we dig up the root page since we
7791 * know the root page might have the lock also.
7792 */
7793 if (pp->p_szc != 0) {
7794 index = PP_MAPINDEX(pp);
7795 cons = TTE8K;
7796 again:
7797 while (index != 0) {
7798 index >>= 1;
7799 if (index != 0)
7800 cons++;
7801 if (index & 0x1) {
7802 pp = PP_GROUPLEADER(pp, cons);
7803 goto again;
7804 }
7805 }
7806 }
7807
7808 if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7809 return;
7810
7811 /*
7812 * Pages need to be locked or allocated "permanent" (either from
7813 * static_arena arena or explicitly setting PG_NORELOC when calling
7814 * page_create_va()) for VA->PA translations to be valid.
7815 */
7816 if (!PP_ISNORELOC(pp))
7817 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7818 (void *)pp);
7819 else
7820 panic("Illegal VA->PA translation, pp 0x%p not locked",
7821 (void *)pp);
7822 }
7823 #endif /* DEBUG */
7824
7825 /*
7826 * Returns a page frame number for a given virtual address.
7827 * Returns PFN_INVALID to indicate an invalid mapping
7828 */
7829 pfn_t
7830 hat_getpfnum(struct hat *hat, caddr_t addr)
7831 {
7832 pfn_t pfn;
7833 tte_t tte;
7834
7835 /*
7836 * We would like to
7837 * ASSERT(AS_LOCK_HELD(as));
7838 * but we can't because the iommu driver will call this
7839 * routine at interrupt time and it can't grab the as lock
7840 * or it will deadlock: A thread could have the as lock
7841 * and be waiting for io. The io can't complete
7842 * because the interrupt thread is blocked trying to grab
7843 * the as lock.
7844 */
7845
7846 if (hat == ksfmmup) {
7847 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7848 ASSERT(segkmem_lpszc > 0);
7849 pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7850 if (pfn != PFN_INVALID) {
7851 sfmmu_check_kpfn(pfn);
7852 return (pfn);
7853 }
7854 } else if (segkpm && IS_KPM_ADDR(addr)) {
7855 return (sfmmu_kpm_vatopfn(addr));
7856 }
7857 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7858 == PFN_SUSPENDED) {
7859 sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7860 }
7861 sfmmu_check_kpfn(pfn);
7862 return (pfn);
7863 } else {
7864 return (sfmmu_uvatopfn(addr, hat, NULL));
7865 }
7866 }
7867
7868 /*
7869 * This routine will return both pfn and tte for the vaddr.
7870 */
7871 static pfn_t
7872 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
7873 {
7874 struct hmehash_bucket *hmebp;
7875 hmeblk_tag hblktag;
7876 int hmeshift, hashno = 1;
7877 struct hme_blk *hmeblkp = NULL;
7878 tte_t tte;
7879
7880 struct sf_hment *sfhmep;
7881 pfn_t pfn;
7882
7883 /* support for ISM */
7884 ism_map_t *ism_map;
7885 ism_blk_t *ism_blkp;
7886 int i;
7887 sfmmu_t *ism_hatid = NULL;
7888 sfmmu_t *locked_hatid = NULL;
7889 sfmmu_t *sv_sfmmup = sfmmup;
7890 caddr_t sv_vaddr = vaddr;
7891 sf_srd_t *srdp;
7892
7893 if (ttep == NULL) {
7894 ttep = &tte;
7895 } else {
7896 ttep->ll = 0;
7897 }
7898
7899 ASSERT(sfmmup != ksfmmup);
7900 SFMMU_STAT(sf_user_vtop);
7901 /*
7902 * Set ism_hatid if vaddr falls in a ISM segment.
7903 */
7904 ism_blkp = sfmmup->sfmmu_iblk;
7905 if (ism_blkp != NULL) {
7906 sfmmu_ismhat_enter(sfmmup, 0);
7907 locked_hatid = sfmmup;
7908 }
7909 while (ism_blkp != NULL && ism_hatid == NULL) {
7910 ism_map = ism_blkp->iblk_maps;
7911 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
7912 if (vaddr >= ism_start(ism_map[i]) &&
7913 vaddr < ism_end(ism_map[i])) {
7914 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
7915 vaddr = (caddr_t)(vaddr -
7916 ism_start(ism_map[i]));
7917 break;
7918 }
7919 }
7920 ism_blkp = ism_blkp->iblk_next;
7921 }
7922 if (locked_hatid) {
7923 sfmmu_ismhat_exit(locked_hatid, 0);
7924 }
7925
7926 hblktag.htag_id = sfmmup;
7927 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
7928 do {
7929 hmeshift = HME_HASH_SHIFT(hashno);
7930 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
7931 hblktag.htag_rehash = hashno;
7932 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
7933
7934 SFMMU_HASH_LOCK(hmebp);
7935
7936 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
7937 if (hmeblkp != NULL) {
7938 ASSERT(!hmeblkp->hblk_shared);
7939 HBLKTOHME(sfhmep, hmeblkp, vaddr);
7940 sfmmu_copytte(&sfhmep->hme_tte, ttep);
7941 SFMMU_HASH_UNLOCK(hmebp);
7942 if (TTE_IS_VALID(ttep)) {
7943 pfn = TTE_TO_PFN(vaddr, ttep);
7944 return (pfn);
7945 }
7946 break;
7947 }
7948 SFMMU_HASH_UNLOCK(hmebp);
7949 hashno++;
7950 } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
7951
7952 if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
7953 return (PFN_INVALID);
7954 }
7955 srdp = sv_sfmmup->sfmmu_srdp;
7956 ASSERT(srdp != NULL);
7957 ASSERT(srdp->srd_refcnt != 0);
7958 hblktag.htag_id = srdp;
7959 hashno = 1;
7960 do {
7961 hmeshift = HME_HASH_SHIFT(hashno);
7962 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
7963 hblktag.htag_rehash = hashno;
7964 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
7965
7966 SFMMU_HASH_LOCK(hmebp);
7967 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
7968 hmeblkp = hmeblkp->hblk_next) {
7969 uint_t rid;
7970 sf_region_t *rgnp;
7971 caddr_t rsaddr;
7972 caddr_t readdr;
7973
7974 if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
7975 sv_sfmmup->sfmmu_hmeregion_map)) {
7976 continue;
7977 }
7978 ASSERT(hmeblkp->hblk_shared);
7979 rid = hmeblkp->hblk_tag.htag_rid;
7980 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7981 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7982 rgnp = srdp->srd_hmergnp[rid];
7983 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7984 HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
7985 sfmmu_copytte(&sfhmep->hme_tte, ttep);
7986 rsaddr = rgnp->rgn_saddr;
7987 readdr = rsaddr + rgnp->rgn_size;
7988 #ifdef DEBUG
7989 if (TTE_IS_VALID(ttep) ||
7990 get_hblk_ttesz(hmeblkp) > TTE8K) {
7991 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
7992 ASSERT(eva > sv_vaddr);
7993 ASSERT(sv_vaddr >= rsaddr);
7994 ASSERT(sv_vaddr < readdr);
7995 ASSERT(eva <= readdr);
7996 }
7997 #endif /* DEBUG */
7998 /*
7999 * Continue the search if we
8000 * found an invalid 8K tte outside of the area
8001 * covered by this hmeblk's region.
8002 */
8003 if (TTE_IS_VALID(ttep)) {
8004 SFMMU_HASH_UNLOCK(hmebp);
8005 pfn = TTE_TO_PFN(sv_vaddr, ttep);
8006 return (pfn);
8007 } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
8008 (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
8009 SFMMU_HASH_UNLOCK(hmebp);
8010 pfn = PFN_INVALID;
8011 return (pfn);
8012 }
8013 }
8014 SFMMU_HASH_UNLOCK(hmebp);
8015 hashno++;
8016 } while (hashno <= mmu_hashcnt);
8017 return (PFN_INVALID);
8018 }
8019
8020
8021 /*
8022 * For compatability with AT&T and later optimizations
8023 */
8024 /* ARGSUSED */
8025 void
8026 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8027 {
8028 ASSERT(hat != NULL);
8029 }
8030
8031 /*
8032 * Return the number of mappings to a particular page. This number is an
8033 * approximation of the number of people sharing the page.
8034 *
8035 * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8036 * hat_page_checkshare() can be used to compare threshold to share
8037 * count that reflects the number of region sharers albeit at higher cost.
8038 */
8039 ulong_t
8040 hat_page_getshare(page_t *pp)
8041 {
8042 page_t *spp = pp; /* start page */
8043 kmutex_t *pml;
8044 ulong_t cnt;
8045 int index, sz = TTE64K;
8046
8047 /*
8048 * We need to grab the mlist lock to make sure any outstanding
8049 * load/unloads complete. Otherwise we could return zero
8050 * even though the unload(s) hasn't finished yet.
8051 */
8052 pml = sfmmu_mlist_enter(spp);
8053 cnt = spp->p_share;
8054
8055 #ifdef VAC
8056 if (kpm_enable)
8057 cnt += spp->p_kpmref;
8058 #endif
8059 if (vpm_enable && pp->p_vpmref) {
8060 cnt += 1;
8061 }
8062
8063 /*
8064 * If we have any large mappings, we count the number of
8065 * mappings that this large page is part of.
8066 */
8067 index = PP_MAPINDEX(spp);
8068 index >>= 1;
8069 while (index) {
8070 pp = PP_GROUPLEADER(spp, sz);
8071 if ((index & 0x1) && pp != spp) {
8072 cnt += pp->p_share;
8073 spp = pp;
8074 }
8075 index >>= 1;
8076 sz++;
8077 }
8078 sfmmu_mlist_exit(pml);
8079 return (cnt);
8080 }
8081
8082 /*
8083 * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8084 * otherwise. Count shared hmeblks by region's refcnt.
8085 */
8086 int
8087 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8088 {
8089 kmutex_t *pml;
8090 ulong_t cnt = 0;
8091 int index, sz = TTE8K;
8092 struct sf_hment *sfhme, *tmphme = NULL;
8093 struct hme_blk *hmeblkp;
8094
8095 pml = sfmmu_mlist_enter(pp);
8096
8097 #ifdef VAC
8098 if (kpm_enable)
8099 cnt = pp->p_kpmref;
8100 #endif
8101
8102 if (vpm_enable && pp->p_vpmref) {
8103 cnt += 1;
8104 }
8105
8106 if (pp->p_share + cnt > sh_thresh) {
8107 sfmmu_mlist_exit(pml);
8108 return (1);
8109 }
8110
8111 index = PP_MAPINDEX(pp);
8112
8113 again:
8114 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8115 tmphme = sfhme->hme_next;
8116 if (IS_PAHME(sfhme)) {
8117 continue;
8118 }
8119
8120 hmeblkp = sfmmu_hmetohblk(sfhme);
8121 if (hme_size(sfhme) != sz) {
8122 continue;
8123 }
8124
8125 if (hmeblkp->hblk_shared) {
8126 sf_srd_t *srdp = hblktosrd(hmeblkp);
8127 uint_t rid = hmeblkp->hblk_tag.htag_rid;
8128 sf_region_t *rgnp;
8129 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8130 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8131 ASSERT(srdp != NULL);
8132 rgnp = srdp->srd_hmergnp[rid];
8133 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8134 rgnp, rid);
8135 cnt += rgnp->rgn_refcnt;
8136 } else {
8137 cnt++;
8138 }
8139 if (cnt > sh_thresh) {
8140 sfmmu_mlist_exit(pml);
8141 return (1);
8142 }
8143 }
8144
8145 index >>= 1;
8146 sz++;
8147 while (index) {
8148 pp = PP_GROUPLEADER(pp, sz);
8149 ASSERT(sfmmu_mlist_held(pp));
8150 if (index & 0x1) {
8151 goto again;
8152 }
8153 index >>= 1;
8154 sz++;
8155 }
8156 sfmmu_mlist_exit(pml);
8157 return (0);
8158 }
8159
8160 /*
8161 * Unload all large mappings to the pp and reset the p_szc field of every
8162 * constituent page according to the remaining mappings.
8163 *
8164 * pp must be locked SE_EXCL. Even though no other constituent pages are
8165 * locked it's legal to unload the large mappings to the pp because all
8166 * constituent pages of large locked mappings have to be locked SE_SHARED.
8167 * This means if we have SE_EXCL lock on one of constituent pages none of the
8168 * large mappings to pp are locked.
8169 *
8170 * Decrease p_szc field starting from the last constituent page and ending
8171 * with the root page. This method is used because other threads rely on the
8172 * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8173 * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8174 * ensures that p_szc changes of the constituent pages appears atomic for all
8175 * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8176 *
8177 * This mechanism is only used for file system pages where it's not always
8178 * possible to get SE_EXCL locks on all constituent pages to demote the size
8179 * code (as is done for anonymous or kernel large pages).
8180 *
8181 * See more comments in front of sfmmu_mlspl_enter().
8182 */
8183 void
8184 hat_page_demote(page_t *pp)
8185 {
8186 int index;
8187 int sz;
8188 cpuset_t cpuset;
8189 int sync = 0;
8190 page_t *rootpp;
8191 struct sf_hment *sfhme;
8192 struct sf_hment *tmphme = NULL;
8193 struct hme_blk *hmeblkp;
8194 uint_t pszc;
8195 page_t *lastpp;
8196 cpuset_t tset;
8197 pgcnt_t npgs;
8198 kmutex_t *pml;
8199 kmutex_t *pmtx = NULL;
8200
8201 ASSERT(PAGE_EXCL(pp));
8202 ASSERT(!PP_ISFREE(pp));
8203 ASSERT(!PP_ISKAS(pp));
8204 ASSERT(page_szc_lock_assert(pp));
8205 pml = sfmmu_mlist_enter(pp);
8206
8207 pszc = pp->p_szc;
8208 if (pszc == 0) {
8209 goto out;
8210 }
8211
8212 index = PP_MAPINDEX(pp) >> 1;
8213
8214 if (index) {
8215 CPUSET_ZERO(cpuset);
8216 sz = TTE64K;
8217 sync = 1;
8218 }
8219
8220 while (index) {
8221 if (!(index & 0x1)) {
8222 index >>= 1;
8223 sz++;
8224 continue;
8225 }
8226 ASSERT(sz <= pszc);
8227 rootpp = PP_GROUPLEADER(pp, sz);
8228 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8229 tmphme = sfhme->hme_next;
8230 ASSERT(!IS_PAHME(sfhme));
8231 hmeblkp = sfmmu_hmetohblk(sfhme);
8232 if (hme_size(sfhme) != sz) {
8233 continue;
8234 }
8235 tset = sfmmu_pageunload(rootpp, sfhme, sz);
8236 CPUSET_OR(cpuset, tset);
8237 }
8238 if (index >>= 1) {
8239 sz++;
8240 }
8241 }
8242
8243 ASSERT(!PP_ISMAPPED_LARGE(pp));
8244
8245 if (sync) {
8246 xt_sync(cpuset);
8247 #ifdef VAC
8248 if (PP_ISTNC(pp)) {
8249 conv_tnc(rootpp, sz);
8250 }
8251 #endif /* VAC */
8252 }
8253
8254 pmtx = sfmmu_page_enter(pp);
8255
8256 ASSERT(pp->p_szc == pszc);
8257 rootpp = PP_PAGEROOT(pp);
8258 ASSERT(rootpp->p_szc == pszc);
8259 lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8260
8261 while (lastpp != rootpp) {
8262 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8263 ASSERT(sz < pszc);
8264 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8265 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8266 while (--npgs > 0) {
8267 lastpp->p_szc = (uchar_t)sz;
8268 lastpp = PP_PAGEPREV(lastpp);
8269 }
8270 if (sz) {
8271 /*
8272 * make sure before current root's pszc
8273 * is updated all updates to constituent pages pszc
8274 * fields are globally visible.
8275 */
8276 membar_producer();
8277 }
8278 lastpp->p_szc = sz;
8279 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8280 if (lastpp != rootpp) {
8281 lastpp = PP_PAGEPREV(lastpp);
8282 }
8283 }
8284 if (sz == 0) {
8285 /* the loop above doesn't cover this case */
8286 rootpp->p_szc = 0;
8287 }
8288 out:
8289 ASSERT(pp->p_szc == 0);
8290 if (pmtx != NULL) {
8291 sfmmu_page_exit(pmtx);
8292 }
8293 sfmmu_mlist_exit(pml);
8294 }
8295
8296 /*
8297 * Refresh the HAT ismttecnt[] element for size szc.
8298 * Caller must have set ISM busy flag to prevent mapping
8299 * lists from changing while we're traversing them.
8300 */
8301 pgcnt_t
8302 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8303 {
8304 ism_blk_t *ism_blkp = sfmmup->sfmmu_iblk;
8305 ism_map_t *ism_map;
8306 pgcnt_t npgs = 0;
8307 pgcnt_t npgs_scd = 0;
8308 int j;
8309 sf_scd_t *scdp;
8310 uchar_t rid;
8311
8312 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8313 scdp = sfmmup->sfmmu_scdp;
8314
8315 for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8316 ism_map = ism_blkp->iblk_maps;
8317 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8318 rid = ism_map[j].imap_rid;
8319 ASSERT(rid == SFMMU_INVALID_ISMRID ||
8320 rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8321
8322 if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8323 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8324 /* ISM is in sfmmup's SCD */
8325 npgs_scd +=
8326 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8327 } else {
8328 /* ISMs is not in SCD */
8329 npgs +=
8330 ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8331 }
8332 }
8333 }
8334 sfmmup->sfmmu_ismttecnt[szc] = npgs;
8335 sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8336 return (npgs);
8337 }
8338
8339 /*
8340 * Yield the memory claim requirement for an address space.
8341 *
8342 * This is currently implemented as the number of bytes that have active
8343 * hardware translations that have page structures. Therefore, it can
8344 * underestimate the traditional resident set size, eg, if the
8345 * physical page is present and the hardware translation is missing;
8346 * and it can overestimate the rss, eg, if there are active
8347 * translations to a frame buffer with page structs.
8348 * Also, it does not take sharing into account.
8349 *
8350 * Note that we don't acquire locks here since this function is most often
8351 * called from the clock thread.
8352 */
8353 size_t
8354 hat_get_mapped_size(struct hat *hat)
8355 {
8356 size_t assize = 0;
8357 int i;
8358
8359 if (hat == NULL)
8360 return (0);
8361
8362 for (i = 0; i < mmu_page_sizes; i++)
8363 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8364 (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8365
8366 if (hat->sfmmu_iblk == NULL)
8367 return (assize);
8368
8369 for (i = 0; i < mmu_page_sizes; i++)
8370 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8371 (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8372
8373 return (assize);
8374 }
8375
8376 int
8377 hat_stats_enable(struct hat *hat)
8378 {
8379 hatlock_t *hatlockp;
8380
8381 hatlockp = sfmmu_hat_enter(hat);
8382 hat->sfmmu_rmstat++;
8383 sfmmu_hat_exit(hatlockp);
8384 return (1);
8385 }
8386
8387 void
8388 hat_stats_disable(struct hat *hat)
8389 {
8390 hatlock_t *hatlockp;
8391
8392 hatlockp = sfmmu_hat_enter(hat);
8393 hat->sfmmu_rmstat--;
8394 sfmmu_hat_exit(hatlockp);
8395 }
8396
8397 /*
8398 * Routines for entering or removing ourselves from the
8399 * ism_hat's mapping list. This is used for both private and
8400 * SCD hats.
8401 */
8402 static void
8403 iment_add(struct ism_ment *iment, struct hat *ism_hat)
8404 {
8405 ASSERT(MUTEX_HELD(&ism_mlist_lock));
8406
8407 iment->iment_prev = NULL;
8408 iment->iment_next = ism_hat->sfmmu_iment;
8409 if (ism_hat->sfmmu_iment) {
8410 ism_hat->sfmmu_iment->iment_prev = iment;
8411 }
8412 ism_hat->sfmmu_iment = iment;
8413 }
8414
8415 static void
8416 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8417 {
8418 ASSERT(MUTEX_HELD(&ism_mlist_lock));
8419
8420 if (ism_hat->sfmmu_iment == NULL) {
8421 panic("ism map entry remove - no entries");
8422 }
8423
8424 if (iment->iment_prev) {
8425 ASSERT(ism_hat->sfmmu_iment != iment);
8426 iment->iment_prev->iment_next = iment->iment_next;
8427 } else {
8428 ASSERT(ism_hat->sfmmu_iment == iment);
8429 ism_hat->sfmmu_iment = iment->iment_next;
8430 }
8431
8432 if (iment->iment_next) {
8433 iment->iment_next->iment_prev = iment->iment_prev;
8434 }
8435
8436 /*
8437 * zero out the entry
8438 */
8439 iment->iment_next = NULL;
8440 iment->iment_prev = NULL;
8441 iment->iment_hat = NULL;
8442 iment->iment_base_va = 0;
8443 }
8444
8445 /*
8446 * Hat_share()/unshare() return an (non-zero) error
8447 * when saddr and daddr are not properly aligned.
8448 *
8449 * The top level mapping element determines the alignment
8450 * requirement for saddr and daddr, depending on different
8451 * architectures.
8452 *
8453 * When hat_share()/unshare() are not supported,
8454 * HATOP_SHARE()/UNSHARE() return 0
8455 */
8456 int
8457 hat_share(struct hat *sfmmup, caddr_t addr,
8458 struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8459 {
8460 ism_blk_t *ism_blkp;
8461 ism_blk_t *new_iblk;
8462 ism_map_t *ism_map;
8463 ism_ment_t *ism_ment;
8464 int i, added;
8465 hatlock_t *hatlockp;
8466 int reload_mmu = 0;
8467 uint_t ismshift = page_get_shift(ismszc);
8468 size_t ismpgsz = page_get_pagesize(ismszc);
8469 uint_t ismmask = (uint_t)ismpgsz - 1;
8470 size_t sh_size = ISM_SHIFT(ismshift, len);
8471 ushort_t ismhatflag;
8472 hat_region_cookie_t rcookie;
8473 sf_scd_t *old_scdp;
8474
8475 #ifdef DEBUG
8476 caddr_t eaddr = addr + len;
8477 #endif /* DEBUG */
8478
8479 ASSERT(ism_hatid != NULL && sfmmup != NULL);
8480 ASSERT(sptaddr == ISMID_STARTADDR);
8481 /*
8482 * Check the alignment.
8483 */
8484 if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8485 return (EINVAL);
8486
8487 /*
8488 * Check size alignment.
8489 */
8490 if (!ISM_ALIGNED(ismshift, len))
8491 return (EINVAL);
8492
8493 /*
8494 * Allocate ism_ment for the ism_hat's mapping list, and an
8495 * ism map blk in case we need one. We must do our
8496 * allocations before acquiring locks to prevent a deadlock
8497 * in the kmem allocator on the mapping list lock.
8498 */
8499 new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8500 ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8501
8502 /*
8503 * Serialize ISM mappings with the ISM busy flag, and also the
8504 * trap handlers.
8505 */
8506 sfmmu_ismhat_enter(sfmmup, 0);
8507
8508 /*
8509 * Allocate an ism map blk if necessary.
8510 */
8511 if (sfmmup->sfmmu_iblk == NULL) {
8512 sfmmup->sfmmu_iblk = new_iblk;
8513 bzero(new_iblk, sizeof (*new_iblk));
8514 new_iblk->iblk_nextpa = (uint64_t)-1;
8515 membar_stst(); /* make sure next ptr visible to all CPUs */
8516 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8517 reload_mmu = 1;
8518 new_iblk = NULL;
8519 }
8520
8521 #ifdef DEBUG
8522 /*
8523 * Make sure mapping does not already exist.
8524 */
8525 ism_blkp = sfmmup->sfmmu_iblk;
8526 while (ism_blkp != NULL) {
8527 ism_map = ism_blkp->iblk_maps;
8528 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8529 if ((addr >= ism_start(ism_map[i]) &&
8530 addr < ism_end(ism_map[i])) ||
8531 eaddr > ism_start(ism_map[i]) &&
8532 eaddr <= ism_end(ism_map[i])) {
8533 panic("sfmmu_share: Already mapped!");
8534 }
8535 }
8536 ism_blkp = ism_blkp->iblk_next;
8537 }
8538 #endif /* DEBUG */
8539
8540 ASSERT(ismszc >= TTE4M);
8541 if (ismszc == TTE4M) {
8542 ismhatflag = HAT_4M_FLAG;
8543 } else if (ismszc == TTE32M) {
8544 ismhatflag = HAT_32M_FLAG;
8545 } else if (ismszc == TTE256M) {
8546 ismhatflag = HAT_256M_FLAG;
8547 }
8548 /*
8549 * Add mapping to first available mapping slot.
8550 */
8551 ism_blkp = sfmmup->sfmmu_iblk;
8552 added = 0;
8553 while (!added) {
8554 ism_map = ism_blkp->iblk_maps;
8555 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8556 if (ism_map[i].imap_ismhat == NULL) {
8557
8558 ism_map[i].imap_ismhat = ism_hatid;
8559 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8560 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8561 ism_map[i].imap_hatflags = ismhatflag;
8562 ism_map[i].imap_sz_mask = ismmask;
8563 /*
8564 * imap_seg is checked in ISM_CHECK to see if
8565 * non-NULL, then other info assumed valid.
8566 */
8567 membar_stst();
8568 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8569 ism_map[i].imap_ment = ism_ment;
8570
8571 /*
8572 * Now add ourselves to the ism_hat's
8573 * mapping list.
8574 */
8575 ism_ment->iment_hat = sfmmup;
8576 ism_ment->iment_base_va = addr;
8577 ism_hatid->sfmmu_ismhat = 1;
8578 mutex_enter(&ism_mlist_lock);
8579 iment_add(ism_ment, ism_hatid);
8580 mutex_exit(&ism_mlist_lock);
8581 added = 1;
8582 break;
8583 }
8584 }
8585 if (!added && ism_blkp->iblk_next == NULL) {
8586 ism_blkp->iblk_next = new_iblk;
8587 new_iblk = NULL;
8588 bzero(ism_blkp->iblk_next,
8589 sizeof (*ism_blkp->iblk_next));
8590 ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8591 membar_stst();
8592 ism_blkp->iblk_nextpa =
8593 va_to_pa((caddr_t)ism_blkp->iblk_next);
8594 }
8595 ism_blkp = ism_blkp->iblk_next;
8596 }
8597
8598 /*
8599 * After calling hat_join_region, sfmmup may join a new SCD or
8600 * move from the old scd to a new scd, in which case, we want to
8601 * shrink the sfmmup's private tsb size, i.e., pass shrink to
8602 * sfmmu_check_page_sizes at the end of this routine.
8603 */
8604 old_scdp = sfmmup->sfmmu_scdp;
8605
8606 rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8607 PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8608 if (rcookie != HAT_INVALID_REGION_COOKIE) {
8609 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8610 }
8611 /*
8612 * Update our counters for this sfmmup's ism mappings.
8613 */
8614 for (i = 0; i <= ismszc; i++) {
8615 if (!(disable_ism_large_pages & (1 << i)))
8616 (void) ism_tsb_entries(sfmmup, i);
8617 }
8618
8619 /*
8620 * For ISM and DISM we do not support 512K pages, so we only only
8621 * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8622 * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8623 *
8624 * Need to set 32M/256M ISM flags to make sure
8625 * sfmmu_check_page_sizes() enables them on Panther.
8626 */
8627 ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8628
8629 switch (ismszc) {
8630 case TTE256M:
8631 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8632 hatlockp = sfmmu_hat_enter(sfmmup);
8633 SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8634 sfmmu_hat_exit(hatlockp);
8635 }
8636 break;
8637 case TTE32M:
8638 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8639 hatlockp = sfmmu_hat_enter(sfmmup);
8640 SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8641 sfmmu_hat_exit(hatlockp);
8642 }
8643 break;
8644 default:
8645 break;
8646 }
8647
8648 /*
8649 * If we updated the ismblkpa for this HAT we must make
8650 * sure all CPUs running this process reload their tsbmiss area.
8651 * Otherwise they will fail to load the mappings in the tsbmiss
8652 * handler and will loop calling pagefault().
8653 */
8654 if (reload_mmu) {
8655 hatlockp = sfmmu_hat_enter(sfmmup);
8656 sfmmu_sync_mmustate(sfmmup);
8657 sfmmu_hat_exit(hatlockp);
8658 }
8659
8660 sfmmu_ismhat_exit(sfmmup, 0);
8661
8662 /*
8663 * Free up ismblk if we didn't use it.
8664 */
8665 if (new_iblk != NULL)
8666 kmem_cache_free(ism_blk_cache, new_iblk);
8667
8668 /*
8669 * Check TSB and TLB page sizes.
8670 */
8671 if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8672 sfmmu_check_page_sizes(sfmmup, 0);
8673 } else {
8674 sfmmu_check_page_sizes(sfmmup, 1);
8675 }
8676 return (0);
8677 }
8678
8679 /*
8680 * hat_unshare removes exactly one ism_map from
8681 * this process's as. It expects multiple calls
8682 * to hat_unshare for multiple shm segments.
8683 */
8684 void
8685 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8686 {
8687 ism_map_t *ism_map;
8688 ism_ment_t *free_ment = NULL;
8689 ism_blk_t *ism_blkp;
8690 struct hat *ism_hatid;
8691 int found, i;
8692 hatlock_t *hatlockp;
8693 struct tsb_info *tsbinfo;
8694 uint_t ismshift = page_get_shift(ismszc);
8695 size_t sh_size = ISM_SHIFT(ismshift, len);
8696 uchar_t ism_rid;
8697 sf_scd_t *old_scdp;
8698
8699 ASSERT(ISM_ALIGNED(ismshift, addr));
8700 ASSERT(ISM_ALIGNED(ismshift, len));
8701 ASSERT(sfmmup != NULL);
8702 ASSERT(sfmmup != ksfmmup);
8703
8704 ASSERT(sfmmup->sfmmu_as != NULL);
8705
8706 /*
8707 * Make sure that during the entire time ISM mappings are removed,
8708 * the trap handlers serialize behind us, and that no one else
8709 * can be mucking with ISM mappings. This also lets us get away
8710 * with not doing expensive cross calls to flush the TLB -- we
8711 * just discard the context, flush the entire TSB, and call it
8712 * a day.
8713 */
8714 sfmmu_ismhat_enter(sfmmup, 0);
8715
8716 /*
8717 * Remove the mapping.
8718 *
8719 * We can't have any holes in the ism map.
8720 * The tsb miss code while searching the ism map will
8721 * stop on an empty map slot. So we must move
8722 * everyone past the hole up 1 if any.
8723 *
8724 * Also empty ism map blks are not freed until the
8725 * process exits. This is to prevent a MT race condition
8726 * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8727 */
8728 found = 0;
8729 ism_blkp = sfmmup->sfmmu_iblk;
8730 while (!found && ism_blkp != NULL) {
8731 ism_map = ism_blkp->iblk_maps;
8732 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8733 if (addr == ism_start(ism_map[i]) &&
8734 sh_size == (size_t)(ism_size(ism_map[i]))) {
8735 found = 1;
8736 break;
8737 }
8738 }
8739 if (!found)
8740 ism_blkp = ism_blkp->iblk_next;
8741 }
8742
8743 if (found) {
8744 ism_hatid = ism_map[i].imap_ismhat;
8745 ism_rid = ism_map[i].imap_rid;
8746 ASSERT(ism_hatid != NULL);
8747 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8748
8749 /*
8750 * After hat_leave_region, the sfmmup may leave SCD,
8751 * in which case, we want to grow the private tsb size when
8752 * calling sfmmu_check_page_sizes at the end of the routine.
8753 */
8754 old_scdp = sfmmup->sfmmu_scdp;
8755 /*
8756 * Then remove ourselves from the region.
8757 */
8758 if (ism_rid != SFMMU_INVALID_ISMRID) {
8759 hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8760 HAT_REGION_ISM);
8761 }
8762
8763 /*
8764 * And now guarantee that any other cpu
8765 * that tries to process an ISM miss
8766 * will go to tl=0.
8767 */
8768 hatlockp = sfmmu_hat_enter(sfmmup);
8769 sfmmu_invalidate_ctx(sfmmup);
8770 sfmmu_hat_exit(hatlockp);
8771
8772 /*
8773 * Remove ourselves from the ism mapping list.
8774 */
8775 mutex_enter(&ism_mlist_lock);
8776 iment_sub(ism_map[i].imap_ment, ism_hatid);
8777 mutex_exit(&ism_mlist_lock);
8778 free_ment = ism_map[i].imap_ment;
8779
8780 /*
8781 * We delete the ism map by copying
8782 * the next map over the current one.
8783 * We will take the next one in the maps
8784 * array or from the next ism_blk.
8785 */
8786 while (ism_blkp != NULL) {
8787 ism_map = ism_blkp->iblk_maps;
8788 while (i < (ISM_MAP_SLOTS - 1)) {
8789 ism_map[i] = ism_map[i + 1];
8790 i++;
8791 }
8792 /* i == (ISM_MAP_SLOTS - 1) */
8793 ism_blkp = ism_blkp->iblk_next;
8794 if (ism_blkp != NULL) {
8795 ism_map[i] = ism_blkp->iblk_maps[0];
8796 i = 0;
8797 } else {
8798 ism_map[i].imap_seg = 0;
8799 ism_map[i].imap_vb_shift = 0;
8800 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8801 ism_map[i].imap_hatflags = 0;
8802 ism_map[i].imap_sz_mask = 0;
8803 ism_map[i].imap_ismhat = NULL;
8804 ism_map[i].imap_ment = NULL;
8805 }
8806 }
8807
8808 /*
8809 * Now flush entire TSB for the process, since
8810 * demapping page by page can be too expensive.
8811 * We don't have to flush the TLB here anymore
8812 * since we switch to a new TLB ctx instead.
8813 * Also, there is no need to flush if the process
8814 * is exiting since the TSB will be freed later.
8815 */
8816 if (!sfmmup->sfmmu_free) {
8817 hatlockp = sfmmu_hat_enter(sfmmup);
8818 for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8819 tsbinfo = tsbinfo->tsb_next) {
8820 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8821 continue;
8822 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8823 tsbinfo->tsb_flags |=
8824 TSB_FLUSH_NEEDED;
8825 continue;
8826 }
8827
8828 sfmmu_inv_tsb(tsbinfo->tsb_va,
8829 TSB_BYTES(tsbinfo->tsb_szc));
8830 }
8831 sfmmu_hat_exit(hatlockp);
8832 }
8833 }
8834
8835 /*
8836 * Update our counters for this sfmmup's ism mappings.
8837 */
8838 for (i = 0; i <= ismszc; i++) {
8839 if (!(disable_ism_large_pages & (1 << i)))
8840 (void) ism_tsb_entries(sfmmup, i);
8841 }
8842
8843 sfmmu_ismhat_exit(sfmmup, 0);
8844
8845 /*
8846 * We must do our freeing here after dropping locks
8847 * to prevent a deadlock in the kmem allocator on the
8848 * mapping list lock.
8849 */
8850 if (free_ment != NULL)
8851 kmem_cache_free(ism_ment_cache, free_ment);
8852
8853 /*
8854 * Check TSB and TLB page sizes if the process isn't exiting.
8855 */
8856 if (!sfmmup->sfmmu_free) {
8857 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
8858 sfmmu_check_page_sizes(sfmmup, 1);
8859 } else {
8860 sfmmu_check_page_sizes(sfmmup, 0);
8861 }
8862 }
8863 }
8864
8865 /* ARGSUSED */
8866 static int
8867 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
8868 {
8869 /* void *buf is sfmmu_t pointer */
8870 bzero(buf, sizeof (sfmmu_t));
8871
8872 return (0);
8873 }
8874
8875 /* ARGSUSED */
8876 static void
8877 sfmmu_idcache_destructor(void *buf, void *cdrarg)
8878 {
8879 /* void *buf is sfmmu_t pointer */
8880 }
8881
8882 /*
8883 * setup kmem hmeblks by bzeroing all members and initializing the nextpa
8884 * field to be the pa of this hmeblk
8885 */
8886 /* ARGSUSED */
8887 static int
8888 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
8889 {
8890 struct hme_blk *hmeblkp;
8891
8892 bzero(buf, (size_t)cdrarg);
8893 hmeblkp = (struct hme_blk *)buf;
8894 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
8895
8896 #ifdef HBLK_TRACE
8897 mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
8898 #endif /* HBLK_TRACE */
8899
8900 return (0);
8901 }
8902
8903 /* ARGSUSED */
8904 static void
8905 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
8906 {
8907
8908 #ifdef HBLK_TRACE
8909
8910 struct hme_blk *hmeblkp;
8911
8912 hmeblkp = (struct hme_blk *)buf;
8913 mutex_destroy(&hmeblkp->hblk_audit_lock);
8914
8915 #endif /* HBLK_TRACE */
8916 }
8917
8918 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
8919 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
8920 /*
8921 * The kmem allocator will callback into our reclaim routine when the system
8922 * is running low in memory. We traverse the hash and free up all unused but
8923 * still cached hme_blks. We also traverse the free list and free them up
8924 * as well.
8925 */
8926 /*ARGSUSED*/
8927 static void
8928 sfmmu_hblkcache_reclaim(void *cdrarg)
8929 {
8930 int i;
8931 struct hmehash_bucket *hmebp;
8932 struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
8933 static struct hmehash_bucket *uhmehash_reclaim_hand;
8934 static struct hmehash_bucket *khmehash_reclaim_hand;
8935 struct hme_blk *list = NULL, *last_hmeblkp;
8936 cpuset_t cpuset = cpu_ready_set;
8937 cpu_hme_pend_t *cpuhp;
8938
8939 /* Free up hmeblks on the cpu pending lists */
8940 for (i = 0; i < NCPU; i++) {
8941 cpuhp = &cpu_hme_pend[i];
8942 if (cpuhp->chp_listp != NULL) {
8943 mutex_enter(&cpuhp->chp_mutex);
8944 if (cpuhp->chp_listp == NULL) {
8945 mutex_exit(&cpuhp->chp_mutex);
8946 continue;
8947 }
8948 for (last_hmeblkp = cpuhp->chp_listp;
8949 last_hmeblkp->hblk_next != NULL;
8950 last_hmeblkp = last_hmeblkp->hblk_next)
8951 ;
8952 last_hmeblkp->hblk_next = list;
8953 list = cpuhp->chp_listp;
8954 cpuhp->chp_listp = NULL;
8955 cpuhp->chp_count = 0;
8956 mutex_exit(&cpuhp->chp_mutex);
8957 }
8958
8959 }
8960
8961 if (list != NULL) {
8962 kpreempt_disable();
8963 CPUSET_DEL(cpuset, CPU->cpu_id);
8964 xt_sync(cpuset);
8965 xt_sync(cpuset);
8966 kpreempt_enable();
8967 sfmmu_hblk_free(&list);
8968 list = NULL;
8969 }
8970
8971 hmebp = uhmehash_reclaim_hand;
8972 if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
8973 uhmehash_reclaim_hand = hmebp = uhme_hash;
8974 uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8975
8976 for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8977 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8978 hmeblkp = hmebp->hmeblkp;
8979 pr_hblk = NULL;
8980 while (hmeblkp) {
8981 nx_hblk = hmeblkp->hblk_next;
8982 if (!hmeblkp->hblk_vcnt &&
8983 !hmeblkp->hblk_hmecnt) {
8984 sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8985 pr_hblk, &list, 0);
8986 } else {
8987 pr_hblk = hmeblkp;
8988 }
8989 hmeblkp = nx_hblk;
8990 }
8991 SFMMU_HASH_UNLOCK(hmebp);
8992 }
8993 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
8994 hmebp = uhme_hash;
8995 }
8996
8997 hmebp = khmehash_reclaim_hand;
8998 if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
8999 khmehash_reclaim_hand = hmebp = khme_hash;
9000 khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9001
9002 for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9003 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9004 hmeblkp = hmebp->hmeblkp;
9005 pr_hblk = NULL;
9006 while (hmeblkp) {
9007 nx_hblk = hmeblkp->hblk_next;
9008 if (!hmeblkp->hblk_vcnt &&
9009 !hmeblkp->hblk_hmecnt) {
9010 sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9011 pr_hblk, &list, 0);
9012 } else {
9013 pr_hblk = hmeblkp;
9014 }
9015 hmeblkp = nx_hblk;
9016 }
9017 SFMMU_HASH_UNLOCK(hmebp);
9018 }
9019 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9020 hmebp = khme_hash;
9021 }
9022 sfmmu_hblks_list_purge(&list, 0);
9023 }
9024
9025 /*
9026 * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9027 * same goes for sfmmu_get_addrvcolor().
9028 *
9029 * This function will return the virtual color for the specified page. The
9030 * virtual color corresponds to this page current mapping or its last mapping.
9031 * It is used by memory allocators to choose addresses with the correct
9032 * alignment so vac consistency is automatically maintained. If the page
9033 * has no color it returns -1.
9034 */
9035 /*ARGSUSED*/
9036 int
9037 sfmmu_get_ppvcolor(struct page *pp)
9038 {
9039 #ifdef VAC
9040 int color;
9041
9042 if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9043 return (-1);
9044 }
9045 color = PP_GET_VCOLOR(pp);
9046 ASSERT(color < mmu_btop(shm_alignment));
9047 return (color);
9048 #else
9049 return (-1);
9050 #endif /* VAC */
9051 }
9052
9053 /*
9054 * This function will return the desired alignment for vac consistency
9055 * (vac color) given a virtual address. If no vac is present it returns -1.
9056 */
9057 /*ARGSUSED*/
9058 int
9059 sfmmu_get_addrvcolor(caddr_t vaddr)
9060 {
9061 #ifdef VAC
9062 if (cache & CACHE_VAC) {
9063 return (addr_to_vcolor(vaddr));
9064 } else {
9065 return (-1);
9066 }
9067 #else
9068 return (-1);
9069 #endif /* VAC */
9070 }
9071
9072 #ifdef VAC
9073 /*
9074 * Check for conflicts.
9075 * A conflict exists if the new and existent mappings do not match in
9076 * their "shm_alignment fields. If conflicts exist, the existant mappings
9077 * are flushed unless one of them is locked. If one of them is locked, then
9078 * the mappings are flushed and converted to non-cacheable mappings.
9079 */
9080 static void
9081 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9082 {
9083 struct hat *tmphat;
9084 struct sf_hment *sfhmep, *tmphme = NULL;
9085 struct hme_blk *hmeblkp;
9086 int vcolor;
9087 tte_t tte;
9088
9089 ASSERT(sfmmu_mlist_held(pp));
9090 ASSERT(!PP_ISNC(pp)); /* page better be cacheable */
9091
9092 vcolor = addr_to_vcolor(addr);
9093 if (PP_NEWPAGE(pp)) {
9094 PP_SET_VCOLOR(pp, vcolor);
9095 return;
9096 }
9097
9098 if (PP_GET_VCOLOR(pp) == vcolor) {
9099 return;
9100 }
9101
9102 if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9103 /*
9104 * Previous user of page had a different color
9105 * but since there are no current users
9106 * we just flush the cache and change the color.
9107 */
9108 SFMMU_STAT(sf_pgcolor_conflict);
9109 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9110 PP_SET_VCOLOR(pp, vcolor);
9111 return;
9112 }
9113
9114 /*
9115 * If we get here we have a vac conflict with a current
9116 * mapping. VAC conflict policy is as follows.
9117 * - The default is to unload the other mappings unless:
9118 * - If we have a large mapping we uncache the page.
9119 * We need to uncache the rest of the large page too.
9120 * - If any of the mappings are locked we uncache the page.
9121 * - If the requested mapping is inconsistent
9122 * with another mapping and that mapping
9123 * is in the same address space we have to
9124 * make it non-cached. The default thing
9125 * to do is unload the inconsistent mapping
9126 * but if they are in the same address space
9127 * we run the risk of unmapping the pc or the
9128 * stack which we will use as we return to the user,
9129 * in which case we can then fault on the thing
9130 * we just unloaded and get into an infinite loop.
9131 */
9132 if (PP_ISMAPPED_LARGE(pp)) {
9133 int sz;
9134
9135 /*
9136 * Existing mapping is for big pages. We don't unload
9137 * existing big mappings to satisfy new mappings.
9138 * Always convert all mappings to TNC.
9139 */
9140 sz = fnd_mapping_sz(pp);
9141 pp = PP_GROUPLEADER(pp, sz);
9142 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9143 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9144 TTEPAGES(sz));
9145
9146 return;
9147 }
9148
9149 /*
9150 * check if any mapping is in same as or if it is locked
9151 * since in that case we need to uncache.
9152 */
9153 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9154 tmphme = sfhmep->hme_next;
9155 if (IS_PAHME(sfhmep))
9156 continue;
9157 hmeblkp = sfmmu_hmetohblk(sfhmep);
9158 tmphat = hblktosfmmu(hmeblkp);
9159 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9160 ASSERT(TTE_IS_VALID(&tte));
9161 if (hmeblkp->hblk_shared || tmphat == hat ||
9162 hmeblkp->hblk_lckcnt) {
9163 /*
9164 * We have an uncache conflict
9165 */
9166 SFMMU_STAT(sf_uncache_conflict);
9167 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9168 return;
9169 }
9170 }
9171
9172 /*
9173 * We have an unload conflict
9174 * We have already checked for LARGE mappings, therefore
9175 * the remaining mapping(s) must be TTE8K.
9176 */
9177 SFMMU_STAT(sf_unload_conflict);
9178
9179 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9180 tmphme = sfhmep->hme_next;
9181 if (IS_PAHME(sfhmep))
9182 continue;
9183 hmeblkp = sfmmu_hmetohblk(sfhmep);
9184 ASSERT(!hmeblkp->hblk_shared);
9185 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9186 }
9187
9188 if (PP_ISMAPPED_KPM(pp))
9189 sfmmu_kpm_vac_unload(pp, addr);
9190
9191 /*
9192 * Unloads only do TLB flushes so we need to flush the
9193 * cache here.
9194 */
9195 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9196 PP_SET_VCOLOR(pp, vcolor);
9197 }
9198
9199 /*
9200 * Whenever a mapping is unloaded and the page is in TNC state,
9201 * we see if the page can be made cacheable again. 'pp' is
9202 * the page that we just unloaded a mapping from, the size
9203 * of mapping that was unloaded is 'ottesz'.
9204 * Remark:
9205 * The recache policy for mpss pages can leave a performance problem
9206 * under the following circumstances:
9207 * . A large page in uncached mode has just been unmapped.
9208 * . All constituent pages are TNC due to a conflicting small mapping.
9209 * . There are many other, non conflicting, small mappings around for
9210 * a lot of the constituent pages.
9211 * . We're called w/ the "old" groupleader page and the old ottesz,
9212 * but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9213 * we end up w/ TTE8K or npages == 1.
9214 * . We call tst_tnc w/ the old groupleader only, and if there is no
9215 * conflict, we re-cache only this page.
9216 * . All other small mappings are not checked and will be left in TNC mode.
9217 * The problem is not very serious because:
9218 * . mpss is actually only defined for heap and stack, so the probability
9219 * is not very high that a large page mapping exists in parallel to a small
9220 * one (this is possible, but seems to be bad programming style in the
9221 * appl).
9222 * . The problem gets a little bit more serious, when those TNC pages
9223 * have to be mapped into kernel space, e.g. for networking.
9224 * . When VAC alias conflicts occur in applications, this is regarded
9225 * as an application bug. So if kstat's show them, the appl should
9226 * be changed anyway.
9227 */
9228 void
9229 conv_tnc(page_t *pp, int ottesz)
9230 {
9231 int cursz, dosz;
9232 pgcnt_t curnpgs, dopgs;
9233 pgcnt_t pg64k;
9234 page_t *pp2;
9235
9236 /*
9237 * Determine how big a range we check for TNC and find
9238 * leader page. cursz is the size of the biggest
9239 * mapping that still exist on 'pp'.
9240 */
9241 if (PP_ISMAPPED_LARGE(pp)) {
9242 cursz = fnd_mapping_sz(pp);
9243 } else {
9244 cursz = TTE8K;
9245 }
9246
9247 if (ottesz >= cursz) {
9248 dosz = ottesz;
9249 pp2 = pp;
9250 } else {
9251 dosz = cursz;
9252 pp2 = PP_GROUPLEADER(pp, dosz);
9253 }
9254
9255 pg64k = TTEPAGES(TTE64K);
9256 dopgs = TTEPAGES(dosz);
9257
9258 ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9259
9260 while (dopgs != 0) {
9261 curnpgs = TTEPAGES(cursz);
9262 if (tst_tnc(pp2, curnpgs)) {
9263 SFMMU_STAT_ADD(sf_recache, curnpgs);
9264 sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9265 curnpgs);
9266 }
9267
9268 ASSERT(dopgs >= curnpgs);
9269 dopgs -= curnpgs;
9270
9271 if (dopgs == 0) {
9272 break;
9273 }
9274
9275 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9276 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9277 cursz = fnd_mapping_sz(pp2);
9278 } else {
9279 cursz = TTE8K;
9280 }
9281 }
9282 }
9283
9284 /*
9285 * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9286 * returns 0 otherwise. Note that oaddr argument is valid for only
9287 * 8k pages.
9288 */
9289 int
9290 tst_tnc(page_t *pp, pgcnt_t npages)
9291 {
9292 struct sf_hment *sfhme;
9293 struct hme_blk *hmeblkp;
9294 tte_t tte;
9295 caddr_t vaddr;
9296 int clr_valid = 0;
9297 int color, color1, bcolor;
9298 int i, ncolors;
9299
9300 ASSERT(pp != NULL);
9301 ASSERT(!(cache & CACHE_WRITEBACK));
9302
9303 if (npages > 1) {
9304 ncolors = CACHE_NUM_COLOR;
9305 }
9306
9307 for (i = 0; i < npages; i++) {
9308 ASSERT(sfmmu_mlist_held(pp));
9309 ASSERT(PP_ISTNC(pp));
9310 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9311
9312 if (PP_ISPNC(pp)) {
9313 return (0);
9314 }
9315
9316 clr_valid = 0;
9317 if (PP_ISMAPPED_KPM(pp)) {
9318 caddr_t kpmvaddr;
9319
9320 ASSERT(kpm_enable);
9321 kpmvaddr = hat_kpm_page2va(pp, 1);
9322 ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9323 color1 = addr_to_vcolor(kpmvaddr);
9324 clr_valid = 1;
9325 }
9326
9327 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9328 if (IS_PAHME(sfhme))
9329 continue;
9330 hmeblkp = sfmmu_hmetohblk(sfhme);
9331
9332 sfmmu_copytte(&sfhme->hme_tte, &tte);
9333 ASSERT(TTE_IS_VALID(&tte));
9334
9335 vaddr = tte_to_vaddr(hmeblkp, tte);
9336 color = addr_to_vcolor(vaddr);
9337
9338 if (npages > 1) {
9339 /*
9340 * If there is a big mapping, make sure
9341 * 8K mapping is consistent with the big
9342 * mapping.
9343 */
9344 bcolor = i % ncolors;
9345 if (color != bcolor) {
9346 return (0);
9347 }
9348 }
9349 if (!clr_valid) {
9350 clr_valid = 1;
9351 color1 = color;
9352 }
9353
9354 if (color1 != color) {
9355 return (0);
9356 }
9357 }
9358
9359 pp = PP_PAGENEXT(pp);
9360 }
9361
9362 return (1);
9363 }
9364
9365 void
9366 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9367 pgcnt_t npages)
9368 {
9369 kmutex_t *pmtx;
9370 int i, ncolors, bcolor;
9371 kpm_hlk_t *kpmp;
9372 cpuset_t cpuset;
9373
9374 ASSERT(pp != NULL);
9375 ASSERT(!(cache & CACHE_WRITEBACK));
9376
9377 kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9378 pmtx = sfmmu_page_enter(pp);
9379
9380 /*
9381 * Fast path caching single unmapped page
9382 */
9383 if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9384 flags == HAT_CACHE) {
9385 PP_CLRTNC(pp);
9386 PP_CLRPNC(pp);
9387 sfmmu_page_exit(pmtx);
9388 sfmmu_kpm_kpmp_exit(kpmp);
9389 return;
9390 }
9391
9392 /*
9393 * We need to capture all cpus in order to change cacheability
9394 * because we can't allow one cpu to access the same physical
9395 * page using a cacheable and a non-cachebale mapping at the same
9396 * time. Since we may end up walking the ism mapping list
9397 * have to grab it's lock now since we can't after all the
9398 * cpus have been captured.
9399 */
9400 sfmmu_hat_lock_all();
9401 mutex_enter(&ism_mlist_lock);
9402 kpreempt_disable();
9403 cpuset = cpu_ready_set;
9404 xc_attention(cpuset);
9405
9406 if (npages > 1) {
9407 /*
9408 * Make sure all colors are flushed since the
9409 * sfmmu_page_cache() only flushes one color-
9410 * it does not know big pages.
9411 */
9412 ncolors = CACHE_NUM_COLOR;
9413 if (flags & HAT_TMPNC) {
9414 for (i = 0; i < ncolors; i++) {
9415 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9416 }
9417 cache_flush_flag = CACHE_NO_FLUSH;
9418 }
9419 }
9420
9421 for (i = 0; i < npages; i++) {
9422
9423 ASSERT(sfmmu_mlist_held(pp));
9424
9425 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9426
9427 if (npages > 1) {
9428 bcolor = i % ncolors;
9429 } else {
9430 bcolor = NO_VCOLOR;
9431 }
9432
9433 sfmmu_page_cache(pp, flags, cache_flush_flag,
9434 bcolor);
9435 }
9436
9437 pp = PP_PAGENEXT(pp);
9438 }
9439
9440 xt_sync(cpuset);
9441 xc_dismissed(cpuset);
9442 mutex_exit(&ism_mlist_lock);
9443 sfmmu_hat_unlock_all();
9444 sfmmu_page_exit(pmtx);
9445 sfmmu_kpm_kpmp_exit(kpmp);
9446 kpreempt_enable();
9447 }
9448
9449 /*
9450 * This function changes the virtual cacheability of all mappings to a
9451 * particular page. When changing from uncache to cacheable the mappings will
9452 * only be changed if all of them have the same virtual color.
9453 * We need to flush the cache in all cpus. It is possible that
9454 * a process referenced a page as cacheable but has sinced exited
9455 * and cleared the mapping list. We still to flush it but have no
9456 * state so all cpus is the only alternative.
9457 */
9458 static void
9459 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9460 {
9461 struct sf_hment *sfhme;
9462 struct hme_blk *hmeblkp;
9463 sfmmu_t *sfmmup;
9464 tte_t tte, ttemod;
9465 caddr_t vaddr;
9466 int ret, color;
9467 pfn_t pfn;
9468
9469 color = bcolor;
9470 pfn = pp->p_pagenum;
9471
9472 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9473
9474 if (IS_PAHME(sfhme))
9475 continue;
9476 hmeblkp = sfmmu_hmetohblk(sfhme);
9477
9478 sfmmu_copytte(&sfhme->hme_tte, &tte);
9479 ASSERT(TTE_IS_VALID(&tte));
9480 vaddr = tte_to_vaddr(hmeblkp, tte);
9481 color = addr_to_vcolor(vaddr);
9482
9483 #ifdef DEBUG
9484 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9485 ASSERT(color == bcolor);
9486 }
9487 #endif
9488
9489 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9490
9491 ttemod = tte;
9492 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9493 TTE_CLR_VCACHEABLE(&ttemod);
9494 } else { /* flags & HAT_CACHE */
9495 TTE_SET_VCACHEABLE(&ttemod);
9496 }
9497 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9498 if (ret < 0) {
9499 /*
9500 * Since all cpus are captured modifytte should not
9501 * fail.
9502 */
9503 panic("sfmmu_page_cache: write to tte failed");
9504 }
9505
9506 sfmmup = hblktosfmmu(hmeblkp);
9507 if (cache_flush_flag == CACHE_FLUSH) {
9508 /*
9509 * Flush TSBs, TLBs and caches
9510 */
9511 if (hmeblkp->hblk_shared) {
9512 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9513 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9514 sf_region_t *rgnp;
9515 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9516 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9517 ASSERT(srdp != NULL);
9518 rgnp = srdp->srd_hmergnp[rid];
9519 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9520 srdp, rgnp, rid);
9521 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9522 hmeblkp, 0);
9523 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9524 } else if (sfmmup->sfmmu_ismhat) {
9525 if (flags & HAT_CACHE) {
9526 SFMMU_STAT(sf_ism_recache);
9527 } else {
9528 SFMMU_STAT(sf_ism_uncache);
9529 }
9530 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9531 pfn, CACHE_FLUSH);
9532 } else {
9533 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9534 pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9535 }
9536
9537 /*
9538 * all cache entries belonging to this pfn are
9539 * now flushed.
9540 */
9541 cache_flush_flag = CACHE_NO_FLUSH;
9542 } else {
9543 /*
9544 * Flush only TSBs and TLBs.
9545 */
9546 if (hmeblkp->hblk_shared) {
9547 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9548 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9549 sf_region_t *rgnp;
9550 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9551 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9552 ASSERT(srdp != NULL);
9553 rgnp = srdp->srd_hmergnp[rid];
9554 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9555 srdp, rgnp, rid);
9556 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9557 hmeblkp, 0);
9558 } else if (sfmmup->sfmmu_ismhat) {
9559 if (flags & HAT_CACHE) {
9560 SFMMU_STAT(sf_ism_recache);
9561 } else {
9562 SFMMU_STAT(sf_ism_uncache);
9563 }
9564 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9565 pfn, CACHE_NO_FLUSH);
9566 } else {
9567 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9568 }
9569 }
9570 }
9571
9572 if (PP_ISMAPPED_KPM(pp))
9573 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9574
9575 switch (flags) {
9576
9577 default:
9578 panic("sfmmu_pagecache: unknown flags");
9579 break;
9580
9581 case HAT_CACHE:
9582 PP_CLRTNC(pp);
9583 PP_CLRPNC(pp);
9584 PP_SET_VCOLOR(pp, color);
9585 break;
9586
9587 case HAT_TMPNC:
9588 PP_SETTNC(pp);
9589 PP_SET_VCOLOR(pp, NO_VCOLOR);
9590 break;
9591
9592 case HAT_UNCACHE:
9593 PP_SETPNC(pp);
9594 PP_CLRTNC(pp);
9595 PP_SET_VCOLOR(pp, NO_VCOLOR);
9596 break;
9597 }
9598 }
9599 #endif /* VAC */
9600
9601
9602 /*
9603 * Wrapper routine used to return a context.
9604 *
9605 * It's the responsibility of the caller to guarantee that the
9606 * process serializes on calls here by taking the HAT lock for
9607 * the hat.
9608 *
9609 */
9610 static void
9611 sfmmu_get_ctx(sfmmu_t *sfmmup)
9612 {
9613 mmu_ctx_t *mmu_ctxp;
9614 uint_t pstate_save;
9615 int ret;
9616
9617 ASSERT(sfmmu_hat_lock_held(sfmmup));
9618 ASSERT(sfmmup != ksfmmup);
9619
9620 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9621 sfmmu_setup_tsbinfo(sfmmup);
9622 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9623 }
9624
9625 kpreempt_disable();
9626
9627 mmu_ctxp = CPU_MMU_CTXP(CPU);
9628 ASSERT(mmu_ctxp);
9629 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9630 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9631
9632 /*
9633 * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9634 */
9635 if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9636 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9637
9638 /*
9639 * Let the MMU set up the page sizes to use for
9640 * this context in the TLB. Don't program 2nd dtlb for ism hat.
9641 */
9642 if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9643 mmu_set_ctx_page_sizes(sfmmup);
9644 }
9645
9646 /*
9647 * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9648 * interrupts disabled to prevent race condition with wrap-around
9649 * ctx invalidatation. In sun4v, ctx invalidation also involves
9650 * a HV call to set the number of TSBs to 0. If interrupts are not
9651 * disabled until after sfmmu_load_mmustate is complete TSBs may
9652 * become assigned to INVALID_CONTEXT. This is not allowed.
9653 */
9654 pstate_save = sfmmu_disable_intrs();
9655
9656 if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9657 sfmmup->sfmmu_scdp != NULL) {
9658 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9659 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9660 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9661 /* debug purpose only */
9662 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9663 != INVALID_CONTEXT);
9664 }
9665 sfmmu_load_mmustate(sfmmup);
9666
9667 sfmmu_enable_intrs(pstate_save);
9668
9669 kpreempt_enable();
9670 }
9671
9672 /*
9673 * When all cnums are used up in a MMU, cnum will wrap around to the
9674 * next generation and start from 2.
9675 */
9676 static void
9677 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9678 {
9679
9680 /* caller must have disabled the preemption */
9681 ASSERT(curthread->t_preempt >= 1);
9682 ASSERT(mmu_ctxp != NULL);
9683
9684 /* acquire Per-MMU (PM) spin lock */
9685 mutex_enter(&mmu_ctxp->mmu_lock);
9686
9687 /* re-check to see if wrap-around is needed */
9688 if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9689 goto done;
9690
9691 SFMMU_MMU_STAT(mmu_wrap_around);
9692
9693 /* update gnum */
9694 ASSERT(mmu_ctxp->mmu_gnum != 0);
9695 mmu_ctxp->mmu_gnum++;
9696 if (mmu_ctxp->mmu_gnum == 0 ||
9697 mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9698 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9699 (void *)mmu_ctxp);
9700 }
9701
9702 if (mmu_ctxp->mmu_ncpus > 1) {
9703 cpuset_t cpuset;
9704
9705 membar_enter(); /* make sure updated gnum visible */
9706
9707 SFMMU_XCALL_STATS(NULL);
9708
9709 /* xcall to others on the same MMU to invalidate ctx */
9710 cpuset = mmu_ctxp->mmu_cpuset;
9711 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9712 CPUSET_DEL(cpuset, CPU->cpu_id);
9713 CPUSET_AND(cpuset, cpu_ready_set);
9714
9715 /*
9716 * Pass in INVALID_CONTEXT as the first parameter to
9717 * sfmmu_raise_tsb_exception, which invalidates the context
9718 * of any process running on the CPUs in the MMU.
9719 */
9720 xt_some(cpuset, sfmmu_raise_tsb_exception,
9721 INVALID_CONTEXT, INVALID_CONTEXT);
9722 xt_sync(cpuset);
9723
9724 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9725 }
9726
9727 if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9728 sfmmu_setctx_sec(INVALID_CONTEXT);
9729 sfmmu_clear_utsbinfo();
9730 }
9731
9732 /*
9733 * No xcall is needed here. For sun4u systems all CPUs in context
9734 * domain share a single physical MMU therefore it's enough to flush
9735 * TLB on local CPU. On sun4v systems we use 1 global context
9736 * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9737 * handler. Note that vtag_flushall_uctxs() is called
9738 * for Ultra II machine, where the equivalent flushall functionality
9739 * is implemented in SW, and only user ctx TLB entries are flushed.
9740 */
9741 if (&vtag_flushall_uctxs != NULL) {
9742 vtag_flushall_uctxs();
9743 } else {
9744 vtag_flushall();
9745 }
9746
9747 /* reset mmu cnum, skips cnum 0 and 1 */
9748 if (reset_cnum == B_TRUE)
9749 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9750
9751 done:
9752 mutex_exit(&mmu_ctxp->mmu_lock);
9753 }
9754
9755
9756 /*
9757 * For multi-threaded process, set the process context to INVALID_CONTEXT
9758 * so that it faults and reloads the MMU state from TL=0. For single-threaded
9759 * process, we can just load the MMU state directly without having to
9760 * set context invalid. Caller must hold the hat lock since we don't
9761 * acquire it here.
9762 */
9763 static void
9764 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9765 {
9766 uint_t cnum;
9767 uint_t pstate_save;
9768
9769 ASSERT(sfmmup != ksfmmup);
9770 ASSERT(sfmmu_hat_lock_held(sfmmup));
9771
9772 kpreempt_disable();
9773
9774 /*
9775 * We check whether the pass'ed-in sfmmup is the same as the
9776 * current running proc. This is to makes sure the current proc
9777 * stays single-threaded if it already is.
9778 */
9779 if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9780 (curthread->t_procp->p_lwpcnt == 1)) {
9781 /* single-thread */
9782 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9783 if (cnum != INVALID_CONTEXT) {
9784 uint_t curcnum;
9785 /*
9786 * Disable interrupts to prevent race condition
9787 * with sfmmu_ctx_wrap_around ctx invalidation.
9788 * In sun4v, ctx invalidation involves setting
9789 * TSB to NULL, hence, interrupts should be disabled
9790 * untill after sfmmu_load_mmustate is completed.
9791 */
9792 pstate_save = sfmmu_disable_intrs();
9793 curcnum = sfmmu_getctx_sec();
9794 if (curcnum == cnum)
9795 sfmmu_load_mmustate(sfmmup);
9796 sfmmu_enable_intrs(pstate_save);
9797 ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9798 }
9799 } else {
9800 /*
9801 * multi-thread
9802 * or when sfmmup is not the same as the curproc.
9803 */
9804 sfmmu_invalidate_ctx(sfmmup);
9805 }
9806
9807 kpreempt_enable();
9808 }
9809
9810
9811 /*
9812 * Replace the specified TSB with a new TSB. This function gets called when
9813 * we grow, shrink or swapin a TSB. When swapping in a TSB (TSB_SWAPIN), the
9814 * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9815 * (8K).
9816 *
9817 * Caller must hold the HAT lock, but should assume any tsb_info
9818 * pointers it has are no longer valid after calling this function.
9819 *
9820 * Return values:
9821 * TSB_ALLOCFAIL Failed to allocate a TSB, due to memory constraints
9822 * TSB_LOSTRACE HAT is busy, i.e. another thread is already doing
9823 * something to this tsbinfo/TSB
9824 * TSB_SUCCESS Operation succeeded
9825 */
9826 static tsb_replace_rc_t
9827 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
9828 hatlock_t *hatlockp, uint_t flags)
9829 {
9830 struct tsb_info *new_tsbinfo = NULL;
9831 struct tsb_info *curtsb, *prevtsb;
9832 uint_t tte_sz_mask;
9833 int i;
9834
9835 ASSERT(sfmmup != ksfmmup);
9836 ASSERT(sfmmup->sfmmu_ismhat == 0);
9837 ASSERT(sfmmu_hat_lock_held(sfmmup));
9838 ASSERT(szc <= tsb_max_growsize);
9839
9840 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
9841 return (TSB_LOSTRACE);
9842
9843 /*
9844 * Find the tsb_info ahead of this one in the list, and
9845 * also make sure that the tsb_info passed in really
9846 * exists!
9847 */
9848 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9849 curtsb != old_tsbinfo && curtsb != NULL;
9850 prevtsb = curtsb, curtsb = curtsb->tsb_next)
9851 ;
9852 ASSERT(curtsb != NULL);
9853
9854 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9855 /*
9856 * The process is swapped out, so just set the new size
9857 * code. When it swaps back in, we'll allocate a new one
9858 * of the new chosen size.
9859 */
9860 curtsb->tsb_szc = szc;
9861 return (TSB_SUCCESS);
9862 }
9863 SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
9864
9865 tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
9866
9867 /*
9868 * All initialization is done inside of sfmmu_tsbinfo_alloc().
9869 * If we fail to allocate a TSB, exit.
9870 *
9871 * If tsb grows with new tsb size > 4M and old tsb size < 4M,
9872 * then try 4M slab after the initial alloc fails.
9873 *
9874 * If tsb swapin with tsb size > 4M, then try 4M after the
9875 * initial alloc fails.
9876 */
9877 sfmmu_hat_exit(hatlockp);
9878 if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
9879 tte_sz_mask, flags, sfmmup) &&
9880 (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
9881 (!(flags & TSB_SWAPIN) &&
9882 (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
9883 sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
9884 tte_sz_mask, flags, sfmmup))) {
9885 (void) sfmmu_hat_enter(sfmmup);
9886 if (!(flags & TSB_SWAPIN))
9887 SFMMU_STAT(sf_tsb_resize_failures);
9888 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9889 return (TSB_ALLOCFAIL);
9890 }
9891 (void) sfmmu_hat_enter(sfmmup);
9892
9893 /*
9894 * Re-check to make sure somebody else didn't muck with us while we
9895 * didn't hold the HAT lock. If the process swapped out, fine, just
9896 * exit; this can happen if we try to shrink the TSB from the context
9897 * of another process (such as on an ISM unmap), though it is rare.
9898 */
9899 if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9900 SFMMU_STAT(sf_tsb_resize_failures);
9901 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9902 sfmmu_hat_exit(hatlockp);
9903 sfmmu_tsbinfo_free(new_tsbinfo);
9904 (void) sfmmu_hat_enter(sfmmup);
9905 return (TSB_LOSTRACE);
9906 }
9907
9908 #ifdef DEBUG
9909 /* Reverify that the tsb_info still exists.. for debugging only */
9910 for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9911 curtsb != old_tsbinfo && curtsb != NULL;
9912 prevtsb = curtsb, curtsb = curtsb->tsb_next)
9913 ;
9914 ASSERT(curtsb != NULL);
9915 #endif /* DEBUG */
9916
9917 /*
9918 * Quiesce any CPUs running this process on their next TLB miss
9919 * so they atomically see the new tsb_info. We temporarily set the
9920 * context to invalid context so new threads that come on processor
9921 * after we do the xcall to cpusran will also serialize behind the
9922 * HAT lock on TLB miss and will see the new TSB. Since this short
9923 * race with a new thread coming on processor is relatively rare,
9924 * this synchronization mechanism should be cheaper than always
9925 * pausing all CPUs for the duration of the setup, which is what
9926 * the old implementation did. This is particuarly true if we are
9927 * copying a huge chunk of memory around during that window.
9928 *
9929 * The memory barriers are to make sure things stay consistent
9930 * with resume() since it does not hold the HAT lock while
9931 * walking the list of tsb_info structures.
9932 */
9933 if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
9934 /* The TSB is either growing or shrinking. */
9935 sfmmu_invalidate_ctx(sfmmup);
9936 } else {
9937 /*
9938 * It is illegal to swap in TSBs from a process other
9939 * than a process being swapped in. This in turn
9940 * implies we do not have a valid MMU context here
9941 * since a process needs one to resolve translation
9942 * misses.
9943 */
9944 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
9945 }
9946
9947 #ifdef DEBUG
9948 ASSERT(max_mmu_ctxdoms > 0);
9949
9950 /*
9951 * Process should have INVALID_CONTEXT on all MMUs
9952 */
9953 for (i = 0; i < max_mmu_ctxdoms; i++) {
9954
9955 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
9956 }
9957 #endif
9958
9959 new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
9960 membar_stst(); /* strict ordering required */
9961 if (prevtsb)
9962 prevtsb->tsb_next = new_tsbinfo;
9963 else
9964 sfmmup->sfmmu_tsb = new_tsbinfo;
9965 membar_enter(); /* make sure new TSB globally visible */
9966
9967 /*
9968 * We need to migrate TSB entries from the old TSB to the new TSB
9969 * if tsb_remap_ttes is set and the TSB is growing.
9970 */
9971 if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
9972 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
9973
9974 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9975
9976 /*
9977 * Drop the HAT lock to free our old tsb_info.
9978 */
9979 sfmmu_hat_exit(hatlockp);
9980
9981 if ((flags & TSB_GROW) == TSB_GROW) {
9982 SFMMU_STAT(sf_tsb_grow);
9983 } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
9984 SFMMU_STAT(sf_tsb_shrink);
9985 }
9986
9987 sfmmu_tsbinfo_free(old_tsbinfo);
9988
9989 (void) sfmmu_hat_enter(sfmmup);
9990 return (TSB_SUCCESS);
9991 }
9992
9993 /*
9994 * This function will re-program hat pgsz array, and invalidate the
9995 * process' context, forcing the process to switch to another
9996 * context on the next TLB miss, and therefore start using the
9997 * TLB that is reprogrammed for the new page sizes.
9998 */
9999 void
10000 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
10001 {
10002 int i;
10003 hatlock_t *hatlockp = NULL;
10004
10005 hatlockp = sfmmu_hat_enter(sfmmup);
10006 /* USIII+-IV+ optimization, requires hat lock */
10007 if (tmp_pgsz) {
10008 for (i = 0; i < mmu_page_sizes; i++)
10009 sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
10010 }
10011 SFMMU_STAT(sf_tlb_reprog_pgsz);
10012
10013 sfmmu_invalidate_ctx(sfmmup);
10014
10015 sfmmu_hat_exit(hatlockp);
10016 }
10017
10018 /*
10019 * The scd_rttecnt field in the SCD must be updated to take account of the
10020 * regions which it contains.
10021 */
10022 static void
10023 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10024 {
10025 uint_t rid;
10026 uint_t i, j;
10027 ulong_t w;
10028 sf_region_t *rgnp;
10029
10030 ASSERT(srdp != NULL);
10031
10032 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10033 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10034 continue;
10035 }
10036
10037 j = 0;
10038 while (w) {
10039 if (!(w & 0x1)) {
10040 j++;
10041 w >>= 1;
10042 continue;
10043 }
10044 rid = (i << BT_ULSHIFT) | j;
10045 j++;
10046 w >>= 1;
10047
10048 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10049 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10050 rgnp = srdp->srd_hmergnp[rid];
10051 ASSERT(rgnp->rgn_refcnt > 0);
10052 ASSERT(rgnp->rgn_id == rid);
10053
10054 scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10055 rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10056
10057 /*
10058 * Maintain the tsb0 inflation cnt for the regions
10059 * in the SCD.
10060 */
10061 if (rgnp->rgn_pgszc >= TTE4M) {
10062 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10063 rgnp->rgn_size >>
10064 (TTE_PAGE_SHIFT(TTE8K) + 2);
10065 }
10066 }
10067 }
10068 }
10069
10070 /*
10071 * This function assumes that there are either four or six supported page
10072 * sizes and at most two programmable TLBs, so we need to decide which
10073 * page sizes are most important and then tell the MMU layer so it
10074 * can adjust the TLB page sizes accordingly (if supported).
10075 *
10076 * If these assumptions change, this function will need to be
10077 * updated to support whatever the new limits are.
10078 *
10079 * The growing flag is nonzero if we are growing the address space,
10080 * and zero if it is shrinking. This allows us to decide whether
10081 * to grow or shrink our TSB, depending upon available memory
10082 * conditions.
10083 */
10084 static void
10085 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10086 {
10087 uint64_t ttecnt[MMU_PAGE_SIZES];
10088 uint64_t tte8k_cnt, tte4m_cnt;
10089 uint8_t i;
10090 int sectsb_thresh;
10091
10092 /*
10093 * Kernel threads, processes with small address spaces not using
10094 * large pages, and dummy ISM HATs need not apply.
10095 */
10096 if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10097 return;
10098
10099 if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10100 sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10101 return;
10102
10103 for (i = 0; i < mmu_page_sizes; i++) {
10104 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10105 sfmmup->sfmmu_ismttecnt[i];
10106 }
10107
10108 /* Check pagesizes in use, and possibly reprogram DTLB. */
10109 if (&mmu_check_page_sizes)
10110 mmu_check_page_sizes(sfmmup, ttecnt);
10111
10112 /*
10113 * Calculate the number of 8k ttes to represent the span of these
10114 * pages.
10115 */
10116 tte8k_cnt = ttecnt[TTE8K] +
10117 (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10118 (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10119 if (mmu_page_sizes == max_mmu_page_sizes) {
10120 tte4m_cnt = ttecnt[TTE4M] +
10121 (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10122 (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10123 } else {
10124 tte4m_cnt = ttecnt[TTE4M];
10125 }
10126
10127 /*
10128 * Inflate tte8k_cnt to allow for region large page allocation failure.
10129 */
10130 tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10131
10132 /*
10133 * Inflate TSB sizes by a factor of 2 if this process
10134 * uses 4M text pages to minimize extra conflict misses
10135 * in the first TSB since without counting text pages
10136 * 8K TSB may become too small.
10137 *
10138 * Also double the size of the second TSB to minimize
10139 * extra conflict misses due to competition between 4M text pages
10140 * and data pages.
10141 *
10142 * We need to adjust the second TSB allocation threshold by the
10143 * inflation factor, since there is no point in creating a second
10144 * TSB when we know all the mappings can fit in the I/D TLBs.
10145 */
10146 sectsb_thresh = tsb_sectsb_threshold;
10147 if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10148 tte8k_cnt <<= 1;
10149 tte4m_cnt <<= 1;
10150 sectsb_thresh <<= 1;
10151 }
10152
10153 /*
10154 * Check to see if our TSB is the right size; we may need to
10155 * grow or shrink it. If the process is small, our work is
10156 * finished at this point.
10157 */
10158 if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10159 return;
10160 }
10161 sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10162 }
10163
10164 static void
10165 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10166 uint64_t tte4m_cnt, int sectsb_thresh)
10167 {
10168 int tsb_bits;
10169 uint_t tsb_szc;
10170 struct tsb_info *tsbinfop;
10171 hatlock_t *hatlockp = NULL;
10172
10173 hatlockp = sfmmu_hat_enter(sfmmup);
10174 ASSERT(hatlockp != NULL);
10175 tsbinfop = sfmmup->sfmmu_tsb;
10176 ASSERT(tsbinfop != NULL);
10177
10178 /*
10179 * If we're growing, select the size based on RSS. If we're
10180 * shrinking, leave some room so we don't have to turn around and
10181 * grow again immediately.
10182 */
10183 if (growing)
10184 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10185 else
10186 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10187
10188 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10189 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10190 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10191 hatlockp, TSB_SHRINK);
10192 } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10193 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10194 hatlockp, TSB_GROW);
10195 }
10196 tsbinfop = sfmmup->sfmmu_tsb;
10197
10198 /*
10199 * With the TLB and first TSB out of the way, we need to see if
10200 * we need a second TSB for 4M pages. If we managed to reprogram
10201 * the TLB page sizes above, the process will start using this new
10202 * TSB right away; otherwise, it will start using it on the next
10203 * context switch. Either way, it's no big deal so there's no
10204 * synchronization with the trap handlers here unless we grow the
10205 * TSB (in which case it's required to prevent using the old one
10206 * after it's freed). Note: second tsb is required for 32M/256M
10207 * page sizes.
10208 */
10209 if (tte4m_cnt > sectsb_thresh) {
10210 /*
10211 * If we're growing, select the size based on RSS. If we're
10212 * shrinking, leave some room so we don't have to turn
10213 * around and grow again immediately.
10214 */
10215 if (growing)
10216 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10217 else
10218 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10219 if (tsbinfop->tsb_next == NULL) {
10220 struct tsb_info *newtsb;
10221 int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10222 0 : TSB_ALLOC;
10223
10224 sfmmu_hat_exit(hatlockp);
10225
10226 /*
10227 * Try to allocate a TSB for 4[32|256]M pages. If we
10228 * can't get the size we want, retry w/a minimum sized
10229 * TSB. If that still didn't work, give up; we can
10230 * still run without one.
10231 */
10232 tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10233 TSB4M|TSB32M|TSB256M:TSB4M;
10234 if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10235 allocflags, sfmmup)) &&
10236 (tsb_szc <= TSB_4M_SZCODE ||
10237 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10238 tsb_bits, allocflags, sfmmup)) &&
10239 sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10240 tsb_bits, allocflags, sfmmup)) {
10241 return;
10242 }
10243
10244 hatlockp = sfmmu_hat_enter(sfmmup);
10245
10246 sfmmu_invalidate_ctx(sfmmup);
10247
10248 if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10249 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10250 SFMMU_STAT(sf_tsb_sectsb_create);
10251 sfmmu_hat_exit(hatlockp);
10252 return;
10253 } else {
10254 /*
10255 * It's annoying, but possible for us
10256 * to get here.. we dropped the HAT lock
10257 * because of locking order in the kmem
10258 * allocator, and while we were off getting
10259 * our memory, some other thread decided to
10260 * do us a favor and won the race to get a
10261 * second TSB for this process. Sigh.
10262 */
10263 sfmmu_hat_exit(hatlockp);
10264 sfmmu_tsbinfo_free(newtsb);
10265 return;
10266 }
10267 }
10268
10269 /*
10270 * We have a second TSB, see if it's big enough.
10271 */
10272 tsbinfop = tsbinfop->tsb_next;
10273
10274 /*
10275 * Check to see if our second TSB is the right size;
10276 * we may need to grow or shrink it.
10277 * To prevent thrashing (e.g. growing the TSB on a
10278 * subsequent map operation), only try to shrink if
10279 * the TSB reach exceeds twice the virtual address
10280 * space size.
10281 */
10282 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10283 (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10284 (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10285 tsb_szc, hatlockp, TSB_SHRINK);
10286 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10287 TSB_OK_GROW()) {
10288 (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10289 tsb_szc, hatlockp, TSB_GROW);
10290 }
10291 }
10292
10293 sfmmu_hat_exit(hatlockp);
10294 }
10295
10296 /*
10297 * Free up a sfmmu
10298 * Since the sfmmu is currently embedded in the hat struct we simply zero
10299 * out our fields and free up the ism map blk list if any.
10300 */
10301 static void
10302 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10303 {
10304 ism_blk_t *blkp, *nx_blkp;
10305 #ifdef DEBUG
10306 ism_map_t *map;
10307 int i;
10308 #endif
10309
10310 ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10311 ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10312 ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10313 ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10314 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10315 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10316 ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10317
10318 sfmmup->sfmmu_free = 0;
10319 sfmmup->sfmmu_ismhat = 0;
10320
10321 blkp = sfmmup->sfmmu_iblk;
10322 sfmmup->sfmmu_iblk = NULL;
10323
10324 while (blkp) {
10325 #ifdef DEBUG
10326 map = blkp->iblk_maps;
10327 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10328 ASSERT(map[i].imap_seg == 0);
10329 ASSERT(map[i].imap_ismhat == NULL);
10330 ASSERT(map[i].imap_ment == NULL);
10331 }
10332 #endif
10333 nx_blkp = blkp->iblk_next;
10334 blkp->iblk_next = NULL;
10335 blkp->iblk_nextpa = (uint64_t)-1;
10336 kmem_cache_free(ism_blk_cache, blkp);
10337 blkp = nx_blkp;
10338 }
10339 }
10340
10341 /*
10342 * Locking primitves accessed by HATLOCK macros
10343 */
10344
10345 #define SFMMU_SPL_MTX (0x0)
10346 #define SFMMU_ML_MTX (0x1)
10347
10348 #define SFMMU_MLSPL_MTX(type, pg) (((type) == SFMMU_SPL_MTX) ? \
10349 SPL_HASH(pg) : MLIST_HASH(pg))
10350
10351 kmutex_t *
10352 sfmmu_page_enter(struct page *pp)
10353 {
10354 return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10355 }
10356
10357 void
10358 sfmmu_page_exit(kmutex_t *spl)
10359 {
10360 mutex_exit(spl);
10361 }
10362
10363 int
10364 sfmmu_page_spl_held(struct page *pp)
10365 {
10366 return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10367 }
10368
10369 kmutex_t *
10370 sfmmu_mlist_enter(struct page *pp)
10371 {
10372 return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10373 }
10374
10375 void
10376 sfmmu_mlist_exit(kmutex_t *mml)
10377 {
10378 mutex_exit(mml);
10379 }
10380
10381 int
10382 sfmmu_mlist_held(struct page *pp)
10383 {
10384
10385 return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10386 }
10387
10388 /*
10389 * Common code for sfmmu_mlist_enter() and sfmmu_page_enter(). For
10390 * sfmmu_mlist_enter() case mml_table lock array is used and for
10391 * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10392 *
10393 * The lock is taken on a root page so that it protects an operation on all
10394 * constituent pages of a large page pp belongs to.
10395 *
10396 * The routine takes a lock from the appropriate array. The lock is determined
10397 * by hashing the root page. After taking the lock this routine checks if the
10398 * root page has the same size code that was used to determine the root (i.e
10399 * that root hasn't changed). If root page has the expected p_szc field we
10400 * have the right lock and it's returned to the caller. If root's p_szc
10401 * decreased we release the lock and retry from the beginning. This case can
10402 * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10403 * value and taking the lock. The number of retries due to p_szc decrease is
10404 * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10405 * determined by hashing pp itself.
10406 *
10407 * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10408 * possible that p_szc can increase. To increase p_szc a thread has to lock
10409 * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10410 * callers that don't hold a page locked recheck if hmeblk through which pp
10411 * was found still maps this pp. If it doesn't map it anymore returned lock
10412 * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10413 * p_szc increase after taking the lock it returns this lock without further
10414 * retries because in this case the caller doesn't care about which lock was
10415 * taken. The caller will drop it right away.
10416 *
10417 * After the routine returns it's guaranteed that hat_page_demote() can't
10418 * change p_szc field of any of constituent pages of a large page pp belongs
10419 * to as long as pp was either locked at least SHARED prior to this call or
10420 * the caller finds that hment that pointed to this pp still references this
10421 * pp (this also assumes that the caller holds hme hash bucket lock so that
10422 * the same pp can't be remapped into the same hmeblk after it was unmapped by
10423 * hat_pageunload()).
10424 */
10425 static kmutex_t *
10426 sfmmu_mlspl_enter(struct page *pp, int type)
10427 {
10428 kmutex_t *mtx;
10429 uint_t prev_rszc = UINT_MAX;
10430 page_t *rootpp;
10431 uint_t szc;
10432 uint_t rszc;
10433 uint_t pszc = pp->p_szc;
10434
10435 ASSERT(pp != NULL);
10436
10437 again:
10438 if (pszc == 0) {
10439 mtx = SFMMU_MLSPL_MTX(type, pp);
10440 mutex_enter(mtx);
10441 return (mtx);
10442 }
10443
10444 /* The lock lives in the root page */
10445 rootpp = PP_GROUPLEADER(pp, pszc);
10446 mtx = SFMMU_MLSPL_MTX(type, rootpp);
10447 mutex_enter(mtx);
10448
10449 /*
10450 * Return mml in the following 3 cases:
10451 *
10452 * 1) If pp itself is root since if its p_szc decreased before we took
10453 * the lock pp is still the root of smaller szc page. And if its p_szc
10454 * increased it doesn't matter what lock we return (see comment in
10455 * front of this routine).
10456 *
10457 * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10458 * large page we have the right lock since any previous potential
10459 * hat_page_demote() is done demoting from greater than current root's
10460 * p_szc because hat_page_demote() changes root's p_szc last. No
10461 * further hat_page_demote() can start or be in progress since it
10462 * would need the same lock we currently hold.
10463 *
10464 * 3) If rootpp's p_szc increased since previous iteration it doesn't
10465 * matter what lock we return (see comment in front of this routine).
10466 */
10467 if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10468 rszc >= prev_rszc) {
10469 return (mtx);
10470 }
10471
10472 /*
10473 * hat_page_demote() could have decreased root's p_szc.
10474 * In this case pp's p_szc must also be smaller than pszc.
10475 * Retry.
10476 */
10477 if (rszc < pszc) {
10478 szc = pp->p_szc;
10479 if (szc < pszc) {
10480 mutex_exit(mtx);
10481 pszc = szc;
10482 goto again;
10483 }
10484 /*
10485 * pp's p_szc increased after it was decreased.
10486 * page cannot be mapped. Return current lock. The caller
10487 * will drop it right away.
10488 */
10489 return (mtx);
10490 }
10491
10492 /*
10493 * root's p_szc is greater than pp's p_szc.
10494 * hat_page_demote() is not done with all pages
10495 * yet. Wait for it to complete.
10496 */
10497 mutex_exit(mtx);
10498 rootpp = PP_GROUPLEADER(rootpp, rszc);
10499 mtx = SFMMU_MLSPL_MTX(type, rootpp);
10500 mutex_enter(mtx);
10501 mutex_exit(mtx);
10502 prev_rszc = rszc;
10503 goto again;
10504 }
10505
10506 static int
10507 sfmmu_mlspl_held(struct page *pp, int type)
10508 {
10509 kmutex_t *mtx;
10510
10511 ASSERT(pp != NULL);
10512 /* The lock lives in the root page */
10513 pp = PP_PAGEROOT(pp);
10514 ASSERT(pp != NULL);
10515
10516 mtx = SFMMU_MLSPL_MTX(type, pp);
10517 return (MUTEX_HELD(mtx));
10518 }
10519
10520 static uint_t
10521 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10522 {
10523 struct hme_blk *hblkp;
10524
10525
10526 if (freehblkp != NULL) {
10527 mutex_enter(&freehblkp_lock);
10528 if (freehblkp != NULL) {
10529 /*
10530 * If the current thread is owning hblk_reserve OR
10531 * critical request from sfmmu_hblk_steal()
10532 * let it succeed even if freehblkcnt is really low.
10533 */
10534 if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10535 SFMMU_STAT(sf_get_free_throttle);
10536 mutex_exit(&freehblkp_lock);
10537 return (0);
10538 }
10539 freehblkcnt--;
10540 *hmeblkpp = freehblkp;
10541 hblkp = *hmeblkpp;
10542 freehblkp = hblkp->hblk_next;
10543 mutex_exit(&freehblkp_lock);
10544 hblkp->hblk_next = NULL;
10545 SFMMU_STAT(sf_get_free_success);
10546
10547 ASSERT(hblkp->hblk_hmecnt == 0);
10548 ASSERT(hblkp->hblk_vcnt == 0);
10549 ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10550
10551 return (1);
10552 }
10553 mutex_exit(&freehblkp_lock);
10554 }
10555
10556 /* Check cpu hblk pending queues */
10557 if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10558 hblkp = *hmeblkpp;
10559 hblkp->hblk_next = NULL;
10560 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10561
10562 ASSERT(hblkp->hblk_hmecnt == 0);
10563 ASSERT(hblkp->hblk_vcnt == 0);
10564
10565 return (1);
10566 }
10567
10568 SFMMU_STAT(sf_get_free_fail);
10569 return (0);
10570 }
10571
10572 static uint_t
10573 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10574 {
10575 struct hme_blk *hblkp;
10576
10577 ASSERT(hmeblkp->hblk_hmecnt == 0);
10578 ASSERT(hmeblkp->hblk_vcnt == 0);
10579 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10580
10581 /*
10582 * If the current thread is mapping into kernel space,
10583 * let it succede even if freehblkcnt is max
10584 * so that it will avoid freeing it to kmem.
10585 * This will prevent stack overflow due to
10586 * possible recursion since kmem_cache_free()
10587 * might require creation of a slab which
10588 * in turn needs an hmeblk to map that slab;
10589 * let's break this vicious chain at the first
10590 * opportunity.
10591 */
10592 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10593 mutex_enter(&freehblkp_lock);
10594 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10595 SFMMU_STAT(sf_put_free_success);
10596 freehblkcnt++;
10597 hmeblkp->hblk_next = freehblkp;
10598 freehblkp = hmeblkp;
10599 mutex_exit(&freehblkp_lock);
10600 return (1);
10601 }
10602 mutex_exit(&freehblkp_lock);
10603 }
10604
10605 /*
10606 * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10607 * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10608 * we are not in the process of mapping into kernel space.
10609 */
10610 ASSERT(!critical);
10611 while (freehblkcnt > HBLK_RESERVE_CNT) {
10612 mutex_enter(&freehblkp_lock);
10613 if (freehblkcnt > HBLK_RESERVE_CNT) {
10614 freehblkcnt--;
10615 hblkp = freehblkp;
10616 freehblkp = hblkp->hblk_next;
10617 mutex_exit(&freehblkp_lock);
10618 ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10619 kmem_cache_free(sfmmu8_cache, hblkp);
10620 continue;
10621 }
10622 mutex_exit(&freehblkp_lock);
10623 }
10624 SFMMU_STAT(sf_put_free_fail);
10625 return (0);
10626 }
10627
10628 static void
10629 sfmmu_hblk_swap(struct hme_blk *new)
10630 {
10631 struct hme_blk *old, *hblkp, *prev;
10632 uint64_t newpa;
10633 caddr_t base, vaddr, endaddr;
10634 struct hmehash_bucket *hmebp;
10635 struct sf_hment *osfhme, *nsfhme;
10636 page_t *pp;
10637 kmutex_t *pml;
10638 tte_t tte;
10639 struct hme_blk *list = NULL;
10640
10641 #ifdef DEBUG
10642 hmeblk_tag hblktag;
10643 struct hme_blk *found;
10644 #endif
10645 old = HBLK_RESERVE;
10646 ASSERT(!old->hblk_shared);
10647
10648 /*
10649 * save pa before bcopy clobbers it
10650 */
10651 newpa = new->hblk_nextpa;
10652
10653 base = (caddr_t)get_hblk_base(old);
10654 endaddr = base + get_hblk_span(old);
10655
10656 /*
10657 * acquire hash bucket lock.
10658 */
10659 hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10660 SFMMU_INVALID_SHMERID);
10661
10662 /*
10663 * copy contents from old to new
10664 */
10665 bcopy((void *)old, (void *)new, HME8BLK_SZ);
10666
10667 /*
10668 * add new to hash chain
10669 */
10670 sfmmu_hblk_hash_add(hmebp, new, newpa);
10671
10672 /*
10673 * search hash chain for hblk_reserve; this needs to be performed
10674 * after adding new, otherwise prev won't correspond to the hblk which
10675 * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10676 * remove old later.
10677 */
10678 for (prev = NULL,
10679 hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10680 prev = hblkp, hblkp = hblkp->hblk_next)
10681 ;
10682
10683 if (hblkp != old)
10684 panic("sfmmu_hblk_swap: hblk_reserve not found");
10685
10686 /*
10687 * p_mapping list is still pointing to hments in hblk_reserve;
10688 * fix up p_mapping list so that they point to hments in new.
10689 *
10690 * Since all these mappings are created by hblk_reserve_thread
10691 * on the way and it's using at least one of the buffers from each of
10692 * the newly minted slabs, there is no danger of any of these
10693 * mappings getting unloaded by another thread.
10694 *
10695 * tsbmiss could only modify ref/mod bits of hments in old/new.
10696 * Since all of these hments hold mappings established by segkmem
10697 * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10698 * have no meaning for the mappings in hblk_reserve. hments in
10699 * old and new are identical except for ref/mod bits.
10700 */
10701 for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10702
10703 HBLKTOHME(osfhme, old, vaddr);
10704 sfmmu_copytte(&osfhme->hme_tte, &tte);
10705
10706 if (TTE_IS_VALID(&tte)) {
10707 if ((pp = osfhme->hme_page) == NULL)
10708 panic("sfmmu_hblk_swap: page not mapped");
10709
10710 pml = sfmmu_mlist_enter(pp);
10711
10712 if (pp != osfhme->hme_page)
10713 panic("sfmmu_hblk_swap: mapping changed");
10714
10715 HBLKTOHME(nsfhme, new, vaddr);
10716
10717 HME_ADD(nsfhme, pp);
10718 HME_SUB(osfhme, pp);
10719
10720 sfmmu_mlist_exit(pml);
10721 }
10722 }
10723
10724 /*
10725 * remove old from hash chain
10726 */
10727 sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10728
10729 #ifdef DEBUG
10730
10731 hblktag.htag_id = ksfmmup;
10732 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10733 hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10734 hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10735 HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10736
10737 if (found != new)
10738 panic("sfmmu_hblk_swap: new hblk not found");
10739 #endif
10740
10741 SFMMU_HASH_UNLOCK(hmebp);
10742
10743 /*
10744 * Reset hblk_reserve
10745 */
10746 bzero((void *)old, HME8BLK_SZ);
10747 old->hblk_nextpa = va_to_pa((caddr_t)old);
10748 }
10749
10750 /*
10751 * Grab the mlist mutex for both pages passed in.
10752 *
10753 * low and high will be returned as pointers to the mutexes for these pages.
10754 * low refers to the mutex residing in the lower bin of the mlist hash, while
10755 * high refers to the mutex residing in the higher bin of the mlist hash. This
10756 * is due to the locking order restrictions on the same thread grabbing
10757 * multiple mlist mutexes. The low lock must be acquired before the high lock.
10758 *
10759 * If both pages hash to the same mutex, only grab that single mutex, and
10760 * high will be returned as NULL
10761 * If the pages hash to different bins in the hash, grab the lower addressed
10762 * lock first and then the higher addressed lock in order to follow the locking
10763 * rules involved with the same thread grabbing multiple mlist mutexes.
10764 * low and high will both have non-NULL values.
10765 */
10766 static void
10767 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10768 kmutex_t **low, kmutex_t **high)
10769 {
10770 kmutex_t *mml_targ, *mml_repl;
10771
10772 /*
10773 * no need to do the dance around szc as in sfmmu_mlist_enter()
10774 * because this routine is only called by hat_page_relocate() and all
10775 * targ and repl pages are already locked EXCL so szc can't change.
10776 */
10777
10778 mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10779 mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10780
10781 if (mml_targ == mml_repl) {
10782 *low = mml_targ;
10783 *high = NULL;
10784 } else {
10785 if (mml_targ < mml_repl) {
10786 *low = mml_targ;
10787 *high = mml_repl;
10788 } else {
10789 *low = mml_repl;
10790 *high = mml_targ;
10791 }
10792 }
10793
10794 mutex_enter(*low);
10795 if (*high)
10796 mutex_enter(*high);
10797 }
10798
10799 static void
10800 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10801 {
10802 if (high)
10803 mutex_exit(high);
10804 mutex_exit(low);
10805 }
10806
10807 static hatlock_t *
10808 sfmmu_hat_enter(sfmmu_t *sfmmup)
10809 {
10810 hatlock_t *hatlockp;
10811
10812 if (sfmmup != ksfmmup) {
10813 hatlockp = TSB_HASH(sfmmup);
10814 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10815 return (hatlockp);
10816 }
10817 return (NULL);
10818 }
10819
10820 static hatlock_t *
10821 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
10822 {
10823 hatlock_t *hatlockp;
10824
10825 if (sfmmup != ksfmmup) {
10826 hatlockp = TSB_HASH(sfmmup);
10827 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
10828 return (NULL);
10829 return (hatlockp);
10830 }
10831 return (NULL);
10832 }
10833
10834 static void
10835 sfmmu_hat_exit(hatlock_t *hatlockp)
10836 {
10837 if (hatlockp != NULL)
10838 mutex_exit(HATLOCK_MUTEXP(hatlockp));
10839 }
10840
10841 static void
10842 sfmmu_hat_lock_all(void)
10843 {
10844 int i;
10845 for (i = 0; i < SFMMU_NUM_LOCK; i++)
10846 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
10847 }
10848
10849 static void
10850 sfmmu_hat_unlock_all(void)
10851 {
10852 int i;
10853 for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
10854 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
10855 }
10856
10857 int
10858 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
10859 {
10860 ASSERT(sfmmup != ksfmmup);
10861 return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
10862 }
10863
10864 /*
10865 * Locking primitives to provide consistency between ISM unmap
10866 * and other operations. Since ISM unmap can take a long time, we
10867 * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
10868 * contention on the hatlock buckets while ISM segments are being
10869 * unmapped. The tradeoff is that the flags don't prevent priority
10870 * inversion from occurring, so we must request kernel priority in
10871 * case we have to sleep to keep from getting buried while holding
10872 * the HAT_ISMBUSY flag set, which in turn could block other kernel
10873 * threads from running (for example, in sfmmu_uvatopfn()).
10874 */
10875 static void
10876 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
10877 {
10878 hatlock_t *hatlockp;
10879
10880 THREAD_KPRI_REQUEST();
10881 if (!hatlock_held)
10882 hatlockp = sfmmu_hat_enter(sfmmup);
10883 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
10884 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
10885 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
10886 if (!hatlock_held)
10887 sfmmu_hat_exit(hatlockp);
10888 }
10889
10890 static void
10891 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
10892 {
10893 hatlock_t *hatlockp;
10894
10895 if (!hatlock_held)
10896 hatlockp = sfmmu_hat_enter(sfmmup);
10897 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
10898 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
10899 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
10900 if (!hatlock_held)
10901 sfmmu_hat_exit(hatlockp);
10902 THREAD_KPRI_RELEASE();
10903 }
10904
10905 /*
10906 *
10907 * Algorithm:
10908 *
10909 * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
10910 * hblks.
10911 *
10912 * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
10913 *
10914 * (a) try to return an hblk from reserve pool of free hblks;
10915 * (b) if the reserve pool is empty, acquire hblk_reserve_lock
10916 * and return hblk_reserve.
10917 *
10918 * (3) call kmem_cache_alloc() to allocate hblk;
10919 *
10920 * (a) if hblk_reserve_lock is held by the current thread,
10921 * atomically replace hblk_reserve by the hblk that is
10922 * returned by kmem_cache_alloc; release hblk_reserve_lock
10923 * and call kmem_cache_alloc() again.
10924 * (b) if reserve pool is not full, add the hblk that is
10925 * returned by kmem_cache_alloc to reserve pool and
10926 * call kmem_cache_alloc again.
10927 *
10928 */
10929 static struct hme_blk *
10930 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
10931 struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
10932 uint_t flags, uint_t rid)
10933 {
10934 struct hme_blk *hmeblkp = NULL;
10935 struct hme_blk *newhblkp;
10936 struct hme_blk *shw_hblkp = NULL;
10937 struct kmem_cache *sfmmu_cache = NULL;
10938 uint64_t hblkpa;
10939 ulong_t index;
10940 uint_t owner; /* set to 1 if using hblk_reserve */
10941 uint_t forcefree;
10942 int sleep;
10943 sf_srd_t *srdp;
10944 sf_region_t *rgnp;
10945
10946 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
10947 ASSERT(hblktag.htag_rid == rid);
10948 SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
10949 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
10950 IS_P2ALIGNED(vaddr, TTEBYTES(size)));
10951
10952 /*
10953 * If segkmem is not created yet, allocate from static hmeblks
10954 * created at the end of startup_modules(). See the block comment
10955 * in startup_modules() describing how we estimate the number of
10956 * static hmeblks that will be needed during re-map.
10957 */
10958 if (!hblk_alloc_dynamic) {
10959
10960 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10961
10962 if (size == TTE8K) {
10963 index = nucleus_hblk8.index;
10964 if (index >= nucleus_hblk8.len) {
10965 /*
10966 * If we panic here, see startup_modules() to
10967 * make sure that we are calculating the
10968 * number of hblk8's that we need correctly.
10969 */
10970 prom_panic("no nucleus hblk8 to allocate");
10971 }
10972 hmeblkp =
10973 (struct hme_blk *)&nucleus_hblk8.list[index];
10974 nucleus_hblk8.index++;
10975 SFMMU_STAT(sf_hblk8_nalloc);
10976 } else {
10977 index = nucleus_hblk1.index;
10978 if (nucleus_hblk1.index >= nucleus_hblk1.len) {
10979 /*
10980 * If we panic here, see startup_modules().
10981 * Most likely you need to update the
10982 * calculation of the number of hblk1 elements
10983 * that the kernel needs to boot.
10984 */
10985 prom_panic("no nucleus hblk1 to allocate");
10986 }
10987 hmeblkp =
10988 (struct hme_blk *)&nucleus_hblk1.list[index];
10989 nucleus_hblk1.index++;
10990 SFMMU_STAT(sf_hblk1_nalloc);
10991 }
10992
10993 goto hblk_init;
10994 }
10995
10996 SFMMU_HASH_UNLOCK(hmebp);
10997
10998 if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
10999 if (mmu_page_sizes == max_mmu_page_sizes) {
11000 if (size < TTE256M)
11001 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11002 size, flags);
11003 } else {
11004 if (size < TTE4M)
11005 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11006 size, flags);
11007 }
11008 } else if (SFMMU_IS_SHMERID_VALID(rid)) {
11009 /*
11010 * Shared hmes use per region bitmaps in rgn_hmeflag
11011 * rather than shadow hmeblks to keep track of the
11012 * mapping sizes which have been allocated for the region.
11013 * Here we cleanup old invalid hmeblks with this rid,
11014 * which may be left around by pageunload().
11015 */
11016 int ttesz;
11017 caddr_t va;
11018 caddr_t eva = vaddr + TTEBYTES(size);
11019
11020 ASSERT(sfmmup != KHATID);
11021
11022 srdp = sfmmup->sfmmu_srdp;
11023 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11024 rgnp = srdp->srd_hmergnp[rid];
11025 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11026 ASSERT(rgnp->rgn_refcnt != 0);
11027 ASSERT(size <= rgnp->rgn_pgszc);
11028
11029 ttesz = HBLK_MIN_TTESZ;
11030 do {
11031 if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11032 continue;
11033 }
11034
11035 if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11036 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11037 } else if (ttesz < size) {
11038 for (va = vaddr; va < eva;
11039 va += TTEBYTES(ttesz)) {
11040 sfmmu_cleanup_rhblk(srdp, va, rid,
11041 ttesz);
11042 }
11043 }
11044 } while (++ttesz <= rgnp->rgn_pgszc);
11045 }
11046
11047 fill_hblk:
11048 owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11049
11050 if (owner && size == TTE8K) {
11051
11052 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11053 /*
11054 * We are really in a tight spot. We already own
11055 * hblk_reserve and we need another hblk. In anticipation
11056 * of this kind of scenario, we specifically set aside
11057 * HBLK_RESERVE_MIN number of hblks to be used exclusively
11058 * by owner of hblk_reserve.
11059 */
11060 SFMMU_STAT(sf_hblk_recurse_cnt);
11061
11062 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11063 panic("sfmmu_hblk_alloc: reserve list is empty");
11064
11065 goto hblk_verify;
11066 }
11067
11068 ASSERT(!owner);
11069
11070 if ((flags & HAT_NO_KALLOC) == 0) {
11071
11072 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11073 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11074
11075 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11076 hmeblkp = sfmmu_hblk_steal(size);
11077 } else {
11078 /*
11079 * if we are the owner of hblk_reserve,
11080 * swap hblk_reserve with hmeblkp and
11081 * start a fresh life. Hope things go
11082 * better this time.
11083 */
11084 if (hblk_reserve_thread == curthread) {
11085 ASSERT(sfmmu_cache == sfmmu8_cache);
11086 sfmmu_hblk_swap(hmeblkp);
11087 hblk_reserve_thread = NULL;
11088 mutex_exit(&hblk_reserve_lock);
11089 goto fill_hblk;
11090 }
11091 /*
11092 * let's donate this hblk to our reserve list if
11093 * we are not mapping kernel range
11094 */
11095 if (size == TTE8K && sfmmup != KHATID) {
11096 if (sfmmu_put_free_hblk(hmeblkp, 0))
11097 goto fill_hblk;
11098 }
11099 }
11100 } else {
11101 /*
11102 * We are here to map the slab in sfmmu8_cache; let's
11103 * check if we could tap our reserve list; if successful,
11104 * this will avoid the pain of going thru sfmmu_hblk_swap
11105 */
11106 SFMMU_STAT(sf_hblk_slab_cnt);
11107 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11108 /*
11109 * let's start hblk_reserve dance
11110 */
11111 SFMMU_STAT(sf_hblk_reserve_cnt);
11112 owner = 1;
11113 mutex_enter(&hblk_reserve_lock);
11114 hmeblkp = HBLK_RESERVE;
11115 hblk_reserve_thread = curthread;
11116 }
11117 }
11118
11119 hblk_verify:
11120 ASSERT(hmeblkp != NULL);
11121 set_hblk_sz(hmeblkp, size);
11122 ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11123 SFMMU_HASH_LOCK(hmebp);
11124 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11125 if (newhblkp != NULL) {
11126 SFMMU_HASH_UNLOCK(hmebp);
11127 if (hmeblkp != HBLK_RESERVE) {
11128 /*
11129 * This is really tricky!
11130 *
11131 * vmem_alloc(vmem_seg_arena)
11132 * vmem_alloc(vmem_internal_arena)
11133 * segkmem_alloc(heap_arena)
11134 * vmem_alloc(heap_arena)
11135 * page_create()
11136 * hat_memload()
11137 * kmem_cache_free()
11138 * kmem_cache_alloc()
11139 * kmem_slab_create()
11140 * vmem_alloc(kmem_internal_arena)
11141 * segkmem_alloc(heap_arena)
11142 * vmem_alloc(heap_arena)
11143 * page_create()
11144 * hat_memload()
11145 * kmem_cache_free()
11146 * ...
11147 *
11148 * Thus, hat_memload() could call kmem_cache_free
11149 * for enough number of times that we could easily
11150 * hit the bottom of the stack or run out of reserve
11151 * list of vmem_seg structs. So, we must donate
11152 * this hblk to reserve list if it's allocated
11153 * from sfmmu8_cache *and* mapping kernel range.
11154 * We don't need to worry about freeing hmeblk1's
11155 * to kmem since they don't map any kmem slabs.
11156 *
11157 * Note: When segkmem supports largepages, we must
11158 * free hmeblk1's to reserve list as well.
11159 */
11160 forcefree = (sfmmup == KHATID) ? 1 : 0;
11161 if (size == TTE8K &&
11162 sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11163 goto re_verify;
11164 }
11165 ASSERT(sfmmup != KHATID);
11166 kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11167 } else {
11168 /*
11169 * Hey! we don't need hblk_reserve any more.
11170 */
11171 ASSERT(owner);
11172 hblk_reserve_thread = NULL;
11173 mutex_exit(&hblk_reserve_lock);
11174 owner = 0;
11175 }
11176 re_verify:
11177 /*
11178 * let's check if the goodies are still present
11179 */
11180 SFMMU_HASH_LOCK(hmebp);
11181 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11182 if (newhblkp != NULL) {
11183 /*
11184 * return newhblkp if it's not hblk_reserve;
11185 * if newhblkp is hblk_reserve, return it
11186 * _only if_ we are the owner of hblk_reserve.
11187 */
11188 if (newhblkp != HBLK_RESERVE || owner) {
11189 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11190 newhblkp->hblk_shared);
11191 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11192 !newhblkp->hblk_shared);
11193 return (newhblkp);
11194 } else {
11195 /*
11196 * we just hit hblk_reserve in the hash and
11197 * we are not the owner of that;
11198 *
11199 * block until hblk_reserve_thread completes
11200 * swapping hblk_reserve and try the dance
11201 * once again.
11202 */
11203 SFMMU_HASH_UNLOCK(hmebp);
11204 mutex_enter(&hblk_reserve_lock);
11205 mutex_exit(&hblk_reserve_lock);
11206 SFMMU_STAT(sf_hblk_reserve_hit);
11207 goto fill_hblk;
11208 }
11209 } else {
11210 /*
11211 * it's no more! try the dance once again.
11212 */
11213 SFMMU_HASH_UNLOCK(hmebp);
11214 goto fill_hblk;
11215 }
11216 }
11217
11218 hblk_init:
11219 if (SFMMU_IS_SHMERID_VALID(rid)) {
11220 uint16_t tteflag = 0x1 <<
11221 ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11222
11223 if (!(rgnp->rgn_hmeflags & tteflag)) {
11224 atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11225 }
11226 hmeblkp->hblk_shared = 1;
11227 } else {
11228 hmeblkp->hblk_shared = 0;
11229 }
11230 set_hblk_sz(hmeblkp, size);
11231 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11232 hmeblkp->hblk_next = (struct hme_blk *)NULL;
11233 hmeblkp->hblk_tag = hblktag;
11234 hmeblkp->hblk_shadow = shw_hblkp;
11235 hblkpa = hmeblkp->hblk_nextpa;
11236 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11237
11238 ASSERT(get_hblk_ttesz(hmeblkp) == size);
11239 ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11240 ASSERT(hmeblkp->hblk_hmecnt == 0);
11241 ASSERT(hmeblkp->hblk_vcnt == 0);
11242 ASSERT(hmeblkp->hblk_lckcnt == 0);
11243 ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11244 sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11245 return (hmeblkp);
11246 }
11247
11248 /*
11249 * This function cleans up the hme_blk and returns it to the free list.
11250 */
11251 /* ARGSUSED */
11252 static void
11253 sfmmu_hblk_free(struct hme_blk **listp)
11254 {
11255 struct hme_blk *hmeblkp, *next_hmeblkp;
11256 int size;
11257 uint_t critical;
11258 uint64_t hblkpa;
11259
11260 ASSERT(*listp != NULL);
11261
11262 hmeblkp = *listp;
11263 while (hmeblkp != NULL) {
11264 next_hmeblkp = hmeblkp->hblk_next;
11265 ASSERT(!hmeblkp->hblk_hmecnt);
11266 ASSERT(!hmeblkp->hblk_vcnt);
11267 ASSERT(!hmeblkp->hblk_lckcnt);
11268 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11269 ASSERT(hmeblkp->hblk_shared == 0);
11270 ASSERT(hmeblkp->hblk_shw_bit == 0);
11271 ASSERT(hmeblkp->hblk_shadow == NULL);
11272
11273 hblkpa = va_to_pa((caddr_t)hmeblkp);
11274 ASSERT(hblkpa != (uint64_t)-1);
11275 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11276
11277 size = get_hblk_ttesz(hmeblkp);
11278 hmeblkp->hblk_next = NULL;
11279 hmeblkp->hblk_nextpa = hblkpa;
11280
11281 if (hmeblkp->hblk_nuc_bit == 0) {
11282
11283 if (size != TTE8K ||
11284 !sfmmu_put_free_hblk(hmeblkp, critical))
11285 kmem_cache_free(get_hblk_cache(hmeblkp),
11286 hmeblkp);
11287 }
11288 hmeblkp = next_hmeblkp;
11289 }
11290 }
11291
11292 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11293 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11294
11295 static uint_t sfmmu_hblk_steal_twice;
11296 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11297
11298 /*
11299 * Steal a hmeblk from user or kernel hme hash lists.
11300 * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11301 * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11302 * tap into critical reserve of freehblkp.
11303 * Note: We remain looping in this routine until we find one.
11304 */
11305 static struct hme_blk *
11306 sfmmu_hblk_steal(int size)
11307 {
11308 static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11309 struct hmehash_bucket *hmebp;
11310 struct hme_blk *hmeblkp = NULL, *pr_hblk;
11311 uint64_t hblkpa;
11312 int i;
11313 uint_t loop_cnt = 0, critical;
11314
11315 for (;;) {
11316 /* Check cpu hblk pending queues */
11317 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11318 hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11319 ASSERT(hmeblkp->hblk_hmecnt == 0);
11320 ASSERT(hmeblkp->hblk_vcnt == 0);
11321 return (hmeblkp);
11322 }
11323
11324 if (size == TTE8K) {
11325 critical =
11326 (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11327 if (sfmmu_get_free_hblk(&hmeblkp, critical))
11328 return (hmeblkp);
11329 }
11330
11331 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11332 uhmehash_steal_hand;
11333 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11334
11335 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11336 BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11337 SFMMU_HASH_LOCK(hmebp);
11338 hmeblkp = hmebp->hmeblkp;
11339 hblkpa = hmebp->hmeh_nextpa;
11340 pr_hblk = NULL;
11341 while (hmeblkp) {
11342 /*
11343 * check if it is a hmeblk that is not locked
11344 * and not shared. skip shadow hmeblks with
11345 * shadow_mask set i.e valid count non zero.
11346 */
11347 if ((get_hblk_ttesz(hmeblkp) == size) &&
11348 (hmeblkp->hblk_shw_bit == 0 ||
11349 hmeblkp->hblk_vcnt == 0) &&
11350 (hmeblkp->hblk_lckcnt == 0)) {
11351 /*
11352 * there is a high probability that we
11353 * will find a free one. search some
11354 * buckets for a free hmeblk initially
11355 * before unloading a valid hmeblk.
11356 */
11357 if ((hmeblkp->hblk_vcnt == 0 &&
11358 hmeblkp->hblk_hmecnt == 0) || (i >=
11359 BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11360 if (sfmmu_steal_this_hblk(hmebp,
11361 hmeblkp, hblkpa, pr_hblk)) {
11362 /*
11363 * Hblk is unloaded
11364 * successfully
11365 */
11366 break;
11367 }
11368 }
11369 }
11370 pr_hblk = hmeblkp;
11371 hblkpa = hmeblkp->hblk_nextpa;
11372 hmeblkp = hmeblkp->hblk_next;
11373 }
11374
11375 SFMMU_HASH_UNLOCK(hmebp);
11376 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11377 hmebp = uhme_hash;
11378 }
11379 uhmehash_steal_hand = hmebp;
11380
11381 if (hmeblkp != NULL)
11382 break;
11383
11384 /*
11385 * in the worst case, look for a free one in the kernel
11386 * hash table.
11387 */
11388 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11389 SFMMU_HASH_LOCK(hmebp);
11390 hmeblkp = hmebp->hmeblkp;
11391 hblkpa = hmebp->hmeh_nextpa;
11392 pr_hblk = NULL;
11393 while (hmeblkp) {
11394 /*
11395 * check if it is free hmeblk
11396 */
11397 if ((get_hblk_ttesz(hmeblkp) == size) &&
11398 (hmeblkp->hblk_lckcnt == 0) &&
11399 (hmeblkp->hblk_vcnt == 0) &&
11400 (hmeblkp->hblk_hmecnt == 0)) {
11401 if (sfmmu_steal_this_hblk(hmebp,
11402 hmeblkp, hblkpa, pr_hblk)) {
11403 break;
11404 } else {
11405 /*
11406 * Cannot fail since we have
11407 * hash lock.
11408 */
11409 panic("fail to steal?");
11410 }
11411 }
11412
11413 pr_hblk = hmeblkp;
11414 hblkpa = hmeblkp->hblk_nextpa;
11415 hmeblkp = hmeblkp->hblk_next;
11416 }
11417
11418 SFMMU_HASH_UNLOCK(hmebp);
11419 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11420 hmebp = khme_hash;
11421 }
11422
11423 if (hmeblkp != NULL)
11424 break;
11425 sfmmu_hblk_steal_twice++;
11426 }
11427 return (hmeblkp);
11428 }
11429
11430 /*
11431 * This routine does real work to prepare a hblk to be "stolen" by
11432 * unloading the mappings, updating shadow counts ....
11433 * It returns 1 if the block is ready to be reused (stolen), or 0
11434 * means the block cannot be stolen yet- pageunload is still working
11435 * on this hblk.
11436 */
11437 static int
11438 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11439 uint64_t hblkpa, struct hme_blk *pr_hblk)
11440 {
11441 int shw_size, vshift;
11442 struct hme_blk *shw_hblkp;
11443 caddr_t vaddr;
11444 uint_t shw_mask, newshw_mask;
11445 struct hme_blk *list = NULL;
11446
11447 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11448
11449 /*
11450 * check if the hmeblk is free, unload if necessary
11451 */
11452 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11453 sfmmu_t *sfmmup;
11454 demap_range_t dmr;
11455
11456 sfmmup = hblktosfmmu(hmeblkp);
11457 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11458 return (0);
11459 }
11460 DEMAP_RANGE_INIT(sfmmup, &dmr);
11461 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11462 (caddr_t)get_hblk_base(hmeblkp),
11463 get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11464 DEMAP_RANGE_FLUSH(&dmr);
11465 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11466 /*
11467 * Pageunload is working on the same hblk.
11468 */
11469 return (0);
11470 }
11471
11472 sfmmu_hblk_steal_unload_count++;
11473 }
11474
11475 ASSERT(hmeblkp->hblk_lckcnt == 0);
11476 ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11477
11478 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11479 hmeblkp->hblk_nextpa = hblkpa;
11480
11481 shw_hblkp = hmeblkp->hblk_shadow;
11482 if (shw_hblkp) {
11483 ASSERT(!hmeblkp->hblk_shared);
11484 shw_size = get_hblk_ttesz(shw_hblkp);
11485 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11486 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11487 ASSERT(vshift < 8);
11488 /*
11489 * Atomically clear shadow mask bit
11490 */
11491 do {
11492 shw_mask = shw_hblkp->hblk_shw_mask;
11493 ASSERT(shw_mask & (1 << vshift));
11494 newshw_mask = shw_mask & ~(1 << vshift);
11495 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11496 shw_mask, newshw_mask);
11497 } while (newshw_mask != shw_mask);
11498 hmeblkp->hblk_shadow = NULL;
11499 }
11500
11501 /*
11502 * remove shadow bit if we are stealing an unused shadow hmeblk.
11503 * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11504 * we are indeed allocating a shadow hmeblk.
11505 */
11506 hmeblkp->hblk_shw_bit = 0;
11507
11508 if (hmeblkp->hblk_shared) {
11509 sf_srd_t *srdp;
11510 sf_region_t *rgnp;
11511 uint_t rid;
11512
11513 srdp = hblktosrd(hmeblkp);
11514 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11515 rid = hmeblkp->hblk_tag.htag_rid;
11516 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11517 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11518 rgnp = srdp->srd_hmergnp[rid];
11519 ASSERT(rgnp != NULL);
11520 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11521 hmeblkp->hblk_shared = 0;
11522 }
11523
11524 sfmmu_hblk_steal_count++;
11525 SFMMU_STAT(sf_steal_count);
11526
11527 return (1);
11528 }
11529
11530 struct hme_blk *
11531 sfmmu_hmetohblk(struct sf_hment *sfhme)
11532 {
11533 struct hme_blk *hmeblkp;
11534 struct sf_hment *sfhme0;
11535 struct hme_blk *hblk_dummy = 0;
11536
11537 /*
11538 * No dummy sf_hments, please.
11539 */
11540 ASSERT(sfhme->hme_tte.ll != 0);
11541
11542 sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11543 hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11544 (uintptr_t)&hblk_dummy->hblk_hme[0]);
11545
11546 return (hmeblkp);
11547 }
11548
11549 /*
11550 * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11551 * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11552 * KM_SLEEP allocation.
11553 *
11554 * Return 0 on success, -1 otherwise.
11555 */
11556 static void
11557 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11558 {
11559 struct tsb_info *tsbinfop, *next;
11560 tsb_replace_rc_t rc;
11561 boolean_t gotfirst = B_FALSE;
11562
11563 ASSERT(sfmmup != ksfmmup);
11564 ASSERT(sfmmu_hat_lock_held(sfmmup));
11565
11566 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11567 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11568 }
11569
11570 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11571 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11572 } else {
11573 return;
11574 }
11575
11576 ASSERT(sfmmup->sfmmu_tsb != NULL);
11577
11578 /*
11579 * Loop over all tsbinfo's replacing them with ones that actually have
11580 * a TSB. If any of the replacements ever fail, bail out of the loop.
11581 */
11582 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11583 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11584 next = tsbinfop->tsb_next;
11585 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11586 hatlockp, TSB_SWAPIN);
11587 if (rc != TSB_SUCCESS) {
11588 break;
11589 }
11590 gotfirst = B_TRUE;
11591 }
11592
11593 switch (rc) {
11594 case TSB_SUCCESS:
11595 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11596 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11597 return;
11598 case TSB_LOSTRACE:
11599 break;
11600 case TSB_ALLOCFAIL:
11601 break;
11602 default:
11603 panic("sfmmu_replace_tsb returned unrecognized failure code "
11604 "%d", rc);
11605 }
11606
11607 /*
11608 * In this case, we failed to get one of our TSBs. If we failed to
11609 * get the first TSB, get one of minimum size (8KB). Walk the list
11610 * and throw away the tsbinfos, starting where the allocation failed;
11611 * we can get by with just one TSB as long as we don't leave the
11612 * SWAPPED tsbinfo structures lying around.
11613 */
11614 tsbinfop = sfmmup->sfmmu_tsb;
11615 next = tsbinfop->tsb_next;
11616 tsbinfop->tsb_next = NULL;
11617
11618 sfmmu_hat_exit(hatlockp);
11619 for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11620 next = tsbinfop->tsb_next;
11621 sfmmu_tsbinfo_free(tsbinfop);
11622 }
11623 hatlockp = sfmmu_hat_enter(sfmmup);
11624
11625 /*
11626 * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11627 * pages.
11628 */
11629 if (!gotfirst) {
11630 tsbinfop = sfmmup->sfmmu_tsb;
11631 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11632 hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11633 ASSERT(rc == TSB_SUCCESS);
11634 }
11635
11636 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11637 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11638 }
11639
11640 static int
11641 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11642 {
11643 ulong_t bix = 0;
11644 uint_t rid;
11645 sf_region_t *rgnp;
11646
11647 ASSERT(srdp != NULL);
11648 ASSERT(srdp->srd_refcnt != 0);
11649
11650 w <<= BT_ULSHIFT;
11651 while (bmw) {
11652 if (!(bmw & 0x1)) {
11653 bix++;
11654 bmw >>= 1;
11655 continue;
11656 }
11657 rid = w | bix;
11658 rgnp = srdp->srd_hmergnp[rid];
11659 ASSERT(rgnp->rgn_refcnt > 0);
11660 ASSERT(rgnp->rgn_id == rid);
11661 if (addr < rgnp->rgn_saddr ||
11662 addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11663 bix++;
11664 bmw >>= 1;
11665 } else {
11666 return (1);
11667 }
11668 }
11669 return (0);
11670 }
11671
11672 /*
11673 * Handle exceptions for low level tsb_handler.
11674 *
11675 * There are many scenarios that could land us here:
11676 *
11677 * If the context is invalid we land here. The context can be invalid
11678 * for 3 reasons: 1) we couldn't allocate a new context and now need to
11679 * perform a wrap around operation in order to allocate a new context.
11680 * 2) Context was invalidated to change pagesize programming 3) ISMs or
11681 * TSBs configuration is changeing for this process and we are forced into
11682 * here to do a syncronization operation. If the context is valid we can
11683 * be here from window trap hanlder. In this case just call trap to handle
11684 * the fault.
11685 *
11686 * Note that the process will run in INVALID_CONTEXT before
11687 * faulting into here and subsequently loading the MMU registers
11688 * (including the TSB base register) associated with this process.
11689 * For this reason, the trap handlers must all test for
11690 * INVALID_CONTEXT before attempting to access any registers other
11691 * than the context registers.
11692 */
11693 void
11694 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11695 {
11696 sfmmu_t *sfmmup, *shsfmmup;
11697 uint_t ctxtype;
11698 klwp_id_t lwp;
11699 char lwp_save_state;
11700 hatlock_t *hatlockp, *shatlockp;
11701 struct tsb_info *tsbinfop;
11702 struct tsbmiss *tsbmp;
11703 sf_scd_t *scdp;
11704
11705 SFMMU_STAT(sf_tsb_exceptions);
11706 SFMMU_MMU_STAT(mmu_tsb_exceptions);
11707 sfmmup = astosfmmu(curthread->t_procp->p_as);
11708 /*
11709 * note that in sun4u, tagacces register contains ctxnum
11710 * while sun4v passes ctxtype in the tagaccess register.
11711 */
11712 ctxtype = tagaccess & TAGACC_CTX_MASK;
11713
11714 ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11715 ASSERT(sfmmup->sfmmu_ismhat == 0);
11716 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11717 ctxtype == INVALID_CONTEXT);
11718
11719 if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11720 /*
11721 * We may land here because shme bitmap and pagesize
11722 * flags are updated lazily in tsbmiss area on other cpus.
11723 * If we detect here that tsbmiss area is out of sync with
11724 * sfmmu update it and retry the trapped instruction.
11725 * Otherwise call trap().
11726 */
11727 int ret = 0;
11728 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11729 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11730
11731 /*
11732 * Must set lwp state to LWP_SYS before
11733 * trying to acquire any adaptive lock
11734 */
11735 lwp = ttolwp(curthread);
11736 ASSERT(lwp);
11737 lwp_save_state = lwp->lwp_state;
11738 lwp->lwp_state = LWP_SYS;
11739
11740 hatlockp = sfmmu_hat_enter(sfmmup);
11741 kpreempt_disable();
11742 tsbmp = &tsbmiss_area[CPU->cpu_id];
11743 ASSERT(sfmmup == tsbmp->usfmmup);
11744 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11745 ~tteflag_mask) ||
11746 ((tsbmp->uhat_rtteflags ^ sfmmup->sfmmu_rtteflags) &
11747 ~tteflag_mask)) {
11748 tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11749 tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11750 ret = 1;
11751 }
11752 if (sfmmup->sfmmu_srdp != NULL) {
11753 ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11754 ulong_t *tm = tsbmp->shmermap;
11755 ulong_t i;
11756 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11757 ulong_t d = tm[i] ^ sm[i];
11758 if (d) {
11759 if (d & sm[i]) {
11760 if (!ret && sfmmu_is_rgnva(
11761 sfmmup->sfmmu_srdp,
11762 addr, i, d & sm[i])) {
11763 ret = 1;
11764 }
11765 }
11766 tm[i] = sm[i];
11767 }
11768 }
11769 }
11770 kpreempt_enable();
11771 sfmmu_hat_exit(hatlockp);
11772 lwp->lwp_state = lwp_save_state;
11773 if (ret) {
11774 return;
11775 }
11776 } else if (ctxtype == INVALID_CONTEXT) {
11777 /*
11778 * First, make sure we come out of here with a valid ctx,
11779 * since if we don't get one we'll simply loop on the
11780 * faulting instruction.
11781 *
11782 * If the ISM mappings are changing, the TSB is relocated,
11783 * the process is swapped, the process is joining SCD or
11784 * leaving SCD or shared regions we serialize behind the
11785 * controlling thread with hat lock, sfmmu_flags and
11786 * sfmmu_tsb_cv condition variable.
11787 */
11788
11789 /*
11790 * Must set lwp state to LWP_SYS before
11791 * trying to acquire any adaptive lock
11792 */
11793 lwp = ttolwp(curthread);
11794 ASSERT(lwp);
11795 lwp_save_state = lwp->lwp_state;
11796 lwp->lwp_state = LWP_SYS;
11797
11798 hatlockp = sfmmu_hat_enter(sfmmup);
11799 retry:
11800 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11801 shsfmmup = scdp->scd_sfmmup;
11802 ASSERT(shsfmmup != NULL);
11803
11804 for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11805 tsbinfop = tsbinfop->tsb_next) {
11806 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11807 /* drop the private hat lock */
11808 sfmmu_hat_exit(hatlockp);
11809 /* acquire the shared hat lock */
11810 shatlockp = sfmmu_hat_enter(shsfmmup);
11811 /*
11812 * recheck to see if anything changed
11813 * after we drop the private hat lock.
11814 */
11815 if (sfmmup->sfmmu_scdp == scdp &&
11816 shsfmmup == scdp->scd_sfmmup) {
11817 sfmmu_tsb_chk_reloc(shsfmmup,
11818 shatlockp);
11819 }
11820 sfmmu_hat_exit(shatlockp);
11821 hatlockp = sfmmu_hat_enter(sfmmup);
11822 goto retry;
11823 }
11824 }
11825 }
11826
11827 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
11828 tsbinfop = tsbinfop->tsb_next) {
11829 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11830 cv_wait(&sfmmup->sfmmu_tsb_cv,
11831 HATLOCK_MUTEXP(hatlockp));
11832 goto retry;
11833 }
11834 }
11835
11836 /*
11837 * Wait for ISM maps to be updated.
11838 */
11839 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11840 cv_wait(&sfmmup->sfmmu_tsb_cv,
11841 HATLOCK_MUTEXP(hatlockp));
11842 goto retry;
11843 }
11844
11845 /* Is this process joining an SCD? */
11846 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11847 /*
11848 * Flush private TSB and setup shared TSB.
11849 * sfmmu_finish_join_scd() does not drop the
11850 * hat lock.
11851 */
11852 sfmmu_finish_join_scd(sfmmup);
11853 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
11854 }
11855
11856 /*
11857 * If we're swapping in, get TSB(s). Note that we must do
11858 * this before we get a ctx or load the MMU state. Once
11859 * we swap in we have to recheck to make sure the TSB(s) and
11860 * ISM mappings didn't change while we slept.
11861 */
11862 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11863 sfmmu_tsb_swapin(sfmmup, hatlockp);
11864 goto retry;
11865 }
11866
11867 sfmmu_get_ctx(sfmmup);
11868
11869 sfmmu_hat_exit(hatlockp);
11870 /*
11871 * Must restore lwp_state if not calling
11872 * trap() for further processing. Restore
11873 * it anyway.
11874 */
11875 lwp->lwp_state = lwp_save_state;
11876 return;
11877 }
11878 trap(rp, (caddr_t)tagaccess, traptype, 0);
11879 }
11880
11881 static void
11882 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11883 {
11884 struct tsb_info *tp;
11885
11886 ASSERT(sfmmu_hat_lock_held(sfmmup));
11887
11888 for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
11889 if (tp->tsb_flags & TSB_RELOC_FLAG) {
11890 cv_wait(&sfmmup->sfmmu_tsb_cv,
11891 HATLOCK_MUTEXP(hatlockp));
11892 break;
11893 }
11894 }
11895 }
11896
11897 /*
11898 * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
11899 * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
11900 * rather than spinning to avoid send mondo timeouts with
11901 * interrupts enabled. When the lock is acquired it is immediately
11902 * released and we return back to sfmmu_vatopfn just after
11903 * the GET_TTE call.
11904 */
11905 void
11906 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
11907 {
11908 struct page **pp;
11909
11910 (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11911 as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11912 }
11913
11914 /*
11915 * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
11916 * TTE_SUSPENDED bit set in tte. We do this so that we can handle
11917 * cross traps which cannot be handled while spinning in the
11918 * trap handlers. Simply enter and exit the kpr_suspendlock spin
11919 * mutex, which is held by the holder of the suspend bit, and then
11920 * retry the trapped instruction after unwinding.
11921 */
11922 /*ARGSUSED*/
11923 void
11924 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
11925 {
11926 ASSERT(curthread != kreloc_thread);
11927 mutex_enter(&kpr_suspendlock);
11928 mutex_exit(&kpr_suspendlock);
11929 }
11930
11931 /*
11932 * This routine could be optimized to reduce the number of xcalls by flushing
11933 * the entire TLBs if region reference count is above some threshold but the
11934 * tradeoff will depend on the size of the TLB. So for now flush the specific
11935 * page a context at a time.
11936 *
11937 * If uselocks is 0 then it's called after all cpus were captured and all the
11938 * hat locks were taken. In this case don't take the region lock by relying on
11939 * the order of list region update operations in hat_join_region(),
11940 * hat_leave_region() and hat_dup_region(). The ordering in those routines
11941 * guarantees that list is always forward walkable and reaches active sfmmus
11942 * regardless of where xc_attention() captures a cpu.
11943 */
11944 cpuset_t
11945 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
11946 struct hme_blk *hmeblkp, int uselocks)
11947 {
11948 sfmmu_t *sfmmup;
11949 cpuset_t cpuset;
11950 cpuset_t rcpuset;
11951 hatlock_t *hatlockp;
11952 uint_t rid = rgnp->rgn_id;
11953 sf_rgn_link_t *rlink;
11954 sf_scd_t *scdp;
11955
11956 ASSERT(hmeblkp->hblk_shared);
11957 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11958 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11959
11960 CPUSET_ZERO(rcpuset);
11961 if (uselocks) {
11962 mutex_enter(&rgnp->rgn_mutex);
11963 }
11964 sfmmup = rgnp->rgn_sfmmu_head;
11965 while (sfmmup != NULL) {
11966 if (uselocks) {
11967 hatlockp = sfmmu_hat_enter(sfmmup);
11968 }
11969
11970 /*
11971 * When an SCD is created the SCD hat is linked on the sfmmu
11972 * region lists for each hme region which is part of the
11973 * SCD. If we find an SCD hat, when walking these lists,
11974 * then we flush the shared TSBs, if we find a private hat,
11975 * which is part of an SCD, but where the region
11976 * is not part of the SCD then we flush the private TSBs.
11977 */
11978 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11979 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11980 scdp = sfmmup->sfmmu_scdp;
11981 if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
11982 if (uselocks) {
11983 sfmmu_hat_exit(hatlockp);
11984 }
11985 goto next;
11986 }
11987 }
11988
11989 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
11990
11991 kpreempt_disable();
11992 cpuset = sfmmup->sfmmu_cpusran;
11993 CPUSET_AND(cpuset, cpu_ready_set);
11994 CPUSET_DEL(cpuset, CPU->cpu_id);
11995 SFMMU_XCALL_STATS(sfmmup);
11996 xt_some(cpuset, vtag_flushpage_tl1,
11997 (uint64_t)addr, (uint64_t)sfmmup);
11998 vtag_flushpage(addr, (uint64_t)sfmmup);
11999 if (uselocks) {
12000 sfmmu_hat_exit(hatlockp);
12001 }
12002 kpreempt_enable();
12003 CPUSET_OR(rcpuset, cpuset);
12004
12005 next:
12006 /* LINTED: constant in conditional context */
12007 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
12008 ASSERT(rlink != NULL);
12009 sfmmup = rlink->next;
12010 }
12011 if (uselocks) {
12012 mutex_exit(&rgnp->rgn_mutex);
12013 }
12014 return (rcpuset);
12015 }
12016
12017 /*
12018 * This routine takes an sfmmu pointer and the va for an adddress in an
12019 * ISM region as input and returns the corresponding region id in ism_rid.
12020 * The return value of 1 indicates that a region has been found and ism_rid
12021 * is valid, otherwise 0 is returned.
12022 */
12023 static int
12024 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12025 {
12026 ism_blk_t *ism_blkp;
12027 int i;
12028 ism_map_t *ism_map;
12029 #ifdef DEBUG
12030 struct hat *ism_hatid;
12031 #endif
12032 ASSERT(sfmmu_hat_lock_held(sfmmup));
12033
12034 ism_blkp = sfmmup->sfmmu_iblk;
12035 while (ism_blkp != NULL) {
12036 ism_map = ism_blkp->iblk_maps;
12037 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12038 if ((va >= ism_start(ism_map[i])) &&
12039 (va < ism_end(ism_map[i]))) {
12040
12041 *ism_rid = ism_map[i].imap_rid;
12042 #ifdef DEBUG
12043 ism_hatid = ism_map[i].imap_ismhat;
12044 ASSERT(ism_hatid == ism_sfmmup);
12045 ASSERT(ism_hatid->sfmmu_ismhat);
12046 #endif
12047 return (1);
12048 }
12049 }
12050 ism_blkp = ism_blkp->iblk_next;
12051 }
12052 return (0);
12053 }
12054
12055 /*
12056 * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12057 * This routine may be called with all cpu's captured. Therefore, the
12058 * caller is responsible for holding all locks and disabling kernel
12059 * preemption.
12060 */
12061 /* ARGSUSED */
12062 static void
12063 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12064 struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12065 {
12066 cpuset_t cpuset;
12067 caddr_t va;
12068 ism_ment_t *ment;
12069 sfmmu_t *sfmmup;
12070 #ifdef VAC
12071 int vcolor;
12072 #endif
12073
12074 sf_scd_t *scdp;
12075 uint_t ism_rid;
12076
12077 ASSERT(!hmeblkp->hblk_shared);
12078 /*
12079 * Walk the ism_hat's mapping list and flush the page
12080 * from every hat sharing this ism_hat. This routine
12081 * may be called while all cpu's have been captured.
12082 * Therefore we can't attempt to grab any locks. For now
12083 * this means we will protect the ism mapping list under
12084 * a single lock which will be grabbed by the caller.
12085 * If hat_share/unshare scalibility becomes a performance
12086 * problem then we may need to re-think ism mapping list locking.
12087 */
12088 ASSERT(ism_sfmmup->sfmmu_ismhat);
12089 ASSERT(MUTEX_HELD(&ism_mlist_lock));
12090 addr = addr - ISMID_STARTADDR;
12091
12092 for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12093
12094 sfmmup = ment->iment_hat;
12095
12096 va = ment->iment_base_va;
12097 va = (caddr_t)((uintptr_t)va + (uintptr_t)addr);
12098
12099 /*
12100 * When an SCD is created the SCD hat is linked on the ism
12101 * mapping lists for each ISM segment which is part of the
12102 * SCD. If we find an SCD hat, when walking these lists,
12103 * then we flush the shared TSBs, if we find a private hat,
12104 * which is part of an SCD, but where the region
12105 * corresponding to this va is not part of the SCD then we
12106 * flush the private TSBs.
12107 */
12108 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12109 !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12110 !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12111 if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12112 &ism_rid)) {
12113 cmn_err(CE_PANIC,
12114 "can't find matching ISM rid!");
12115 }
12116
12117 scdp = sfmmup->sfmmu_scdp;
12118 if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12119 SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12120 ism_rid)) {
12121 continue;
12122 }
12123 }
12124 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12125
12126 cpuset = sfmmup->sfmmu_cpusran;
12127 CPUSET_AND(cpuset, cpu_ready_set);
12128 CPUSET_DEL(cpuset, CPU->cpu_id);
12129 SFMMU_XCALL_STATS(sfmmup);
12130 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12131 (uint64_t)sfmmup);
12132 vtag_flushpage(va, (uint64_t)sfmmup);
12133
12134 #ifdef VAC
12135 /*
12136 * Flush D$
12137 * When flushing D$ we must flush all
12138 * cpu's. See sfmmu_cache_flush().
12139 */
12140 if (cache_flush_flag == CACHE_FLUSH) {
12141 cpuset = cpu_ready_set;
12142 CPUSET_DEL(cpuset, CPU->cpu_id);
12143
12144 SFMMU_XCALL_STATS(sfmmup);
12145 vcolor = addr_to_vcolor(va);
12146 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12147 vac_flushpage(pfnum, vcolor);
12148 }
12149 #endif /* VAC */
12150 }
12151 }
12152
12153 /*
12154 * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12155 * a particular virtual address and ctx. If noflush is set we do not
12156 * flush the TLB/TSB. This function may or may not be called with the
12157 * HAT lock held.
12158 */
12159 static void
12160 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12161 pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12162 int hat_lock_held)
12163 {
12164 #ifdef VAC
12165 int vcolor;
12166 #endif
12167 cpuset_t cpuset;
12168 hatlock_t *hatlockp;
12169
12170 ASSERT(!hmeblkp->hblk_shared);
12171
12172 #if defined(lint) && !defined(VAC)
12173 pfnum = pfnum;
12174 cpu_flag = cpu_flag;
12175 cache_flush_flag = cache_flush_flag;
12176 #endif
12177
12178 /*
12179 * There is no longer a need to protect against ctx being
12180 * stolen here since we don't store the ctx in the TSB anymore.
12181 */
12182 #ifdef VAC
12183 vcolor = addr_to_vcolor(addr);
12184 #endif
12185
12186 /*
12187 * We must hold the hat lock during the flush of TLB,
12188 * to avoid a race with sfmmu_invalidate_ctx(), where
12189 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12190 * causing TLB demap routine to skip flush on that MMU.
12191 * If the context on a MMU has already been set to
12192 * INVALID_CONTEXT, we just get an extra flush on
12193 * that MMU.
12194 */
12195 if (!hat_lock_held && !tlb_noflush)
12196 hatlockp = sfmmu_hat_enter(sfmmup);
12197
12198 kpreempt_disable();
12199 if (!tlb_noflush) {
12200 /*
12201 * Flush the TSB and TLB.
12202 */
12203 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12204
12205 cpuset = sfmmup->sfmmu_cpusran;
12206 CPUSET_AND(cpuset, cpu_ready_set);
12207 CPUSET_DEL(cpuset, CPU->cpu_id);
12208
12209 SFMMU_XCALL_STATS(sfmmup);
12210
12211 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12212 (uint64_t)sfmmup);
12213
12214 vtag_flushpage(addr, (uint64_t)sfmmup);
12215 }
12216
12217 if (!hat_lock_held && !tlb_noflush)
12218 sfmmu_hat_exit(hatlockp);
12219
12220 #ifdef VAC
12221 /*
12222 * Flush the D$
12223 *
12224 * Even if the ctx is stolen, we need to flush the
12225 * cache. Our ctx stealer only flushes the TLBs.
12226 */
12227 if (cache_flush_flag == CACHE_FLUSH) {
12228 if (cpu_flag & FLUSH_ALL_CPUS) {
12229 cpuset = cpu_ready_set;
12230 } else {
12231 cpuset = sfmmup->sfmmu_cpusran;
12232 CPUSET_AND(cpuset, cpu_ready_set);
12233 }
12234 CPUSET_DEL(cpuset, CPU->cpu_id);
12235 SFMMU_XCALL_STATS(sfmmup);
12236 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12237 vac_flushpage(pfnum, vcolor);
12238 }
12239 #endif /* VAC */
12240 kpreempt_enable();
12241 }
12242
12243 /*
12244 * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12245 * address and ctx. If noflush is set we do not currently do anything.
12246 * This function may or may not be called with the HAT lock held.
12247 */
12248 static void
12249 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12250 int tlb_noflush, int hat_lock_held)
12251 {
12252 cpuset_t cpuset;
12253 hatlock_t *hatlockp;
12254
12255 ASSERT(!hmeblkp->hblk_shared);
12256
12257 /*
12258 * If the process is exiting we have nothing to do.
12259 */
12260 if (tlb_noflush)
12261 return;
12262
12263 /*
12264 * Flush TSB.
12265 */
12266 if (!hat_lock_held)
12267 hatlockp = sfmmu_hat_enter(sfmmup);
12268 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12269
12270 kpreempt_disable();
12271
12272 cpuset = sfmmup->sfmmu_cpusran;
12273 CPUSET_AND(cpuset, cpu_ready_set);
12274 CPUSET_DEL(cpuset, CPU->cpu_id);
12275
12276 SFMMU_XCALL_STATS(sfmmup);
12277 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12278
12279 vtag_flushpage(addr, (uint64_t)sfmmup);
12280
12281 if (!hat_lock_held)
12282 sfmmu_hat_exit(hatlockp);
12283
12284 kpreempt_enable();
12285
12286 }
12287
12288 /*
12289 * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12290 * call handler that can flush a range of pages to save on xcalls.
12291 */
12292 static int sfmmu_xcall_save;
12293
12294 /*
12295 * this routine is never used for demaping addresses backed by SRD hmeblks.
12296 */
12297 static void
12298 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12299 {
12300 sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12301 hatlock_t *hatlockp;
12302 cpuset_t cpuset;
12303 uint64_t sfmmu_pgcnt;
12304 pgcnt_t pgcnt = 0;
12305 int pgunload = 0;
12306 int dirtypg = 0;
12307 caddr_t addr = dmrp->dmr_addr;
12308 caddr_t eaddr;
12309 uint64_t bitvec = dmrp->dmr_bitvec;
12310
12311 ASSERT(bitvec & 1);
12312
12313 /*
12314 * Flush TSB and calculate number of pages to flush.
12315 */
12316 while (bitvec != 0) {
12317 dirtypg = 0;
12318 /*
12319 * Find the first page to flush and then count how many
12320 * pages there are after it that also need to be flushed.
12321 * This way the number of TSB flushes is minimized.
12322 */
12323 while ((bitvec & 1) == 0) {
12324 pgcnt++;
12325 addr += MMU_PAGESIZE;
12326 bitvec >>= 1;
12327 }
12328 while (bitvec & 1) {
12329 dirtypg++;
12330 bitvec >>= 1;
12331 }
12332 eaddr = addr + ptob(dirtypg);
12333 hatlockp = sfmmu_hat_enter(sfmmup);
12334 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12335 sfmmu_hat_exit(hatlockp);
12336 pgunload += dirtypg;
12337 addr = eaddr;
12338 pgcnt += dirtypg;
12339 }
12340
12341 ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12342 if (sfmmup->sfmmu_free == 0) {
12343 addr = dmrp->dmr_addr;
12344 bitvec = dmrp->dmr_bitvec;
12345
12346 /*
12347 * make sure it has SFMMU_PGCNT_SHIFT bits only,
12348 * as it will be used to pack argument for xt_some
12349 */
12350 ASSERT((pgcnt > 0) &&
12351 (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12352
12353 /*
12354 * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12355 * the low 6 bits of sfmmup. This is doable since pgcnt
12356 * always >= 1.
12357 */
12358 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12359 sfmmu_pgcnt = (uint64_t)sfmmup |
12360 ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12361
12362 /*
12363 * We must hold the hat lock during the flush of TLB,
12364 * to avoid a race with sfmmu_invalidate_ctx(), where
12365 * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12366 * causing TLB demap routine to skip flush on that MMU.
12367 * If the context on a MMU has already been set to
12368 * INVALID_CONTEXT, we just get an extra flush on
12369 * that MMU.
12370 */
12371 hatlockp = sfmmu_hat_enter(sfmmup);
12372 kpreempt_disable();
12373
12374 cpuset = sfmmup->sfmmu_cpusran;
12375 CPUSET_AND(cpuset, cpu_ready_set);
12376 CPUSET_DEL(cpuset, CPU->cpu_id);
12377
12378 SFMMU_XCALL_STATS(sfmmup);
12379 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12380 sfmmu_pgcnt);
12381
12382 for (; bitvec != 0; bitvec >>= 1) {
12383 if (bitvec & 1)
12384 vtag_flushpage(addr, (uint64_t)sfmmup);
12385 addr += MMU_PAGESIZE;
12386 }
12387 kpreempt_enable();
12388 sfmmu_hat_exit(hatlockp);
12389
12390 sfmmu_xcall_save += (pgunload-1);
12391 }
12392 dmrp->dmr_bitvec = 0;
12393 }
12394
12395 /*
12396 * In cases where we need to synchronize with TLB/TSB miss trap
12397 * handlers, _and_ need to flush the TLB, it's a lot easier to
12398 * throw away the context from the process than to do a
12399 * special song and dance to keep things consistent for the
12400 * handlers.
12401 *
12402 * Since the process suddenly ends up without a context and our caller
12403 * holds the hat lock, threads that fault after this function is called
12404 * will pile up on the lock. We can then do whatever we need to
12405 * atomically from the context of the caller. The first blocked thread
12406 * to resume executing will get the process a new context, and the
12407 * process will resume executing.
12408 *
12409 * One added advantage of this approach is that on MMUs that
12410 * support a "flush all" operation, we will delay the flush until
12411 * cnum wrap-around, and then flush the TLB one time. This
12412 * is rather rare, so it's a lot less expensive than making 8000
12413 * x-calls to flush the TLB 8000 times.
12414 *
12415 * A per-process (PP) lock is used to synchronize ctx allocations in
12416 * resume() and ctx invalidations here.
12417 */
12418 static void
12419 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12420 {
12421 cpuset_t cpuset;
12422 int cnum, currcnum;
12423 mmu_ctx_t *mmu_ctxp;
12424 int i;
12425 uint_t pstate_save;
12426
12427 SFMMU_STAT(sf_ctx_inv);
12428
12429 ASSERT(sfmmu_hat_lock_held(sfmmup));
12430 ASSERT(sfmmup != ksfmmup);
12431
12432 kpreempt_disable();
12433
12434 mmu_ctxp = CPU_MMU_CTXP(CPU);
12435 ASSERT(mmu_ctxp);
12436 ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12437 ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12438
12439 currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12440
12441 pstate_save = sfmmu_disable_intrs();
12442
12443 lock_set(&sfmmup->sfmmu_ctx_lock); /* acquire PP lock */
12444 /* set HAT cnum invalid across all context domains. */
12445 for (i = 0; i < max_mmu_ctxdoms; i++) {
12446
12447 cnum = sfmmup->sfmmu_ctxs[i].cnum;
12448 if (cnum == INVALID_CONTEXT) {
12449 continue;
12450 }
12451
12452 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12453 }
12454 membar_enter(); /* make sure globally visible to all CPUs */
12455 lock_clear(&sfmmup->sfmmu_ctx_lock); /* release PP lock */
12456
12457 sfmmu_enable_intrs(pstate_save);
12458
12459 cpuset = sfmmup->sfmmu_cpusran;
12460 CPUSET_DEL(cpuset, CPU->cpu_id);
12461 CPUSET_AND(cpuset, cpu_ready_set);
12462 if (!CPUSET_ISNULL(cpuset)) {
12463 SFMMU_XCALL_STATS(sfmmup);
12464 xt_some(cpuset, sfmmu_raise_tsb_exception,
12465 (uint64_t)sfmmup, INVALID_CONTEXT);
12466 xt_sync(cpuset);
12467 SFMMU_STAT(sf_tsb_raise_exception);
12468 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12469 }
12470
12471 /*
12472 * If the hat to-be-invalidated is the same as the current
12473 * process on local CPU we need to invalidate
12474 * this CPU context as well.
12475 */
12476 if ((sfmmu_getctx_sec() == currcnum) &&
12477 (currcnum != INVALID_CONTEXT)) {
12478 /* sets shared context to INVALID too */
12479 sfmmu_setctx_sec(INVALID_CONTEXT);
12480 sfmmu_clear_utsbinfo();
12481 }
12482
12483 SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12484
12485 kpreempt_enable();
12486
12487 /*
12488 * we hold the hat lock, so nobody should allocate a context
12489 * for us yet
12490 */
12491 ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12492 }
12493
12494 #ifdef VAC
12495 /*
12496 * We need to flush the cache in all cpus. It is possible that
12497 * a process referenced a page as cacheable but has sinced exited
12498 * and cleared the mapping list. We still to flush it but have no
12499 * state so all cpus is the only alternative.
12500 */
12501 void
12502 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12503 {
12504 cpuset_t cpuset;
12505
12506 kpreempt_disable();
12507 cpuset = cpu_ready_set;
12508 CPUSET_DEL(cpuset, CPU->cpu_id);
12509 SFMMU_XCALL_STATS(NULL); /* account to any ctx */
12510 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12511 xt_sync(cpuset);
12512 vac_flushpage(pfnum, vcolor);
12513 kpreempt_enable();
12514 }
12515
12516 void
12517 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12518 {
12519 cpuset_t cpuset;
12520
12521 ASSERT(vcolor >= 0);
12522
12523 kpreempt_disable();
12524 cpuset = cpu_ready_set;
12525 CPUSET_DEL(cpuset, CPU->cpu_id);
12526 SFMMU_XCALL_STATS(NULL); /* account to any ctx */
12527 xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12528 xt_sync(cpuset);
12529 vac_flushcolor(vcolor, pfnum);
12530 kpreempt_enable();
12531 }
12532 #endif /* VAC */
12533
12534 /*
12535 * We need to prevent processes from accessing the TSB using a cached physical
12536 * address. It's alright if they try to access the TSB via virtual address
12537 * since they will just fault on that virtual address once the mapping has
12538 * been suspended.
12539 */
12540 #pragma weak sendmondo_in_recover
12541
12542 /* ARGSUSED */
12543 static int
12544 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12545 {
12546 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12547 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12548 hatlock_t *hatlockp;
12549 sf_scd_t *scdp;
12550
12551 if (flags != HAT_PRESUSPEND)
12552 return (0);
12553
12554 /*
12555 * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12556 * be a shared hat, then set SCD's tsbinfo's flag.
12557 * If tsb is not shared, sfmmup is a private hat, then set
12558 * its private tsbinfo's flag.
12559 */
12560 hatlockp = sfmmu_hat_enter(sfmmup);
12561 tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12562
12563 if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12564 sfmmu_tsb_inv_ctx(sfmmup);
12565 sfmmu_hat_exit(hatlockp);
12566 } else {
12567 /* release lock on the shared hat */
12568 sfmmu_hat_exit(hatlockp);
12569 /* sfmmup is a shared hat */
12570 ASSERT(sfmmup->sfmmu_scdhat);
12571 scdp = sfmmup->sfmmu_scdp;
12572 ASSERT(scdp != NULL);
12573 /* get private hat from the scd list */
12574 mutex_enter(&scdp->scd_mutex);
12575 sfmmup = scdp->scd_sf_list;
12576 while (sfmmup != NULL) {
12577 hatlockp = sfmmu_hat_enter(sfmmup);
12578 /*
12579 * We do not call sfmmu_tsb_inv_ctx here because
12580 * sendmondo_in_recover check is only needed for
12581 * sun4u.
12582 */
12583 sfmmu_invalidate_ctx(sfmmup);
12584 sfmmu_hat_exit(hatlockp);
12585 sfmmup = sfmmup->sfmmu_scd_link.next;
12586
12587 }
12588 mutex_exit(&scdp->scd_mutex);
12589 }
12590 return (0);
12591 }
12592
12593 static void
12594 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12595 {
12596 extern uint32_t sendmondo_in_recover;
12597
12598 ASSERT(sfmmu_hat_lock_held(sfmmup));
12599
12600 /*
12601 * For Cheetah+ Erratum 25:
12602 * Wait for any active recovery to finish. We can't risk
12603 * relocating the TSB of the thread running mondo_recover_proc()
12604 * since, if we did that, we would deadlock. The scenario we are
12605 * trying to avoid is as follows:
12606 *
12607 * THIS CPU RECOVER CPU
12608 * -------- -----------
12609 * Begins recovery, walking through TSB
12610 * hat_pagesuspend() TSB TTE
12611 * TLB miss on TSB TTE, spins at TL1
12612 * xt_sync()
12613 * send_mondo_timeout()
12614 * mondo_recover_proc()
12615 * ((deadlocked))
12616 *
12617 * The second half of the workaround is that mondo_recover_proc()
12618 * checks to see if the tsb_info has the RELOC flag set, and if it
12619 * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12620 * and hence avoiding the TLB miss that could result in a deadlock.
12621 */
12622 if (&sendmondo_in_recover) {
12623 membar_enter(); /* make sure RELOC flag visible */
12624 while (sendmondo_in_recover) {
12625 drv_usecwait(1);
12626 membar_consumer();
12627 }
12628 }
12629
12630 sfmmu_invalidate_ctx(sfmmup);
12631 }
12632
12633 /* ARGSUSED */
12634 static int
12635 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12636 void *tsbinfo, pfn_t newpfn)
12637 {
12638 hatlock_t *hatlockp;
12639 struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12640 sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12641
12642 if (flags != HAT_POSTUNSUSPEND)
12643 return (0);
12644
12645 hatlockp = sfmmu_hat_enter(sfmmup);
12646
12647 SFMMU_STAT(sf_tsb_reloc);
12648
12649 /*
12650 * The process may have swapped out while we were relocating one
12651 * of its TSBs. If so, don't bother doing the setup since the
12652 * process can't be using the memory anymore.
12653 */
12654 if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12655 ASSERT(va == tsbinfop->tsb_va);
12656 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12657
12658 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12659 sfmmu_inv_tsb(tsbinfop->tsb_va,
12660 TSB_BYTES(tsbinfop->tsb_szc));
12661 tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12662 }
12663 }
12664
12665 membar_exit();
12666 tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12667 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12668
12669 sfmmu_hat_exit(hatlockp);
12670
12671 return (0);
12672 }
12673
12674 /*
12675 * Allocate and initialize a tsb_info structure. Note that we may or may not
12676 * allocate a TSB here, depending on the flags passed in.
12677 */
12678 static int
12679 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12680 uint_t flags, sfmmu_t *sfmmup)
12681 {
12682 int err;
12683
12684 *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12685 sfmmu_tsbinfo_cache, KM_SLEEP);
12686
12687 if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12688 tsb_szc, flags, sfmmup)) != 0) {
12689 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12690 SFMMU_STAT(sf_tsb_allocfail);
12691 *tsbinfopp = NULL;
12692 return (err);
12693 }
12694 SFMMU_STAT(sf_tsb_alloc);
12695
12696 /*
12697 * Bump the TSB size counters for this TSB size.
12698 */
12699 (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12700 return (0);
12701 }
12702
12703 static void
12704 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12705 {
12706 caddr_t tsbva = tsbinfo->tsb_va;
12707 uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12708 struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12709 vmem_t *vmp = tsbinfo->tsb_vmp;
12710
12711 /*
12712 * If we allocated this TSB from relocatable kernel memory, then we
12713 * need to uninstall the callback handler.
12714 */
12715 if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12716 uintptr_t slab_mask;
12717 caddr_t slab_vaddr;
12718 page_t **ppl;
12719 int ret;
12720
12721 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12722 if (tsb_size > MMU_PAGESIZE4M)
12723 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12724 else
12725 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12726 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12727
12728 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12729 ASSERT(ret == 0);
12730 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12731 0, NULL);
12732 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12733 }
12734
12735 if (kmem_cachep != NULL) {
12736 kmem_cache_free(kmem_cachep, tsbva);
12737 } else {
12738 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12739 }
12740 tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12741 atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12742 }
12743
12744 static void
12745 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12746 {
12747 if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12748 sfmmu_tsb_free(tsbinfo);
12749 }
12750 kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12751
12752 }
12753
12754 /*
12755 * Setup all the references to physical memory for this tsbinfo.
12756 * The underlying page(s) must be locked.
12757 */
12758 static void
12759 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12760 {
12761 ASSERT(pfn != PFN_INVALID);
12762 ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12763
12764 #ifndef sun4v
12765 if (tsbinfo->tsb_szc == 0) {
12766 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12767 PROT_WRITE|PROT_READ, TTE8K);
12768 } else {
12769 /*
12770 * Round down PA and use a large mapping; the handlers will
12771 * compute the TSB pointer at the correct offset into the
12772 * big virtual page. NOTE: this assumes all TSBs larger
12773 * than 8K must come from physically contiguous slabs of
12774 * size tsb_slab_size.
12775 */
12776 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12777 PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12778 }
12779 tsbinfo->tsb_pa = ptob(pfn);
12780
12781 TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12782 TTE_SET_MOD(&tsbinfo->tsb_tte); /* enable writes */
12783
12784 ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12785 ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12786 #else /* sun4v */
12787 tsbinfo->tsb_pa = ptob(pfn);
12788 #endif /* sun4v */
12789 }
12790
12791
12792 /*
12793 * Returns zero on success, ENOMEM if over the high water mark,
12794 * or EAGAIN if the caller needs to retry with a smaller TSB
12795 * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12796 *
12797 * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12798 * is specified and the TSB requested is PAGESIZE, though it
12799 * may sleep waiting for memory if sufficient memory is not
12800 * available.
12801 */
12802 static int
12803 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12804 int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12805 {
12806 caddr_t vaddr = NULL;
12807 caddr_t slab_vaddr;
12808 uintptr_t slab_mask;
12809 int tsbbytes = TSB_BYTES(tsbcode);
12810 int lowmem = 0;
12811 struct kmem_cache *kmem_cachep = NULL;
12812 vmem_t *vmp = NULL;
12813 lgrp_id_t lgrpid = LGRP_NONE;
12814 pfn_t pfn;
12815 uint_t cbflags = HAC_SLEEP;
12816 page_t **pplist;
12817 int ret;
12818
12819 ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
12820 if (tsbbytes > MMU_PAGESIZE4M)
12821 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12822 else
12823 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12824
12825 if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
12826 flags |= TSB_ALLOC;
12827
12828 ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
12829
12830 tsbinfo->tsb_sfmmu = sfmmup;
12831
12832 /*
12833 * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
12834 * return.
12835 */
12836 if ((flags & TSB_ALLOC) == 0) {
12837 tsbinfo->tsb_szc = tsbcode;
12838 tsbinfo->tsb_ttesz_mask = tteszmask;
12839 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
12840 tsbinfo->tsb_pa = -1;
12841 tsbinfo->tsb_tte.ll = 0;
12842 tsbinfo->tsb_next = NULL;
12843 tsbinfo->tsb_flags = TSB_SWAPPED;
12844 tsbinfo->tsb_cache = NULL;
12845 tsbinfo->tsb_vmp = NULL;
12846 return (0);
12847 }
12848
12849 #ifdef DEBUG
12850 /*
12851 * For debugging:
12852 * Randomly force allocation failures every tsb_alloc_mtbf
12853 * tries if TSB_FORCEALLOC is not specified. This will
12854 * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
12855 * it is even, to allow testing of both failure paths...
12856 */
12857 if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
12858 (tsb_alloc_count++ == tsb_alloc_mtbf)) {
12859 tsb_alloc_count = 0;
12860 tsb_alloc_fail_mtbf++;
12861 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
12862 }
12863 #endif /* DEBUG */
12864
12865 /*
12866 * Enforce high water mark if we are not doing a forced allocation
12867 * and are not shrinking a process' TSB.
12868 */
12869 if ((flags & TSB_SHRINK) == 0 &&
12870 (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
12871 if ((flags & TSB_FORCEALLOC) == 0)
12872 return (ENOMEM);
12873 lowmem = 1;
12874 }
12875
12876 /*
12877 * Allocate from the correct location based upon the size of the TSB
12878 * compared to the base page size, and what memory conditions dictate.
12879 * Note we always do nonblocking allocations from the TSB arena since
12880 * we don't want memory fragmentation to cause processes to block
12881 * indefinitely waiting for memory; until the kernel algorithms that
12882 * coalesce large pages are improved this is our best option.
12883 *
12884 * Algorithm:
12885 * If allocating a "large" TSB (>8K), allocate from the
12886 * appropriate kmem_tsb_default_arena vmem arena
12887 * else if low on memory or the TSB_FORCEALLOC flag is set or
12888 * tsb_forceheap is set
12889 * Allocate from kernel heap via sfmmu_tsb8k_cache with
12890 * KM_SLEEP (never fails)
12891 * else
12892 * Allocate from appropriate sfmmu_tsb_cache with
12893 * KM_NOSLEEP
12894 * endif
12895 */
12896 if (tsb_lgrp_affinity)
12897 lgrpid = lgrp_home_id(curthread);
12898 if (lgrpid == LGRP_NONE)
12899 lgrpid = 0; /* use lgrp of boot CPU */
12900
12901 if (tsbbytes > MMU_PAGESIZE) {
12902 if (tsbbytes > MMU_PAGESIZE4M) {
12903 vmp = kmem_bigtsb_default_arena[lgrpid];
12904 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12905 0, 0, NULL, NULL, VM_NOSLEEP);
12906 } else {
12907 vmp = kmem_tsb_default_arena[lgrpid];
12908 vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12909 0, 0, NULL, NULL, VM_NOSLEEP);
12910 }
12911 #ifdef DEBUG
12912 } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
12913 #else /* !DEBUG */
12914 } else if (lowmem || (flags & TSB_FORCEALLOC)) {
12915 #endif /* DEBUG */
12916 kmem_cachep = sfmmu_tsb8k_cache;
12917 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
12918 ASSERT(vaddr != NULL);
12919 } else {
12920 kmem_cachep = sfmmu_tsb_cache[lgrpid];
12921 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
12922 }
12923
12924 tsbinfo->tsb_cache = kmem_cachep;
12925 tsbinfo->tsb_vmp = vmp;
12926
12927 if (vaddr == NULL) {
12928 return (EAGAIN);
12929 }
12930
12931 atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
12932 kmem_cachep = tsbinfo->tsb_cache;
12933
12934 /*
12935 * If we are allocating from outside the cage, then we need to
12936 * register a relocation callback handler. Note that for now
12937 * since pseudo mappings always hang off of the slab's root page,
12938 * we need only lock the first 8K of the TSB slab. This is a bit
12939 * hacky but it is good for performance.
12940 */
12941 if (kmem_cachep != sfmmu_tsb8k_cache) {
12942 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
12943 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
12944 ASSERT(ret == 0);
12945 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
12946 cbflags, (void *)tsbinfo, &pfn, NULL);
12947
12948 /*
12949 * Need to free up resources if we could not successfully
12950 * add the callback function and return an error condition.
12951 */
12952 if (ret != 0) {
12953 if (kmem_cachep) {
12954 kmem_cache_free(kmem_cachep, vaddr);
12955 } else {
12956 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
12957 }
12958 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
12959 S_WRITE);
12960 return (EAGAIN);
12961 }
12962 } else {
12963 /*
12964 * Since allocation of 8K TSBs from heap is rare and occurs
12965 * during memory pressure we allocate them from permanent
12966 * memory rather than using callbacks to get the PFN.
12967 */
12968 pfn = hat_getpfnum(kas.a_hat, vaddr);
12969 }
12970
12971 tsbinfo->tsb_va = vaddr;
12972 tsbinfo->tsb_szc = tsbcode;
12973 tsbinfo->tsb_ttesz_mask = tteszmask;
12974 tsbinfo->tsb_next = NULL;
12975 tsbinfo->tsb_flags = 0;
12976
12977 sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
12978
12979 sfmmu_inv_tsb(vaddr, tsbbytes);
12980
12981 if (kmem_cachep != sfmmu_tsb8k_cache) {
12982 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
12983 }
12984
12985 return (0);
12986 }
12987
12988 /*
12989 * Initialize per cpu tsb and per cpu tsbmiss_area
12990 */
12991 void
12992 sfmmu_init_tsbs(void)
12993 {
12994 int i;
12995 struct tsbmiss *tsbmissp;
12996 struct kpmtsbm *kpmtsbmp;
12997 #ifndef sun4v
12998 extern int dcache_line_mask;
12999 #endif /* sun4v */
13000 extern uint_t vac_colors;
13001
13002 /*
13003 * Init. tsb miss area.
13004 */
13005 tsbmissp = tsbmiss_area;
13006
13007 for (i = 0; i < NCPU; tsbmissp++, i++) {
13008 /*
13009 * initialize the tsbmiss area.
13010 * Do this for all possible CPUs as some may be added
13011 * while the system is running. There is no cost to this.
13012 */
13013 tsbmissp->ksfmmup = ksfmmup;
13014 #ifndef sun4v
13015 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13016 #endif /* sun4v */
13017 tsbmissp->khashstart =
13018 (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13019 tsbmissp->uhashstart =
13020 (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13021 tsbmissp->khashsz = khmehash_num;
13022 tsbmissp->uhashsz = uhmehash_num;
13023 }
13024
13025 sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13026 sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13027
13028 if (kpm_enable == 0)
13029 return;
13030
13031 /* -- Begin KPM specific init -- */
13032
13033 if (kpm_smallpages) {
13034 /*
13035 * If we're using base pagesize pages for seg_kpm
13036 * mappings, we use the kernel TSB since we can't afford
13037 * to allocate a second huge TSB for these mappings.
13038 */
13039 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13040 kpm_tsbsz = ktsb_szcode;
13041 kpmsm_tsbbase = kpm_tsbbase;
13042 kpmsm_tsbsz = kpm_tsbsz;
13043 } else {
13044 /*
13045 * In VAC conflict case, just put the entries in the
13046 * kernel 8K indexed TSB for now so we can find them.
13047 * This could really be changed in the future if we feel
13048 * the need...
13049 */
13050 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13051 kpmsm_tsbsz = ktsb_szcode;
13052 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13053 kpm_tsbsz = ktsb4m_szcode;
13054 }
13055
13056 kpmtsbmp = kpmtsbm_area;
13057 for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13058 /*
13059 * Initialize the kpmtsbm area.
13060 * Do this for all possible CPUs as some may be added
13061 * while the system is running. There is no cost to this.
13062 */
13063 kpmtsbmp->vbase = kpm_vbase;
13064 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13065 kpmtsbmp->sz_shift = kpm_size_shift;
13066 kpmtsbmp->kpmp_shift = kpmp_shift;
13067 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13068 if (kpm_smallpages == 0) {
13069 kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13070 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13071 } else {
13072 kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13073 kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13074 }
13075 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13076 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13077 #ifdef DEBUG
13078 kpmtsbmp->flags |= (kpm_tsbmtl) ? KPMTSBM_TLTSBM_FLAG : 0;
13079 #endif /* DEBUG */
13080 if (ktsb_phys)
13081 kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13082 }
13083
13084 /* -- End KPM specific init -- */
13085 }
13086
13087 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13088 struct tsb_info ktsb_info[2];
13089
13090 /*
13091 * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13092 */
13093 void
13094 sfmmu_init_ktsbinfo()
13095 {
13096 ASSERT(ksfmmup != NULL);
13097 ASSERT(ksfmmup->sfmmu_tsb == NULL);
13098 /*
13099 * Allocate tsbinfos for kernel and copy in data
13100 * to make debug easier and sun4v setup easier.
13101 */
13102 ktsb_info[0].tsb_sfmmu = ksfmmup;
13103 ktsb_info[0].tsb_szc = ktsb_szcode;
13104 ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13105 ktsb_info[0].tsb_va = ktsb_base;
13106 ktsb_info[0].tsb_pa = ktsb_pbase;
13107 ktsb_info[0].tsb_flags = 0;
13108 ktsb_info[0].tsb_tte.ll = 0;
13109 ktsb_info[0].tsb_cache = NULL;
13110
13111 ktsb_info[1].tsb_sfmmu = ksfmmup;
13112 ktsb_info[1].tsb_szc = ktsb4m_szcode;
13113 ktsb_info[1].tsb_ttesz_mask = TSB4M;
13114 ktsb_info[1].tsb_va = ktsb4m_base;
13115 ktsb_info[1].tsb_pa = ktsb4m_pbase;
13116 ktsb_info[1].tsb_flags = 0;
13117 ktsb_info[1].tsb_tte.ll = 0;
13118 ktsb_info[1].tsb_cache = NULL;
13119
13120 /* Link them into ksfmmup. */
13121 ktsb_info[0].tsb_next = &ktsb_info[1];
13122 ktsb_info[1].tsb_next = NULL;
13123 ksfmmup->sfmmu_tsb = &ktsb_info[0];
13124
13125 sfmmu_setup_tsbinfo(ksfmmup);
13126 }
13127
13128 /*
13129 * Cache the last value returned from va_to_pa(). If the VA specified
13130 * in the current call to cached_va_to_pa() maps to the same Page (as the
13131 * previous call to cached_va_to_pa()), then compute the PA using
13132 * cached info, else call va_to_pa().
13133 *
13134 * Note: this function is neither MT-safe nor consistent in the presence
13135 * of multiple, interleaved threads. This function was created to enable
13136 * an optimization used during boot (at a point when there's only one thread
13137 * executing on the "boot CPU", and before startup_vm() has been called).
13138 */
13139 static uint64_t
13140 cached_va_to_pa(void *vaddr)
13141 {
13142 static uint64_t prev_vaddr_base = 0;
13143 static uint64_t prev_pfn = 0;
13144
13145 if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13146 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13147 } else {
13148 uint64_t pa = va_to_pa(vaddr);
13149
13150 if (pa != ((uint64_t)-1)) {
13151 /*
13152 * Computed physical address is valid. Cache its
13153 * related info for the next cached_va_to_pa() call.
13154 */
13155 prev_pfn = pa & MMU_PAGEMASK;
13156 prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13157 }
13158
13159 return (pa);
13160 }
13161 }
13162
13163 /*
13164 * Carve up our nucleus hblk region. We may allocate more hblks than
13165 * asked due to rounding errors but we are guaranteed to have at least
13166 * enough space to allocate the requested number of hblk8's and hblk1's.
13167 */
13168 void
13169 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13170 {
13171 struct hme_blk *hmeblkp;
13172 size_t hme8blk_sz, hme1blk_sz;
13173 size_t i;
13174 size_t hblk8_bound;
13175 ulong_t j = 0, k = 0;
13176
13177 ASSERT(addr != NULL && size != 0);
13178
13179 /* Need to use proper structure alignment */
13180 hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13181 hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13182
13183 nucleus_hblk8.list = (void *)addr;
13184 nucleus_hblk8.index = 0;
13185
13186 /*
13187 * Use as much memory as possible for hblk8's since we
13188 * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13189 * We need to hold back enough space for the hblk1's which
13190 * we'll allocate next.
13191 */
13192 hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13193 for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13194 hmeblkp = (struct hme_blk *)addr;
13195 addr += hme8blk_sz;
13196 hmeblkp->hblk_nuc_bit = 1;
13197 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13198 }
13199 nucleus_hblk8.len = j;
13200 ASSERT(j >= nhblk8);
13201 SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13202
13203 nucleus_hblk1.list = (void *)addr;
13204 nucleus_hblk1.index = 0;
13205 for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13206 hmeblkp = (struct hme_blk *)addr;
13207 addr += hme1blk_sz;
13208 hmeblkp->hblk_nuc_bit = 1;
13209 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13210 }
13211 ASSERT(k >= nhblk1);
13212 nucleus_hblk1.len = k;
13213 SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13214 }
13215
13216 /*
13217 * This function is currently not supported on this platform. For what
13218 * it's supposed to do, see hat.c and hat_srmmu.c
13219 */
13220 /* ARGSUSED */
13221 faultcode_t
13222 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13223 uint_t flags)
13224 {
13225 return (FC_NOSUPPORT);
13226 }
13227
13228 /*
13229 * Searchs the mapping list of the page for a mapping of the same size. If not
13230 * found the corresponding bit is cleared in the p_index field. When large
13231 * pages are more prevalent in the system, we can maintain the mapping list
13232 * in order and we don't have to traverse the list each time. Just check the
13233 * next and prev entries, and if both are of different size, we clear the bit.
13234 */
13235 static void
13236 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13237 {
13238 struct sf_hment *sfhmep;
13239 struct hme_blk *hmeblkp;
13240 int index;
13241 pgcnt_t npgs;
13242
13243 ASSERT(ttesz > TTE8K);
13244
13245 ASSERT(sfmmu_mlist_held(pp));
13246
13247 ASSERT(PP_ISMAPPED_LARGE(pp));
13248
13249 /*
13250 * Traverse mapping list looking for another mapping of same size.
13251 * since we only want to clear index field if all mappings of
13252 * that size are gone.
13253 */
13254
13255 for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13256 if (IS_PAHME(sfhmep))
13257 continue;
13258 hmeblkp = sfmmu_hmetohblk(sfhmep);
13259 if (hme_size(sfhmep) == ttesz) {
13260 /*
13261 * another mapping of the same size. don't clear index.
13262 */
13263 return;
13264 }
13265 }
13266
13267 /*
13268 * Clear the p_index bit for large page.
13269 */
13270 index = PAGESZ_TO_INDEX(ttesz);
13271 npgs = TTEPAGES(ttesz);
13272 while (npgs-- > 0) {
13273 ASSERT(pp->p_index & index);
13274 pp->p_index &= ~index;
13275 pp = PP_PAGENEXT(pp);
13276 }
13277 }
13278
13279 /*
13280 * return supported features
13281 */
13282 /* ARGSUSED */
13283 int
13284 hat_supported(enum hat_features feature, void *arg)
13285 {
13286 switch (feature) {
13287 case HAT_SHARED_PT:
13288 case HAT_DYNAMIC_ISM_UNMAP:
13289 case HAT_VMODSORT:
13290 return (1);
13291 case HAT_SHARED_REGIONS:
13292 if (shctx_on)
13293 return (1);
13294 else
13295 return (0);
13296 default:
13297 return (0);
13298 }
13299 }
13300
13301 void
13302 hat_enter(struct hat *hat)
13303 {
13304 hatlock_t *hatlockp;
13305
13306 if (hat != ksfmmup) {
13307 hatlockp = TSB_HASH(hat);
13308 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13309 }
13310 }
13311
13312 void
13313 hat_exit(struct hat *hat)
13314 {
13315 hatlock_t *hatlockp;
13316
13317 if (hat != ksfmmup) {
13318 hatlockp = TSB_HASH(hat);
13319 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13320 }
13321 }
13322
13323 /*ARGSUSED*/
13324 void
13325 hat_reserve(struct as *as, caddr_t addr, size_t len)
13326 {
13327 }
13328
13329 static void
13330 hat_kstat_init(void)
13331 {
13332 kstat_t *ksp;
13333
13334 ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13335 KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13336 KSTAT_FLAG_VIRTUAL);
13337 if (ksp) {
13338 ksp->ks_data = (void *) &sfmmu_global_stat;
13339 kstat_install(ksp);
13340 }
13341 ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13342 KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13343 KSTAT_FLAG_VIRTUAL);
13344 if (ksp) {
13345 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13346 kstat_install(ksp);
13347 }
13348 ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13349 KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13350 KSTAT_FLAG_WRITABLE);
13351 if (ksp) {
13352 ksp->ks_update = sfmmu_kstat_percpu_update;
13353 kstat_install(ksp);
13354 }
13355 }
13356
13357 /* ARGSUSED */
13358 static int
13359 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13360 {
13361 struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13362 struct tsbmiss *tsbm = tsbmiss_area;
13363 struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13364 int i;
13365
13366 ASSERT(cpu_kstat);
13367 if (rw == KSTAT_READ) {
13368 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13369 cpu_kstat->sf_itlb_misses = 0;
13370 cpu_kstat->sf_dtlb_misses = 0;
13371 cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13372 tsbm->uprot_traps;
13373 cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13374 kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13375 cpu_kstat->sf_tsb_hits = 0;
13376 cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13377 cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13378 }
13379 } else {
13380 /* KSTAT_WRITE is used to clear stats */
13381 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13382 tsbm->utsb_misses = 0;
13383 tsbm->ktsb_misses = 0;
13384 tsbm->uprot_traps = 0;
13385 tsbm->kprot_traps = 0;
13386 kpmtsbm->kpm_dtlb_misses = 0;
13387 kpmtsbm->kpm_tsb_misses = 0;
13388 }
13389 }
13390 return (0);
13391 }
13392
13393 #ifdef DEBUG
13394
13395 tte_t *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13396
13397 /*
13398 * A tte checker. *orig_old is the value we read before cas.
13399 * *cur is the value returned by cas.
13400 * *new is the desired value when we do the cas.
13401 *
13402 * *hmeblkp is currently unused.
13403 */
13404
13405 /* ARGSUSED */
13406 void
13407 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13408 {
13409 pfn_t i, j, k;
13410 int cpuid = CPU->cpu_id;
13411
13412 gorig[cpuid] = orig_old;
13413 gcur[cpuid] = cur;
13414 gnew[cpuid] = new;
13415
13416 #ifdef lint
13417 hmeblkp = hmeblkp;
13418 #endif
13419
13420 if (TTE_IS_VALID(orig_old)) {
13421 if (TTE_IS_VALID(cur)) {
13422 i = TTE_TO_TTEPFN(orig_old);
13423 j = TTE_TO_TTEPFN(cur);
13424 k = TTE_TO_TTEPFN(new);
13425 if (i != j) {
13426 /* remap error? */
13427 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13428 }
13429
13430 if (i != k) {
13431 /* remap error? */
13432 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13433 }
13434 } else {
13435 if (TTE_IS_VALID(new)) {
13436 panic("chk_tte: invalid cur? ");
13437 }
13438
13439 i = TTE_TO_TTEPFN(orig_old);
13440 k = TTE_TO_TTEPFN(new);
13441 if (i != k) {
13442 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13443 }
13444 }
13445 } else {
13446 if (TTE_IS_VALID(cur)) {
13447 j = TTE_TO_TTEPFN(cur);
13448 if (TTE_IS_VALID(new)) {
13449 k = TTE_TO_TTEPFN(new);
13450 if (j != k) {
13451 panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13452 j, k);
13453 }
13454 } else {
13455 panic("chk_tte: why here?");
13456 }
13457 } else {
13458 if (!TTE_IS_VALID(new)) {
13459 panic("chk_tte: why here2 ?");
13460 }
13461 }
13462 }
13463 }
13464
13465 #endif /* DEBUG */
13466
13467 extern void prefetch_tsbe_read(struct tsbe *);
13468 extern void prefetch_tsbe_write(struct tsbe *);
13469
13470
13471 /*
13472 * We want to prefetch 7 cache lines ahead for our read prefetch. This gives
13473 * us optimal performance on Cheetah+. You can only have 8 outstanding
13474 * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13475 * prefetch to make the most utilization of the prefetch capability.
13476 */
13477 #define TSBE_PREFETCH_STRIDE (7)
13478
13479 void
13480 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13481 {
13482 int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13483 int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13484 int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13485 int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13486 struct tsbe *old;
13487 struct tsbe *new;
13488 struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13489 uint64_t va;
13490 int new_offset;
13491 int i;
13492 int vpshift;
13493 int last_prefetch;
13494
13495 if (old_bytes == new_bytes) {
13496 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13497 } else {
13498
13499 /*
13500 * A TSBE is 16 bytes which means there are four TSBE's per
13501 * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13502 */
13503 old = (struct tsbe *)old_tsbinfo->tsb_va;
13504 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13505 for (i = 0; i < old_entries; i++, old++) {
13506 if (((i & (4-1)) == 0) && (i < last_prefetch))
13507 prefetch_tsbe_read(old);
13508 if (!old->tte_tag.tag_invalid) {
13509 /*
13510 * We have a valid TTE to remap. Check the
13511 * size. We won't remap 64K or 512K TTEs
13512 * because they span more than one TSB entry
13513 * and are indexed using an 8K virt. page.
13514 * Ditto for 32M and 256M TTEs.
13515 */
13516 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13517 TTE_CSZ(&old->tte_data) == TTE512K)
13518 continue;
13519 if (mmu_page_sizes == max_mmu_page_sizes) {
13520 if (TTE_CSZ(&old->tte_data) == TTE32M ||
13521 TTE_CSZ(&old->tte_data) == TTE256M)
13522 continue;
13523 }
13524
13525 /* clear the lower 22 bits of the va */
13526 va = *(uint64_t *)old << 22;
13527 /* turn va into a virtual pfn */
13528 va >>= 22 - TSB_START_SIZE;
13529 /*
13530 * or in bits from the offset in the tsb
13531 * to get the real virtual pfn. These
13532 * correspond to bits [21:13] in the va
13533 */
13534 vpshift =
13535 TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13536 0x1ff;
13537 va |= (i << vpshift);
13538 va >>= vpshift;
13539 new_offset = va & (new_entries - 1);
13540 new = new_base + new_offset;
13541 prefetch_tsbe_write(new);
13542 *new = *old;
13543 }
13544 }
13545 }
13546 }
13547
13548 /*
13549 * unused in sfmmu
13550 */
13551 void
13552 hat_dump(void)
13553 {
13554 }
13555
13556 /*
13557 * Called when a thread is exiting and we have switched to the kernel address
13558 * space. Perform the same VM initialization resume() uses when switching
13559 * processes.
13560 *
13561 * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13562 * we call it anyway in case the semantics change in the future.
13563 */
13564 /*ARGSUSED*/
13565 void
13566 hat_thread_exit(kthread_t *thd)
13567 {
13568 uint_t pgsz_cnum;
13569 uint_t pstate_save;
13570
13571 ASSERT(thd->t_procp->p_as == &kas);
13572
13573 pgsz_cnum = KCONTEXT;
13574 #ifdef sun4u
13575 pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13576 #endif
13577
13578 /*
13579 * Note that sfmmu_load_mmustate() is currently a no-op for
13580 * kernel threads. We need to disable interrupts here,
13581 * simply because otherwise sfmmu_load_mmustate() would panic
13582 * if the caller does not disable interrupts.
13583 */
13584 pstate_save = sfmmu_disable_intrs();
13585
13586 /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13587 sfmmu_setctx_sec(pgsz_cnum);
13588 sfmmu_load_mmustate(ksfmmup);
13589 sfmmu_enable_intrs(pstate_save);
13590 }
13591
13592
13593 /*
13594 * SRD support
13595 */
13596 #define SRD_HASH_FUNCTION(vp) (((((uintptr_t)(vp)) >> 4) ^ \
13597 (((uintptr_t)(vp)) >> 11)) & \
13598 srd_hashmask)
13599
13600 /*
13601 * Attach the process to the srd struct associated with the exec vnode
13602 * from which the process is started.
13603 */
13604 void
13605 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13606 {
13607 uint_t hash = SRD_HASH_FUNCTION(evp);
13608 sf_srd_t *srdp;
13609 sf_srd_t *newsrdp;
13610
13611 ASSERT(sfmmup != ksfmmup);
13612 ASSERT(sfmmup->sfmmu_srdp == NULL);
13613
13614 if (!shctx_on) {
13615 return;
13616 }
13617
13618 VN_HOLD(evp);
13619
13620 if (srd_buckets[hash].srdb_srdp != NULL) {
13621 mutex_enter(&srd_buckets[hash].srdb_lock);
13622 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13623 srdp = srdp->srd_hash) {
13624 if (srdp->srd_evp == evp) {
13625 ASSERT(srdp->srd_refcnt >= 0);
13626 sfmmup->sfmmu_srdp = srdp;
13627 atomic_inc_32(
13628 (volatile uint_t *)&srdp->srd_refcnt);
13629 mutex_exit(&srd_buckets[hash].srdb_lock);
13630 return;
13631 }
13632 }
13633 mutex_exit(&srd_buckets[hash].srdb_lock);
13634 }
13635 newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13636 ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13637
13638 newsrdp->srd_evp = evp;
13639 newsrdp->srd_refcnt = 1;
13640 newsrdp->srd_hmergnfree = NULL;
13641 newsrdp->srd_ismrgnfree = NULL;
13642
13643 mutex_enter(&srd_buckets[hash].srdb_lock);
13644 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13645 srdp = srdp->srd_hash) {
13646 if (srdp->srd_evp == evp) {
13647 ASSERT(srdp->srd_refcnt >= 0);
13648 sfmmup->sfmmu_srdp = srdp;
13649 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13650 mutex_exit(&srd_buckets[hash].srdb_lock);
13651 kmem_cache_free(srd_cache, newsrdp);
13652 return;
13653 }
13654 }
13655 newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13656 srd_buckets[hash].srdb_srdp = newsrdp;
13657 sfmmup->sfmmu_srdp = newsrdp;
13658
13659 mutex_exit(&srd_buckets[hash].srdb_lock);
13660
13661 }
13662
13663 static void
13664 sfmmu_leave_srd(sfmmu_t *sfmmup)
13665 {
13666 vnode_t *evp;
13667 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13668 uint_t hash;
13669 sf_srd_t **prev_srdpp;
13670 sf_region_t *rgnp;
13671 sf_region_t *nrgnp;
13672 #ifdef DEBUG
13673 int rgns = 0;
13674 #endif
13675 int i;
13676
13677 ASSERT(sfmmup != ksfmmup);
13678 ASSERT(srdp != NULL);
13679 ASSERT(srdp->srd_refcnt > 0);
13680 ASSERT(sfmmup->sfmmu_scdp == NULL);
13681 ASSERT(sfmmup->sfmmu_free == 1);
13682
13683 sfmmup->sfmmu_srdp = NULL;
13684 evp = srdp->srd_evp;
13685 ASSERT(evp != NULL);
13686 if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13687 VN_RELE(evp);
13688 return;
13689 }
13690
13691 hash = SRD_HASH_FUNCTION(evp);
13692 mutex_enter(&srd_buckets[hash].srdb_lock);
13693 for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13694 (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13695 if (srdp->srd_evp == evp) {
13696 break;
13697 }
13698 }
13699 if (srdp == NULL || srdp->srd_refcnt) {
13700 mutex_exit(&srd_buckets[hash].srdb_lock);
13701 VN_RELE(evp);
13702 return;
13703 }
13704 *prev_srdpp = srdp->srd_hash;
13705 mutex_exit(&srd_buckets[hash].srdb_lock);
13706
13707 ASSERT(srdp->srd_refcnt == 0);
13708 VN_RELE(evp);
13709
13710 #ifdef DEBUG
13711 for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13712 ASSERT(srdp->srd_rgnhash[i] == NULL);
13713 }
13714 #endif /* DEBUG */
13715
13716 /* free each hme regions in the srd */
13717 for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13718 nrgnp = rgnp->rgn_next;
13719 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13720 ASSERT(rgnp->rgn_refcnt == 0);
13721 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13722 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13723 ASSERT(rgnp->rgn_hmeflags == 0);
13724 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13725 #ifdef DEBUG
13726 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13727 ASSERT(rgnp->rgn_ttecnt[i] == 0);
13728 }
13729 rgns++;
13730 #endif /* DEBUG */
13731 kmem_cache_free(region_cache, rgnp);
13732 }
13733 ASSERT(rgns == srdp->srd_next_hmerid);
13734
13735 #ifdef DEBUG
13736 rgns = 0;
13737 #endif
13738 /* free each ism rgns in the srd */
13739 for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13740 nrgnp = rgnp->rgn_next;
13741 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13742 ASSERT(rgnp->rgn_refcnt == 0);
13743 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13744 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13745 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13746 #ifdef DEBUG
13747 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13748 ASSERT(rgnp->rgn_ttecnt[i] == 0);
13749 }
13750 rgns++;
13751 #endif /* DEBUG */
13752 kmem_cache_free(region_cache, rgnp);
13753 }
13754 ASSERT(rgns == srdp->srd_next_ismrid);
13755 ASSERT(srdp->srd_ismbusyrgns == 0);
13756 ASSERT(srdp->srd_hmebusyrgns == 0);
13757
13758 srdp->srd_next_ismrid = 0;
13759 srdp->srd_next_hmerid = 0;
13760
13761 bzero((void *)srdp->srd_ismrgnp,
13762 sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13763 bzero((void *)srdp->srd_hmergnp,
13764 sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13765
13766 ASSERT(srdp->srd_scdp == NULL);
13767 kmem_cache_free(srd_cache, srdp);
13768 }
13769
13770 /* ARGSUSED */
13771 static int
13772 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13773 {
13774 sf_srd_t *srdp = (sf_srd_t *)buf;
13775 bzero(buf, sizeof (*srdp));
13776
13777 mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13778 mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13779 return (0);
13780 }
13781
13782 /* ARGSUSED */
13783 static void
13784 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13785 {
13786 sf_srd_t *srdp = (sf_srd_t *)buf;
13787
13788 mutex_destroy(&srdp->srd_mutex);
13789 mutex_destroy(&srdp->srd_scd_mutex);
13790 }
13791
13792 /*
13793 * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13794 * at the same time for the same process and address range. This is ensured by
13795 * the fact that address space is locked as writer when a process joins the
13796 * regions. Therefore there's no need to hold an srd lock during the entire
13797 * execution of hat_join_region()/hat_leave_region().
13798 */
13799
13800 #define RGN_HASH_FUNCTION(obj) (((((uintptr_t)(obj)) >> 4) ^ \
13801 (((uintptr_t)(obj)) >> 11)) & \
13802 srd_rgn_hashmask)
13803 /*
13804 * This routine implements the shared context functionality required when
13805 * attaching a segment to an address space. It must be called from
13806 * hat_share() for D(ISM) segments and from segvn_create() for segments
13807 * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13808 * which is saved in the private segment data for hme segments and
13809 * the ism_map structure for ism segments.
13810 */
13811 hat_region_cookie_t
13812 hat_join_region(struct hat *sfmmup,
13813 caddr_t r_saddr,
13814 size_t r_size,
13815 void *r_obj,
13816 u_offset_t r_objoff,
13817 uchar_t r_perm,
13818 uchar_t r_pgszc,
13819 hat_rgn_cb_func_t r_cb_function,
13820 uint_t flags)
13821 {
13822 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13823 uint_t rhash;
13824 uint_t rid;
13825 hatlock_t *hatlockp;
13826 sf_region_t *rgnp;
13827 sf_region_t *new_rgnp = NULL;
13828 int i;
13829 uint16_t *nextidp;
13830 sf_region_t **freelistp;
13831 int maxids;
13832 sf_region_t **rarrp;
13833 uint16_t *busyrgnsp;
13834 ulong_t rttecnt;
13835 uchar_t tteflag;
13836 uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13837 int text = (r_type == HAT_REGION_TEXT);
13838
13839 if (srdp == NULL || r_size == 0) {
13840 return (HAT_INVALID_REGION_COOKIE);
13841 }
13842
13843 ASSERT(sfmmup != ksfmmup);
13844 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
13845 ASSERT(srdp->srd_refcnt > 0);
13846 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13847 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13848 ASSERT(r_pgszc < mmu_page_sizes);
13849 if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
13850 !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
13851 panic("hat_join_region: region addr or size is not aligned\n");
13852 }
13853
13854
13855 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13856 SFMMU_REGION_HME;
13857 /*
13858 * Currently only support shared hmes for the read only main text
13859 * region.
13860 */
13861 if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
13862 (r_perm & PROT_WRITE))) {
13863 return (HAT_INVALID_REGION_COOKIE);
13864 }
13865
13866 rhash = RGN_HASH_FUNCTION(r_obj);
13867
13868 if (r_type == SFMMU_REGION_ISM) {
13869 nextidp = &srdp->srd_next_ismrid;
13870 freelistp = &srdp->srd_ismrgnfree;
13871 maxids = SFMMU_MAX_ISM_REGIONS;
13872 rarrp = srdp->srd_ismrgnp;
13873 busyrgnsp = &srdp->srd_ismbusyrgns;
13874 } else {
13875 nextidp = &srdp->srd_next_hmerid;
13876 freelistp = &srdp->srd_hmergnfree;
13877 maxids = SFMMU_MAX_HME_REGIONS;
13878 rarrp = srdp->srd_hmergnp;
13879 busyrgnsp = &srdp->srd_hmebusyrgns;
13880 }
13881
13882 mutex_enter(&srdp->srd_mutex);
13883
13884 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13885 rgnp = rgnp->rgn_hash) {
13886 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
13887 rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
13888 rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
13889 break;
13890 }
13891 }
13892
13893 rfound:
13894 if (rgnp != NULL) {
13895 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
13896 ASSERT(rgnp->rgn_cb_function == r_cb_function);
13897 ASSERT(rgnp->rgn_refcnt >= 0);
13898 rid = rgnp->rgn_id;
13899 ASSERT(rid < maxids);
13900 ASSERT(rarrp[rid] == rgnp);
13901 ASSERT(rid < *nextidp);
13902 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
13903 mutex_exit(&srdp->srd_mutex);
13904 if (new_rgnp != NULL) {
13905 kmem_cache_free(region_cache, new_rgnp);
13906 }
13907 if (r_type == SFMMU_REGION_HME) {
13908 int myjoin =
13909 (sfmmup == astosfmmu(curthread->t_procp->p_as));
13910
13911 sfmmu_link_to_hmeregion(sfmmup, rgnp);
13912 /*
13913 * bitmap should be updated after linking sfmmu on
13914 * region list so that pageunload() doesn't skip
13915 * TSB/TLB flush. As soon as bitmap is updated another
13916 * thread in this process can already start accessing
13917 * this region.
13918 */
13919 /*
13920 * Normally ttecnt accounting is done as part of
13921 * pagefault handling. But a process may not take any
13922 * pagefaults on shared hmeblks created by some other
13923 * process. To compensate for this assume that the
13924 * entire region will end up faulted in using
13925 * the region's pagesize.
13926 *
13927 */
13928 if (r_pgszc > TTE8K) {
13929 tteflag = 1 << r_pgszc;
13930 if (disable_large_pages & tteflag) {
13931 tteflag = 0;
13932 }
13933 } else {
13934 tteflag = 0;
13935 }
13936 if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
13937 hatlockp = sfmmu_hat_enter(sfmmup);
13938 sfmmup->sfmmu_rtteflags |= tteflag;
13939 sfmmu_hat_exit(hatlockp);
13940 }
13941 hatlockp = sfmmu_hat_enter(sfmmup);
13942
13943 /*
13944 * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
13945 * region to allow for large page allocation failure.
13946 */
13947 if (r_pgszc >= TTE4M) {
13948 sfmmup->sfmmu_tsb0_4minflcnt +=
13949 r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
13950 }
13951
13952 /* update sfmmu_ttecnt with the shme rgn ttecnt */
13953 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
13954 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
13955 rttecnt);
13956
13957 if (text && r_pgszc >= TTE4M &&
13958 (tteflag || ((disable_large_pages >> TTE4M) &
13959 ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
13960 !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
13961 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
13962 }
13963
13964 sfmmu_hat_exit(hatlockp);
13965 /*
13966 * On Panther we need to make sure TLB is programmed
13967 * to accept 32M/256M pages. Call
13968 * sfmmu_check_page_sizes() now to make sure TLB is
13969 * setup before making hmeregions visible to other
13970 * threads.
13971 */
13972 sfmmu_check_page_sizes(sfmmup, 1);
13973 hatlockp = sfmmu_hat_enter(sfmmup);
13974 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
13975
13976 /*
13977 * if context is invalid tsb miss exception code will
13978 * call sfmmu_check_page_sizes() and update tsbmiss
13979 * area later.
13980 */
13981 kpreempt_disable();
13982 if (myjoin &&
13983 (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
13984 != INVALID_CONTEXT)) {
13985 struct tsbmiss *tsbmp;
13986
13987 tsbmp = &tsbmiss_area[CPU->cpu_id];
13988 ASSERT(sfmmup == tsbmp->usfmmup);
13989 BT_SET(tsbmp->shmermap, rid);
13990 if (r_pgszc > TTE64K) {
13991 tsbmp->uhat_rtteflags |= tteflag;
13992 }
13993
13994 }
13995 kpreempt_enable();
13996
13997 sfmmu_hat_exit(hatlockp);
13998 ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
13999 HAT_INVALID_REGION_COOKIE);
14000 } else {
14001 hatlockp = sfmmu_hat_enter(sfmmup);
14002 SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
14003 sfmmu_hat_exit(hatlockp);
14004 }
14005 ASSERT(rid < maxids);
14006
14007 if (r_type == SFMMU_REGION_ISM) {
14008 sfmmu_find_scd(sfmmup);
14009 }
14010 return ((hat_region_cookie_t)((uint64_t)rid));
14011 }
14012
14013 ASSERT(new_rgnp == NULL);
14014
14015 if (*busyrgnsp >= maxids) {
14016 mutex_exit(&srdp->srd_mutex);
14017 return (HAT_INVALID_REGION_COOKIE);
14018 }
14019
14020 ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14021 if (*freelistp != NULL) {
14022 rgnp = *freelistp;
14023 *freelistp = rgnp->rgn_next;
14024 ASSERT(rgnp->rgn_id < *nextidp);
14025 ASSERT(rgnp->rgn_id < maxids);
14026 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14027 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14028 == r_type);
14029 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14030 ASSERT(rgnp->rgn_hmeflags == 0);
14031 } else {
14032 /*
14033 * release local locks before memory allocation.
14034 */
14035 mutex_exit(&srdp->srd_mutex);
14036
14037 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14038
14039 mutex_enter(&srdp->srd_mutex);
14040 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14041 rgnp = rgnp->rgn_hash) {
14042 if (rgnp->rgn_saddr == r_saddr &&
14043 rgnp->rgn_size == r_size &&
14044 rgnp->rgn_obj == r_obj &&
14045 rgnp->rgn_objoff == r_objoff &&
14046 rgnp->rgn_perm == r_perm &&
14047 rgnp->rgn_pgszc == r_pgszc) {
14048 break;
14049 }
14050 }
14051 if (rgnp != NULL) {
14052 goto rfound;
14053 }
14054
14055 if (*nextidp >= maxids) {
14056 mutex_exit(&srdp->srd_mutex);
14057 goto fail;
14058 }
14059 rgnp = new_rgnp;
14060 new_rgnp = NULL;
14061 rgnp->rgn_id = (*nextidp)++;
14062 ASSERT(rgnp->rgn_id < maxids);
14063 ASSERT(rarrp[rgnp->rgn_id] == NULL);
14064 rarrp[rgnp->rgn_id] = rgnp;
14065 }
14066
14067 ASSERT(rgnp->rgn_sfmmu_head == NULL);
14068 ASSERT(rgnp->rgn_hmeflags == 0);
14069 #ifdef DEBUG
14070 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14071 ASSERT(rgnp->rgn_ttecnt[i] == 0);
14072 }
14073 #endif
14074 rgnp->rgn_saddr = r_saddr;
14075 rgnp->rgn_size = r_size;
14076 rgnp->rgn_obj = r_obj;
14077 rgnp->rgn_objoff = r_objoff;
14078 rgnp->rgn_perm = r_perm;
14079 rgnp->rgn_pgszc = r_pgszc;
14080 rgnp->rgn_flags = r_type;
14081 rgnp->rgn_refcnt = 0;
14082 rgnp->rgn_cb_function = r_cb_function;
14083 rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14084 srdp->srd_rgnhash[rhash] = rgnp;
14085 (*busyrgnsp)++;
14086 ASSERT(*busyrgnsp <= maxids);
14087 goto rfound;
14088
14089 fail:
14090 ASSERT(new_rgnp != NULL);
14091 kmem_cache_free(region_cache, new_rgnp);
14092 return (HAT_INVALID_REGION_COOKIE);
14093 }
14094
14095 /*
14096 * This function implements the shared context functionality required
14097 * when detaching a segment from an address space. It must be called
14098 * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14099 * for segments with a valid region_cookie.
14100 * It will also be called from all seg_vn routines which change a
14101 * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14102 * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14103 * from segvn_fault().
14104 */
14105 void
14106 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14107 {
14108 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14109 sf_scd_t *scdp;
14110 uint_t rhash;
14111 uint_t rid = (uint_t)((uint64_t)rcookie);
14112 hatlock_t *hatlockp = NULL;
14113 sf_region_t *rgnp;
14114 sf_region_t **prev_rgnpp;
14115 sf_region_t *cur_rgnp;
14116 void *r_obj;
14117 int i;
14118 caddr_t r_saddr;
14119 caddr_t r_eaddr;
14120 size_t r_size;
14121 uchar_t r_pgszc;
14122 uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14123
14124 ASSERT(sfmmup != ksfmmup);
14125 ASSERT(srdp != NULL);
14126 ASSERT(srdp->srd_refcnt > 0);
14127 ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14128 ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14129 ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14130
14131 r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14132 SFMMU_REGION_HME;
14133
14134 if (r_type == SFMMU_REGION_ISM) {
14135 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14136 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14137 rgnp = srdp->srd_ismrgnp[rid];
14138 } else {
14139 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14140 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14141 rgnp = srdp->srd_hmergnp[rid];
14142 }
14143 ASSERT(rgnp != NULL);
14144 ASSERT(rgnp->rgn_id == rid);
14145 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14146 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14147 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14148
14149 if (sfmmup->sfmmu_free) {
14150 ulong_t rttecnt;
14151 r_pgszc = rgnp->rgn_pgszc;
14152 r_size = rgnp->rgn_size;
14153
14154 ASSERT(sfmmup->sfmmu_scdp == NULL);
14155 if (r_type == SFMMU_REGION_ISM) {
14156 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14157 } else {
14158 /* update shme rgns ttecnt in sfmmu_ttecnt */
14159 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14160 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14161
14162 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14163 -rttecnt);
14164
14165 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14166 }
14167 } else if (r_type == SFMMU_REGION_ISM) {
14168 hatlockp = sfmmu_hat_enter(sfmmup);
14169 ASSERT(rid < srdp->srd_next_ismrid);
14170 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14171 scdp = sfmmup->sfmmu_scdp;
14172 if (scdp != NULL &&
14173 SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14174 sfmmu_leave_scd(sfmmup, r_type);
14175 ASSERT(sfmmu_hat_lock_held(sfmmup));
14176 }
14177 sfmmu_hat_exit(hatlockp);
14178 } else {
14179 ulong_t rttecnt;
14180 r_pgszc = rgnp->rgn_pgszc;
14181 r_saddr = rgnp->rgn_saddr;
14182 r_size = rgnp->rgn_size;
14183 r_eaddr = r_saddr + r_size;
14184
14185 ASSERT(r_type == SFMMU_REGION_HME);
14186 hatlockp = sfmmu_hat_enter(sfmmup);
14187 ASSERT(rid < srdp->srd_next_hmerid);
14188 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14189
14190 /*
14191 * If region is part of an SCD call sfmmu_leave_scd().
14192 * Otherwise if process is not exiting and has valid context
14193 * just drop the context on the floor to lose stale TLB
14194 * entries and force the update of tsb miss area to reflect
14195 * the new region map. After that clean our TSB entries.
14196 */
14197 scdp = sfmmup->sfmmu_scdp;
14198 if (scdp != NULL &&
14199 SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14200 sfmmu_leave_scd(sfmmup, r_type);
14201 ASSERT(sfmmu_hat_lock_held(sfmmup));
14202 }
14203 sfmmu_invalidate_ctx(sfmmup);
14204
14205 i = TTE8K;
14206 while (i < mmu_page_sizes) {
14207 if (rgnp->rgn_ttecnt[i] != 0) {
14208 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14209 r_eaddr, i);
14210 if (i < TTE4M) {
14211 i = TTE4M;
14212 continue;
14213 } else {
14214 break;
14215 }
14216 }
14217 i++;
14218 }
14219 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14220 if (r_pgszc >= TTE4M) {
14221 rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14222 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14223 rttecnt);
14224 sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14225 }
14226
14227 /* update shme rgns ttecnt in sfmmu_ttecnt */
14228 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14229 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14230 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14231
14232 sfmmu_hat_exit(hatlockp);
14233 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14234 /* sfmmup left the scd, grow private tsb */
14235 sfmmu_check_page_sizes(sfmmup, 1);
14236 } else {
14237 sfmmu_check_page_sizes(sfmmup, 0);
14238 }
14239 }
14240
14241 if (r_type == SFMMU_REGION_HME) {
14242 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14243 }
14244
14245 r_obj = rgnp->rgn_obj;
14246 if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14247 return;
14248 }
14249
14250 /*
14251 * looks like nobody uses this region anymore. Free it.
14252 */
14253 rhash = RGN_HASH_FUNCTION(r_obj);
14254 mutex_enter(&srdp->srd_mutex);
14255 for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14256 (cur_rgnp = *prev_rgnpp) != NULL;
14257 prev_rgnpp = &cur_rgnp->rgn_hash) {
14258 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14259 break;
14260 }
14261 }
14262
14263 if (cur_rgnp == NULL) {
14264 mutex_exit(&srdp->srd_mutex);
14265 return;
14266 }
14267
14268 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14269 *prev_rgnpp = rgnp->rgn_hash;
14270 if (r_type == SFMMU_REGION_ISM) {
14271 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14272 ASSERT(rid < srdp->srd_next_ismrid);
14273 rgnp->rgn_next = srdp->srd_ismrgnfree;
14274 srdp->srd_ismrgnfree = rgnp;
14275 ASSERT(srdp->srd_ismbusyrgns > 0);
14276 srdp->srd_ismbusyrgns--;
14277 mutex_exit(&srdp->srd_mutex);
14278 return;
14279 }
14280 mutex_exit(&srdp->srd_mutex);
14281
14282 /*
14283 * Destroy region's hmeblks.
14284 */
14285 sfmmu_unload_hmeregion(srdp, rgnp);
14286
14287 rgnp->rgn_hmeflags = 0;
14288
14289 ASSERT(rgnp->rgn_sfmmu_head == NULL);
14290 ASSERT(rgnp->rgn_id == rid);
14291 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14292 rgnp->rgn_ttecnt[i] = 0;
14293 }
14294 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14295 mutex_enter(&srdp->srd_mutex);
14296 ASSERT(rid < srdp->srd_next_hmerid);
14297 rgnp->rgn_next = srdp->srd_hmergnfree;
14298 srdp->srd_hmergnfree = rgnp;
14299 ASSERT(srdp->srd_hmebusyrgns > 0);
14300 srdp->srd_hmebusyrgns--;
14301 mutex_exit(&srdp->srd_mutex);
14302 }
14303
14304 /*
14305 * For now only called for hmeblk regions and not for ISM regions.
14306 */
14307 void
14308 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14309 {
14310 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14311 uint_t rid = (uint_t)((uint64_t)rcookie);
14312 sf_region_t *rgnp;
14313 sf_rgn_link_t *rlink;
14314 sf_rgn_link_t *hrlink;
14315 ulong_t rttecnt;
14316
14317 ASSERT(sfmmup != ksfmmup);
14318 ASSERT(srdp != NULL);
14319 ASSERT(srdp->srd_refcnt > 0);
14320
14321 ASSERT(rid < srdp->srd_next_hmerid);
14322 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14323 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14324
14325 rgnp = srdp->srd_hmergnp[rid];
14326 ASSERT(rgnp->rgn_refcnt > 0);
14327 ASSERT(rgnp->rgn_id == rid);
14328 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14329 ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14330
14331 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14332
14333 /* LINTED: constant in conditional context */
14334 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14335 ASSERT(rlink != NULL);
14336 mutex_enter(&rgnp->rgn_mutex);
14337 ASSERT(rgnp->rgn_sfmmu_head != NULL);
14338 /* LINTED: constant in conditional context */
14339 SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14340 ASSERT(hrlink != NULL);
14341 ASSERT(hrlink->prev == NULL);
14342 rlink->next = rgnp->rgn_sfmmu_head;
14343 rlink->prev = NULL;
14344 hrlink->prev = sfmmup;
14345 /*
14346 * make sure rlink's next field is correct
14347 * before making this link visible.
14348 */
14349 membar_stst();
14350 rgnp->rgn_sfmmu_head = sfmmup;
14351 mutex_exit(&rgnp->rgn_mutex);
14352
14353 /* update sfmmu_ttecnt with the shme rgn ttecnt */
14354 rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14355 atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14356 /* update tsb0 inflation count */
14357 if (rgnp->rgn_pgszc >= TTE4M) {
14358 sfmmup->sfmmu_tsb0_4minflcnt +=
14359 rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14360 }
14361 /*
14362 * Update regionid bitmask without hat lock since no other thread
14363 * can update this region bitmask right now.
14364 */
14365 SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14366 }
14367
14368 /* ARGSUSED */
14369 static int
14370 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14371 {
14372 sf_region_t *rgnp = (sf_region_t *)buf;
14373 bzero(buf, sizeof (*rgnp));
14374
14375 mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14376
14377 return (0);
14378 }
14379
14380 /* ARGSUSED */
14381 static void
14382 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14383 {
14384 sf_region_t *rgnp = (sf_region_t *)buf;
14385 mutex_destroy(&rgnp->rgn_mutex);
14386 }
14387
14388 static int
14389 sfrgnmap_isnull(sf_region_map_t *map)
14390 {
14391 int i;
14392
14393 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14394 if (map->bitmap[i] != 0) {
14395 return (0);
14396 }
14397 }
14398 return (1);
14399 }
14400
14401 static int
14402 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14403 {
14404 int i;
14405
14406 for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14407 if (map->bitmap[i] != 0) {
14408 return (0);
14409 }
14410 }
14411 return (1);
14412 }
14413
14414 #ifdef DEBUG
14415 static void
14416 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14417 {
14418 sfmmu_t *sp;
14419 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14420
14421 for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14422 ASSERT(srdp == sp->sfmmu_srdp);
14423 if (sp == sfmmup) {
14424 if (onlist) {
14425 return;
14426 } else {
14427 panic("shctx: sfmmu 0x%p found on scd"
14428 "list 0x%p", (void *)sfmmup,
14429 (void *)*headp);
14430 }
14431 }
14432 }
14433 if (onlist) {
14434 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14435 (void *)sfmmup, (void *)*headp);
14436 } else {
14437 return;
14438 }
14439 }
14440 #else /* DEBUG */
14441 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14442 #endif /* DEBUG */
14443
14444 /*
14445 * Removes an sfmmu from the SCD sfmmu list.
14446 */
14447 static void
14448 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14449 {
14450 ASSERT(sfmmup->sfmmu_srdp != NULL);
14451 check_scd_sfmmu_list(headp, sfmmup, 1);
14452 if (sfmmup->sfmmu_scd_link.prev != NULL) {
14453 ASSERT(*headp != sfmmup);
14454 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14455 sfmmup->sfmmu_scd_link.next;
14456 } else {
14457 ASSERT(*headp == sfmmup);
14458 *headp = sfmmup->sfmmu_scd_link.next;
14459 }
14460 if (sfmmup->sfmmu_scd_link.next != NULL) {
14461 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14462 sfmmup->sfmmu_scd_link.prev;
14463 }
14464 }
14465
14466
14467 /*
14468 * Adds an sfmmu to the start of the queue.
14469 */
14470 static void
14471 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14472 {
14473 check_scd_sfmmu_list(headp, sfmmup, 0);
14474 sfmmup->sfmmu_scd_link.prev = NULL;
14475 sfmmup->sfmmu_scd_link.next = *headp;
14476 if (*headp != NULL)
14477 (*headp)->sfmmu_scd_link.prev = sfmmup;
14478 *headp = sfmmup;
14479 }
14480
14481 /*
14482 * Remove an scd from the start of the queue.
14483 */
14484 static void
14485 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14486 {
14487 if (scdp->scd_prev != NULL) {
14488 ASSERT(*headp != scdp);
14489 scdp->scd_prev->scd_next = scdp->scd_next;
14490 } else {
14491 ASSERT(*headp == scdp);
14492 *headp = scdp->scd_next;
14493 }
14494
14495 if (scdp->scd_next != NULL) {
14496 scdp->scd_next->scd_prev = scdp->scd_prev;
14497 }
14498 }
14499
14500 /*
14501 * Add an scd to the start of the queue.
14502 */
14503 static void
14504 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14505 {
14506 scdp->scd_prev = NULL;
14507 scdp->scd_next = *headp;
14508 if (*headp != NULL) {
14509 (*headp)->scd_prev = scdp;
14510 }
14511 *headp = scdp;
14512 }
14513
14514 static int
14515 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14516 {
14517 uint_t rid;
14518 uint_t i;
14519 uint_t j;
14520 ulong_t w;
14521 sf_region_t *rgnp;
14522 ulong_t tte8k_cnt = 0;
14523 ulong_t tte4m_cnt = 0;
14524 uint_t tsb_szc;
14525 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14526 sfmmu_t *ism_hatid;
14527 struct tsb_info *newtsb;
14528 int szc;
14529
14530 ASSERT(srdp != NULL);
14531
14532 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14533 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14534 continue;
14535 }
14536 j = 0;
14537 while (w) {
14538 if (!(w & 0x1)) {
14539 j++;
14540 w >>= 1;
14541 continue;
14542 }
14543 rid = (i << BT_ULSHIFT) | j;
14544 j++;
14545 w >>= 1;
14546
14547 if (rid < SFMMU_MAX_HME_REGIONS) {
14548 rgnp = srdp->srd_hmergnp[rid];
14549 ASSERT(rgnp->rgn_id == rid);
14550 ASSERT(rgnp->rgn_refcnt > 0);
14551
14552 if (rgnp->rgn_pgszc < TTE4M) {
14553 tte8k_cnt += rgnp->rgn_size >>
14554 TTE_PAGE_SHIFT(TTE8K);
14555 } else {
14556 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14557 tte4m_cnt += rgnp->rgn_size >>
14558 TTE_PAGE_SHIFT(TTE4M);
14559 /*
14560 * Inflate SCD tsb0 by preallocating
14561 * 1/4 8k ttecnt for 4M regions to
14562 * allow for lgpg alloc failure.
14563 */
14564 tte8k_cnt += rgnp->rgn_size >>
14565 (TTE_PAGE_SHIFT(TTE8K) + 2);
14566 }
14567 } else {
14568 rid -= SFMMU_MAX_HME_REGIONS;
14569 rgnp = srdp->srd_ismrgnp[rid];
14570 ASSERT(rgnp->rgn_id == rid);
14571 ASSERT(rgnp->rgn_refcnt > 0);
14572
14573 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14574 ASSERT(ism_hatid->sfmmu_ismhat);
14575
14576 for (szc = 0; szc < TTE4M; szc++) {
14577 tte8k_cnt +=
14578 ism_hatid->sfmmu_ttecnt[szc] <<
14579 TTE_BSZS_SHIFT(szc);
14580 }
14581
14582 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14583 if (rgnp->rgn_pgszc >= TTE4M) {
14584 tte4m_cnt += rgnp->rgn_size >>
14585 TTE_PAGE_SHIFT(TTE4M);
14586 }
14587 }
14588 }
14589 }
14590
14591 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14592
14593 /* Allocate both the SCD TSBs here. */
14594 if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14595 tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14596 (tsb_szc <= TSB_4M_SZCODE ||
14597 sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14598 TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14599 TSB_ALLOC, scsfmmup))) {
14600
14601 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14602 return (TSB_ALLOCFAIL);
14603 } else {
14604 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14605
14606 if (tte4m_cnt) {
14607 tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14608 if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14609 TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14610 (tsb_szc <= TSB_4M_SZCODE ||
14611 sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14612 TSB4M|TSB32M|TSB256M,
14613 TSB_ALLOC, scsfmmup))) {
14614 /*
14615 * If we fail to allocate the 2nd shared tsb,
14616 * just free the 1st tsb, return failure.
14617 */
14618 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14619 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14620 return (TSB_ALLOCFAIL);
14621 } else {
14622 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14623 newtsb->tsb_flags |= TSB_SHAREDCTX;
14624 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14625 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14626 }
14627 }
14628 SFMMU_STAT(sf_scd_1sttsb_alloc);
14629 }
14630 return (TSB_SUCCESS);
14631 }
14632
14633 static void
14634 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14635 {
14636 while (scd_sfmmu->sfmmu_tsb != NULL) {
14637 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14638 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14639 scd_sfmmu->sfmmu_tsb = next;
14640 }
14641 }
14642
14643 /*
14644 * Link the sfmmu onto the hme region list.
14645 */
14646 void
14647 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14648 {
14649 uint_t rid;
14650 sf_rgn_link_t *rlink;
14651 sfmmu_t *head;
14652 sf_rgn_link_t *hrlink;
14653
14654 rid = rgnp->rgn_id;
14655 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14656
14657 /* LINTED: constant in conditional context */
14658 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14659 ASSERT(rlink != NULL);
14660 mutex_enter(&rgnp->rgn_mutex);
14661 if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14662 rlink->next = NULL;
14663 rlink->prev = NULL;
14664 /*
14665 * make sure rlink's next field is NULL
14666 * before making this link visible.
14667 */
14668 membar_stst();
14669 rgnp->rgn_sfmmu_head = sfmmup;
14670 } else {
14671 /* LINTED: constant in conditional context */
14672 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14673 ASSERT(hrlink != NULL);
14674 ASSERT(hrlink->prev == NULL);
14675 rlink->next = head;
14676 rlink->prev = NULL;
14677 hrlink->prev = sfmmup;
14678 /*
14679 * make sure rlink's next field is correct
14680 * before making this link visible.
14681 */
14682 membar_stst();
14683 rgnp->rgn_sfmmu_head = sfmmup;
14684 }
14685 mutex_exit(&rgnp->rgn_mutex);
14686 }
14687
14688 /*
14689 * Unlink the sfmmu from the hme region list.
14690 */
14691 void
14692 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14693 {
14694 uint_t rid;
14695 sf_rgn_link_t *rlink;
14696
14697 rid = rgnp->rgn_id;
14698 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14699
14700 /* LINTED: constant in conditional context */
14701 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14702 ASSERT(rlink != NULL);
14703 mutex_enter(&rgnp->rgn_mutex);
14704 if (rgnp->rgn_sfmmu_head == sfmmup) {
14705 sfmmu_t *next = rlink->next;
14706 rgnp->rgn_sfmmu_head = next;
14707 /*
14708 * if we are stopped by xc_attention() after this
14709 * point the forward link walking in
14710 * sfmmu_rgntlb_demap() will work correctly since the
14711 * head correctly points to the next element.
14712 */
14713 membar_stst();
14714 rlink->next = NULL;
14715 ASSERT(rlink->prev == NULL);
14716 if (next != NULL) {
14717 sf_rgn_link_t *nrlink;
14718 /* LINTED: constant in conditional context */
14719 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14720 ASSERT(nrlink != NULL);
14721 ASSERT(nrlink->prev == sfmmup);
14722 nrlink->prev = NULL;
14723 }
14724 } else {
14725 sfmmu_t *next = rlink->next;
14726 sfmmu_t *prev = rlink->prev;
14727 sf_rgn_link_t *prlink;
14728
14729 ASSERT(prev != NULL);
14730 /* LINTED: constant in conditional context */
14731 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14732 ASSERT(prlink != NULL);
14733 ASSERT(prlink->next == sfmmup);
14734 prlink->next = next;
14735 /*
14736 * if we are stopped by xc_attention()
14737 * after this point the forward link walking
14738 * will work correctly since the prev element
14739 * correctly points to the next element.
14740 */
14741 membar_stst();
14742 rlink->next = NULL;
14743 rlink->prev = NULL;
14744 if (next != NULL) {
14745 sf_rgn_link_t *nrlink;
14746 /* LINTED: constant in conditional context */
14747 SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14748 ASSERT(nrlink != NULL);
14749 ASSERT(nrlink->prev == sfmmup);
14750 nrlink->prev = prev;
14751 }
14752 }
14753 mutex_exit(&rgnp->rgn_mutex);
14754 }
14755
14756 /*
14757 * Link scd sfmmu onto ism or hme region list for each region in the
14758 * scd region map.
14759 */
14760 void
14761 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14762 {
14763 uint_t rid;
14764 uint_t i;
14765 uint_t j;
14766 ulong_t w;
14767 sf_region_t *rgnp;
14768 sfmmu_t *scsfmmup;
14769
14770 scsfmmup = scdp->scd_sfmmup;
14771 ASSERT(scsfmmup->sfmmu_scdhat);
14772 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14773 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14774 continue;
14775 }
14776 j = 0;
14777 while (w) {
14778 if (!(w & 0x1)) {
14779 j++;
14780 w >>= 1;
14781 continue;
14782 }
14783 rid = (i << BT_ULSHIFT) | j;
14784 j++;
14785 w >>= 1;
14786
14787 if (rid < SFMMU_MAX_HME_REGIONS) {
14788 rgnp = srdp->srd_hmergnp[rid];
14789 ASSERT(rgnp->rgn_id == rid);
14790 ASSERT(rgnp->rgn_refcnt > 0);
14791 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14792 } else {
14793 sfmmu_t *ism_hatid = NULL;
14794 ism_ment_t *ism_ment;
14795 rid -= SFMMU_MAX_HME_REGIONS;
14796 rgnp = srdp->srd_ismrgnp[rid];
14797 ASSERT(rgnp->rgn_id == rid);
14798 ASSERT(rgnp->rgn_refcnt > 0);
14799
14800 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14801 ASSERT(ism_hatid->sfmmu_ismhat);
14802 ism_ment = &scdp->scd_ism_links[rid];
14803 ism_ment->iment_hat = scsfmmup;
14804 ism_ment->iment_base_va = rgnp->rgn_saddr;
14805 mutex_enter(&ism_mlist_lock);
14806 iment_add(ism_ment, ism_hatid);
14807 mutex_exit(&ism_mlist_lock);
14808
14809 }
14810 }
14811 }
14812 }
14813 /*
14814 * Unlink scd sfmmu from ism or hme region list for each region in the
14815 * scd region map.
14816 */
14817 void
14818 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14819 {
14820 uint_t rid;
14821 uint_t i;
14822 uint_t j;
14823 ulong_t w;
14824 sf_region_t *rgnp;
14825 sfmmu_t *scsfmmup;
14826
14827 scsfmmup = scdp->scd_sfmmup;
14828 for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14829 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14830 continue;
14831 }
14832 j = 0;
14833 while (w) {
14834 if (!(w & 0x1)) {
14835 j++;
14836 w >>= 1;
14837 continue;
14838 }
14839 rid = (i << BT_ULSHIFT) | j;
14840 j++;
14841 w >>= 1;
14842
14843 if (rid < SFMMU_MAX_HME_REGIONS) {
14844 rgnp = srdp->srd_hmergnp[rid];
14845 ASSERT(rgnp->rgn_id == rid);
14846 ASSERT(rgnp->rgn_refcnt > 0);
14847 sfmmu_unlink_from_hmeregion(scsfmmup,
14848 rgnp);
14849
14850 } else {
14851 sfmmu_t *ism_hatid = NULL;
14852 ism_ment_t *ism_ment;
14853 rid -= SFMMU_MAX_HME_REGIONS;
14854 rgnp = srdp->srd_ismrgnp[rid];
14855 ASSERT(rgnp->rgn_id == rid);
14856 ASSERT(rgnp->rgn_refcnt > 0);
14857
14858 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14859 ASSERT(ism_hatid->sfmmu_ismhat);
14860 ism_ment = &scdp->scd_ism_links[rid];
14861 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
14862 ASSERT(ism_ment->iment_base_va ==
14863 rgnp->rgn_saddr);
14864 mutex_enter(&ism_mlist_lock);
14865 iment_sub(ism_ment, ism_hatid);
14866 mutex_exit(&ism_mlist_lock);
14867
14868 }
14869 }
14870 }
14871 }
14872 /*
14873 * Allocates and initialises a new SCD structure, this is called with
14874 * the srd_scd_mutex held and returns with the reference count
14875 * initialised to 1.
14876 */
14877 static sf_scd_t *
14878 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
14879 {
14880 sf_scd_t *new_scdp;
14881 sfmmu_t *scsfmmup;
14882 int i;
14883
14884 ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
14885 new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
14886
14887 scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
14888 new_scdp->scd_sfmmup = scsfmmup;
14889 scsfmmup->sfmmu_srdp = srdp;
14890 scsfmmup->sfmmu_scdp = new_scdp;
14891 scsfmmup->sfmmu_tsb0_4minflcnt = 0;
14892 scsfmmup->sfmmu_scdhat = 1;
14893 CPUSET_ALL(scsfmmup->sfmmu_cpusran);
14894 bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
14895
14896 ASSERT(max_mmu_ctxdoms > 0);
14897 for (i = 0; i < max_mmu_ctxdoms; i++) {
14898 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
14899 scsfmmup->sfmmu_ctxs[i].gnum = 0;
14900 }
14901
14902 for (i = 0; i < MMU_PAGE_SIZES; i++) {
14903 new_scdp->scd_rttecnt[i] = 0;
14904 }
14905
14906 new_scdp->scd_region_map = *new_map;
14907 new_scdp->scd_refcnt = 1;
14908 if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
14909 kmem_cache_free(scd_cache, new_scdp);
14910 kmem_cache_free(sfmmuid_cache, scsfmmup);
14911 return (NULL);
14912 }
14913 if (&mmu_init_scd) {
14914 mmu_init_scd(new_scdp);
14915 }
14916 return (new_scdp);
14917 }
14918
14919 /*
14920 * The first phase of a process joining an SCD. The hat structure is
14921 * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
14922 * and a cross-call with context invalidation is used to cause the
14923 * remaining work to be carried out in the sfmmu_tsbmiss_exception()
14924 * routine.
14925 */
14926 static void
14927 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
14928 {
14929 hatlock_t *hatlockp;
14930 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14931 int i;
14932 sf_scd_t *old_scdp;
14933
14934 ASSERT(srdp != NULL);
14935 ASSERT(scdp != NULL);
14936 ASSERT(scdp->scd_refcnt > 0);
14937 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14938
14939 if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
14940 ASSERT(old_scdp != scdp);
14941
14942 mutex_enter(&old_scdp->scd_mutex);
14943 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
14944 mutex_exit(&old_scdp->scd_mutex);
14945 /*
14946 * sfmmup leaves the old scd. Update sfmmu_ttecnt to
14947 * include the shme rgn ttecnt for rgns that
14948 * were in the old SCD
14949 */
14950 for (i = 0; i < mmu_page_sizes; i++) {
14951 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14952 old_scdp->scd_rttecnt[i]);
14953 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14954 sfmmup->sfmmu_scdrttecnt[i]);
14955 }
14956 }
14957
14958 /*
14959 * Move sfmmu to the scd lists.
14960 */
14961 mutex_enter(&scdp->scd_mutex);
14962 sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
14963 mutex_exit(&scdp->scd_mutex);
14964 SF_SCD_INCR_REF(scdp);
14965
14966 hatlockp = sfmmu_hat_enter(sfmmup);
14967 /*
14968 * For a multi-thread process, we must stop
14969 * all the other threads before joining the scd.
14970 */
14971
14972 SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
14973
14974 sfmmu_invalidate_ctx(sfmmup);
14975 sfmmup->sfmmu_scdp = scdp;
14976
14977 /*
14978 * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
14979 * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
14980 */
14981 for (i = 0; i < mmu_page_sizes; i++) {
14982 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
14983 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
14984 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14985 -sfmmup->sfmmu_scdrttecnt[i]);
14986 }
14987 /* update tsb0 inflation count */
14988 if (old_scdp != NULL) {
14989 sfmmup->sfmmu_tsb0_4minflcnt +=
14990 old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14991 }
14992 ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14993 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
14994 sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14995
14996 sfmmu_hat_exit(hatlockp);
14997
14998 if (old_scdp != NULL) {
14999 SF_SCD_DECR_REF(srdp, old_scdp);
15000 }
15001
15002 }
15003
15004 /*
15005 * This routine is called by a process to become part of an SCD. It is called
15006 * from sfmmu_tsbmiss_exception() once most of the initial work has been
15007 * done by sfmmu_join_scd(). This routine must not drop the hat lock.
15008 */
15009 static void
15010 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
15011 {
15012 struct tsb_info *tsbinfop;
15013
15014 ASSERT(sfmmu_hat_lock_held(sfmmup));
15015 ASSERT(sfmmup->sfmmu_scdp != NULL);
15016 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
15017 ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15018 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15019
15020 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15021 tsbinfop = tsbinfop->tsb_next) {
15022 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15023 continue;
15024 }
15025 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15026
15027 sfmmu_inv_tsb(tsbinfop->tsb_va,
15028 TSB_BYTES(tsbinfop->tsb_szc));
15029 }
15030
15031 /* Set HAT_CTX1_FLAG for all SCD ISMs */
15032 sfmmu_ism_hatflags(sfmmup, 1);
15033
15034 SFMMU_STAT(sf_join_scd);
15035 }
15036
15037 /*
15038 * This routine is called in order to check if there is an SCD which matches
15039 * the process's region map if not then a new SCD may be created.
15040 */
15041 static void
15042 sfmmu_find_scd(sfmmu_t *sfmmup)
15043 {
15044 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15045 sf_scd_t *scdp, *new_scdp;
15046 int ret;
15047
15048 ASSERT(srdp != NULL);
15049 ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15050
15051 mutex_enter(&srdp->srd_scd_mutex);
15052 for (scdp = srdp->srd_scdp; scdp != NULL;
15053 scdp = scdp->scd_next) {
15054 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15055 &sfmmup->sfmmu_region_map, ret);
15056 if (ret == 1) {
15057 SF_SCD_INCR_REF(scdp);
15058 mutex_exit(&srdp->srd_scd_mutex);
15059 sfmmu_join_scd(scdp, sfmmup);
15060 ASSERT(scdp->scd_refcnt >= 2);
15061 atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
15062 return;
15063 } else {
15064 /*
15065 * If the sfmmu region map is a subset of the scd
15066 * region map, then the assumption is that this process
15067 * will continue attaching to ISM segments until the
15068 * region maps are equal.
15069 */
15070 SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15071 &sfmmup->sfmmu_region_map, ret);
15072 if (ret == 1) {
15073 mutex_exit(&srdp->srd_scd_mutex);
15074 return;
15075 }
15076 }
15077 }
15078
15079 ASSERT(scdp == NULL);
15080 /*
15081 * No matching SCD has been found, create a new one.
15082 */
15083 if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15084 NULL) {
15085 mutex_exit(&srdp->srd_scd_mutex);
15086 return;
15087 }
15088
15089 /*
15090 * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15091 */
15092
15093 /* Set scd_rttecnt for shme rgns in SCD */
15094 sfmmu_set_scd_rttecnt(srdp, new_scdp);
15095
15096 /*
15097 * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15098 */
15099 sfmmu_link_scd_to_regions(srdp, new_scdp);
15100 sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15101 SFMMU_STAT_ADD(sf_create_scd, 1);
15102
15103 mutex_exit(&srdp->srd_scd_mutex);
15104 sfmmu_join_scd(new_scdp, sfmmup);
15105 ASSERT(new_scdp->scd_refcnt >= 2);
15106 atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
15107 }
15108
15109 /*
15110 * This routine is called by a process to remove itself from an SCD. It is
15111 * either called when the processes has detached from a segment or from
15112 * hat_free_start() as a result of calling exit.
15113 */
15114 static void
15115 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15116 {
15117 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15118 sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15119 hatlock_t *hatlockp = TSB_HASH(sfmmup);
15120 int i;
15121
15122 ASSERT(scdp != NULL);
15123 ASSERT(srdp != NULL);
15124
15125 if (sfmmup->sfmmu_free) {
15126 /*
15127 * If the process is part of an SCD the sfmmu is unlinked
15128 * from scd_sf_list.
15129 */
15130 mutex_enter(&scdp->scd_mutex);
15131 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15132 mutex_exit(&scdp->scd_mutex);
15133 /*
15134 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15135 * are about to leave the SCD
15136 */
15137 for (i = 0; i < mmu_page_sizes; i++) {
15138 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15139 scdp->scd_rttecnt[i]);
15140 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15141 sfmmup->sfmmu_scdrttecnt[i]);
15142 sfmmup->sfmmu_scdrttecnt[i] = 0;
15143 }
15144 sfmmup->sfmmu_scdp = NULL;
15145
15146 SF_SCD_DECR_REF(srdp, scdp);
15147 return;
15148 }
15149
15150 ASSERT(r_type != SFMMU_REGION_ISM ||
15151 SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15152 ASSERT(scdp->scd_refcnt);
15153 ASSERT(!sfmmup->sfmmu_free);
15154 ASSERT(sfmmu_hat_lock_held(sfmmup));
15155 ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15156
15157 /*
15158 * Wait for ISM maps to be updated.
15159 */
15160 if (r_type != SFMMU_REGION_ISM) {
15161 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15162 sfmmup->sfmmu_scdp != NULL) {
15163 cv_wait(&sfmmup->sfmmu_tsb_cv,
15164 HATLOCK_MUTEXP(hatlockp));
15165 }
15166
15167 if (sfmmup->sfmmu_scdp == NULL) {
15168 sfmmu_hat_exit(hatlockp);
15169 return;
15170 }
15171 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15172 }
15173
15174 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15175 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15176 /*
15177 * Since HAT_JOIN_SCD was set our context
15178 * is still invalid.
15179 */
15180 } else {
15181 /*
15182 * For a multi-thread process, we must stop
15183 * all the other threads before leaving the scd.
15184 */
15185
15186 sfmmu_invalidate_ctx(sfmmup);
15187 }
15188
15189 /* Clear all the rid's for ISM, delete flags, etc */
15190 ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15191 sfmmu_ism_hatflags(sfmmup, 0);
15192
15193 /*
15194 * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15195 * are in SCD before this sfmmup leaves the SCD.
15196 */
15197 for (i = 0; i < mmu_page_sizes; i++) {
15198 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15199 scdp->scd_rttecnt[i]);
15200 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15201 sfmmup->sfmmu_scdrttecnt[i]);
15202 sfmmup->sfmmu_scdrttecnt[i] = 0;
15203 /* update ismttecnt to include SCD ism before hat leaves SCD */
15204 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15205 sfmmup->sfmmu_scdismttecnt[i] = 0;
15206 }
15207 /* update tsb0 inflation count */
15208 sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15209
15210 if (r_type != SFMMU_REGION_ISM) {
15211 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15212 }
15213 sfmmup->sfmmu_scdp = NULL;
15214
15215 sfmmu_hat_exit(hatlockp);
15216
15217 /*
15218 * Unlink sfmmu from scd_sf_list this can be done without holding
15219 * the hat lock as we hold the sfmmu_as lock which prevents
15220 * hat_join_region from adding this thread to the scd again. Other
15221 * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15222 * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15223 * while holding the hat lock.
15224 */
15225 mutex_enter(&scdp->scd_mutex);
15226 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15227 mutex_exit(&scdp->scd_mutex);
15228 SFMMU_STAT(sf_leave_scd);
15229
15230 SF_SCD_DECR_REF(srdp, scdp);
15231 hatlockp = sfmmu_hat_enter(sfmmup);
15232
15233 }
15234
15235 /*
15236 * Unlink and free up an SCD structure with a reference count of 0.
15237 */
15238 static void
15239 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15240 {
15241 sfmmu_t *scsfmmup;
15242 sf_scd_t *sp;
15243 hatlock_t *shatlockp;
15244 int i, ret;
15245
15246 mutex_enter(&srdp->srd_scd_mutex);
15247 for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15248 if (sp == scdp)
15249 break;
15250 }
15251 if (sp == NULL || sp->scd_refcnt) {
15252 mutex_exit(&srdp->srd_scd_mutex);
15253 return;
15254 }
15255
15256 /*
15257 * It is possible that the scd has been freed and reallocated with a
15258 * different region map while we've been waiting for the srd_scd_mutex.
15259 */
15260 SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15261 if (ret != 1) {
15262 mutex_exit(&srdp->srd_scd_mutex);
15263 return;
15264 }
15265
15266 ASSERT(scdp->scd_sf_list == NULL);
15267 /*
15268 * Unlink scd from srd_scdp list.
15269 */
15270 sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15271 mutex_exit(&srdp->srd_scd_mutex);
15272
15273 sfmmu_unlink_scd_from_regions(srdp, scdp);
15274
15275 /* Clear shared context tsb and release ctx */
15276 scsfmmup = scdp->scd_sfmmup;
15277
15278 /*
15279 * create a barrier so that scd will not be destroyed
15280 * if other thread still holds the same shared hat lock.
15281 * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15282 * shared hat lock before checking the shared tsb reloc flag.
15283 */
15284 shatlockp = sfmmu_hat_enter(scsfmmup);
15285 sfmmu_hat_exit(shatlockp);
15286
15287 sfmmu_free_scd_tsbs(scsfmmup);
15288
15289 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15290 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15291 kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15292 SFMMU_L2_HMERLINKS_SIZE);
15293 scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15294 }
15295 }
15296 kmem_cache_free(sfmmuid_cache, scsfmmup);
15297 kmem_cache_free(scd_cache, scdp);
15298 SFMMU_STAT(sf_destroy_scd);
15299 }
15300
15301 /*
15302 * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15303 * bits which are set in the ism_region_map parameter. This flag indicates to
15304 * the tsbmiss handler that mapping for these segments should be loaded using
15305 * the shared context.
15306 */
15307 static void
15308 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15309 {
15310 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15311 ism_blk_t *ism_blkp;
15312 ism_map_t *ism_map;
15313 int i, rid;
15314
15315 ASSERT(sfmmup->sfmmu_iblk != NULL);
15316 ASSERT(scdp != NULL);
15317 /*
15318 * Note that the caller either set HAT_ISMBUSY flag or checked
15319 * under hat lock that HAT_ISMBUSY was not set by another thread.
15320 */
15321 ASSERT(sfmmu_hat_lock_held(sfmmup));
15322
15323 ism_blkp = sfmmup->sfmmu_iblk;
15324 while (ism_blkp != NULL) {
15325 ism_map = ism_blkp->iblk_maps;
15326 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15327 rid = ism_map[i].imap_rid;
15328 if (rid == SFMMU_INVALID_ISMRID) {
15329 continue;
15330 }
15331 ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15332 if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15333 addflag) {
15334 ism_map[i].imap_hatflags |=
15335 HAT_CTX1_FLAG;
15336 } else {
15337 ism_map[i].imap_hatflags &=
15338 ~HAT_CTX1_FLAG;
15339 }
15340 }
15341 ism_blkp = ism_blkp->iblk_next;
15342 }
15343 }
15344
15345 static int
15346 sfmmu_srd_lock_held(sf_srd_t *srdp)
15347 {
15348 return (MUTEX_HELD(&srdp->srd_mutex));
15349 }
15350
15351 /* ARGSUSED */
15352 static int
15353 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15354 {
15355 sf_scd_t *scdp = (sf_scd_t *)buf;
15356
15357 bzero(buf, sizeof (sf_scd_t));
15358 mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15359 return (0);
15360 }
15361
15362 /* ARGSUSED */
15363 static void
15364 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15365 {
15366 sf_scd_t *scdp = (sf_scd_t *)buf;
15367
15368 mutex_destroy(&scdp->scd_mutex);
15369 }
15370
15371 /*
15372 * The listp parameter is a pointer to a list of hmeblks which are partially
15373 * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15374 * freeing process is to cross-call all cpus to ensure that there are no
15375 * remaining cached references.
15376 *
15377 * If the local generation number is less than the global then we can free
15378 * hmeblks which are already on the pending queue as another cpu has completed
15379 * the cross-call.
15380 *
15381 * We cross-call to make sure that there are no threads on other cpus accessing
15382 * these hmblks and then complete the process of freeing them under the
15383 * following conditions:
15384 * The total number of pending hmeblks is greater than the threshold
15385 * The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15386 * It is at least 1 second since the last time we cross-called
15387 *
15388 * Otherwise, we add the hmeblks to the per-cpu pending queue.
15389 */
15390 static void
15391 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15392 {
15393 struct hme_blk *hblkp, *pr_hblkp = NULL;
15394 int count = 0;
15395 cpuset_t cpuset = cpu_ready_set;
15396 cpu_hme_pend_t *cpuhp;
15397 timestruc_t now;
15398 int one_second_expired = 0;
15399
15400 gethrestime_lasttick(&now);
15401
15402 for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15403 ASSERT(hblkp->hblk_shw_bit == 0);
15404 ASSERT(hblkp->hblk_shared == 0);
15405 count++;
15406 pr_hblkp = hblkp;
15407 }
15408
15409 cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15410 mutex_enter(&cpuhp->chp_mutex);
15411
15412 if ((cpuhp->chp_count + count) == 0) {
15413 mutex_exit(&cpuhp->chp_mutex);
15414 return;
15415 }
15416
15417 if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15418 one_second_expired = 1;
15419 }
15420
15421 if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15422 (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15423 one_second_expired)) {
15424 /* Append global list to local */
15425 if (pr_hblkp == NULL) {
15426 *listp = cpuhp->chp_listp;
15427 } else {
15428 pr_hblkp->hblk_next = cpuhp->chp_listp;
15429 }
15430 cpuhp->chp_listp = NULL;
15431 cpuhp->chp_count = 0;
15432 cpuhp->chp_timestamp = now.tv_sec;
15433 mutex_exit(&cpuhp->chp_mutex);
15434
15435 kpreempt_disable();
15436 CPUSET_DEL(cpuset, CPU->cpu_id);
15437 xt_sync(cpuset);
15438 xt_sync(cpuset);
15439 kpreempt_enable();
15440
15441 /*
15442 * At this stage we know that no trap handlers on other
15443 * cpus can have references to hmeblks on the list.
15444 */
15445 sfmmu_hblk_free(listp);
15446 } else if (*listp != NULL) {
15447 pr_hblkp->hblk_next = cpuhp->chp_listp;
15448 cpuhp->chp_listp = *listp;
15449 cpuhp->chp_count += count;
15450 *listp = NULL;
15451 mutex_exit(&cpuhp->chp_mutex);
15452 } else {
15453 mutex_exit(&cpuhp->chp_mutex);
15454 }
15455 }
15456
15457 /*
15458 * Add an hmeblk to the the hash list.
15459 */
15460 void
15461 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15462 uint64_t hblkpa)
15463 {
15464 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15465 #ifdef DEBUG
15466 if (hmebp->hmeblkp == NULL) {
15467 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15468 }
15469 #endif /* DEBUG */
15470
15471 hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15472 /*
15473 * Since the TSB miss handler now does not lock the hash chain before
15474 * walking it, make sure that the hmeblks nextpa is globally visible
15475 * before we make the hmeblk globally visible by updating the chain root
15476 * pointer in the hash bucket.
15477 */
15478 membar_producer();
15479 hmebp->hmeh_nextpa = hblkpa;
15480 hmeblkp->hblk_next = hmebp->hmeblkp;
15481 hmebp->hmeblkp = hmeblkp;
15482
15483 }
15484
15485 /*
15486 * This function is the first part of a 2 part process to remove an hmeblk
15487 * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15488 * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15489 * a per-cpu pending list using the virtual address pointer.
15490 *
15491 * TSB miss trap handlers that start after this phase will no longer see
15492 * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15493 * can still use it for further chain traversal because we haven't yet modifed
15494 * the next physical pointer or freed it.
15495 *
15496 * In the second phase of hmeblk removal we'll issue a barrier xcall before
15497 * we reuse or free this hmeblk. This will make sure all lingering references to
15498 * the hmeblk after first phase disappear before we finally reclaim it.
15499 * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15500 * during their traversal.
15501 *
15502 * The hmehash_mutex must be held when calling this function.
15503 *
15504 * Input:
15505 * hmebp - hme hash bucket pointer
15506 * hmeblkp - address of hmeblk to be removed
15507 * pr_hblk - virtual address of previous hmeblkp
15508 * listp - pointer to list of hmeblks linked by virtual address
15509 * free_now flag - indicates that a complete removal from the hash chains
15510 * is necessary.
15511 *
15512 * It is inefficient to use the free_now flag as a cross-call is required to
15513 * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15514 * in short supply.
15515 */
15516 void
15517 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15518 struct hme_blk *pr_hblk, struct hme_blk **listp,
15519 int free_now)
15520 {
15521 int shw_size, vshift;
15522 struct hme_blk *shw_hblkp;
15523 uint_t shw_mask, newshw_mask;
15524 caddr_t vaddr;
15525 int size;
15526 cpuset_t cpuset = cpu_ready_set;
15527
15528 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15529
15530 if (hmebp->hmeblkp == hmeblkp) {
15531 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15532 hmebp->hmeblkp = hmeblkp->hblk_next;
15533 } else {
15534 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15535 pr_hblk->hblk_next = hmeblkp->hblk_next;
15536 }
15537
15538 size = get_hblk_ttesz(hmeblkp);
15539 shw_hblkp = hmeblkp->hblk_shadow;
15540 if (shw_hblkp) {
15541 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15542 ASSERT(!hmeblkp->hblk_shared);
15543 #ifdef DEBUG
15544 if (mmu_page_sizes == max_mmu_page_sizes) {
15545 ASSERT(size < TTE256M);
15546 } else {
15547 ASSERT(size < TTE4M);
15548 }
15549 #endif /* DEBUG */
15550
15551 shw_size = get_hblk_ttesz(shw_hblkp);
15552 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15553 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15554 ASSERT(vshift < 8);
15555 /*
15556 * Atomically clear shadow mask bit
15557 */
15558 do {
15559 shw_mask = shw_hblkp->hblk_shw_mask;
15560 ASSERT(shw_mask & (1 << vshift));
15561 newshw_mask = shw_mask & ~(1 << vshift);
15562 newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15563 shw_mask, newshw_mask);
15564 } while (newshw_mask != shw_mask);
15565 hmeblkp->hblk_shadow = NULL;
15566 }
15567 hmeblkp->hblk_shw_bit = 0;
15568
15569 if (hmeblkp->hblk_shared) {
15570 #ifdef DEBUG
15571 sf_srd_t *srdp;
15572 sf_region_t *rgnp;
15573 uint_t rid;
15574
15575 srdp = hblktosrd(hmeblkp);
15576 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15577 rid = hmeblkp->hblk_tag.htag_rid;
15578 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15579 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15580 rgnp = srdp->srd_hmergnp[rid];
15581 ASSERT(rgnp != NULL);
15582 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15583 #endif /* DEBUG */
15584 hmeblkp->hblk_shared = 0;
15585 }
15586 if (free_now) {
15587 kpreempt_disable();
15588 CPUSET_DEL(cpuset, CPU->cpu_id);
15589 xt_sync(cpuset);
15590 xt_sync(cpuset);
15591 kpreempt_enable();
15592
15593 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15594 hmeblkp->hblk_next = NULL;
15595 } else {
15596 /* Append hmeblkp to listp for processing later. */
15597 hmeblkp->hblk_next = *listp;
15598 *listp = hmeblkp;
15599 }
15600 }
15601
15602 /*
15603 * This routine is called when memory is in short supply and returns a free
15604 * hmeblk of the requested size from the cpu pending lists.
15605 */
15606 static struct hme_blk *
15607 sfmmu_check_pending_hblks(int size)
15608 {
15609 int i;
15610 struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15611 int found_hmeblk;
15612 cpuset_t cpuset = cpu_ready_set;
15613 cpu_hme_pend_t *cpuhp;
15614
15615 /* Flush cpu hblk pending queues */
15616 for (i = 0; i < NCPU; i++) {
15617 cpuhp = &cpu_hme_pend[i];
15618 if (cpuhp->chp_listp != NULL) {
15619 mutex_enter(&cpuhp->chp_mutex);
15620 if (cpuhp->chp_listp == NULL) {
15621 mutex_exit(&cpuhp->chp_mutex);
15622 continue;
15623 }
15624 found_hmeblk = 0;
15625 last_hmeblkp = NULL;
15626 for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15627 hmeblkp = hmeblkp->hblk_next) {
15628 if (get_hblk_ttesz(hmeblkp) == size) {
15629 if (last_hmeblkp == NULL) {
15630 cpuhp->chp_listp =
15631 hmeblkp->hblk_next;
15632 } else {
15633 last_hmeblkp->hblk_next =
15634 hmeblkp->hblk_next;
15635 }
15636 ASSERT(cpuhp->chp_count > 0);
15637 cpuhp->chp_count--;
15638 found_hmeblk = 1;
15639 break;
15640 } else {
15641 last_hmeblkp = hmeblkp;
15642 }
15643 }
15644 mutex_exit(&cpuhp->chp_mutex);
15645
15646 if (found_hmeblk) {
15647 kpreempt_disable();
15648 CPUSET_DEL(cpuset, CPU->cpu_id);
15649 xt_sync(cpuset);
15650 xt_sync(cpuset);
15651 kpreempt_enable();
15652 return (hmeblkp);
15653 }
15654 }
15655 }
15656 return (NULL);
15657 }