xref: /illumos-gate/usr/src/uts/i86pc/os/fastboot.c (revision 635216b673cf196ac523ff2a7ab715717e553292)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * This file contains the functions for performing Fast Reboot -- a
29  * reboot which bypasses the firmware and bootloader, considerably
30  * reducing downtime.
31  *
32  * fastboot_load_kernel(): This function is invoked by mdpreboot() in the
33  * reboot path.  It loads the new kernel and boot archive into memory, builds
34  * the data structure containing sufficient information about the new
35  * kernel and boot archive to be passed to the fast reboot switcher
36  * (see fb_swtch_src.s for details).  When invoked the switcher relocates
37  * the new kernel and boot archive to physically contiguous low memory,
38  * similar to where the boot loader would have loaded them, and jumps to
39  * the new kernel.
40  *
41  * If fastreboot_onpanic is enabled, fastboot_load_kernel() is called
42  * by fastreboot_post_startup() to load the back up kernel in case of
43  * panic.
44  *
45  * The physical addresses of the memory allocated for the new kernel, boot
46  * archive and their page tables must be above where the boot archive ends
47  * after it has been relocated by the switcher, otherwise the new files
48  * and their page tables could be overridden during relocation.
49  *
50  * fast_reboot(): This function is invoked by mdboot() once it's determined
51  * that the system is capable of fast reboot.  It jumps to the fast reboot
52  * switcher with the data structure built by fastboot_load_kernel() as the
53  * argument.
54  */
55 
56 #include <sys/types.h>
57 #include <sys/param.h>
58 #include <sys/segments.h>
59 #include <sys/sysmacros.h>
60 #include <sys/vm.h>
61 
62 #include <sys/proc.h>
63 #include <sys/buf.h>
64 #include <sys/kmem.h>
65 
66 #include <sys/reboot.h>
67 #include <sys/uadmin.h>
68 
69 #include <sys/cred.h>
70 #include <sys/vnode.h>
71 #include <sys/file.h>
72 
73 #include <sys/cmn_err.h>
74 #include <sys/dumphdr.h>
75 #include <sys/bootconf.h>
76 #include <sys/ddidmareq.h>
77 #include <sys/varargs.h>
78 #include <sys/promif.h>
79 #include <sys/modctl.h>
80 
81 #include <vm/hat.h>
82 #include <vm/as.h>
83 #include <vm/page.h>
84 #include <vm/seg.h>
85 #include <vm/hat_i86.h>
86 #include <sys/vm_machparam.h>
87 #include <sys/archsystm.h>
88 #include <sys/machsystm.h>
89 #include <sys/mman.h>
90 #include <sys/x86_archext.h>
91 #include <sys/smp_impldefs.h>
92 #include <sys/spl.h>
93 
94 #include <sys/fastboot.h>
95 #include <sys/machelf.h>
96 #include <sys/kobj.h>
97 #include <sys/multiboot.h>
98 #include <sys/kobj_lex.h>
99 
100 /*
101  * Macro to determine how many pages are needed for PTEs to map a particular
102  * file.  Allocate one extra page table entry for terminating the list.
103  */
104 #define	FASTBOOT_PTE_LIST_SIZE(fsize)	\
105 	P2ROUNDUP((((fsize) >> PAGESHIFT) + 1) * sizeof (x86pte_t), PAGESIZE)
106 
107 /*
108  * Data structure containing necessary information for the fast reboot
109  * switcher to jump to the new kernel.
110  */
111 fastboot_info_t newkernel = { 0 };
112 char		fastboot_args[OBP_MAXPATHLEN];
113 
114 static char fastboot_filename[2][OBP_MAXPATHLEN] = { { 0 }, { 0 }};
115 static x86pte_t ptp_bits = PT_VALID | PT_REF | PT_USER | PT_WRITABLE;
116 static x86pte_t pte_bits =
117     PT_VALID | PT_REF | PT_MOD | PT_NOCONSIST | PT_WRITABLE;
118 static uint_t fastboot_shift_amt_pae[] = {12, 21, 30, 39};
119 
120 int fastboot_debug = 0;
121 int fastboot_contig = 0;
122 
123 /*
124  * Fake starting va for new kernel and boot archive.
125  */
126 static uintptr_t fake_va = FASTBOOT_FAKE_VA;
127 
128 /*
129  * Reserve memory below PA 1G in preparation of fast reboot.
130  *
131  * This variable is only checked when fastreboot_capable is set, but
132  * fastreboot_onpanic is not set.  The amount of memory reserved
133  * is negligible, but just in case we are really short of low memory,
134  * this variable will give us a backdoor to not consume memory at all.
135  */
136 int reserve_mem_enabled = 1;
137 
138 /*
139  * Mutex to protect fastreboot_onpanic.
140  */
141 kmutex_t fastreboot_config_mutex;
142 
143 /*
144  * Amount of memory below PA 1G to reserve for constructing the multiboot
145  * data structure and the page tables as we tend to run out of those
146  * when more drivers are loaded.
147  */
148 static size_t fastboot_mbi_size = 0x2000;	/* 8K */
149 static size_t fastboot_pagetable_size = 0x5000;	/* 20K */
150 
151 /*
152  * Use below 1G for page tables as
153  *	1. we are only doing 1:1 mapping of the bottom 1G of physical memory.
154  *	2. we are using 2G as the fake virtual address for the new kernel and
155  *	boot archive.
156  */
157 static ddi_dma_attr_t fastboot_below_1G_dma_attr = {
158 	DMA_ATTR_V0,
159 	0x0000000008000000ULL,	/* dma_attr_addr_lo: 128MB */
160 	0x000000003FFFFFFFULL,	/* dma_attr_addr_hi: 1G */
161 	0x00000000FFFFFFFFULL,	/* dma_attr_count_max */
162 	0x0000000000001000ULL,	/* dma_attr_align: 4KB */
163 	1,			/* dma_attr_burstsize */
164 	1,			/* dma_attr_minxfer */
165 	0x00000000FFFFFFFFULL,	/* dma_attr_maxxfer */
166 	0x00000000FFFFFFFFULL,	/* dma_attr_seg */
167 	1,			/* dma_attr_sgllen */
168 	0x1000ULL,		/* dma_attr_granular */
169 	0,			/* dma_attr_flags */
170 };
171 
172 static ddi_dma_attr_t fastboot_dma_attr = {
173 	DMA_ATTR_V0,
174 	0x0000000008000000ULL,	/* dma_attr_addr_lo: 128MB */
175 #ifdef	__amd64
176 	0xFFFFFFFFFFFFFFFFULL,	/* dma_attr_addr_hi: 2^64B */
177 #else
178 	0x0000000FFFFFFFFFULL,	/* dma_attr_addr_hi: 64GB */
179 #endif	/* __amd64 */
180 	0x00000000FFFFFFFFULL,	/* dma_attr_count_max */
181 	0x0000000000001000ULL,	/* dma_attr_align: 4KB */
182 	1,			/* dma_attr_burstsize */
183 	1,			/* dma_attr_minxfer */
184 	0x00000000FFFFFFFFULL,	/* dma_attr_maxxfer */
185 	0x00000000FFFFFFFFULL,	/* dma_attr_seg */
186 	1,			/* dma_attr_sgllen */
187 	0x1000ULL,		/* dma_attr_granular */
188 	0,			/* dma_attr_flags */
189 };
190 
191 /*
192  * Various information saved from the previous boot to reconstruct
193  * multiboot_info.
194  */
195 extern multiboot_info_t saved_mbi;
196 extern mb_memory_map_t saved_mmap[FASTBOOT_SAVED_MMAP_COUNT];
197 extern uint8_t saved_drives[FASTBOOT_SAVED_DRIVES_SIZE];
198 extern char saved_cmdline[FASTBOOT_SAVED_CMDLINE_LEN];
199 extern int saved_cmdline_len;
200 extern size_t saved_file_size[];
201 
202 extern void* contig_alloc(size_t size, ddi_dma_attr_t *attr,
203     uintptr_t align, int cansleep);
204 extern void contig_free(void *addr, size_t size);
205 
206 
207 /* PRINTLIKE */
208 extern void vprintf(const char *, va_list);
209 
210 
211 /*
212  * Need to be able to get boot_archives from other places
213  */
214 #define	BOOTARCHIVE64	"/platform/i86pc/amd64/boot_archive"
215 #define	BOOTARCHIVE32	"/platform/i86pc/boot_archive"
216 #define	BOOTARCHIVE32_FAILSAFE	"/boot/x86.miniroot-safe"
217 #define	BOOTARCHIVE64_FAILSAFE	"/boot/amd64/x86.miniroot-safe"
218 #define	FAILSAFE_BOOTFILE32	"/boot/platform/i86pc/kernel/unix"
219 #define	FAILSAFE_BOOTFILE64	"/boot/platform/i86pc/kernel/amd64/unix"
220 
221 static uint_t fastboot_vatoindex(fastboot_info_t *, uintptr_t, int);
222 static void fastboot_map_with_size(fastboot_info_t *, uintptr_t,
223     paddr_t, size_t, int);
224 static void fastboot_build_pagetables(fastboot_info_t *);
225 static int fastboot_build_mbi(char *, fastboot_info_t *);
226 static void fastboot_free_file(fastboot_file_t *);
227 
228 static const char fastboot_enomem_msg[] = "Fastboot: Couldn't allocate 0x%"
229 	PRIx64" bytes below %s to do fast reboot";
230 
231 static void
232 dprintf(char *fmt, ...)
233 {
234 	va_list adx;
235 
236 	if (!fastboot_debug)
237 		return;
238 
239 	va_start(adx, fmt);
240 	vprintf(fmt, adx);
241 	va_end(adx);
242 }
243 
244 
245 /*
246  * Return the index corresponding to a virt address at a given page table level.
247  */
248 static uint_t
249 fastboot_vatoindex(fastboot_info_t *nk, uintptr_t va, int level)
250 {
251 	return ((va >> nk->fi_shift_amt[level]) & (nk->fi_ptes_per_table - 1));
252 }
253 
254 
255 /*
256  * Add mapping from vstart to pstart for the specified size.
257  * vstart, pstart and size should all have been aligned at 2M boundaries.
258  */
259 static void
260 fastboot_map_with_size(fastboot_info_t *nk, uintptr_t vstart, paddr_t pstart,
261     size_t size, int level)
262 {
263 	x86pte_t	pteval, *table;
264 	uintptr_t	vaddr;
265 	paddr_t		paddr;
266 	int		index, l;
267 
268 	table = (x86pte_t *)(nk->fi_pagetable_va);
269 
270 	for (l = nk->fi_top_level; l >= level; l--) {
271 
272 		index = fastboot_vatoindex(nk, vstart, l);
273 
274 		if (l == level) {
275 			/*
276 			 * Last level.  Program the page table entries.
277 			 */
278 			for (vaddr = vstart, paddr = pstart;
279 			    vaddr < vstart + size;
280 			    vaddr += (1ULL << nk->fi_shift_amt[l]),
281 			    paddr += (1ULL << nk->fi_shift_amt[l])) {
282 
283 				uint_t index = fastboot_vatoindex(nk, vaddr, l);
284 
285 				if (l > 0)
286 					pteval = paddr | pte_bits | PT_PAGESIZE;
287 				else
288 					pteval = paddr | pte_bits;
289 
290 				table[index] = pteval;
291 			}
292 		} else if (table[index] & PT_VALID) {
293 
294 			table = (x86pte_t *)
295 			    ((uintptr_t)(((paddr_t)table[index] & MMU_PAGEMASK)
296 			    - nk->fi_pagetable_pa) + nk->fi_pagetable_va);
297 		} else {
298 			/*
299 			 * Intermediate levels.
300 			 * Program with either valid bit or PTP bits.
301 			 */
302 			if (l == nk->fi_top_level) {
303 #ifdef	__amd64
304 				ASSERT(nk->fi_top_level == 3);
305 				table[index] = nk->fi_next_table_pa | ptp_bits;
306 #else
307 				table[index] = nk->fi_next_table_pa | PT_VALID;
308 #endif	/* __amd64 */
309 			} else {
310 				table[index] = nk->fi_next_table_pa | ptp_bits;
311 			}
312 			table = (x86pte_t *)(nk->fi_next_table_va);
313 			nk->fi_next_table_va += MMU_PAGESIZE;
314 			nk->fi_next_table_pa += MMU_PAGESIZE;
315 		}
316 	}
317 }
318 
319 /*
320  * Build page tables for the lower 1G of physical memory using 2M
321  * pages, and prepare page tables for mapping new kernel and boot
322  * archive pages using 4K pages.
323  */
324 static void
325 fastboot_build_pagetables(fastboot_info_t *nk)
326 {
327 	/*
328 	 * Map lower 1G physical memory.  Use large pages.
329 	 */
330 	fastboot_map_with_size(nk, 0, 0, ONE_GIG, 1);
331 
332 	/*
333 	 * Map one 4K page to get the middle page tables set up.
334 	 */
335 	fake_va = P2ALIGN_TYPED(fake_va, nk->fi_lpagesize, uintptr_t);
336 	fastboot_map_with_size(nk, fake_va,
337 	    nk->fi_files[0].fb_pte_list_va[0] & MMU_PAGEMASK, PAGESIZE, 0);
338 }
339 
340 
341 /*
342  * Sanity check.  Look for dboot offset.
343  */
344 static int
345 fastboot_elf64_find_dboot_load_offset(void *img, off_t imgsz, uint32_t *offp)
346 {
347 	Elf64_Ehdr	*ehdr = (Elf64_Ehdr *)img;
348 	Elf64_Phdr	*phdr;
349 	uint8_t		*phdrbase;
350 	int		i;
351 
352 	if ((ehdr->e_phoff + ehdr->e_phnum * ehdr->e_phentsize) >= imgsz)
353 		return (-1);
354 
355 	phdrbase = (uint8_t *)img + ehdr->e_phoff;
356 
357 	for (i = 0; i < ehdr->e_phnum; i++) {
358 		phdr = (Elf64_Phdr *)(phdrbase + ehdr->e_phentsize * i);
359 
360 		if (phdr->p_type == PT_LOAD) {
361 			if (phdr->p_vaddr == phdr->p_paddr &&
362 			    phdr->p_vaddr == DBOOT_ENTRY_ADDRESS) {
363 				ASSERT(phdr->p_offset <= UINT32_MAX);
364 				*offp = (uint32_t)phdr->p_offset;
365 				return (0);
366 			}
367 		}
368 	}
369 
370 	return (-1);
371 }
372 
373 
374 /*
375  * Initialize text and data section information for 32-bit kernel.
376  * sectcntp - is both input/output parameter.
377  * On entry, *sectcntp contains maximum allowable number of sections;
378  * on return, it contains the actual number of sections filled.
379  */
380 static int
381 fastboot_elf32_find_loadables(void *img, off_t imgsz, fastboot_section_t *sectp,
382     int *sectcntp, uint32_t *offp)
383 {
384 	Elf32_Ehdr	*ehdr = (Elf32_Ehdr *)img;
385 	Elf32_Phdr	*phdr;
386 	uint8_t		*phdrbase;
387 	int		i;
388 	int		used_sections = 0;
389 	const int	max_sectcnt = *sectcntp;
390 
391 	if ((ehdr->e_phoff + ehdr->e_phnum * ehdr->e_phentsize) >= imgsz)
392 		return (-1);
393 
394 	phdrbase = (uint8_t *)img + ehdr->e_phoff;
395 
396 	for (i = 0; i < ehdr->e_phnum; i++) {
397 		phdr = (Elf32_Phdr *)(phdrbase + ehdr->e_phentsize * i);
398 
399 		if (phdr->p_type == PT_INTERP)
400 			return (-1);
401 
402 		if (phdr->p_type != PT_LOAD)
403 			continue;
404 
405 		if (phdr->p_vaddr == phdr->p_paddr &&
406 		    phdr->p_paddr == DBOOT_ENTRY_ADDRESS) {
407 			*offp = (uint32_t)phdr->p_offset;
408 		} else {
409 			if (max_sectcnt <= used_sections)
410 				return (-1);
411 
412 			sectp[used_sections].fb_sec_offset = phdr->p_offset;
413 			sectp[used_sections].fb_sec_paddr = phdr->p_paddr;
414 			sectp[used_sections].fb_sec_size = phdr->p_filesz;
415 			sectp[used_sections].fb_sec_bss_size =
416 			    (phdr->p_filesz < phdr->p_memsz) ?
417 			    (phdr->p_memsz - phdr->p_filesz) : 0;
418 
419 			/* Extra sanity check for the input object file */
420 			if (sectp[used_sections].fb_sec_paddr +
421 			    sectp[used_sections].fb_sec_size +
422 			    sectp[used_sections].fb_sec_bss_size >=
423 			    DBOOT_ENTRY_ADDRESS)
424 				return (-1);
425 
426 			used_sections++;
427 		}
428 	}
429 
430 	*sectcntp = used_sections;
431 	return (0);
432 }
433 
434 /*
435  * Create multiboot info structure (mbi) base on the saved mbi.
436  * Recalculate values of the pointer type fields in the data
437  * structure based on the new starting physical address of the
438  * data structure.
439  */
440 static int
441 fastboot_build_mbi(char *mdep, fastboot_info_t *nk)
442 {
443 	mb_module_t	*mbp;
444 	multiboot_info_t	*mbi;	/* pointer to multiboot structure */
445 	uintptr_t	start_addr_va;	/* starting VA of mbi */
446 	uintptr_t	start_addr_pa;	/* starting PA of mbi */
447 	size_t		offs = 0;	/* offset from the starting address */
448 	size_t		arglen;		/* length of the command line arg */
449 	size_t		size;	/* size of the memory reserved for mbi */
450 	size_t		mdnsz;	/* length of the boot archive name */
451 
452 	/*
453 	 * If mdep is not NULL or empty, use the length of mdep + 1
454 	 * (for NULL terminating) as the length of the new command
455 	 * line; else use the saved command line length as the
456 	 * length for the new command line.
457 	 */
458 	if (mdep != NULL && strlen(mdep) != 0) {
459 		arglen = strlen(mdep) + 1;
460 	} else {
461 		arglen = saved_cmdline_len;
462 	}
463 
464 	/*
465 	 * Allocate memory for the new multiboot info structure (mbi).
466 	 * If we have reserved memory for mbi but it's not enough,
467 	 * free it and reallocate.
468 	 */
469 	size = PAGESIZE + P2ROUNDUP(arglen, PAGESIZE);
470 	if (nk->fi_mbi_size && nk->fi_mbi_size < size) {
471 		contig_free((void *)nk->fi_new_mbi_va, nk->fi_mbi_size);
472 		nk->fi_mbi_size = 0;
473 	}
474 
475 	if (nk->fi_mbi_size == 0) {
476 		if ((nk->fi_new_mbi_va =
477 		    (uintptr_t)contig_alloc(size, &fastboot_below_1G_dma_attr,
478 		    PAGESIZE, 0)) == NULL) {
479 			cmn_err(CE_WARN, fastboot_enomem_msg,
480 			    (uint64_t)size, "1G");
481 			return (-1);
482 		}
483 		/*
484 		 * fi_mbi_size must be set after the allocation succeeds
485 		 * as it's used to determine how much memory to free.
486 		 */
487 		nk->fi_mbi_size = size;
488 	}
489 
490 	/*
491 	 * Initalize memory
492 	 */
493 	bzero((void *)nk->fi_new_mbi_va, nk->fi_mbi_size);
494 
495 	/*
496 	 * Get PA for the new mbi
497 	 */
498 	start_addr_va = nk->fi_new_mbi_va;
499 	start_addr_pa = mmu_ptob((uint64_t)hat_getpfnum(kas.a_hat,
500 	    (caddr_t)start_addr_va));
501 	nk->fi_new_mbi_pa = (paddr_t)start_addr_pa;
502 
503 	/*
504 	 * Populate the rest of the fields in the data structure
505 	 */
506 
507 	/*
508 	 * Copy from the saved mbi to preserve all non-pointer type fields.
509 	 */
510 	mbi = (multiboot_info_t *)start_addr_va;
511 	bcopy(&saved_mbi, mbi, sizeof (*mbi));
512 
513 	/*
514 	 * Recalculate mods_addr.  Set mod_start and mod_end based on
515 	 * the physical address of the new boot archive.  Set mod_name
516 	 * to the name of the new boto archive.
517 	 */
518 	offs += sizeof (multiboot_info_t);
519 	mbi->mods_addr = start_addr_pa + offs;
520 	mbp = (mb_module_t *)(start_addr_va + offs);
521 	mbp->mod_start = nk->fi_files[FASTBOOT_BOOTARCHIVE].fb_dest_pa;
522 	mbp->mod_end = nk->fi_files[FASTBOOT_BOOTARCHIVE].fb_next_pa;
523 
524 	offs += sizeof (mb_module_t);
525 	mdnsz = strlen(fastboot_filename[FASTBOOT_NAME_BOOTARCHIVE]) + 1;
526 	bcopy(fastboot_filename[FASTBOOT_NAME_BOOTARCHIVE],
527 	    (void *)(start_addr_va + offs), mdnsz);
528 	mbp->mod_name = start_addr_pa + offs;
529 	mbp->reserved = 0;
530 
531 	/*
532 	 * Make sure the offset is 16-byte aligned to avoid unaligned access.
533 	 */
534 	offs += mdnsz;
535 	offs = P2ROUNDUP_TYPED(offs, 16, size_t);
536 
537 	/*
538 	 * Recalculate mmap_addr
539 	 */
540 	mbi->mmap_addr = start_addr_pa + offs;
541 	bcopy((void *)(uintptr_t)saved_mmap, (void *)(start_addr_va + offs),
542 	    saved_mbi.mmap_length);
543 	offs += saved_mbi.mmap_length;
544 
545 	/*
546 	 * Recalculate drives_addr
547 	 */
548 	mbi->drives_addr = start_addr_pa + offs;
549 	bcopy((void *)(uintptr_t)saved_drives, (void *)(start_addr_va + offs),
550 	    saved_mbi.drives_length);
551 	offs += saved_mbi.drives_length;
552 
553 	/*
554 	 * Recalculate the address of cmdline.  Set cmdline to contain the
555 	 * new boot argument.
556 	 */
557 	mbi->cmdline = start_addr_pa + offs;
558 
559 	if (mdep != NULL && strlen(mdep) != 0) {
560 		bcopy(mdep, (void *)(start_addr_va + offs), arglen);
561 	} else {
562 		bcopy((void *)saved_cmdline, (void *)(start_addr_va + offs),
563 		    arglen);
564 	}
565 
566 	/* clear fields and flags that are not copied */
567 	bzero(&mbi->config_table,
568 	    sizeof (*mbi) - offsetof(multiboot_info_t, config_table));
569 	mbi->flags &= ~(MB_INFO_CONFIG_TABLE | MB_INFO_BOOT_LOADER_NAME |
570 	    MB_INFO_APM_TABLE | MB_INFO_VIDEO_INFO);
571 
572 	return (0);
573 }
574 
575 /*
576  * Initialize HAT related fields
577  */
578 static void
579 fastboot_init_fields(fastboot_info_t *nk)
580 {
581 	if (x86_feature & X86_PAE) {
582 		nk->fi_has_pae = 1;
583 		nk->fi_shift_amt = fastboot_shift_amt_pae;
584 		nk->fi_ptes_per_table = 512;
585 		nk->fi_lpagesize = (2 << 20);	/* 2M */
586 #ifdef	__amd64
587 		nk->fi_top_level = 3;
588 #else
589 		nk->fi_top_level = 2;
590 #endif	/* __amd64 */
591 	}
592 }
593 
594 /*
595  * Process boot argument
596  */
597 static void
598 fastboot_parse_mdep(char *mdep, char *kern_bootpath, int *bootpath_len,
599     char *bootargs)
600 {
601 	int	i;
602 
603 	/*
604 	 * If mdep is not NULL, it comes in the format of
605 	 *	mountpoint unix args
606 	 */
607 	if (mdep != NULL && strlen(mdep) != 0) {
608 		if (mdep[0] != '-') {
609 			/* First get the root argument */
610 			i = 0;
611 			while (mdep[i] != '\0' && mdep[i] != ' ') {
612 				i++;
613 			}
614 
615 			if (i < 4 || strncmp(&mdep[i-4], "unix", 4) != 0) {
616 				/* mount point */
617 				bcopy(mdep, kern_bootpath, i);
618 				kern_bootpath[i] = '\0';
619 				*bootpath_len = i;
620 
621 				/*
622 				 * Get the next argument. It should be unix as
623 				 * we have validated in in halt.c.
624 				 */
625 				if (strlen(mdep) > i) {
626 					mdep += (i + 1);
627 					i = 0;
628 					while (mdep[i] != '\0' &&
629 					    mdep[i] != ' ') {
630 						i++;
631 					}
632 				}
633 
634 			}
635 			bcopy(mdep, kern_bootfile, i);
636 			kern_bootfile[i] = '\0';
637 			bcopy(mdep, bootargs, strlen(mdep));
638 		} else {
639 			int off = strlen(kern_bootfile);
640 			bcopy(kern_bootfile, bootargs, off);
641 			bcopy(" ", &bootargs[off++], 1);
642 			bcopy(mdep, &bootargs[off], strlen(mdep));
643 			off += strlen(mdep);
644 			bootargs[off] = '\0';
645 		}
646 	}
647 }
648 
649 /*
650  * Reserve memory under PA 1G for mapping the new kernel and boot archive.
651  * This function is only called if fastreboot_onpanic is *not* set.
652  */
653 static void
654 fastboot_reserve_mem(fastboot_info_t *nk)
655 {
656 	int i;
657 
658 	/*
659 	 * A valid kernel is in place.  No need to reserve any memory.
660 	 */
661 	if (nk->fi_valid)
662 		return;
663 
664 	/*
665 	 * Reserve memory under PA 1G for PTE lists.
666 	 */
667 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
668 		fastboot_file_t *fb = &nk->fi_files[i];
669 		size_t fsize_roundup, size;
670 
671 		fsize_roundup = P2ROUNDUP_TYPED(saved_file_size[i],
672 		    PAGESIZE, size_t);
673 		size = FASTBOOT_PTE_LIST_SIZE(fsize_roundup);
674 		if ((fb->fb_pte_list_va = contig_alloc(size,
675 		    &fastboot_below_1G_dma_attr, PAGESIZE, 0)) == NULL) {
676 			return;
677 		}
678 		fb->fb_pte_list_size = size;
679 	}
680 
681 	/*
682 	 * Reserve memory under PA 1G for page tables.
683 	 */
684 	if ((nk->fi_pagetable_va =
685 	    (uintptr_t)contig_alloc(fastboot_pagetable_size,
686 	    &fastboot_below_1G_dma_attr, PAGESIZE, 0)) == NULL) {
687 		return;
688 	}
689 	nk->fi_pagetable_size = fastboot_pagetable_size;
690 
691 	/*
692 	 * Reserve memory under PA 1G for multiboot structure.
693 	 */
694 	if ((nk->fi_new_mbi_va = (uintptr_t)contig_alloc(fastboot_mbi_size,
695 	    &fastboot_below_1G_dma_attr, PAGESIZE, 0)) == NULL) {
696 		return;
697 	}
698 	nk->fi_mbi_size = fastboot_mbi_size;
699 }
700 
701 /*
702  * Calculate MD5 digest for the given fastboot_file.
703  * Assumes that the file is allready loaded properly.
704  */
705 static void
706 fastboot_cksum_file(fastboot_file_t *fb, uchar_t *md5_hash)
707 {
708 	MD5_CTX md5_ctx;
709 
710 	MD5Init(&md5_ctx);
711 	MD5Update(&md5_ctx, (void *)fb->fb_va, fb->fb_size);
712 	MD5Final(md5_hash, &md5_ctx);
713 }
714 
715 /*
716  * Free up the memory we have allocated for a file
717  */
718 static void
719 fastboot_free_file(fastboot_file_t *fb)
720 {
721 	size_t	fsize_roundup;
722 
723 	fsize_roundup = P2ROUNDUP_TYPED(fb->fb_size, PAGESIZE, size_t);
724 	if (fsize_roundup) {
725 		contig_free((void *)fb->fb_va, fsize_roundup);
726 		fb->fb_va = NULL;
727 		fb->fb_size = 0;
728 	}
729 }
730 
731 /*
732  * Free up memory used by the PTEs for a file.
733  */
734 static void
735 fastboot_free_file_pte(fastboot_file_t *fb, uint64_t endaddr)
736 {
737 	if (fb->fb_pte_list_size && fb->fb_pte_list_pa < endaddr) {
738 		contig_free((void *)fb->fb_pte_list_va, fb->fb_pte_list_size);
739 		fb->fb_pte_list_va = 0;
740 		fb->fb_pte_list_pa = 0;
741 		fb->fb_pte_list_size = 0;
742 	}
743 }
744 
745 /*
746  * Free up all the memory used for representing a kernel with
747  * fastboot_info_t.
748  */
749 static void
750 fastboot_free_mem(fastboot_info_t *nk, uint64_t endaddr)
751 {
752 	int i;
753 
754 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
755 		fastboot_free_file(nk->fi_files + i);
756 		fastboot_free_file_pte(nk->fi_files + i, endaddr);
757 	}
758 
759 	if (nk->fi_pagetable_size && nk->fi_pagetable_pa < endaddr) {
760 		contig_free((void *)nk->fi_pagetable_va, nk->fi_pagetable_size);
761 		nk->fi_pagetable_va = 0;
762 		nk->fi_pagetable_pa = 0;
763 		nk->fi_pagetable_size = 0;
764 	}
765 
766 	if (nk->fi_mbi_size && nk->fi_new_mbi_pa < endaddr) {
767 		contig_free((void *)nk->fi_new_mbi_va, nk->fi_mbi_size);
768 		nk->fi_new_mbi_va = 0;
769 		nk->fi_new_mbi_pa = 0;
770 		nk->fi_mbi_size = 0;
771 	}
772 }
773 
774 /*
775  * Only free up the memory allocated for the kernel and boot archive,
776  * but not for the page tables.
777  */
778 void
779 fastboot_free_newkernel(fastboot_info_t *nk)
780 {
781 	int i;
782 
783 	nk->fi_valid = 0;
784 	/*
785 	 * Free the memory we have allocated
786 	 */
787 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
788 		fastboot_free_file(&(nk->fi_files[i]));
789 	}
790 }
791 
792 static void
793 fastboot_cksum_cdata(fastboot_info_t *nk, uchar_t *md5_hash)
794 {
795 	int i;
796 	MD5_CTX md5_ctx;
797 
798 	MD5Init(&md5_ctx);
799 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
800 		MD5Update(&md5_ctx, nk->fi_files[i].fb_pte_list_va,
801 		    nk->fi_files[i].fb_pte_list_size);
802 	}
803 	MD5Update(&md5_ctx, (void *)nk->fi_pagetable_va, nk->fi_pagetable_size);
804 	MD5Update(&md5_ctx, (void *)nk->fi_new_mbi_va, nk->fi_mbi_size);
805 
806 	MD5Final(md5_hash, &md5_ctx);
807 }
808 
809 /*
810  * Generate MD5 checksum of the given kernel.
811  */
812 static void
813 fastboot_cksum_generate(fastboot_info_t *nk)
814 {
815 	int i;
816 
817 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
818 		fastboot_cksum_file(nk->fi_files + i, nk->fi_md5_hash[i]);
819 	}
820 	fastboot_cksum_cdata(nk, nk->fi_md5_hash[i]);
821 }
822 
823 /*
824  * Calculate MD5 checksum of the given kernel and verify that
825  * it matches with what was calculated before.
826  */
827 int
828 fastboot_cksum_verify(fastboot_info_t *nk)
829 {
830 	int i;
831 	uchar_t md5_hash[MD5_DIGEST_LENGTH];
832 
833 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
834 		fastboot_cksum_file(nk->fi_files + i, md5_hash);
835 		if (bcmp(nk->fi_md5_hash[i], md5_hash,
836 		    sizeof (nk->fi_md5_hash[i])) != 0)
837 			return (i + 1);
838 	}
839 
840 	fastboot_cksum_cdata(nk, md5_hash);
841 	if (bcmp(nk->fi_md5_hash[i], md5_hash,
842 	    sizeof (nk->fi_md5_hash[i])) != 0)
843 		return (i + 1);
844 
845 	return (0);
846 }
847 
848 /*
849  * This function performs the following tasks:
850  * - Read the sizes of the new kernel and boot archive.
851  * - Allocate memory for the new kernel and boot archive.
852  * - Allocate memory for page tables necessary for mapping the memory
853  *   allocated for the files.
854  * - Read the new kernel and boot archive into memory.
855  * - Map in the fast reboot switcher.
856  * - Load the fast reboot switcher to FASTBOOT_SWTCH_PA.
857  * - Build the new multiboot_info structure
858  * - Build page tables for the low 1G of physical memory.
859  * - Mark the data structure as valid if all steps have succeeded.
860  */
861 void
862 fastboot_load_kernel(char *mdep)
863 {
864 	void		*buf = NULL;
865 	int		i;
866 	fastboot_file_t	*fb;
867 	uint32_t	dboot_start_offset;
868 	char		kern_bootpath[OBP_MAXPATHLEN];
869 	extern uintptr_t postbootkernelbase;
870 	uintptr_t	saved_kernelbase;
871 	int		bootpath_len = 0;
872 	int		is_failsafe = 0;
873 	int		is_retry = 0;
874 	uint64_t	end_addr;
875 
876 	if (!fastreboot_capable)
877 		return;
878 
879 	if (newkernel.fi_valid)
880 		fastboot_free_newkernel(&newkernel);
881 
882 	saved_kernelbase = postbootkernelbase;
883 
884 	postbootkernelbase = 0;
885 
886 	/*
887 	 * Initialize various HAT related fields in the data structure
888 	 */
889 	fastboot_init_fields(&newkernel);
890 
891 	bzero(kern_bootpath, OBP_MAXPATHLEN);
892 
893 	/*
894 	 * Process the boot argument
895 	 */
896 	bzero(fastboot_args, OBP_MAXPATHLEN);
897 	fastboot_parse_mdep(mdep, kern_bootpath, &bootpath_len, fastboot_args);
898 
899 	/*
900 	 * Make sure we get the null character
901 	 */
902 	bcopy(kern_bootpath, fastboot_filename[FASTBOOT_NAME_UNIX],
903 	    bootpath_len);
904 	bcopy(kern_bootfile,
905 	    &fastboot_filename[FASTBOOT_NAME_UNIX][bootpath_len],
906 	    strlen(kern_bootfile) + 1);
907 
908 	bcopy(kern_bootpath, fastboot_filename[FASTBOOT_NAME_BOOTARCHIVE],
909 	    bootpath_len);
910 
911 	if (bcmp(kern_bootfile, FAILSAFE_BOOTFILE32,
912 	    (sizeof (FAILSAFE_BOOTFILE32) - 1)) == 0 ||
913 	    bcmp(kern_bootfile, FAILSAFE_BOOTFILE64,
914 	    (sizeof (FAILSAFE_BOOTFILE64) - 1)) == 0) {
915 		is_failsafe = 1;
916 	}
917 
918 load_kernel_retry:
919 	/*
920 	 * Read in unix and boot_archive
921 	 */
922 	end_addr = DBOOT_ENTRY_ADDRESS;
923 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
924 		struct _buf	*file;
925 		uintptr_t	va;
926 		uint64_t	fsize;
927 		size_t		fsize_roundup, pt_size;
928 		int		page_index;
929 		uintptr_t	offset;
930 		ddi_dma_attr_t dma_attr = fastboot_dma_attr;
931 
932 
933 		dprintf("fastboot_filename[%d] = %s\n",
934 		    i, fastboot_filename[i]);
935 
936 		if ((file = kobj_open_file(fastboot_filename[i])) ==
937 		    (struct _buf *)-1) {
938 			cmn_err(CE_WARN, "Fastboot: Couldn't open %s",
939 			    fastboot_filename[i]);
940 			goto err_out;
941 		}
942 
943 		if (kobj_get_filesize(file, &fsize) != 0) {
944 			cmn_err(CE_WARN,
945 			    "Fastboot: Couldn't get filesize for %s",
946 			    fastboot_filename[i]);
947 			goto err_out;
948 		}
949 
950 		fsize_roundup = P2ROUNDUP_TYPED(fsize, PAGESIZE, size_t);
951 
952 		/*
953 		 * Where the files end in physical memory after being
954 		 * relocated by the fast boot switcher.
955 		 */
956 		end_addr += fsize_roundup;
957 		if (end_addr > fastboot_below_1G_dma_attr.dma_attr_addr_hi) {
958 			cmn_err(CE_WARN, "Fastboot: boot archive is too big");
959 			goto err_out;
960 		}
961 
962 		/*
963 		 * Adjust dma_attr_addr_lo so that the new kernel and boot
964 		 * archive will not be overridden during relocation.
965 		 */
966 		if (end_addr > fastboot_dma_attr.dma_attr_addr_lo ||
967 		    end_addr > fastboot_below_1G_dma_attr.dma_attr_addr_lo) {
968 
969 			if (is_retry) {
970 				/*
971 				 * If we have already tried and didn't succeed,
972 				 * just give up.
973 				 */
974 				cmn_err(CE_WARN,
975 				    "Fastboot: boot archive is too big");
976 				goto err_out;
977 			} else {
978 				/* Set the flag so we don't keep retrying */
979 				is_retry++;
980 
981 				/* Adjust dma_attr_addr_lo */
982 				fastboot_dma_attr.dma_attr_addr_lo = end_addr;
983 				fastboot_below_1G_dma_attr.dma_attr_addr_lo =
984 				    end_addr;
985 
986 				/*
987 				 * Free the memory we have already allocated
988 				 * whose physical addresses might not fit
989 				 * the new lo and hi constraints.
990 				 */
991 				fastboot_free_mem(&newkernel, end_addr);
992 				goto load_kernel_retry;
993 			}
994 		}
995 
996 
997 		if (!fastboot_contig)
998 			dma_attr.dma_attr_sgllen = (fsize / PAGESIZE) +
999 			    (((fsize % PAGESIZE) == 0) ? 0 : 1);
1000 
1001 		if ((buf = contig_alloc(fsize, &dma_attr, PAGESIZE, 0))
1002 		    == NULL) {
1003 			cmn_err(CE_WARN, fastboot_enomem_msg, fsize, "64G");
1004 			goto err_out;
1005 		}
1006 
1007 		va = P2ROUNDUP_TYPED((uintptr_t)buf, PAGESIZE, uintptr_t);
1008 
1009 		if (kobj_read_file(file, (char *)va, fsize, 0) < 0) {
1010 			cmn_err(CE_WARN, "Fastboot: Couldn't read %s",
1011 			    fastboot_filename[i]);
1012 			goto err_out;
1013 		}
1014 
1015 		fb = &newkernel.fi_files[i];
1016 		fb->fb_va = va;
1017 		fb->fb_size = fsize;
1018 		fb->fb_sectcnt = 0;
1019 
1020 		pt_size = FASTBOOT_PTE_LIST_SIZE(fsize_roundup);
1021 
1022 		/*
1023 		 * If we have reserved memory but it not enough, free it.
1024 		 */
1025 		if (fb->fb_pte_list_size && fb->fb_pte_list_size < pt_size) {
1026 			contig_free((void *)fb->fb_pte_list_va,
1027 			    fb->fb_pte_list_size);
1028 			fb->fb_pte_list_size = 0;
1029 		}
1030 
1031 		if (fb->fb_pte_list_size == 0) {
1032 			if ((fb->fb_pte_list_va =
1033 			    (x86pte_t *)contig_alloc(pt_size,
1034 			    &fastboot_below_1G_dma_attr, PAGESIZE, 0))
1035 			    == NULL) {
1036 				cmn_err(CE_WARN, fastboot_enomem_msg,
1037 				    (uint64_t)pt_size, "1G");
1038 				goto err_out;
1039 			}
1040 			/*
1041 			 * fb_pte_list_size must be set after the allocation
1042 			 * succeeds as it's used to determine how much memory to
1043 			 * free.
1044 			 */
1045 			fb->fb_pte_list_size = pt_size;
1046 		}
1047 
1048 		bzero((void *)(fb->fb_pte_list_va), fb->fb_pte_list_size);
1049 
1050 		fb->fb_pte_list_pa = mmu_ptob((uint64_t)hat_getpfnum(kas.a_hat,
1051 		    (caddr_t)fb->fb_pte_list_va));
1052 
1053 		for (page_index = 0, offset = 0; offset < fb->fb_size;
1054 		    offset += PAGESIZE) {
1055 			uint64_t paddr;
1056 
1057 			paddr = mmu_ptob((uint64_t)hat_getpfnum(kas.a_hat,
1058 			    (caddr_t)fb->fb_va + offset));
1059 
1060 			ASSERT(paddr >= fastboot_dma_attr.dma_attr_addr_lo);
1061 
1062 			/*
1063 			 * Include the pte_bits so we don't have to make
1064 			 * it in assembly.
1065 			 */
1066 			fb->fb_pte_list_va[page_index++] = (x86pte_t)
1067 			    (paddr | pte_bits);
1068 		}
1069 
1070 		fb->fb_pte_list_va[page_index] = FASTBOOT_TERMINATE;
1071 
1072 		if (i == FASTBOOT_UNIX) {
1073 			Ehdr	*ehdr = (Ehdr *)va;
1074 			int	j;
1075 
1076 			/*
1077 			 * Sanity checks:
1078 			 */
1079 			for (j = 0; j < SELFMAG; j++) {
1080 				if (ehdr->e_ident[j] != ELFMAG[j]) {
1081 					cmn_err(CE_WARN, "Fastboot: Bad ELF "
1082 					    "signature");
1083 					goto err_out;
1084 				}
1085 			}
1086 
1087 			if (ehdr->e_ident[EI_CLASS] == ELFCLASS32 &&
1088 			    ehdr->e_ident[EI_DATA] == ELFDATA2LSB &&
1089 			    ehdr->e_machine == EM_386) {
1090 
1091 				fb->fb_sectcnt = sizeof (fb->fb_sections) /
1092 				    sizeof (fb->fb_sections[0]);
1093 
1094 				if (fastboot_elf32_find_loadables((void *)va,
1095 				    fsize, &fb->fb_sections[0],
1096 				    &fb->fb_sectcnt, &dboot_start_offset) < 0) {
1097 					cmn_err(CE_WARN, "Fastboot: ELF32 "
1098 					    "program section failure");
1099 					goto err_out;
1100 				}
1101 
1102 				if (fb->fb_sectcnt == 0) {
1103 					cmn_err(CE_WARN, "Fastboot: No ELF32 "
1104 					    "program sections found");
1105 					goto err_out;
1106 				}
1107 
1108 				if (is_failsafe) {
1109 					/* Failsafe boot_archive */
1110 					bcopy(BOOTARCHIVE32_FAILSAFE,
1111 					    &fastboot_filename
1112 					    [FASTBOOT_NAME_BOOTARCHIVE]
1113 					    [bootpath_len],
1114 					    sizeof (BOOTARCHIVE32_FAILSAFE));
1115 				} else {
1116 					bcopy(BOOTARCHIVE32,
1117 					    &fastboot_filename
1118 					    [FASTBOOT_NAME_BOOTARCHIVE]
1119 					    [bootpath_len],
1120 					    sizeof (BOOTARCHIVE32));
1121 				}
1122 
1123 			} else if (ehdr->e_ident[EI_CLASS] == ELFCLASS64 &&
1124 			    ehdr->e_ident[EI_DATA] == ELFDATA2LSB &&
1125 			    ehdr->e_machine == EM_AMD64) {
1126 
1127 				if (fastboot_elf64_find_dboot_load_offset(
1128 				    (void *)va, fsize, &dboot_start_offset)
1129 				    != 0) {
1130 					cmn_err(CE_WARN, "Fastboot: Couldn't "
1131 					    "find ELF64 dboot entry offset");
1132 					goto err_out;
1133 				}
1134 
1135 				if ((x86_feature & X86_64) == 0 ||
1136 				    (x86_feature & X86_PAE) == 0) {
1137 					cmn_err(CE_WARN, "Fastboot: Cannot "
1138 					    "reboot to %s: "
1139 					    "not a 64-bit capable system",
1140 					    kern_bootfile);
1141 					goto err_out;
1142 				}
1143 
1144 				if (is_failsafe) {
1145 					/* Failsafe boot_archive */
1146 					bcopy(BOOTARCHIVE64_FAILSAFE,
1147 					    &fastboot_filename
1148 					    [FASTBOOT_NAME_BOOTARCHIVE]
1149 					    [bootpath_len],
1150 					    sizeof (BOOTARCHIVE64_FAILSAFE));
1151 				} else {
1152 					bcopy(BOOTARCHIVE64,
1153 					    &fastboot_filename
1154 					    [FASTBOOT_NAME_BOOTARCHIVE]
1155 					    [bootpath_len],
1156 					    sizeof (BOOTARCHIVE64));
1157 				}
1158 			} else {
1159 				cmn_err(CE_WARN, "Fastboot: Unknown ELF type");
1160 				goto err_out;
1161 			}
1162 
1163 			fb->fb_dest_pa = DBOOT_ENTRY_ADDRESS -
1164 			    dboot_start_offset;
1165 
1166 			fb->fb_next_pa = DBOOT_ENTRY_ADDRESS + fsize_roundup;
1167 		} else {
1168 			fb->fb_dest_pa = newkernel.fi_files[i - 1].fb_next_pa;
1169 			fb->fb_next_pa = fb->fb_dest_pa + fsize_roundup;
1170 		}
1171 
1172 		kobj_close_file(file);
1173 
1174 	}
1175 
1176 	/*
1177 	 * Add the function that will switch us to 32-bit protected mode
1178 	 */
1179 	fb = &newkernel.fi_files[FASTBOOT_SWTCH];
1180 	fb->fb_va = fb->fb_dest_pa = FASTBOOT_SWTCH_PA;
1181 	fb->fb_size = MMU_PAGESIZE;
1182 
1183 	hat_devload(kas.a_hat, (caddr_t)fb->fb_va,
1184 	    MMU_PAGESIZE, mmu_btop(fb->fb_dest_pa),
1185 	    PROT_READ | PROT_WRITE | PROT_EXEC,
1186 	    HAT_LOAD_NOCONSIST | HAT_LOAD_LOCK);
1187 
1188 	/*
1189 	 * Build the new multiboot_info structure
1190 	 */
1191 	if (fastboot_build_mbi(fastboot_args, &newkernel) != 0) {
1192 		goto err_out;
1193 	}
1194 
1195 	/*
1196 	 * Build page table for low 1G physical memory. Use big pages.
1197 	 * Allocate 4 (5 for amd64) pages for the page tables.
1198 	 *    1 page for PML4 (amd64)
1199 	 *    1 page for Page-Directory-Pointer Table
1200 	 *    2 pages for Page Directory
1201 	 *    1 page for Page Table.
1202 	 * The page table entry will be rewritten to map the physical
1203 	 * address as we do the copying.
1204 	 */
1205 	if (newkernel.fi_has_pae) {
1206 #ifdef	__amd64
1207 		size_t size = MMU_PAGESIZE * 5;
1208 #else
1209 		size_t size = MMU_PAGESIZE * 4;
1210 #endif	/* __amd64 */
1211 
1212 		if (newkernel.fi_pagetable_size && newkernel.fi_pagetable_size
1213 		    < size) {
1214 			contig_free((void *)newkernel.fi_pagetable_va,
1215 			    newkernel.fi_pagetable_size);
1216 			newkernel.fi_pagetable_size = 0;
1217 		}
1218 
1219 		if (newkernel.fi_pagetable_size == 0) {
1220 			if ((newkernel.fi_pagetable_va = (uintptr_t)
1221 			    contig_alloc(size, &fastboot_below_1G_dma_attr,
1222 			    MMU_PAGESIZE, 0)) == NULL) {
1223 				cmn_err(CE_WARN, fastboot_enomem_msg,
1224 				    (uint64_t)size, "1G");
1225 				goto err_out;
1226 			}
1227 			/*
1228 			 * fi_pagetable_size must be set after the allocation
1229 			 * succeeds as it's used to determine how much memory to
1230 			 * free.
1231 			 */
1232 			newkernel.fi_pagetable_size = size;
1233 		}
1234 
1235 		bzero((void *)(newkernel.fi_pagetable_va), size);
1236 
1237 		newkernel.fi_pagetable_pa =
1238 		    mmu_ptob((uint64_t)hat_getpfnum(kas.a_hat,
1239 		    (caddr_t)newkernel.fi_pagetable_va));
1240 
1241 		newkernel.fi_last_table_pa = newkernel.fi_pagetable_pa +
1242 		    size - MMU_PAGESIZE;
1243 
1244 		newkernel.fi_next_table_va = newkernel.fi_pagetable_va +
1245 		    MMU_PAGESIZE;
1246 		newkernel.fi_next_table_pa = newkernel.fi_pagetable_pa +
1247 		    MMU_PAGESIZE;
1248 
1249 		fastboot_build_pagetables(&newkernel);
1250 	}
1251 
1252 
1253 	/* Generate MD5 checksums */
1254 	fastboot_cksum_generate(&newkernel);
1255 
1256 	/* Mark it as valid */
1257 	newkernel.fi_valid = 1;
1258 	newkernel.fi_magic = FASTBOOT_MAGIC;
1259 
1260 	postbootkernelbase = saved_kernelbase;
1261 	return;
1262 
1263 err_out:
1264 	postbootkernelbase = saved_kernelbase;
1265 	newkernel.fi_valid = 0;
1266 	fastboot_free_newkernel(&newkernel);
1267 }
1268 
1269 
1270 /* ARGSUSED */
1271 static int
1272 fastboot_xc_func(fastboot_info_t *nk, xc_arg_t unused2, xc_arg_t unused3)
1273 {
1274 	void (*fastboot_func)(fastboot_info_t *);
1275 	fastboot_file_t	*fb = &nk->fi_files[FASTBOOT_SWTCH];
1276 	fastboot_func = (void (*)())(fb->fb_va);
1277 	kthread_t *t_intr = curthread->t_intr;
1278 
1279 	if (&kas != curproc->p_as) {
1280 		hat_devload(curproc->p_as->a_hat, (caddr_t)fb->fb_va,
1281 		    MMU_PAGESIZE, mmu_btop(fb->fb_dest_pa),
1282 		    PROT_READ | PROT_WRITE | PROT_EXEC,
1283 		    HAT_LOAD_NOCONSIST | HAT_LOAD_LOCK);
1284 	}
1285 
1286 	/*
1287 	 * If we have pinned a thread, make sure the address is mapped
1288 	 * in the address space of the pinned thread.
1289 	 */
1290 	if (t_intr && t_intr->t_procp->p_as->a_hat != curproc->p_as->a_hat &&
1291 	    t_intr->t_procp->p_as != &kas)
1292 		hat_devload(t_intr->t_procp->p_as->a_hat, (caddr_t)fb->fb_va,
1293 		    MMU_PAGESIZE, mmu_btop(fb->fb_dest_pa),
1294 		    PROT_READ | PROT_WRITE | PROT_EXEC,
1295 		    HAT_LOAD_NOCONSIST | HAT_LOAD_LOCK);
1296 
1297 	(*psm_shutdownf)(A_SHUTDOWN, AD_FASTREBOOT);
1298 	(*fastboot_func)(nk);
1299 
1300 	/*NOTREACHED*/
1301 	return (0);
1302 }
1303 
1304 /*
1305  * Jump to the fast reboot switcher.  This function never returns.
1306  */
1307 void
1308 fast_reboot()
1309 {
1310 	processorid_t bootcpuid = 0;
1311 	extern uintptr_t postbootkernelbase;
1312 	extern char	fb_swtch_image[];
1313 	fastboot_file_t	*fb;
1314 	int i;
1315 
1316 	postbootkernelbase = 0;
1317 
1318 	fb = &newkernel.fi_files[FASTBOOT_SWTCH];
1319 
1320 	/*
1321 	 * Map the address into both the current proc's address
1322 	 * space and the kernel's address space in case the panic
1323 	 * is forced by kmdb.
1324 	 */
1325 	if (&kas != curproc->p_as) {
1326 		hat_devload(curproc->p_as->a_hat, (caddr_t)fb->fb_va,
1327 		    MMU_PAGESIZE, mmu_btop(fb->fb_dest_pa),
1328 		    PROT_READ | PROT_WRITE | PROT_EXEC,
1329 		    HAT_LOAD_NOCONSIST | HAT_LOAD_LOCK);
1330 	}
1331 
1332 	bcopy((void *)fb_swtch_image, (void *)fb->fb_va, fb->fb_size);
1333 
1334 
1335 	/*
1336 	 * Set fb_va to fake_va
1337 	 */
1338 	for (i = 0; i < FASTBOOT_MAX_FILES_MAP; i++) {
1339 		newkernel.fi_files[i].fb_va = fake_va;
1340 
1341 	}
1342 
1343 	if (panicstr && CPU->cpu_id != bootcpuid &&
1344 	    CPU_ACTIVE(cpu_get(bootcpuid))) {
1345 		extern void panic_idle(void);
1346 		cpuset_t cpuset;
1347 
1348 		CPUSET_ZERO(cpuset);
1349 		CPUSET_ADD(cpuset, bootcpuid);
1350 		xc_priority((xc_arg_t)&newkernel, 0, 0, CPUSET2BV(cpuset),
1351 		    (xc_func_t)fastboot_xc_func);
1352 
1353 		panic_idle();
1354 	} else
1355 		(void) fastboot_xc_func(&newkernel, 0, 0);
1356 }
1357 
1358 
1359 /*
1360  * Get boot property value for fastreboot_onpanic.
1361  *
1362  * NOTE: If fastreboot_onpanic is set to non-zero in /etc/system,
1363  * new setting passed in via "-B fastreboot_onpanic" is ignored.
1364  * This order of precedence is to enable developers debugging panics
1365  * that occur early in boot to utilize Fast Reboot on panic.
1366  */
1367 static void
1368 fastboot_get_bootprop(void)
1369 {
1370 	int		val = 0xaa, len, ret;
1371 	dev_info_t	*devi;
1372 	char		*propstr = NULL;
1373 
1374 	devi = ddi_root_node();
1375 
1376 	ret = ddi_prop_lookup_string(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
1377 	    FASTREBOOT_ONPANIC, &propstr);
1378 
1379 	if (ret == DDI_PROP_SUCCESS) {
1380 		if (FASTREBOOT_ONPANIC_NOTSET(propstr))
1381 			val = 0;
1382 		else if (FASTREBOOT_ONPANIC_ISSET(propstr))
1383 			val = UA_FASTREBOOT_ONPANIC;
1384 
1385 		/*
1386 		 * Only set fastreboot_onpanic to the value passed in
1387 		 * if it's not already set to non-zero, and the value
1388 		 * has indeed been passed in via command line.
1389 		 */
1390 		if (!fastreboot_onpanic && val != 0xaa)
1391 			fastreboot_onpanic = val;
1392 		ddi_prop_free(propstr);
1393 	} else if (ret != DDI_PROP_NOT_FOUND && ret != DDI_PROP_UNDEFINED) {
1394 		cmn_err(CE_WARN, "%s value is invalid, will be ignored",
1395 		    FASTREBOOT_ONPANIC);
1396 	}
1397 
1398 	len = sizeof (fastreboot_onpanic_cmdline);
1399 	ret = ddi_getlongprop_buf(DDI_DEV_T_ANY, devi, DDI_PROP_DONTPASS,
1400 	    FASTREBOOT_ONPANIC_CMDLINE, fastreboot_onpanic_cmdline, &len);
1401 
1402 	if (ret == DDI_PROP_BUF_TOO_SMALL)
1403 		cmn_err(CE_WARN, "%s value is too long, will be ignored",
1404 		    FASTREBOOT_ONPANIC_CMDLINE);
1405 }
1406 
1407 /*
1408  * This function is called by main() to either load the backup kernel for panic
1409  * fast reboot, or to reserve low physical memory for fast reboot.
1410  */
1411 void
1412 fastboot_post_startup()
1413 {
1414 	if (!fastreboot_capable)
1415 		return;
1416 
1417 	mutex_enter(&fastreboot_config_mutex);
1418 
1419 	fastboot_get_bootprop();
1420 
1421 	if (fastreboot_onpanic)
1422 		fastboot_load_kernel(fastreboot_onpanic_cmdline);
1423 	else if (reserve_mem_enabled)
1424 		fastboot_reserve_mem(&newkernel);
1425 
1426 	mutex_exit(&fastreboot_config_mutex);
1427 }
1428 
1429 /*
1430  * Update boot configuration settings.
1431  * If the new fastreboot_onpanic setting is false, and a kernel has
1432  * been preloaded, free the memory;
1433  * if the new fastreboot_onpanic setting is true and newkernel is
1434  * not valid, load the new kernel.
1435  */
1436 void
1437 fastboot_update_config(const char *mdep)
1438 {
1439 	uint8_t boot_config = (uint8_t)*mdep;
1440 	int cur_fastreboot_onpanic;
1441 
1442 	if (!fastreboot_capable)
1443 		return;
1444 
1445 	mutex_enter(&fastreboot_config_mutex);
1446 
1447 	cur_fastreboot_onpanic = fastreboot_onpanic;
1448 	fastreboot_onpanic = boot_config & UA_FASTREBOOT_ONPANIC;
1449 
1450 	if (fastreboot_onpanic && (!cur_fastreboot_onpanic ||
1451 	    !newkernel.fi_valid))
1452 		fastboot_load_kernel(fastreboot_onpanic_cmdline);
1453 	if (cur_fastreboot_onpanic && !fastreboot_onpanic)
1454 		fastboot_free_newkernel(&newkernel);
1455 
1456 	mutex_exit(&fastreboot_config_mutex);
1457 }
1458 
1459 /*
1460  * This is the interface to be called by other kernel components to
1461  * disable fastreboot_onpanic.
1462  */
1463 void
1464 fastreboot_disable()
1465 {
1466 	uint8_t boot_config = (uint8_t)(~UA_FASTREBOOT_ONPANIC);
1467 	fastboot_update_config((const char *)&boot_config);
1468 }
1469 
1470 /*
1471  * This is the interface to be called by fm_panic() in case FMA has diagnosed
1472  * a terminal machine check exception.  It does not free up memory allocated
1473  * for the backup kernel.  General disabling fastreboot_onpanic in a
1474  * non-panicking situation must go through fastboot_update_config().
1475  */
1476 void
1477 fastreboot_disable_highpil()
1478 {
1479 	fastreboot_onpanic = 0;
1480 }
1481 
1482 
1483 /*
1484  * A simplified interface for uadmin to call to update the configuration
1485  * setting and load a new kernel if necessary.
1486  */
1487 void
1488 fastboot_update_and_load(int fcn, char *mdep)
1489 {
1490 	if (fcn != AD_FASTREBOOT) {
1491 		/*
1492 		 * If user has explicitly requested reboot to prom,
1493 		 * or uadmin(1M) was invoked with other functions,
1494 		 * don't try to fast reboot after dumping.
1495 		 */
1496 		fastreboot_disable();
1497 	}
1498 
1499 	mutex_enter(&fastreboot_config_mutex);
1500 
1501 	if (fastreboot_onpanic)
1502 		fastboot_load_kernel(mdep);
1503 
1504 	mutex_exit(&fastreboot_config_mutex);
1505 }
1506