10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24 /*
25 * Copyright (c) 2010, Intel Corporation.
26 * All rights reserved.
27 */
28 /*
29 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
30 * Copyright (c) 2014, 2015 by Delphix. All rights reserved.
31 */
32
33 /*
34 * VM - Hardware Address Translation management for i386 and amd64
35 *
36 * Implementation of the interfaces described in <common/vm/hat.h>
37 *
38 * Nearly all the details of how the hardware is managed should not be
39 * visible outside this layer except for misc. machine specific functions
40 * that work in conjunction with this code.
41 *
42 * Routines used only inside of i86pc/vm start with hati_ for HAT Internal.
43 */
44
45 #include <sys/machparam.h>
46 #include <sys/machsystm.h>
47 #include <sys/mman.h>
48 #include <sys/types.h>
49 #include <sys/systm.h>
50 #include <sys/cpuvar.h>
51 #include <sys/thread.h>
52 #include <sys/proc.h>
53 #include <sys/cpu.h>
54 #include <sys/kmem.h>
55 #include <sys/disp.h>
56 #include <sys/shm.h>
57 #include <sys/sysmacros.h>
58 #include <sys/machparam.h>
59 #include <sys/vmem.h>
60 #include <sys/vmsystm.h>
61 #include <sys/promif.h>
62 #include <sys/var.h>
63 #include <sys/x86_archext.h>
64 #include <sys/atomic.h>
78 #include <vm/seg_kpm.h>
79 #include <vm/vm_dep.h>
80 #ifdef __xpv
81 #include <sys/hypervisor.h>
82 #endif
83 #include <vm/kboot_mmu.h>
84 #include <vm/seg_spt.h>
85
86 #include <sys/cmn_err.h>
87
88 /*
89 * Basic parameters for hat operation.
90 */
91 struct hat_mmu_info mmu;
92
93 /*
94 * The page that is the kernel's top level pagetable.
95 *
96 * For 32 bit PAE support on i86pc, the kernel hat will use the 1st 4 entries
97 * on this 4K page for its top level page table. The remaining groups of
98 * 4 entries are used for per processor copies of user VLP pagetables for
99 * running threads. See hat_switch() and reload_pae32() for details.
100 *
101 * vlp_page[0..3] - level==2 PTEs for kernel HAT
102 * vlp_page[4..7] - level==2 PTEs for user thread on cpu 0
103 * vlp_page[8..11] - level==2 PTE for user thread on cpu 1
104 * etc...
105 */
106 static x86pte_t *vlp_page;
107
108 /*
109 * forward declaration of internal utility routines
110 */
111 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected,
112 x86pte_t new);
113
114 /*
115 * The kernel address space exists in all HATs. To implement this the
116 * kernel reserves a fixed number of entries in the topmost level(s) of page
117 * tables. The values are setup during startup and then copied to every user
118 * hat created by hat_alloc(). This means that kernelbase must be:
119 *
120 * 4Meg aligned for 32 bit kernels
121 * 512Gig aligned for x86_64 64 bit kernel
122 *
123 * The hat_kernel_range_ts describe what needs to be copied from kernel hat
124 * to each user hat.
125 */
126 typedef struct hat_kernel_range {
127 level_t hkr_level;
128 uintptr_t hkr_start_va;
129 uintptr_t hkr_end_va; /* zero means to end of memory */
130 } hat_kernel_range_t;
131 #define NUM_KERNEL_RANGE 2
132 static hat_kernel_range_t kernel_ranges[NUM_KERNEL_RANGE];
133 static int num_kernel_ranges;
134
135 uint_t use_boot_reserve = 1; /* cleared after early boot process */
136 uint_t can_steal_post_boot = 0; /* set late in boot to enable stealing */
137
138 /*
153
154
155 #ifdef DEBUG
156 uint_t map1gcnt;
157 #endif
158
159
160 /*
161 * A cpuset for all cpus. This is used for kernel address cross calls, since
162 * the kernel addresses apply to all cpus.
163 */
164 cpuset_t khat_cpuset;
165
166 /*
167 * management stuff for hat structures
168 */
169 kmutex_t hat_list_lock;
170 kcondvar_t hat_list_cv;
171 kmem_cache_t *hat_cache;
172 kmem_cache_t *hat_hash_cache;
173 kmem_cache_t *vlp_hash_cache;
174
175 /*
176 * Simple statistics
177 */
178 struct hatstats hatstat;
179
180 /*
181 * Some earlier hypervisor versions do not emulate cmpxchg of PTEs
182 * correctly. For such hypervisors we must set PT_USER for kernel
183 * entries ourselves (normally the emulation would set PT_USER for
184 * kernel entries and PT_USER|PT_GLOBAL for user entries). pt_kern is
185 * thus set appropriately. Note that dboot/kbm is OK, as only the full
186 * HAT uses cmpxchg() and the other paths (hypercall etc.) were never
187 * incorrect.
188 */
189 int pt_kern;
190
191 /*
192 * useful stuff for atomic access/clearing/setting REF/MOD/RO bits in page_t's.
193 */
194 extern void atomic_orb(uchar_t *addr, uchar_t val);
195 extern void atomic_andb(uchar_t *addr, uchar_t val);
196
197 #ifndef __xpv
198 extern pfn_t memseg_get_start(struct memseg *);
199 #endif
200
201 #define PP_GETRM(pp, rmmask) (pp->p_nrm & rmmask)
202 #define PP_ISMOD(pp) PP_GETRM(pp, P_MOD)
203 #define PP_ISREF(pp) PP_GETRM(pp, P_REF)
204 #define PP_ISRO(pp) PP_GETRM(pp, P_RO)
205
206 #define PP_SETRM(pp, rm) atomic_orb(&(pp->p_nrm), rm)
207 #define PP_SETMOD(pp) PP_SETRM(pp, P_MOD)
208 #define PP_SETREF(pp) PP_SETRM(pp, P_REF)
209 #define PP_SETRO(pp) PP_SETRM(pp, P_RO)
210
211 #define PP_CLRRM(pp, rm) atomic_andb(&(pp->p_nrm), ~(rm))
212 #define PP_CLRMOD(pp) PP_CLRRM(pp, P_MOD)
213 #define PP_CLRREF(pp) PP_CLRRM(pp, P_REF)
214 #define PP_CLRRO(pp) PP_CLRRM(pp, P_RO)
215 #define PP_CLRALL(pp) PP_CLRRM(pp, P_MOD | P_REF | P_RO)
216
219 */
220 /*ARGSUSED*/
221 static int
222 hati_constructor(void *buf, void *handle, int kmflags)
223 {
224 hat_t *hat = buf;
225
226 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
227 bzero(hat->hat_pages_mapped,
228 sizeof (pgcnt_t) * (mmu.max_page_level + 1));
229 hat->hat_ism_pgcnt = 0;
230 hat->hat_stats = 0;
231 hat->hat_flags = 0;
232 CPUSET_ZERO(hat->hat_cpus);
233 hat->hat_htable = NULL;
234 hat->hat_ht_hash = NULL;
235 return (0);
236 }
237
238 /*
239 * Allocate a hat structure for as. We also create the top level
240 * htable and initialize it to contain the kernel hat entries.
241 */
242 hat_t *
243 hat_alloc(struct as *as)
244 {
245 hat_t *hat;
246 htable_t *ht; /* top level htable */
247 uint_t use_vlp;
248 uint_t r;
249 hat_kernel_range_t *rp;
250 uintptr_t va;
251 uintptr_t eva;
252 uint_t start;
253 uint_t cnt;
254 htable_t *src;
255
256 /*
257 * Once we start creating user process HATs we can enable
258 * the htable_steal() code.
259 */
260 if (can_steal_post_boot == 0)
261 can_steal_post_boot = 1;
262
263 ASSERT(AS_WRITE_HELD(as));
264 hat = kmem_cache_alloc(hat_cache, KM_SLEEP);
265 hat->hat_as = as;
266 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
267 ASSERT(hat->hat_flags == 0);
268
269 #if defined(__xpv)
270 /*
271 * No VLP stuff on the hypervisor due to the 64-bit split top level
272 * page tables. On 32-bit it's not needed as the hypervisor takes
273 * care of copying the top level PTEs to a below 4Gig page.
274 */
275 use_vlp = 0;
276 #else /* __xpv */
277 /* 32 bit processes uses a VLP style hat when running with PAE */
278 #if defined(__amd64)
279 use_vlp = (ttoproc(curthread)->p_model == DATAMODEL_ILP32);
280 #elif defined(__i386)
281 use_vlp = mmu.pae_hat;
282 #endif
283 #endif /* __xpv */
284 if (use_vlp) {
285 hat->hat_flags = HAT_VLP;
286 bzero(hat->hat_vlp_ptes, VLP_SIZE);
287 }
288
289 /*
290 * Allocate the htable hash
291 */
292 if ((hat->hat_flags & HAT_VLP)) {
293 hat->hat_num_hash = mmu.vlp_hash_cnt;
294 hat->hat_ht_hash = kmem_cache_alloc(vlp_hash_cache, KM_SLEEP);
295 } else {
296 hat->hat_num_hash = mmu.hash_cnt;
297 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP);
298 }
299 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *));
300
301 /*
302 * Initialize Kernel HAT entries at the top of the top level page
303 * tables for the new hat.
304 */
305 hat->hat_htable = NULL;
306 hat->hat_ht_cached = NULL;
307 XPV_DISALLOW_MIGRATE();
308 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL);
309 hat->hat_htable = ht;
310
311 #if defined(__amd64)
312 if (hat->hat_flags & HAT_VLP)
313 goto init_done;
314 #endif
315
316 for (r = 0; r < num_kernel_ranges; ++r) {
317 rp = &kernel_ranges[r];
318 for (va = rp->hkr_start_va; va != rp->hkr_end_va;
319 va += cnt * LEVEL_SIZE(rp->hkr_level)) {
320
321 if (rp->hkr_level == TOP_LEVEL(hat))
322 ht = hat->hat_htable;
323 else
324 ht = htable_create(hat, va, rp->hkr_level,
325 NULL);
326
327 start = htable_va2entry(va, ht);
328 cnt = HTABLE_NUM_PTES(ht) - start;
329 eva = va +
330 ((uintptr_t)cnt << LEVEL_SHIFT(rp->hkr_level));
331 if (rp->hkr_end_va != 0 &&
332 (eva > rp->hkr_end_va || eva == 0))
333 cnt = htable_va2entry(rp->hkr_end_va, ht) -
334 start;
335
336 #if defined(__i386) && !defined(__xpv)
337 if (ht->ht_flags & HTABLE_VLP) {
338 bcopy(&vlp_page[start],
339 &hat->hat_vlp_ptes[start],
340 cnt * sizeof (x86pte_t));
341 continue;
342 }
343 #endif
344 src = htable_lookup(kas.a_hat, va, rp->hkr_level);
345 ASSERT(src != NULL);
346 x86pte_copy(src, ht, start, cnt);
347 htable_release(src);
348 }
349 }
350
351 init_done:
352
353 #if defined(__xpv)
354 /*
355 * Pin top level page tables after initializing them
356 */
357 xen_pin(hat->hat_htable->ht_pfn, mmu.max_level);
358 #if defined(__amd64)
359 xen_pin(hat->hat_user_ptable, mmu.max_level);
360 #endif
361 #endif
362 XPV_ALLOW_MIGRATE();
363
364 /*
365 * Put it at the start of the global list of all hats (used by stealing)
366 *
367 * kas.a_hat is not in the list but is instead used to find the
368 * first and last items in the list.
369 *
370 * - kas.a_hat->hat_next points to the start of the user hats.
371 * The list ends where hat->hat_next == NULL
372 *
373 * - kas.a_hat->hat_prev points to the last of the user hats.
374 * The list begins where hat->hat_prev == NULL
375 */
376 mutex_enter(&hat_list_lock);
377 hat->hat_prev = NULL;
378 hat->hat_next = kas.a_hat->hat_next;
379 if (hat->hat_next)
380 hat->hat_next->hat_prev = hat;
381 else
382 kas.a_hat->hat_prev = hat;
383 kas.a_hat->hat_next = hat;
384 mutex_exit(&hat_list_lock);
385
386 return (hat);
387 }
388
389 /*
390 * process has finished executing but as has not been cleaned up yet.
391 */
392 /*ARGSUSED*/
393 void
394 hat_free_start(hat_t *hat)
395 {
396 ASSERT(AS_WRITE_HELD(hat->hat_as));
397
398 /*
399 * If the hat is currently a stealing victim, wait for the stealing
400 * to finish. Once we mark it as HAT_FREEING, htable_steal()
401 * won't look at its pagetables anymore.
402 */
403 mutex_enter(&hat_list_lock);
404 while (hat->hat_flags & HAT_VICTIM)
405 cv_wait(&hat_list_cv, &hat_list_lock);
406 hat->hat_flags |= HAT_FREEING;
407 mutex_exit(&hat_list_lock);
424
425 /*
426 * Remove it from the list of HATs
427 */
428 mutex_enter(&hat_list_lock);
429 if (hat->hat_prev)
430 hat->hat_prev->hat_next = hat->hat_next;
431 else
432 kas.a_hat->hat_next = hat->hat_next;
433 if (hat->hat_next)
434 hat->hat_next->hat_prev = hat->hat_prev;
435 else
436 kas.a_hat->hat_prev = hat->hat_prev;
437 mutex_exit(&hat_list_lock);
438 hat->hat_next = hat->hat_prev = NULL;
439
440 #if defined(__xpv)
441 /*
442 * On the hypervisor, unpin top level page table(s)
443 */
444 xen_unpin(hat->hat_htable->ht_pfn);
445 #if defined(__amd64)
446 xen_unpin(hat->hat_user_ptable);
447 #endif
448 #endif
449
450 /*
451 * Make a pass through the htables freeing them all up.
452 */
453 htable_purge_hat(hat);
454
455 /*
456 * Decide which kmem cache the hash table came from, then free it.
457 */
458 if (hat->hat_flags & HAT_VLP)
459 cache = vlp_hash_cache;
460 else
461 cache = hat_hash_cache;
462 kmem_cache_free(cache, hat->hat_ht_hash);
463 hat->hat_ht_hash = NULL;
464
465 hat->hat_flags = 0;
466 kmem_cache_free(hat_cache, hat);
467 }
468
469 /*
470 * round kernelbase down to a supported value to use for _userlimit
471 *
472 * userlimit must be aligned down to an entry in the top level htable.
473 * The one exception is for 32 bit HAT's running PAE.
474 */
475 uintptr_t
476 hat_kernelbase(uintptr_t va)
477 {
478 #if defined(__i386)
479 va &= LEVEL_MASK(1);
480 #endif
481 if (IN_VA_HOLE(va))
482 panic("_userlimit %p will fall in VA hole\n", (void *)va);
483 return (va);
484 }
485
500 cpuid_opteron_erratum(CPU, 6671130)) {
501 lvl = 1;
502 }
503 if (plat_mnode_xcheck(LEVEL_SIZE(2) >>
504 LEVEL_SHIFT(0))) {
505 lvl = 1;
506 }
507 } else {
508 lvl = 1;
509 }
510 }
511 mmu.max_page_level = lvl;
512
513 if ((lvl == 2) && (enable_1gpg == 0))
514 mmu.umax_page_level = 1;
515 else
516 mmu.umax_page_level = lvl;
517 }
518
519 /*
520 * Initialize hat data structures based on processor MMU information.
521 */
522 void
523 mmu_init(void)
524 {
525 uint_t max_htables;
526 uint_t pa_bits;
527 uint_t va_bits;
528 int i;
529
530 /*
531 * If CPU enabled the page table global bit, use it for the kernel
532 * This is bit 7 in CR4 (PGE - Page Global Enable).
533 */
534 if (is_x86_feature(x86_featureset, X86FSET_PGE) &&
535 (getcr4() & CR4_PGE) != 0)
536 mmu.pt_global = PT_GLOBAL;
537
538 /*
539 * Detect NX and PAE usage.
540 */
541 mmu.pae_hat = kbm_pae_support;
542 if (kbm_nx_support)
543 mmu.pt_nx = PT_NX;
544 else
545 mmu.pt_nx = 0;
546
547 /*
548 * Use CPU info to set various MMU parameters
549 */
550 cpuid_get_addrsize(CPU, &pa_bits, &va_bits);
551
552 if (va_bits < sizeof (void *) * NBBY) {
553 mmu.hole_start = (1ul << (va_bits - 1));
554 mmu.hole_end = 0ul - mmu.hole_start - 1;
555 } else {
556 mmu.hole_end = 0;
557 mmu.hole_start = mmu.hole_end - 1;
558 }
576 mmu.pte_size = 8; /* 8 byte PTEs */
577 mmu.pte_size_shift = 3;
578 } else {
579 mmu.pte_size = 4; /* 4 byte PTEs */
580 mmu.pte_size_shift = 2;
581 }
582
583 if (mmu.pae_hat && !is_x86_feature(x86_featureset, X86FSET_PAE))
584 panic("Processor does not support PAE");
585
586 if (!is_x86_feature(x86_featureset, X86FSET_CX8))
587 panic("Processor does not support cmpxchg8b instruction");
588
589 #if defined(__amd64)
590
591 mmu.num_level = 4;
592 mmu.max_level = 3;
593 mmu.ptes_per_table = 512;
594 mmu.top_level_count = 512;
595
596 mmu.level_shift[0] = 12;
597 mmu.level_shift[1] = 21;
598 mmu.level_shift[2] = 30;
599 mmu.level_shift[3] = 39;
600
601 #elif defined(__i386)
602
603 if (mmu.pae_hat) {
604 mmu.num_level = 3;
605 mmu.max_level = 2;
606 mmu.ptes_per_table = 512;
607 mmu.top_level_count = 4;
608
609 mmu.level_shift[0] = 12;
610 mmu.level_shift[1] = 21;
611 mmu.level_shift[2] = 30;
612
613 } else {
614 mmu.num_level = 2;
615 mmu.max_level = 1;
616 mmu.ptes_per_table = 1024;
617 mmu.top_level_count = 1024;
618
619 mmu.level_shift[0] = 12;
620 mmu.level_shift[1] = 22;
621 }
622
623 #endif /* __i386 */
624
625 for (i = 0; i < mmu.num_level; ++i) {
626 mmu.level_size[i] = 1UL << mmu.level_shift[i];
627 mmu.level_offset[i] = mmu.level_size[i] - 1;
628 mmu.level_mask[i] = ~mmu.level_offset[i];
629 }
630
631 set_max_page_level();
632
633 mmu_page_sizes = mmu.max_page_level + 1;
634 mmu_exported_page_sizes = mmu.umax_page_level + 1;
635
636 /* restrict legacy applications from using pagesizes 1g and above */
637 mmu_legacy_page_sizes =
638 (mmu_exported_page_sizes > 2) ? 2 : mmu_exported_page_sizes;
639
640
641 for (i = 0; i <= mmu.max_page_level; ++i) {
642 mmu.pte_bits[i] = PT_VALID | pt_kern;
643 if (i > 0)
644 mmu.pte_bits[i] |= PT_PAGESIZE;
645 }
646
647 /*
648 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level.
649 */
650 for (i = 1; i < mmu.num_level; ++i)
651 mmu.ptp_bits[i] = PT_PTPBITS;
652
653 #if defined(__i386)
654 mmu.ptp_bits[2] = PT_VALID;
655 #endif
656
657 /*
658 * Compute how many hash table entries to have per process for htables.
659 * We start with 1 page's worth of entries.
660 *
661 * If physical memory is small, reduce the amount need to cover it.
662 */
663 max_htables = physmax / mmu.ptes_per_table;
664 mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *);
665 while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables)
666 mmu.hash_cnt >>= 1;
667 mmu.vlp_hash_cnt = mmu.hash_cnt;
668
669 #if defined(__amd64)
670 /*
671 * If running in 64 bits and physical memory is large,
672 * increase the size of the cache to cover all of memory for
673 * a 64 bit process.
674 */
675 #define HASH_MAX_LENGTH 4
676 while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables)
677 mmu.hash_cnt <<= 1;
678 #endif
679 }
680
681
682 /*
683 * initialize hat data structures
684 */
685 void
686 hat_init()
687 {
696 }
697 #endif
698
699 cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL);
700
701 /*
702 * initialize kmem caches
703 */
704 htable_init();
705 hment_init();
706
707 hat_cache = kmem_cache_create("hat_t",
708 sizeof (hat_t), 0, hati_constructor, NULL, NULL,
709 NULL, 0, 0);
710
711 hat_hash_cache = kmem_cache_create("HatHash",
712 mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL,
713 NULL, 0, 0);
714
715 /*
716 * VLP hats can use a smaller hash table size on large memroy machines
717 */
718 if (mmu.hash_cnt == mmu.vlp_hash_cnt) {
719 vlp_hash_cache = hat_hash_cache;
720 } else {
721 vlp_hash_cache = kmem_cache_create("HatVlpHash",
722 mmu.vlp_hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL,
723 NULL, 0, 0);
724 }
725
726 /*
727 * Set up the kernel's hat
728 */
729 AS_LOCK_ENTER(&kas, RW_WRITER);
730 kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP);
731 mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
732 kas.a_hat->hat_as = &kas;
733 kas.a_hat->hat_flags = 0;
734 AS_LOCK_EXIT(&kas);
735
736 CPUSET_ZERO(khat_cpuset);
737 CPUSET_ADD(khat_cpuset, CPU->cpu_id);
738
739 /*
740 * The kernel hat's next pointer serves as the head of the hat list .
741 * The kernel hat's prev pointer tracks the last hat on the list for
742 * htable_steal() to use.
743 */
744 kas.a_hat->hat_next = NULL;
745 kas.a_hat->hat_prev = NULL;
746
747 /*
748 * Allocate an htable hash bucket for the kernel
749 * XX64 - tune for 64 bit procs
750 */
751 kas.a_hat->hat_num_hash = mmu.hash_cnt;
752 kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP);
753 bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *));
754
755 /*
756 * zero out the top level and cached htable pointers
757 */
758 kas.a_hat->hat_ht_cached = NULL;
759 kas.a_hat->hat_htable = NULL;
760
761 /*
762 * Pre-allocate hrm_hashtab before enabling the collection of
763 * refmod statistics. Allocating on the fly would mean us
764 * running the risk of suffering recursive mutex enters or
765 * deadlocks.
766 */
767 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
768 KM_SLEEP);
769 }
770
771 /*
772 * Prepare CPU specific pagetables for VLP processes on 64 bit kernels.
773 *
774 * Each CPU has a set of 2 pagetables that are reused for any 32 bit
775 * process it runs. They are the top level pagetable, hci_vlp_l3ptes, and
776 * the next to top level table for the bottom 512 Gig, hci_vlp_l2ptes.
777 */
778 /*ARGSUSED*/
779 static void
780 hat_vlp_setup(struct cpu *cpu)
781 {
782 #if defined(__amd64) && !defined(__xpv)
783 struct hat_cpu_info *hci = cpu->cpu_hat_info;
784 pfn_t pfn;
785
786 /*
787 * allocate the level==2 page table for the bottom most
788 * 512Gig of address space (this is where 32 bit apps live)
789 */
790 ASSERT(hci != NULL);
791 hci->hci_vlp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
792
793 /*
794 * Allocate a top level pagetable and copy the kernel's
795 * entries into it. Then link in hci_vlp_l2ptes in the 1st entry.
796 */
797 hci->hci_vlp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
798 hci->hci_vlp_pfn =
799 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l3ptes);
800 ASSERT(hci->hci_vlp_pfn != PFN_INVALID);
801 bcopy(vlp_page, hci->hci_vlp_l3ptes, MMU_PAGESIZE);
802
803 pfn = hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l2ptes);
804 ASSERT(pfn != PFN_INVALID);
805 hci->hci_vlp_l3ptes[0] = MAKEPTP(pfn, 2);
806 #endif /* __amd64 && !__xpv */
807 }
808
809 /*ARGSUSED*/
810 static void
811 hat_vlp_teardown(cpu_t *cpu)
812 {
813 #if defined(__amd64) && !defined(__xpv)
814 struct hat_cpu_info *hci;
815
816 if ((hci = cpu->cpu_hat_info) == NULL)
817 return;
818 if (hci->hci_vlp_l2ptes)
819 kmem_free(hci->hci_vlp_l2ptes, MMU_PAGESIZE);
820 if (hci->hci_vlp_l3ptes)
821 kmem_free(hci->hci_vlp_l3ptes, MMU_PAGESIZE);
822 #endif
823 }
824
825 #define NEXT_HKR(r, l, s, e) { \
826 kernel_ranges[r].hkr_level = l; \
827 kernel_ranges[r].hkr_start_va = s; \
828 kernel_ranges[r].hkr_end_va = e; \
829 ++r; \
830 }
831
832 /*
833 * Finish filling in the kernel hat.
834 * Pre fill in all top level kernel page table entries for the kernel's
835 * part of the address range. From this point on we can't use any new
836 * kernel large pages if they need PTE's at max_level
837 *
838 * create the kmap mappings.
839 */
840 void
841 hat_init_finish(void)
897
898 if (IN_HYPERVISOR_VA(va))
899 continue;
900
901 /* can/must skip if a page mapping already exists */
902 if (rp->hkr_level <= mmu.max_page_level &&
903 (ht = htable_getpage(kas.a_hat, va, NULL)) !=
904 NULL) {
905 htable_release(ht);
906 continue;
907 }
908
909 (void) htable_create(kas.a_hat, va, rp->hkr_level - 1,
910 NULL);
911 }
912 }
913
914 /*
915 * 32 bit PAE metal kernels use only 4 of the 512 entries in the
916 * page holding the top level pagetable. We use the remainder for
917 * the "per CPU" page tables for VLP processes.
918 * Map the top level kernel pagetable into the kernel to make
919 * it easy to use bcopy access these tables.
920 */
921 if (mmu.pae_hat) {
922 vlp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP);
923 hat_devload(kas.a_hat, (caddr_t)vlp_page, MMU_PAGESIZE,
924 kas.a_hat->hat_htable->ht_pfn,
925 #if !defined(__xpv)
926 PROT_WRITE |
927 #endif
928 PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK,
929 HAT_LOAD | HAT_LOAD_NOCONSIST);
930 }
931 hat_vlp_setup(CPU);
932
933 /*
934 * Create kmap (cached mappings of kernel PTEs)
935 * for 32 bit we map from segmap_start .. ekernelheap
936 * for 64 bit we map from segmap_start .. segmap_start + segmapsize;
937 */
938 #if defined(__i386)
939 size = (uintptr_t)ekernelheap - segmap_start;
940 #elif defined(__amd64)
941 size = segmapsize;
942 #endif
943 hat_kmap_init((uintptr_t)segmap_start, size);
944 }
945
946 /*
947 * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references
948 * are 32 bit, so for safety we must use atomic_cas_64() to install these.
949 */
950 #ifdef __i386
951 static void
952 reload_pae32(hat_t *hat, cpu_t *cpu)
953 {
954 x86pte_t *src;
955 x86pte_t *dest;
956 x86pte_t pte;
957 int i;
958
959 /*
960 * Load the 4 entries of the level 2 page table into this
961 * cpu's range of the vlp_page and point cr3 at them.
962 */
963 ASSERT(mmu.pae_hat);
964 src = hat->hat_vlp_ptes;
965 dest = vlp_page + (cpu->cpu_id + 1) * VLP_NUM_PTES;
966 for (i = 0; i < VLP_NUM_PTES; ++i) {
967 for (;;) {
968 pte = dest[i];
969 if (pte == src[i])
970 break;
971 if (atomic_cas_64(dest + i, pte, src[i]) != src[i])
972 break;
973 }
974 }
975 }
976 #endif
977
978 /*
979 * Switch to a new active hat, maintaining bit masks to track active CPUs.
980 *
981 * On the 32-bit PAE hypervisor, %cr3 is a 64-bit value, on metal it
982 * remains a 32-bit value.
983 */
984 void
985 hat_switch(hat_t *hat)
986 {
987 uint64_t newcr3;
988 cpu_t *cpu = CPU;
989 hat_t *old = cpu->cpu_current_hat;
990
991 /*
992 * set up this information first, so we don't miss any cross calls
993 */
994 if (old != NULL) {
995 if (old == hat)
996 return;
997 if (old != kas.a_hat)
998 CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id);
999 }
1000
1001 /*
1002 * Add this CPU to the active set for this HAT.
1003 */
1004 if (hat != kas.a_hat) {
1005 CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id);
1006 }
1007 cpu->cpu_current_hat = hat;
1008
1009 /*
1010 * now go ahead and load cr3
1011 */
1012 if (hat->hat_flags & HAT_VLP) {
1013 #if defined(__amd64)
1014 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes;
1015
1016 VLP_COPY(hat->hat_vlp_ptes, vlpptep);
1017 newcr3 = MAKECR3(cpu->cpu_hat_info->hci_vlp_pfn);
1018 #elif defined(__i386)
1019 reload_pae32(hat, cpu);
1020 newcr3 = MAKECR3(kas.a_hat->hat_htable->ht_pfn) +
1021 (cpu->cpu_id + 1) * VLP_SIZE;
1022 #endif
1023 } else {
1024 newcr3 = MAKECR3((uint64_t)hat->hat_htable->ht_pfn);
1025 }
1026 #ifdef __xpv
1027 {
1028 struct mmuext_op t[2];
1029 uint_t retcnt;
1030 uint_t opcnt = 1;
1031
1032 t[0].cmd = MMUEXT_NEW_BASEPTR;
1033 t[0].arg1.mfn = mmu_btop(pa_to_ma(newcr3));
1034 #if defined(__amd64)
1035 /*
1036 * There's an interesting problem here, as to what to
1037 * actually specify when switching to the kernel hat.
1038 * For now we'll reuse the kernel hat again.
1039 */
1040 t[1].cmd = MMUEXT_NEW_USER_BASEPTR;
1041 if (hat == kas.a_hat)
1042 t[1].arg1.mfn = mmu_btop(pa_to_ma(newcr3));
1043 else
1044 t[1].arg1.mfn = pfn_to_mfn(hat->hat_user_ptable);
1045 ++opcnt;
1046 #endif /* __amd64 */
1047 if (HYPERVISOR_mmuext_op(t, opcnt, &retcnt, DOMID_SELF) < 0)
1048 panic("HYPERVISOR_mmu_update() failed");
1049 ASSERT(retcnt == opcnt);
1050
1051 }
1052 #else
1053 setcr3(newcr3);
1054 #endif
1055 ASSERT(cpu == CPU);
1056 }
1057
1058 /*
1059 * Utility to return a valid x86pte_t from protections, pfn, and level number
1060 */
1061 static x86pte_t
1062 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags)
1063 {
1064 x86pte_t pte;
1065 uint_t cache_attr = attr & HAT_ORDER_MASK;
1066
1067 pte = MAKEPTE(pfn, level);
1068
1069 if (attr & PROT_WRITE)
1070 PTE_SET(pte, PT_WRITABLE);
1071
1072 if (attr & PROT_USER)
1073 PTE_SET(pte, PT_USER);
1074
1346 goto done;
1347 }
1348
1349 /*
1350 * If the mapping didn't change there is nothing more to do.
1351 */
1352 if (PTE_EQUIV(pte, old_pte))
1353 goto done;
1354
1355 /*
1356 * Install a new mapping in the page's mapping list
1357 */
1358 if (!PTE_ISVALID(old_pte)) {
1359 if (is_consist) {
1360 hment_assign(ht, entry, pp, hm);
1361 x86_hm_exit(pp);
1362 } else {
1363 ASSERT(flags & HAT_LOAD_NOCONSIST);
1364 }
1365 #if defined(__amd64)
1366 if (ht->ht_flags & HTABLE_VLP) {
1367 cpu_t *cpu = CPU;
1368 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes;
1369 VLP_COPY(hat->hat_vlp_ptes, vlpptep);
1370 }
1371 #endif
1372 HTABLE_INC(ht->ht_valid_cnt);
1373 PGCNT_INC(hat, l);
1374 return (rv);
1375 }
1376
1377 /*
1378 * Remap's are more complicated:
1379 * - HAT_LOAD_REMAP must be specified if changing the pfn.
1380 * We also require that NOCONSIST be specified.
1381 * - Otherwise only permission or caching bits may change.
1382 */
1383 if (!PTE_ISPAGE(old_pte, l))
1384 panic("non-null/page mapping pte=" FMT_PTE, old_pte);
1385
1386 if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) {
1387 REMAPASSERT(flags & HAT_LOAD_REMAP);
1388 REMAPASSERT(flags & HAT_LOAD_NOCONSIST);
1389 REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST);
1421 hat_t *hat,
1422 uintptr_t va,
1423 page_t *pp,
1424 uint_t attr,
1425 uint_t flags,
1426 level_t level,
1427 pfn_t pfn)
1428 {
1429 htable_t *ht;
1430 uint_t entry;
1431 x86pte_t pte;
1432 int rv = 0;
1433
1434 /*
1435 * The number 16 is arbitrary and here to catch a recursion problem
1436 * early before we blow out the kernel stack.
1437 */
1438 ++curthread->t_hatdepth;
1439 ASSERT(curthread->t_hatdepth < 16);
1440
1441 ASSERT(hat == kas.a_hat || AS_LOCK_HELD(hat->hat_as));
1442
1443 if (flags & HAT_LOAD_SHARE)
1444 hat->hat_flags |= HAT_SHARED;
1445
1446 /*
1447 * Find the page table that maps this page if it already exists.
1448 */
1449 ht = htable_lookup(hat, va, level);
1450
1451 /*
1452 * We must have HAT_LOAD_NOCONSIST if page_t is NULL.
1453 */
1454 if (pp == NULL)
1455 flags |= HAT_LOAD_NOCONSIST;
1456
1457 if (ht == NULL) {
1458 ht = htable_create(hat, va, level, NULL);
1459 ASSERT(ht != NULL);
1460 }
1461 entry = htable_va2entry(va, ht);
1462
1463 /*
1464 * a bunch of paranoid error checking
1465 */
1466 ASSERT(ht->ht_busy > 0);
1467 if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht))
1468 panic("hati_load_common: bad htable %p, va %p",
1469 (void *)ht, (void *)va);
1470 ASSERT(ht->ht_level == level);
1471
1472 /*
1473 * construct the new PTE
1474 */
1475 if (hat == kas.a_hat)
1476 attr &= ~PROT_USER;
1477 pte = hati_mkpte(pfn, attr, level, flags);
1478 if (hat == kas.a_hat && va >= kernelbase)
1479 PTE_SET(pte, mmu.pt_global);
1480
1481 /*
1482 * establish the mapping
1483 */
1484 rv = hati_pte_map(ht, entry, pp, pte, flags, NULL);
1485
1486 /*
1487 * release the htable and any reserves
1488 */
1489 htable_release(ht);
1899 "htable=%p, vaddr=%p\n", (void *)ht, (void *)vaddr);
1900 HTABLE_LOCK_DEC(ht);
1901
1902 vaddr += LEVEL_SIZE(ht->ht_level);
1903 }
1904 if (ht)
1905 htable_release(ht);
1906 XPV_ALLOW_MIGRATE();
1907 }
1908
1909 /* ARGSUSED */
1910 void
1911 hat_unlock_region(struct hat *hat, caddr_t addr, size_t len,
1912 hat_region_cookie_t rcookie)
1913 {
1914 panic("No shared region support on x86");
1915 }
1916
1917 #if !defined(__xpv)
1918 /*
1919 * Cross call service routine to demap a virtual page on
1920 * the current CPU or flush all mappings in TLB.
1921 */
1922 /*ARGSUSED*/
1923 static int
1924 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3)
1925 {
1926 hat_t *hat = (hat_t *)a1;
1927 caddr_t addr = (caddr_t)a2;
1928 size_t len = (size_t)a3;
1929
1930 /*
1931 * If the target hat isn't the kernel and this CPU isn't operating
1932 * in the target hat, we can ignore the cross call.
1933 */
1934 if (hat != kas.a_hat && hat != CPU->cpu_current_hat)
1935 return (0);
1936
1937 /*
1938 * For a normal address, we flush a range of contiguous mappings
1939 */
1940 if ((uintptr_t)addr != DEMAP_ALL_ADDR) {
1941 for (size_t i = 0; i < len; i += MMU_PAGESIZE)
1942 mmu_tlbflush_entry(addr + i);
1943 return (0);
1944 }
1945
1946 /*
1947 * Otherwise we reload cr3 to effect a complete TLB flush.
1948 *
1949 * A reload of cr3 on a VLP process also means we must also recopy in
1950 * the pte values from the struct hat
1951 */
1952 if (hat->hat_flags & HAT_VLP) {
1953 #if defined(__amd64)
1954 x86pte_t *vlpptep = CPU->cpu_hat_info->hci_vlp_l2ptes;
1955
1956 VLP_COPY(hat->hat_vlp_ptes, vlpptep);
1957 #elif defined(__i386)
1958 reload_pae32(hat, CPU);
1959 #endif
1960 }
1961 reload_cr3();
1962 return (0);
1963 }
1964
1965 /*
1966 * Flush all TLB entries, including global (ie. kernel) ones.
1967 */
1968 static void
1969 flush_all_tlb_entries(void)
1970 {
1971 ulong_t cr4 = getcr4();
1972
1973 if (cr4 & CR4_PGE) {
1974 setcr4(cr4 & ~(ulong_t)CR4_PGE);
1975 setcr4(cr4);
1976
1977 /*
1978 * 32 bit PAE also needs to always reload_cr3()
1979 */
1980 if (mmu.max_level == 2)
1981 reload_cr3();
1982 } else {
1983 reload_cr3();
1984 }
1985 }
1986
1987 #define TLB_CPU_HALTED (01ul)
1988 #define TLB_INVAL_ALL (02ul)
1989 #define CAS_TLB_INFO(cpu, old, new) \
1990 atomic_cas_ulong((ulong_t *)&(cpu)->cpu_m.mcpu_tlb_info, (old), (new))
1991
1992 /*
1993 * Record that a CPU is going idle
1994 */
1995 void
1996 tlb_going_idle(void)
1997 {
1998 atomic_or_ulong((ulong_t *)&CPU->cpu_m.mcpu_tlb_info, TLB_CPU_HALTED);
1999 }
2000
2001 /*
2002 * Service a delayed TLB flush if coming out of being idle.
2003 * It will be called from cpu idle notification with interrupt disabled.
2004 */
2005 void
2006 tlb_service(void)
2007 {
2008 ulong_t tlb_info;
2009 ulong_t found;
2010
2011 /*
2012 * We only have to do something if coming out of being idle.
2013 */
2014 tlb_info = CPU->cpu_m.mcpu_tlb_info;
2015 if (tlb_info & TLB_CPU_HALTED) {
2016 ASSERT(CPU->cpu_current_hat == kas.a_hat);
2017
2018 /*
2019 * Atomic clear and fetch of old state.
2020 */
2021 while ((found = CAS_TLB_INFO(CPU, tlb_info, 0)) != tlb_info) {
2022 ASSERT(found & TLB_CPU_HALTED);
2023 tlb_info = found;
2024 SMT_PAUSE();
2025 }
2026 if (tlb_info & TLB_INVAL_ALL)
2027 flush_all_tlb_entries();
2028 }
2029 }
2030 #endif /* !__xpv */
2031
2032 /*
2033 * Internal routine to do cross calls to invalidate a range of pages on
2034 * all CPUs using a given hat.
2035 */
2036 void
2037 hat_tlb_inval_range(hat_t *hat, uintptr_t va, size_t len)
2038 {
2039 extern int flushes_require_xcalls; /* from mp_startup.c */
2040 cpuset_t justme;
2041 cpuset_t cpus_to_shootdown;
2042 #ifndef __xpv
2043 cpuset_t check_cpus;
2044 cpu_t *cpup;
2045 int c;
2046 #endif
2047
2048 /*
2049 * If the hat is being destroyed, there are no more users, so
2050 * demap need not do anything.
2051 */
2052 if (hat->hat_flags & HAT_FREEING)
2053 return;
2054
2055 /*
2056 * If demapping from a shared pagetable, we best demap the
2057 * entire set of user TLBs, since we don't know what addresses
2058 * these were shared at.
2059 */
2060 if (hat->hat_flags & HAT_SHARED) {
2061 hat = kas.a_hat;
2062 va = DEMAP_ALL_ADDR;
2063 }
2064
2065 /*
2066 * if not running with multiple CPUs, don't use cross calls
2067 */
2068 if (panicstr || !flushes_require_xcalls) {
2069 #ifdef __xpv
2070 if (va == DEMAP_ALL_ADDR) {
2071 xen_flush_tlb();
2072 } else {
2073 for (size_t i = 0; i < len; i += MMU_PAGESIZE)
2074 xen_flush_va((caddr_t)(va + i));
2075 }
2076 #else
2077 (void) hati_demap_func((xc_arg_t)hat,
2078 (xc_arg_t)va, (xc_arg_t)len);
2079 #endif
2080 return;
2081 }
2082
2083
2084 /*
2085 * Determine CPUs to shootdown. Kernel changes always do all CPUs.
2086 * Otherwise it's just CPUs currently executing in this hat.
2087 */
2088 kpreempt_disable();
2089 CPUSET_ONLY(justme, CPU->cpu_id);
2090 if (hat == kas.a_hat)
2091 cpus_to_shootdown = khat_cpuset;
2092 else
2093 cpus_to_shootdown = hat->hat_cpus;
2094
2095 #ifndef __xpv
2096 /*
2097 * If any CPUs in the set are idle, just request a delayed flush
2098 * and avoid waking them up.
2099 */
2100 check_cpus = cpus_to_shootdown;
2101 for (c = 0; c < NCPU && !CPUSET_ISNULL(check_cpus); ++c) {
2102 ulong_t tlb_info;
2103
2104 if (!CPU_IN_SET(check_cpus, c))
2105 continue;
2106 CPUSET_DEL(check_cpus, c);
2107 cpup = cpu[c];
2108 if (cpup == NULL)
2109 continue;
2110
2111 tlb_info = cpup->cpu_m.mcpu_tlb_info;
2112 while (tlb_info == TLB_CPU_HALTED) {
2113 (void) CAS_TLB_INFO(cpup, TLB_CPU_HALTED,
2114 TLB_CPU_HALTED | TLB_INVAL_ALL);
2115 SMT_PAUSE();
2116 tlb_info = cpup->cpu_m.mcpu_tlb_info;
2117 }
2118 if (tlb_info == (TLB_CPU_HALTED | TLB_INVAL_ALL)) {
2119 HATSTAT_INC(hs_tlb_inval_delayed);
2120 CPUSET_DEL(cpus_to_shootdown, c);
2121 }
2122 }
2123 #endif
2124
2125 if (CPUSET_ISNULL(cpus_to_shootdown) ||
2126 CPUSET_ISEQUAL(cpus_to_shootdown, justme)) {
2127
2128 #ifdef __xpv
2129 if (va == DEMAP_ALL_ADDR) {
2130 xen_flush_tlb();
2131 } else {
2132 for (size_t i = 0; i < len; i += MMU_PAGESIZE)
2133 xen_flush_va((caddr_t)(va + i));
2134 }
2135 #else
2136 (void) hati_demap_func((xc_arg_t)hat,
2137 (xc_arg_t)va, (xc_arg_t)len);
2138 #endif
2139
2140 } else {
2141
2142 CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id);
2143 #ifdef __xpv
2144 if (va == DEMAP_ALL_ADDR) {
2145 xen_gflush_tlb(cpus_to_shootdown);
2146 } else {
2147 for (size_t i = 0; i < len; i += MMU_PAGESIZE) {
2148 xen_gflush_va((caddr_t)(va + i),
2149 cpus_to_shootdown);
2150 }
2151 }
2152 #else
2153 xc_call((xc_arg_t)hat, (xc_arg_t)va, (xc_arg_t)len,
2154 CPUSET2BV(cpus_to_shootdown), hati_demap_func);
2155 #endif
2156
2157 }
2158 kpreempt_enable();
2159 }
2160
2161 void
2162 hat_tlb_inval(hat_t *hat, uintptr_t va)
2163 {
2164 hat_tlb_inval_range(hat, va, MMU_PAGESIZE);
2165 }
2166
2167 /*
2168 * Interior routine for HAT_UNLOADs from hat_unload_callback(),
2169 * hat_kmap_unload() OR from hat_steal() code. This routine doesn't
2170 * handle releasing of the htables.
2171 */
2172 void
2173 hat_pte_unmap(
2174 htable_t *ht,
2175 uint_t entry,
2176 uint_t flags,
2177 x86pte_t old_pte,
2178 void *pte_ptr,
2179 boolean_t tlb)
2180 {
2181 hat_t *hat = ht->ht_hat;
2182 hment_t *hm = NULL;
2183 page_t *pp = NULL;
2184 level_t l = ht->ht_level;
2311 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2312 {
2313 uintptr_t va = (uintptr_t)addr;
2314
2315 XPV_DISALLOW_MIGRATE();
2316 ASSERT(hat == kas.a_hat || va + len <= _userlimit);
2317
2318 /*
2319 * special case for performance.
2320 */
2321 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) {
2322 ASSERT(hat == kas.a_hat);
2323 hat_kmap_unload(addr, len, flags);
2324 } else {
2325 hat_unload_callback(hat, addr, len, flags, NULL);
2326 }
2327 XPV_ALLOW_MIGRATE();
2328 }
2329
2330 /*
2331 * Do the callbacks for ranges being unloaded.
2332 */
2333 typedef struct range_info {
2334 uintptr_t rng_va;
2335 ulong_t rng_cnt;
2336 level_t rng_level;
2337 } range_info_t;
2338
2339 /*
2340 * Invalidate the TLB, and perform the callback to the upper level VM system,
2341 * for the specified ranges of contiguous pages.
2342 */
2343 static void
2344 handle_ranges(hat_t *hat, hat_callback_t *cb, uint_t cnt, range_info_t *range)
2345 {
2346 while (cnt > 0) {
2347 size_t len;
2348
2349 --cnt;
2350 len = range[cnt].rng_cnt << LEVEL_SHIFT(range[cnt].rng_level);
2351 hat_tlb_inval_range(hat, (uintptr_t)range[cnt].rng_va, len);
2352
2353 if (cb != NULL) {
2354 cb->hcb_start_addr = (caddr_t)range[cnt].rng_va;
2355 cb->hcb_end_addr = cb->hcb_start_addr;
2356 cb->hcb_end_addr += len;
2357 cb->hcb_function(cb);
2358 }
2359 }
2360 }
2361
2362 /*
2363 * Unload a given range of addresses (has optional callback)
2364 *
2365 * Flags:
2366 * define HAT_UNLOAD 0x00
2367 * define HAT_UNLOAD_NOSYNC 0x02
2368 * define HAT_UNLOAD_UNLOCK 0x04
2369 * define HAT_UNLOAD_OTHER 0x08 - not used
2370 * define HAT_UNLOAD_UNMAP 0x10 - same as HAT_UNLOAD
2371 */
2372 #define MAX_UNLOAD_CNT (8)
2373 void
2374 hat_unload_callback(
2375 hat_t *hat,
2376 caddr_t addr,
2377 size_t len,
2378 uint_t flags,
2379 hat_callback_t *cb)
2380 {
2381 uintptr_t vaddr = (uintptr_t)addr;
2382 uintptr_t eaddr = vaddr + len;
2383 htable_t *ht = NULL;
2384 uint_t entry;
2385 uintptr_t contig_va = (uintptr_t)-1L;
2386 range_info_t r[MAX_UNLOAD_CNT];
2387 uint_t r_cnt = 0;
2388 x86pte_t old_pte;
2389
2390 XPV_DISALLOW_MIGRATE();
2391 ASSERT(hat == kas.a_hat || eaddr <= _userlimit);
2392 ASSERT(IS_PAGEALIGNED(vaddr));
2393 ASSERT(IS_PAGEALIGNED(eaddr));
2394
2395 /*
2396 * Special case a single page being unloaded for speed. This happens
2397 * quite frequently, COW faults after a fork() for example.
2398 */
2399 if (cb == NULL && len == MMU_PAGESIZE) {
2400 ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0);
2401 if (ht != NULL) {
2402 if (PTE_ISVALID(old_pte)) {
2403 hat_pte_unmap(ht, entry, flags, old_pte,
2404 NULL, B_TRUE);
2405 }
2406 htable_release(ht);
2407 }
2408 XPV_ALLOW_MIGRATE();
2409 return;
2410 }
2411
2412 while (vaddr < eaddr) {
2413 old_pte = htable_walk(hat, &ht, &vaddr, eaddr);
2414 if (ht == NULL)
2415 break;
2416
2417 ASSERT(!IN_VA_HOLE(vaddr));
2418
2419 if (vaddr < (uintptr_t)addr)
2420 panic("hat_unload_callback(): unmap inside large page");
2421
2422 /*
2423 * We'll do the call backs for contiguous ranges
2424 */
2425 if (vaddr != contig_va ||
2426 (r_cnt > 0 && r[r_cnt - 1].rng_level != ht->ht_level)) {
2427 if (r_cnt == MAX_UNLOAD_CNT) {
2428 handle_ranges(hat, cb, r_cnt, r);
2429 r_cnt = 0;
2430 }
2431 r[r_cnt].rng_va = vaddr;
2432 r[r_cnt].rng_cnt = 0;
2433 r[r_cnt].rng_level = ht->ht_level;
2434 ++r_cnt;
2435 }
2436
2437 /*
2438 * Unload one mapping (for a single page) from the page tables.
2439 * Note that we do not remove the mapping from the TLB yet,
2440 * as indicated by the tlb=FALSE argument to hat_pte_unmap().
2441 * handle_ranges() will clear the TLB entries with one call to
2442 * hat_tlb_inval_range() per contiguous range. This is
2443 * safe because the page can not be reused until the
2444 * callback is made (or we return).
2445 */
2446 entry = htable_va2entry(vaddr, ht);
2447 hat_pte_unmap(ht, entry, flags, old_pte, NULL, B_FALSE);
2448 ASSERT(ht->ht_level <= mmu.max_page_level);
2449 vaddr += LEVEL_SIZE(ht->ht_level);
2450 contig_va = vaddr;
2451 ++r[r_cnt - 1].rng_cnt;
2452 }
2453 if (ht)
2454 htable_release(ht);
2455
2456 /*
2457 * handle last range for callbacks
2458 */
2459 if (r_cnt > 0)
2460 handle_ranges(hat, cb, r_cnt, r);
2461 XPV_ALLOW_MIGRATE();
2462 }
2463
2464 /*
2465 * Invalidate a virtual address translation on a slave CPU during
2466 * panic() dumps.
2467 */
2468 void
2469 hat_flush_range(hat_t *hat, caddr_t va, size_t size)
2470 {
2471 ssize_t sz;
2472 caddr_t endva = va + size;
2473
2474 while (va < endva) {
2475 sz = hat_getpagesize(hat, va);
2476 if (sz < 0) {
2477 #ifdef __xpv
2478 xen_flush_tlb();
2479 #else
2480 flush_all_tlb_entries();
2481 #endif
2482 break;
2483 }
2484 #ifdef __xpv
2485 xen_flush_va(va);
2486 #else
2487 mmu_tlbflush_entry(va);
2488 #endif
2489 va += sz;
2490 }
2491 }
2492
2493 /*
2494 * synchronize mapping with software data structures
2495 *
2496 * This interface is currently only used by the working set monitor
2497 * driver.
2498 */
2499 /*ARGSUSED*/
2500 void
2501 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2502 {
2503 uintptr_t vaddr = (uintptr_t)addr;
2504 uintptr_t eaddr = vaddr + len;
2505 htable_t *ht = NULL;
2506 uint_t entry;
2507 x86pte_t pte;
3133 */
3134 ht = htable_lookup(hat, vaddr, l);
3135 if (ht == NULL)
3136 continue;
3137 if (ht->ht_flags & HTABLE_SHARED_PFN) {
3138 /*
3139 * clear page count, set valid_cnt to 0,
3140 * let htable_release() finish the job
3141 */
3142 hat->hat_ism_pgcnt -= ht->ht_valid_cnt <<
3143 (LEVEL_SHIFT(ht->ht_level) - MMU_PAGESHIFT);
3144 ht->ht_valid_cnt = 0;
3145 need_demaps = 1;
3146 }
3147 htable_release(ht);
3148 }
3149 }
3150
3151 /*
3152 * flush the TLBs - since we're probably dealing with MANY mappings
3153 * we do just one CR3 reload.
3154 */
3155 if (!(hat->hat_flags & HAT_FREEING) && need_demaps)
3156 hat_tlb_inval(hat, DEMAP_ALL_ADDR);
3157
3158 /*
3159 * Now go back and clean up any unaligned mappings that
3160 * couldn't share pagetables.
3161 */
3162 if (!is_it_dism(hat, addr))
3163 flags |= HAT_UNLOAD_UNLOCK;
3164 hat_unload(hat, addr, len, flags);
3165 XPV_ALLOW_MIGRATE();
3166 }
3167
3168
3169 /*
3170 * hat_reserve() does nothing
3171 */
3172 /*ARGSUSED*/
3173 void
3916 htable_t *ht;
3917
3918 XPV_DISALLOW_MIGRATE();
3919 /*
3920 * invalidate any left over mapping and decrement the htable valid count
3921 */
3922 #ifdef __xpv
3923 if (HYPERVISOR_update_va_mapping((uintptr_t)addr, 0,
3924 UVMF_INVLPG | UVMF_LOCAL))
3925 panic("HYPERVISOR_update_va_mapping() failed");
3926 #else
3927 {
3928 x86pte_t *pteptr;
3929
3930 pteptr = x86pte_mapin(mmu_btop(pte_pa),
3931 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
3932 if (mmu.pae_hat)
3933 *pteptr = 0;
3934 else
3935 *(x86pte32_t *)pteptr = 0;
3936 mmu_tlbflush_entry(addr);
3937 x86pte_mapout();
3938 }
3939 #endif
3940
3941 ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0);
3942 if (ht == NULL)
3943 panic("hat_mempte_release(): invalid address");
3944 ASSERT(ht->ht_level == 0);
3945 HTABLE_DEC(ht->ht_valid_cnt);
3946 htable_release(ht);
3947 XPV_ALLOW_MIGRATE();
3948 }
3949
3950 /*
3951 * Apply a temporary CPU private mapping to a page. We flush the TLB only
3952 * on this CPU, so this ought to have been called with preemption disabled.
3953 */
3954 void
3955 hat_mempte_remap(
3956 pfn_t pfn,
3977 ASSERT(ht->ht_level == 0);
3978 ASSERT(ht->ht_valid_cnt > 0);
3979 ASSERT(ht->ht_pfn == mmu_btop(pte_pa));
3980 htable_release(ht);
3981 #endif
3982 XPV_DISALLOW_MIGRATE();
3983 pte = hati_mkpte(pfn, attr, 0, flags);
3984 #ifdef __xpv
3985 if (HYPERVISOR_update_va_mapping(va, pte, UVMF_INVLPG | UVMF_LOCAL))
3986 panic("HYPERVISOR_update_va_mapping() failed");
3987 #else
3988 {
3989 x86pte_t *pteptr;
3990
3991 pteptr = x86pte_mapin(mmu_btop(pte_pa),
3992 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
3993 if (mmu.pae_hat)
3994 *(x86pte_t *)pteptr = pte;
3995 else
3996 *(x86pte32_t *)pteptr = (x86pte32_t)pte;
3997 mmu_tlbflush_entry(addr);
3998 x86pte_mapout();
3999 }
4000 #endif
4001 XPV_ALLOW_MIGRATE();
4002 }
4003
4004
4005
4006 /*
4007 * Hat locking functions
4008 * XXX - these two functions are currently being used by hatstats
4009 * they can be removed by using a per-as mutex for hatstats.
4010 */
4011 void
4012 hat_enter(hat_t *hat)
4013 {
4014 mutex_enter(&hat->hat_mutex);
4015 }
4016
4017 void
4018 hat_exit(hat_t *hat)
4019 {
4020 mutex_exit(&hat->hat_mutex);
4021 }
4022
4023 /*
4024 * HAT part of cpu initialization.
4025 */
4026 void
4027 hat_cpu_online(struct cpu *cpup)
4028 {
4029 if (cpup != CPU) {
4030 x86pte_cpu_init(cpup);
4031 hat_vlp_setup(cpup);
4032 }
4033 CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id);
4034 }
4035
4036 /*
4037 * HAT part of cpu deletion.
4038 * (currently, we only call this after the cpu is safely passivated.)
4039 */
4040 void
4041 hat_cpu_offline(struct cpu *cpup)
4042 {
4043 ASSERT(cpup != CPU);
4044
4045 CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id);
4046 hat_vlp_teardown(cpup);
4047 x86pte_cpu_fini(cpup);
4048 }
4049
4050 /*
4051 * Function called after all CPUs are brought online.
4052 * Used to remove low address boot mappings.
4053 */
4054 void
4055 clear_boot_mappings(uintptr_t low, uintptr_t high)
4056 {
4057 uintptr_t vaddr = low;
4058 htable_t *ht = NULL;
4059 level_t level;
4060 uint_t entry;
4061 x86pte_t pte;
4062
4063 /*
4064 * On 1st CPU we can unload the prom mappings, basically we blow away
4065 * all virtual mappings under _userlimit.
4066 */
4473 *pte_ma = base_ma + (entry << mmu.pte_size_shift);
4474 }
4475 XPV_ALLOW_MIGRATE();
4476 }
4477
4478 void
4479 hat_release_mapping(hat_t *hat, caddr_t addr)
4480 {
4481 htable_t *ht;
4482
4483 ASSERT(IS_P2ALIGNED((uintptr_t)addr, MMU_PAGESIZE));
4484 XPV_DISALLOW_MIGRATE();
4485 ht = htable_lookup(hat, (uintptr_t)addr, 0);
4486 ASSERT(ht != NULL);
4487 ASSERT(ht->ht_busy >= 2);
4488 htable_release(ht);
4489 htable_release(ht);
4490 XPV_ALLOW_MIGRATE();
4491 }
4492 #endif /* __xpv */
|
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 1992, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24 /*
25 * Copyright (c) 2010, Intel Corporation.
26 * All rights reserved.
27 */
28 /*
29 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
30 * Copyright 2018 Joyent, Inc. All rights reserved.
31 * Copyright (c) 2014, 2015 by Delphix. All rights reserved.
32 */
33
34 /*
35 * VM - Hardware Address Translation management for i386 and amd64
36 *
37 * Implementation of the interfaces described in <common/vm/hat.h>
38 *
39 * Nearly all the details of how the hardware is managed should not be
40 * visible outside this layer except for misc. machine specific functions
41 * that work in conjunction with this code.
42 *
43 * Routines used only inside of i86pc/vm start with hati_ for HAT Internal.
44 */
45
46 /*
47 * amd64 HAT Design
48 *
49 * ----------
50 * Background
51 * ----------
52 *
53 * On x86, the address space is shared between a user process and the kernel.
54 * This is different from SPARC. Conventionally, the kernel lives at the top of
55 * the address space and the user process gets to enjoy the rest of it. If you
56 * look at the image of the address map in uts/i86pc/os/startup.c, you'll get a
57 * rough sense of how the address space is laid out and used.
58 *
59 * Every unique address space is represented by an instance of a HAT structure
60 * called a 'hat_t'. In addition to a hat_t structure for each process, there is
61 * also one that is used for the kernel (kas.a_hat), and each CPU ultimately
62 * also has a HAT.
63 *
64 * Each HAT contains a pointer to its root page table. This root page table is
65 * what we call an L3 page table in illumos and Intel calls the PML4. It is the
66 * physical address of the L3 table that we place in the %cr3 register which the
67 * processor uses.
68 *
69 * Each of the many layers of the page table is represented by a structure
70 * called an htable_t. The htable_t manages a set of 512 8-byte entries. The
71 * number of entries in a given page table is constant across all different
72 * level page tables. Note, this is only true on amd64. This has not always been
73 * the case on x86.
74 *
75 * Each entry in a page table, generally referred to as a PTE, may refer to
76 * another page table or a memory location, depending on the level of the page
77 * table and the use of large pages. Importantly, the top-level L3 page table
78 * (PML4) only supports linking to further page tables. This is also true on
79 * systems which support a 5th level page table (which we do not currently
80 * support).
81 *
82 * Historically, on x86, when a process was running on CPU, the root of the page
83 * table was inserted into %cr3 on each CPU on which it was currently running.
84 * When processes would switch (by calling hat_switch()), then the value in %cr3
85 * on that CPU would change to that of the new HAT. While this behavior is still
86 * maintained in the xpv kernel, this is not what is done today.
87 *
88 * -------------------
89 * Per-CPU Page Tables
90 * -------------------
91 *
92 * Throughout the system the 64-bit kernel has a notion of what it calls a
93 * per-CPU page table or PCP. The notion of a per-CPU page table was originally
94 * introduced as part of the original work to support x86 PAE. On the 64-bit
95 * kernel, it was originally used for 32-bit processes running on the 64-bit
96 * kernel. The rationale behind this was that each 32-bit process could have all
97 * of its memory represented in a single L2 page table as each L2 page table
98 * entry represents 1 GbE of memory.
99 *
100 * Following on from this, the idea was that given that all of the L3 page table
101 * entries for 32-bit processes are basically going to be identical with the
102 * exception of the first entry in the page table, why not share those page
103 * table entries. This gave rise to the idea of a per-CPU page table.
104 *
105 * The way this works is that we have a member in the machcpu_t called the
106 * mcpu_hat_info. That structure contains two different 4k pages: one that
107 * represents the L3 page table and one that represents an L2 page table. When
108 * the CPU starts up, the L3 page table entries are copied in from the kernel's
109 * page table. The L3 kernel entries do not change throughout the lifetime of
110 * the kernel. The kernel portion of these L3 pages for each CPU have the same
111 * records, meaning that they point to the same L2 page tables and thus see a
112 * consistent view of the world.
113 *
114 * When a 32-bit process is loaded into this world, we copy the 32-bit process's
115 * four top-level page table entries into the CPU's L2 page table and then set
116 * the CPU's first L3 page table entry to point to the CPU's L2 page.
117 * Specifically, in hat_pcp_update(), we're copying from the process's
118 * HAT_COPIED_32 HAT into the page tables specific to this CPU.
119 *
120 * As part of the implementation of kernel page table isolation, this was also
121 * extended to 64-bit processes. When a 64-bit process runs, we'll copy their L3
122 * PTEs across into the current CPU's L3 page table. (As we can't do the
123 * first-L3-entry trick for 64-bit processes, ->hci_pcp_l2ptes is unused in this
124 * case.)
125 *
126 * The use of per-CPU page tables has a lot of implementation ramifications. A
127 * HAT that runs a user process will be flagged with the HAT_COPIED flag to
128 * indicate that it is using the per-CPU page table functionality. In tandem
129 * with the HAT, the top-level htable_t will be flagged with the HTABLE_COPIED
130 * flag. If the HAT represents a 32-bit process, then we will also set the
131 * HAT_COPIED_32 flag on that hat_t.
132 *
133 * These two flags work together. The top-level htable_t when using per-CPU page
134 * tables is 'virtual'. We never allocate a ptable for this htable_t (i.e.
135 * ht->ht_pfn is PFN_INVALID). Instead, when we need to modify a PTE in an
136 * HTABLE_COPIED ptable, x86pte_access_pagetable() will redirect any accesses to
137 * ht_hat->hat_copied_ptes.
138 *
139 * Of course, such a modification won't actually modify the HAT_PCP page tables
140 * that were copied from the HAT_COPIED htable. When we change the top level
141 * page table entries (L2 PTEs for a 32-bit process and L3 PTEs for a 64-bit
142 * process), we need to make sure to trigger hat_pcp_update() on all CPUs that
143 * are currently tied to this HAT (including the current CPU).
144 *
145 * To do this, PCP piggy-backs on TLB invalidation, specifically via the
146 * hat_tlb_inval() path from link_ptp() and unlink_ptp().
147 *
148 * (Importantly, in all such cases, when this is in operation, the top-level
149 * entry should not be able to refer to an actual page table entry that can be
150 * changed and consolidated into a large page. If large page consolidation is
151 * required here, then there will be much that needs to be reconsidered.)
152 *
153 * -----------------------------------------------
154 * Kernel Page Table Isolation and the Per-CPU HAT
155 * -----------------------------------------------
156 *
157 * All Intel CPUs that support speculative execution and paging are subject to a
158 * series of bugs that have been termed 'Meltdown'. These exploits allow a user
159 * process to read kernel memory through cache side channels and speculative
160 * execution. To mitigate this on vulnerable CPUs, we need to use a technique
161 * called kernel page table isolation. What this requires is that we have two
162 * different page table roots. When executing in kernel mode, we will use a %cr3
163 * value that has both the user and kernel pages. However when executing in user
164 * mode, we will need to have a %cr3 that has all of the user pages; however,
165 * only a subset of the kernel pages required to operate.
166 *
167 * These kernel pages that we need mapped are:
168 *
169 * o Kernel Text that allows us to switch between the cr3 values.
170 * o The current global descriptor table (GDT)
171 * o The current interrupt descriptor table (IDT)
172 * o The current task switching state (TSS)
173 * o The current local descriptor table (LDT)
174 * o Stacks and scratch space used by the interrupt handlers
175 *
176 * For more information on the stack switching techniques, construction of the
177 * trampolines, and more, please see i86pc/ml/kpti_trampolines.s. The most
178 * important part of these mappings are the following two constraints:
179 *
180 * o The mappings are all per-CPU (except for read-only text)
181 * o The mappings are static. They are all established before the CPU is
182 * started (with the exception of the boot CPU).
183 *
184 * To facilitate the kernel page table isolation we employ our per-CPU
185 * page tables discussed in the previous section and add the notion of a per-CPU
186 * HAT. Fundamentally we have a second page table root. There is both a kernel
187 * page table (hci_pcp_l3ptes), and a user L3 page table (hci_user_l3ptes).
188 * Both will have the user page table entries copied into them, the same way
189 * that we discussed in the section 'Per-CPU Page Tables'.
190 *
191 * The complex part of this is how do we construct the set of kernel mappings
192 * that should be present when running with the user page table. To answer that,
193 * we add the notion of a per-CPU HAT. This HAT functions like a normal HAT,
194 * except that it's not really associated with an address space the same way
195 * that other HATs are.
196 *
197 * This HAT lives off of the 'struct hat_cpu_info' which is a member of the
198 * machcpu in the member hci_user_hat. We use this per-CPU HAT to create the set
199 * of kernel mappings that should be present on this CPU. The kernel mappings
200 * are added to the per-CPU HAT through the function hati_cpu_punchin(). Once a
201 * mapping has been punched in, it may not be punched out. The reason that we
202 * opt to leverage a HAT structure is that it knows how to allocate and manage
203 * all of the lower level page tables as required.
204 *
205 * Because all of the mappings are present at the beginning of time for this CPU
206 * and none of the mappings are in the kernel pageable segment, we don't have to
207 * worry about faulting on these HAT structures and thus the notion of the
208 * current HAT that we're using is always the appropriate HAT for the process
209 * (usually a user HAT or the kernel's HAT).
210 *
211 * A further constraint we place on the system with these per-CPU HATs is that
212 * they are not subject to htable_steal(). Because each CPU will have a rather
213 * fixed number of page tables, the same way that we don't steal from the
214 * kernel's HAT, it was determined that we should not steal from this HAT due to
215 * the complications involved and somewhat criminal nature of htable_steal().
216 *
217 * The per-CPU HAT is initialized in hat_pcp_setup() which is called as part of
218 * onlining the CPU, but before the CPU is actually started. The per-CPU HAT is
219 * removed in hat_pcp_teardown() which is called when a CPU is being offlined to
220 * be removed from the system (which is different from what psradm usually
221 * does).
222 *
223 * Finally, once the CPU has been onlined, the set of mappings in the per-CPU
224 * HAT must not change. The HAT related functions that we call are not meant to
225 * be called when we're switching between processes. For example, it is quite
226 * possible that if they were, they would try to grab an htable mutex which
227 * another thread might have. One needs to treat hat_switch() as though they
228 * were above LOCK_LEVEL and therefore _must not_ block under any circumstance.
229 */
230
231 #include <sys/machparam.h>
232 #include <sys/machsystm.h>
233 #include <sys/mman.h>
234 #include <sys/types.h>
235 #include <sys/systm.h>
236 #include <sys/cpuvar.h>
237 #include <sys/thread.h>
238 #include <sys/proc.h>
239 #include <sys/cpu.h>
240 #include <sys/kmem.h>
241 #include <sys/disp.h>
242 #include <sys/shm.h>
243 #include <sys/sysmacros.h>
244 #include <sys/machparam.h>
245 #include <sys/vmem.h>
246 #include <sys/vmsystm.h>
247 #include <sys/promif.h>
248 #include <sys/var.h>
249 #include <sys/x86_archext.h>
250 #include <sys/atomic.h>
264 #include <vm/seg_kpm.h>
265 #include <vm/vm_dep.h>
266 #ifdef __xpv
267 #include <sys/hypervisor.h>
268 #endif
269 #include <vm/kboot_mmu.h>
270 #include <vm/seg_spt.h>
271
272 #include <sys/cmn_err.h>
273
274 /*
275 * Basic parameters for hat operation.
276 */
277 struct hat_mmu_info mmu;
278
279 /*
280 * The page that is the kernel's top level pagetable.
281 *
282 * For 32 bit PAE support on i86pc, the kernel hat will use the 1st 4 entries
283 * on this 4K page for its top level page table. The remaining groups of
284 * 4 entries are used for per processor copies of user PCP pagetables for
285 * running threads. See hat_switch() and reload_pae32() for details.
286 *
287 * pcp_page[0..3] - level==2 PTEs for kernel HAT
288 * pcp_page[4..7] - level==2 PTEs for user thread on cpu 0
289 * pcp_page[8..11] - level==2 PTE for user thread on cpu 1
290 * etc...
291 *
292 * On the 64-bit kernel, this is the normal root of the page table and there is
293 * nothing special about it when used for other CPUs.
294 */
295 static x86pte_t *pcp_page;
296
297 /*
298 * forward declaration of internal utility routines
299 */
300 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected,
301 x86pte_t new);
302
303 /*
304 * The kernel address space exists in all non-HAT_COPIED HATs. To implement this
305 * the kernel reserves a fixed number of entries in the topmost level(s) of page
306 * tables. The values are setup during startup and then copied to every user hat
307 * created by hat_alloc(). This means that kernelbase must be:
308 *
309 * 4Meg aligned for 32 bit kernels
310 * 512Gig aligned for x86_64 64 bit kernel
311 *
312 * The hat_kernel_range_ts describe what needs to be copied from kernel hat
313 * to each user hat.
314 */
315 typedef struct hat_kernel_range {
316 level_t hkr_level;
317 uintptr_t hkr_start_va;
318 uintptr_t hkr_end_va; /* zero means to end of memory */
319 } hat_kernel_range_t;
320 #define NUM_KERNEL_RANGE 2
321 static hat_kernel_range_t kernel_ranges[NUM_KERNEL_RANGE];
322 static int num_kernel_ranges;
323
324 uint_t use_boot_reserve = 1; /* cleared after early boot process */
325 uint_t can_steal_post_boot = 0; /* set late in boot to enable stealing */
326
327 /*
342
343
344 #ifdef DEBUG
345 uint_t map1gcnt;
346 #endif
347
348
349 /*
350 * A cpuset for all cpus. This is used for kernel address cross calls, since
351 * the kernel addresses apply to all cpus.
352 */
353 cpuset_t khat_cpuset;
354
355 /*
356 * management stuff for hat structures
357 */
358 kmutex_t hat_list_lock;
359 kcondvar_t hat_list_cv;
360 kmem_cache_t *hat_cache;
361 kmem_cache_t *hat_hash_cache;
362 kmem_cache_t *hat32_hash_cache;
363
364 /*
365 * Simple statistics
366 */
367 struct hatstats hatstat;
368
369 /*
370 * Some earlier hypervisor versions do not emulate cmpxchg of PTEs
371 * correctly. For such hypervisors we must set PT_USER for kernel
372 * entries ourselves (normally the emulation would set PT_USER for
373 * kernel entries and PT_USER|PT_GLOBAL for user entries). pt_kern is
374 * thus set appropriately. Note that dboot/kbm is OK, as only the full
375 * HAT uses cmpxchg() and the other paths (hypercall etc.) were never
376 * incorrect.
377 */
378 int pt_kern;
379
380 #ifndef __xpv
381 extern pfn_t memseg_get_start(struct memseg *);
382 #endif
383
384 #define PP_GETRM(pp, rmmask) (pp->p_nrm & rmmask)
385 #define PP_ISMOD(pp) PP_GETRM(pp, P_MOD)
386 #define PP_ISREF(pp) PP_GETRM(pp, P_REF)
387 #define PP_ISRO(pp) PP_GETRM(pp, P_RO)
388
389 #define PP_SETRM(pp, rm) atomic_orb(&(pp->p_nrm), rm)
390 #define PP_SETMOD(pp) PP_SETRM(pp, P_MOD)
391 #define PP_SETREF(pp) PP_SETRM(pp, P_REF)
392 #define PP_SETRO(pp) PP_SETRM(pp, P_RO)
393
394 #define PP_CLRRM(pp, rm) atomic_andb(&(pp->p_nrm), ~(rm))
395 #define PP_CLRMOD(pp) PP_CLRRM(pp, P_MOD)
396 #define PP_CLRREF(pp) PP_CLRRM(pp, P_REF)
397 #define PP_CLRRO(pp) PP_CLRRM(pp, P_RO)
398 #define PP_CLRALL(pp) PP_CLRRM(pp, P_MOD | P_REF | P_RO)
399
402 */
403 /*ARGSUSED*/
404 static int
405 hati_constructor(void *buf, void *handle, int kmflags)
406 {
407 hat_t *hat = buf;
408
409 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
410 bzero(hat->hat_pages_mapped,
411 sizeof (pgcnt_t) * (mmu.max_page_level + 1));
412 hat->hat_ism_pgcnt = 0;
413 hat->hat_stats = 0;
414 hat->hat_flags = 0;
415 CPUSET_ZERO(hat->hat_cpus);
416 hat->hat_htable = NULL;
417 hat->hat_ht_hash = NULL;
418 return (0);
419 }
420
421 /*
422 * Put it at the start of the global list of all hats (used by stealing)
423 *
424 * kas.a_hat is not in the list but is instead used to find the
425 * first and last items in the list.
426 *
427 * - kas.a_hat->hat_next points to the start of the user hats.
428 * The list ends where hat->hat_next == NULL
429 *
430 * - kas.a_hat->hat_prev points to the last of the user hats.
431 * The list begins where hat->hat_prev == NULL
432 */
433 static void
434 hat_list_append(hat_t *hat)
435 {
436 mutex_enter(&hat_list_lock);
437 hat->hat_prev = NULL;
438 hat->hat_next = kas.a_hat->hat_next;
439 if (hat->hat_next)
440 hat->hat_next->hat_prev = hat;
441 else
442 kas.a_hat->hat_prev = hat;
443 kas.a_hat->hat_next = hat;
444 mutex_exit(&hat_list_lock);
445 }
446
447 /*
448 * Allocate a hat structure for as. We also create the top level
449 * htable and initialize it to contain the kernel hat entries.
450 */
451 hat_t *
452 hat_alloc(struct as *as)
453 {
454 hat_t *hat;
455 htable_t *ht; /* top level htable */
456 uint_t use_copied;
457 uint_t r;
458 hat_kernel_range_t *rp;
459 uintptr_t va;
460 uintptr_t eva;
461 uint_t start;
462 uint_t cnt;
463 htable_t *src;
464 boolean_t use_hat32_cache;
465
466 /*
467 * Once we start creating user process HATs we can enable
468 * the htable_steal() code.
469 */
470 if (can_steal_post_boot == 0)
471 can_steal_post_boot = 1;
472
473 ASSERT(AS_WRITE_HELD(as));
474 hat = kmem_cache_alloc(hat_cache, KM_SLEEP);
475 hat->hat_as = as;
476 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
477 ASSERT(hat->hat_flags == 0);
478
479 #if defined(__xpv)
480 /*
481 * No PCP stuff on the hypervisor due to the 64-bit split top level
482 * page tables. On 32-bit it's not needed as the hypervisor takes
483 * care of copying the top level PTEs to a below 4Gig page.
484 */
485 use_copied = 0;
486 use_hat32_cache = B_FALSE;
487 hat->hat_max_level = mmu.max_level;
488 hat->hat_num_copied = 0;
489 hat->hat_flags = 0;
490 #else /* __xpv */
491
492 /*
493 * All processes use HAT_COPIED on the 64-bit kernel if KPTI is
494 * turned on.
495 */
496 if (ttoproc(curthread)->p_model == DATAMODEL_ILP32) {
497 use_copied = 1;
498 hat->hat_max_level = mmu.max_level32;
499 hat->hat_num_copied = mmu.num_copied_ents32;
500 use_hat32_cache = B_TRUE;
501 hat->hat_flags |= HAT_COPIED_32;
502 HATSTAT_INC(hs_hat_copied32);
503 } else if (kpti_enable == 1) {
504 use_copied = 1;
505 hat->hat_max_level = mmu.max_level;
506 hat->hat_num_copied = mmu.num_copied_ents;
507 use_hat32_cache = B_FALSE;
508 HATSTAT_INC(hs_hat_copied64);
509 } else {
510 use_copied = 0;
511 use_hat32_cache = B_FALSE;
512 hat->hat_max_level = mmu.max_level;
513 hat->hat_num_copied = 0;
514 hat->hat_flags = 0;
515 HATSTAT_INC(hs_hat_normal64);
516 }
517 #endif /* __xpv */
518 if (use_copied) {
519 hat->hat_flags |= HAT_COPIED;
520 bzero(hat->hat_copied_ptes, sizeof (hat->hat_copied_ptes));
521 }
522
523 /*
524 * Allocate the htable hash. For 32-bit PCP processes we use the
525 * hat32_hash_cache. However, for 64-bit PCP processes we do not as the
526 * number of entries that they have to handle is closer to
527 * hat_hash_cache in count (though there will be more wastage when we
528 * have more DRAM in the system and thus push down the user address
529 * range).
530 */
531 if (use_hat32_cache) {
532 hat->hat_num_hash = mmu.hat32_hash_cnt;
533 hat->hat_ht_hash = kmem_cache_alloc(hat32_hash_cache, KM_SLEEP);
534 } else {
535 hat->hat_num_hash = mmu.hash_cnt;
536 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP);
537 }
538 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *));
539
540 /*
541 * Initialize Kernel HAT entries at the top of the top level page
542 * tables for the new hat.
543 */
544 hat->hat_htable = NULL;
545 hat->hat_ht_cached = NULL;
546 XPV_DISALLOW_MIGRATE();
547 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL);
548 hat->hat_htable = ht;
549
550 #if defined(__amd64)
551 if (hat->hat_flags & HAT_COPIED)
552 goto init_done;
553 #endif
554
555 for (r = 0; r < num_kernel_ranges; ++r) {
556 rp = &kernel_ranges[r];
557 for (va = rp->hkr_start_va; va != rp->hkr_end_va;
558 va += cnt * LEVEL_SIZE(rp->hkr_level)) {
559
560 if (rp->hkr_level == TOP_LEVEL(hat))
561 ht = hat->hat_htable;
562 else
563 ht = htable_create(hat, va, rp->hkr_level,
564 NULL);
565
566 start = htable_va2entry(va, ht);
567 cnt = HTABLE_NUM_PTES(ht) - start;
568 eva = va +
569 ((uintptr_t)cnt << LEVEL_SHIFT(rp->hkr_level));
570 if (rp->hkr_end_va != 0 &&
571 (eva > rp->hkr_end_va || eva == 0))
572 cnt = htable_va2entry(rp->hkr_end_va, ht) -
573 start;
574
575 #if defined(__i386) && !defined(__xpv)
576 if (ht->ht_flags & HTABLE_COPIED) {
577 bcopy(&pcp_page[start],
578 &hat->hat_copied_ptes[start],
579 cnt * sizeof (x86pte_t));
580 continue;
581 }
582 #endif
583 src = htable_lookup(kas.a_hat, va, rp->hkr_level);
584 ASSERT(src != NULL);
585 x86pte_copy(src, ht, start, cnt);
586 htable_release(src);
587 }
588 }
589
590 init_done:
591
592 #if defined(__xpv)
593 /*
594 * Pin top level page tables after initializing them
595 */
596 xen_pin(hat->hat_htable->ht_pfn, mmu.max_level);
597 #if defined(__amd64)
598 xen_pin(hat->hat_user_ptable, mmu.max_level);
599 #endif
600 #endif
601 XPV_ALLOW_MIGRATE();
602
603 hat_list_append(hat);
604
605 return (hat);
606 }
607
608 #if !defined(__xpv)
609 /*
610 * Cons up a HAT for a CPU. This represents the user mappings. This will have
611 * various kernel pages punched into it manually. Importantly, this hat is
612 * ineligible for stealing. We really don't want to deal with this ever
613 * faulting and figuring out that this is happening, much like we don't with
614 * kas.
615 */
616 static hat_t *
617 hat_cpu_alloc(cpu_t *cpu)
618 {
619 hat_t *hat;
620 htable_t *ht;
621
622 hat = kmem_cache_alloc(hat_cache, KM_SLEEP);
623 hat->hat_as = NULL;
624 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
625 hat->hat_max_level = mmu.max_level;
626 hat->hat_num_copied = 0;
627 hat->hat_flags = HAT_PCP;
628
629 hat->hat_num_hash = mmu.hash_cnt;
630 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP);
631 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *));
632
633 hat->hat_next = hat->hat_prev = NULL;
634
635 /*
636 * Because this HAT will only ever be used by the current CPU, we'll go
637 * ahead and set the CPUSET up to only point to the CPU in question.
638 */
639 CPUSET_ADD(hat->hat_cpus, cpu->cpu_id);
640
641 hat->hat_htable = NULL;
642 hat->hat_ht_cached = NULL;
643 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL);
644 hat->hat_htable = ht;
645
646 hat_list_append(hat);
647
648 return (hat);
649 }
650 #endif /* !__xpv */
651
652 /*
653 * process has finished executing but as has not been cleaned up yet.
654 */
655 /*ARGSUSED*/
656 void
657 hat_free_start(hat_t *hat)
658 {
659 ASSERT(AS_WRITE_HELD(hat->hat_as));
660
661 /*
662 * If the hat is currently a stealing victim, wait for the stealing
663 * to finish. Once we mark it as HAT_FREEING, htable_steal()
664 * won't look at its pagetables anymore.
665 */
666 mutex_enter(&hat_list_lock);
667 while (hat->hat_flags & HAT_VICTIM)
668 cv_wait(&hat_list_cv, &hat_list_lock);
669 hat->hat_flags |= HAT_FREEING;
670 mutex_exit(&hat_list_lock);
687
688 /*
689 * Remove it from the list of HATs
690 */
691 mutex_enter(&hat_list_lock);
692 if (hat->hat_prev)
693 hat->hat_prev->hat_next = hat->hat_next;
694 else
695 kas.a_hat->hat_next = hat->hat_next;
696 if (hat->hat_next)
697 hat->hat_next->hat_prev = hat->hat_prev;
698 else
699 kas.a_hat->hat_prev = hat->hat_prev;
700 mutex_exit(&hat_list_lock);
701 hat->hat_next = hat->hat_prev = NULL;
702
703 #if defined(__xpv)
704 /*
705 * On the hypervisor, unpin top level page table(s)
706 */
707 VERIFY3U(hat->hat_flags & HAT_PCP, ==, 0);
708 xen_unpin(hat->hat_htable->ht_pfn);
709 #if defined(__amd64)
710 xen_unpin(hat->hat_user_ptable);
711 #endif
712 #endif
713
714 /*
715 * Make a pass through the htables freeing them all up.
716 */
717 htable_purge_hat(hat);
718
719 /*
720 * Decide which kmem cache the hash table came from, then free it.
721 */
722 if (hat->hat_flags & HAT_COPIED) {
723 #if defined(__amd64)
724 if (hat->hat_flags & HAT_COPIED_32) {
725 cache = hat32_hash_cache;
726 } else {
727 cache = hat_hash_cache;
728 }
729 #else
730 cache = hat32_hash_cache;
731 #endif
732 } else {
733 cache = hat_hash_cache;
734 }
735 kmem_cache_free(cache, hat->hat_ht_hash);
736 hat->hat_ht_hash = NULL;
737
738 hat->hat_flags = 0;
739 hat->hat_max_level = 0;
740 hat->hat_num_copied = 0;
741 kmem_cache_free(hat_cache, hat);
742 }
743
744 /*
745 * round kernelbase down to a supported value to use for _userlimit
746 *
747 * userlimit must be aligned down to an entry in the top level htable.
748 * The one exception is for 32 bit HAT's running PAE.
749 */
750 uintptr_t
751 hat_kernelbase(uintptr_t va)
752 {
753 #if defined(__i386)
754 va &= LEVEL_MASK(1);
755 #endif
756 if (IN_VA_HOLE(va))
757 panic("_userlimit %p will fall in VA hole\n", (void *)va);
758 return (va);
759 }
760
775 cpuid_opteron_erratum(CPU, 6671130)) {
776 lvl = 1;
777 }
778 if (plat_mnode_xcheck(LEVEL_SIZE(2) >>
779 LEVEL_SHIFT(0))) {
780 lvl = 1;
781 }
782 } else {
783 lvl = 1;
784 }
785 }
786 mmu.max_page_level = lvl;
787
788 if ((lvl == 2) && (enable_1gpg == 0))
789 mmu.umax_page_level = 1;
790 else
791 mmu.umax_page_level = lvl;
792 }
793
794 /*
795 * Determine the number of slots that are in used in the top-most level page
796 * table for user memory. This is based on _userlimit. In effect this is similar
797 * to htable_va2entry, but without the convenience of having an htable.
798 */
799 void
800 mmu_calc_user_slots(void)
801 {
802 uint_t ent, nptes;
803 uintptr_t shift;
804
805 nptes = mmu.top_level_count;
806 shift = _userlimit >> mmu.level_shift[mmu.max_level];
807 ent = shift & (nptes - 1);
808
809 /*
810 * Ent tells us the slot that the page for _userlimit would fit in. We
811 * need to add one to this to cover the total number of entries.
812 */
813 mmu.top_level_uslots = ent + 1;
814
815 /*
816 * When running 32-bit compatability processes on a 64-bit kernel, we
817 * will only need to use one slot.
818 */
819 mmu.top_level_uslots32 = 1;
820
821 /*
822 * Record the number of PCP page table entries that we'll need to copy
823 * around. For 64-bit processes this is the number of user slots. For
824 * 32-bit proceses, this is 4 1 GiB pages.
825 */
826 mmu.num_copied_ents = mmu.top_level_uslots;
827 mmu.num_copied_ents32 = 4;
828 }
829
830 /*
831 * Initialize hat data structures based on processor MMU information.
832 */
833 void
834 mmu_init(void)
835 {
836 uint_t max_htables;
837 uint_t pa_bits;
838 uint_t va_bits;
839 int i;
840
841 /*
842 * If CPU enabled the page table global bit, use it for the kernel
843 * This is bit 7 in CR4 (PGE - Page Global Enable).
844 */
845 if (is_x86_feature(x86_featureset, X86FSET_PGE) &&
846 (getcr4() & CR4_PGE) != 0)
847 mmu.pt_global = PT_GLOBAL;
848
849 #if !defined(__xpv)
850 /*
851 * The 64-bit x86 kernel has split user/kernel page tables. As such we
852 * cannot have the global bit set. The simplest way for us to deal with
853 * this is to just say that pt_global is zero, so the global bit isn't
854 * present.
855 */
856 if (kpti_enable == 1)
857 mmu.pt_global = 0;
858 #endif
859
860 /*
861 * Detect NX and PAE usage.
862 */
863 mmu.pae_hat = kbm_pae_support;
864 if (kbm_nx_support)
865 mmu.pt_nx = PT_NX;
866 else
867 mmu.pt_nx = 0;
868
869 /*
870 * Use CPU info to set various MMU parameters
871 */
872 cpuid_get_addrsize(CPU, &pa_bits, &va_bits);
873
874 if (va_bits < sizeof (void *) * NBBY) {
875 mmu.hole_start = (1ul << (va_bits - 1));
876 mmu.hole_end = 0ul - mmu.hole_start - 1;
877 } else {
878 mmu.hole_end = 0;
879 mmu.hole_start = mmu.hole_end - 1;
880 }
898 mmu.pte_size = 8; /* 8 byte PTEs */
899 mmu.pte_size_shift = 3;
900 } else {
901 mmu.pte_size = 4; /* 4 byte PTEs */
902 mmu.pte_size_shift = 2;
903 }
904
905 if (mmu.pae_hat && !is_x86_feature(x86_featureset, X86FSET_PAE))
906 panic("Processor does not support PAE");
907
908 if (!is_x86_feature(x86_featureset, X86FSET_CX8))
909 panic("Processor does not support cmpxchg8b instruction");
910
911 #if defined(__amd64)
912
913 mmu.num_level = 4;
914 mmu.max_level = 3;
915 mmu.ptes_per_table = 512;
916 mmu.top_level_count = 512;
917
918 /*
919 * 32-bit processes only use 1 GB ptes.
920 */
921 mmu.max_level32 = 2;
922
923 mmu.level_shift[0] = 12;
924 mmu.level_shift[1] = 21;
925 mmu.level_shift[2] = 30;
926 mmu.level_shift[3] = 39;
927
928 #elif defined(__i386)
929
930 if (mmu.pae_hat) {
931 mmu.num_level = 3;
932 mmu.max_level = 2;
933 mmu.ptes_per_table = 512;
934 mmu.top_level_count = 4;
935
936 mmu.level_shift[0] = 12;
937 mmu.level_shift[1] = 21;
938 mmu.level_shift[2] = 30;
939
940 } else {
941 mmu.num_level = 2;
942 mmu.max_level = 1;
943 mmu.ptes_per_table = 1024;
944 mmu.top_level_count = 1024;
945
946 mmu.level_shift[0] = 12;
947 mmu.level_shift[1] = 22;
948 }
949
950 #endif /* __i386 */
951
952 for (i = 0; i < mmu.num_level; ++i) {
953 mmu.level_size[i] = 1UL << mmu.level_shift[i];
954 mmu.level_offset[i] = mmu.level_size[i] - 1;
955 mmu.level_mask[i] = ~mmu.level_offset[i];
956 }
957
958 set_max_page_level();
959 mmu_calc_user_slots();
960
961 mmu_page_sizes = mmu.max_page_level + 1;
962 mmu_exported_page_sizes = mmu.umax_page_level + 1;
963
964 /* restrict legacy applications from using pagesizes 1g and above */
965 mmu_legacy_page_sizes =
966 (mmu_exported_page_sizes > 2) ? 2 : mmu_exported_page_sizes;
967
968
969 for (i = 0; i <= mmu.max_page_level; ++i) {
970 mmu.pte_bits[i] = PT_VALID | pt_kern;
971 if (i > 0)
972 mmu.pte_bits[i] |= PT_PAGESIZE;
973 }
974
975 /*
976 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level.
977 */
978 for (i = 1; i < mmu.num_level; ++i)
979 mmu.ptp_bits[i] = PT_PTPBITS;
980
981 #if defined(__i386)
982 mmu.ptp_bits[2] = PT_VALID;
983 #endif
984
985 /*
986 * Compute how many hash table entries to have per process for htables.
987 * We start with 1 page's worth of entries.
988 *
989 * If physical memory is small, reduce the amount need to cover it.
990 */
991 max_htables = physmax / mmu.ptes_per_table;
992 mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *);
993 while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables)
994 mmu.hash_cnt >>= 1;
995 mmu.hat32_hash_cnt = mmu.hash_cnt;
996
997 #if defined(__amd64)
998 /*
999 * If running in 64 bits and physical memory is large,
1000 * increase the size of the cache to cover all of memory for
1001 * a 64 bit process.
1002 */
1003 #define HASH_MAX_LENGTH 4
1004 while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables)
1005 mmu.hash_cnt <<= 1;
1006 #endif
1007 }
1008
1009
1010 /*
1011 * initialize hat data structures
1012 */
1013 void
1014 hat_init()
1015 {
1024 }
1025 #endif
1026
1027 cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL);
1028
1029 /*
1030 * initialize kmem caches
1031 */
1032 htable_init();
1033 hment_init();
1034
1035 hat_cache = kmem_cache_create("hat_t",
1036 sizeof (hat_t), 0, hati_constructor, NULL, NULL,
1037 NULL, 0, 0);
1038
1039 hat_hash_cache = kmem_cache_create("HatHash",
1040 mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL,
1041 NULL, 0, 0);
1042
1043 /*
1044 * 32-bit PCP hats can use a smaller hash table size on large memory
1045 * machines
1046 */
1047 if (mmu.hash_cnt == mmu.hat32_hash_cnt) {
1048 hat32_hash_cache = hat_hash_cache;
1049 } else {
1050 hat32_hash_cache = kmem_cache_create("Hat32Hash",
1051 mmu.hat32_hash_cnt * sizeof (htable_t *), 0, NULL, NULL,
1052 NULL, NULL, 0, 0);
1053 }
1054
1055 /*
1056 * Set up the kernel's hat
1057 */
1058 AS_LOCK_ENTER(&kas, RW_WRITER);
1059 kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP);
1060 mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL);
1061 kas.a_hat->hat_as = &kas;
1062 kas.a_hat->hat_flags = 0;
1063 AS_LOCK_EXIT(&kas);
1064
1065 CPUSET_ZERO(khat_cpuset);
1066 CPUSET_ADD(khat_cpuset, CPU->cpu_id);
1067
1068 /*
1069 * The kernel HAT doesn't use PCP regardless of architectures.
1070 */
1071 ASSERT3U(mmu.max_level, >, 0);
1072 kas.a_hat->hat_max_level = mmu.max_level;
1073 kas.a_hat->hat_num_copied = 0;
1074
1075 /*
1076 * The kernel hat's next pointer serves as the head of the hat list .
1077 * The kernel hat's prev pointer tracks the last hat on the list for
1078 * htable_steal() to use.
1079 */
1080 kas.a_hat->hat_next = NULL;
1081 kas.a_hat->hat_prev = NULL;
1082
1083 /*
1084 * Allocate an htable hash bucket for the kernel
1085 * XX64 - tune for 64 bit procs
1086 */
1087 kas.a_hat->hat_num_hash = mmu.hash_cnt;
1088 kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP);
1089 bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *));
1090
1091 /*
1092 * zero out the top level and cached htable pointers
1093 */
1094 kas.a_hat->hat_ht_cached = NULL;
1095 kas.a_hat->hat_htable = NULL;
1096
1097 /*
1098 * Pre-allocate hrm_hashtab before enabling the collection of
1099 * refmod statistics. Allocating on the fly would mean us
1100 * running the risk of suffering recursive mutex enters or
1101 * deadlocks.
1102 */
1103 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1104 KM_SLEEP);
1105 }
1106
1107
1108 extern void kpti_tramp_start();
1109 extern void kpti_tramp_end();
1110
1111 extern void kdi_isr_start();
1112 extern void kdi_isr_end();
1113
1114 extern gate_desc_t kdi_idt[NIDT];
1115
1116 /*
1117 * Prepare per-CPU pagetables for all processes on the 64 bit kernel.
1118 *
1119 * Each CPU has a set of 2 pagetables that are reused for any 32 bit
1120 * process it runs. They are the top level pagetable, hci_pcp_l3ptes, and
1121 * the next to top level table for the bottom 512 Gig, hci_pcp_l2ptes.
1122 */
1123 /*ARGSUSED*/
1124 static void
1125 hat_pcp_setup(struct cpu *cpu)
1126 {
1127 #if !defined(__xpv)
1128 struct hat_cpu_info *hci = cpu->cpu_hat_info;
1129 uintptr_t va;
1130 size_t len;
1131
1132 /*
1133 * allocate the level==2 page table for the bottom most
1134 * 512Gig of address space (this is where 32 bit apps live)
1135 */
1136 ASSERT(hci != NULL);
1137 hci->hci_pcp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
1138
1139 /*
1140 * Allocate a top level pagetable and copy the kernel's
1141 * entries into it. Then link in hci_pcp_l2ptes in the 1st entry.
1142 */
1143 hci->hci_pcp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP);
1144 hci->hci_pcp_l3pfn =
1145 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_pcp_l3ptes);
1146 ASSERT3U(hci->hci_pcp_l3pfn, !=, PFN_INVALID);
1147 bcopy(pcp_page, hci->hci_pcp_l3ptes, MMU_PAGESIZE);
1148
1149 hci->hci_pcp_l2pfn =
1150 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_pcp_l2ptes);
1151 ASSERT3U(hci->hci_pcp_l2pfn, !=, PFN_INVALID);
1152
1153 /*
1154 * Now go through and allocate the user version of these structures.
1155 * Unlike with the kernel version, we allocate a hat to represent the
1156 * top-level page table as that will make it much simpler when we need
1157 * to patch through user entries.
1158 */
1159 hci->hci_user_hat = hat_cpu_alloc(cpu);
1160 hci->hci_user_l3pfn = hci->hci_user_hat->hat_htable->ht_pfn;
1161 ASSERT3U(hci->hci_user_l3pfn, !=, PFN_INVALID);
1162 hci->hci_user_l3ptes =
1163 (x86pte_t *)hat_kpm_mapin_pfn(hci->hci_user_l3pfn);
1164
1165 /* Skip the rest of this if KPTI is switched off at boot. */
1166 if (kpti_enable != 1)
1167 return;
1168
1169 /*
1170 * OK, now that we have this we need to go through and punch the normal
1171 * holes in the CPU's hat for this. At this point we'll punch in the
1172 * following:
1173 *
1174 * o GDT
1175 * o IDT
1176 * o LDT
1177 * o Trampoline Code
1178 * o machcpu KPTI page
1179 * o kmdb ISR code page (just trampolines)
1180 *
1181 * If this is cpu0, then we also can initialize the following because
1182 * they'll have already been allocated.
1183 *
1184 * o TSS for CPU 0
1185 * o Double Fault for CPU 0
1186 *
1187 * The following items have yet to be allocated and have not been
1188 * punched in yet. They will be punched in later:
1189 *
1190 * o TSS (mach_cpucontext_alloc_tables())
1191 * o Double Fault Stack (mach_cpucontext_alloc_tables())
1192 */
1193 hati_cpu_punchin(cpu, (uintptr_t)cpu->cpu_gdt, PROT_READ);
1194 hati_cpu_punchin(cpu, (uintptr_t)cpu->cpu_idt, PROT_READ);
1195
1196 /*
1197 * As the KDI IDT is only active during kmdb sessions (including single
1198 * stepping), typically we don't actually need this punched in (we
1199 * consider the routines that switch to the user cr3 to be toxic). But
1200 * if we ever accidentally end up on the user cr3 while on this IDT,
1201 * we'd prefer not to triple fault.
1202 */
1203 hati_cpu_punchin(cpu, (uintptr_t)&kdi_idt, PROT_READ);
1204
1205 CTASSERT(((uintptr_t)&kpti_tramp_start % MMU_PAGESIZE) == 0);
1206 CTASSERT(((uintptr_t)&kpti_tramp_end % MMU_PAGESIZE) == 0);
1207 for (va = (uintptr_t)&kpti_tramp_start;
1208 va < (uintptr_t)&kpti_tramp_end; va += MMU_PAGESIZE) {
1209 hati_cpu_punchin(cpu, va, PROT_READ | PROT_EXEC);
1210 }
1211
1212 VERIFY3U(((uintptr_t)cpu->cpu_m.mcpu_ldt) % MMU_PAGESIZE, ==, 0);
1213 for (va = (uintptr_t)cpu->cpu_m.mcpu_ldt, len = LDT_CPU_SIZE;
1214 len >= MMU_PAGESIZE; va += MMU_PAGESIZE, len -= MMU_PAGESIZE) {
1215 hati_cpu_punchin(cpu, va, PROT_READ);
1216 }
1217
1218 /* mcpu_pad2 is the start of the page containing the kpti_frames. */
1219 hati_cpu_punchin(cpu, (uintptr_t)&cpu->cpu_m.mcpu_pad2[0],
1220 PROT_READ | PROT_WRITE);
1221
1222 if (cpu == &cpus[0]) {
1223 /*
1224 * CPU0 uses a global for its double fault stack to deal with
1225 * the chicken and egg problem. We need to punch it into its
1226 * user HAT.
1227 */
1228 extern char dblfault_stack0[];
1229
1230 hati_cpu_punchin(cpu, (uintptr_t)cpu->cpu_m.mcpu_tss,
1231 PROT_READ);
1232
1233 for (va = (uintptr_t)dblfault_stack0,
1234 len = DEFAULTSTKSZ; len >= MMU_PAGESIZE;
1235 va += MMU_PAGESIZE, len -= MMU_PAGESIZE) {
1236 hati_cpu_punchin(cpu, va, PROT_READ | PROT_WRITE);
1237 }
1238 }
1239
1240 CTASSERT(((uintptr_t)&kdi_isr_start % MMU_PAGESIZE) == 0);
1241 CTASSERT(((uintptr_t)&kdi_isr_end % MMU_PAGESIZE) == 0);
1242 for (va = (uintptr_t)&kdi_isr_start;
1243 va < (uintptr_t)&kdi_isr_end; va += MMU_PAGESIZE) {
1244 hati_cpu_punchin(cpu, va, PROT_READ | PROT_EXEC);
1245 }
1246 #endif /* !__xpv */
1247 }
1248
1249 /*ARGSUSED*/
1250 static void
1251 hat_pcp_teardown(cpu_t *cpu)
1252 {
1253 #if !defined(__xpv)
1254 struct hat_cpu_info *hci;
1255
1256 if ((hci = cpu->cpu_hat_info) == NULL)
1257 return;
1258 if (hci->hci_pcp_l2ptes != NULL)
1259 kmem_free(hci->hci_pcp_l2ptes, MMU_PAGESIZE);
1260 if (hci->hci_pcp_l3ptes != NULL)
1261 kmem_free(hci->hci_pcp_l3ptes, MMU_PAGESIZE);
1262 if (hci->hci_user_hat != NULL) {
1263 hat_free_start(hci->hci_user_hat);
1264 hat_free_end(hci->hci_user_hat);
1265 }
1266 #endif
1267 }
1268
1269 #define NEXT_HKR(r, l, s, e) { \
1270 kernel_ranges[r].hkr_level = l; \
1271 kernel_ranges[r].hkr_start_va = s; \
1272 kernel_ranges[r].hkr_end_va = e; \
1273 ++r; \
1274 }
1275
1276 /*
1277 * Finish filling in the kernel hat.
1278 * Pre fill in all top level kernel page table entries for the kernel's
1279 * part of the address range. From this point on we can't use any new
1280 * kernel large pages if they need PTE's at max_level
1281 *
1282 * create the kmap mappings.
1283 */
1284 void
1285 hat_init_finish(void)
1341
1342 if (IN_HYPERVISOR_VA(va))
1343 continue;
1344
1345 /* can/must skip if a page mapping already exists */
1346 if (rp->hkr_level <= mmu.max_page_level &&
1347 (ht = htable_getpage(kas.a_hat, va, NULL)) !=
1348 NULL) {
1349 htable_release(ht);
1350 continue;
1351 }
1352
1353 (void) htable_create(kas.a_hat, va, rp->hkr_level - 1,
1354 NULL);
1355 }
1356 }
1357
1358 /*
1359 * 32 bit PAE metal kernels use only 4 of the 512 entries in the
1360 * page holding the top level pagetable. We use the remainder for
1361 * the "per CPU" page tables for PCP processes.
1362 * Map the top level kernel pagetable into the kernel to make
1363 * it easy to use bcopy access these tables.
1364 *
1365 * PAE is required for the 64-bit kernel which uses this as well to
1366 * perform the per-CPU pagetables. See the big theory statement.
1367 */
1368 if (mmu.pae_hat) {
1369 pcp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP);
1370 hat_devload(kas.a_hat, (caddr_t)pcp_page, MMU_PAGESIZE,
1371 kas.a_hat->hat_htable->ht_pfn,
1372 #if !defined(__xpv)
1373 PROT_WRITE |
1374 #endif
1375 PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK,
1376 HAT_LOAD | HAT_LOAD_NOCONSIST);
1377 }
1378 hat_pcp_setup(CPU);
1379
1380 /*
1381 * Create kmap (cached mappings of kernel PTEs)
1382 * for 32 bit we map from segmap_start .. ekernelheap
1383 * for 64 bit we map from segmap_start .. segmap_start + segmapsize;
1384 */
1385 #if defined(__i386)
1386 size = (uintptr_t)ekernelheap - segmap_start;
1387 #elif defined(__amd64)
1388 size = segmapsize;
1389 #endif
1390 hat_kmap_init((uintptr_t)segmap_start, size);
1391
1392 #if !defined(__xpv)
1393 ASSERT3U(kas.a_hat->hat_htable->ht_pfn, !=, PFN_INVALID);
1394 ASSERT3U(kpti_safe_cr3, ==,
1395 MAKECR3(kas.a_hat->hat_htable->ht_pfn, PCID_KERNEL));
1396 #endif
1397 }
1398
1399 /*
1400 * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references
1401 * are 32 bit, so for safety we must use atomic_cas_64() to install these.
1402 */
1403 #ifdef __i386
1404 static void
1405 reload_pae32(hat_t *hat, cpu_t *cpu)
1406 {
1407 x86pte_t *src;
1408 x86pte_t *dest;
1409 x86pte_t pte;
1410 int i;
1411
1412 /*
1413 * Load the 4 entries of the level 2 page table into this
1414 * cpu's range of the pcp_page and point cr3 at them.
1415 */
1416 ASSERT(mmu.pae_hat);
1417 src = hat->hat_copied_ptes;
1418 dest = pcp_page + (cpu->cpu_id + 1) * MAX_COPIED_PTES;
1419 for (i = 0; i < MAX_COPIED_PTES; ++i) {
1420 for (;;) {
1421 pte = dest[i];
1422 if (pte == src[i])
1423 break;
1424 if (atomic_cas_64(dest + i, pte, src[i]) != src[i])
1425 break;
1426 }
1427 }
1428 }
1429 #endif
1430
1431 /*
1432 * Update the PCP data on the CPU cpu to the one on the hat. If this is a 32-bit
1433 * process, then we must update the L2 pages and then the L3. If this is a
1434 * 64-bit process then we must update the L3 entries.
1435 */
1436 static void
1437 hat_pcp_update(cpu_t *cpu, const hat_t *hat)
1438 {
1439 ASSERT3U(hat->hat_flags & HAT_COPIED, !=, 0);
1440
1441 if ((hat->hat_flags & HAT_COPIED_32) != 0) {
1442 const x86pte_t *l2src;
1443 x86pte_t *l2dst, *l3ptes, *l3uptes;
1444 /*
1445 * This is a 32-bit process. To set this up, we need to do the
1446 * following:
1447 *
1448 * - Copy the 4 L2 PTEs into the dedicated L2 table
1449 * - Zero the user L3 PTEs in the user and kernel page table
1450 * - Set the first L3 PTE to point to the CPU L2 table
1451 */
1452 l2src = hat->hat_copied_ptes;
1453 l2dst = cpu->cpu_hat_info->hci_pcp_l2ptes;
1454 l3ptes = cpu->cpu_hat_info->hci_pcp_l3ptes;
1455 l3uptes = cpu->cpu_hat_info->hci_user_l3ptes;
1456
1457 l2dst[0] = l2src[0];
1458 l2dst[1] = l2src[1];
1459 l2dst[2] = l2src[2];
1460 l2dst[3] = l2src[3];
1461
1462 /*
1463 * Make sure to use the mmu to get the number of slots. The
1464 * number of PLP entries that this has will always be less as
1465 * it's a 32-bit process.
1466 */
1467 bzero(l3ptes, sizeof (x86pte_t) * mmu.top_level_uslots);
1468 l3ptes[0] = MAKEPTP(cpu->cpu_hat_info->hci_pcp_l2pfn, 2);
1469 bzero(l3uptes, sizeof (x86pte_t) * mmu.top_level_uslots);
1470 l3uptes[0] = MAKEPTP(cpu->cpu_hat_info->hci_pcp_l2pfn, 2);
1471 } else {
1472 /*
1473 * This is a 64-bit process. To set this up, we need to do the
1474 * following:
1475 *
1476 * - Zero the 4 L2 PTEs in the CPU structure for safety
1477 * - Copy over the new user L3 PTEs into the kernel page table
1478 * - Copy over the new user L3 PTEs into the user page table
1479 */
1480 ASSERT3S(kpti_enable, ==, 1);
1481 bzero(cpu->cpu_hat_info->hci_pcp_l2ptes, sizeof (x86pte_t) * 4);
1482 bcopy(hat->hat_copied_ptes, cpu->cpu_hat_info->hci_pcp_l3ptes,
1483 sizeof (x86pte_t) * mmu.top_level_uslots);
1484 bcopy(hat->hat_copied_ptes, cpu->cpu_hat_info->hci_user_l3ptes,
1485 sizeof (x86pte_t) * mmu.top_level_uslots);
1486 }
1487 }
1488
1489 static void
1490 reset_kpti(struct kpti_frame *fr, uint64_t kcr3, uint64_t ucr3)
1491 {
1492 ASSERT3U(fr->kf_tr_flag, ==, 0);
1493 #if DEBUG
1494 if (fr->kf_kernel_cr3 != 0) {
1495 ASSERT3U(fr->kf_lower_redzone, ==, 0xdeadbeefdeadbeef);
1496 ASSERT3U(fr->kf_middle_redzone, ==, 0xdeadbeefdeadbeef);
1497 ASSERT3U(fr->kf_upper_redzone, ==, 0xdeadbeefdeadbeef);
1498 }
1499 #endif
1500
1501 bzero(fr, offsetof(struct kpti_frame, kf_kernel_cr3));
1502 bzero(&fr->kf_unused, sizeof (struct kpti_frame) -
1503 offsetof(struct kpti_frame, kf_unused));
1504
1505 fr->kf_kernel_cr3 = kcr3;
1506 fr->kf_user_cr3 = ucr3;
1507 fr->kf_tr_ret_rsp = (uintptr_t)&fr->kf_tr_rsp;
1508
1509 fr->kf_lower_redzone = 0xdeadbeefdeadbeef;
1510 fr->kf_middle_redzone = 0xdeadbeefdeadbeef;
1511 fr->kf_upper_redzone = 0xdeadbeefdeadbeef;
1512 }
1513
1514 #ifdef __xpv
1515 static void
1516 hat_switch_xen(hat_t *hat)
1517 {
1518 struct mmuext_op t[2];
1519 uint_t retcnt;
1520 uint_t opcnt = 1;
1521 uint64_t newcr3;
1522
1523 ASSERT(!(hat->hat_flags & HAT_COPIED));
1524 ASSERT(!(getcr4() & CR4_PCIDE));
1525
1526 newcr3 = MAKECR3((uint64_t)hat->hat_htable->ht_pfn, PCID_NONE);
1527
1528 t[0].cmd = MMUEXT_NEW_BASEPTR;
1529 t[0].arg1.mfn = mmu_btop(pa_to_ma(newcr3));
1530
1531 /*
1532 * There's an interesting problem here, as to what to actually specify
1533 * when switching to the kernel hat. For now we'll reuse the kernel hat
1534 * again.
1535 */
1536 t[1].cmd = MMUEXT_NEW_USER_BASEPTR;
1537 if (hat == kas.a_hat)
1538 t[1].arg1.mfn = mmu_btop(pa_to_ma(newcr3));
1539 else
1540 t[1].arg1.mfn = pfn_to_mfn(hat->hat_user_ptable);
1541 ++opcnt;
1542
1543 if (HYPERVISOR_mmuext_op(t, opcnt, &retcnt, DOMID_SELF) < 0)
1544 panic("HYPERVISOR_mmu_update() failed");
1545 ASSERT(retcnt == opcnt);
1546 }
1547 #endif /* __xpv */
1548
1549 /*
1550 * Switch to a new active hat, maintaining bit masks to track active CPUs.
1551 *
1552 * With KPTI, all our HATs except kas should be using PCP. Thus, to switch
1553 * HATs, we need to copy over the new user PTEs, then set our trampoline context
1554 * as appropriate.
1555 *
1556 * If lacking PCID, we then load our new cr3, which will flush the TLB: we may
1557 * have established userspace TLB entries via kernel accesses, and these are no
1558 * longer valid. We have to do this eagerly, as we just deleted this CPU from
1559 * ->hat_cpus, so would no longer see any TLB shootdowns.
1560 *
1561 * With PCID enabled, things get a little more complicated. We would like to
1562 * keep TLB context around when entering and exiting the kernel, and to do this,
1563 * we partition the TLB into two different spaces:
1564 *
1565 * PCID_KERNEL is defined as zero, and used both by kas and all other address
1566 * spaces while in the kernel (post-trampoline).
1567 *
1568 * PCID_USER is used while in userspace. Therefore, userspace cannot use any
1569 * lingering PCID_KERNEL entries to kernel addresses it should not be able to
1570 * read.
1571 *
1572 * The trampoline cr3s are set not to invalidate on a mov to %cr3. This means if
1573 * we take a journey through the kernel without switching HATs, we have some
1574 * hope of keeping our TLB state around.
1575 *
1576 * On a hat switch, rather than deal with any necessary flushes on the way out
1577 * of the trampolines, we do them upfront here. If we're switching from kas, we
1578 * shouldn't need any invalidation.
1579 *
1580 * Otherwise, we can have stale userspace entries for both PCID_USER (what
1581 * happened before we move onto the kcr3) and PCID_KERNEL (any subsequent
1582 * userspace accesses such as ddi_copyin()). Since setcr3() won't do these
1583 * flushes on its own in PCIDE, we'll do a non-flushing load and then
1584 * invalidate everything.
1585 */
1586 void
1587 hat_switch(hat_t *hat)
1588 {
1589 cpu_t *cpu = CPU;
1590 hat_t *old = cpu->cpu_current_hat;
1591
1592 /*
1593 * set up this information first, so we don't miss any cross calls
1594 */
1595 if (old != NULL) {
1596 if (old == hat)
1597 return;
1598 if (old != kas.a_hat)
1599 CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id);
1600 }
1601
1602 /*
1603 * Add this CPU to the active set for this HAT.
1604 */
1605 if (hat != kas.a_hat) {
1606 CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id);
1607 }
1608 cpu->cpu_current_hat = hat;
1609
1610 #if defined(__xpv)
1611 hat_switch_xen(hat);
1612 #else
1613 struct hat_cpu_info *info = cpu->cpu_m.mcpu_hat_info;
1614 uint64_t pcide = getcr4() & CR4_PCIDE;
1615 uint64_t kcr3, ucr3;
1616 pfn_t tl_kpfn;
1617 ulong_t flag;
1618
1619 EQUIV(kpti_enable, !mmu.pt_global);
1620
1621 if (hat->hat_flags & HAT_COPIED) {
1622 hat_pcp_update(cpu, hat);
1623 tl_kpfn = info->hci_pcp_l3pfn;
1624 } else {
1625 IMPLY(kpti_enable, hat == kas.a_hat);
1626 tl_kpfn = hat->hat_htable->ht_pfn;
1627 }
1628
1629 if (pcide) {
1630 ASSERT(kpti_enable);
1631
1632 kcr3 = MAKECR3(tl_kpfn, PCID_KERNEL) | CR3_NOINVL_BIT;
1633 ucr3 = MAKECR3(info->hci_user_l3pfn, PCID_USER) |
1634 CR3_NOINVL_BIT;
1635
1636 setcr3(kcr3);
1637 if (old != kas.a_hat)
1638 mmu_flush_tlb(FLUSH_TLB_ALL, NULL);
1639 } else {
1640 kcr3 = MAKECR3(tl_kpfn, PCID_NONE);
1641 ucr3 = kpti_enable ?
1642 MAKECR3(info->hci_user_l3pfn, PCID_NONE) :
1643 0;
1644
1645 setcr3(kcr3);
1646 }
1647
1648 /*
1649 * We will already be taking shootdowns for our new HAT, and as KPTI
1650 * invpcid emulation needs to use kf_user_cr3, make sure we don't get
1651 * any cross calls while we're inconsistent. Note that it's harmless to
1652 * have a *stale* kf_user_cr3 (we just did a FLUSH_TLB_ALL), but a
1653 * *zero* kf_user_cr3 is not going to go very well.
1654 */
1655 if (pcide)
1656 flag = intr_clear();
1657
1658 reset_kpti(&cpu->cpu_m.mcpu_kpti, kcr3, ucr3);
1659 reset_kpti(&cpu->cpu_m.mcpu_kpti_flt, kcr3, ucr3);
1660 reset_kpti(&cpu->cpu_m.mcpu_kpti_dbg, kcr3, ucr3);
1661
1662 if (pcide)
1663 intr_restore(flag);
1664
1665 #endif /* !__xpv */
1666
1667 ASSERT(cpu == CPU);
1668 }
1669
1670 /*
1671 * Utility to return a valid x86pte_t from protections, pfn, and level number
1672 */
1673 static x86pte_t
1674 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags)
1675 {
1676 x86pte_t pte;
1677 uint_t cache_attr = attr & HAT_ORDER_MASK;
1678
1679 pte = MAKEPTE(pfn, level);
1680
1681 if (attr & PROT_WRITE)
1682 PTE_SET(pte, PT_WRITABLE);
1683
1684 if (attr & PROT_USER)
1685 PTE_SET(pte, PT_USER);
1686
1958 goto done;
1959 }
1960
1961 /*
1962 * If the mapping didn't change there is nothing more to do.
1963 */
1964 if (PTE_EQUIV(pte, old_pte))
1965 goto done;
1966
1967 /*
1968 * Install a new mapping in the page's mapping list
1969 */
1970 if (!PTE_ISVALID(old_pte)) {
1971 if (is_consist) {
1972 hment_assign(ht, entry, pp, hm);
1973 x86_hm_exit(pp);
1974 } else {
1975 ASSERT(flags & HAT_LOAD_NOCONSIST);
1976 }
1977 #if defined(__amd64)
1978 if (ht->ht_flags & HTABLE_COPIED) {
1979 cpu_t *cpu = CPU;
1980 hat_pcp_update(cpu, hat);
1981 }
1982 #endif
1983 HTABLE_INC(ht->ht_valid_cnt);
1984 PGCNT_INC(hat, l);
1985 return (rv);
1986 }
1987
1988 /*
1989 * Remap's are more complicated:
1990 * - HAT_LOAD_REMAP must be specified if changing the pfn.
1991 * We also require that NOCONSIST be specified.
1992 * - Otherwise only permission or caching bits may change.
1993 */
1994 if (!PTE_ISPAGE(old_pte, l))
1995 panic("non-null/page mapping pte=" FMT_PTE, old_pte);
1996
1997 if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) {
1998 REMAPASSERT(flags & HAT_LOAD_REMAP);
1999 REMAPASSERT(flags & HAT_LOAD_NOCONSIST);
2000 REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST);
2032 hat_t *hat,
2033 uintptr_t va,
2034 page_t *pp,
2035 uint_t attr,
2036 uint_t flags,
2037 level_t level,
2038 pfn_t pfn)
2039 {
2040 htable_t *ht;
2041 uint_t entry;
2042 x86pte_t pte;
2043 int rv = 0;
2044
2045 /*
2046 * The number 16 is arbitrary and here to catch a recursion problem
2047 * early before we blow out the kernel stack.
2048 */
2049 ++curthread->t_hatdepth;
2050 ASSERT(curthread->t_hatdepth < 16);
2051
2052 ASSERT(hat == kas.a_hat || (hat->hat_flags & HAT_PCP) != 0 ||
2053 AS_LOCK_HELD(hat->hat_as));
2054
2055 if (flags & HAT_LOAD_SHARE)
2056 hat->hat_flags |= HAT_SHARED;
2057
2058 /*
2059 * Find the page table that maps this page if it already exists.
2060 */
2061 ht = htable_lookup(hat, va, level);
2062
2063 /*
2064 * We must have HAT_LOAD_NOCONSIST if page_t is NULL.
2065 */
2066 if (pp == NULL)
2067 flags |= HAT_LOAD_NOCONSIST;
2068
2069 if (ht == NULL) {
2070 ht = htable_create(hat, va, level, NULL);
2071 ASSERT(ht != NULL);
2072 }
2073 /*
2074 * htable_va2entry checks this condition as well, but it won't include
2075 * much useful info in the panic. So we do it in advance here to include
2076 * all the context.
2077 */
2078 if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht)) {
2079 panic("hati_load_common: bad htable: va=%p, last page=%p, "
2080 "ht->ht_vaddr=%p, ht->ht_level=%d", (void *)va,
2081 (void *)HTABLE_LAST_PAGE(ht), (void *)ht->ht_vaddr,
2082 (int)ht->ht_level);
2083 }
2084 entry = htable_va2entry(va, ht);
2085
2086 /*
2087 * a bunch of paranoid error checking
2088 */
2089 ASSERT(ht->ht_busy > 0);
2090 ASSERT(ht->ht_level == level);
2091
2092 /*
2093 * construct the new PTE
2094 */
2095 if (hat == kas.a_hat)
2096 attr &= ~PROT_USER;
2097 pte = hati_mkpte(pfn, attr, level, flags);
2098 if (hat == kas.a_hat && va >= kernelbase)
2099 PTE_SET(pte, mmu.pt_global);
2100
2101 /*
2102 * establish the mapping
2103 */
2104 rv = hati_pte_map(ht, entry, pp, pte, flags, NULL);
2105
2106 /*
2107 * release the htable and any reserves
2108 */
2109 htable_release(ht);
2519 "htable=%p, vaddr=%p\n", (void *)ht, (void *)vaddr);
2520 HTABLE_LOCK_DEC(ht);
2521
2522 vaddr += LEVEL_SIZE(ht->ht_level);
2523 }
2524 if (ht)
2525 htable_release(ht);
2526 XPV_ALLOW_MIGRATE();
2527 }
2528
2529 /* ARGSUSED */
2530 void
2531 hat_unlock_region(struct hat *hat, caddr_t addr, size_t len,
2532 hat_region_cookie_t rcookie)
2533 {
2534 panic("No shared region support on x86");
2535 }
2536
2537 #if !defined(__xpv)
2538 /*
2539 * Cross call service routine to demap a range of virtual
2540 * pages on the current CPU or flush all mappings in TLB.
2541 */
2542 static int
2543 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3)
2544 {
2545 _NOTE(ARGUNUSED(a3));
2546 hat_t *hat = (hat_t *)a1;
2547 tlb_range_t *range = (tlb_range_t *)a2;
2548
2549 /*
2550 * If the target hat isn't the kernel and this CPU isn't operating
2551 * in the target hat, we can ignore the cross call.
2552 */
2553 if (hat != kas.a_hat && hat != CPU->cpu_current_hat)
2554 return (0);
2555
2556 if (range->tr_va != DEMAP_ALL_ADDR) {
2557 mmu_flush_tlb(FLUSH_TLB_RANGE, range);
2558 return (0);
2559 }
2560
2561 /*
2562 * We are flushing all of userspace.
2563 *
2564 * When using PCP, we first need to update this CPU's idea of the PCP
2565 * PTEs.
2566 */
2567 if (hat->hat_flags & HAT_COPIED) {
2568 #if defined(__amd64)
2569 hat_pcp_update(CPU, hat);
2570 #elif defined(__i386)
2571 reload_pae32(hat, CPU);
2572 #endif
2573 }
2574
2575 mmu_flush_tlb(FLUSH_TLB_NONGLOBAL, NULL);
2576 return (0);
2577 }
2578
2579 #define TLBIDLE_CPU_HALTED (0x1UL)
2580 #define TLBIDLE_INVAL_ALL (0x2UL)
2581 #define CAS_TLB_INFO(cpu, old, new) \
2582 atomic_cas_ulong((ulong_t *)&(cpu)->cpu_m.mcpu_tlb_info, (old), (new))
2583
2584 /*
2585 * Record that a CPU is going idle
2586 */
2587 void
2588 tlb_going_idle(void)
2589 {
2590 atomic_or_ulong((ulong_t *)&CPU->cpu_m.mcpu_tlb_info,
2591 TLBIDLE_CPU_HALTED);
2592 }
2593
2594 /*
2595 * Service a delayed TLB flush if coming out of being idle.
2596 * It will be called from cpu idle notification with interrupt disabled.
2597 */
2598 void
2599 tlb_service(void)
2600 {
2601 ulong_t tlb_info;
2602 ulong_t found;
2603
2604 /*
2605 * We only have to do something if coming out of being idle.
2606 */
2607 tlb_info = CPU->cpu_m.mcpu_tlb_info;
2608 if (tlb_info & TLBIDLE_CPU_HALTED) {
2609 ASSERT(CPU->cpu_current_hat == kas.a_hat);
2610
2611 /*
2612 * Atomic clear and fetch of old state.
2613 */
2614 while ((found = CAS_TLB_INFO(CPU, tlb_info, 0)) != tlb_info) {
2615 ASSERT(found & TLBIDLE_CPU_HALTED);
2616 tlb_info = found;
2617 SMT_PAUSE();
2618 }
2619 if (tlb_info & TLBIDLE_INVAL_ALL)
2620 mmu_flush_tlb(FLUSH_TLB_ALL, NULL);
2621 }
2622 }
2623 #endif /* !__xpv */
2624
2625 /*
2626 * Internal routine to do cross calls to invalidate a range of pages on
2627 * all CPUs using a given hat.
2628 */
2629 void
2630 hat_tlb_inval_range(hat_t *hat, tlb_range_t *in_range)
2631 {
2632 extern int flushes_require_xcalls; /* from mp_startup.c */
2633 cpuset_t justme;
2634 cpuset_t cpus_to_shootdown;
2635 tlb_range_t range = *in_range;
2636 #ifndef __xpv
2637 cpuset_t check_cpus;
2638 cpu_t *cpup;
2639 int c;
2640 #endif
2641
2642 /*
2643 * If the hat is being destroyed, there are no more users, so
2644 * demap need not do anything.
2645 */
2646 if (hat->hat_flags & HAT_FREEING)
2647 return;
2648
2649 /*
2650 * If demapping from a shared pagetable, we best demap the
2651 * entire set of user TLBs, since we don't know what addresses
2652 * these were shared at.
2653 */
2654 if (hat->hat_flags & HAT_SHARED) {
2655 hat = kas.a_hat;
2656 range.tr_va = DEMAP_ALL_ADDR;
2657 }
2658
2659 /*
2660 * if not running with multiple CPUs, don't use cross calls
2661 */
2662 if (panicstr || !flushes_require_xcalls) {
2663 #ifdef __xpv
2664 if (range.tr_va == DEMAP_ALL_ADDR) {
2665 xen_flush_tlb();
2666 } else {
2667 for (size_t i = 0; i < TLB_RANGE_LEN(&range);
2668 i += MMU_PAGESIZE) {
2669 xen_flush_va((caddr_t)(range.tr_va + i));
2670 }
2671 }
2672 #else
2673 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)&range, 0);
2674 #endif
2675 return;
2676 }
2677
2678
2679 /*
2680 * Determine CPUs to shootdown. Kernel changes always do all CPUs.
2681 * Otherwise it's just CPUs currently executing in this hat.
2682 */
2683 kpreempt_disable();
2684 CPUSET_ONLY(justme, CPU->cpu_id);
2685 if (hat == kas.a_hat)
2686 cpus_to_shootdown = khat_cpuset;
2687 else
2688 cpus_to_shootdown = hat->hat_cpus;
2689
2690 #ifndef __xpv
2691 /*
2692 * If any CPUs in the set are idle, just request a delayed flush
2693 * and avoid waking them up.
2694 */
2695 check_cpus = cpus_to_shootdown;
2696 for (c = 0; c < NCPU && !CPUSET_ISNULL(check_cpus); ++c) {
2697 ulong_t tlb_info;
2698
2699 if (!CPU_IN_SET(check_cpus, c))
2700 continue;
2701 CPUSET_DEL(check_cpus, c);
2702 cpup = cpu[c];
2703 if (cpup == NULL)
2704 continue;
2705
2706 tlb_info = cpup->cpu_m.mcpu_tlb_info;
2707 while (tlb_info == TLBIDLE_CPU_HALTED) {
2708 (void) CAS_TLB_INFO(cpup, TLBIDLE_CPU_HALTED,
2709 TLBIDLE_CPU_HALTED | TLBIDLE_INVAL_ALL);
2710 SMT_PAUSE();
2711 tlb_info = cpup->cpu_m.mcpu_tlb_info;
2712 }
2713 if (tlb_info == (TLBIDLE_CPU_HALTED | TLBIDLE_INVAL_ALL)) {
2714 HATSTAT_INC(hs_tlb_inval_delayed);
2715 CPUSET_DEL(cpus_to_shootdown, c);
2716 }
2717 }
2718 #endif
2719
2720 if (CPUSET_ISNULL(cpus_to_shootdown) ||
2721 CPUSET_ISEQUAL(cpus_to_shootdown, justme)) {
2722
2723 #ifdef __xpv
2724 if (range.tr_va == DEMAP_ALL_ADDR) {
2725 xen_flush_tlb();
2726 } else {
2727 for (size_t i = 0; i < TLB_RANGE_LEN(&range);
2728 i += MMU_PAGESIZE) {
2729 xen_flush_va((caddr_t)(range.tr_va + i));
2730 }
2731 }
2732 #else
2733 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)&range, 0);
2734 #endif
2735
2736 } else {
2737
2738 CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id);
2739 #ifdef __xpv
2740 if (range.tr_va == DEMAP_ALL_ADDR) {
2741 xen_gflush_tlb(cpus_to_shootdown);
2742 } else {
2743 for (size_t i = 0; i < TLB_RANGE_LEN(&range);
2744 i += MMU_PAGESIZE) {
2745 xen_gflush_va((caddr_t)(range.tr_va + i),
2746 cpus_to_shootdown);
2747 }
2748 }
2749 #else
2750 xc_call((xc_arg_t)hat, (xc_arg_t)&range, 0,
2751 CPUSET2BV(cpus_to_shootdown), hati_demap_func);
2752 #endif
2753
2754 }
2755 kpreempt_enable();
2756 }
2757
2758 void
2759 hat_tlb_inval(hat_t *hat, uintptr_t va)
2760 {
2761 /*
2762 * Create range for a single page.
2763 */
2764 tlb_range_t range;
2765 range.tr_va = va;
2766 range.tr_cnt = 1; /* one page */
2767 range.tr_level = MIN_PAGE_LEVEL; /* pages are MMU_PAGESIZE */
2768
2769 hat_tlb_inval_range(hat, &range);
2770 }
2771
2772 /*
2773 * Interior routine for HAT_UNLOADs from hat_unload_callback(),
2774 * hat_kmap_unload() OR from hat_steal() code. This routine doesn't
2775 * handle releasing of the htables.
2776 */
2777 void
2778 hat_pte_unmap(
2779 htable_t *ht,
2780 uint_t entry,
2781 uint_t flags,
2782 x86pte_t old_pte,
2783 void *pte_ptr,
2784 boolean_t tlb)
2785 {
2786 hat_t *hat = ht->ht_hat;
2787 hment_t *hm = NULL;
2788 page_t *pp = NULL;
2789 level_t l = ht->ht_level;
2916 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
2917 {
2918 uintptr_t va = (uintptr_t)addr;
2919
2920 XPV_DISALLOW_MIGRATE();
2921 ASSERT(hat == kas.a_hat || va + len <= _userlimit);
2922
2923 /*
2924 * special case for performance.
2925 */
2926 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) {
2927 ASSERT(hat == kas.a_hat);
2928 hat_kmap_unload(addr, len, flags);
2929 } else {
2930 hat_unload_callback(hat, addr, len, flags, NULL);
2931 }
2932 XPV_ALLOW_MIGRATE();
2933 }
2934
2935 /*
2936 * Invalidate the TLB, and perform the callback to the upper level VM system,
2937 * for the specified ranges of contiguous pages.
2938 */
2939 static void
2940 handle_ranges(hat_t *hat, hat_callback_t *cb, uint_t cnt, tlb_range_t *range)
2941 {
2942 while (cnt > 0) {
2943 --cnt;
2944 hat_tlb_inval_range(hat, &range[cnt]);
2945
2946 if (cb != NULL) {
2947 cb->hcb_start_addr = (caddr_t)range[cnt].tr_va;
2948 cb->hcb_end_addr = cb->hcb_start_addr;
2949 cb->hcb_end_addr += range[cnt].tr_cnt <<
2950 LEVEL_SHIFT(range[cnt].tr_level);
2951 cb->hcb_function(cb);
2952 }
2953 }
2954 }
2955
2956 /*
2957 * Unload a given range of addresses (has optional callback)
2958 *
2959 * Flags:
2960 * define HAT_UNLOAD 0x00
2961 * define HAT_UNLOAD_NOSYNC 0x02
2962 * define HAT_UNLOAD_UNLOCK 0x04
2963 * define HAT_UNLOAD_OTHER 0x08 - not used
2964 * define HAT_UNLOAD_UNMAP 0x10 - same as HAT_UNLOAD
2965 */
2966 #define MAX_UNLOAD_CNT (8)
2967 void
2968 hat_unload_callback(
2969 hat_t *hat,
2970 caddr_t addr,
2971 size_t len,
2972 uint_t flags,
2973 hat_callback_t *cb)
2974 {
2975 uintptr_t vaddr = (uintptr_t)addr;
2976 uintptr_t eaddr = vaddr + len;
2977 htable_t *ht = NULL;
2978 uint_t entry;
2979 uintptr_t contig_va = (uintptr_t)-1L;
2980 tlb_range_t r[MAX_UNLOAD_CNT];
2981 uint_t r_cnt = 0;
2982 x86pte_t old_pte;
2983
2984 XPV_DISALLOW_MIGRATE();
2985 ASSERT(hat == kas.a_hat || eaddr <= _userlimit);
2986 ASSERT(IS_PAGEALIGNED(vaddr));
2987 ASSERT(IS_PAGEALIGNED(eaddr));
2988
2989 /*
2990 * Special case a single page being unloaded for speed. This happens
2991 * quite frequently, COW faults after a fork() for example.
2992 */
2993 if (cb == NULL && len == MMU_PAGESIZE) {
2994 ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0);
2995 if (ht != NULL) {
2996 if (PTE_ISVALID(old_pte)) {
2997 hat_pte_unmap(ht, entry, flags, old_pte,
2998 NULL, B_TRUE);
2999 }
3000 htable_release(ht);
3001 }
3002 XPV_ALLOW_MIGRATE();
3003 return;
3004 }
3005
3006 while (vaddr < eaddr) {
3007 old_pte = htable_walk(hat, &ht, &vaddr, eaddr);
3008 if (ht == NULL)
3009 break;
3010
3011 ASSERT(!IN_VA_HOLE(vaddr));
3012
3013 if (vaddr < (uintptr_t)addr)
3014 panic("hat_unload_callback(): unmap inside large page");
3015
3016 /*
3017 * We'll do the call backs for contiguous ranges
3018 */
3019 if (vaddr != contig_va ||
3020 (r_cnt > 0 && r[r_cnt - 1].tr_level != ht->ht_level)) {
3021 if (r_cnt == MAX_UNLOAD_CNT) {
3022 handle_ranges(hat, cb, r_cnt, r);
3023 r_cnt = 0;
3024 }
3025 r[r_cnt].tr_va = vaddr;
3026 r[r_cnt].tr_cnt = 0;
3027 r[r_cnt].tr_level = ht->ht_level;
3028 ++r_cnt;
3029 }
3030
3031 /*
3032 * Unload one mapping (for a single page) from the page tables.
3033 * Note that we do not remove the mapping from the TLB yet,
3034 * as indicated by the tlb=FALSE argument to hat_pte_unmap().
3035 * handle_ranges() will clear the TLB entries with one call to
3036 * hat_tlb_inval_range() per contiguous range. This is
3037 * safe because the page can not be reused until the
3038 * callback is made (or we return).
3039 */
3040 entry = htable_va2entry(vaddr, ht);
3041 hat_pte_unmap(ht, entry, flags, old_pte, NULL, B_FALSE);
3042 ASSERT(ht->ht_level <= mmu.max_page_level);
3043 vaddr += LEVEL_SIZE(ht->ht_level);
3044 contig_va = vaddr;
3045 ++r[r_cnt - 1].tr_cnt;
3046 }
3047 if (ht)
3048 htable_release(ht);
3049
3050 /*
3051 * handle last range for callbacks
3052 */
3053 if (r_cnt > 0)
3054 handle_ranges(hat, cb, r_cnt, r);
3055 XPV_ALLOW_MIGRATE();
3056 }
3057
3058 /*
3059 * Invalidate a virtual address translation on a slave CPU during
3060 * panic() dumps.
3061 */
3062 void
3063 hat_flush_range(hat_t *hat, caddr_t va, size_t size)
3064 {
3065 ssize_t sz;
3066 caddr_t endva = va + size;
3067
3068 while (va < endva) {
3069 sz = hat_getpagesize(hat, va);
3070 if (sz < 0) {
3071 #ifdef __xpv
3072 xen_flush_tlb();
3073 #else
3074 mmu_flush_tlb(FLUSH_TLB_ALL, NULL);
3075 #endif
3076 break;
3077 }
3078 #ifdef __xpv
3079 xen_flush_va(va);
3080 #else
3081 mmu_flush_tlb_kpage((uintptr_t)va);
3082 #endif
3083 va += sz;
3084 }
3085 }
3086
3087 /*
3088 * synchronize mapping with software data structures
3089 *
3090 * This interface is currently only used by the working set monitor
3091 * driver.
3092 */
3093 /*ARGSUSED*/
3094 void
3095 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags)
3096 {
3097 uintptr_t vaddr = (uintptr_t)addr;
3098 uintptr_t eaddr = vaddr + len;
3099 htable_t *ht = NULL;
3100 uint_t entry;
3101 x86pte_t pte;
3727 */
3728 ht = htable_lookup(hat, vaddr, l);
3729 if (ht == NULL)
3730 continue;
3731 if (ht->ht_flags & HTABLE_SHARED_PFN) {
3732 /*
3733 * clear page count, set valid_cnt to 0,
3734 * let htable_release() finish the job
3735 */
3736 hat->hat_ism_pgcnt -= ht->ht_valid_cnt <<
3737 (LEVEL_SHIFT(ht->ht_level) - MMU_PAGESHIFT);
3738 ht->ht_valid_cnt = 0;
3739 need_demaps = 1;
3740 }
3741 htable_release(ht);
3742 }
3743 }
3744
3745 /*
3746 * flush the TLBs - since we're probably dealing with MANY mappings
3747 * we just do a full invalidation.
3748 */
3749 if (!(hat->hat_flags & HAT_FREEING) && need_demaps)
3750 hat_tlb_inval(hat, DEMAP_ALL_ADDR);
3751
3752 /*
3753 * Now go back and clean up any unaligned mappings that
3754 * couldn't share pagetables.
3755 */
3756 if (!is_it_dism(hat, addr))
3757 flags |= HAT_UNLOAD_UNLOCK;
3758 hat_unload(hat, addr, len, flags);
3759 XPV_ALLOW_MIGRATE();
3760 }
3761
3762
3763 /*
3764 * hat_reserve() does nothing
3765 */
3766 /*ARGSUSED*/
3767 void
4510 htable_t *ht;
4511
4512 XPV_DISALLOW_MIGRATE();
4513 /*
4514 * invalidate any left over mapping and decrement the htable valid count
4515 */
4516 #ifdef __xpv
4517 if (HYPERVISOR_update_va_mapping((uintptr_t)addr, 0,
4518 UVMF_INVLPG | UVMF_LOCAL))
4519 panic("HYPERVISOR_update_va_mapping() failed");
4520 #else
4521 {
4522 x86pte_t *pteptr;
4523
4524 pteptr = x86pte_mapin(mmu_btop(pte_pa),
4525 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
4526 if (mmu.pae_hat)
4527 *pteptr = 0;
4528 else
4529 *(x86pte32_t *)pteptr = 0;
4530 mmu_flush_tlb_kpage((uintptr_t)addr);
4531 x86pte_mapout();
4532 }
4533 #endif
4534
4535 ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0);
4536 if (ht == NULL)
4537 panic("hat_mempte_release(): invalid address");
4538 ASSERT(ht->ht_level == 0);
4539 HTABLE_DEC(ht->ht_valid_cnt);
4540 htable_release(ht);
4541 XPV_ALLOW_MIGRATE();
4542 }
4543
4544 /*
4545 * Apply a temporary CPU private mapping to a page. We flush the TLB only
4546 * on this CPU, so this ought to have been called with preemption disabled.
4547 */
4548 void
4549 hat_mempte_remap(
4550 pfn_t pfn,
4571 ASSERT(ht->ht_level == 0);
4572 ASSERT(ht->ht_valid_cnt > 0);
4573 ASSERT(ht->ht_pfn == mmu_btop(pte_pa));
4574 htable_release(ht);
4575 #endif
4576 XPV_DISALLOW_MIGRATE();
4577 pte = hati_mkpte(pfn, attr, 0, flags);
4578 #ifdef __xpv
4579 if (HYPERVISOR_update_va_mapping(va, pte, UVMF_INVLPG | UVMF_LOCAL))
4580 panic("HYPERVISOR_update_va_mapping() failed");
4581 #else
4582 {
4583 x86pte_t *pteptr;
4584
4585 pteptr = x86pte_mapin(mmu_btop(pte_pa),
4586 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL);
4587 if (mmu.pae_hat)
4588 *(x86pte_t *)pteptr = pte;
4589 else
4590 *(x86pte32_t *)pteptr = (x86pte32_t)pte;
4591 mmu_flush_tlb_kpage((uintptr_t)addr);
4592 x86pte_mapout();
4593 }
4594 #endif
4595 XPV_ALLOW_MIGRATE();
4596 }
4597
4598
4599
4600 /*
4601 * Hat locking functions
4602 * XXX - these two functions are currently being used by hatstats
4603 * they can be removed by using a per-as mutex for hatstats.
4604 */
4605 void
4606 hat_enter(hat_t *hat)
4607 {
4608 mutex_enter(&hat->hat_mutex);
4609 }
4610
4611 void
4612 hat_exit(hat_t *hat)
4613 {
4614 mutex_exit(&hat->hat_mutex);
4615 }
4616
4617 /*
4618 * HAT part of cpu initialization.
4619 */
4620 void
4621 hat_cpu_online(struct cpu *cpup)
4622 {
4623 if (cpup != CPU) {
4624 x86pte_cpu_init(cpup);
4625 hat_pcp_setup(cpup);
4626 }
4627 CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id);
4628 }
4629
4630 /*
4631 * HAT part of cpu deletion.
4632 * (currently, we only call this after the cpu is safely passivated.)
4633 */
4634 void
4635 hat_cpu_offline(struct cpu *cpup)
4636 {
4637 ASSERT(cpup != CPU);
4638
4639 CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id);
4640 hat_pcp_teardown(cpup);
4641 x86pte_cpu_fini(cpup);
4642 }
4643
4644 /*
4645 * Function called after all CPUs are brought online.
4646 * Used to remove low address boot mappings.
4647 */
4648 void
4649 clear_boot_mappings(uintptr_t low, uintptr_t high)
4650 {
4651 uintptr_t vaddr = low;
4652 htable_t *ht = NULL;
4653 level_t level;
4654 uint_t entry;
4655 x86pte_t pte;
4656
4657 /*
4658 * On 1st CPU we can unload the prom mappings, basically we blow away
4659 * all virtual mappings under _userlimit.
4660 */
5067 *pte_ma = base_ma + (entry << mmu.pte_size_shift);
5068 }
5069 XPV_ALLOW_MIGRATE();
5070 }
5071
5072 void
5073 hat_release_mapping(hat_t *hat, caddr_t addr)
5074 {
5075 htable_t *ht;
5076
5077 ASSERT(IS_P2ALIGNED((uintptr_t)addr, MMU_PAGESIZE));
5078 XPV_DISALLOW_MIGRATE();
5079 ht = htable_lookup(hat, (uintptr_t)addr, 0);
5080 ASSERT(ht != NULL);
5081 ASSERT(ht->ht_busy >= 2);
5082 htable_release(ht);
5083 htable_release(ht);
5084 XPV_ALLOW_MIGRATE();
5085 }
5086 #endif /* __xpv */
5087
5088 /*
5089 * Helper function to punch in a mapping that we need with the specified
5090 * attributes.
5091 */
5092 void
5093 hati_cpu_punchin(cpu_t *cpu, uintptr_t va, uint_t attrs)
5094 {
5095 int ret;
5096 pfn_t pfn;
5097 hat_t *cpu_hat = cpu->cpu_hat_info->hci_user_hat;
5098
5099 ASSERT3S(kpti_enable, ==, 1);
5100 ASSERT3P(cpu_hat, !=, NULL);
5101 ASSERT3U(cpu_hat->hat_flags & HAT_PCP, ==, HAT_PCP);
5102 ASSERT3U(va & MMU_PAGEOFFSET, ==, 0);
5103
5104 pfn = hat_getpfnum(kas.a_hat, (caddr_t)va);
5105 VERIFY3U(pfn, !=, PFN_INVALID);
5106
5107 /*
5108 * We purposefully don't try to find the page_t. This means that this
5109 * will be marked PT_NOCONSIST; however, given that this is pretty much
5110 * a static mapping that we're using we should be relatively OK.
5111 */
5112 attrs |= HAT_STORECACHING_OK;
5113 ret = hati_load_common(cpu_hat, va, NULL, attrs, 0, 0, pfn);
5114 VERIFY3S(ret, ==, 0);
5115 }
|