hwpmc_mod.c revision 156778
1/*-
2 * Copyright (c) 2003-2005 Joseph Koshy
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 */
27
28#include <sys/cdefs.h>
29__FBSDID("$FreeBSD: head/sys/dev/hwpmc/hwpmc_mod.c 156778 2006-03-16 16:32:56Z jkoshy $");
30
31#include <sys/param.h>
32#include <sys/eventhandler.h>
33#include <sys/jail.h>
34#include <sys/kernel.h>
35#include <sys/kthread.h>
36#include <sys/limits.h>
37#include <sys/lock.h>
38#include <sys/malloc.h>
39#include <sys/module.h>
40#include <sys/mutex.h>
41#include <sys/pmc.h>
42#include <sys/pmckern.h>
43#include <sys/pmclog.h>
44#include <sys/proc.h>
45#include <sys/queue.h>
46#include <sys/resourcevar.h>
47#include <sys/sched.h>
48#include <sys/signalvar.h>
49#include <sys/smp.h>
50#include <sys/sx.h>
51#include <sys/sysctl.h>
52#include <sys/sysent.h>
53#include <sys/systm.h>
54#include <sys/vnode.h>
55
56#include <machine/atomic.h>
57#include <machine/md_var.h>
58
59/*
60 * Types
61 */
62
63enum pmc_flags {
64	PMC_FLAG_NONE	  = 0x00, /* do nothing */
65	PMC_FLAG_REMOVE   = 0x01, /* atomically remove entry from hash */
66	PMC_FLAG_ALLOCATE = 0x02, /* add entry to hash if not found */
67};
68
69/*
70 * The offset in sysent where the syscall is allocated.
71 */
72
73static int pmc_syscall_num = NO_SYSCALL;
74struct pmc_cpu		**pmc_pcpu;	 /* per-cpu state */
75pmc_value_t		*pmc_pcpu_saved; /* saved PMC values: CSW handling */
76
77#define	PMC_PCPU_SAVED(C,R)	pmc_pcpu_saved[(R) + md->pmd_npmc*(C)]
78
79struct mtx_pool		*pmc_mtxpool;
80static int		*pmc_pmcdisp;	 /* PMC row dispositions */
81
82#define	PMC_ROW_DISP_IS_FREE(R)		(pmc_pmcdisp[(R)] == 0)
83#define	PMC_ROW_DISP_IS_THREAD(R)	(pmc_pmcdisp[(R)] > 0)
84#define	PMC_ROW_DISP_IS_STANDALONE(R)	(pmc_pmcdisp[(R)] < 0)
85
86#define	PMC_MARK_ROW_FREE(R) do {					  \
87	pmc_pmcdisp[(R)] = 0;						  \
88} while (0)
89
90#define	PMC_MARK_ROW_STANDALONE(R) do {					  \
91	KASSERT(pmc_pmcdisp[(R)] <= 0, ("[pmc,%d] row disposition error", \
92		    __LINE__));						  \
93	atomic_add_int(&pmc_pmcdisp[(R)], -1);				  \
94	KASSERT(pmc_pmcdisp[(R)] >= (-mp_ncpus), ("[pmc,%d] row "	  \
95		"disposition error", __LINE__));			  \
96} while (0)
97
98#define	PMC_UNMARK_ROW_STANDALONE(R) do { 				  \
99	atomic_add_int(&pmc_pmcdisp[(R)], 1);				  \
100	KASSERT(pmc_pmcdisp[(R)] <= 0, ("[pmc,%d] row disposition error", \
101		    __LINE__));						  \
102} while (0)
103
104#define	PMC_MARK_ROW_THREAD(R) do {					  \
105	KASSERT(pmc_pmcdisp[(R)] >= 0, ("[pmc,%d] row disposition error", \
106		    __LINE__));						  \
107	atomic_add_int(&pmc_pmcdisp[(R)], 1);				  \
108} while (0)
109
110#define	PMC_UNMARK_ROW_THREAD(R) do {					  \
111	atomic_add_int(&pmc_pmcdisp[(R)], -1);				  \
112	KASSERT(pmc_pmcdisp[(R)] >= 0, ("[pmc,%d] row disposition error", \
113		    __LINE__));						  \
114} while (0)
115
116
117/* various event handlers */
118static eventhandler_tag	pmc_exit_tag, pmc_fork_tag;
119
120/* Module statistics */
121struct pmc_op_getdriverstats pmc_stats;
122
123/* Machine/processor dependent operations */
124struct pmc_mdep  *md;
125
126/*
127 * Hash tables mapping owner processes and target threads to PMCs.
128 */
129
130struct mtx pmc_processhash_mtx;		/* spin mutex */
131static u_long pmc_processhashmask;
132static LIST_HEAD(pmc_processhash, pmc_process)	*pmc_processhash;
133
134/*
135 * Hash table of PMC owner descriptors.  This table is protected by
136 * the shared PMC "sx" lock.
137 */
138
139static u_long pmc_ownerhashmask;
140static LIST_HEAD(pmc_ownerhash, pmc_owner)	*pmc_ownerhash;
141
142/*
143 * List of PMC owners with system-wide sampling PMCs.
144 */
145
146static LIST_HEAD(, pmc_owner)			pmc_ss_owners;
147
148
149/*
150 * Prototypes
151 */
152
153#ifdef	DEBUG
154static int	pmc_debugflags_sysctl_handler(SYSCTL_HANDLER_ARGS);
155static int	pmc_debugflags_parse(char *newstr, char *fence);
156#endif
157
158static int	load(struct module *module, int cmd, void *arg);
159static int	pmc_attach_process(struct proc *p, struct pmc *pm);
160static struct pmc *pmc_allocate_pmc_descriptor(void);
161static struct pmc_owner *pmc_allocate_owner_descriptor(struct proc *p);
162static int	pmc_attach_one_process(struct proc *p, struct pmc *pm);
163static int	pmc_can_allocate_rowindex(struct proc *p, unsigned int ri,
164    int cpu);
165static int	pmc_can_attach(struct pmc *pm, struct proc *p);
166static void	pmc_cleanup(void);
167static int	pmc_detach_process(struct proc *p, struct pmc *pm);
168static int	pmc_detach_one_process(struct proc *p, struct pmc *pm,
169    int flags);
170static void	pmc_destroy_owner_descriptor(struct pmc_owner *po);
171static struct pmc_owner *pmc_find_owner_descriptor(struct proc *p);
172static int	pmc_find_pmc(pmc_id_t pmcid, struct pmc **pm);
173static struct pmc *pmc_find_pmc_descriptor_in_process(struct pmc_owner *po,
174    pmc_id_t pmc);
175static struct pmc_process *pmc_find_process_descriptor(struct proc *p,
176    uint32_t mode);
177static void	pmc_force_context_switch(void);
178static void	pmc_link_target_process(struct pmc *pm,
179    struct pmc_process *pp);
180static void	pmc_maybe_remove_owner(struct pmc_owner *po);
181static void	pmc_process_csw_in(struct thread *td);
182static void	pmc_process_csw_out(struct thread *td);
183static void	pmc_process_exit(void *arg, struct proc *p);
184static void	pmc_process_fork(void *arg, struct proc *p1,
185    struct proc *p2, int n);
186static void	pmc_process_samples(int cpu);
187static void	pmc_release_pmc_descriptor(struct pmc *pmc);
188static void	pmc_remove_owner(struct pmc_owner *po);
189static void	pmc_remove_process_descriptor(struct pmc_process *pp);
190static void	pmc_restore_cpu_binding(struct pmc_binding *pb);
191static void	pmc_save_cpu_binding(struct pmc_binding *pb);
192static void	pmc_select_cpu(int cpu);
193static int	pmc_start(struct pmc *pm);
194static int	pmc_stop(struct pmc *pm);
195static int	pmc_syscall_handler(struct thread *td, void *syscall_args);
196static void	pmc_unlink_target_process(struct pmc *pmc,
197    struct pmc_process *pp);
198
199/*
200 * Kernel tunables and sysctl(8) interface.
201 */
202
203SYSCTL_NODE(_kern, OID_AUTO, hwpmc, CTLFLAG_RW, 0, "HWPMC parameters");
204
205#ifdef	DEBUG
206struct pmc_debugflags pmc_debugflags = PMC_DEBUG_DEFAULT_FLAGS;
207char	pmc_debugstr[PMC_DEBUG_STRSIZE];
208TUNABLE_STR(PMC_SYSCTL_NAME_PREFIX "debugflags", pmc_debugstr,
209    sizeof(pmc_debugstr));
210SYSCTL_PROC(_kern_hwpmc, OID_AUTO, debugflags,
211    CTLTYPE_STRING|CTLFLAG_RW|CTLFLAG_TUN,
212    0, 0, pmc_debugflags_sysctl_handler, "A", "debug flags");
213#endif
214
215/*
216 * kern.hwpmc.hashrows -- determines the number of rows in the
217 * of the hash table used to look up threads
218 */
219
220static int pmc_hashsize = PMC_HASH_SIZE;
221TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "hashsize", &pmc_hashsize);
222SYSCTL_INT(_kern_hwpmc, OID_AUTO, hashsize, CTLFLAG_TUN|CTLFLAG_RD,
223    &pmc_hashsize, 0, "rows in hash tables");
224
225/*
226 * kern.hwpmc.nsamples --- number of PC samples per CPU
227 */
228
229static int pmc_nsamples = PMC_NSAMPLES;
230TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "nsamples", &pmc_nsamples);
231SYSCTL_INT(_kern_hwpmc, OID_AUTO, nsamples, CTLFLAG_TUN|CTLFLAG_RD,
232    &pmc_nsamples, 0, "number of PC samples per CPU");
233
234/*
235 * kern.hwpmc.mtxpoolsize -- number of mutexes in the mutex pool.
236 */
237
238static int pmc_mtxpool_size = PMC_MTXPOOL_SIZE;
239TUNABLE_INT(PMC_SYSCTL_NAME_PREFIX "mtxpoolsize", &pmc_mtxpool_size);
240SYSCTL_INT(_kern_hwpmc, OID_AUTO, mtxpoolsize, CTLFLAG_TUN|CTLFLAG_RD,
241    &pmc_mtxpool_size, 0, "size of spin mutex pool");
242
243
244/*
245 * security.bsd.unprivileged_syspmcs -- allow non-root processes to
246 * allocate system-wide PMCs.
247 *
248 * Allowing unprivileged processes to allocate system PMCs is convenient
249 * if system-wide measurements need to be taken concurrently with other
250 * per-process measurements.  This feature is turned off by default.
251 */
252
253SYSCTL_DECL(_security_bsd);
254
255static int pmc_unprivileged_syspmcs = 0;
256TUNABLE_INT("security.bsd.unprivileged_syspmcs", &pmc_unprivileged_syspmcs);
257SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_syspmcs, CTLFLAG_RW,
258    &pmc_unprivileged_syspmcs, 0,
259    "allow unprivileged process to allocate system PMCs");
260
261/*
262 * Hash function.  Discard the lower 2 bits of the pointer since
263 * these are always zero for our uses.  The hash multiplier is
264 * round((2^LONG_BIT) * ((sqrt(5)-1)/2)).
265 */
266
267#if	LONG_BIT == 64
268#define	_PMC_HM		11400714819323198486u
269#elif	LONG_BIT == 32
270#define	_PMC_HM		2654435769u
271#else
272#error 	Must know the size of 'long' to compile
273#endif
274
275#define	PMC_HASH_PTR(P,M)	((((unsigned long) (P) >> 2) * _PMC_HM) & (M))
276
277/*
278 * Syscall structures
279 */
280
281/* The `sysent' for the new syscall */
282static struct sysent pmc_sysent = {
283	2,			/* sy_narg */
284	pmc_syscall_handler	/* sy_call */
285};
286
287static struct syscall_module_data pmc_syscall_mod = {
288	load,
289	NULL,
290	&pmc_syscall_num,
291	&pmc_sysent,
292	{ 0, NULL }
293};
294
295static moduledata_t pmc_mod = {
296	PMC_MODULE_NAME,
297	syscall_module_handler,
298	&pmc_syscall_mod
299};
300
301DECLARE_MODULE(pmc, pmc_mod, SI_SUB_SMP, SI_ORDER_ANY);
302MODULE_VERSION(pmc, PMC_VERSION);
303
304#ifdef	DEBUG
305enum pmc_dbgparse_state {
306	PMCDS_WS,		/* in whitespace */
307	PMCDS_MAJOR,		/* seen a major keyword */
308	PMCDS_MINOR
309};
310
311static int
312pmc_debugflags_parse(char *newstr, char *fence)
313{
314	char c, *p, *q;
315	struct pmc_debugflags *tmpflags;
316	int error, found, *newbits, tmp;
317	size_t kwlen;
318
319	MALLOC(tmpflags, struct pmc_debugflags *, sizeof(*tmpflags),
320	    M_PMC, M_WAITOK|M_ZERO);
321
322	p = newstr;
323	error = 0;
324
325	for (; p < fence && (c = *p); p++) {
326
327		/* skip white space */
328		if (c == ' ' || c == '\t')
329			continue;
330
331		/* look for a keyword followed by "=" */
332		for (q = p; p < fence && (c = *p) && c != '='; p++)
333			;
334		if (c != '=') {
335			error = EINVAL;
336			goto done;
337		}
338
339		kwlen = p - q;
340		newbits = NULL;
341
342		/* lookup flag group name */
343#define	DBG_SET_FLAG_MAJ(S,F)						\
344		if (kwlen == sizeof(S)-1 && strncmp(q, S, kwlen) == 0)	\
345			newbits = &tmpflags->pdb_ ## F;
346
347		DBG_SET_FLAG_MAJ("cpu",		CPU);
348		DBG_SET_FLAG_MAJ("csw",		CSW);
349		DBG_SET_FLAG_MAJ("logging",	LOG);
350		DBG_SET_FLAG_MAJ("module",	MOD);
351		DBG_SET_FLAG_MAJ("md", 		MDP);
352		DBG_SET_FLAG_MAJ("owner",	OWN);
353		DBG_SET_FLAG_MAJ("pmc",		PMC);
354		DBG_SET_FLAG_MAJ("process",	PRC);
355		DBG_SET_FLAG_MAJ("sampling", 	SAM);
356
357		if (newbits == NULL) {
358			error = EINVAL;
359			goto done;
360		}
361
362		p++;		/* skip the '=' */
363
364		/* Now parse the individual flags */
365		tmp = 0;
366	newflag:
367		for (q = p; p < fence && (c = *p); p++)
368			if (c == ' ' || c == '\t' || c == ',')
369				break;
370
371		/* p == fence or c == ws or c == "," or c == 0 */
372
373		if ((kwlen = p - q) == 0) {
374			*newbits = tmp;
375			continue;
376		}
377
378		found = 0;
379#define	DBG_SET_FLAG_MIN(S,F)						\
380		if (kwlen == sizeof(S)-1 && strncmp(q, S, kwlen) == 0)	\
381			tmp |= found = (1 << PMC_DEBUG_MIN_ ## F)
382
383		/* a '*' denotes all possible flags in the group */
384		if (kwlen == 1 && *q == '*')
385			tmp = found = ~0;
386		/* look for individual flag names */
387		DBG_SET_FLAG_MIN("allocaterow", ALR);
388		DBG_SET_FLAG_MIN("allocate",	ALL);
389		DBG_SET_FLAG_MIN("attach",	ATT);
390		DBG_SET_FLAG_MIN("bind",	BND);
391		DBG_SET_FLAG_MIN("config",	CFG);
392		DBG_SET_FLAG_MIN("exec",	EXC);
393		DBG_SET_FLAG_MIN("exit",	EXT);
394		DBG_SET_FLAG_MIN("find",	FND);
395		DBG_SET_FLAG_MIN("flush",	FLS);
396		DBG_SET_FLAG_MIN("fork",	FRK);
397		DBG_SET_FLAG_MIN("getbuf",	GTB);
398		DBG_SET_FLAG_MIN("hook",	PMH);
399		DBG_SET_FLAG_MIN("init",	INI);
400		DBG_SET_FLAG_MIN("intr",	INT);
401		DBG_SET_FLAG_MIN("linktarget",	TLK);
402		DBG_SET_FLAG_MIN("mayberemove", OMR);
403		DBG_SET_FLAG_MIN("ops",		OPS);
404		DBG_SET_FLAG_MIN("read",	REA);
405		DBG_SET_FLAG_MIN("register",	REG);
406		DBG_SET_FLAG_MIN("release",	REL);
407		DBG_SET_FLAG_MIN("remove",	ORM);
408		DBG_SET_FLAG_MIN("sample",	SAM);
409		DBG_SET_FLAG_MIN("scheduleio",	SIO);
410		DBG_SET_FLAG_MIN("select",	SEL);
411		DBG_SET_FLAG_MIN("signal",	SIG);
412		DBG_SET_FLAG_MIN("swi",		SWI);
413		DBG_SET_FLAG_MIN("swo",		SWO);
414		DBG_SET_FLAG_MIN("start",	STA);
415		DBG_SET_FLAG_MIN("stop",	STO);
416		DBG_SET_FLAG_MIN("syscall",	PMS);
417		DBG_SET_FLAG_MIN("unlinktarget", TUL);
418		DBG_SET_FLAG_MIN("write",	WRI);
419		if (found == 0) {
420			/* unrecognized flag name */
421			error = EINVAL;
422			goto done;
423		}
424
425		if (c == 0 || c == ' ' || c == '\t') {	/* end of flag group */
426			*newbits = tmp;
427			continue;
428		}
429
430		p++;
431		goto newflag;
432	}
433
434	/* save the new flag set */
435	bcopy(tmpflags, &pmc_debugflags, sizeof(pmc_debugflags));
436
437 done:
438	FREE(tmpflags, M_PMC);
439	return error;
440}
441
442static int
443pmc_debugflags_sysctl_handler(SYSCTL_HANDLER_ARGS)
444{
445	char *fence, *newstr;
446	int error;
447	unsigned int n;
448
449	(void) arg1; (void) arg2; /* unused parameters */
450
451	n = sizeof(pmc_debugstr);
452	MALLOC(newstr, char *, n, M_PMC, M_ZERO|M_WAITOK);
453	(void) strlcpy(newstr, pmc_debugstr, n);
454
455	error = sysctl_handle_string(oidp, newstr, n, req);
456
457	/* if there is a new string, parse and copy it */
458	if (error == 0 && req->newptr != NULL) {
459		fence = newstr + (n < req->newlen ? n : req->newlen + 1);
460		if ((error = pmc_debugflags_parse(newstr, fence)) == 0)
461			(void) strlcpy(pmc_debugstr, newstr,
462			    sizeof(pmc_debugstr));
463	}
464
465	FREE(newstr, M_PMC);
466
467	return error;
468}
469#endif
470
471/*
472 * Concurrency Control
473 *
474 * The driver manages the following data structures:
475 *
476 *   - target process descriptors, one per target process
477 *   - owner process descriptors (and attached lists), one per owner process
478 *   - lookup hash tables for owner and target processes
479 *   - PMC descriptors (and attached lists)
480 *   - per-cpu hardware state
481 *   - the 'hook' variable through which the kernel calls into
482 *     this module
483 *   - the machine hardware state (managed by the MD layer)
484 *
485 * These data structures are accessed from:
486 *
487 * - thread context-switch code
488 * - interrupt handlers (possibly on multiple cpus)
489 * - kernel threads on multiple cpus running on behalf of user
490 *   processes doing system calls
491 * - this driver's private kernel threads
492 *
493 * = Locks and Locking strategy =
494 *
495 * The driver uses four locking strategies for its operation:
496 *
497 * - There is a 'global' SX lock "pmc_sx" that is used to protect
498 *   the its 'meta-data'.
499 *
500 *   Calls into the module (via syscall() or by the kernel) start with
501 *   this lock being held in exclusive mode.  Depending on the requested
502 *   operation, the lock may be downgraded to 'shared' mode to allow
503 *   more concurrent readers into the module.
504 *
505 *   This SX lock is held in exclusive mode for any operations that
506 *   modify the linkages between the driver's internal data structures.
507 *
508 *   The 'pmc_hook' function pointer is also protected by this lock.
509 *   It is only examined with the sx lock held in exclusive mode.  The
510 *   kernel module is allowed to be unloaded only with the sx lock
511 *   held in exclusive mode.  In normal syscall handling, after
512 *   acquiring the pmc_sx lock we first check that 'pmc_hook' is
513 *   non-null before proceeding.  This prevents races between the
514 *   thread unloading the module and other threads seeking to use the
515 *   module.
516 *
517 * - Lookups of target process structures and owner process structures
518 *   cannot use the global "pmc_sx" SX lock because these lookups need
519 *   to happen during context switches and in other critical sections
520 *   where sleeping is not allowed.  We protect these lookup tables
521 *   with their own private spin-mutexes, "pmc_processhash_mtx" and
522 *   "pmc_ownerhash_mtx".  These are 'leaf' mutexes, in that no other
523 *   lock is acquired with these locks held.
524 *
525 * - Interrupt handlers work in a lock free manner.  At interrupt
526 *   time, handlers look at the PMC pointer (phw->phw_pmc) configured
527 *   when the PMC was started.  If this pointer is NULL, the interrupt
528 *   is ignored after updating driver statistics.  We ensure that this
529 *   pointer is set (using an atomic operation if necessary) before the
530 *   PMC hardware is started.  Conversely, this pointer is unset atomically
531 *   only after the PMC hardware is stopped.
532 *
533 *   We ensure that everything needed for the operation of an
534 *   interrupt handler is available without it needing to acquire any
535 *   locks.  We also ensure that a PMC's software state is destroyed only
536 *   after the PMC is taken off hardware (on all CPUs).
537 *
538 * - Context-switch handling with process-private PMCs needs more
539 *   care.
540 *
541 *   A given process may be the target of multiple PMCs.  For example,
542 *   PMCATTACH and PMCDETACH may be requested by a process on one CPU
543 *   while the target process is running on another.  A PMC could also
544 *   be getting released because its owner is exiting.  We tackle
545 *   these situations in the following manner:
546 *
547 *   - each target process structure 'pmc_process' has an array
548 *     of 'struct pmc *' pointers, one for each hardware PMC.
549 *
550 *   - At context switch IN time, each "target" PMC in RUNNING state
551 *     gets started on hardware and a pointer to each PMC is copied into
552 *     the per-cpu phw array.  The 'runcount' for the PMC is
553 *     incremented.
554 *
555 *   - At context switch OUT time, all process-virtual PMCs are stopped
556 *     on hardware.  The saved value is added to the PMCs value field
557 *     only if the PMC is in a non-deleted state (the PMCs state could
558 *     have changed during the current time slice).
559 *
560 *     Note that since in-between a switch IN on a processor and a switch
561 *     OUT, the PMC could have been released on another CPU.  Therefore
562 *     context switch OUT always looks at the hardware state to turn
563 *     OFF PMCs and will update a PMC's saved value only if reachable
564 *     from the target process record.
565 *
566 *   - OP PMCRELEASE could be called on a PMC at any time (the PMC could
567 *     be attached to many processes at the time of the call and could
568 *     be active on multiple CPUs).
569 *
570 *     We prevent further scheduling of the PMC by marking it as in
571 *     state 'DELETED'.  If the runcount of the PMC is non-zero then
572 *     this PMC is currently running on a CPU somewhere.  The thread
573 *     doing the PMCRELEASE operation waits by repeatedly doing an
574 *     tsleep() till the runcount comes to zero.
575 *
576 */
577
578/*
579 * save the cpu binding of the current kthread
580 */
581
582static void
583pmc_save_cpu_binding(struct pmc_binding *pb)
584{
585	PMCDBG(CPU,BND,2, "%s", "save-cpu");
586	mtx_lock_spin(&sched_lock);
587	pb->pb_bound = sched_is_bound(curthread);
588	pb->pb_cpu   = curthread->td_oncpu;
589	mtx_unlock_spin(&sched_lock);
590	PMCDBG(CPU,BND,2, "save-cpu cpu=%d", pb->pb_cpu);
591}
592
593/*
594 * restore the cpu binding of the current thread
595 */
596
597static void
598pmc_restore_cpu_binding(struct pmc_binding *pb)
599{
600	PMCDBG(CPU,BND,2, "restore-cpu curcpu=%d restore=%d",
601	    curthread->td_oncpu, pb->pb_cpu);
602	mtx_lock_spin(&sched_lock);
603	if (pb->pb_bound)
604		sched_bind(curthread, pb->pb_cpu);
605	else
606		sched_unbind(curthread);
607	mtx_unlock_spin(&sched_lock);
608	PMCDBG(CPU,BND,2, "%s", "restore-cpu done");
609}
610
611/*
612 * move execution over the specified cpu and bind it there.
613 */
614
615static void
616pmc_select_cpu(int cpu)
617{
618	KASSERT(cpu >= 0 && cpu < mp_ncpus,
619	    ("[pmc,%d] bad cpu number %d", __LINE__, cpu));
620
621	/* never move to a disabled CPU */
622	KASSERT(pmc_cpu_is_disabled(cpu) == 0, ("[pmc,%d] selecting "
623	    "disabled CPU %d", __LINE__, cpu));
624
625	PMCDBG(CPU,SEL,2, "select-cpu cpu=%d", cpu);
626	mtx_lock_spin(&sched_lock);
627	sched_bind(curthread, cpu);
628	mtx_unlock_spin(&sched_lock);
629
630	KASSERT(curthread->td_oncpu == cpu,
631	    ("[pmc,%d] CPU not bound [cpu=%d, curr=%d]", __LINE__,
632		cpu, curthread->td_oncpu));
633
634	PMCDBG(CPU,SEL,2, "select-cpu cpu=%d ok", cpu);
635}
636
637/*
638 * Force a context switch.
639 *
640 * We do this by tsleep'ing for 1 tick -- invoking mi_switch() is not
641 * guaranteed to force a context switch.
642 */
643
644static void
645pmc_force_context_switch(void)
646{
647	u_char	curpri;
648
649	mtx_lock_spin(&sched_lock);
650	curpri = curthread->td_priority;
651	mtx_unlock_spin(&sched_lock);
652
653	(void) tsleep((void *) pmc_force_context_switch, curpri,
654	    "pmcctx", 1);
655
656}
657
658/*
659 * Get the file name for an executable.  This is a simple wrapper
660 * around vn_fullpath(9).
661 */
662
663static void
664pmc_getfilename(struct vnode *v, char **fullpath, char **freepath)
665{
666	struct thread *td;
667
668	td = curthread;
669	*fullpath = "unknown";
670	*freepath = NULL;
671	vn_lock(v, LK_CANRECURSE | LK_EXCLUSIVE | LK_RETRY, td);
672	vn_fullpath(td, v, fullpath, freepath);
673	VOP_UNLOCK(v, 0, td);
674}
675
676/*
677 * remove an process owning PMCs
678 */
679
680void
681pmc_remove_owner(struct pmc_owner *po)
682{
683	struct pmc *pm, *tmp;
684
685	sx_assert(&pmc_sx, SX_XLOCKED);
686
687	PMCDBG(OWN,ORM,1, "remove-owner po=%p", po);
688
689	/* Remove descriptor from the owner hash table */
690	LIST_REMOVE(po, po_next);
691
692	/* release all owned PMC descriptors */
693	LIST_FOREACH_SAFE(pm, &po->po_pmcs, pm_next, tmp) {
694		PMCDBG(OWN,ORM,2, "pmc=%p", pm);
695		KASSERT(pm->pm_owner == po,
696		    ("[pmc,%d] owner %p != po %p", __LINE__, pm->pm_owner, po));
697
698		pmc_release_pmc_descriptor(pm);	/* will unlink from the list */
699	}
700
701	KASSERT(po->po_sscount == 0,
702	    ("[pmc,%d] SS count not zero", __LINE__));
703	KASSERT(LIST_EMPTY(&po->po_pmcs),
704	    ("[pmc,%d] PMC list not empty", __LINE__));
705
706	/* de-configure the log file if present */
707	if (po->po_flags & PMC_PO_OWNS_LOGFILE)
708		pmclog_deconfigure_log(po);
709}
710
711/*
712 * remove an owner process record if all conditions are met.
713 */
714
715static void
716pmc_maybe_remove_owner(struct pmc_owner *po)
717{
718
719	PMCDBG(OWN,OMR,1, "maybe-remove-owner po=%p", po);
720
721	/*
722	 * Remove owner record if
723	 * - this process does not own any PMCs
724	 * - this process has not allocated a system-wide sampling buffer
725	 */
726
727	if (LIST_EMPTY(&po->po_pmcs) &&
728	    ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)) {
729		pmc_remove_owner(po);
730		pmc_destroy_owner_descriptor(po);
731	}
732}
733
734/*
735 * Add an association between a target process and a PMC.
736 */
737
738static void
739pmc_link_target_process(struct pmc *pm, struct pmc_process *pp)
740{
741	int ri;
742	struct pmc_target *pt;
743
744	sx_assert(&pmc_sx, SX_XLOCKED);
745
746	KASSERT(pm != NULL && pp != NULL,
747	    ("[pmc,%d] Null pm %p or pp %p", __LINE__, pm, pp));
748	KASSERT(PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)),
749	    ("[pmc,%d] Attaching a non-process-virtual pmc=%p to pid=%d",
750		__LINE__, pm, pp->pp_proc->p_pid));
751	KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < ((int) md->pmd_npmc - 1),
752	    ("[pmc,%d] Illegal reference count %d for process record %p",
753		__LINE__, pp->pp_refcnt, (void *) pp));
754
755	ri = PMC_TO_ROWINDEX(pm);
756
757	PMCDBG(PRC,TLK,1, "link-target pmc=%p ri=%d pmc-process=%p",
758	    pm, ri, pp);
759
760#ifdef	DEBUG
761	LIST_FOREACH(pt, &pm->pm_targets, pt_next)
762	    if (pt->pt_process == pp)
763		    KASSERT(0, ("[pmc,%d] pp %p already in pmc %p targets",
764				__LINE__, pp, pm));
765#endif
766
767	MALLOC(pt, struct pmc_target *, sizeof(struct pmc_target),
768	    M_PMC, M_ZERO|M_WAITOK);
769
770	pt->pt_process = pp;
771
772	LIST_INSERT_HEAD(&pm->pm_targets, pt, pt_next);
773
774	atomic_store_rel_ptr((uintptr_t *)&pp->pp_pmcs[ri].pp_pmc,
775	    (uintptr_t)pm);
776
777	if (pm->pm_owner->po_owner == pp->pp_proc)
778		pm->pm_flags |= PMC_F_ATTACHED_TO_OWNER;
779
780	/*
781	 * Initialize the per-process values at this row index.
782	 */
783	pp->pp_pmcs[ri].pp_pmcval = PMC_TO_MODE(pm) == PMC_MODE_TS ?
784	    pm->pm_sc.pm_reloadcount : 0;
785
786	pp->pp_refcnt++;
787
788}
789
790/*
791 * Removes the association between a target process and a PMC.
792 */
793
794static void
795pmc_unlink_target_process(struct pmc *pm, struct pmc_process *pp)
796{
797	int ri;
798	struct proc *p;
799	struct pmc_target *ptgt;
800
801	sx_assert(&pmc_sx, SX_XLOCKED);
802
803	KASSERT(pm != NULL && pp != NULL,
804	    ("[pmc,%d] Null pm %p or pp %p", __LINE__, pm, pp));
805
806	KASSERT(pp->pp_refcnt >= 1 && pp->pp_refcnt < (int) md->pmd_npmc,
807	    ("[pmc,%d] Illegal ref count %d on process record %p",
808		__LINE__, pp->pp_refcnt, (void *) pp));
809
810	ri = PMC_TO_ROWINDEX(pm);
811
812	PMCDBG(PRC,TUL,1, "unlink-target pmc=%p ri=%d pmc-process=%p",
813	    pm, ri, pp);
814
815	KASSERT(pp->pp_pmcs[ri].pp_pmc == pm,
816	    ("[pmc,%d] PMC ri %d mismatch pmc %p pp->[ri] %p", __LINE__,
817		ri, pm, pp->pp_pmcs[ri].pp_pmc));
818
819	pp->pp_pmcs[ri].pp_pmc = NULL;
820	pp->pp_pmcs[ri].pp_pmcval = (pmc_value_t) 0;
821
822	/* Remove owner-specific flags */
823	if (pm->pm_owner->po_owner == pp->pp_proc) {
824		pp->pp_flags &= ~PMC_PP_ENABLE_MSR_ACCESS;
825		pm->pm_flags &= ~PMC_F_ATTACHED_TO_OWNER;
826	}
827
828	pp->pp_refcnt--;
829
830	/* Remove the target process from the PMC structure */
831	LIST_FOREACH(ptgt, &pm->pm_targets, pt_next)
832		if (ptgt->pt_process == pp)
833			break;
834
835	KASSERT(ptgt != NULL, ("[pmc,%d] process %p (pp: %p) not found "
836		    "in pmc %p", __LINE__, pp->pp_proc, pp, pm));
837
838	LIST_REMOVE(ptgt, pt_next);
839	FREE(ptgt, M_PMC);
840
841	/* if the PMC now lacks targets, send the owner a SIGIO */
842	if (LIST_EMPTY(&pm->pm_targets)) {
843		p = pm->pm_owner->po_owner;
844		PROC_LOCK(p);
845		psignal(p, SIGIO);
846		PROC_UNLOCK(p);
847
848		PMCDBG(PRC,SIG,2, "signalling proc=%p signal=%d", p,
849		    SIGIO);
850	}
851}
852
853/*
854 * Check if PMC 'pm' may be attached to target process 't'.
855 */
856
857static int
858pmc_can_attach(struct pmc *pm, struct proc *t)
859{
860	struct proc *o;		/* pmc owner */
861	struct ucred *oc, *tc;	/* owner, target credentials */
862	int decline_attach, i;
863
864	/*
865	 * A PMC's owner can always attach that PMC to itself.
866	 */
867
868	if ((o = pm->pm_owner->po_owner) == t)
869		return 0;
870
871	PROC_LOCK(o);
872	oc = o->p_ucred;
873	crhold(oc);
874	PROC_UNLOCK(o);
875
876	PROC_LOCK(t);
877	tc = t->p_ucred;
878	crhold(tc);
879	PROC_UNLOCK(t);
880
881	/*
882	 * The effective uid of the PMC owner should match at least one
883	 * of the {effective,real,saved} uids of the target process.
884	 */
885
886	decline_attach = oc->cr_uid != tc->cr_uid &&
887	    oc->cr_uid != tc->cr_svuid &&
888	    oc->cr_uid != tc->cr_ruid;
889
890	/*
891	 * Every one of the target's group ids, must be in the owner's
892	 * group list.
893	 */
894	for (i = 0; !decline_attach && i < tc->cr_ngroups; i++)
895		decline_attach = !groupmember(tc->cr_groups[i], oc);
896
897	/* check the read and saved gids too */
898	if (decline_attach == 0)
899		decline_attach = !groupmember(tc->cr_rgid, oc) ||
900		    !groupmember(tc->cr_svgid, oc);
901
902	crfree(tc);
903	crfree(oc);
904
905	return !decline_attach;
906}
907
908/*
909 * Attach a process to a PMC.
910 */
911
912static int
913pmc_attach_one_process(struct proc *p, struct pmc *pm)
914{
915	int ri;
916	char *fullpath, *freepath;
917	struct pmc_process	*pp;
918
919	sx_assert(&pmc_sx, SX_XLOCKED);
920
921	PMCDBG(PRC,ATT,2, "attach-one pm=%p ri=%d proc=%p (%d, %s)", pm,
922	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
923
924	/*
925	 * Locate the process descriptor corresponding to process 'p',
926	 * allocating space as needed.
927	 *
928	 * Verify that rowindex 'pm_rowindex' is free in the process
929	 * descriptor.
930	 *
931	 * If not, allocate space for a descriptor and link the
932	 * process descriptor and PMC.
933	 */
934	ri = PMC_TO_ROWINDEX(pm);
935
936	if ((pp = pmc_find_process_descriptor(p, PMC_FLAG_ALLOCATE)) == NULL)
937		return ENOMEM;
938
939	if (pp->pp_pmcs[ri].pp_pmc == pm) /* already present at slot [ri] */
940		return EEXIST;
941
942	if (pp->pp_pmcs[ri].pp_pmc != NULL)
943		return EBUSY;
944
945	pmc_link_target_process(pm, pp);
946
947	if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)) &&
948	    (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) == 0)
949		pm->pm_flags |= PMC_F_NEEDS_LOGFILE;
950
951	pm->pm_flags |= PMC_F_ATTACH_DONE; /* mark as attached */
952
953	/* issue an attach event to a configured log file */
954	if (pm->pm_owner->po_flags & PMC_PO_OWNS_LOGFILE) {
955		pmc_getfilename(p->p_textvp, &fullpath, &freepath);
956		pmclog_process_pmcattach(pm, p->p_pid, fullpath);
957		if (freepath)
958			FREE(freepath, M_TEMP);
959	}
960	/* mark process as using HWPMCs */
961	PROC_LOCK(p);
962	p->p_flag |= P_HWPMC;
963	PROC_UNLOCK(p);
964
965	return 0;
966}
967
968/*
969 * Attach a process and optionally its children
970 */
971
972static int
973pmc_attach_process(struct proc *p, struct pmc *pm)
974{
975	int error;
976	struct proc *top;
977
978	sx_assert(&pmc_sx, SX_XLOCKED);
979
980	PMCDBG(PRC,ATT,1, "attach pm=%p ri=%d proc=%p (%d, %s)", pm,
981	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
982
983
984	/*
985	 * If this PMC successfully allowed a GETMSR operation
986	 * in the past, disallow further ATTACHes.
987	 */
988
989	if ((pm->pm_flags & PMC_PP_ENABLE_MSR_ACCESS) != 0)
990		return EPERM;
991
992	if ((pm->pm_flags & PMC_F_DESCENDANTS) == 0)
993		return pmc_attach_one_process(p, pm);
994
995	/*
996	 * Traverse all child processes, attaching them to
997	 * this PMC.
998	 */
999
1000	sx_slock(&proctree_lock);
1001
1002	top = p;
1003
1004	for (;;) {
1005		if ((error = pmc_attach_one_process(p, pm)) != 0)
1006			break;
1007		if (!LIST_EMPTY(&p->p_children))
1008			p = LIST_FIRST(&p->p_children);
1009		else for (;;) {
1010			if (p == top)
1011				goto done;
1012			if (LIST_NEXT(p, p_sibling)) {
1013				p = LIST_NEXT(p, p_sibling);
1014				break;
1015			}
1016			p = p->p_pptr;
1017		}
1018	}
1019
1020	if (error)
1021		(void) pmc_detach_process(top, pm);
1022
1023 done:
1024	sx_sunlock(&proctree_lock);
1025	return error;
1026}
1027
1028/*
1029 * Detach a process from a PMC.  If there are no other PMCs tracking
1030 * this process, remove the process structure from its hash table.  If
1031 * 'flags' contains PMC_FLAG_REMOVE, then free the process structure.
1032 */
1033
1034static int
1035pmc_detach_one_process(struct proc *p, struct pmc *pm, int flags)
1036{
1037	int ri;
1038	struct pmc_process *pp;
1039
1040	sx_assert(&pmc_sx, SX_XLOCKED);
1041
1042	KASSERT(pm != NULL,
1043	    ("[pmc,%d] null pm pointer", __LINE__));
1044
1045	ri = PMC_TO_ROWINDEX(pm);
1046
1047	PMCDBG(PRC,ATT,2, "detach-one pm=%p ri=%d proc=%p (%d, %s) flags=0x%x",
1048	    pm, ri, p, p->p_pid, p->p_comm, flags);
1049
1050	if ((pp = pmc_find_process_descriptor(p, 0)) == NULL)
1051		return ESRCH;
1052
1053	if (pp->pp_pmcs[ri].pp_pmc != pm)
1054		return EINVAL;
1055
1056	pmc_unlink_target_process(pm, pp);
1057
1058	/* Issue a detach entry if a log file is configured */
1059	if (pm->pm_owner->po_flags & PMC_PO_OWNS_LOGFILE)
1060		pmclog_process_pmcdetach(pm, p->p_pid);
1061
1062	/*
1063	 * If there are no PMCs targetting this process, we remove its
1064	 * descriptor from the target hash table and unset the P_HWPMC
1065	 * flag in the struct proc.
1066	 */
1067	KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < (int) md->pmd_npmc,
1068	    ("[pmc,%d] Illegal refcnt %d for process struct %p",
1069		__LINE__, pp->pp_refcnt, pp));
1070
1071	if (pp->pp_refcnt != 0)	/* still a target of some PMC */
1072		return 0;
1073
1074	pmc_remove_process_descriptor(pp);
1075
1076	if (flags & PMC_FLAG_REMOVE)
1077		FREE(pp, M_PMC);
1078
1079	PROC_LOCK(p);
1080	p->p_flag &= ~P_HWPMC;
1081	PROC_UNLOCK(p);
1082
1083	return 0;
1084}
1085
1086/*
1087 * Detach a process and optionally its descendants from a PMC.
1088 */
1089
1090static int
1091pmc_detach_process(struct proc *p, struct pmc *pm)
1092{
1093	struct proc *top;
1094
1095	sx_assert(&pmc_sx, SX_XLOCKED);
1096
1097	PMCDBG(PRC,ATT,1, "detach pm=%p ri=%d proc=%p (%d, %s)", pm,
1098	    PMC_TO_ROWINDEX(pm), p, p->p_pid, p->p_comm);
1099
1100	if ((pm->pm_flags & PMC_F_DESCENDANTS) == 0)
1101		return pmc_detach_one_process(p, pm, PMC_FLAG_REMOVE);
1102
1103	/*
1104	 * Traverse all children, detaching them from this PMC.  We
1105	 * ignore errors since we could be detaching a PMC from a
1106	 * partially attached proc tree.
1107	 */
1108
1109	sx_slock(&proctree_lock);
1110
1111	top = p;
1112
1113	for (;;) {
1114		(void) pmc_detach_one_process(p, pm, PMC_FLAG_REMOVE);
1115
1116		if (!LIST_EMPTY(&p->p_children))
1117			p = LIST_FIRST(&p->p_children);
1118		else for (;;) {
1119			if (p == top)
1120				goto done;
1121			if (LIST_NEXT(p, p_sibling)) {
1122				p = LIST_NEXT(p, p_sibling);
1123				break;
1124			}
1125			p = p->p_pptr;
1126		}
1127	}
1128
1129 done:
1130	sx_sunlock(&proctree_lock);
1131
1132	if (LIST_EMPTY(&pm->pm_targets))
1133		pm->pm_flags &= ~PMC_F_ATTACH_DONE;
1134
1135	return 0;
1136}
1137
1138
1139/*
1140 * Thread context switch IN
1141 */
1142
1143static void
1144pmc_process_csw_in(struct thread *td)
1145{
1146	int cpu;
1147	unsigned int ri;
1148	struct pmc *pm;
1149	struct proc *p;
1150	struct pmc_cpu *pc;
1151	struct pmc_hw *phw;
1152	struct pmc_process *pp;
1153	pmc_value_t newvalue;
1154
1155	p = td->td_proc;
1156
1157	if ((pp = pmc_find_process_descriptor(p, PMC_FLAG_NONE)) == NULL)
1158		return;
1159
1160	KASSERT(pp->pp_proc == td->td_proc,
1161	    ("[pmc,%d] not my thread state", __LINE__));
1162
1163	critical_enter(); /* no preemption from this point */
1164
1165	cpu = PCPU_GET(cpuid); /* td->td_oncpu is invalid */
1166
1167	PMCDBG(CSW,SWI,1, "cpu=%d proc=%p (%d, %s) pp=%p", cpu, p,
1168	    p->p_pid, p->p_comm, pp);
1169
1170	KASSERT(cpu >= 0 && cpu < mp_ncpus,
1171	    ("[pmc,%d] wierd CPU id %d", __LINE__, cpu));
1172
1173	pc = pmc_pcpu[cpu];
1174
1175	for (ri = 0; ri < md->pmd_npmc; ri++) {
1176
1177		if ((pm = pp->pp_pmcs[ri].pp_pmc) == NULL)
1178			continue;
1179
1180		KASSERT(PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)),
1181		    ("[pmc,%d] Target PMC in non-virtual mode (%d)",
1182			__LINE__, PMC_TO_MODE(pm)));
1183
1184		KASSERT(PMC_TO_ROWINDEX(pm) == ri,
1185		    ("[pmc,%d] Row index mismatch pmc %d != ri %d",
1186			__LINE__, PMC_TO_ROWINDEX(pm), ri));
1187
1188		/*
1189		 * Only PMCs that are marked as 'RUNNING' need
1190		 * be placed on hardware.
1191		 */
1192
1193		if (pm->pm_state != PMC_STATE_RUNNING)
1194			continue;
1195
1196		/* increment PMC runcount */
1197		atomic_add_rel_32(&pm->pm_runcount, 1);
1198
1199		/* configure the HWPMC we are going to use. */
1200		md->pmd_config_pmc(cpu, ri, pm);
1201
1202		phw = pc->pc_hwpmcs[ri];
1203
1204		KASSERT(phw != NULL,
1205		    ("[pmc,%d] null hw pointer", __LINE__));
1206
1207		KASSERT(phw->phw_pmc == pm,
1208		    ("[pmc,%d] hw->pmc %p != pmc %p", __LINE__,
1209			phw->phw_pmc, pm));
1210
1211		/*
1212		 * Write out saved value and start the PMC.
1213		 *
1214		 * Sampling PMCs use a per-process value, while
1215		 * counting mode PMCs use a per-pmc value that is
1216		 * inherited across descendants.
1217		 */
1218		if (PMC_TO_MODE(pm) == PMC_MODE_TS) {
1219			mtx_pool_lock_spin(pmc_mtxpool, pm);
1220			newvalue = PMC_PCPU_SAVED(cpu,ri) =
1221			    pp->pp_pmcs[ri].pp_pmcval;
1222			mtx_pool_unlock_spin(pmc_mtxpool, pm);
1223		} else {
1224			KASSERT(PMC_TO_MODE(pm) == PMC_MODE_TC,
1225			    ("[pmc,%d] illegal mode=%d", __LINE__,
1226			    PMC_TO_MODE(pm)));
1227			mtx_pool_lock_spin(pmc_mtxpool, pm);
1228			newvalue = PMC_PCPU_SAVED(cpu, ri) =
1229			    pm->pm_gv.pm_savedvalue;
1230			mtx_pool_unlock_spin(pmc_mtxpool, pm);
1231		}
1232
1233		PMCDBG(CSW,SWI,1,"cpu=%d ri=%d new=%jd", cpu, ri, newvalue);
1234
1235		md->pmd_write_pmc(cpu, ri, newvalue);
1236		md->pmd_start_pmc(cpu, ri);
1237	}
1238
1239	/*
1240	 * perform any other architecture/cpu dependent thread
1241	 * switch-in actions.
1242	 */
1243
1244	(void) (*md->pmd_switch_in)(pc, pp);
1245
1246	critical_exit();
1247
1248}
1249
1250/*
1251 * Thread context switch OUT.
1252 */
1253
1254static void
1255pmc_process_csw_out(struct thread *td)
1256{
1257	int cpu;
1258	enum pmc_mode mode;
1259	unsigned int ri;
1260	struct pmc *pm;
1261	struct proc *p;
1262	struct pmc_cpu *pc;
1263	struct pmc_process *pp;
1264	int64_t tmp;
1265	pmc_value_t newvalue;
1266
1267	/*
1268	 * Locate our process descriptor; this may be NULL if
1269	 * this process is exiting and we have already removed
1270	 * the process from the target process table.
1271	 *
1272	 * Note that due to kernel preemption, multiple
1273	 * context switches may happen while the process is
1274	 * exiting.
1275	 *
1276	 * Note also that if the target process cannot be
1277	 * found we still need to deconfigure any PMCs that
1278	 * are currently running on hardware.
1279	 */
1280
1281	p = td->td_proc;
1282	pp = pmc_find_process_descriptor(p, PMC_FLAG_NONE);
1283
1284	/*
1285	 * save PMCs
1286	 */
1287
1288	critical_enter();
1289
1290	cpu = PCPU_GET(cpuid); /* td->td_oncpu is invalid */
1291
1292	PMCDBG(CSW,SWO,1, "cpu=%d proc=%p (%d, %s) pp=%p", cpu, p,
1293	    p->p_pid, p->p_comm, pp);
1294
1295	KASSERT(cpu >= 0 && cpu < mp_ncpus,
1296	    ("[pmc,%d wierd CPU id %d", __LINE__, cpu));
1297
1298	pc = pmc_pcpu[cpu];
1299
1300	/*
1301	 * When a PMC gets unlinked from a target PMC, it will
1302	 * be removed from the target's pp_pmc[] array.
1303	 *
1304	 * However, on a MP system, the target could have been
1305	 * executing on another CPU at the time of the unlink.
1306	 * So, at context switch OUT time, we need to look at
1307	 * the hardware to determine if a PMC is scheduled on
1308	 * it.
1309	 */
1310
1311	for (ri = 0; ri < md->pmd_npmc; ri++) {
1312
1313		pm = NULL;
1314		(void) (*md->pmd_get_config)(cpu, ri, &pm);
1315
1316		if (pm == NULL)	/* nothing at this row index */
1317			continue;
1318
1319		mode = PMC_TO_MODE(pm);
1320		if (!PMC_IS_VIRTUAL_MODE(mode))
1321			continue; /* not a process virtual PMC */
1322
1323		KASSERT(PMC_TO_ROWINDEX(pm) == ri,
1324		    ("[pmc,%d] ri mismatch pmc(%d) ri(%d)",
1325			__LINE__, PMC_TO_ROWINDEX(pm), ri));
1326
1327		/* Stop hardware if not already stopped */
1328		if (pm->pm_stalled == 0)
1329			md->pmd_stop_pmc(cpu, ri);
1330
1331		/* reduce this PMC's runcount */
1332		atomic_subtract_rel_32(&pm->pm_runcount, 1);
1333
1334		/*
1335		 * If this PMC is associated with this process,
1336		 * save the reading.
1337		 */
1338
1339		if (pp != NULL && pp->pp_pmcs[ri].pp_pmc != NULL) {
1340
1341			KASSERT(pm == pp->pp_pmcs[ri].pp_pmc,
1342			    ("[pmc,%d] pm %p != pp_pmcs[%d] %p", __LINE__,
1343				pm, ri, pp->pp_pmcs[ri].pp_pmc));
1344
1345			KASSERT(pp->pp_refcnt > 0,
1346			    ("[pmc,%d] pp refcnt = %d", __LINE__,
1347				pp->pp_refcnt));
1348
1349			md->pmd_read_pmc(cpu, ri, &newvalue);
1350
1351			tmp = newvalue - PMC_PCPU_SAVED(cpu,ri);
1352
1353			PMCDBG(CSW,SWI,1,"cpu=%d ri=%d tmp=%jd", cpu, ri,
1354			    tmp);
1355
1356			if (mode == PMC_MODE_TS) {
1357
1358				/*
1359				 * For sampling process-virtual PMCs,
1360				 * we expect the count to be
1361				 * decreasing as the 'value'
1362				 * programmed into the PMC is the
1363				 * number of events to be seen till
1364				 * the next sampling interrupt.
1365				 */
1366				if (tmp < 0)
1367					tmp += pm->pm_sc.pm_reloadcount;
1368				mtx_pool_lock_spin(pmc_mtxpool, pm);
1369				pp->pp_pmcs[ri].pp_pmcval -= tmp;
1370				if ((int64_t) pp->pp_pmcs[ri].pp_pmcval < 0)
1371					pp->pp_pmcs[ri].pp_pmcval +=
1372					    pm->pm_sc.pm_reloadcount;
1373				mtx_pool_unlock_spin(pmc_mtxpool, pm);
1374
1375			} else {
1376
1377				/*
1378				 * For counting process-virtual PMCs,
1379				 * we expect the count to be
1380				 * increasing monotonically, modulo a 64
1381				 * bit wraparound.
1382				 */
1383				KASSERT((int64_t) tmp >= 0,
1384				    ("[pmc,%d] negative increment cpu=%d "
1385				     "ri=%d newvalue=%jx saved=%jx "
1386				     "incr=%jx", __LINE__, cpu, ri,
1387				     newvalue, PMC_PCPU_SAVED(cpu,ri), tmp));
1388
1389				mtx_pool_lock_spin(pmc_mtxpool, pm);
1390				pm->pm_gv.pm_savedvalue += tmp;
1391				pp->pp_pmcs[ri].pp_pmcval += tmp;
1392				mtx_pool_unlock_spin(pmc_mtxpool, pm);
1393
1394				if (pm->pm_flags & PMC_F_LOG_PROCCSW)
1395					pmclog_process_proccsw(pm, pp, tmp);
1396			}
1397		}
1398
1399		/* mark hardware as free */
1400		md->pmd_config_pmc(cpu, ri, NULL);
1401	}
1402
1403	/*
1404	 * perform any other architecture/cpu dependent thread
1405	 * switch out functions.
1406	 */
1407
1408	(void) (*md->pmd_switch_out)(pc, pp);
1409
1410	critical_exit();
1411}
1412
1413/*
1414 * The 'hook' invoked from the kernel proper
1415 */
1416
1417
1418#ifdef	DEBUG
1419const char *pmc_hooknames[] = {
1420	"",
1421	"EXIT",
1422	"EXEC",
1423	"FORK",
1424	"CSW-IN",
1425	"CSW-OUT",
1426	"SAMPLE"
1427};
1428#endif
1429
1430static int
1431pmc_hook_handler(struct thread *td, int function, void *arg)
1432{
1433
1434	PMCDBG(MOD,PMH,1, "hook td=%p func=%d \"%s\" arg=%p", td, function,
1435	    pmc_hooknames[function], arg);
1436
1437	switch (function)
1438	{
1439
1440	/*
1441	 * Process exec()
1442	 */
1443
1444	case PMC_FN_PROCESS_EXEC:
1445	{
1446		char *fullpath, *freepath;
1447		unsigned int ri;
1448		int is_using_hwpmcs;
1449		struct pmc *pm;
1450		struct proc *p;
1451		struct pmc_owner *po;
1452		struct pmc_process *pp;
1453		struct pmckern_procexec *pk;
1454
1455		sx_assert(&pmc_sx, SX_XLOCKED);
1456
1457		p = td->td_proc;
1458		pmc_getfilename(p->p_textvp, &fullpath, &freepath);
1459
1460		pk = (struct pmckern_procexec *) arg;
1461
1462		/* Inform owners of SS mode PMCs of the exec event. */
1463		LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
1464		    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
1465			    pmclog_process_procexec(po, PMC_ID_INVALID,
1466				p->p_pid, pk->pm_entryaddr, fullpath);
1467
1468		PROC_LOCK(p);
1469		is_using_hwpmcs = p->p_flag & P_HWPMC;
1470		PROC_UNLOCK(p);
1471
1472		if (!is_using_hwpmcs) {
1473			if (freepath)
1474				FREE(freepath, M_TEMP);
1475			break;
1476		}
1477
1478		/*
1479		 * PMCs are not inherited across an exec():  remove any
1480		 * PMCs that this process is the owner of.
1481		 */
1482
1483		if ((po = pmc_find_owner_descriptor(p)) != NULL) {
1484			pmc_remove_owner(po);
1485			pmc_destroy_owner_descriptor(po);
1486		}
1487
1488		/*
1489		 * If the process being exec'ed is not the target of any
1490		 * PMC, we are done.
1491		 */
1492		if ((pp = pmc_find_process_descriptor(p, 0)) == NULL) {
1493			if (freepath)
1494				FREE(freepath, M_TEMP);
1495			break;
1496		}
1497
1498		/*
1499		 * Log the exec event to all monitoring owners.  Skip
1500		 * owners who have already recieved the event because
1501		 * they had system sampling PMCs active.
1502		 */
1503		for (ri = 0; ri < md->pmd_npmc; ri++)
1504			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL) {
1505				po = pm->pm_owner;
1506				if (po->po_sscount == 0 &&
1507				    po->po_flags & PMC_PO_OWNS_LOGFILE)
1508					pmclog_process_procexec(po, pm->pm_id,
1509					    p->p_pid, pk->pm_entryaddr,
1510					    fullpath);
1511			}
1512
1513		if (freepath)
1514			FREE(freepath, M_TEMP);
1515
1516
1517		PMCDBG(PRC,EXC,1, "exec proc=%p (%d, %s) cred-changed=%d",
1518		    p, p->p_pid, p->p_comm, pk->pm_credentialschanged);
1519
1520		if (pk->pm_credentialschanged == 0) /* no change */
1521			break;
1522
1523		/*
1524		 * If the newly exec()'ed process has a different credential
1525		 * than before, allow it to be the target of a PMC only if
1526		 * the PMC's owner has sufficient priviledge.
1527		 */
1528
1529		for (ri = 0; ri < md->pmd_npmc; ri++)
1530			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL)
1531				if (pmc_can_attach(pm, td->td_proc) != 0)
1532					pmc_detach_one_process(td->td_proc,
1533					    pm, PMC_FLAG_NONE);
1534
1535		KASSERT(pp->pp_refcnt >= 0 && pp->pp_refcnt < (int) md->pmd_npmc,
1536		    ("[pmc,%d] Illegal ref count %d on pp %p", __LINE__,
1537			pp->pp_refcnt, pp));
1538
1539		/*
1540		 * If this process is no longer the target of any
1541		 * PMCs, we can remove the process entry and free
1542		 * up space.
1543		 */
1544
1545		if (pp->pp_refcnt == 0) {
1546			pmc_remove_process_descriptor(pp);
1547			FREE(pp, M_PMC);
1548			break;
1549		}
1550
1551	}
1552	break;
1553
1554	case PMC_FN_CSW_IN:
1555		pmc_process_csw_in(td);
1556		break;
1557
1558	case PMC_FN_CSW_OUT:
1559		pmc_process_csw_out(td);
1560		break;
1561
1562	/*
1563	 * Process accumulated PC samples.
1564	 *
1565	 * This function is expected to be called by hardclock() for
1566	 * each CPU that has accumulated PC samples.
1567	 *
1568	 * This function is to be executed on the CPU whose samples
1569	 * are being processed.
1570	 */
1571	case PMC_FN_DO_SAMPLES:
1572
1573		/*
1574		 * Clear the cpu specific bit in the CPU mask before
1575		 * do the rest of the processing.  If the NMI handler
1576		 * gets invoked after the "atomic_clear_int()" call
1577		 * below but before "pmc_process_samples()" gets
1578		 * around to processing the interrupt, then we will
1579		 * come back here at the next hardclock() tick (and
1580		 * may find nothing to do if "pmc_process_samples()"
1581		 * had already processed the interrupt).  We don't
1582		 * lose the interrupt sample.
1583		 */
1584		atomic_clear_int(&pmc_cpumask, (1 << PCPU_GET(cpuid)));
1585		pmc_process_samples(PCPU_GET(cpuid));
1586		break;
1587
1588	default:
1589#ifdef	DEBUG
1590		KASSERT(0, ("[pmc,%d] unknown hook %d\n", __LINE__, function));
1591#endif
1592		break;
1593
1594	}
1595
1596	return 0;
1597}
1598
1599/*
1600 * allocate a 'struct pmc_owner' descriptor in the owner hash table.
1601 */
1602
1603static struct pmc_owner *
1604pmc_allocate_owner_descriptor(struct proc *p)
1605{
1606	uint32_t hindex;
1607	struct pmc_owner *po;
1608	struct pmc_ownerhash *poh;
1609
1610	hindex = PMC_HASH_PTR(p, pmc_ownerhashmask);
1611	poh = &pmc_ownerhash[hindex];
1612
1613	/* allocate space for N pointers and one descriptor struct */
1614	MALLOC(po, struct pmc_owner *, sizeof(struct pmc_owner),
1615	    M_PMC, M_ZERO|M_WAITOK);
1616
1617	po->po_sscount = po->po_error = po->po_flags = 0;
1618	po->po_file  = NULL;
1619	po->po_owner = p;
1620	po->po_kthread = NULL;
1621	LIST_INIT(&po->po_pmcs);
1622	LIST_INSERT_HEAD(poh, po, po_next); /* insert into hash table */
1623
1624	TAILQ_INIT(&po->po_logbuffers);
1625	mtx_init(&po->po_mtx, "pmc-owner-mtx", "pmc", MTX_SPIN);
1626
1627	PMCDBG(OWN,ALL,1, "allocate-owner proc=%p (%d, %s) pmc-owner=%p",
1628	    p, p->p_pid, p->p_comm, po);
1629
1630	return po;
1631}
1632
1633static void
1634pmc_destroy_owner_descriptor(struct pmc_owner *po)
1635{
1636
1637	PMCDBG(OWN,REL,1, "destroy-owner po=%p proc=%p (%d, %s)",
1638	    po, po->po_owner, po->po_owner->p_pid, po->po_owner->p_comm);
1639
1640	mtx_destroy(&po->po_mtx);
1641	FREE(po, M_PMC);
1642}
1643
1644/*
1645 * find the descriptor corresponding to process 'p', adding or removing it
1646 * as specified by 'mode'.
1647 */
1648
1649static struct pmc_process *
1650pmc_find_process_descriptor(struct proc *p, uint32_t mode)
1651{
1652	uint32_t hindex;
1653	struct pmc_process *pp, *ppnew;
1654	struct pmc_processhash *pph;
1655
1656	hindex = PMC_HASH_PTR(p, pmc_processhashmask);
1657	pph = &pmc_processhash[hindex];
1658
1659	ppnew = NULL;
1660
1661	/*
1662	 * Pre-allocate memory in the FIND_ALLOCATE case since we
1663	 * cannot call malloc(9) once we hold a spin lock.
1664	 */
1665
1666	if (mode & PMC_FLAG_ALLOCATE) {
1667		/* allocate additional space for 'n' pmc pointers */
1668		MALLOC(ppnew, struct pmc_process *,
1669		    sizeof(struct pmc_process) + md->pmd_npmc *
1670		    sizeof(struct pmc_targetstate), M_PMC, M_ZERO|M_WAITOK);
1671	}
1672
1673	mtx_lock_spin(&pmc_processhash_mtx);
1674	LIST_FOREACH(pp, pph, pp_next)
1675	    if (pp->pp_proc == p)
1676		    break;
1677
1678	if ((mode & PMC_FLAG_REMOVE) && pp != NULL)
1679		LIST_REMOVE(pp, pp_next);
1680
1681	if ((mode & PMC_FLAG_ALLOCATE) && pp == NULL &&
1682	    ppnew != NULL) {
1683		ppnew->pp_proc = p;
1684		LIST_INSERT_HEAD(pph, ppnew, pp_next);
1685		pp = ppnew;
1686		ppnew = NULL;
1687	}
1688	mtx_unlock_spin(&pmc_processhash_mtx);
1689
1690	if (pp != NULL && ppnew != NULL)
1691		FREE(ppnew, M_PMC);
1692
1693	return pp;
1694}
1695
1696/*
1697 * remove a process descriptor from the process hash table.
1698 */
1699
1700static void
1701pmc_remove_process_descriptor(struct pmc_process *pp)
1702{
1703	KASSERT(pp->pp_refcnt == 0,
1704	    ("[pmc,%d] Removing process descriptor %p with count %d",
1705		__LINE__, pp, pp->pp_refcnt));
1706
1707	mtx_lock_spin(&pmc_processhash_mtx);
1708	LIST_REMOVE(pp, pp_next);
1709	mtx_unlock_spin(&pmc_processhash_mtx);
1710}
1711
1712
1713/*
1714 * find an owner descriptor corresponding to proc 'p'
1715 */
1716
1717static struct pmc_owner *
1718pmc_find_owner_descriptor(struct proc *p)
1719{
1720	uint32_t hindex;
1721	struct pmc_owner *po;
1722	struct pmc_ownerhash *poh;
1723
1724	hindex = PMC_HASH_PTR(p, pmc_ownerhashmask);
1725	poh = &pmc_ownerhash[hindex];
1726
1727	po = NULL;
1728	LIST_FOREACH(po, poh, po_next)
1729	    if (po->po_owner == p)
1730		    break;
1731
1732	PMCDBG(OWN,FND,1, "find-owner proc=%p (%d, %s) hindex=0x%x -> "
1733	    "pmc-owner=%p", p, p->p_pid, p->p_comm, hindex, po);
1734
1735	return po;
1736}
1737
1738/*
1739 * pmc_allocate_pmc_descriptor
1740 *
1741 * Allocate a pmc descriptor and initialize its
1742 * fields.
1743 */
1744
1745static struct pmc *
1746pmc_allocate_pmc_descriptor(void)
1747{
1748	struct pmc *pmc;
1749
1750	MALLOC(pmc, struct pmc *, sizeof(struct pmc), M_PMC, M_ZERO|M_WAITOK);
1751
1752	if (pmc != NULL) {
1753		pmc->pm_owner = NULL;
1754		LIST_INIT(&pmc->pm_targets);
1755	}
1756
1757	PMCDBG(PMC,ALL,1, "allocate-pmc -> pmc=%p", pmc);
1758
1759	return pmc;
1760}
1761
1762/*
1763 * Destroy a pmc descriptor.
1764 */
1765
1766static void
1767pmc_destroy_pmc_descriptor(struct pmc *pm)
1768{
1769	(void) pm;
1770
1771#ifdef	DEBUG
1772	KASSERT(pm->pm_state == PMC_STATE_DELETED ||
1773	    pm->pm_state == PMC_STATE_FREE,
1774	    ("[pmc,%d] destroying non-deleted PMC", __LINE__));
1775	KASSERT(LIST_EMPTY(&pm->pm_targets),
1776	    ("[pmc,%d] destroying pmc with targets", __LINE__));
1777	KASSERT(pm->pm_owner == NULL,
1778	    ("[pmc,%d] destroying pmc attached to an owner", __LINE__));
1779	KASSERT(pm->pm_runcount == 0,
1780	    ("[pmc,%d] pmc has non-zero run count %d", __LINE__,
1781		pm->pm_runcount));
1782#endif
1783}
1784
1785static void
1786pmc_wait_for_pmc_idle(struct pmc *pm)
1787{
1788#ifdef	DEBUG
1789	volatile int maxloop;
1790
1791	maxloop = 100 * mp_ncpus;
1792#endif
1793
1794	/*
1795	 * Loop (with a forced context switch) till the PMC's runcount
1796	 * comes down to zero.
1797	 */
1798	while (atomic_load_acq_32(&pm->pm_runcount) > 0) {
1799#ifdef	DEBUG
1800		maxloop--;
1801		KASSERT(maxloop > 0,
1802		    ("[pmc,%d] (ri%d, rc%d) waiting too long for "
1803			"pmc to be free", __LINE__,
1804			PMC_TO_ROWINDEX(pm), pm->pm_runcount));
1805#endif
1806		pmc_force_context_switch();
1807	}
1808}
1809
1810/*
1811 * This function does the following things:
1812 *
1813 *  - detaches the PMC from hardware
1814 *  - unlinks all target threads that were attached to it
1815 *  - removes the PMC from its owner's list
1816 *  - destroy's the PMC private mutex
1817 *
1818 * Once this function completes, the given pmc pointer can be safely
1819 * FREE'd by the caller.
1820 */
1821
1822static void
1823pmc_release_pmc_descriptor(struct pmc *pm)
1824{
1825	u_int ri, cpu;
1826	enum pmc_mode mode;
1827	struct pmc_hw *phw;
1828	struct pmc_owner *po;
1829	struct pmc_process *pp;
1830	struct pmc_target *ptgt, *tmp;
1831	struct pmc_binding pb;
1832
1833	sx_assert(&pmc_sx, SX_XLOCKED);
1834
1835	KASSERT(pm, ("[pmc,%d] null pmc", __LINE__));
1836
1837	ri   = PMC_TO_ROWINDEX(pm);
1838	mode = PMC_TO_MODE(pm);
1839
1840	PMCDBG(PMC,REL,1, "release-pmc pmc=%p ri=%d mode=%d", pm, ri,
1841	    mode);
1842
1843	/*
1844	 * First, we take the PMC off hardware.
1845	 */
1846	cpu = 0;
1847	if (PMC_IS_SYSTEM_MODE(mode)) {
1848
1849		/*
1850		 * A system mode PMC runs on a specific CPU.  Switch
1851		 * to this CPU and turn hardware off.
1852		 */
1853		pmc_save_cpu_binding(&pb);
1854
1855		cpu = PMC_TO_CPU(pm);
1856
1857		pmc_select_cpu(cpu);
1858
1859		/* switch off non-stalled CPUs */
1860		if (pm->pm_state == PMC_STATE_RUNNING &&
1861		    pm->pm_stalled == 0) {
1862
1863			phw = pmc_pcpu[cpu]->pc_hwpmcs[ri];
1864
1865			KASSERT(phw->phw_pmc == pm,
1866			    ("[pmc, %d] pmc ptr ri(%d) hw(%p) pm(%p)",
1867				__LINE__, ri, phw->phw_pmc, pm));
1868			PMCDBG(PMC,REL,2, "stopping cpu=%d ri=%d", cpu, ri);
1869
1870			critical_enter();
1871			md->pmd_stop_pmc(cpu, ri);
1872			critical_exit();
1873		}
1874
1875		PMCDBG(PMC,REL,2, "decfg cpu=%d ri=%d", cpu, ri);
1876
1877		critical_enter();
1878		md->pmd_config_pmc(cpu, ri, NULL);
1879		critical_exit();
1880
1881		/* adjust the global and process count of SS mode PMCs */
1882		if (mode == PMC_MODE_SS && pm->pm_state == PMC_STATE_RUNNING) {
1883			po = pm->pm_owner;
1884			po->po_sscount--;
1885			if (po->po_sscount == 0) {
1886				atomic_subtract_rel_int(&pmc_ss_count, 1);
1887				LIST_REMOVE(po, po_ssnext);
1888			}
1889		}
1890
1891		pm->pm_state = PMC_STATE_DELETED;
1892
1893		pmc_restore_cpu_binding(&pb);
1894
1895		/*
1896		 * We could have references to this PMC structure in
1897		 * the per-cpu sample queues.  Wait for the queue to
1898		 * drain.
1899		 */
1900		pmc_wait_for_pmc_idle(pm);
1901
1902	} else if (PMC_IS_VIRTUAL_MODE(mode)) {
1903
1904		/*
1905		 * A virtual PMC could be running on multiple CPUs at
1906		 * a given instant.
1907		 *
1908		 * By marking its state as DELETED, we ensure that
1909		 * this PMC is never further scheduled on hardware.
1910		 *
1911		 * Then we wait till all CPUs are done with this PMC.
1912		 */
1913		pm->pm_state = PMC_STATE_DELETED;
1914
1915
1916		/* Wait for the PMCs runcount to come to zero. */
1917		pmc_wait_for_pmc_idle(pm);
1918
1919		/*
1920		 * At this point the PMC is off all CPUs and cannot be
1921		 * freshly scheduled onto a CPU.  It is now safe to
1922		 * unlink all targets from this PMC.  If a
1923		 * process-record's refcount falls to zero, we remove
1924		 * it from the hash table.  The module-wide SX lock
1925		 * protects us from races.
1926		 */
1927		LIST_FOREACH_SAFE(ptgt, &pm->pm_targets, pt_next, tmp) {
1928			pp = ptgt->pt_process;
1929			pmc_unlink_target_process(pm, pp); /* frees 'ptgt' */
1930
1931			PMCDBG(PMC,REL,3, "pp->refcnt=%d", pp->pp_refcnt);
1932
1933			/*
1934			 * If the target process record shows that no
1935			 * PMCs are attached to it, reclaim its space.
1936			 */
1937
1938			if (pp->pp_refcnt == 0) {
1939				pmc_remove_process_descriptor(pp);
1940				FREE(pp, M_PMC);
1941			}
1942		}
1943
1944		cpu = curthread->td_oncpu; /* setup cpu for pmd_release() */
1945
1946	}
1947
1948	/*
1949	 * Release any MD resources
1950	 */
1951
1952	(void) md->pmd_release_pmc(cpu, ri, pm);
1953
1954	/*
1955	 * Update row disposition
1956	 */
1957
1958	if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm)))
1959		PMC_UNMARK_ROW_STANDALONE(ri);
1960	else
1961		PMC_UNMARK_ROW_THREAD(ri);
1962
1963	/* unlink from the owner's list */
1964	if (pm->pm_owner) {
1965		LIST_REMOVE(pm, pm_next);
1966		pm->pm_owner = NULL;
1967	}
1968
1969	pmc_destroy_pmc_descriptor(pm);
1970}
1971
1972/*
1973 * Register an owner and a pmc.
1974 */
1975
1976static int
1977pmc_register_owner(struct proc *p, struct pmc *pmc)
1978{
1979	struct pmc_owner *po;
1980
1981	sx_assert(&pmc_sx, SX_XLOCKED);
1982
1983	if ((po = pmc_find_owner_descriptor(p)) == NULL)
1984		if ((po = pmc_allocate_owner_descriptor(p)) == NULL)
1985			return ENOMEM;
1986
1987	KASSERT(pmc->pm_owner == NULL,
1988	    ("[pmc,%d] attempting to own an initialized PMC", __LINE__));
1989	pmc->pm_owner  = po;
1990
1991	LIST_INSERT_HEAD(&po->po_pmcs, pmc, pm_next);
1992
1993	PROC_LOCK(p);
1994	p->p_flag |= P_HWPMC;
1995	PROC_UNLOCK(p);
1996
1997	if (po->po_flags & PMC_PO_OWNS_LOGFILE)
1998		pmclog_process_pmcallocate(pmc);
1999
2000	PMCDBG(PMC,REG,1, "register-owner pmc-owner=%p pmc=%p",
2001	    po, pmc);
2002
2003	return 0;
2004}
2005
2006/*
2007 * Return the current row disposition:
2008 * == 0 => FREE
2009 *  > 0 => PROCESS MODE
2010 *  < 0 => SYSTEM MODE
2011 */
2012
2013int
2014pmc_getrowdisp(int ri)
2015{
2016	return pmc_pmcdisp[ri];
2017}
2018
2019/*
2020 * Check if a PMC at row index 'ri' can be allocated to the current
2021 * process.
2022 *
2023 * Allocation can fail if:
2024 *   - the current process is already being profiled by a PMC at index 'ri',
2025 *     attached to it via OP_PMCATTACH.
2026 *   - the current process has already allocated a PMC at index 'ri'
2027 *     via OP_ALLOCATE.
2028 */
2029
2030static int
2031pmc_can_allocate_rowindex(struct proc *p, unsigned int ri, int cpu)
2032{
2033	enum pmc_mode mode;
2034	struct pmc *pm;
2035	struct pmc_owner *po;
2036	struct pmc_process *pp;
2037
2038	PMCDBG(PMC,ALR,1, "can-allocate-rowindex proc=%p (%d, %s) ri=%d "
2039	    "cpu=%d", p, p->p_pid, p->p_comm, ri, cpu);
2040
2041	/*
2042	 * We shouldn't have already allocated a process-mode PMC at
2043	 * row index 'ri'.
2044	 *
2045	 * We shouldn't have allocated a system-wide PMC on the same
2046	 * CPU and same RI.
2047	 */
2048	if ((po = pmc_find_owner_descriptor(p)) != NULL)
2049		LIST_FOREACH(pm, &po->po_pmcs, pm_next) {
2050		    if (PMC_TO_ROWINDEX(pm) == ri) {
2051			    mode = PMC_TO_MODE(pm);
2052			    if (PMC_IS_VIRTUAL_MODE(mode))
2053				    return EEXIST;
2054			    if (PMC_IS_SYSTEM_MODE(mode) &&
2055				(int) PMC_TO_CPU(pm) == cpu)
2056				    return EEXIST;
2057		    }
2058	        }
2059
2060	/*
2061	 * We also shouldn't be the target of any PMC at this index
2062	 * since otherwise a PMC_ATTACH to ourselves will fail.
2063	 */
2064	if ((pp = pmc_find_process_descriptor(p, 0)) != NULL)
2065		if (pp->pp_pmcs[ri].pp_pmc)
2066			return EEXIST;
2067
2068	PMCDBG(PMC,ALR,2, "can-allocate-rowindex proc=%p (%d, %s) ri=%d ok",
2069	    p, p->p_pid, p->p_comm, ri);
2070
2071	return 0;
2072}
2073
2074/*
2075 * Check if a given PMC at row index 'ri' can be currently used in
2076 * mode 'mode'.
2077 */
2078
2079static int
2080pmc_can_allocate_row(int ri, enum pmc_mode mode)
2081{
2082	enum pmc_disp	disp;
2083
2084	sx_assert(&pmc_sx, SX_XLOCKED);
2085
2086	PMCDBG(PMC,ALR,1, "can-allocate-row ri=%d mode=%d", ri, mode);
2087
2088	if (PMC_IS_SYSTEM_MODE(mode))
2089		disp = PMC_DISP_STANDALONE;
2090	else
2091		disp = PMC_DISP_THREAD;
2092
2093	/*
2094	 * check disposition for PMC row 'ri':
2095	 *
2096	 * Expected disposition		Row-disposition		Result
2097	 *
2098	 * STANDALONE			STANDALONE or FREE	proceed
2099	 * STANDALONE			THREAD			fail
2100	 * THREAD			THREAD or FREE		proceed
2101	 * THREAD			STANDALONE		fail
2102	 */
2103
2104	if (!PMC_ROW_DISP_IS_FREE(ri) &&
2105	    !(disp == PMC_DISP_THREAD && PMC_ROW_DISP_IS_THREAD(ri)) &&
2106	    !(disp == PMC_DISP_STANDALONE && PMC_ROW_DISP_IS_STANDALONE(ri)))
2107		return EBUSY;
2108
2109	/*
2110	 * All OK
2111	 */
2112
2113	PMCDBG(PMC,ALR,2, "can-allocate-row ri=%d mode=%d ok", ri, mode);
2114
2115	return 0;
2116
2117}
2118
2119/*
2120 * Find a PMC descriptor with user handle 'pmcid' for thread 'td'.
2121 */
2122
2123static struct pmc *
2124pmc_find_pmc_descriptor_in_process(struct pmc_owner *po, pmc_id_t pmcid)
2125{
2126	struct pmc *pm;
2127
2128	KASSERT(PMC_ID_TO_ROWINDEX(pmcid) < md->pmd_npmc,
2129	    ("[pmc,%d] Illegal pmc index %d (max %d)", __LINE__,
2130		PMC_ID_TO_ROWINDEX(pmcid), md->pmd_npmc));
2131
2132	LIST_FOREACH(pm, &po->po_pmcs, pm_next)
2133	    if (pm->pm_id == pmcid)
2134		    return pm;
2135
2136	return NULL;
2137}
2138
2139static int
2140pmc_find_pmc(pmc_id_t pmcid, struct pmc **pmc)
2141{
2142
2143	struct pmc *pm;
2144	struct pmc_owner *po;
2145
2146	PMCDBG(PMC,FND,1, "find-pmc id=%d", pmcid);
2147
2148	if ((po = pmc_find_owner_descriptor(curthread->td_proc)) == NULL)
2149		return ESRCH;
2150
2151	if ((pm = pmc_find_pmc_descriptor_in_process(po, pmcid)) == NULL)
2152		return EINVAL;
2153
2154	PMCDBG(PMC,FND,2, "find-pmc id=%d -> pmc=%p", pmcid, pm);
2155
2156	*pmc = pm;
2157	return 0;
2158}
2159
2160/*
2161 * Start a PMC.
2162 */
2163
2164static int
2165pmc_start(struct pmc *pm)
2166{
2167	int error, cpu, ri;
2168	enum pmc_mode mode;
2169	struct pmc_owner *po;
2170	struct pmc_binding pb;
2171
2172	KASSERT(pm != NULL,
2173	    ("[pmc,%d] null pm", __LINE__));
2174
2175	mode = PMC_TO_MODE(pm);
2176	ri   = PMC_TO_ROWINDEX(pm);
2177	error = 0;
2178
2179	PMCDBG(PMC,OPS,1, "start pmc=%p mode=%d ri=%d", pm, mode, ri);
2180
2181	po = pm->pm_owner;
2182
2183	if (PMC_IS_VIRTUAL_MODE(mode)) {
2184
2185		/*
2186		 * If a PMCATTACH has never been done on this PMC,
2187		 * attach it to its owner process.
2188		 */
2189
2190		if (LIST_EMPTY(&pm->pm_targets))
2191			error = (pm->pm_flags & PMC_F_ATTACH_DONE) ? ESRCH :
2192			    pmc_attach_process(po->po_owner, pm);
2193
2194		/*
2195		 * Disallow PMCSTART if a logfile is required but has not
2196		 * been configured yet.
2197		 */
2198
2199		if (error == 0 && (pm->pm_flags & PMC_F_NEEDS_LOGFILE) &&
2200		    (po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
2201			error = EDOOFUS;
2202
2203		/*
2204		 * If the PMC is attached to its owner, then force a context
2205		 * switch to ensure that the MD state gets set correctly.
2206		 */
2207
2208		if (error == 0) {
2209			pm->pm_state = PMC_STATE_RUNNING;
2210			if (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER)
2211				pmc_force_context_switch();
2212		}
2213
2214		return error;
2215	}
2216
2217
2218	/*
2219	 * A system-wide PMC.
2220	 */
2221
2222	if ((pm->pm_flags & PMC_F_NEEDS_LOGFILE) &&
2223	    (po->po_flags & PMC_PO_OWNS_LOGFILE) == 0)
2224		return EDOOFUS;	/* programming error */
2225
2226	/*
2227	 * Add the owner to the global list if this is a system-wide
2228	 * sampling PMC.
2229	 */
2230
2231	if (mode == PMC_MODE_SS) {
2232		if (po->po_sscount == 0) {
2233			LIST_INSERT_HEAD(&pmc_ss_owners, po, po_ssnext);
2234			atomic_add_rel_int(&pmc_ss_count, 1);
2235			PMCDBG(PMC,OPS,1, "po=%p in global list", po);
2236		}
2237		po->po_sscount++;
2238	}
2239
2240	/*
2241	 * Move to the CPU associated with this
2242	 * PMC, and start the hardware.
2243	 */
2244
2245	pmc_save_cpu_binding(&pb);
2246
2247	cpu = PMC_TO_CPU(pm);
2248
2249	if (pmc_cpu_is_disabled(cpu))
2250		return ENXIO;
2251
2252	pmc_select_cpu(cpu);
2253
2254	/*
2255	 * global PMCs are configured at allocation time
2256	 * so write out the initial value and start the PMC.
2257	 */
2258
2259	pm->pm_state = PMC_STATE_RUNNING;
2260
2261	critical_enter();
2262	if ((error = md->pmd_write_pmc(cpu, ri,
2263		 PMC_IS_SAMPLING_MODE(mode) ?
2264		 pm->pm_sc.pm_reloadcount :
2265		 pm->pm_sc.pm_initial)) == 0)
2266		error = md->pmd_start_pmc(cpu, ri);
2267	critical_exit();
2268
2269	pmc_restore_cpu_binding(&pb);
2270
2271	return error;
2272}
2273
2274/*
2275 * Stop a PMC.
2276 */
2277
2278static int
2279pmc_stop(struct pmc *pm)
2280{
2281	int cpu, error, ri;
2282	struct pmc_owner *po;
2283	struct pmc_binding pb;
2284
2285	KASSERT(pm != NULL, ("[pmc,%d] null pmc", __LINE__));
2286
2287	PMCDBG(PMC,OPS,1, "stop pmc=%p mode=%d ri=%d", pm,
2288	    PMC_TO_MODE(pm), PMC_TO_ROWINDEX(pm));
2289
2290	pm->pm_state = PMC_STATE_STOPPED;
2291
2292	/*
2293	 * If the PMC is a virtual mode one, changing the state to
2294	 * non-RUNNING is enough to ensure that the PMC never gets
2295	 * scheduled.
2296	 *
2297	 * If this PMC is current running on a CPU, then it will
2298	 * handled correctly at the time its target process is context
2299	 * switched out.
2300	 */
2301
2302	if (PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)))
2303		return 0;
2304
2305	/*
2306	 * A system-mode PMC.  Move to the CPU associated with
2307	 * this PMC, and stop the hardware.  We update the
2308	 * 'initial count' so that a subsequent PMCSTART will
2309	 * resume counting from the current hardware count.
2310	 */
2311
2312	pmc_save_cpu_binding(&pb);
2313
2314	cpu = PMC_TO_CPU(pm);
2315
2316	KASSERT(cpu >= 0 && cpu < mp_ncpus,
2317	    ("[pmc,%d] illegal cpu=%d", __LINE__, cpu));
2318
2319	if (pmc_cpu_is_disabled(cpu))
2320		return ENXIO;
2321
2322	pmc_select_cpu(cpu);
2323
2324	ri = PMC_TO_ROWINDEX(pm);
2325
2326	critical_enter();
2327	if ((error = md->pmd_stop_pmc(cpu, ri)) == 0)
2328		error = md->pmd_read_pmc(cpu, ri, &pm->pm_sc.pm_initial);
2329	critical_exit();
2330
2331	pmc_restore_cpu_binding(&pb);
2332
2333	po = pm->pm_owner;
2334
2335	/* remove this owner from the global list of SS PMC owners */
2336	if (PMC_TO_MODE(pm) == PMC_MODE_SS) {
2337		po->po_sscount--;
2338		if (po->po_sscount == 0) {
2339			atomic_subtract_rel_int(&pmc_ss_count, 1);
2340			LIST_REMOVE(po, po_ssnext);
2341			PMCDBG(PMC,OPS,2,"po=%p removed from global list", po);
2342		}
2343	}
2344
2345	return error;
2346}
2347
2348
2349#ifdef	DEBUG
2350static const char *pmc_op_to_name[] = {
2351#undef	__PMC_OP
2352#define	__PMC_OP(N, D)	#N ,
2353	__PMC_OPS()
2354	NULL
2355};
2356#endif
2357
2358/*
2359 * The syscall interface
2360 */
2361
2362#define	PMC_GET_SX_XLOCK(...) do {		\
2363	sx_xlock(&pmc_sx);			\
2364	if (pmc_hook == NULL) {			\
2365		sx_xunlock(&pmc_sx);		\
2366		return __VA_ARGS__;		\
2367	}					\
2368} while (0)
2369
2370#define	PMC_DOWNGRADE_SX() do {			\
2371	sx_downgrade(&pmc_sx);			\
2372	is_sx_downgraded = 1;			\
2373} while (0)
2374
2375static int
2376pmc_syscall_handler(struct thread *td, void *syscall_args)
2377{
2378	int error, is_sx_downgraded, op;
2379	struct pmc_syscall_args *c;
2380	void *arg;
2381
2382	PMC_GET_SX_XLOCK(ENOSYS);
2383
2384	DROP_GIANT();
2385
2386	is_sx_downgraded = 0;
2387
2388	c = (struct pmc_syscall_args *) syscall_args;
2389
2390	op = c->pmop_code;
2391	arg = c->pmop_data;
2392
2393	PMCDBG(MOD,PMS,1, "syscall op=%d \"%s\" arg=%p", op,
2394	    pmc_op_to_name[op], arg);
2395
2396	error = 0;
2397	atomic_add_int(&pmc_stats.pm_syscalls, 1);
2398
2399	switch(op)
2400	{
2401
2402
2403	/*
2404	 * Configure a log file.
2405	 *
2406	 * XXX This OP will be reworked.
2407	 */
2408
2409	case PMC_OP_CONFIGURELOG:
2410	{
2411		struct pmc *pm;
2412		struct pmc_owner *po;
2413		struct pmc_op_configurelog cl;
2414		struct proc *p;
2415
2416		sx_assert(&pmc_sx, SX_XLOCKED);
2417
2418		if ((error = copyin(arg, &cl, sizeof(cl))) != 0)
2419			break;
2420
2421		/* mark this process as owning a log file */
2422		p = td->td_proc;
2423		if ((po = pmc_find_owner_descriptor(p)) == NULL)
2424			if ((po = pmc_allocate_owner_descriptor(p)) == NULL) {
2425				error = ENOMEM;
2426				break;
2427			}
2428
2429		/*
2430		 * If a valid fd was passed in, try to configure that,
2431		 * otherwise if 'fd' was less than zero and there was
2432		 * a log file configured, flush its buffers and
2433		 * de-configure it.
2434		 */
2435		if (cl.pm_logfd >= 0)
2436			error = pmclog_configure_log(po, cl.pm_logfd);
2437		else if (po->po_flags & PMC_PO_OWNS_LOGFILE) {
2438			pmclog_process_closelog(po);
2439			error = pmclog_flush(po);
2440			if (error == 0) {
2441				LIST_FOREACH(pm, &po->po_pmcs, pm_next)
2442				    if (pm->pm_flags & PMC_F_NEEDS_LOGFILE)
2443					    pmc_stop(pm);
2444				error = pmclog_deconfigure_log(po);
2445			}
2446		} else
2447			error = EINVAL;
2448	}
2449	break;
2450
2451
2452	/*
2453	 * Flush a log file.
2454	 */
2455
2456	case PMC_OP_FLUSHLOG:
2457	{
2458		struct pmc_owner *po;
2459
2460		sx_assert(&pmc_sx, SX_XLOCKED);
2461
2462		if ((po = pmc_find_owner_descriptor(td->td_proc)) == NULL) {
2463			error = EINVAL;
2464			break;
2465		}
2466
2467		error = pmclog_flush(po);
2468	}
2469	break;
2470
2471	/*
2472	 * Retrieve hardware configuration.
2473	 */
2474
2475	case PMC_OP_GETCPUINFO:	/* CPU information */
2476	{
2477		struct pmc_op_getcpuinfo gci;
2478
2479		gci.pm_cputype = md->pmd_cputype;
2480		gci.pm_ncpu    = mp_ncpus;
2481		gci.pm_npmc    = md->pmd_npmc;
2482		gci.pm_nclass  = md->pmd_nclass;
2483		bcopy(md->pmd_classes, &gci.pm_classes,
2484		    sizeof(gci.pm_classes));
2485		error = copyout(&gci, arg, sizeof(gci));
2486	}
2487	break;
2488
2489
2490	/*
2491	 * Get module statistics
2492	 */
2493
2494	case PMC_OP_GETDRIVERSTATS:
2495	{
2496		struct pmc_op_getdriverstats gms;
2497
2498		bcopy(&pmc_stats, &gms, sizeof(gms));
2499		error = copyout(&gms, arg, sizeof(gms));
2500	}
2501	break;
2502
2503
2504	/*
2505	 * Retrieve module version number
2506	 */
2507
2508	case PMC_OP_GETMODULEVERSION:
2509	{
2510		uint32_t cv, modv;
2511
2512		/* retrieve the client's idea of the ABI version */
2513		if ((error = copyin(arg, &cv, sizeof(uint32_t))) != 0)
2514			break;
2515		/* don't service clients newer than our driver */
2516		modv = PMC_VERSION;
2517		if ((cv & 0xFFFF0000) > (modv & 0xFFFF0000)) {
2518			error = EPROGMISMATCH;
2519			break;
2520		}
2521		error = copyout(&modv, arg, sizeof(int));
2522	}
2523	break;
2524
2525
2526	/*
2527	 * Retrieve the state of all the PMCs on a given
2528	 * CPU.
2529	 */
2530
2531	case PMC_OP_GETPMCINFO:
2532	{
2533		uint32_t cpu, n, npmc;
2534		size_t pmcinfo_size;
2535		struct pmc *pm;
2536		struct pmc_info *p, *pmcinfo;
2537		struct pmc_op_getpmcinfo *gpi;
2538		struct pmc_owner *po;
2539		struct pmc_binding pb;
2540
2541		PMC_DOWNGRADE_SX();
2542
2543		gpi = (struct pmc_op_getpmcinfo *) arg;
2544
2545		if ((error = copyin(&gpi->pm_cpu, &cpu, sizeof(cpu))) != 0)
2546			break;
2547
2548		if (cpu >= (unsigned int) mp_ncpus) {
2549			error = EINVAL;
2550			break;
2551		}
2552
2553		if (pmc_cpu_is_disabled(cpu)) {
2554			error = ENXIO;
2555			break;
2556		}
2557
2558		/* switch to CPU 'cpu' */
2559		pmc_save_cpu_binding(&pb);
2560		pmc_select_cpu(cpu);
2561
2562		npmc = md->pmd_npmc;
2563
2564		pmcinfo_size = npmc * sizeof(struct pmc_info);
2565		MALLOC(pmcinfo, struct pmc_info *, pmcinfo_size, M_PMC,
2566		    M_WAITOK);
2567
2568		p = pmcinfo;
2569
2570		for (n = 0; n < md->pmd_npmc; n++, p++) {
2571
2572			if ((error = md->pmd_describe(cpu, n, p, &pm)) != 0)
2573				break;
2574
2575			if (PMC_ROW_DISP_IS_STANDALONE(n))
2576				p->pm_rowdisp = PMC_DISP_STANDALONE;
2577			else if (PMC_ROW_DISP_IS_THREAD(n))
2578				p->pm_rowdisp = PMC_DISP_THREAD;
2579			else
2580				p->pm_rowdisp = PMC_DISP_FREE;
2581
2582			p->pm_ownerpid = -1;
2583
2584			if (pm == NULL)	/* no PMC associated */
2585				continue;
2586
2587			po = pm->pm_owner;
2588
2589			KASSERT(po->po_owner != NULL,
2590			    ("[pmc,%d] pmc_owner had a null proc pointer",
2591				__LINE__));
2592
2593			p->pm_ownerpid = po->po_owner->p_pid;
2594			p->pm_mode     = PMC_TO_MODE(pm);
2595			p->pm_event    = pm->pm_event;
2596			p->pm_flags    = pm->pm_flags;
2597
2598			if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
2599				p->pm_reloadcount =
2600				    pm->pm_sc.pm_reloadcount;
2601		}
2602
2603		pmc_restore_cpu_binding(&pb);
2604
2605		/* now copy out the PMC info collected */
2606		if (error == 0)
2607			error = copyout(pmcinfo, &gpi->pm_pmcs, pmcinfo_size);
2608
2609		FREE(pmcinfo, M_PMC);
2610	}
2611	break;
2612
2613
2614	/*
2615	 * Set the administrative state of a PMC.  I.e. whether
2616	 * the PMC is to be used or not.
2617	 */
2618
2619	case PMC_OP_PMCADMIN:
2620	{
2621		int cpu, ri;
2622		enum pmc_state request;
2623		struct pmc_cpu *pc;
2624		struct pmc_hw *phw;
2625		struct pmc_op_pmcadmin pma;
2626		struct pmc_binding pb;
2627
2628		sx_assert(&pmc_sx, SX_XLOCKED);
2629
2630		KASSERT(td == curthread,
2631		    ("[pmc,%d] td != curthread", __LINE__));
2632
2633		if (suser(td) || jailed(td->td_ucred)) {
2634			error =  EPERM;
2635			break;
2636		}
2637
2638		if ((error = copyin(arg, &pma, sizeof(pma))) != 0)
2639			break;
2640
2641		cpu = pma.pm_cpu;
2642
2643		if (cpu < 0 || cpu >= mp_ncpus) {
2644			error = EINVAL;
2645			break;
2646		}
2647
2648		if (pmc_cpu_is_disabled(cpu)) {
2649			error = ENXIO;
2650			break;
2651		}
2652
2653		request = pma.pm_state;
2654
2655		if (request != PMC_STATE_DISABLED &&
2656		    request != PMC_STATE_FREE) {
2657			error = EINVAL;
2658			break;
2659		}
2660
2661		ri = pma.pm_pmc; /* pmc id == row index */
2662		if (ri < 0 || ri >= (int) md->pmd_npmc) {
2663			error = EINVAL;
2664			break;
2665		}
2666
2667		/*
2668		 * We can't disable a PMC with a row-index allocated
2669		 * for process virtual PMCs.
2670		 */
2671
2672		if (PMC_ROW_DISP_IS_THREAD(ri) &&
2673		    request == PMC_STATE_DISABLED) {
2674			error = EBUSY;
2675			break;
2676		}
2677
2678		/*
2679		 * otherwise, this PMC on this CPU is either free or
2680		 * in system-wide mode.
2681		 */
2682
2683		pmc_save_cpu_binding(&pb);
2684		pmc_select_cpu(cpu);
2685
2686		pc  = pmc_pcpu[cpu];
2687		phw = pc->pc_hwpmcs[ri];
2688
2689		/*
2690		 * XXX do we need some kind of 'forced' disable?
2691		 */
2692
2693		if (phw->phw_pmc == NULL) {
2694			if (request == PMC_STATE_DISABLED &&
2695			    (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED)) {
2696				phw->phw_state &= ~PMC_PHW_FLAG_IS_ENABLED;
2697				PMC_MARK_ROW_STANDALONE(ri);
2698			} else if (request == PMC_STATE_FREE &&
2699			    (phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) == 0) {
2700				phw->phw_state |=  PMC_PHW_FLAG_IS_ENABLED;
2701				PMC_UNMARK_ROW_STANDALONE(ri);
2702			}
2703			/* other cases are a no-op */
2704		} else
2705			error = EBUSY;
2706
2707		pmc_restore_cpu_binding(&pb);
2708	}
2709	break;
2710
2711
2712	/*
2713	 * Allocate a PMC.
2714	 */
2715
2716	case PMC_OP_PMCALLOCATE:
2717	{
2718		uint32_t caps;
2719		u_int cpu;
2720		int n;
2721		enum pmc_mode mode;
2722		struct pmc *pmc;
2723		struct pmc_hw *phw;
2724		struct pmc_op_pmcallocate pa;
2725		struct pmc_binding pb;
2726
2727		if ((error = copyin(arg, &pa, sizeof(pa))) != 0)
2728			break;
2729
2730		caps = pa.pm_caps;
2731		mode = pa.pm_mode;
2732		cpu  = pa.pm_cpu;
2733
2734		if ((mode != PMC_MODE_SS  &&  mode != PMC_MODE_SC  &&
2735		     mode != PMC_MODE_TS  &&  mode != PMC_MODE_TC) ||
2736		    (cpu != (u_int) PMC_CPU_ANY && cpu >= (u_int) mp_ncpus)) {
2737			error = EINVAL;
2738			break;
2739		}
2740
2741		/*
2742		 * Virtual PMCs should only ask for a default CPU.
2743		 * System mode PMCs need to specify a non-default CPU.
2744		 */
2745
2746		if ((PMC_IS_VIRTUAL_MODE(mode) && cpu != (u_int) PMC_CPU_ANY) ||
2747		    (PMC_IS_SYSTEM_MODE(mode) && cpu == (u_int) PMC_CPU_ANY)) {
2748			error = EINVAL;
2749			break;
2750		}
2751
2752		/*
2753		 * Check that a disabled CPU is not being asked for.
2754		 */
2755
2756		if (PMC_IS_SYSTEM_MODE(mode) && pmc_cpu_is_disabled(cpu)) {
2757			error = ENXIO;
2758			break;
2759		}
2760
2761		/*
2762		 * Refuse an allocation for a system-wide PMC if this
2763		 * process has been jailed, or if this process lacks
2764		 * super-user credentials and the sysctl tunable
2765		 * 'security.bsd.unprivileged_syspmcs' is zero.
2766		 */
2767
2768		if (PMC_IS_SYSTEM_MODE(mode)) {
2769			if (jailed(curthread->td_ucred))
2770				error = EPERM;
2771			else if (suser(curthread) &&
2772			    (pmc_unprivileged_syspmcs == 0))
2773				error = EPERM;
2774		}
2775
2776		if (error)
2777			break;
2778
2779		/*
2780		 * Look for valid values for 'pm_flags'
2781		 */
2782
2783		if ((pa.pm_flags & ~(PMC_F_DESCENDANTS | PMC_F_LOG_PROCCSW |
2784		    PMC_F_LOG_PROCEXIT)) != 0) {
2785			error = EINVAL;
2786			break;
2787		}
2788
2789		/* process logging options are not allowed for system PMCs */
2790		if (PMC_IS_SYSTEM_MODE(mode) && (pa.pm_flags &
2791		    (PMC_F_LOG_PROCCSW | PMC_F_LOG_PROCEXIT))) {
2792			error = EINVAL;
2793			break;
2794		}
2795
2796		/*
2797		 * All sampling mode PMCs need to be able to interrupt the
2798		 * CPU.
2799		 */
2800		if (PMC_IS_SAMPLING_MODE(mode))
2801			caps |= PMC_CAP_INTERRUPT;
2802
2803		/* A valid class specifier should have been passed in. */
2804		for (n = 0; n < md->pmd_nclass; n++)
2805			if (md->pmd_classes[n].pm_class == pa.pm_class)
2806				break;
2807		if (n == md->pmd_nclass) {
2808			error = EINVAL;
2809			break;
2810		}
2811
2812		/* The requested PMC capabilities should be feasible. */
2813		if ((md->pmd_classes[n].pm_caps & caps) != caps) {
2814			error = EOPNOTSUPP;
2815			break;
2816		}
2817
2818		PMCDBG(PMC,ALL,2, "event=%d caps=0x%x mode=%d cpu=%d",
2819		    pa.pm_ev, caps, mode, cpu);
2820
2821		pmc = pmc_allocate_pmc_descriptor();
2822		pmc->pm_id    = PMC_ID_MAKE_ID(cpu,pa.pm_mode,pa.pm_class,
2823		    PMC_ID_INVALID);
2824		pmc->pm_event = pa.pm_ev;
2825		pmc->pm_state = PMC_STATE_FREE;
2826		pmc->pm_caps  = caps;
2827		pmc->pm_flags = pa.pm_flags;
2828
2829		/* switch thread to CPU 'cpu' */
2830		pmc_save_cpu_binding(&pb);
2831
2832#define	PMC_IS_SHAREABLE_PMC(cpu, n)				\
2833	(pmc_pcpu[(cpu)]->pc_hwpmcs[(n)]->phw_state &		\
2834	 PMC_PHW_FLAG_IS_SHAREABLE)
2835#define	PMC_IS_UNALLOCATED(cpu, n)				\
2836	(pmc_pcpu[(cpu)]->pc_hwpmcs[(n)]->phw_pmc == NULL)
2837
2838		if (PMC_IS_SYSTEM_MODE(mode)) {
2839			pmc_select_cpu(cpu);
2840			for (n = 0; n < (int) md->pmd_npmc; n++)
2841				if (pmc_can_allocate_row(n, mode) == 0 &&
2842				    pmc_can_allocate_rowindex(
2843					    curthread->td_proc, n, cpu) == 0 &&
2844				    (PMC_IS_UNALLOCATED(cpu, n) ||
2845				     PMC_IS_SHAREABLE_PMC(cpu, n)) &&
2846				    md->pmd_allocate_pmc(cpu, n, pmc,
2847					&pa) == 0)
2848					break;
2849		} else {
2850			/* Process virtual mode */
2851			for (n = 0; n < (int) md->pmd_npmc; n++) {
2852				if (pmc_can_allocate_row(n, mode) == 0 &&
2853				    pmc_can_allocate_rowindex(
2854					    curthread->td_proc, n,
2855					    PMC_CPU_ANY) == 0 &&
2856				    md->pmd_allocate_pmc(curthread->td_oncpu,
2857					n, pmc, &pa) == 0)
2858					break;
2859			}
2860		}
2861
2862#undef	PMC_IS_UNALLOCATED
2863#undef	PMC_IS_SHAREABLE_PMC
2864
2865		pmc_restore_cpu_binding(&pb);
2866
2867		if (n == (int) md->pmd_npmc) {
2868			pmc_destroy_pmc_descriptor(pmc);
2869			FREE(pmc, M_PMC);
2870			pmc = NULL;
2871			error = EINVAL;
2872			break;
2873		}
2874
2875		/* Fill in the correct value in the ID field */
2876		pmc->pm_id = PMC_ID_MAKE_ID(cpu,mode,pa.pm_class,n);
2877
2878		PMCDBG(PMC,ALL,2, "ev=%d class=%d mode=%d n=%d -> pmcid=%x",
2879		    pmc->pm_event, pa.pm_class, mode, n, pmc->pm_id);
2880
2881		/* Process mode PMCs with logging enabled need log files */
2882		if (pmc->pm_flags & (PMC_F_LOG_PROCEXIT | PMC_F_LOG_PROCCSW))
2883			pmc->pm_flags |= PMC_F_NEEDS_LOGFILE;
2884
2885		/* All system mode sampling PMCs require a log file */
2886		if (PMC_IS_SAMPLING_MODE(mode) && PMC_IS_SYSTEM_MODE(mode))
2887			pmc->pm_flags |= PMC_F_NEEDS_LOGFILE;
2888
2889		/*
2890		 * Configure global pmc's immediately
2891		 */
2892
2893		if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pmc))) {
2894
2895			pmc_save_cpu_binding(&pb);
2896			pmc_select_cpu(cpu);
2897
2898			phw = pmc_pcpu[cpu]->pc_hwpmcs[n];
2899
2900			if ((phw->phw_state & PMC_PHW_FLAG_IS_ENABLED) == 0 ||
2901			    (error = md->pmd_config_pmc(cpu, n, pmc)) != 0) {
2902				(void) md->pmd_release_pmc(cpu, n, pmc);
2903				pmc_destroy_pmc_descriptor(pmc);
2904				FREE(pmc, M_PMC);
2905				pmc = NULL;
2906				pmc_restore_cpu_binding(&pb);
2907				error = EPERM;
2908				break;
2909			}
2910
2911			pmc_restore_cpu_binding(&pb);
2912		}
2913
2914		pmc->pm_state    = PMC_STATE_ALLOCATED;
2915
2916		/*
2917		 * mark row disposition
2918		 */
2919
2920		if (PMC_IS_SYSTEM_MODE(mode))
2921			PMC_MARK_ROW_STANDALONE(n);
2922		else
2923			PMC_MARK_ROW_THREAD(n);
2924
2925		/*
2926		 * Register this PMC with the current thread as its owner.
2927		 */
2928
2929		if ((error =
2930		    pmc_register_owner(curthread->td_proc, pmc)) != 0) {
2931			pmc_release_pmc_descriptor(pmc);
2932			FREE(pmc, M_PMC);
2933			pmc = NULL;
2934			break;
2935		}
2936
2937		/*
2938		 * Return the allocated index.
2939		 */
2940
2941		pa.pm_pmcid = pmc->pm_id;
2942
2943		error = copyout(&pa, arg, sizeof(pa));
2944	}
2945	break;
2946
2947
2948	/*
2949	 * Attach a PMC to a process.
2950	 */
2951
2952	case PMC_OP_PMCATTACH:
2953	{
2954		struct pmc *pm;
2955		struct proc *p;
2956		struct pmc_op_pmcattach a;
2957
2958		sx_assert(&pmc_sx, SX_XLOCKED);
2959
2960		if ((error = copyin(arg, &a, sizeof(a))) != 0)
2961			break;
2962
2963		if (a.pm_pid < 0) {
2964			error = EINVAL;
2965			break;
2966		} else if (a.pm_pid == 0)
2967			a.pm_pid = td->td_proc->p_pid;
2968
2969		if ((error = pmc_find_pmc(a.pm_pmc, &pm)) != 0)
2970			break;
2971
2972		if (PMC_IS_SYSTEM_MODE(PMC_TO_MODE(pm))) {
2973			error = EINVAL;
2974			break;
2975		}
2976
2977		/* PMCs may be (re)attached only when allocated or stopped */
2978		if (pm->pm_state == PMC_STATE_RUNNING) {
2979			error = EBUSY;
2980			break;
2981		} else if (pm->pm_state != PMC_STATE_ALLOCATED &&
2982		    pm->pm_state != PMC_STATE_STOPPED) {
2983			error = EINVAL;
2984			break;
2985		}
2986
2987		/* lookup pid */
2988		if ((p = pfind(a.pm_pid)) == NULL) {
2989			error = ESRCH;
2990			break;
2991		}
2992
2993		/*
2994		 * Ignore processes that are working on exiting.
2995		 */
2996		if (p->p_flag & P_WEXIT) {
2997			error = ESRCH;
2998			PROC_UNLOCK(p);	/* pfind() returns a locked process */
2999			break;
3000		}
3001
3002		/*
3003		 * we are allowed to attach a PMC to a process if
3004		 * we can debug it.
3005		 */
3006		error = p_candebug(curthread, p);
3007
3008		PROC_UNLOCK(p);
3009
3010		if (error == 0)
3011			error = pmc_attach_process(p, pm);
3012	}
3013	break;
3014
3015
3016	/*
3017	 * Detach an attached PMC from a process.
3018	 */
3019
3020	case PMC_OP_PMCDETACH:
3021	{
3022		struct pmc *pm;
3023		struct proc *p;
3024		struct pmc_op_pmcattach a;
3025
3026		if ((error = copyin(arg, &a, sizeof(a))) != 0)
3027			break;
3028
3029		if (a.pm_pid < 0) {
3030			error = EINVAL;
3031			break;
3032		} else if (a.pm_pid == 0)
3033			a.pm_pid = td->td_proc->p_pid;
3034
3035		if ((error = pmc_find_pmc(a.pm_pmc, &pm)) != 0)
3036			break;
3037
3038		if ((p = pfind(a.pm_pid)) == NULL) {
3039			error = ESRCH;
3040			break;
3041		}
3042
3043		/*
3044		 * Treat processes that are in the process of exiting
3045		 * as if they were not present.
3046		 */
3047
3048		if (p->p_flag & P_WEXIT)
3049			error = ESRCH;
3050
3051		PROC_UNLOCK(p);	/* pfind() returns a locked process */
3052
3053		if (error == 0)
3054			error = pmc_detach_process(p, pm);
3055	}
3056	break;
3057
3058
3059	/*
3060	 * Retrieve the MSR number associated with the counter
3061	 * 'pmc_id'.  This allows processes to directly use RDPMC
3062	 * instructions to read their PMCs, without the overhead of a
3063	 * system call.
3064	 */
3065
3066	case PMC_OP_PMCGETMSR:
3067	{
3068		int ri;
3069		struct pmc	*pm;
3070		struct pmc_target *pt;
3071		struct pmc_op_getmsr gm;
3072
3073		PMC_DOWNGRADE_SX();
3074
3075		/* CPU has no 'GETMSR' support */
3076		if (md->pmd_get_msr == NULL) {
3077			error = ENOSYS;
3078			break;
3079		}
3080
3081		if ((error = copyin(arg, &gm, sizeof(gm))) != 0)
3082			break;
3083
3084		if ((error = pmc_find_pmc(gm.pm_pmcid, &pm)) != 0)
3085			break;
3086
3087		/*
3088		 * The allocated PMC has to be a process virtual PMC,
3089		 * i.e., of type MODE_T[CS].  Global PMCs can only be
3090		 * read using the PMCREAD operation since they may be
3091		 * allocated on a different CPU than the one we could
3092		 * be running on at the time of the RDPMC instruction.
3093		 *
3094		 * The GETMSR operation is not allowed for PMCs that
3095		 * are inherited across processes.
3096		 */
3097
3098		if (!PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)) ||
3099		    (pm->pm_flags & PMC_F_DESCENDANTS)) {
3100			error = EINVAL;
3101			break;
3102		}
3103
3104		/*
3105		 * It only makes sense to use a RDPMC (or its
3106		 * equivalent instruction on non-x86 architectures) on
3107		 * a process that has allocated and attached a PMC to
3108		 * itself.  Conversely the PMC is only allowed to have
3109		 * one process attached to it -- its owner.
3110		 */
3111
3112		if ((pt = LIST_FIRST(&pm->pm_targets)) == NULL ||
3113		    LIST_NEXT(pt, pt_next) != NULL ||
3114		    pt->pt_process->pp_proc != pm->pm_owner->po_owner) {
3115			error = EINVAL;
3116			break;
3117		}
3118
3119		ri = PMC_TO_ROWINDEX(pm);
3120
3121		if ((error = (*md->pmd_get_msr)(ri, &gm.pm_msr)) < 0)
3122			break;
3123
3124		if ((error = copyout(&gm, arg, sizeof(gm))) < 0)
3125			break;
3126
3127		/*
3128		 * Mark our process as using MSRs.  Update machine
3129		 * state using a forced context switch.
3130		 */
3131
3132		pt->pt_process->pp_flags |= PMC_PP_ENABLE_MSR_ACCESS;
3133		pmc_force_context_switch();
3134
3135	}
3136	break;
3137
3138	/*
3139	 * Release an allocated PMC
3140	 */
3141
3142	case PMC_OP_PMCRELEASE:
3143	{
3144		pmc_id_t pmcid;
3145		struct pmc *pm;
3146		struct pmc_owner *po;
3147		struct pmc_op_simple sp;
3148
3149		/*
3150		 * Find PMC pointer for the named PMC.
3151		 *
3152		 * Use pmc_release_pmc_descriptor() to switch off the
3153		 * PMC, remove all its target threads, and remove the
3154		 * PMC from its owner's list.
3155		 *
3156		 * Remove the owner record if this is the last PMC
3157		 * owned.
3158		 *
3159		 * Free up space.
3160		 */
3161
3162		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
3163			break;
3164
3165		pmcid = sp.pm_pmcid;
3166
3167		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
3168			break;
3169
3170		po = pm->pm_owner;
3171		pmc_release_pmc_descriptor(pm);
3172		pmc_maybe_remove_owner(po);
3173
3174		FREE(pm, M_PMC);
3175	}
3176	break;
3177
3178
3179	/*
3180	 * Read and/or write a PMC.
3181	 */
3182
3183	case PMC_OP_PMCRW:
3184	{
3185		uint32_t cpu, ri;
3186		struct pmc *pm;
3187		struct pmc_op_pmcrw *pprw;
3188		struct pmc_op_pmcrw prw;
3189		struct pmc_binding pb;
3190		pmc_value_t oldvalue;
3191
3192		PMC_DOWNGRADE_SX();
3193
3194		if ((error = copyin(arg, &prw, sizeof(prw))) != 0)
3195			break;
3196
3197		ri = 0;
3198		PMCDBG(PMC,OPS,1, "rw id=%d flags=0x%x", prw.pm_pmcid,
3199		    prw.pm_flags);
3200
3201		/* must have at least one flag set */
3202		if ((prw.pm_flags & (PMC_F_OLDVALUE|PMC_F_NEWVALUE)) == 0) {
3203			error = EINVAL;
3204			break;
3205		}
3206
3207		/* locate pmc descriptor */
3208		if ((error = pmc_find_pmc(prw.pm_pmcid, &pm)) != 0)
3209			break;
3210
3211		/* Can't read a PMC that hasn't been started. */
3212		if (pm->pm_state != PMC_STATE_ALLOCATED &&
3213		    pm->pm_state != PMC_STATE_STOPPED &&
3214		    pm->pm_state != PMC_STATE_RUNNING) {
3215			error = EINVAL;
3216			break;
3217		}
3218
3219		/* writing a new value is allowed only for 'STOPPED' pmcs */
3220		if (pm->pm_state == PMC_STATE_RUNNING &&
3221		    (prw.pm_flags & PMC_F_NEWVALUE)) {
3222			error = EBUSY;
3223			break;
3224		}
3225
3226		if (PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm))) {
3227
3228			/*
3229			 * If this PMC is attached to its owner (i.e.,
3230			 * the process requesting this operation) and
3231			 * is running, then attempt to get an
3232			 * upto-date reading from hardware for a READ.
3233			 * Writes are only allowed when the PMC is
3234			 * stopped, so only update the saved value
3235			 * field.
3236			 *
3237			 * If the PMC is not running, or is not
3238			 * attached to its owner, read/write to the
3239			 * savedvalue field.
3240			 */
3241
3242			ri = PMC_TO_ROWINDEX(pm);
3243
3244			mtx_pool_lock_spin(pmc_mtxpool, pm);
3245			cpu = curthread->td_oncpu;
3246
3247			if (prw.pm_flags & PMC_F_OLDVALUE) {
3248				if ((pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) &&
3249				    (pm->pm_state == PMC_STATE_RUNNING))
3250					error = (*md->pmd_read_pmc)(cpu, ri,
3251					    &oldvalue);
3252				else
3253					oldvalue = pm->pm_gv.pm_savedvalue;
3254			}
3255			if (prw.pm_flags & PMC_F_NEWVALUE)
3256				pm->pm_gv.pm_savedvalue = prw.pm_value;
3257
3258			mtx_pool_unlock_spin(pmc_mtxpool, pm);
3259
3260		} else { /* System mode PMCs */
3261			cpu = PMC_TO_CPU(pm);
3262			ri  = PMC_TO_ROWINDEX(pm);
3263
3264			if (pmc_cpu_is_disabled(cpu)) {
3265				error = ENXIO;
3266				break;
3267			}
3268
3269			/* move this thread to CPU 'cpu' */
3270			pmc_save_cpu_binding(&pb);
3271			pmc_select_cpu(cpu);
3272
3273			critical_enter();
3274			/* save old value */
3275			if (prw.pm_flags & PMC_F_OLDVALUE)
3276				if ((error = (*md->pmd_read_pmc)(cpu, ri,
3277					 &oldvalue)))
3278					goto error;
3279			/* write out new value */
3280			if (prw.pm_flags & PMC_F_NEWVALUE)
3281				error = (*md->pmd_write_pmc)(cpu, ri,
3282				    prw.pm_value);
3283		error:
3284			critical_exit();
3285			pmc_restore_cpu_binding(&pb);
3286			if (error)
3287				break;
3288		}
3289
3290		pprw = (struct pmc_op_pmcrw *) arg;
3291
3292#ifdef	DEBUG
3293		if (prw.pm_flags & PMC_F_NEWVALUE)
3294			PMCDBG(PMC,OPS,2, "rw id=%d new %jx -> old %jx",
3295			    ri, prw.pm_value, oldvalue);
3296		else if (prw.pm_flags & PMC_F_OLDVALUE)
3297			PMCDBG(PMC,OPS,2, "rw id=%d -> old %jx", ri, oldvalue);
3298#endif
3299
3300		/* return old value if requested */
3301		if (prw.pm_flags & PMC_F_OLDVALUE)
3302			if ((error = copyout(&oldvalue, &pprw->pm_value,
3303				 sizeof(prw.pm_value))))
3304				break;
3305
3306	}
3307	break;
3308
3309
3310	/*
3311	 * Set the sampling rate for a sampling mode PMC and the
3312	 * initial count for a counting mode PMC.
3313	 */
3314
3315	case PMC_OP_PMCSETCOUNT:
3316	{
3317		struct pmc *pm;
3318		struct pmc_op_pmcsetcount sc;
3319
3320		PMC_DOWNGRADE_SX();
3321
3322		if ((error = copyin(arg, &sc, sizeof(sc))) != 0)
3323			break;
3324
3325		if ((error = pmc_find_pmc(sc.pm_pmcid, &pm)) != 0)
3326			break;
3327
3328		if (pm->pm_state == PMC_STATE_RUNNING) {
3329			error = EBUSY;
3330			break;
3331		}
3332
3333		if (PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)))
3334			pm->pm_sc.pm_reloadcount = sc.pm_count;
3335		else
3336			pm->pm_sc.pm_initial = sc.pm_count;
3337	}
3338	break;
3339
3340
3341	/*
3342	 * Start a PMC.
3343	 */
3344
3345	case PMC_OP_PMCSTART:
3346	{
3347		pmc_id_t pmcid;
3348		struct pmc *pm;
3349		struct pmc_op_simple sp;
3350
3351		sx_assert(&pmc_sx, SX_XLOCKED);
3352
3353		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
3354			break;
3355
3356		pmcid = sp.pm_pmcid;
3357
3358		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
3359			break;
3360
3361		KASSERT(pmcid == pm->pm_id,
3362		    ("[pmc,%d] pmcid %x != id %x", __LINE__,
3363			pm->pm_id, pmcid));
3364
3365		if (pm->pm_state == PMC_STATE_RUNNING) /* already running */
3366			break;
3367		else if (pm->pm_state != PMC_STATE_STOPPED &&
3368		    pm->pm_state != PMC_STATE_ALLOCATED) {
3369			error = EINVAL;
3370			break;
3371		}
3372
3373		error = pmc_start(pm);
3374	}
3375	break;
3376
3377
3378	/*
3379	 * Stop a PMC.
3380	 */
3381
3382	case PMC_OP_PMCSTOP:
3383	{
3384		pmc_id_t pmcid;
3385		struct pmc *pm;
3386		struct pmc_op_simple sp;
3387
3388		PMC_DOWNGRADE_SX();
3389
3390		if ((error = copyin(arg, &sp, sizeof(sp))) != 0)
3391			break;
3392
3393		pmcid = sp.pm_pmcid;
3394
3395		/*
3396		 * Mark the PMC as inactive and invoke the MD stop
3397		 * routines if needed.
3398		 */
3399
3400		if ((error = pmc_find_pmc(pmcid, &pm)) != 0)
3401			break;
3402
3403		KASSERT(pmcid == pm->pm_id,
3404		    ("[pmc,%d] pmc id %x != pmcid %x", __LINE__,
3405			pm->pm_id, pmcid));
3406
3407		if (pm->pm_state == PMC_STATE_STOPPED) /* already stopped */
3408			break;
3409		else if (pm->pm_state != PMC_STATE_RUNNING) {
3410			error = EINVAL;
3411			break;
3412		}
3413
3414		error = pmc_stop(pm);
3415	}
3416	break;
3417
3418
3419	/*
3420	 * Write a user supplied value to the log file.
3421	 */
3422
3423	case PMC_OP_WRITELOG:
3424	{
3425		struct pmc_op_writelog wl;
3426		struct pmc_owner *po;
3427
3428		PMC_DOWNGRADE_SX();
3429
3430		if ((error = copyin(arg, &wl, sizeof(wl))) != 0)
3431			break;
3432
3433		if ((po = pmc_find_owner_descriptor(td->td_proc)) == NULL) {
3434			error = EINVAL;
3435			break;
3436		}
3437
3438		if ((po->po_flags & PMC_PO_OWNS_LOGFILE) == 0) {
3439			error = EINVAL;
3440			break;
3441		}
3442
3443		error = pmclog_process_userlog(po, &wl);
3444	}
3445	break;
3446
3447
3448	default:
3449		error = EINVAL;
3450		break;
3451	}
3452
3453	if (is_sx_downgraded)
3454		sx_sunlock(&pmc_sx);
3455	else
3456		sx_xunlock(&pmc_sx);
3457
3458	if (error)
3459		atomic_add_int(&pmc_stats.pm_syscall_errors, 1);
3460
3461	PICKUP_GIANT();
3462
3463	return error;
3464}
3465
3466/*
3467 * Helper functions
3468 */
3469
3470
3471/*
3472 * Interrupt processing.
3473 *
3474 * Find a free slot in the per-cpu array of PC samples and write the
3475 * current (PMC,PID,PC) triple to it.  If an event was successfully
3476 * added, a bit is set in mask 'pmc_cpumask' denoting that the
3477 * DO_SAMPLES hook needs to be invoked from the clock handler.
3478 *
3479 * This function is meant to be called from an NMI handler.  It cannot
3480 * use any of the locking primitives supplied by the OS.
3481 */
3482
3483int
3484pmc_process_interrupt(int cpu, struct pmc *pm, uintfptr_t pc, int usermode)
3485{
3486	int error, ri;
3487	struct thread *td;
3488	struct pmc_sample *ps;
3489	struct pmc_samplebuffer *psb;
3490
3491	error = 0;
3492	ri = PMC_TO_ROWINDEX(pm);
3493
3494	psb = pmc_pcpu[cpu]->pc_sb;
3495
3496	ps = psb->ps_write;
3497	if (ps->ps_pc) {	/* in use, reader hasn't caught up */
3498		pm->pm_stalled = 1;
3499		atomic_add_int(&pmc_stats.pm_intr_bufferfull, 1);
3500		PMCDBG(SAM,INT,1,"(spc) cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d",
3501		    cpu, pm, (uint64_t) pc, usermode,
3502		    (int) (psb->ps_write - psb->ps_samples),
3503		    (int) (psb->ps_read - psb->ps_samples));
3504		error = ENOMEM;
3505		goto done;
3506	}
3507
3508	/* fill in entry */
3509	PMCDBG(SAM,INT,1,"cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d", cpu, pm,
3510	    (uint64_t) pc, usermode,
3511	    (int) (psb->ps_write - psb->ps_samples),
3512	    (int) (psb->ps_read - psb->ps_samples));
3513
3514	atomic_add_rel_32(&pm->pm_runcount, 1);		/* hold onto PMC */
3515	ps->ps_pmc = pm;
3516	if ((td = curthread) && td->td_proc)
3517		ps->ps_pid = td->td_proc->p_pid;
3518	else
3519		ps->ps_pid = -1;
3520	ps->ps_usermode = usermode;
3521	ps->ps_pc = pc;		/* mark entry as in use */
3522
3523	/* increment write pointer, modulo ring buffer size */
3524	ps++;
3525	if (ps == psb->ps_fence)
3526		psb->ps_write = psb->ps_samples;
3527	else
3528		psb->ps_write = ps;
3529
3530 done:
3531	/* mark CPU as needing processing */
3532	atomic_set_rel_int(&pmc_cpumask, (1 << cpu));
3533
3534	return error;
3535}
3536
3537
3538/*
3539 * Process saved PC samples.
3540 */
3541
3542static void
3543pmc_process_samples(int cpu)
3544{
3545	int n, ri;
3546	struct pmc *pm;
3547	struct thread *td;
3548	struct pmc_owner *po;
3549	struct pmc_sample *ps;
3550	struct pmc_samplebuffer *psb;
3551
3552	KASSERT(PCPU_GET(cpuid) == cpu,
3553	    ("[pmc,%d] not on the correct CPU pcpu=%d cpu=%d", __LINE__,
3554		PCPU_GET(cpuid), cpu));
3555
3556	psb = pmc_pcpu[cpu]->pc_sb;
3557
3558	for (n = 0; n < pmc_nsamples; n++) { /* bound on #iterations */
3559
3560		ps = psb->ps_read;
3561		if (ps->ps_pc == (uintfptr_t) 0)	/* no data */
3562			break;
3563
3564		pm = ps->ps_pmc;
3565		po = pm->pm_owner;
3566
3567		KASSERT(PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)),
3568		    ("[pmc,%d] pmc=%p non-sampling mode=%d", __LINE__,
3569			pm, PMC_TO_MODE(pm)));
3570
3571		/* Ignore PMCs that have been switched off */
3572		if (pm->pm_state != PMC_STATE_RUNNING)
3573			goto entrydone;
3574
3575		PMCDBG(SAM,OPS,1,"cpu=%d pm=%p pc=%jx um=%d wr=%d rd=%d", cpu,
3576		    pm, (uint64_t) ps->ps_pc, ps->ps_usermode,
3577		    (int) (psb->ps_write - psb->ps_samples),
3578		    (int) (psb->ps_read - psb->ps_samples));
3579
3580		/*
3581		 * If this is a process-mode PMC that is attached to
3582		 * its owner, and if the PC is in user mode, update
3583		 * profiling statistics like timer-based profiling
3584		 * would have done.
3585		 */
3586		if (pm->pm_flags & PMC_F_ATTACHED_TO_OWNER) {
3587			if (ps->ps_usermode) {
3588				td = FIRST_THREAD_IN_PROC(po->po_owner);
3589				addupc_intr(td, ps->ps_pc, 1);
3590			}
3591			goto entrydone;
3592		}
3593
3594		/*
3595		 * Otherwise, this is either a sampling mode PMC that
3596		 * is attached to a different process than its owner,
3597		 * or a system-wide sampling PMC.  Dispatch a log
3598		 * entry to the PMC's owner process.
3599		 */
3600
3601		pmclog_process_pcsample(pm, ps);
3602
3603	entrydone:
3604		ps->ps_pc = (uintfptr_t) 0;	/* mark entry as free */
3605		atomic_subtract_rel_32(&pm->pm_runcount, 1);
3606
3607		/* increment read pointer, modulo sample size */
3608		if (++ps == psb->ps_fence)
3609			psb->ps_read = psb->ps_samples;
3610		else
3611			psb->ps_read = ps;
3612	}
3613
3614	atomic_add_int(&pmc_stats.pm_log_sweeps, 1);
3615
3616	/* Do not re-enable stalled PMCs if we failed to process any samples */
3617	if (n == 0)
3618		return;
3619
3620	/*
3621	 * Restart any stalled sampling PMCs on this CPU.
3622	 *
3623	 * If the NMI handler sets the pm_stalled field of a PMC after
3624	 * the check below, we'll end up processing the stalled PMC at
3625	 * the next hardclock tick.
3626	 */
3627	for (n = 0; n < md->pmd_npmc; n++) {
3628		(void) (*md->pmd_get_config)(cpu,n,&pm);
3629		if (pm == NULL ||			 /* !cfg'ed */
3630		    pm->pm_state != PMC_STATE_RUNNING || /* !active */
3631		    !PMC_IS_SAMPLING_MODE(PMC_TO_MODE(pm)) || /* !sampling */
3632		    pm->pm_stalled == 0) /* !stalled */
3633			continue;
3634
3635		pm->pm_stalled = 0;
3636		ri = PMC_TO_ROWINDEX(pm);
3637		(*md->pmd_start_pmc)(cpu, ri);
3638	}
3639}
3640
3641/*
3642 * Event handlers.
3643 */
3644
3645/*
3646 * Handle a process exit.
3647 *
3648 * Remove this process from all hash tables.  If this process
3649 * owned any PMCs, turn off those PMCs and deallocate them,
3650 * removing any associations with target processes.
3651 *
3652 * This function will be called by the last 'thread' of a
3653 * process.
3654 *
3655 * XXX This eventhandler gets called early in the exit process.
3656 * Consider using a 'hook' invocation from thread_exit() or equivalent
3657 * spot.  Another negative is that kse_exit doesn't seem to call
3658 * exit1() [??].
3659 *
3660 */
3661
3662static void
3663pmc_process_exit(void *arg __unused, struct proc *p)
3664{
3665	int is_using_hwpmcs;
3666	int cpu;
3667	unsigned int ri;
3668	struct pmc *pm;
3669	struct pmc_process *pp;
3670	struct pmc_owner *po;
3671	pmc_value_t newvalue, tmp;
3672
3673	PROC_LOCK(p);
3674	is_using_hwpmcs = p->p_flag & P_HWPMC;
3675	PROC_UNLOCK(p);
3676
3677	/*
3678	 * Log a sysexit event to all SS PMC owners.
3679	 */
3680	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
3681	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
3682		    pmclog_process_sysexit(po, p->p_pid);
3683
3684	if (!is_using_hwpmcs)
3685		return;
3686
3687	PMC_GET_SX_XLOCK();
3688	PMCDBG(PRC,EXT,1,"process-exit proc=%p (%d, %s)", p, p->p_pid,
3689	    p->p_comm);
3690
3691	/*
3692	 * Since this code is invoked by the last thread in an exiting
3693	 * process, we would have context switched IN at some prior
3694	 * point.  However, with PREEMPTION, kernel mode context
3695	 * switches may happen any time, so we want to disable a
3696	 * context switch OUT till we get any PMCs targetting this
3697	 * process off the hardware.
3698	 *
3699	 * We also need to atomically remove this process'
3700	 * entry from our target process hash table, using
3701	 * PMC_FLAG_REMOVE.
3702	 */
3703	PMCDBG(PRC,EXT,1, "process-exit proc=%p (%d, %s)", p, p->p_pid,
3704	    p->p_comm);
3705
3706	critical_enter(); /* no preemption */
3707
3708	cpu = curthread->td_oncpu;
3709
3710	if ((pp = pmc_find_process_descriptor(p,
3711		 PMC_FLAG_REMOVE)) != NULL) {
3712
3713		PMCDBG(PRC,EXT,2,
3714		    "process-exit proc=%p pmc-process=%p", p, pp);
3715
3716		/*
3717		 * The exiting process could the target of
3718		 * some PMCs which will be running on
3719		 * currently executing CPU.
3720		 *
3721		 * We need to turn these PMCs off like we
3722		 * would do at context switch OUT time.
3723		 */
3724		for (ri = 0; ri < md->pmd_npmc; ri++) {
3725
3726			/*
3727			 * Pick up the pmc pointer from hardware
3728			 * state similar to the CSW_OUT code.
3729			 */
3730			pm = NULL;
3731			(void) (*md->pmd_get_config)(cpu, ri, &pm);
3732
3733			PMCDBG(PRC,EXT,2, "ri=%d pm=%p", ri, pm);
3734
3735			if (pm == NULL ||
3736			    !PMC_IS_VIRTUAL_MODE(PMC_TO_MODE(pm)))
3737				continue;
3738
3739			PMCDBG(PRC,EXT,2, "ppmcs[%d]=%p pm=%p "
3740			    "state=%d", ri, pp->pp_pmcs[ri].pp_pmc,
3741			    pm, pm->pm_state);
3742
3743			KASSERT(PMC_TO_ROWINDEX(pm) == ri,
3744			    ("[pmc,%d] ri mismatch pmc(%d) ri(%d)",
3745				__LINE__, PMC_TO_ROWINDEX(pm), ri));
3746
3747			KASSERT(pm == pp->pp_pmcs[ri].pp_pmc,
3748			    ("[pmc,%d] pm %p != pp_pmcs[%d] %p",
3749				__LINE__, pm, ri, pp->pp_pmcs[ri].pp_pmc));
3750
3751			(void) md->pmd_stop_pmc(cpu, ri);
3752
3753			KASSERT(pm->pm_runcount > 0,
3754			    ("[pmc,%d] bad runcount ri %d rc %d",
3755				__LINE__, ri, pm->pm_runcount));
3756
3757			/* Stop hardware only if it is actually running */
3758			if (pm->pm_state == PMC_STATE_RUNNING &&
3759			    pm->pm_stalled == 0) {
3760				md->pmd_read_pmc(cpu, ri, &newvalue);
3761				tmp = newvalue -
3762				    PMC_PCPU_SAVED(cpu,ri);
3763
3764				mtx_pool_lock_spin(pmc_mtxpool, pm);
3765				pm->pm_gv.pm_savedvalue += tmp;
3766				pp->pp_pmcs[ri].pp_pmcval += tmp;
3767				mtx_pool_unlock_spin(pmc_mtxpool, pm);
3768			}
3769
3770			atomic_subtract_rel_32(&pm->pm_runcount,1);
3771
3772			KASSERT((int) pm->pm_runcount >= 0,
3773			    ("[pmc,%d] runcount is %d", __LINE__, ri));
3774
3775			(void) md->pmd_config_pmc(cpu, ri, NULL);
3776		}
3777
3778		/*
3779		 * Inform the MD layer of this pseudo "context switch
3780		 * out"
3781		 */
3782		(void) md->pmd_switch_out(pmc_pcpu[cpu], pp);
3783
3784		critical_exit(); /* ok to be pre-empted now */
3785
3786		/*
3787		 * Unlink this process from the PMCs that are
3788		 * targetting it.  This will send a signal to
3789		 * all PMC owner's whose PMCs are orphaned.
3790		 *
3791		 * Log PMC value at exit time if requested.
3792		 */
3793		for (ri = 0; ri < md->pmd_npmc; ri++)
3794			if ((pm = pp->pp_pmcs[ri].pp_pmc) != NULL) {
3795				if (pm->pm_flags & PMC_F_NEEDS_LOGFILE &&
3796				    PMC_IS_COUNTING_MODE(PMC_TO_MODE(pm)))
3797					pmclog_process_procexit(pm, pp);
3798				pmc_unlink_target_process(pm, pp);
3799			}
3800		FREE(pp, M_PMC);
3801
3802	} else
3803		critical_exit(); /* pp == NULL */
3804
3805
3806	/*
3807	 * If the process owned PMCs, free them up and free up
3808	 * memory.
3809	 */
3810	if ((po = pmc_find_owner_descriptor(p)) != NULL) {
3811		pmc_remove_owner(po);
3812		pmc_destroy_owner_descriptor(po);
3813	}
3814
3815	sx_xunlock(&pmc_sx);
3816}
3817
3818/*
3819 * Handle a process fork.
3820 *
3821 * If the parent process 'p1' is under HWPMC monitoring, then copy
3822 * over any attached PMCs that have 'do_descendants' semantics.
3823 */
3824
3825static void
3826pmc_process_fork(void *arg __unused, struct proc *p1, struct proc *newproc,
3827    int flags)
3828{
3829	int is_using_hwpmcs;
3830	unsigned int ri;
3831	uint32_t do_descendants;
3832	struct pmc *pm;
3833	struct pmc_owner *po;
3834	struct pmc_process *ppnew, *ppold;
3835
3836	(void) flags;		/* unused parameter */
3837
3838	PROC_LOCK(p1);
3839	is_using_hwpmcs = p1->p_flag & P_HWPMC;
3840	PROC_UNLOCK(p1);
3841
3842	/*
3843	 * If there are system-wide sampling PMCs active, we need to
3844	 * log all fork events to their owner's logs.
3845	 */
3846
3847	LIST_FOREACH(po, &pmc_ss_owners, po_ssnext)
3848	    if (po->po_flags & PMC_PO_OWNS_LOGFILE)
3849		    pmclog_process_procfork(po, p1->p_pid, newproc->p_pid);
3850
3851	if (!is_using_hwpmcs)
3852		return;
3853
3854	PMC_GET_SX_XLOCK();
3855	PMCDBG(PMC,FRK,1, "process-fork proc=%p (%d, %s) -> %p", p1,
3856	    p1->p_pid, p1->p_comm, newproc);
3857
3858	/*
3859	 * If the parent process (curthread->td_proc) is a
3860	 * target of any PMCs, look for PMCs that are to be
3861	 * inherited, and link these into the new process
3862	 * descriptor.
3863	 */
3864	if ((ppold = pmc_find_process_descriptor(curthread->td_proc,
3865		 PMC_FLAG_NONE)) == NULL)
3866		goto done;		/* nothing to do */
3867
3868	do_descendants = 0;
3869	for (ri = 0; ri < md->pmd_npmc; ri++)
3870		if ((pm = ppold->pp_pmcs[ri].pp_pmc) != NULL)
3871			do_descendants |= pm->pm_flags & PMC_F_DESCENDANTS;
3872	if (do_descendants == 0) /* nothing to do */
3873		goto done;
3874
3875	/* allocate a descriptor for the new process  */
3876	if ((ppnew = pmc_find_process_descriptor(newproc,
3877		 PMC_FLAG_ALLOCATE)) == NULL)
3878		goto done;
3879
3880	/*
3881	 * Run through all PMCs that were targeting the old process
3882	 * and which specified F_DESCENDANTS and attach them to the
3883	 * new process.
3884	 *
3885	 * Log the fork event to all owners of PMCs attached to this
3886	 * process, if not already logged.
3887	 */
3888	for (ri = 0; ri < md->pmd_npmc; ri++)
3889		if ((pm = ppold->pp_pmcs[ri].pp_pmc) != NULL &&
3890		    (pm->pm_flags & PMC_F_DESCENDANTS)) {
3891			pmc_link_target_process(pm, ppnew);
3892			po = pm->pm_owner;
3893			if (po->po_sscount == 0 &&
3894			    po->po_flags & PMC_PO_OWNS_LOGFILE)
3895				pmclog_process_procfork(po, p1->p_pid,
3896				    newproc->p_pid);
3897		}
3898
3899	/*
3900	 * Now mark the new process as being tracked by this driver.
3901	 */
3902	PROC_LOCK(newproc);
3903	newproc->p_flag |= P_HWPMC;
3904	PROC_UNLOCK(newproc);
3905
3906 done:
3907	sx_xunlock(&pmc_sx);
3908}
3909
3910
3911/*
3912 * initialization
3913 */
3914
3915static const char *pmc_name_of_pmcclass[] = {
3916#undef	__PMC_CLASS
3917#define	__PMC_CLASS(N) #N ,
3918	__PMC_CLASSES()
3919};
3920
3921static int
3922pmc_initialize(void)
3923{
3924	int cpu, error, n;
3925	struct pmc_binding pb;
3926	struct pmc_samplebuffer *sb;
3927
3928	md = NULL;
3929	error = 0;
3930
3931#ifdef	DEBUG
3932	/* parse debug flags first */
3933	if (TUNABLE_STR_FETCH(PMC_SYSCTL_NAME_PREFIX "debugflags",
3934		pmc_debugstr, sizeof(pmc_debugstr)))
3935		pmc_debugflags_parse(pmc_debugstr,
3936		    pmc_debugstr+strlen(pmc_debugstr));
3937#endif
3938
3939	PMCDBG(MOD,INI,0, "PMC Initialize (version %x)", PMC_VERSION);
3940
3941	/* check kernel version */
3942	if (pmc_kernel_version != PMC_VERSION) {
3943		if (pmc_kernel_version == 0)
3944			printf("hwpmc: this kernel has not been compiled with "
3945			    "'options HWPMC_HOOKS'.\n");
3946		else
3947			printf("hwpmc: kernel version (0x%x) does not match "
3948			    "module version (0x%x).\n", pmc_kernel_version,
3949			    PMC_VERSION);
3950		return EPROGMISMATCH;
3951	}
3952
3953	/*
3954	 * check sysctl parameters
3955	 */
3956
3957	if (pmc_hashsize <= 0) {
3958		(void) printf("hwpmc: tunable hashsize=%d must be greater "
3959		    "than zero.\n", pmc_hashsize);
3960		pmc_hashsize = PMC_HASH_SIZE;
3961	}
3962
3963	if (pmc_nsamples <= 0 || pmc_nsamples > 65535) {
3964		(void) printf("hwpmc: tunable nsamples=%d out of range.\n",
3965		    pmc_nsamples);
3966		pmc_nsamples = PMC_NSAMPLES;
3967	}
3968
3969	md = pmc_md_initialize();
3970
3971	if (md == NULL || md->pmd_init == NULL)
3972		return ENOSYS;
3973
3974	/* allocate space for the per-cpu array */
3975	MALLOC(pmc_pcpu, struct pmc_cpu **, mp_ncpus * sizeof(struct pmc_cpu *),
3976	    M_PMC, M_WAITOK|M_ZERO);
3977
3978	/* per-cpu 'saved values' for managing process-mode PMCs */
3979	MALLOC(pmc_pcpu_saved, pmc_value_t *,
3980	    sizeof(pmc_value_t) * mp_ncpus * md->pmd_npmc, M_PMC, M_WAITOK);
3981
3982	/* perform cpu dependent initialization */
3983	pmc_save_cpu_binding(&pb);
3984	for (cpu = 0; cpu < mp_ncpus; cpu++) {
3985		if (pmc_cpu_is_disabled(cpu))
3986			continue;
3987		pmc_select_cpu(cpu);
3988		if ((error = md->pmd_init(cpu)) != 0)
3989			break;
3990	}
3991	pmc_restore_cpu_binding(&pb);
3992
3993	if (error != 0)
3994		return error;
3995
3996	/* allocate space for the sample array */
3997	for (cpu = 0; cpu < mp_ncpus; cpu++) {
3998		if (pmc_cpu_is_disabled(cpu))
3999			continue;
4000		MALLOC(sb, struct pmc_samplebuffer *,
4001		    sizeof(struct pmc_samplebuffer) +
4002		    pmc_nsamples * sizeof(struct pmc_sample), M_PMC,
4003		    M_WAITOK|M_ZERO);
4004
4005		sb->ps_read = sb->ps_write = sb->ps_samples;
4006		sb->ps_fence = sb->ps_samples + pmc_nsamples;
4007		KASSERT(pmc_pcpu[cpu] != NULL,
4008		    ("[pmc,%d] cpu=%d Null per-cpu data", __LINE__, cpu));
4009
4010		pmc_pcpu[cpu]->pc_sb = sb;
4011	}
4012
4013	/* allocate space for the row disposition array */
4014	pmc_pmcdisp = malloc(sizeof(enum pmc_mode) * md->pmd_npmc,
4015	    M_PMC, M_WAITOK|M_ZERO);
4016
4017	KASSERT(pmc_pmcdisp != NULL,
4018	    ("[pmc,%d] pmcdisp allocation returned NULL", __LINE__));
4019
4020	/* mark all PMCs as available */
4021	for (n = 0; n < (int) md->pmd_npmc; n++)
4022		PMC_MARK_ROW_FREE(n);
4023
4024	/* allocate thread hash tables */
4025	pmc_ownerhash = hashinit(pmc_hashsize, M_PMC,
4026	    &pmc_ownerhashmask);
4027
4028	pmc_processhash = hashinit(pmc_hashsize, M_PMC,
4029	    &pmc_processhashmask);
4030	mtx_init(&pmc_processhash_mtx, "pmc-process-hash", "pmc", MTX_SPIN);
4031
4032	LIST_INIT(&pmc_ss_owners);
4033	pmc_ss_count = 0;
4034
4035	/* allocate a pool of spin mutexes */
4036	pmc_mtxpool = mtx_pool_create("pmc", pmc_mtxpool_size, MTX_SPIN);
4037
4038	PMCDBG(MOD,INI,1, "pmc_ownerhash=%p, mask=0x%lx "
4039	    "targethash=%p mask=0x%lx", pmc_ownerhash, pmc_ownerhashmask,
4040	    pmc_processhash, pmc_processhashmask);
4041
4042	/* register process {exit,fork,exec} handlers */
4043	pmc_exit_tag = EVENTHANDLER_REGISTER(process_exit,
4044	    pmc_process_exit, NULL, EVENTHANDLER_PRI_ANY);
4045	pmc_fork_tag = EVENTHANDLER_REGISTER(process_fork,
4046	    pmc_process_fork, NULL, EVENTHANDLER_PRI_ANY);
4047
4048	/* initialize logging */
4049	pmclog_initialize();
4050
4051	/* set hook functions */
4052	pmc_intr = md->pmd_intr;
4053	pmc_hook = pmc_hook_handler;
4054
4055	if (error == 0) {
4056		printf(PMC_MODULE_NAME ":");
4057		for (n = 0; n < (int) md->pmd_nclass; n++) {
4058			printf(" %s/%d/0x%b",
4059			    pmc_name_of_pmcclass[md->pmd_classes[n].pm_class],
4060			    md->pmd_nclasspmcs[n],
4061			    md->pmd_classes[n].pm_caps,
4062			    "\20"
4063			    "\1INT\2USR\3SYS\4EDG\5THR"
4064			    "\6REA\7WRI\10INV\11QUA\12PRC"
4065			    "\13TAG\14CSC");
4066		}
4067		printf("\n");
4068	}
4069
4070	return error;
4071}
4072
4073/* prepare to be unloaded */
4074static void
4075pmc_cleanup(void)
4076{
4077	int cpu;
4078	struct pmc_ownerhash *ph;
4079	struct pmc_owner *po, *tmp;
4080	struct pmc_binding pb;
4081#ifdef	DEBUG
4082	struct pmc_processhash *prh;
4083#endif
4084
4085	PMCDBG(MOD,INI,0, "%s", "cleanup");
4086
4087	/* switch off sampling */
4088	atomic_store_rel_int(&pmc_cpumask, 0);
4089	pmc_intr = NULL;
4090
4091	sx_xlock(&pmc_sx);
4092	if (pmc_hook == NULL) {	/* being unloaded already */
4093		sx_xunlock(&pmc_sx);
4094		return;
4095	}
4096
4097	pmc_hook = NULL; /* prevent new threads from entering module */
4098
4099	/* deregister event handlers */
4100	EVENTHANDLER_DEREGISTER(process_fork, pmc_fork_tag);
4101	EVENTHANDLER_DEREGISTER(process_exit, pmc_exit_tag);
4102
4103	/* send SIGBUS to all owner threads, free up allocations */
4104	if (pmc_ownerhash)
4105		for (ph = pmc_ownerhash;
4106		     ph <= &pmc_ownerhash[pmc_ownerhashmask];
4107		     ph++) {
4108			LIST_FOREACH_SAFE(po, ph, po_next, tmp) {
4109				pmc_remove_owner(po);
4110
4111				/* send SIGBUS to owner processes */
4112				PMCDBG(MOD,INI,2, "cleanup signal proc=%p "
4113				    "(%d, %s)", po->po_owner,
4114				    po->po_owner->p_pid,
4115				    po->po_owner->p_comm);
4116
4117				PROC_LOCK(po->po_owner);
4118				psignal(po->po_owner, SIGBUS);
4119				PROC_UNLOCK(po->po_owner);
4120
4121				pmc_destroy_owner_descriptor(po);
4122			}
4123		}
4124
4125	/* reclaim allocated data structures */
4126	if (pmc_mtxpool)
4127		mtx_pool_destroy(&pmc_mtxpool);
4128
4129	mtx_destroy(&pmc_processhash_mtx);
4130	if (pmc_processhash) {
4131#ifdef	DEBUG
4132		struct pmc_process *pp;
4133
4134		PMCDBG(MOD,INI,3, "%s", "destroy process hash");
4135		for (prh = pmc_processhash;
4136		     prh <= &pmc_processhash[pmc_processhashmask];
4137		     prh++)
4138			LIST_FOREACH(pp, prh, pp_next)
4139			    PMCDBG(MOD,INI,3, "pid=%d", pp->pp_proc->p_pid);
4140#endif
4141
4142		hashdestroy(pmc_processhash, M_PMC, pmc_processhashmask);
4143		pmc_processhash = NULL;
4144	}
4145
4146	if (pmc_ownerhash) {
4147		PMCDBG(MOD,INI,3, "%s", "destroy owner hash");
4148		hashdestroy(pmc_ownerhash, M_PMC, pmc_ownerhashmask);
4149		pmc_ownerhash = NULL;
4150	}
4151
4152	KASSERT(LIST_EMPTY(&pmc_ss_owners),
4153	    ("[pmc,%d] Global SS owner list not empty", __LINE__));
4154	KASSERT(pmc_ss_count == 0,
4155	    ("[pmc,%d] Global SS count not empty", __LINE__));
4156
4157	/* free the per-cpu sample buffers */
4158	for (cpu = 0; cpu < mp_ncpus; cpu++) {
4159		if (pmc_cpu_is_disabled(cpu))
4160			continue;
4161		KASSERT(pmc_pcpu[cpu]->pc_sb != NULL,
4162		    ("[pmc,%d] Null cpu sample buffer cpu=%d", __LINE__,
4163			cpu));
4164		FREE(pmc_pcpu[cpu]->pc_sb, M_PMC);
4165		pmc_pcpu[cpu]->pc_sb = NULL;
4166	}
4167
4168 	/* do processor dependent cleanup */
4169	PMCDBG(MOD,INI,3, "%s", "md cleanup");
4170	if (md) {
4171		pmc_save_cpu_binding(&pb);
4172		for (cpu = 0; cpu < mp_ncpus; cpu++) {
4173			PMCDBG(MOD,INI,1,"pmc-cleanup cpu=%d pcs=%p",
4174			    cpu, pmc_pcpu[cpu]);
4175			if (pmc_cpu_is_disabled(cpu))
4176				continue;
4177			pmc_select_cpu(cpu);
4178			if (pmc_pcpu[cpu])
4179				(void) md->pmd_cleanup(cpu);
4180		}
4181		FREE(md, M_PMC);
4182		md = NULL;
4183		pmc_restore_cpu_binding(&pb);
4184	}
4185
4186	/* deallocate per-cpu structures */
4187	FREE(pmc_pcpu, M_PMC);
4188	pmc_pcpu = NULL;
4189
4190	FREE(pmc_pcpu_saved, M_PMC);
4191	pmc_pcpu_saved = NULL;
4192
4193	if (pmc_pmcdisp) {
4194		FREE(pmc_pmcdisp, M_PMC);
4195		pmc_pmcdisp = NULL;
4196	}
4197
4198	pmclog_shutdown();
4199
4200	sx_xunlock(&pmc_sx); 	/* we are done */
4201}
4202
4203/*
4204 * The function called at load/unload.
4205 */
4206
4207static int
4208load (struct module *module __unused, int cmd, void *arg __unused)
4209{
4210	int error;
4211
4212	error = 0;
4213
4214	switch (cmd) {
4215	case MOD_LOAD :
4216		/* initialize the subsystem */
4217		error = pmc_initialize();
4218		if (error != 0)
4219			break;
4220		PMCDBG(MOD,INI,1, "syscall=%d ncpus=%d",
4221		    pmc_syscall_num, mp_ncpus);
4222		break;
4223
4224
4225	case MOD_UNLOAD :
4226	case MOD_SHUTDOWN:
4227		pmc_cleanup();
4228		PMCDBG(MOD,INI,1, "%s", "unloaded");
4229		break;
4230
4231	default :
4232		error = EINVAL;	/* XXX should panic(9) */
4233		break;
4234	}
4235
4236	return error;
4237}
4238
4239/* memory pool */
4240MALLOC_DEFINE(M_PMC, "pmc", "Memory space for the PMC module");
4241