1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 27 /* 28 * VM - Hardware Address Translation management for i386 and amd64 29 * 30 * Implementation of the interfaces described in <common/vm/hat.h> 31 * 32 * Nearly all the details of how the hardware is managed should not be 33 * visible outside this layer except for misc. machine specific functions 34 * that work in conjunction with this code. 35 * 36 * Routines used only inside of i86pc/vm start with hati_ for HAT Internal. 37 */ 38 39 #include <sys/machparam.h> 40 #include <sys/machsystm.h> 41 #include <sys/mman.h> 42 #include <sys/types.h> 43 #include <sys/systm.h> 44 #include <sys/cpuvar.h> 45 #include <sys/thread.h> 46 #include <sys/proc.h> 47 #include <sys/cpu.h> 48 #include <sys/kmem.h> 49 #include <sys/disp.h> 50 #include <sys/shm.h> 51 #include <sys/sysmacros.h> 52 #include <sys/machparam.h> 53 #include <sys/vmem.h> 54 #include <sys/vmsystm.h> 55 #include <sys/promif.h> 56 #include <sys/var.h> 57 #include <sys/x86_archext.h> 58 #include <sys/atomic.h> 59 #include <sys/bitmap.h> 60 #include <sys/controlregs.h> 61 #include <sys/bootconf.h> 62 #include <sys/bootsvcs.h> 63 #include <sys/bootinfo.h> 64 #include <sys/archsystm.h> 65 66 #include <vm/seg_kmem.h> 67 #include <vm/hat_i86.h> 68 #include <vm/as.h> 69 #include <vm/seg.h> 70 #include <vm/page.h> 71 #include <vm/seg_kp.h> 72 #include <vm/seg_kpm.h> 73 #include <vm/vm_dep.h> 74 #ifdef __xpv 75 #include <sys/hypervisor.h> 76 #endif 77 #include <vm/kboot_mmu.h> 78 #include <vm/seg_spt.h> 79 80 #include <sys/cmn_err.h> 81 82 /* 83 * Basic parameters for hat operation. 84 */ 85 struct hat_mmu_info mmu; 86 87 /* 88 * The page that is the kernel's top level pagetable. 89 * 90 * For 32 bit PAE support on i86pc, the kernel hat will use the 1st 4 entries 91 * on this 4K page for its top level page table. The remaining groups of 92 * 4 entries are used for per processor copies of user VLP pagetables for 93 * running threads. See hat_switch() and reload_pae32() for details. 94 * 95 * vlp_page[0..3] - level==2 PTEs for kernel HAT 96 * vlp_page[4..7] - level==2 PTEs for user thread on cpu 0 97 * vlp_page[8..11] - level==2 PTE for user thread on cpu 1 98 * etc... 99 */ 100 static x86pte_t *vlp_page; 101 102 /* 103 * forward declaration of internal utility routines 104 */ 105 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, 106 x86pte_t new); 107 108 /* 109 * The kernel address space exists in all HATs. To implement this the 110 * kernel reserves a fixed number of entries in the topmost level(s) of page 111 * tables. The values are setup during startup and then copied to every user 112 * hat created by hat_alloc(). This means that kernelbase must be: 113 * 114 * 4Meg aligned for 32 bit kernels 115 * 512Gig aligned for x86_64 64 bit kernel 116 * 117 * The hat_kernel_range_ts describe what needs to be copied from kernel hat 118 * to each user hat. 119 */ 120 typedef struct hat_kernel_range { 121 level_t hkr_level; 122 uintptr_t hkr_start_va; 123 uintptr_t hkr_end_va; /* zero means to end of memory */ 124 } hat_kernel_range_t; 125 #define NUM_KERNEL_RANGE 2 126 static hat_kernel_range_t kernel_ranges[NUM_KERNEL_RANGE]; 127 static int num_kernel_ranges; 128 129 uint_t use_boot_reserve = 1; /* cleared after early boot process */ 130 uint_t can_steal_post_boot = 0; /* set late in boot to enable stealing */ 131 132 /* 133 * enable_1gpg: controls 1g page support for user applications. 134 * By default, 1g pages are exported to user applications. enable_1gpg can 135 * be set to 0 to not export. 136 */ 137 int enable_1gpg = 1; 138 139 /* 140 * AMD shanghai processors provide better management of 1gb ptes in its tlb. 141 * By default, 1g page suppport will be disabled for pre-shanghai AMD 142 * processors that don't have optimal tlb support for the 1g page size. 143 * chk_optimal_1gtlb can be set to 0 to force 1g page support on sub-optimal 144 * processors. 145 */ 146 int chk_optimal_1gtlb = 1; 147 148 149 #ifdef DEBUG 150 uint_t map1gcnt; 151 #endif 152 153 154 /* 155 * A cpuset for all cpus. This is used for kernel address cross calls, since 156 * the kernel addresses apply to all cpus. 157 */ 158 cpuset_t khat_cpuset; 159 160 /* 161 * management stuff for hat structures 162 */ 163 kmutex_t hat_list_lock; 164 kcondvar_t hat_list_cv; 165 kmem_cache_t *hat_cache; 166 kmem_cache_t *hat_hash_cache; 167 kmem_cache_t *vlp_hash_cache; 168 169 /* 170 * Simple statistics 171 */ 172 struct hatstats hatstat; 173 174 /* 175 * Some earlier hypervisor versions do not emulate cmpxchg of PTEs 176 * correctly. For such hypervisors we must set PT_USER for kernel 177 * entries ourselves (normally the emulation would set PT_USER for 178 * kernel entries and PT_USER|PT_GLOBAL for user entries). pt_kern is 179 * thus set appropriately. Note that dboot/kbm is OK, as only the full 180 * HAT uses cmpxchg() and the other paths (hypercall etc.) were never 181 * incorrect. 182 */ 183 int pt_kern; 184 185 /* 186 * useful stuff for atomic access/clearing/setting REF/MOD/RO bits in page_t's. 187 */ 188 extern void atomic_orb(uchar_t *addr, uchar_t val); 189 extern void atomic_andb(uchar_t *addr, uchar_t val); 190 191 #define PP_GETRM(pp, rmmask) (pp->p_nrm & rmmask) 192 #define PP_ISMOD(pp) PP_GETRM(pp, P_MOD) 193 #define PP_ISREF(pp) PP_GETRM(pp, P_REF) 194 #define PP_ISRO(pp) PP_GETRM(pp, P_RO) 195 196 #define PP_SETRM(pp, rm) atomic_orb(&(pp->p_nrm), rm) 197 #define PP_SETMOD(pp) PP_SETRM(pp, P_MOD) 198 #define PP_SETREF(pp) PP_SETRM(pp, P_REF) 199 #define PP_SETRO(pp) PP_SETRM(pp, P_RO) 200 201 #define PP_CLRRM(pp, rm) atomic_andb(&(pp->p_nrm), ~(rm)) 202 #define PP_CLRMOD(pp) PP_CLRRM(pp, P_MOD) 203 #define PP_CLRREF(pp) PP_CLRRM(pp, P_REF) 204 #define PP_CLRRO(pp) PP_CLRRM(pp, P_RO) 205 #define PP_CLRALL(pp) PP_CLRRM(pp, P_MOD | P_REF | P_RO) 206 207 /* 208 * kmem cache constructor for struct hat 209 */ 210 /*ARGSUSED*/ 211 static int 212 hati_constructor(void *buf, void *handle, int kmflags) 213 { 214 hat_t *hat = buf; 215 216 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 217 bzero(hat->hat_pages_mapped, 218 sizeof (pgcnt_t) * (mmu.max_page_level + 1)); 219 hat->hat_ism_pgcnt = 0; 220 hat->hat_stats = 0; 221 hat->hat_flags = 0; 222 CPUSET_ZERO(hat->hat_cpus); 223 hat->hat_htable = NULL; 224 hat->hat_ht_hash = NULL; 225 return (0); 226 } 227 228 /* 229 * Allocate a hat structure for as. We also create the top level 230 * htable and initialize it to contain the kernel hat entries. 231 */ 232 hat_t * 233 hat_alloc(struct as *as) 234 { 235 hat_t *hat; 236 htable_t *ht; /* top level htable */ 237 uint_t use_vlp; 238 uint_t r; 239 hat_kernel_range_t *rp; 240 uintptr_t va; 241 uintptr_t eva; 242 uint_t start; 243 uint_t cnt; 244 htable_t *src; 245 246 /* 247 * Once we start creating user process HATs we can enable 248 * the htable_steal() code. 249 */ 250 if (can_steal_post_boot == 0) 251 can_steal_post_boot = 1; 252 253 ASSERT(AS_WRITE_HELD(as, &as->a_lock)); 254 hat = kmem_cache_alloc(hat_cache, KM_SLEEP); 255 hat->hat_as = as; 256 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 257 ASSERT(hat->hat_flags == 0); 258 259 #if defined(__xpv) 260 /* 261 * No VLP stuff on the hypervisor due to the 64-bit split top level 262 * page tables. On 32-bit it's not needed as the hypervisor takes 263 * care of copying the top level PTEs to a below 4Gig page. 264 */ 265 use_vlp = 0; 266 #else /* __xpv */ 267 /* 32 bit processes uses a VLP style hat when running with PAE */ 268 #if defined(__amd64) 269 use_vlp = (ttoproc(curthread)->p_model == DATAMODEL_ILP32); 270 #elif defined(__i386) 271 use_vlp = mmu.pae_hat; 272 #endif 273 #endif /* __xpv */ 274 if (use_vlp) { 275 hat->hat_flags = HAT_VLP; 276 bzero(hat->hat_vlp_ptes, VLP_SIZE); 277 } 278 279 /* 280 * Allocate the htable hash 281 */ 282 if ((hat->hat_flags & HAT_VLP)) { 283 hat->hat_num_hash = mmu.vlp_hash_cnt; 284 hat->hat_ht_hash = kmem_cache_alloc(vlp_hash_cache, KM_SLEEP); 285 } else { 286 hat->hat_num_hash = mmu.hash_cnt; 287 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP); 288 } 289 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *)); 290 291 /* 292 * Initialize Kernel HAT entries at the top of the top level page 293 * tables for the new hat. 294 */ 295 hat->hat_htable = NULL; 296 hat->hat_ht_cached = NULL; 297 XPV_DISALLOW_MIGRATE(); 298 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL); 299 hat->hat_htable = ht; 300 301 #if defined(__amd64) 302 if (hat->hat_flags & HAT_VLP) 303 goto init_done; 304 #endif 305 306 for (r = 0; r < num_kernel_ranges; ++r) { 307 rp = &kernel_ranges[r]; 308 for (va = rp->hkr_start_va; va != rp->hkr_end_va; 309 va += cnt * LEVEL_SIZE(rp->hkr_level)) { 310 311 if (rp->hkr_level == TOP_LEVEL(hat)) 312 ht = hat->hat_htable; 313 else 314 ht = htable_create(hat, va, rp->hkr_level, 315 NULL); 316 317 start = htable_va2entry(va, ht); 318 cnt = HTABLE_NUM_PTES(ht) - start; 319 eva = va + 320 ((uintptr_t)cnt << LEVEL_SHIFT(rp->hkr_level)); 321 if (rp->hkr_end_va != 0 && 322 (eva > rp->hkr_end_va || eva == 0)) 323 cnt = htable_va2entry(rp->hkr_end_va, ht) - 324 start; 325 326 #if defined(__i386) && !defined(__xpv) 327 if (ht->ht_flags & HTABLE_VLP) { 328 bcopy(&vlp_page[start], 329 &hat->hat_vlp_ptes[start], 330 cnt * sizeof (x86pte_t)); 331 continue; 332 } 333 #endif 334 src = htable_lookup(kas.a_hat, va, rp->hkr_level); 335 ASSERT(src != NULL); 336 x86pte_copy(src, ht, start, cnt); 337 htable_release(src); 338 } 339 } 340 341 init_done: 342 343 #if defined(__xpv) 344 /* 345 * Pin top level page tables after initializing them 346 */ 347 xen_pin(hat->hat_htable->ht_pfn, mmu.max_level); 348 #if defined(__amd64) 349 xen_pin(hat->hat_user_ptable, mmu.max_level); 350 #endif 351 #endif 352 XPV_ALLOW_MIGRATE(); 353 354 /* 355 * Put it at the start of the global list of all hats (used by stealing) 356 * 357 * kas.a_hat is not in the list but is instead used to find the 358 * first and last items in the list. 359 * 360 * - kas.a_hat->hat_next points to the start of the user hats. 361 * The list ends where hat->hat_next == NULL 362 * 363 * - kas.a_hat->hat_prev points to the last of the user hats. 364 * The list begins where hat->hat_prev == NULL 365 */ 366 mutex_enter(&hat_list_lock); 367 hat->hat_prev = NULL; 368 hat->hat_next = kas.a_hat->hat_next; 369 if (hat->hat_next) 370 hat->hat_next->hat_prev = hat; 371 else 372 kas.a_hat->hat_prev = hat; 373 kas.a_hat->hat_next = hat; 374 mutex_exit(&hat_list_lock); 375 376 return (hat); 377 } 378 379 /* 380 * process has finished executing but as has not been cleaned up yet. 381 */ 382 /*ARGSUSED*/ 383 void 384 hat_free_start(hat_t *hat) 385 { 386 ASSERT(AS_WRITE_HELD(hat->hat_as, &hat->hat_as->a_lock)); 387 388 /* 389 * If the hat is currently a stealing victim, wait for the stealing 390 * to finish. Once we mark it as HAT_FREEING, htable_steal() 391 * won't look at its pagetables anymore. 392 */ 393 mutex_enter(&hat_list_lock); 394 while (hat->hat_flags & HAT_VICTIM) 395 cv_wait(&hat_list_cv, &hat_list_lock); 396 hat->hat_flags |= HAT_FREEING; 397 mutex_exit(&hat_list_lock); 398 } 399 400 /* 401 * An address space is being destroyed, so we destroy the associated hat. 402 */ 403 void 404 hat_free_end(hat_t *hat) 405 { 406 kmem_cache_t *cache; 407 408 ASSERT(hat->hat_flags & HAT_FREEING); 409 410 /* 411 * must not be running on the given hat 412 */ 413 ASSERT(CPU->cpu_current_hat != hat); 414 415 /* 416 * Remove it from the list of HATs 417 */ 418 mutex_enter(&hat_list_lock); 419 if (hat->hat_prev) 420 hat->hat_prev->hat_next = hat->hat_next; 421 else 422 kas.a_hat->hat_next = hat->hat_next; 423 if (hat->hat_next) 424 hat->hat_next->hat_prev = hat->hat_prev; 425 else 426 kas.a_hat->hat_prev = hat->hat_prev; 427 mutex_exit(&hat_list_lock); 428 hat->hat_next = hat->hat_prev = NULL; 429 430 #if defined(__xpv) 431 /* 432 * On the hypervisor, unpin top level page table(s) 433 */ 434 xen_unpin(hat->hat_htable->ht_pfn); 435 #if defined(__amd64) 436 xen_unpin(hat->hat_user_ptable); 437 #endif 438 #endif 439 440 /* 441 * Make a pass through the htables freeing them all up. 442 */ 443 htable_purge_hat(hat); 444 445 /* 446 * Decide which kmem cache the hash table came from, then free it. 447 */ 448 if (hat->hat_flags & HAT_VLP) 449 cache = vlp_hash_cache; 450 else 451 cache = hat_hash_cache; 452 kmem_cache_free(cache, hat->hat_ht_hash); 453 hat->hat_ht_hash = NULL; 454 455 hat->hat_flags = 0; 456 kmem_cache_free(hat_cache, hat); 457 } 458 459 /* 460 * round kernelbase down to a supported value to use for _userlimit 461 * 462 * userlimit must be aligned down to an entry in the top level htable. 463 * The one exception is for 32 bit HAT's running PAE. 464 */ 465 uintptr_t 466 hat_kernelbase(uintptr_t va) 467 { 468 #if defined(__i386) 469 va &= LEVEL_MASK(1); 470 #endif 471 if (IN_VA_HOLE(va)) 472 panic("_userlimit %p will fall in VA hole\n", (void *)va); 473 return (va); 474 } 475 476 /* 477 * 478 */ 479 static void 480 set_max_page_level() 481 { 482 level_t lvl; 483 484 if (!kbm_largepage_support) { 485 lvl = 0; 486 } else { 487 if (x86_feature & X86_1GPG) { 488 lvl = 2; 489 if (chk_optimal_1gtlb && 490 cpuid_opteron_erratum(CPU, 6671130)) { 491 lvl = 1; 492 } 493 if (plat_mnode_xcheck(LEVEL_SIZE(2) >> 494 LEVEL_SHIFT(0))) { 495 lvl = 1; 496 } 497 } else { 498 lvl = 1; 499 } 500 } 501 mmu.max_page_level = lvl; 502 503 if ((lvl == 2) && (enable_1gpg == 0)) 504 mmu.umax_page_level = 1; 505 else 506 mmu.umax_page_level = lvl; 507 } 508 509 /* 510 * Initialize hat data structures based on processor MMU information. 511 */ 512 void 513 mmu_init(void) 514 { 515 uint_t max_htables; 516 uint_t pa_bits; 517 uint_t va_bits; 518 int i; 519 520 /* 521 * If CPU enabled the page table global bit, use it for the kernel 522 * This is bit 7 in CR4 (PGE - Page Global Enable). 523 */ 524 if ((x86_feature & X86_PGE) != 0 && (getcr4() & CR4_PGE) != 0) 525 mmu.pt_global = PT_GLOBAL; 526 527 /* 528 * Detect NX and PAE usage. 529 */ 530 mmu.pae_hat = kbm_pae_support; 531 if (kbm_nx_support) 532 mmu.pt_nx = PT_NX; 533 else 534 mmu.pt_nx = 0; 535 536 /* 537 * Use CPU info to set various MMU parameters 538 */ 539 cpuid_get_addrsize(CPU, &pa_bits, &va_bits); 540 541 if (va_bits < sizeof (void *) * NBBY) { 542 mmu.hole_start = (1ul << (va_bits - 1)); 543 mmu.hole_end = 0ul - mmu.hole_start - 1; 544 } else { 545 mmu.hole_end = 0; 546 mmu.hole_start = mmu.hole_end - 1; 547 } 548 #if defined(OPTERON_ERRATUM_121) 549 /* 550 * If erratum 121 has already been detected at this time, hole_start 551 * contains the value to be subtracted from mmu.hole_start. 552 */ 553 ASSERT(hole_start == 0 || opteron_erratum_121 != 0); 554 hole_start = mmu.hole_start - hole_start; 555 #else 556 hole_start = mmu.hole_start; 557 #endif 558 hole_end = mmu.hole_end; 559 560 mmu.highest_pfn = mmu_btop((1ull << pa_bits) - 1); 561 if (mmu.pae_hat == 0 && pa_bits > 32) 562 mmu.highest_pfn = PFN_4G - 1; 563 564 if (mmu.pae_hat) { 565 mmu.pte_size = 8; /* 8 byte PTEs */ 566 mmu.pte_size_shift = 3; 567 } else { 568 mmu.pte_size = 4; /* 4 byte PTEs */ 569 mmu.pte_size_shift = 2; 570 } 571 572 if (mmu.pae_hat && (x86_feature & X86_PAE) == 0) 573 panic("Processor does not support PAE"); 574 575 if ((x86_feature & X86_CX8) == 0) 576 panic("Processor does not support cmpxchg8b instruction"); 577 578 #if defined(__amd64) 579 580 mmu.num_level = 4; 581 mmu.max_level = 3; 582 mmu.ptes_per_table = 512; 583 mmu.top_level_count = 512; 584 585 mmu.level_shift[0] = 12; 586 mmu.level_shift[1] = 21; 587 mmu.level_shift[2] = 30; 588 mmu.level_shift[3] = 39; 589 590 #elif defined(__i386) 591 592 if (mmu.pae_hat) { 593 mmu.num_level = 3; 594 mmu.max_level = 2; 595 mmu.ptes_per_table = 512; 596 mmu.top_level_count = 4; 597 598 mmu.level_shift[0] = 12; 599 mmu.level_shift[1] = 21; 600 mmu.level_shift[2] = 30; 601 602 } else { 603 mmu.num_level = 2; 604 mmu.max_level = 1; 605 mmu.ptes_per_table = 1024; 606 mmu.top_level_count = 1024; 607 608 mmu.level_shift[0] = 12; 609 mmu.level_shift[1] = 22; 610 } 611 612 #endif /* __i386 */ 613 614 for (i = 0; i < mmu.num_level; ++i) { 615 mmu.level_size[i] = 1UL << mmu.level_shift[i]; 616 mmu.level_offset[i] = mmu.level_size[i] - 1; 617 mmu.level_mask[i] = ~mmu.level_offset[i]; 618 } 619 620 set_max_page_level(); 621 622 mmu_page_sizes = mmu.max_page_level + 1; 623 mmu_exported_page_sizes = mmu.umax_page_level + 1; 624 625 /* restrict legacy applications from using pagesizes 1g and above */ 626 mmu_legacy_page_sizes = 627 (mmu_exported_page_sizes > 2) ? 2 : mmu_exported_page_sizes; 628 629 630 for (i = 0; i <= mmu.max_page_level; ++i) { 631 mmu.pte_bits[i] = PT_VALID | pt_kern; 632 if (i > 0) 633 mmu.pte_bits[i] |= PT_PAGESIZE; 634 } 635 636 /* 637 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level. 638 */ 639 for (i = 1; i < mmu.num_level; ++i) 640 mmu.ptp_bits[i] = PT_PTPBITS; 641 642 #if defined(__i386) 643 mmu.ptp_bits[2] = PT_VALID; 644 #endif 645 646 /* 647 * Compute how many hash table entries to have per process for htables. 648 * We start with 1 page's worth of entries. 649 * 650 * If physical memory is small, reduce the amount need to cover it. 651 */ 652 max_htables = physmax / mmu.ptes_per_table; 653 mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *); 654 while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables) 655 mmu.hash_cnt >>= 1; 656 mmu.vlp_hash_cnt = mmu.hash_cnt; 657 658 #if defined(__amd64) 659 /* 660 * If running in 64 bits and physical memory is large, 661 * increase the size of the cache to cover all of memory for 662 * a 64 bit process. 663 */ 664 #define HASH_MAX_LENGTH 4 665 while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables) 666 mmu.hash_cnt <<= 1; 667 #endif 668 } 669 670 671 /* 672 * initialize hat data structures 673 */ 674 void 675 hat_init() 676 { 677 #if defined(__i386) 678 /* 679 * _userlimit must be aligned correctly 680 */ 681 if ((_userlimit & LEVEL_MASK(1)) != _userlimit) { 682 prom_printf("hat_init(): _userlimit=%p, not aligned at %p\n", 683 (void *)_userlimit, (void *)LEVEL_SIZE(1)); 684 halt("hat_init(): Unable to continue"); 685 } 686 #endif 687 688 cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL); 689 690 /* 691 * initialize kmem caches 692 */ 693 htable_init(); 694 hment_init(); 695 696 hat_cache = kmem_cache_create("hat_t", 697 sizeof (hat_t), 0, hati_constructor, NULL, NULL, 698 NULL, 0, 0); 699 700 hat_hash_cache = kmem_cache_create("HatHash", 701 mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 702 NULL, 0, 0); 703 704 /* 705 * VLP hats can use a smaller hash table size on large memroy machines 706 */ 707 if (mmu.hash_cnt == mmu.vlp_hash_cnt) { 708 vlp_hash_cache = hat_hash_cache; 709 } else { 710 vlp_hash_cache = kmem_cache_create("HatVlpHash", 711 mmu.vlp_hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 712 NULL, 0, 0); 713 } 714 715 /* 716 * Set up the kernel's hat 717 */ 718 AS_LOCK_ENTER(&kas, &kas.a_lock, RW_WRITER); 719 kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP); 720 mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 721 kas.a_hat->hat_as = &kas; 722 kas.a_hat->hat_flags = 0; 723 AS_LOCK_EXIT(&kas, &kas.a_lock); 724 725 CPUSET_ZERO(khat_cpuset); 726 CPUSET_ADD(khat_cpuset, CPU->cpu_id); 727 728 /* 729 * The kernel hat's next pointer serves as the head of the hat list . 730 * The kernel hat's prev pointer tracks the last hat on the list for 731 * htable_steal() to use. 732 */ 733 kas.a_hat->hat_next = NULL; 734 kas.a_hat->hat_prev = NULL; 735 736 /* 737 * Allocate an htable hash bucket for the kernel 738 * XX64 - tune for 64 bit procs 739 */ 740 kas.a_hat->hat_num_hash = mmu.hash_cnt; 741 kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP); 742 bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *)); 743 744 /* 745 * zero out the top level and cached htable pointers 746 */ 747 kas.a_hat->hat_ht_cached = NULL; 748 kas.a_hat->hat_htable = NULL; 749 750 /* 751 * Pre-allocate hrm_hashtab before enabling the collection of 752 * refmod statistics. Allocating on the fly would mean us 753 * running the risk of suffering recursive mutex enters or 754 * deadlocks. 755 */ 756 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *), 757 KM_SLEEP); 758 } 759 760 /* 761 * Prepare CPU specific pagetables for VLP processes on 64 bit kernels. 762 * 763 * Each CPU has a set of 2 pagetables that are reused for any 32 bit 764 * process it runs. They are the top level pagetable, hci_vlp_l3ptes, and 765 * the next to top level table for the bottom 512 Gig, hci_vlp_l2ptes. 766 */ 767 /*ARGSUSED*/ 768 static void 769 hat_vlp_setup(struct cpu *cpu) 770 { 771 #if defined(__amd64) && !defined(__xpv) 772 struct hat_cpu_info *hci = cpu->cpu_hat_info; 773 pfn_t pfn; 774 775 /* 776 * allocate the level==2 page table for the bottom most 777 * 512Gig of address space (this is where 32 bit apps live) 778 */ 779 ASSERT(hci != NULL); 780 hci->hci_vlp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 781 782 /* 783 * Allocate a top level pagetable and copy the kernel's 784 * entries into it. Then link in hci_vlp_l2ptes in the 1st entry. 785 */ 786 hci->hci_vlp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 787 hci->hci_vlp_pfn = 788 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l3ptes); 789 ASSERT(hci->hci_vlp_pfn != PFN_INVALID); 790 bcopy(vlp_page, hci->hci_vlp_l3ptes, MMU_PAGESIZE); 791 792 pfn = hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l2ptes); 793 ASSERT(pfn != PFN_INVALID); 794 hci->hci_vlp_l3ptes[0] = MAKEPTP(pfn, 2); 795 #endif /* __amd64 && !__xpv */ 796 } 797 798 /*ARGSUSED*/ 799 static void 800 hat_vlp_teardown(cpu_t *cpu) 801 { 802 #if defined(__amd64) && !defined(__xpv) 803 struct hat_cpu_info *hci; 804 805 if ((hci = cpu->cpu_hat_info) == NULL) 806 return; 807 if (hci->hci_vlp_l2ptes) 808 kmem_free(hci->hci_vlp_l2ptes, MMU_PAGESIZE); 809 if (hci->hci_vlp_l3ptes) 810 kmem_free(hci->hci_vlp_l3ptes, MMU_PAGESIZE); 811 #endif 812 } 813 814 #define NEXT_HKR(r, l, s, e) { \ 815 kernel_ranges[r].hkr_level = l; \ 816 kernel_ranges[r].hkr_start_va = s; \ 817 kernel_ranges[r].hkr_end_va = e; \ 818 ++r; \ 819 } 820 821 /* 822 * Finish filling in the kernel hat. 823 * Pre fill in all top level kernel page table entries for the kernel's 824 * part of the address range. From this point on we can't use any new 825 * kernel large pages if they need PTE's at max_level 826 * 827 * create the kmap mappings. 828 */ 829 void 830 hat_init_finish(void) 831 { 832 size_t size; 833 uint_t r = 0; 834 uintptr_t va; 835 hat_kernel_range_t *rp; 836 837 838 /* 839 * We are now effectively running on the kernel hat. 840 * Clearing use_boot_reserve shuts off using the pre-allocated boot 841 * reserve for all HAT allocations. From here on, the reserves are 842 * only used when avoiding recursion in kmem_alloc(). 843 */ 844 use_boot_reserve = 0; 845 htable_adjust_reserve(); 846 847 /* 848 * User HATs are initialized with copies of all kernel mappings in 849 * higher level page tables. Ensure that those entries exist. 850 */ 851 #if defined(__amd64) 852 853 NEXT_HKR(r, 3, kernelbase, 0); 854 #if defined(__xpv) 855 NEXT_HKR(r, 3, HYPERVISOR_VIRT_START, HYPERVISOR_VIRT_END); 856 #endif 857 858 #elif defined(__i386) 859 860 #if !defined(__xpv) 861 if (mmu.pae_hat) { 862 va = kernelbase; 863 if ((va & LEVEL_MASK(2)) != va) { 864 va = P2ROUNDUP(va, LEVEL_SIZE(2)); 865 NEXT_HKR(r, 1, kernelbase, va); 866 } 867 if (va != 0) 868 NEXT_HKR(r, 2, va, 0); 869 } else 870 #endif /* __xpv */ 871 NEXT_HKR(r, 1, kernelbase, 0); 872 873 #endif /* __i386 */ 874 875 num_kernel_ranges = r; 876 877 /* 878 * Create all the kernel pagetables that will have entries 879 * shared to user HATs. 880 */ 881 for (r = 0; r < num_kernel_ranges; ++r) { 882 rp = &kernel_ranges[r]; 883 for (va = rp->hkr_start_va; va != rp->hkr_end_va; 884 va += LEVEL_SIZE(rp->hkr_level)) { 885 htable_t *ht; 886 887 if (IN_HYPERVISOR_VA(va)) 888 continue; 889 890 /* can/must skip if a page mapping already exists */ 891 if (rp->hkr_level <= mmu.max_page_level && 892 (ht = htable_getpage(kas.a_hat, va, NULL)) != 893 NULL) { 894 htable_release(ht); 895 continue; 896 } 897 898 (void) htable_create(kas.a_hat, va, rp->hkr_level - 1, 899 NULL); 900 } 901 } 902 903 /* 904 * 32 bit PAE metal kernels use only 4 of the 512 entries in the 905 * page holding the top level pagetable. We use the remainder for 906 * the "per CPU" page tables for VLP processes. 907 * Map the top level kernel pagetable into the kernel to make 908 * it easy to use bcopy access these tables. 909 */ 910 if (mmu.pae_hat) { 911 vlp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP); 912 hat_devload(kas.a_hat, (caddr_t)vlp_page, MMU_PAGESIZE, 913 kas.a_hat->hat_htable->ht_pfn, 914 #if !defined(__xpv) 915 PROT_WRITE | 916 #endif 917 PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK, 918 HAT_LOAD | HAT_LOAD_NOCONSIST); 919 } 920 hat_vlp_setup(CPU); 921 922 /* 923 * Create kmap (cached mappings of kernel PTEs) 924 * for 32 bit we map from segmap_start .. ekernelheap 925 * for 64 bit we map from segmap_start .. segmap_start + segmapsize; 926 */ 927 #if defined(__i386) 928 size = (uintptr_t)ekernelheap - segmap_start; 929 #elif defined(__amd64) 930 size = segmapsize; 931 #endif 932 hat_kmap_init((uintptr_t)segmap_start, size); 933 } 934 935 /* 936 * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references 937 * are 32 bit, so for safety we must use cas64() to install these. 938 */ 939 #ifdef __i386 940 static void 941 reload_pae32(hat_t *hat, cpu_t *cpu) 942 { 943 x86pte_t *src; 944 x86pte_t *dest; 945 x86pte_t pte; 946 int i; 947 948 /* 949 * Load the 4 entries of the level 2 page table into this 950 * cpu's range of the vlp_page and point cr3 at them. 951 */ 952 ASSERT(mmu.pae_hat); 953 src = hat->hat_vlp_ptes; 954 dest = vlp_page + (cpu->cpu_id + 1) * VLP_NUM_PTES; 955 for (i = 0; i < VLP_NUM_PTES; ++i) { 956 for (;;) { 957 pte = dest[i]; 958 if (pte == src[i]) 959 break; 960 if (cas64(dest + i, pte, src[i]) != src[i]) 961 break; 962 } 963 } 964 } 965 #endif 966 967 /* 968 * Switch to a new active hat, maintaining bit masks to track active CPUs. 969 * 970 * On the 32-bit PAE hypervisor, %cr3 is a 64-bit value, on metal it 971 * remains a 32-bit value. 972 */ 973 void 974 hat_switch(hat_t *hat) 975 { 976 uint64_t newcr3; 977 cpu_t *cpu = CPU; 978 hat_t *old = cpu->cpu_current_hat; 979 980 /* 981 * set up this information first, so we don't miss any cross calls 982 */ 983 if (old != NULL) { 984 if (old == hat) 985 return; 986 if (old != kas.a_hat) 987 CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id); 988 } 989 990 /* 991 * Add this CPU to the active set for this HAT. 992 */ 993 if (hat != kas.a_hat) { 994 CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id); 995 } 996 cpu->cpu_current_hat = hat; 997 998 /* 999 * now go ahead and load cr3 1000 */ 1001 if (hat->hat_flags & HAT_VLP) { 1002 #if defined(__amd64) 1003 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes; 1004 1005 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 1006 newcr3 = MAKECR3(cpu->cpu_hat_info->hci_vlp_pfn); 1007 #elif defined(__i386) 1008 reload_pae32(hat, cpu); 1009 newcr3 = MAKECR3(kas.a_hat->hat_htable->ht_pfn) + 1010 (cpu->cpu_id + 1) * VLP_SIZE; 1011 #endif 1012 } else { 1013 newcr3 = MAKECR3((uint64_t)hat->hat_htable->ht_pfn); 1014 } 1015 #ifdef __xpv 1016 { 1017 struct mmuext_op t[2]; 1018 uint_t retcnt; 1019 uint_t opcnt = 1; 1020 1021 t[0].cmd = MMUEXT_NEW_BASEPTR; 1022 t[0].arg1.mfn = mmu_btop(pa_to_ma(newcr3)); 1023 #if defined(__amd64) 1024 /* 1025 * There's an interesting problem here, as to what to 1026 * actually specify when switching to the kernel hat. 1027 * For now we'll reuse the kernel hat again. 1028 */ 1029 t[1].cmd = MMUEXT_NEW_USER_BASEPTR; 1030 if (hat == kas.a_hat) 1031 t[1].arg1.mfn = mmu_btop(pa_to_ma(newcr3)); 1032 else 1033 t[1].arg1.mfn = pfn_to_mfn(hat->hat_user_ptable); 1034 ++opcnt; 1035 #endif /* __amd64 */ 1036 if (HYPERVISOR_mmuext_op(t, opcnt, &retcnt, DOMID_SELF) < 0) 1037 panic("HYPERVISOR_mmu_update() failed"); 1038 ASSERT(retcnt == opcnt); 1039 1040 } 1041 #else 1042 setcr3(newcr3); 1043 #endif 1044 ASSERT(cpu == CPU); 1045 } 1046 1047 /* 1048 * Utility to return a valid x86pte_t from protections, pfn, and level number 1049 */ 1050 static x86pte_t 1051 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags) 1052 { 1053 x86pte_t pte; 1054 uint_t cache_attr = attr & HAT_ORDER_MASK; 1055 1056 pte = MAKEPTE(pfn, level); 1057 1058 if (attr & PROT_WRITE) 1059 PTE_SET(pte, PT_WRITABLE); 1060 1061 if (attr & PROT_USER) 1062 PTE_SET(pte, PT_USER); 1063 1064 if (!(attr & PROT_EXEC)) 1065 PTE_SET(pte, mmu.pt_nx); 1066 1067 /* 1068 * Set the software bits used track ref/mod sync's and hments. 1069 * If not using REF/MOD, set them to avoid h/w rewriting PTEs. 1070 */ 1071 if (flags & HAT_LOAD_NOCONSIST) 1072 PTE_SET(pte, PT_NOCONSIST | PT_REF | PT_MOD); 1073 else if (attr & HAT_NOSYNC) 1074 PTE_SET(pte, PT_NOSYNC | PT_REF | PT_MOD); 1075 1076 /* 1077 * Set the caching attributes in the PTE. The combination 1078 * of attributes are poorly defined, so we pay attention 1079 * to them in the given order. 1080 * 1081 * The test for HAT_STRICTORDER is different because it's defined 1082 * as "0" - which was a stupid thing to do, but is too late to change! 1083 */ 1084 if (cache_attr == HAT_STRICTORDER) { 1085 PTE_SET(pte, PT_NOCACHE); 1086 /*LINTED [Lint hates empty ifs, but it's the obvious way to do this] */ 1087 } else if (cache_attr & (HAT_UNORDERED_OK | HAT_STORECACHING_OK)) { 1088 /* nothing to set */; 1089 } else if (cache_attr & (HAT_MERGING_OK | HAT_LOADCACHING_OK)) { 1090 PTE_SET(pte, PT_NOCACHE); 1091 if (x86_feature & X86_PAT) 1092 PTE_SET(pte, (level == 0) ? PT_PAT_4K : PT_PAT_LARGE); 1093 else 1094 PTE_SET(pte, PT_WRITETHRU); 1095 } else { 1096 panic("hati_mkpte(): bad caching attributes: %x\n", cache_attr); 1097 } 1098 1099 return (pte); 1100 } 1101 1102 /* 1103 * Duplicate address translations of the parent to the child. 1104 * This function really isn't used anymore. 1105 */ 1106 /*ARGSUSED*/ 1107 int 1108 hat_dup(hat_t *old, hat_t *new, caddr_t addr, size_t len, uint_t flag) 1109 { 1110 ASSERT((uintptr_t)addr < kernelbase); 1111 ASSERT(new != kas.a_hat); 1112 ASSERT(old != kas.a_hat); 1113 return (0); 1114 } 1115 1116 /* 1117 * Allocate any hat resources required for a process being swapped in. 1118 */ 1119 /*ARGSUSED*/ 1120 void 1121 hat_swapin(hat_t *hat) 1122 { 1123 /* do nothing - we let everything fault back in */ 1124 } 1125 1126 /* 1127 * Unload all translations associated with an address space of a process 1128 * that is being swapped out. 1129 */ 1130 void 1131 hat_swapout(hat_t *hat) 1132 { 1133 uintptr_t vaddr = (uintptr_t)0; 1134 uintptr_t eaddr = _userlimit; 1135 htable_t *ht = NULL; 1136 level_t l; 1137 1138 XPV_DISALLOW_MIGRATE(); 1139 /* 1140 * We can't just call hat_unload(hat, 0, _userlimit...) here, because 1141 * seg_spt and shared pagetables can't be swapped out. 1142 * Take a look at segspt_shmswapout() - it's a big no-op. 1143 * 1144 * Instead we'll walk through all the address space and unload 1145 * any mappings which we are sure are not shared, not locked. 1146 */ 1147 ASSERT(IS_PAGEALIGNED(vaddr)); 1148 ASSERT(IS_PAGEALIGNED(eaddr)); 1149 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1150 if ((uintptr_t)hat->hat_as->a_userlimit < eaddr) 1151 eaddr = (uintptr_t)hat->hat_as->a_userlimit; 1152 1153 while (vaddr < eaddr) { 1154 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1155 if (ht == NULL) 1156 break; 1157 1158 ASSERT(!IN_VA_HOLE(vaddr)); 1159 1160 /* 1161 * If the page table is shared skip its entire range. 1162 */ 1163 l = ht->ht_level; 1164 if (ht->ht_flags & HTABLE_SHARED_PFN) { 1165 vaddr = ht->ht_vaddr + LEVEL_SIZE(l + 1); 1166 htable_release(ht); 1167 ht = NULL; 1168 continue; 1169 } 1170 1171 /* 1172 * If the page table has no locked entries, unload this one. 1173 */ 1174 if (ht->ht_lock_cnt == 0) 1175 hat_unload(hat, (caddr_t)vaddr, LEVEL_SIZE(l), 1176 HAT_UNLOAD_UNMAP); 1177 1178 /* 1179 * If we have a level 0 page table with locked entries, 1180 * skip the entire page table, otherwise skip just one entry. 1181 */ 1182 if (ht->ht_lock_cnt > 0 && l == 0) 1183 vaddr = ht->ht_vaddr + LEVEL_SIZE(1); 1184 else 1185 vaddr += LEVEL_SIZE(l); 1186 } 1187 if (ht) 1188 htable_release(ht); 1189 1190 /* 1191 * We're in swapout because the system is low on memory, so 1192 * go back and flush all the htables off the cached list. 1193 */ 1194 htable_purge_hat(hat); 1195 XPV_ALLOW_MIGRATE(); 1196 } 1197 1198 /* 1199 * returns number of bytes that have valid mappings in hat. 1200 */ 1201 size_t 1202 hat_get_mapped_size(hat_t *hat) 1203 { 1204 size_t total = 0; 1205 int l; 1206 1207 for (l = 0; l <= mmu.max_page_level; l++) 1208 total += (hat->hat_pages_mapped[l] << LEVEL_SHIFT(l)); 1209 total += hat->hat_ism_pgcnt; 1210 1211 return (total); 1212 } 1213 1214 /* 1215 * enable/disable collection of stats for hat. 1216 */ 1217 int 1218 hat_stats_enable(hat_t *hat) 1219 { 1220 atomic_add_32(&hat->hat_stats, 1); 1221 return (1); 1222 } 1223 1224 void 1225 hat_stats_disable(hat_t *hat) 1226 { 1227 atomic_add_32(&hat->hat_stats, -1); 1228 } 1229 1230 /* 1231 * Utility to sync the ref/mod bits from a page table entry to the page_t 1232 * We must be holding the mapping list lock when this is called. 1233 */ 1234 static void 1235 hati_sync_pte_to_page(page_t *pp, x86pte_t pte, level_t level) 1236 { 1237 uint_t rm = 0; 1238 pgcnt_t pgcnt; 1239 1240 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 1241 return; 1242 1243 if (PTE_GET(pte, PT_REF)) 1244 rm |= P_REF; 1245 1246 if (PTE_GET(pte, PT_MOD)) 1247 rm |= P_MOD; 1248 1249 if (rm == 0) 1250 return; 1251 1252 /* 1253 * sync to all constituent pages of a large page 1254 */ 1255 ASSERT(x86_hm_held(pp)); 1256 pgcnt = page_get_pagecnt(level); 1257 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 1258 for (; pgcnt > 0; --pgcnt) { 1259 /* 1260 * hat_page_demote() can't decrease 1261 * pszc below this mapping size 1262 * since this large mapping existed after we 1263 * took mlist lock. 1264 */ 1265 ASSERT(pp->p_szc >= level); 1266 hat_page_setattr(pp, rm); 1267 ++pp; 1268 } 1269 } 1270 1271 /* 1272 * This the set of PTE bits for PFN, permissions and caching 1273 * that are allowed to change on a HAT_LOAD_REMAP 1274 */ 1275 #define PT_REMAP_BITS \ 1276 (PT_PADDR | PT_NX | PT_WRITABLE | PT_WRITETHRU | \ 1277 PT_NOCACHE | PT_PAT_4K | PT_PAT_LARGE | PT_IGNORE | PT_REF | PT_MOD) 1278 1279 #define REMAPASSERT(EX) if (!(EX)) panic("hati_pte_map: " #EX) 1280 /* 1281 * Do the low-level work to get a mapping entered into a HAT's pagetables 1282 * and in the mapping list of the associated page_t. 1283 */ 1284 static int 1285 hati_pte_map( 1286 htable_t *ht, 1287 uint_t entry, 1288 page_t *pp, 1289 x86pte_t pte, 1290 int flags, 1291 void *pte_ptr) 1292 { 1293 hat_t *hat = ht->ht_hat; 1294 x86pte_t old_pte; 1295 level_t l = ht->ht_level; 1296 hment_t *hm; 1297 uint_t is_consist; 1298 int rv = 0; 1299 1300 /* 1301 * Is this a consistant (ie. need mapping list lock) mapping? 1302 */ 1303 is_consist = (pp != NULL && (flags & HAT_LOAD_NOCONSIST) == 0); 1304 1305 /* 1306 * Track locked mapping count in the htable. Do this first, 1307 * as we track locking even if there already is a mapping present. 1308 */ 1309 if ((flags & HAT_LOAD_LOCK) != 0 && hat != kas.a_hat) 1310 HTABLE_LOCK_INC(ht); 1311 1312 /* 1313 * Acquire the page's mapping list lock and get an hment to use. 1314 * Note that hment_prepare() might return NULL. 1315 */ 1316 if (is_consist) { 1317 x86_hm_enter(pp); 1318 hm = hment_prepare(ht, entry, pp); 1319 } 1320 1321 /* 1322 * Set the new pte, retrieving the old one at the same time. 1323 */ 1324 old_pte = x86pte_set(ht, entry, pte, pte_ptr); 1325 1326 /* 1327 * did we get a large page / page table collision? 1328 */ 1329 if (old_pte == LPAGE_ERROR) { 1330 rv = -1; 1331 goto done; 1332 } 1333 1334 /* 1335 * If the mapping didn't change there is nothing more to do. 1336 */ 1337 if (PTE_EQUIV(pte, old_pte)) 1338 goto done; 1339 1340 /* 1341 * Install a new mapping in the page's mapping list 1342 */ 1343 if (!PTE_ISVALID(old_pte)) { 1344 if (is_consist) { 1345 hment_assign(ht, entry, pp, hm); 1346 x86_hm_exit(pp); 1347 } else { 1348 ASSERT(flags & HAT_LOAD_NOCONSIST); 1349 } 1350 #if defined(__amd64) 1351 if (ht->ht_flags & HTABLE_VLP) { 1352 cpu_t *cpu = CPU; 1353 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes; 1354 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 1355 } 1356 #endif 1357 HTABLE_INC(ht->ht_valid_cnt); 1358 PGCNT_INC(hat, l); 1359 return (rv); 1360 } 1361 1362 /* 1363 * Remap's are more complicated: 1364 * - HAT_LOAD_REMAP must be specified if changing the pfn. 1365 * We also require that NOCONSIST be specified. 1366 * - Otherwise only permission or caching bits may change. 1367 */ 1368 if (!PTE_ISPAGE(old_pte, l)) 1369 panic("non-null/page mapping pte=" FMT_PTE, old_pte); 1370 1371 if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) { 1372 REMAPASSERT(flags & HAT_LOAD_REMAP); 1373 REMAPASSERT(flags & HAT_LOAD_NOCONSIST); 1374 REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 1375 REMAPASSERT(pf_is_memory(PTE2PFN(old_pte, l)) == 1376 pf_is_memory(PTE2PFN(pte, l))); 1377 REMAPASSERT(!is_consist); 1378 } 1379 1380 /* 1381 * We only let remaps change the certain bits in the PTE. 1382 */ 1383 if (PTE_GET(old_pte, ~PT_REMAP_BITS) != PTE_GET(pte, ~PT_REMAP_BITS)) 1384 panic("remap bits changed: old_pte="FMT_PTE", pte="FMT_PTE"\n", 1385 old_pte, pte); 1386 1387 /* 1388 * We don't create any mapping list entries on a remap, so release 1389 * any allocated hment after we drop the mapping list lock. 1390 */ 1391 done: 1392 if (is_consist) { 1393 x86_hm_exit(pp); 1394 if (hm != NULL) 1395 hment_free(hm); 1396 } 1397 return (rv); 1398 } 1399 1400 /* 1401 * Internal routine to load a single page table entry. This only fails if 1402 * we attempt to overwrite a page table link with a large page. 1403 */ 1404 static int 1405 hati_load_common( 1406 hat_t *hat, 1407 uintptr_t va, 1408 page_t *pp, 1409 uint_t attr, 1410 uint_t flags, 1411 level_t level, 1412 pfn_t pfn) 1413 { 1414 htable_t *ht; 1415 uint_t entry; 1416 x86pte_t pte; 1417 int rv = 0; 1418 1419 /* 1420 * The number 16 is arbitrary and here to catch a recursion problem 1421 * early before we blow out the kernel stack. 1422 */ 1423 ++curthread->t_hatdepth; 1424 ASSERT(curthread->t_hatdepth < 16); 1425 1426 ASSERT(hat == kas.a_hat || 1427 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1428 1429 if (flags & HAT_LOAD_SHARE) 1430 hat->hat_flags |= HAT_SHARED; 1431 1432 /* 1433 * Find the page table that maps this page if it already exists. 1434 */ 1435 ht = htable_lookup(hat, va, level); 1436 1437 /* 1438 * We must have HAT_LOAD_NOCONSIST if page_t is NULL. 1439 */ 1440 if (pp == NULL) 1441 flags |= HAT_LOAD_NOCONSIST; 1442 1443 if (ht == NULL) { 1444 ht = htable_create(hat, va, level, NULL); 1445 ASSERT(ht != NULL); 1446 } 1447 entry = htable_va2entry(va, ht); 1448 1449 /* 1450 * a bunch of paranoid error checking 1451 */ 1452 ASSERT(ht->ht_busy > 0); 1453 if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht)) 1454 panic("hati_load_common: bad htable %p, va %p", 1455 (void *)ht, (void *)va); 1456 ASSERT(ht->ht_level == level); 1457 1458 /* 1459 * construct the new PTE 1460 */ 1461 if (hat == kas.a_hat) 1462 attr &= ~PROT_USER; 1463 pte = hati_mkpte(pfn, attr, level, flags); 1464 if (hat == kas.a_hat && va >= kernelbase) 1465 PTE_SET(pte, mmu.pt_global); 1466 1467 /* 1468 * establish the mapping 1469 */ 1470 rv = hati_pte_map(ht, entry, pp, pte, flags, NULL); 1471 1472 /* 1473 * release the htable and any reserves 1474 */ 1475 htable_release(ht); 1476 --curthread->t_hatdepth; 1477 return (rv); 1478 } 1479 1480 /* 1481 * special case of hat_memload to deal with some kernel addrs for performance 1482 */ 1483 static void 1484 hat_kmap_load( 1485 caddr_t addr, 1486 page_t *pp, 1487 uint_t attr, 1488 uint_t flags) 1489 { 1490 uintptr_t va = (uintptr_t)addr; 1491 x86pte_t pte; 1492 pfn_t pfn = page_pptonum(pp); 1493 pgcnt_t pg_off = mmu_btop(va - mmu.kmap_addr); 1494 htable_t *ht; 1495 uint_t entry; 1496 void *pte_ptr; 1497 1498 /* 1499 * construct the requested PTE 1500 */ 1501 attr &= ~PROT_USER; 1502 attr |= HAT_STORECACHING_OK; 1503 pte = hati_mkpte(pfn, attr, 0, flags); 1504 PTE_SET(pte, mmu.pt_global); 1505 1506 /* 1507 * Figure out the pte_ptr and htable and use common code to finish up 1508 */ 1509 if (mmu.pae_hat) 1510 pte_ptr = mmu.kmap_ptes + pg_off; 1511 else 1512 pte_ptr = (x86pte32_t *)mmu.kmap_ptes + pg_off; 1513 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) >> 1514 LEVEL_SHIFT(1)]; 1515 entry = htable_va2entry(va, ht); 1516 ++curthread->t_hatdepth; 1517 ASSERT(curthread->t_hatdepth < 16); 1518 (void) hati_pte_map(ht, entry, pp, pte, flags, pte_ptr); 1519 --curthread->t_hatdepth; 1520 } 1521 1522 /* 1523 * hat_memload() - load a translation to the given page struct 1524 * 1525 * Flags for hat_memload/hat_devload/hat_*attr. 1526 * 1527 * HAT_LOAD Default flags to load a translation to the page. 1528 * 1529 * HAT_LOAD_LOCK Lock down mapping resources; hat_map(), hat_memload(), 1530 * and hat_devload(). 1531 * 1532 * HAT_LOAD_NOCONSIST Do not add mapping to page_t mapping list. 1533 * sets PT_NOCONSIST 1534 * 1535 * HAT_LOAD_SHARE A flag to hat_memload() to indicate h/w page tables 1536 * that map some user pages (not kas) is shared by more 1537 * than one process (eg. ISM). 1538 * 1539 * HAT_LOAD_REMAP Reload a valid pte with a different page frame. 1540 * 1541 * HAT_NO_KALLOC Do not kmem_alloc while creating the mapping; at this 1542 * point, it's setting up mapping to allocate internal 1543 * hat layer data structures. This flag forces hat layer 1544 * to tap its reserves in order to prevent infinite 1545 * recursion. 1546 * 1547 * The following is a protection attribute (like PROT_READ, etc.) 1548 * 1549 * HAT_NOSYNC set PT_NOSYNC - this mapping's ref/mod bits 1550 * are never cleared. 1551 * 1552 * Installing new valid PTE's and creation of the mapping list 1553 * entry are controlled under the same lock. It's derived from the 1554 * page_t being mapped. 1555 */ 1556 static uint_t supported_memload_flags = 1557 HAT_LOAD | HAT_LOAD_LOCK | HAT_LOAD_ADV | HAT_LOAD_NOCONSIST | 1558 HAT_LOAD_SHARE | HAT_NO_KALLOC | HAT_LOAD_REMAP | HAT_LOAD_TEXT; 1559 1560 void 1561 hat_memload( 1562 hat_t *hat, 1563 caddr_t addr, 1564 page_t *pp, 1565 uint_t attr, 1566 uint_t flags) 1567 { 1568 uintptr_t va = (uintptr_t)addr; 1569 level_t level = 0; 1570 pfn_t pfn = page_pptonum(pp); 1571 1572 XPV_DISALLOW_MIGRATE(); 1573 ASSERT(IS_PAGEALIGNED(va)); 1574 ASSERT(hat == kas.a_hat || va < _userlimit); 1575 ASSERT(hat == kas.a_hat || 1576 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1577 ASSERT((flags & supported_memload_flags) == flags); 1578 1579 ASSERT(!IN_VA_HOLE(va)); 1580 ASSERT(!PP_ISFREE(pp)); 1581 1582 /* 1583 * kernel address special case for performance. 1584 */ 1585 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 1586 ASSERT(hat == kas.a_hat); 1587 hat_kmap_load(addr, pp, attr, flags); 1588 XPV_ALLOW_MIGRATE(); 1589 return; 1590 } 1591 1592 /* 1593 * This is used for memory with normal caching enabled, so 1594 * always set HAT_STORECACHING_OK. 1595 */ 1596 attr |= HAT_STORECACHING_OK; 1597 if (hati_load_common(hat, va, pp, attr, flags, level, pfn) != 0) 1598 panic("unexpected hati_load_common() failure"); 1599 XPV_ALLOW_MIGRATE(); 1600 } 1601 1602 /* ARGSUSED */ 1603 void 1604 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp, 1605 uint_t attr, uint_t flags, hat_region_cookie_t rcookie) 1606 { 1607 hat_memload(hat, addr, pp, attr, flags); 1608 } 1609 1610 /* 1611 * Load the given array of page structs using large pages when possible 1612 */ 1613 void 1614 hat_memload_array( 1615 hat_t *hat, 1616 caddr_t addr, 1617 size_t len, 1618 page_t **pages, 1619 uint_t attr, 1620 uint_t flags) 1621 { 1622 uintptr_t va = (uintptr_t)addr; 1623 uintptr_t eaddr = va + len; 1624 level_t level; 1625 size_t pgsize; 1626 pgcnt_t pgindx = 0; 1627 pfn_t pfn; 1628 pgcnt_t i; 1629 1630 XPV_DISALLOW_MIGRATE(); 1631 ASSERT(IS_PAGEALIGNED(va)); 1632 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 1633 ASSERT(hat == kas.a_hat || 1634 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1635 ASSERT((flags & supported_memload_flags) == flags); 1636 1637 /* 1638 * memload is used for memory with full caching enabled, so 1639 * set HAT_STORECACHING_OK. 1640 */ 1641 attr |= HAT_STORECACHING_OK; 1642 1643 /* 1644 * handle all pages using largest possible pagesize 1645 */ 1646 while (va < eaddr) { 1647 /* 1648 * decide what level mapping to use (ie. pagesize) 1649 */ 1650 pfn = page_pptonum(pages[pgindx]); 1651 for (level = mmu.max_page_level; ; --level) { 1652 pgsize = LEVEL_SIZE(level); 1653 if (level == 0) 1654 break; 1655 1656 if (!IS_P2ALIGNED(va, pgsize) || 1657 (eaddr - va) < pgsize || 1658 !IS_P2ALIGNED(pfn_to_pa(pfn), pgsize)) 1659 continue; 1660 1661 /* 1662 * To use a large mapping of this size, all the 1663 * pages we are passed must be sequential subpages 1664 * of the large page. 1665 * hat_page_demote() can't change p_szc because 1666 * all pages are locked. 1667 */ 1668 if (pages[pgindx]->p_szc >= level) { 1669 for (i = 0; i < mmu_btop(pgsize); ++i) { 1670 if (pfn + i != 1671 page_pptonum(pages[pgindx + i])) 1672 break; 1673 ASSERT(pages[pgindx + i]->p_szc >= 1674 level); 1675 ASSERT(pages[pgindx] + i == 1676 pages[pgindx + i]); 1677 } 1678 if (i == mmu_btop(pgsize)) { 1679 #ifdef DEBUG 1680 if (level == 2) 1681 map1gcnt++; 1682 #endif 1683 break; 1684 } 1685 } 1686 } 1687 1688 /* 1689 * Load this page mapping. If the load fails, try a smaller 1690 * pagesize. 1691 */ 1692 ASSERT(!IN_VA_HOLE(va)); 1693 while (hati_load_common(hat, va, pages[pgindx], attr, 1694 flags, level, pfn) != 0) { 1695 if (level == 0) 1696 panic("unexpected hati_load_common() failure"); 1697 --level; 1698 pgsize = LEVEL_SIZE(level); 1699 } 1700 1701 /* 1702 * move to next page 1703 */ 1704 va += pgsize; 1705 pgindx += mmu_btop(pgsize); 1706 } 1707 XPV_ALLOW_MIGRATE(); 1708 } 1709 1710 /* ARGSUSED */ 1711 void 1712 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len, 1713 struct page **pps, uint_t attr, uint_t flags, 1714 hat_region_cookie_t rcookie) 1715 { 1716 hat_memload_array(hat, addr, len, pps, attr, flags); 1717 } 1718 1719 /* 1720 * void hat_devload(hat, addr, len, pf, attr, flags) 1721 * load/lock the given page frame number 1722 * 1723 * Advisory ordering attributes. Apply only to device mappings. 1724 * 1725 * HAT_STRICTORDER: the CPU must issue the references in order, as the 1726 * programmer specified. This is the default. 1727 * HAT_UNORDERED_OK: the CPU may reorder the references (this is all kinds 1728 * of reordering; store or load with store or load). 1729 * HAT_MERGING_OK: merging and batching: the CPU may merge individual stores 1730 * to consecutive locations (for example, turn two consecutive byte 1731 * stores into one halfword store), and it may batch individual loads 1732 * (for example, turn two consecutive byte loads into one halfword load). 1733 * This also implies re-ordering. 1734 * HAT_LOADCACHING_OK: the CPU may cache the data it fetches and reuse it 1735 * until another store occurs. The default is to fetch new data 1736 * on every load. This also implies merging. 1737 * HAT_STORECACHING_OK: the CPU may keep the data in the cache and push it to 1738 * the device (perhaps with other data) at a later time. The default is 1739 * to push the data right away. This also implies load caching. 1740 * 1741 * Equivalent of hat_memload(), but can be used for device memory where 1742 * there are no page_t's and we support additional flags (write merging, etc). 1743 * Note that we can have large page mappings with this interface. 1744 */ 1745 int supported_devload_flags = HAT_LOAD | HAT_LOAD_LOCK | 1746 HAT_LOAD_NOCONSIST | HAT_STRICTORDER | HAT_UNORDERED_OK | 1747 HAT_MERGING_OK | HAT_LOADCACHING_OK | HAT_STORECACHING_OK; 1748 1749 void 1750 hat_devload( 1751 hat_t *hat, 1752 caddr_t addr, 1753 size_t len, 1754 pfn_t pfn, 1755 uint_t attr, 1756 int flags) 1757 { 1758 uintptr_t va = ALIGN2PAGE(addr); 1759 uintptr_t eva = va + len; 1760 level_t level; 1761 size_t pgsize; 1762 page_t *pp; 1763 int f; /* per PTE copy of flags - maybe modified */ 1764 uint_t a; /* per PTE copy of attr */ 1765 1766 XPV_DISALLOW_MIGRATE(); 1767 ASSERT(IS_PAGEALIGNED(va)); 1768 ASSERT(hat == kas.a_hat || eva <= _userlimit); 1769 ASSERT(hat == kas.a_hat || 1770 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1771 ASSERT((flags & supported_devload_flags) == flags); 1772 1773 /* 1774 * handle all pages 1775 */ 1776 while (va < eva) { 1777 1778 /* 1779 * decide what level mapping to use (ie. pagesize) 1780 */ 1781 for (level = mmu.max_page_level; ; --level) { 1782 pgsize = LEVEL_SIZE(level); 1783 if (level == 0) 1784 break; 1785 if (IS_P2ALIGNED(va, pgsize) && 1786 (eva - va) >= pgsize && 1787 IS_P2ALIGNED(pfn, mmu_btop(pgsize))) { 1788 #ifdef DEBUG 1789 if (level == 2) 1790 map1gcnt++; 1791 #endif 1792 break; 1793 } 1794 } 1795 1796 /* 1797 * If this is just memory then allow caching (this happens 1798 * for the nucleus pages) - though HAT_PLAT_NOCACHE can be used 1799 * to override that. If we don't have a page_t then make sure 1800 * NOCONSIST is set. 1801 */ 1802 a = attr; 1803 f = flags; 1804 if (!pf_is_memory(pfn)) 1805 f |= HAT_LOAD_NOCONSIST; 1806 else if (!(a & HAT_PLAT_NOCACHE)) 1807 a |= HAT_STORECACHING_OK; 1808 1809 if (f & HAT_LOAD_NOCONSIST) 1810 pp = NULL; 1811 else 1812 pp = page_numtopp_nolock(pfn); 1813 1814 /* 1815 * load this page mapping 1816 */ 1817 ASSERT(!IN_VA_HOLE(va)); 1818 while (hati_load_common(hat, va, pp, a, f, level, pfn) != 0) { 1819 if (level == 0) 1820 panic("unexpected hati_load_common() failure"); 1821 --level; 1822 pgsize = LEVEL_SIZE(level); 1823 } 1824 1825 /* 1826 * move to next page 1827 */ 1828 va += pgsize; 1829 pfn += mmu_btop(pgsize); 1830 } 1831 XPV_ALLOW_MIGRATE(); 1832 } 1833 1834 /* 1835 * void hat_unlock(hat, addr, len) 1836 * unlock the mappings to a given range of addresses 1837 * 1838 * Locks are tracked by ht_lock_cnt in the htable. 1839 */ 1840 void 1841 hat_unlock(hat_t *hat, caddr_t addr, size_t len) 1842 { 1843 uintptr_t vaddr = (uintptr_t)addr; 1844 uintptr_t eaddr = vaddr + len; 1845 htable_t *ht = NULL; 1846 1847 /* 1848 * kernel entries are always locked, we don't track lock counts 1849 */ 1850 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 1851 ASSERT(IS_PAGEALIGNED(vaddr)); 1852 ASSERT(IS_PAGEALIGNED(eaddr)); 1853 if (hat == kas.a_hat) 1854 return; 1855 if (eaddr > _userlimit) 1856 panic("hat_unlock() address out of range - above _userlimit"); 1857 1858 XPV_DISALLOW_MIGRATE(); 1859 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1860 while (vaddr < eaddr) { 1861 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1862 if (ht == NULL) 1863 break; 1864 1865 ASSERT(!IN_VA_HOLE(vaddr)); 1866 1867 if (ht->ht_lock_cnt < 1) 1868 panic("hat_unlock(): lock_cnt < 1, " 1869 "htable=%p, vaddr=%p\n", (void *)ht, (void *)vaddr); 1870 HTABLE_LOCK_DEC(ht); 1871 1872 vaddr += LEVEL_SIZE(ht->ht_level); 1873 } 1874 if (ht) 1875 htable_release(ht); 1876 XPV_ALLOW_MIGRATE(); 1877 } 1878 1879 /* ARGSUSED */ 1880 void 1881 hat_unlock_region(struct hat *hat, caddr_t addr, size_t len, 1882 hat_region_cookie_t rcookie) 1883 { 1884 panic("No shared region support on x86"); 1885 } 1886 1887 #if !defined(__xpv) 1888 /* 1889 * Cross call service routine to demap a virtual page on 1890 * the current CPU or flush all mappings in TLB. 1891 */ 1892 /*ARGSUSED*/ 1893 static int 1894 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3) 1895 { 1896 hat_t *hat = (hat_t *)a1; 1897 caddr_t addr = (caddr_t)a2; 1898 1899 /* 1900 * If the target hat isn't the kernel and this CPU isn't operating 1901 * in the target hat, we can ignore the cross call. 1902 */ 1903 if (hat != kas.a_hat && hat != CPU->cpu_current_hat) 1904 return (0); 1905 1906 /* 1907 * For a normal address, we just flush one page mapping 1908 */ 1909 if ((uintptr_t)addr != DEMAP_ALL_ADDR) { 1910 mmu_tlbflush_entry(addr); 1911 return (0); 1912 } 1913 1914 /* 1915 * Otherwise we reload cr3 to effect a complete TLB flush. 1916 * 1917 * A reload of cr3 on a VLP process also means we must also recopy in 1918 * the pte values from the struct hat 1919 */ 1920 if (hat->hat_flags & HAT_VLP) { 1921 #if defined(__amd64) 1922 x86pte_t *vlpptep = CPU->cpu_hat_info->hci_vlp_l2ptes; 1923 1924 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 1925 #elif defined(__i386) 1926 reload_pae32(hat, CPU); 1927 #endif 1928 } 1929 reload_cr3(); 1930 return (0); 1931 } 1932 1933 /* 1934 * Flush all TLB entries, including global (ie. kernel) ones. 1935 */ 1936 static void 1937 flush_all_tlb_entries(void) 1938 { 1939 ulong_t cr4 = getcr4(); 1940 1941 if (cr4 & CR4_PGE) { 1942 setcr4(cr4 & ~(ulong_t)CR4_PGE); 1943 setcr4(cr4); 1944 1945 /* 1946 * 32 bit PAE also needs to always reload_cr3() 1947 */ 1948 if (mmu.max_level == 2) 1949 reload_cr3(); 1950 } else { 1951 reload_cr3(); 1952 } 1953 } 1954 1955 #define TLB_CPU_HALTED (01ul) 1956 #define TLB_INVAL_ALL (02ul) 1957 #define CAS_TLB_INFO(cpu, old, new) \ 1958 caslong((ulong_t *)&(cpu)->cpu_m.mcpu_tlb_info, (old), (new)) 1959 1960 /* 1961 * Record that a CPU is going idle 1962 */ 1963 void 1964 tlb_going_idle(void) 1965 { 1966 atomic_or_long((ulong_t *)&CPU->cpu_m.mcpu_tlb_info, TLB_CPU_HALTED); 1967 } 1968 1969 /* 1970 * Service a delayed TLB flush if coming out of being idle. 1971 */ 1972 void 1973 tlb_service(void) 1974 { 1975 ulong_t flags = getflags(); 1976 ulong_t tlb_info; 1977 ulong_t found; 1978 1979 /* 1980 * Be sure interrupts are off while doing this so that 1981 * higher level interrupts correctly wait for flushes to finish. 1982 */ 1983 if (flags & PS_IE) 1984 flags = intr_clear(); 1985 1986 /* 1987 * We only have to do something if coming out of being idle. 1988 */ 1989 tlb_info = CPU->cpu_m.mcpu_tlb_info; 1990 if (tlb_info & TLB_CPU_HALTED) { 1991 ASSERT(CPU->cpu_current_hat == kas.a_hat); 1992 1993 /* 1994 * Atomic clear and fetch of old state. 1995 */ 1996 while ((found = CAS_TLB_INFO(CPU, tlb_info, 0)) != tlb_info) { 1997 ASSERT(found & TLB_CPU_HALTED); 1998 tlb_info = found; 1999 SMT_PAUSE(); 2000 } 2001 if (tlb_info & TLB_INVAL_ALL) 2002 flush_all_tlb_entries(); 2003 } 2004 2005 /* 2006 * Restore interrupt enable control bit. 2007 */ 2008 if (flags & PS_IE) 2009 sti(); 2010 } 2011 #endif /* !__xpv */ 2012 2013 /* 2014 * Internal routine to do cross calls to invalidate a range of pages on 2015 * all CPUs using a given hat. 2016 */ 2017 void 2018 hat_tlb_inval(hat_t *hat, uintptr_t va) 2019 { 2020 extern int flushes_require_xcalls; /* from mp_startup.c */ 2021 cpuset_t justme; 2022 cpuset_t cpus_to_shootdown; 2023 #ifndef __xpv 2024 cpuset_t check_cpus; 2025 cpu_t *cpup; 2026 int c; 2027 #endif 2028 2029 /* 2030 * If the hat is being destroyed, there are no more users, so 2031 * demap need not do anything. 2032 */ 2033 if (hat->hat_flags & HAT_FREEING) 2034 return; 2035 2036 /* 2037 * If demapping from a shared pagetable, we best demap the 2038 * entire set of user TLBs, since we don't know what addresses 2039 * these were shared at. 2040 */ 2041 if (hat->hat_flags & HAT_SHARED) { 2042 hat = kas.a_hat; 2043 va = DEMAP_ALL_ADDR; 2044 } 2045 2046 /* 2047 * if not running with multiple CPUs, don't use cross calls 2048 */ 2049 if (panicstr || !flushes_require_xcalls) { 2050 #ifdef __xpv 2051 if (va == DEMAP_ALL_ADDR) 2052 xen_flush_tlb(); 2053 else 2054 xen_flush_va((caddr_t)va); 2055 #else 2056 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 2057 #endif 2058 return; 2059 } 2060 2061 2062 /* 2063 * Determine CPUs to shootdown. Kernel changes always do all CPUs. 2064 * Otherwise it's just CPUs currently executing in this hat. 2065 */ 2066 kpreempt_disable(); 2067 CPUSET_ONLY(justme, CPU->cpu_id); 2068 if (hat == kas.a_hat) 2069 cpus_to_shootdown = khat_cpuset; 2070 else 2071 cpus_to_shootdown = hat->hat_cpus; 2072 2073 #ifndef __xpv 2074 /* 2075 * If any CPUs in the set are idle, just request a delayed flush 2076 * and avoid waking them up. 2077 */ 2078 check_cpus = cpus_to_shootdown; 2079 for (c = 0; c < NCPU && !CPUSET_ISNULL(check_cpus); ++c) { 2080 ulong_t tlb_info; 2081 2082 if (!CPU_IN_SET(check_cpus, c)) 2083 continue; 2084 CPUSET_DEL(check_cpus, c); 2085 cpup = cpu[c]; 2086 if (cpup == NULL) 2087 continue; 2088 2089 tlb_info = cpup->cpu_m.mcpu_tlb_info; 2090 while (tlb_info == TLB_CPU_HALTED) { 2091 (void) CAS_TLB_INFO(cpup, TLB_CPU_HALTED, 2092 TLB_CPU_HALTED | TLB_INVAL_ALL); 2093 SMT_PAUSE(); 2094 tlb_info = cpup->cpu_m.mcpu_tlb_info; 2095 } 2096 if (tlb_info == (TLB_CPU_HALTED | TLB_INVAL_ALL)) { 2097 HATSTAT_INC(hs_tlb_inval_delayed); 2098 CPUSET_DEL(cpus_to_shootdown, c); 2099 } 2100 } 2101 #endif 2102 2103 if (CPUSET_ISNULL(cpus_to_shootdown) || 2104 CPUSET_ISEQUAL(cpus_to_shootdown, justme)) { 2105 2106 #ifdef __xpv 2107 if (va == DEMAP_ALL_ADDR) 2108 xen_flush_tlb(); 2109 else 2110 xen_flush_va((caddr_t)va); 2111 #else 2112 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 2113 #endif 2114 2115 } else { 2116 2117 CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id); 2118 #ifdef __xpv 2119 if (va == DEMAP_ALL_ADDR) 2120 xen_gflush_tlb(cpus_to_shootdown); 2121 else 2122 xen_gflush_va((caddr_t)va, cpus_to_shootdown); 2123 #else 2124 xc_call((xc_arg_t)hat, (xc_arg_t)va, NULL, X_CALL_HIPRI, 2125 cpus_to_shootdown, hati_demap_func); 2126 #endif 2127 2128 } 2129 kpreempt_enable(); 2130 } 2131 2132 /* 2133 * Interior routine for HAT_UNLOADs from hat_unload_callback(), 2134 * hat_kmap_unload() OR from hat_steal() code. This routine doesn't 2135 * handle releasing of the htables. 2136 */ 2137 void 2138 hat_pte_unmap( 2139 htable_t *ht, 2140 uint_t entry, 2141 uint_t flags, 2142 x86pte_t old_pte, 2143 void *pte_ptr) 2144 { 2145 hat_t *hat = ht->ht_hat; 2146 hment_t *hm = NULL; 2147 page_t *pp = NULL; 2148 level_t l = ht->ht_level; 2149 pfn_t pfn; 2150 2151 /* 2152 * We always track the locking counts, even if nothing is unmapped 2153 */ 2154 if ((flags & HAT_UNLOAD_UNLOCK) != 0 && hat != kas.a_hat) { 2155 ASSERT(ht->ht_lock_cnt > 0); 2156 HTABLE_LOCK_DEC(ht); 2157 } 2158 2159 /* 2160 * Figure out which page's mapping list lock to acquire using the PFN 2161 * passed in "old" PTE. We then attempt to invalidate the PTE. 2162 * If another thread, probably a hat_pageunload, has asynchronously 2163 * unmapped/remapped this address we'll loop here. 2164 */ 2165 ASSERT(ht->ht_busy > 0); 2166 while (PTE_ISVALID(old_pte)) { 2167 pfn = PTE2PFN(old_pte, l); 2168 if (PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST) { 2169 pp = NULL; 2170 } else { 2171 #ifdef __xpv 2172 if (pfn == PFN_INVALID) 2173 panic("Invalid PFN, but not PT_NOCONSIST"); 2174 #endif 2175 pp = page_numtopp_nolock(pfn); 2176 if (pp == NULL) { 2177 panic("no page_t, not NOCONSIST: old_pte=" 2178 FMT_PTE " ht=%lx entry=0x%x pte_ptr=%lx", 2179 old_pte, (uintptr_t)ht, entry, 2180 (uintptr_t)pte_ptr); 2181 } 2182 x86_hm_enter(pp); 2183 } 2184 2185 /* 2186 * If freeing the address space, check that the PTE 2187 * hasn't changed, as the mappings are no longer in use by 2188 * any thread, invalidation is unnecessary. 2189 * If not freeing, do a full invalidate. 2190 * 2191 * On the hypervisor we must always remove mappings, as a 2192 * writable mapping left behind could cause a page table 2193 * allocation to fail. 2194 */ 2195 #if !defined(__xpv) 2196 if (hat->hat_flags & HAT_FREEING) 2197 old_pte = x86pte_get(ht, entry); 2198 else 2199 #endif 2200 old_pte = x86pte_inval(ht, entry, old_pte, pte_ptr); 2201 2202 /* 2203 * If the page hadn't changed we've unmapped it and can proceed 2204 */ 2205 if (PTE_ISVALID(old_pte) && PTE2PFN(old_pte, l) == pfn) 2206 break; 2207 2208 /* 2209 * Otherwise, we'll have to retry with the current old_pte. 2210 * Drop the hment lock, since the pfn may have changed. 2211 */ 2212 if (pp != NULL) { 2213 x86_hm_exit(pp); 2214 pp = NULL; 2215 } else { 2216 ASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 2217 } 2218 } 2219 2220 /* 2221 * If the old mapping wasn't valid, there's nothing more to do 2222 */ 2223 if (!PTE_ISVALID(old_pte)) { 2224 if (pp != NULL) 2225 x86_hm_exit(pp); 2226 return; 2227 } 2228 2229 /* 2230 * Take care of syncing any MOD/REF bits and removing the hment. 2231 */ 2232 if (pp != NULL) { 2233 if (!(flags & HAT_UNLOAD_NOSYNC)) 2234 hati_sync_pte_to_page(pp, old_pte, l); 2235 hm = hment_remove(pp, ht, entry); 2236 x86_hm_exit(pp); 2237 if (hm != NULL) 2238 hment_free(hm); 2239 } 2240 2241 /* 2242 * Handle book keeping in the htable and hat 2243 */ 2244 ASSERT(ht->ht_valid_cnt > 0); 2245 HTABLE_DEC(ht->ht_valid_cnt); 2246 PGCNT_DEC(hat, l); 2247 } 2248 2249 /* 2250 * very cheap unload implementation to special case some kernel addresses 2251 */ 2252 static void 2253 hat_kmap_unload(caddr_t addr, size_t len, uint_t flags) 2254 { 2255 uintptr_t va = (uintptr_t)addr; 2256 uintptr_t eva = va + len; 2257 pgcnt_t pg_index; 2258 htable_t *ht; 2259 uint_t entry; 2260 x86pte_t *pte_ptr; 2261 x86pte_t old_pte; 2262 2263 for (; va < eva; va += MMU_PAGESIZE) { 2264 /* 2265 * Get the PTE 2266 */ 2267 pg_index = mmu_btop(va - mmu.kmap_addr); 2268 pte_ptr = PT_INDEX_PTR(mmu.kmap_ptes, pg_index); 2269 old_pte = GET_PTE(pte_ptr); 2270 2271 /* 2272 * get the htable / entry 2273 */ 2274 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) 2275 >> LEVEL_SHIFT(1)]; 2276 entry = htable_va2entry(va, ht); 2277 2278 /* 2279 * use mostly common code to unmap it. 2280 */ 2281 hat_pte_unmap(ht, entry, flags, old_pte, pte_ptr); 2282 } 2283 } 2284 2285 2286 /* 2287 * unload a range of virtual address space (no callback) 2288 */ 2289 void 2290 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2291 { 2292 uintptr_t va = (uintptr_t)addr; 2293 2294 XPV_DISALLOW_MIGRATE(); 2295 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 2296 2297 /* 2298 * special case for performance. 2299 */ 2300 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 2301 ASSERT(hat == kas.a_hat); 2302 hat_kmap_unload(addr, len, flags); 2303 } else { 2304 hat_unload_callback(hat, addr, len, flags, NULL); 2305 } 2306 XPV_ALLOW_MIGRATE(); 2307 } 2308 2309 /* 2310 * Do the callbacks for ranges being unloaded. 2311 */ 2312 typedef struct range_info { 2313 uintptr_t rng_va; 2314 ulong_t rng_cnt; 2315 level_t rng_level; 2316 } range_info_t; 2317 2318 static void 2319 handle_ranges(hat_callback_t *cb, uint_t cnt, range_info_t *range) 2320 { 2321 /* 2322 * do callbacks to upper level VM system 2323 */ 2324 while (cb != NULL && cnt > 0) { 2325 --cnt; 2326 cb->hcb_start_addr = (caddr_t)range[cnt].rng_va; 2327 cb->hcb_end_addr = cb->hcb_start_addr; 2328 cb->hcb_end_addr += 2329 range[cnt].rng_cnt << LEVEL_SIZE(range[cnt].rng_level); 2330 cb->hcb_function(cb); 2331 } 2332 } 2333 2334 /* 2335 * Unload a given range of addresses (has optional callback) 2336 * 2337 * Flags: 2338 * define HAT_UNLOAD 0x00 2339 * define HAT_UNLOAD_NOSYNC 0x02 2340 * define HAT_UNLOAD_UNLOCK 0x04 2341 * define HAT_UNLOAD_OTHER 0x08 - not used 2342 * define HAT_UNLOAD_UNMAP 0x10 - same as HAT_UNLOAD 2343 */ 2344 #define MAX_UNLOAD_CNT (8) 2345 void 2346 hat_unload_callback( 2347 hat_t *hat, 2348 caddr_t addr, 2349 size_t len, 2350 uint_t flags, 2351 hat_callback_t *cb) 2352 { 2353 uintptr_t vaddr = (uintptr_t)addr; 2354 uintptr_t eaddr = vaddr + len; 2355 htable_t *ht = NULL; 2356 uint_t entry; 2357 uintptr_t contig_va = (uintptr_t)-1L; 2358 range_info_t r[MAX_UNLOAD_CNT]; 2359 uint_t r_cnt = 0; 2360 x86pte_t old_pte; 2361 2362 XPV_DISALLOW_MIGRATE(); 2363 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2364 ASSERT(IS_PAGEALIGNED(vaddr)); 2365 ASSERT(IS_PAGEALIGNED(eaddr)); 2366 2367 /* 2368 * Special case a single page being unloaded for speed. This happens 2369 * quite frequently, COW faults after a fork() for example. 2370 */ 2371 if (cb == NULL && len == MMU_PAGESIZE) { 2372 ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0); 2373 if (ht != NULL) { 2374 if (PTE_ISVALID(old_pte)) 2375 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2376 htable_release(ht); 2377 } 2378 XPV_ALLOW_MIGRATE(); 2379 return; 2380 } 2381 2382 while (vaddr < eaddr) { 2383 old_pte = htable_walk(hat, &ht, &vaddr, eaddr); 2384 if (ht == NULL) 2385 break; 2386 2387 ASSERT(!IN_VA_HOLE(vaddr)); 2388 2389 if (vaddr < (uintptr_t)addr) 2390 panic("hat_unload_callback(): unmap inside large page"); 2391 2392 /* 2393 * We'll do the call backs for contiguous ranges 2394 */ 2395 if (vaddr != contig_va || 2396 (r_cnt > 0 && r[r_cnt - 1].rng_level != ht->ht_level)) { 2397 if (r_cnt == MAX_UNLOAD_CNT) { 2398 handle_ranges(cb, r_cnt, r); 2399 r_cnt = 0; 2400 } 2401 r[r_cnt].rng_va = vaddr; 2402 r[r_cnt].rng_cnt = 0; 2403 r[r_cnt].rng_level = ht->ht_level; 2404 ++r_cnt; 2405 } 2406 2407 /* 2408 * Unload one mapping from the page tables. 2409 */ 2410 entry = htable_va2entry(vaddr, ht); 2411 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2412 ASSERT(ht->ht_level <= mmu.max_page_level); 2413 vaddr += LEVEL_SIZE(ht->ht_level); 2414 contig_va = vaddr; 2415 ++r[r_cnt - 1].rng_cnt; 2416 } 2417 if (ht) 2418 htable_release(ht); 2419 2420 /* 2421 * handle last range for callbacks 2422 */ 2423 if (r_cnt > 0) 2424 handle_ranges(cb, r_cnt, r); 2425 XPV_ALLOW_MIGRATE(); 2426 } 2427 2428 /* 2429 * synchronize mapping with software data structures 2430 * 2431 * This interface is currently only used by the working set monitor 2432 * driver. 2433 */ 2434 /*ARGSUSED*/ 2435 void 2436 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2437 { 2438 uintptr_t vaddr = (uintptr_t)addr; 2439 uintptr_t eaddr = vaddr + len; 2440 htable_t *ht = NULL; 2441 uint_t entry; 2442 x86pte_t pte; 2443 x86pte_t save_pte; 2444 x86pte_t new; 2445 page_t *pp; 2446 2447 ASSERT(!IN_VA_HOLE(vaddr)); 2448 ASSERT(IS_PAGEALIGNED(vaddr)); 2449 ASSERT(IS_PAGEALIGNED(eaddr)); 2450 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2451 2452 XPV_DISALLOW_MIGRATE(); 2453 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2454 try_again: 2455 pte = htable_walk(hat, &ht, &vaddr, eaddr); 2456 if (ht == NULL) 2457 break; 2458 entry = htable_va2entry(vaddr, ht); 2459 2460 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2461 PTE_GET(pte, PT_REF | PT_MOD) == 0) 2462 continue; 2463 2464 /* 2465 * We need to acquire the mapping list lock to protect 2466 * against hat_pageunload(), hat_unload(), etc. 2467 */ 2468 pp = page_numtopp_nolock(PTE2PFN(pte, ht->ht_level)); 2469 if (pp == NULL) 2470 break; 2471 x86_hm_enter(pp); 2472 save_pte = pte; 2473 pte = x86pte_get(ht, entry); 2474 if (pte != save_pte) { 2475 x86_hm_exit(pp); 2476 goto try_again; 2477 } 2478 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2479 PTE_GET(pte, PT_REF | PT_MOD) == 0) { 2480 x86_hm_exit(pp); 2481 continue; 2482 } 2483 2484 /* 2485 * Need to clear ref or mod bits. We may compete with 2486 * hardware updating the R/M bits and have to try again. 2487 */ 2488 if (flags == HAT_SYNC_ZERORM) { 2489 new = pte; 2490 PTE_CLR(new, PT_REF | PT_MOD); 2491 pte = hati_update_pte(ht, entry, pte, new); 2492 if (pte != 0) { 2493 x86_hm_exit(pp); 2494 goto try_again; 2495 } 2496 } else { 2497 /* 2498 * sync the PTE to the page_t 2499 */ 2500 hati_sync_pte_to_page(pp, save_pte, ht->ht_level); 2501 } 2502 x86_hm_exit(pp); 2503 } 2504 if (ht) 2505 htable_release(ht); 2506 XPV_ALLOW_MIGRATE(); 2507 } 2508 2509 /* 2510 * void hat_map(hat, addr, len, flags) 2511 */ 2512 /*ARGSUSED*/ 2513 void 2514 hat_map(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2515 { 2516 /* does nothing */ 2517 } 2518 2519 /* 2520 * uint_t hat_getattr(hat, addr, *attr) 2521 * returns attr for <hat,addr> in *attr. returns 0 if there was a 2522 * mapping and *attr is valid, nonzero if there was no mapping and 2523 * *attr is not valid. 2524 */ 2525 uint_t 2526 hat_getattr(hat_t *hat, caddr_t addr, uint_t *attr) 2527 { 2528 uintptr_t vaddr = ALIGN2PAGE(addr); 2529 htable_t *ht = NULL; 2530 x86pte_t pte; 2531 2532 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2533 2534 if (IN_VA_HOLE(vaddr)) 2535 return ((uint_t)-1); 2536 2537 ht = htable_getpte(hat, vaddr, NULL, &pte, mmu.max_page_level); 2538 if (ht == NULL) 2539 return ((uint_t)-1); 2540 2541 if (!PTE_ISVALID(pte) || !PTE_ISPAGE(pte, ht->ht_level)) { 2542 htable_release(ht); 2543 return ((uint_t)-1); 2544 } 2545 2546 *attr = PROT_READ; 2547 if (PTE_GET(pte, PT_WRITABLE)) 2548 *attr |= PROT_WRITE; 2549 if (PTE_GET(pte, PT_USER)) 2550 *attr |= PROT_USER; 2551 if (!PTE_GET(pte, mmu.pt_nx)) 2552 *attr |= PROT_EXEC; 2553 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 2554 *attr |= HAT_NOSYNC; 2555 htable_release(ht); 2556 return (0); 2557 } 2558 2559 /* 2560 * hat_updateattr() applies the given attribute change to an existing mapping 2561 */ 2562 #define HAT_LOAD_ATTR 1 2563 #define HAT_SET_ATTR 2 2564 #define HAT_CLR_ATTR 3 2565 2566 static void 2567 hat_updateattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr, int what) 2568 { 2569 uintptr_t vaddr = (uintptr_t)addr; 2570 uintptr_t eaddr = (uintptr_t)addr + len; 2571 htable_t *ht = NULL; 2572 uint_t entry; 2573 x86pte_t oldpte, newpte; 2574 page_t *pp; 2575 2576 XPV_DISALLOW_MIGRATE(); 2577 ASSERT(IS_PAGEALIGNED(vaddr)); 2578 ASSERT(IS_PAGEALIGNED(eaddr)); 2579 ASSERT(hat == kas.a_hat || 2580 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2581 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2582 try_again: 2583 oldpte = htable_walk(hat, &ht, &vaddr, eaddr); 2584 if (ht == NULL) 2585 break; 2586 if (PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOCONSIST) 2587 continue; 2588 2589 pp = page_numtopp_nolock(PTE2PFN(oldpte, ht->ht_level)); 2590 if (pp == NULL) 2591 continue; 2592 x86_hm_enter(pp); 2593 2594 newpte = oldpte; 2595 /* 2596 * We found a page table entry in the desired range, 2597 * figure out the new attributes. 2598 */ 2599 if (what == HAT_SET_ATTR || what == HAT_LOAD_ATTR) { 2600 if ((attr & PROT_WRITE) && 2601 !PTE_GET(oldpte, PT_WRITABLE)) 2602 newpte |= PT_WRITABLE; 2603 2604 if ((attr & HAT_NOSYNC) && 2605 PTE_GET(oldpte, PT_SOFTWARE) < PT_NOSYNC) 2606 newpte |= PT_NOSYNC; 2607 2608 if ((attr & PROT_EXEC) && PTE_GET(oldpte, mmu.pt_nx)) 2609 newpte &= ~mmu.pt_nx; 2610 } 2611 2612 if (what == HAT_LOAD_ATTR) { 2613 if (!(attr & PROT_WRITE) && 2614 PTE_GET(oldpte, PT_WRITABLE)) 2615 newpte &= ~PT_WRITABLE; 2616 2617 if (!(attr & HAT_NOSYNC) && 2618 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2619 newpte &= ~PT_SOFTWARE; 2620 2621 if (!(attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2622 newpte |= mmu.pt_nx; 2623 } 2624 2625 if (what == HAT_CLR_ATTR) { 2626 if ((attr & PROT_WRITE) && PTE_GET(oldpte, PT_WRITABLE)) 2627 newpte &= ~PT_WRITABLE; 2628 2629 if ((attr & HAT_NOSYNC) && 2630 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2631 newpte &= ~PT_SOFTWARE; 2632 2633 if ((attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2634 newpte |= mmu.pt_nx; 2635 } 2636 2637 /* 2638 * Ensure NOSYNC/NOCONSIST mappings have REF and MOD set. 2639 * x86pte_set() depends on this. 2640 */ 2641 if (PTE_GET(newpte, PT_SOFTWARE) >= PT_NOSYNC) 2642 newpte |= PT_REF | PT_MOD; 2643 2644 /* 2645 * what about PROT_READ or others? this code only handles: 2646 * EXEC, WRITE, NOSYNC 2647 */ 2648 2649 /* 2650 * If new PTE really changed, update the table. 2651 */ 2652 if (newpte != oldpte) { 2653 entry = htable_va2entry(vaddr, ht); 2654 oldpte = hati_update_pte(ht, entry, oldpte, newpte); 2655 if (oldpte != 0) { 2656 x86_hm_exit(pp); 2657 goto try_again; 2658 } 2659 } 2660 x86_hm_exit(pp); 2661 } 2662 if (ht) 2663 htable_release(ht); 2664 XPV_ALLOW_MIGRATE(); 2665 } 2666 2667 /* 2668 * Various wrappers for hat_updateattr() 2669 */ 2670 void 2671 hat_setattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2672 { 2673 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2674 hat_updateattr(hat, addr, len, attr, HAT_SET_ATTR); 2675 } 2676 2677 void 2678 hat_clrattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2679 { 2680 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2681 hat_updateattr(hat, addr, len, attr, HAT_CLR_ATTR); 2682 } 2683 2684 void 2685 hat_chgattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2686 { 2687 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2688 hat_updateattr(hat, addr, len, attr, HAT_LOAD_ATTR); 2689 } 2690 2691 void 2692 hat_chgprot(hat_t *hat, caddr_t addr, size_t len, uint_t vprot) 2693 { 2694 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2695 hat_updateattr(hat, addr, len, vprot & HAT_PROT_MASK, HAT_LOAD_ATTR); 2696 } 2697 2698 /* 2699 * size_t hat_getpagesize(hat, addr) 2700 * returns pagesize in bytes for <hat, addr>. returns -1 of there is 2701 * no mapping. This is an advisory call. 2702 */ 2703 ssize_t 2704 hat_getpagesize(hat_t *hat, caddr_t addr) 2705 { 2706 uintptr_t vaddr = ALIGN2PAGE(addr); 2707 htable_t *ht; 2708 size_t pagesize; 2709 2710 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2711 if (IN_VA_HOLE(vaddr)) 2712 return (-1); 2713 ht = htable_getpage(hat, vaddr, NULL); 2714 if (ht == NULL) 2715 return (-1); 2716 pagesize = LEVEL_SIZE(ht->ht_level); 2717 htable_release(ht); 2718 return (pagesize); 2719 } 2720 2721 2722 2723 /* 2724 * pfn_t hat_getpfnum(hat, addr) 2725 * returns pfn for <hat, addr> or PFN_INVALID if mapping is invalid. 2726 */ 2727 pfn_t 2728 hat_getpfnum(hat_t *hat, caddr_t addr) 2729 { 2730 uintptr_t vaddr = ALIGN2PAGE(addr); 2731 htable_t *ht; 2732 uint_t entry; 2733 pfn_t pfn = PFN_INVALID; 2734 2735 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2736 if (khat_running == 0) 2737 return (PFN_INVALID); 2738 2739 if (IN_VA_HOLE(vaddr)) 2740 return (PFN_INVALID); 2741 2742 XPV_DISALLOW_MIGRATE(); 2743 /* 2744 * A very common use of hat_getpfnum() is from the DDI for kernel pages. 2745 * Use the kmap_ptes (which also covers the 32 bit heap) to speed 2746 * this up. 2747 */ 2748 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2749 x86pte_t pte; 2750 pgcnt_t pg_index; 2751 2752 pg_index = mmu_btop(vaddr - mmu.kmap_addr); 2753 pte = GET_PTE(PT_INDEX_PTR(mmu.kmap_ptes, pg_index)); 2754 if (PTE_ISVALID(pte)) 2755 /*LINTED [use of constant 0 causes a lint warning] */ 2756 pfn = PTE2PFN(pte, 0); 2757 XPV_ALLOW_MIGRATE(); 2758 return (pfn); 2759 } 2760 2761 ht = htable_getpage(hat, vaddr, &entry); 2762 if (ht == NULL) { 2763 XPV_ALLOW_MIGRATE(); 2764 return (PFN_INVALID); 2765 } 2766 ASSERT(vaddr >= ht->ht_vaddr); 2767 ASSERT(vaddr <= HTABLE_LAST_PAGE(ht)); 2768 pfn = PTE2PFN(x86pte_get(ht, entry), ht->ht_level); 2769 if (ht->ht_level > 0) 2770 pfn += mmu_btop(vaddr & LEVEL_OFFSET(ht->ht_level)); 2771 htable_release(ht); 2772 XPV_ALLOW_MIGRATE(); 2773 return (pfn); 2774 } 2775 2776 /* 2777 * hat_getkpfnum() is an obsolete DDI routine, and its use is discouraged. 2778 * Use hat_getpfnum(kas.a_hat, ...) instead. 2779 * 2780 * We'd like to return PFN_INVALID if the mappings have underlying page_t's 2781 * but can't right now due to the fact that some software has grown to use 2782 * this interface incorrectly. So for now when the interface is misused, 2783 * return a warning to the user that in the future it won't work in the 2784 * way they're abusing it, and carry on. 2785 * 2786 * Note that hat_getkpfnum() is never supported on amd64. 2787 */ 2788 #if !defined(__amd64) 2789 pfn_t 2790 hat_getkpfnum(caddr_t addr) 2791 { 2792 pfn_t pfn; 2793 int badcaller = 0; 2794 2795 if (khat_running == 0) 2796 panic("hat_getkpfnum(): called too early\n"); 2797 if ((uintptr_t)addr < kernelbase) 2798 return (PFN_INVALID); 2799 2800 XPV_DISALLOW_MIGRATE(); 2801 if (segkpm && IS_KPM_ADDR(addr)) { 2802 badcaller = 1; 2803 pfn = hat_kpm_va2pfn(addr); 2804 } else { 2805 pfn = hat_getpfnum(kas.a_hat, addr); 2806 badcaller = pf_is_memory(pfn); 2807 } 2808 2809 if (badcaller) 2810 hat_getkpfnum_badcall(caller()); 2811 XPV_ALLOW_MIGRATE(); 2812 return (pfn); 2813 } 2814 #endif /* __amd64 */ 2815 2816 /* 2817 * int hat_probe(hat, addr) 2818 * return 0 if no valid mapping is present. Faster version 2819 * of hat_getattr in certain architectures. 2820 */ 2821 int 2822 hat_probe(hat_t *hat, caddr_t addr) 2823 { 2824 uintptr_t vaddr = ALIGN2PAGE(addr); 2825 uint_t entry; 2826 htable_t *ht; 2827 pgcnt_t pg_off; 2828 2829 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2830 ASSERT(hat == kas.a_hat || 2831 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2832 if (IN_VA_HOLE(vaddr)) 2833 return (0); 2834 2835 /* 2836 * Most common use of hat_probe is from segmap. We special case it 2837 * for performance. 2838 */ 2839 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2840 pg_off = mmu_btop(vaddr - mmu.kmap_addr); 2841 if (mmu.pae_hat) 2842 return (PTE_ISVALID(mmu.kmap_ptes[pg_off])); 2843 else 2844 return (PTE_ISVALID( 2845 ((x86pte32_t *)mmu.kmap_ptes)[pg_off])); 2846 } 2847 2848 ht = htable_getpage(hat, vaddr, &entry); 2849 htable_release(ht); 2850 return (ht != NULL); 2851 } 2852 2853 /* 2854 * Find out if the segment for hat_share()/hat_unshare() is DISM or locked ISM. 2855 */ 2856 static int 2857 is_it_dism(hat_t *hat, caddr_t va) 2858 { 2859 struct seg *seg; 2860 struct shm_data *shmd; 2861 struct spt_data *sptd; 2862 2863 seg = as_findseg(hat->hat_as, va, 0); 2864 ASSERT(seg != NULL); 2865 ASSERT(seg->s_base <= va); 2866 shmd = (struct shm_data *)seg->s_data; 2867 ASSERT(shmd != NULL); 2868 sptd = (struct spt_data *)shmd->shm_sptseg->s_data; 2869 ASSERT(sptd != NULL); 2870 if (sptd->spt_flags & SHM_PAGEABLE) 2871 return (1); 2872 return (0); 2873 } 2874 2875 /* 2876 * Simple implementation of ISM. hat_share() is similar to hat_memload_array(), 2877 * except that we use the ism_hat's existing mappings to determine the pages 2878 * and protections to use for this hat. If we find a full properly aligned 2879 * and sized pagetable, we will attempt to share the pagetable itself. 2880 */ 2881 /*ARGSUSED*/ 2882 int 2883 hat_share( 2884 hat_t *hat, 2885 caddr_t addr, 2886 hat_t *ism_hat, 2887 caddr_t src_addr, 2888 size_t len, /* almost useless value, see below.. */ 2889 uint_t ismszc) 2890 { 2891 uintptr_t vaddr_start = (uintptr_t)addr; 2892 uintptr_t vaddr; 2893 uintptr_t eaddr = vaddr_start + len; 2894 uintptr_t ism_addr_start = (uintptr_t)src_addr; 2895 uintptr_t ism_addr = ism_addr_start; 2896 uintptr_t e_ism_addr = ism_addr + len; 2897 htable_t *ism_ht = NULL; 2898 htable_t *ht; 2899 x86pte_t pte; 2900 page_t *pp; 2901 pfn_t pfn; 2902 level_t l; 2903 pgcnt_t pgcnt; 2904 uint_t prot; 2905 int is_dism; 2906 int flags; 2907 2908 /* 2909 * We might be asked to share an empty DISM hat by as_dup() 2910 */ 2911 ASSERT(hat != kas.a_hat); 2912 ASSERT(eaddr <= _userlimit); 2913 if (!(ism_hat->hat_flags & HAT_SHARED)) { 2914 ASSERT(hat_get_mapped_size(ism_hat) == 0); 2915 return (0); 2916 } 2917 XPV_DISALLOW_MIGRATE(); 2918 2919 /* 2920 * The SPT segment driver often passes us a size larger than there are 2921 * valid mappings. That's because it rounds the segment size up to a 2922 * large pagesize, even if the actual memory mapped by ism_hat is less. 2923 */ 2924 ASSERT(IS_PAGEALIGNED(vaddr_start)); 2925 ASSERT(IS_PAGEALIGNED(ism_addr_start)); 2926 ASSERT(ism_hat->hat_flags & HAT_SHARED); 2927 is_dism = is_it_dism(hat, addr); 2928 while (ism_addr < e_ism_addr) { 2929 /* 2930 * use htable_walk to get the next valid ISM mapping 2931 */ 2932 pte = htable_walk(ism_hat, &ism_ht, &ism_addr, e_ism_addr); 2933 if (ism_ht == NULL) 2934 break; 2935 2936 /* 2937 * First check to see if we already share the page table. 2938 */ 2939 l = ism_ht->ht_level; 2940 vaddr = vaddr_start + (ism_addr - ism_addr_start); 2941 ht = htable_lookup(hat, vaddr, l); 2942 if (ht != NULL) { 2943 if (ht->ht_flags & HTABLE_SHARED_PFN) 2944 goto shared; 2945 htable_release(ht); 2946 goto not_shared; 2947 } 2948 2949 /* 2950 * Can't ever share top table. 2951 */ 2952 if (l == mmu.max_level) 2953 goto not_shared; 2954 2955 /* 2956 * Avoid level mismatches later due to DISM faults. 2957 */ 2958 if (is_dism && l > 0) 2959 goto not_shared; 2960 2961 /* 2962 * addresses and lengths must align 2963 * table must be fully populated 2964 * no lower level page tables 2965 */ 2966 if (ism_addr != ism_ht->ht_vaddr || 2967 (vaddr & LEVEL_OFFSET(l + 1)) != 0) 2968 goto not_shared; 2969 2970 /* 2971 * The range of address space must cover a full table. 2972 */ 2973 if (e_ism_addr - ism_addr < LEVEL_SIZE(l + 1)) 2974 goto not_shared; 2975 2976 /* 2977 * All entries in the ISM page table must be leaf PTEs. 2978 */ 2979 if (l > 0) { 2980 int e; 2981 2982 /* 2983 * We know the 0th is from htable_walk() above. 2984 */ 2985 for (e = 1; e < HTABLE_NUM_PTES(ism_ht); ++e) { 2986 x86pte_t pte; 2987 pte = x86pte_get(ism_ht, e); 2988 if (!PTE_ISPAGE(pte, l)) 2989 goto not_shared; 2990 } 2991 } 2992 2993 /* 2994 * share the page table 2995 */ 2996 ht = htable_create(hat, vaddr, l, ism_ht); 2997 shared: 2998 ASSERT(ht->ht_flags & HTABLE_SHARED_PFN); 2999 ASSERT(ht->ht_shares == ism_ht); 3000 hat->hat_ism_pgcnt += 3001 (ism_ht->ht_valid_cnt - ht->ht_valid_cnt) << 3002 (LEVEL_SHIFT(ht->ht_level) - MMU_PAGESHIFT); 3003 ht->ht_valid_cnt = ism_ht->ht_valid_cnt; 3004 htable_release(ht); 3005 ism_addr = ism_ht->ht_vaddr + LEVEL_SIZE(l + 1); 3006 htable_release(ism_ht); 3007 ism_ht = NULL; 3008 continue; 3009 3010 not_shared: 3011 /* 3012 * Unable to share the page table. Instead we will 3013 * create new mappings from the values in the ISM mappings. 3014 * Figure out what level size mappings to use; 3015 */ 3016 for (l = ism_ht->ht_level; l > 0; --l) { 3017 if (LEVEL_SIZE(l) <= eaddr - vaddr && 3018 (vaddr & LEVEL_OFFSET(l)) == 0) 3019 break; 3020 } 3021 3022 /* 3023 * The ISM mapping might be larger than the share area, 3024 * be careful to truncate it if needed. 3025 */ 3026 if (eaddr - vaddr >= LEVEL_SIZE(ism_ht->ht_level)) { 3027 pgcnt = mmu_btop(LEVEL_SIZE(ism_ht->ht_level)); 3028 } else { 3029 pgcnt = mmu_btop(eaddr - vaddr); 3030 l = 0; 3031 } 3032 3033 pfn = PTE2PFN(pte, ism_ht->ht_level); 3034 ASSERT(pfn != PFN_INVALID); 3035 while (pgcnt > 0) { 3036 /* 3037 * Make a new pte for the PFN for this level. 3038 * Copy protections for the pte from the ISM pte. 3039 */ 3040 pp = page_numtopp_nolock(pfn); 3041 ASSERT(pp != NULL); 3042 3043 prot = PROT_USER | PROT_READ | HAT_UNORDERED_OK; 3044 if (PTE_GET(pte, PT_WRITABLE)) 3045 prot |= PROT_WRITE; 3046 if (!PTE_GET(pte, PT_NX)) 3047 prot |= PROT_EXEC; 3048 3049 flags = HAT_LOAD; 3050 if (!is_dism) 3051 flags |= HAT_LOAD_LOCK | HAT_LOAD_NOCONSIST; 3052 while (hati_load_common(hat, vaddr, pp, prot, flags, 3053 l, pfn) != 0) { 3054 if (l == 0) 3055 panic("hati_load_common() failure"); 3056 --l; 3057 } 3058 3059 vaddr += LEVEL_SIZE(l); 3060 ism_addr += LEVEL_SIZE(l); 3061 pfn += mmu_btop(LEVEL_SIZE(l)); 3062 pgcnt -= mmu_btop(LEVEL_SIZE(l)); 3063 } 3064 } 3065 if (ism_ht != NULL) 3066 htable_release(ism_ht); 3067 XPV_ALLOW_MIGRATE(); 3068 return (0); 3069 } 3070 3071 3072 /* 3073 * hat_unshare() is similar to hat_unload_callback(), but 3074 * we have to look for empty shared pagetables. Note that 3075 * hat_unshare() is always invoked against an entire segment. 3076 */ 3077 /*ARGSUSED*/ 3078 void 3079 hat_unshare(hat_t *hat, caddr_t addr, size_t len, uint_t ismszc) 3080 { 3081 uint64_t vaddr = (uintptr_t)addr; 3082 uintptr_t eaddr = vaddr + len; 3083 htable_t *ht = NULL; 3084 uint_t need_demaps = 0; 3085 int flags = HAT_UNLOAD_UNMAP; 3086 level_t l; 3087 3088 ASSERT(hat != kas.a_hat); 3089 ASSERT(eaddr <= _userlimit); 3090 ASSERT(IS_PAGEALIGNED(vaddr)); 3091 ASSERT(IS_PAGEALIGNED(eaddr)); 3092 XPV_DISALLOW_MIGRATE(); 3093 3094 /* 3095 * First go through and remove any shared pagetables. 3096 * 3097 * Note that it's ok to delay the TLB shootdown till the entire range is 3098 * finished, because if hat_pageunload() were to unload a shared 3099 * pagetable page, its hat_tlb_inval() will do a global TLB invalidate. 3100 */ 3101 l = mmu.max_page_level; 3102 if (l == mmu.max_level) 3103 --l; 3104 for (; l >= 0; --l) { 3105 for (vaddr = (uintptr_t)addr; vaddr < eaddr; 3106 vaddr = (vaddr & LEVEL_MASK(l + 1)) + LEVEL_SIZE(l + 1)) { 3107 ASSERT(!IN_VA_HOLE(vaddr)); 3108 /* 3109 * find a pagetable that maps the current address 3110 */ 3111 ht = htable_lookup(hat, vaddr, l); 3112 if (ht == NULL) 3113 continue; 3114 if (ht->ht_flags & HTABLE_SHARED_PFN) { 3115 /* 3116 * clear page count, set valid_cnt to 0, 3117 * let htable_release() finish the job 3118 */ 3119 hat->hat_ism_pgcnt -= ht->ht_valid_cnt << 3120 (LEVEL_SHIFT(ht->ht_level) - MMU_PAGESHIFT); 3121 ht->ht_valid_cnt = 0; 3122 need_demaps = 1; 3123 } 3124 htable_release(ht); 3125 } 3126 } 3127 3128 /* 3129 * flush the TLBs - since we're probably dealing with MANY mappings 3130 * we do just one CR3 reload. 3131 */ 3132 if (!(hat->hat_flags & HAT_FREEING) && need_demaps) 3133 hat_tlb_inval(hat, DEMAP_ALL_ADDR); 3134 3135 /* 3136 * Now go back and clean up any unaligned mappings that 3137 * couldn't share pagetables. 3138 */ 3139 if (!is_it_dism(hat, addr)) 3140 flags |= HAT_UNLOAD_UNLOCK; 3141 hat_unload(hat, addr, len, flags); 3142 XPV_ALLOW_MIGRATE(); 3143 } 3144 3145 3146 /* 3147 * hat_reserve() does nothing 3148 */ 3149 /*ARGSUSED*/ 3150 void 3151 hat_reserve(struct as *as, caddr_t addr, size_t len) 3152 { 3153 } 3154 3155 3156 /* 3157 * Called when all mappings to a page should have write permission removed. 3158 * Mostly stolem from hat_pagesync() 3159 */ 3160 static void 3161 hati_page_clrwrt(struct page *pp) 3162 { 3163 hment_t *hm = NULL; 3164 htable_t *ht; 3165 uint_t entry; 3166 x86pte_t old; 3167 x86pte_t new; 3168 uint_t pszc = 0; 3169 3170 XPV_DISALLOW_MIGRATE(); 3171 next_size: 3172 /* 3173 * walk thru the mapping list clearing write permission 3174 */ 3175 x86_hm_enter(pp); 3176 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 3177 if (ht->ht_level < pszc) 3178 continue; 3179 old = x86pte_get(ht, entry); 3180 3181 for (;;) { 3182 /* 3183 * Is this mapping of interest? 3184 */ 3185 if (PTE2PFN(old, ht->ht_level) != pp->p_pagenum || 3186 PTE_GET(old, PT_WRITABLE) == 0) 3187 break; 3188 3189 /* 3190 * Clear ref/mod writable bits. This requires cross 3191 * calls to ensure any executing TLBs see cleared bits. 3192 */ 3193 new = old; 3194 PTE_CLR(new, PT_REF | PT_MOD | PT_WRITABLE); 3195 old = hati_update_pte(ht, entry, old, new); 3196 if (old != 0) 3197 continue; 3198 3199 break; 3200 } 3201 } 3202 x86_hm_exit(pp); 3203 while (pszc < pp->p_szc) { 3204 page_t *tpp; 3205 pszc++; 3206 tpp = PP_GROUPLEADER(pp, pszc); 3207 if (pp != tpp) { 3208 pp = tpp; 3209 goto next_size; 3210 } 3211 } 3212 XPV_ALLOW_MIGRATE(); 3213 } 3214 3215 /* 3216 * void hat_page_setattr(pp, flag) 3217 * void hat_page_clrattr(pp, flag) 3218 * used to set/clr ref/mod bits. 3219 */ 3220 void 3221 hat_page_setattr(struct page *pp, uint_t flag) 3222 { 3223 vnode_t *vp = pp->p_vnode; 3224 kmutex_t *vphm = NULL; 3225 page_t **listp; 3226 int noshuffle; 3227 3228 noshuffle = flag & P_NSH; 3229 flag &= ~P_NSH; 3230 3231 if (PP_GETRM(pp, flag) == flag) 3232 return; 3233 3234 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) && 3235 !noshuffle) { 3236 vphm = page_vnode_mutex(vp); 3237 mutex_enter(vphm); 3238 } 3239 3240 PP_SETRM(pp, flag); 3241 3242 if (vphm != NULL) { 3243 3244 /* 3245 * Some File Systems examine v_pages for NULL w/o 3246 * grabbing the vphm mutex. Must not let it become NULL when 3247 * pp is the only page on the list. 3248 */ 3249 if (pp->p_vpnext != pp) { 3250 page_vpsub(&vp->v_pages, pp); 3251 if (vp->v_pages != NULL) 3252 listp = &vp->v_pages->p_vpprev->p_vpnext; 3253 else 3254 listp = &vp->v_pages; 3255 page_vpadd(listp, pp); 3256 } 3257 mutex_exit(vphm); 3258 } 3259 } 3260 3261 void 3262 hat_page_clrattr(struct page *pp, uint_t flag) 3263 { 3264 vnode_t *vp = pp->p_vnode; 3265 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 3266 3267 /* 3268 * Caller is expected to hold page's io lock for VMODSORT to work 3269 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod 3270 * bit is cleared. 3271 * We don't have assert to avoid tripping some existing third party 3272 * code. The dirty page is moved back to top of the v_page list 3273 * after IO is done in pvn_write_done(). 3274 */ 3275 PP_CLRRM(pp, flag); 3276 3277 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 3278 3279 /* 3280 * VMODSORT works by removing write permissions and getting 3281 * a fault when a page is made dirty. At this point 3282 * we need to remove write permission from all mappings 3283 * to this page. 3284 */ 3285 hati_page_clrwrt(pp); 3286 } 3287 } 3288 3289 /* 3290 * If flag is specified, returns 0 if attribute is disabled 3291 * and non zero if enabled. If flag specifes multiple attributs 3292 * then returns 0 if ALL atriibutes are disabled. This is an advisory 3293 * call. 3294 */ 3295 uint_t 3296 hat_page_getattr(struct page *pp, uint_t flag) 3297 { 3298 return (PP_GETRM(pp, flag)); 3299 } 3300 3301 3302 /* 3303 * common code used by hat_pageunload() and hment_steal() 3304 */ 3305 hment_t * 3306 hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry) 3307 { 3308 x86pte_t old_pte; 3309 pfn_t pfn = pp->p_pagenum; 3310 hment_t *hm; 3311 3312 /* 3313 * We need to acquire a hold on the htable in order to 3314 * do the invalidate. We know the htable must exist, since 3315 * unmap's don't release the htable until after removing any 3316 * hment. Having x86_hm_enter() keeps that from proceeding. 3317 */ 3318 htable_acquire(ht); 3319 3320 /* 3321 * Invalidate the PTE and remove the hment. 3322 */ 3323 old_pte = x86pte_inval(ht, entry, 0, NULL); 3324 if (PTE2PFN(old_pte, ht->ht_level) != pfn) { 3325 panic("x86pte_inval() failure found PTE = " FMT_PTE 3326 " pfn being unmapped is %lx ht=0x%lx entry=0x%x", 3327 old_pte, pfn, (uintptr_t)ht, entry); 3328 } 3329 3330 /* 3331 * Clean up all the htable information for this mapping 3332 */ 3333 ASSERT(ht->ht_valid_cnt > 0); 3334 HTABLE_DEC(ht->ht_valid_cnt); 3335 PGCNT_DEC(ht->ht_hat, ht->ht_level); 3336 3337 /* 3338 * sync ref/mod bits to the page_t 3339 */ 3340 if (PTE_GET(old_pte, PT_SOFTWARE) < PT_NOSYNC) 3341 hati_sync_pte_to_page(pp, old_pte, ht->ht_level); 3342 3343 /* 3344 * Remove the mapping list entry for this page. 3345 */ 3346 hm = hment_remove(pp, ht, entry); 3347 3348 /* 3349 * drop the mapping list lock so that we might free the 3350 * hment and htable. 3351 */ 3352 x86_hm_exit(pp); 3353 htable_release(ht); 3354 return (hm); 3355 } 3356 3357 extern int vpm_enable; 3358 /* 3359 * Unload all translations to a page. If the page is a subpage of a large 3360 * page, the large page mappings are also removed. 3361 * 3362 * The forceflags are unused. 3363 */ 3364 3365 /*ARGSUSED*/ 3366 static int 3367 hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag) 3368 { 3369 page_t *cur_pp = pp; 3370 hment_t *hm; 3371 hment_t *prev; 3372 htable_t *ht; 3373 uint_t entry; 3374 level_t level; 3375 3376 XPV_DISALLOW_MIGRATE(); 3377 #if defined(__amd64) 3378 /* 3379 * clear the vpm ref. 3380 */ 3381 if (vpm_enable) { 3382 pp->p_vpmref = 0; 3383 } 3384 #endif 3385 /* 3386 * The loop with next_size handles pages with multiple pagesize mappings 3387 */ 3388 next_size: 3389 for (;;) { 3390 3391 /* 3392 * Get a mapping list entry 3393 */ 3394 x86_hm_enter(cur_pp); 3395 for (prev = NULL; ; prev = hm) { 3396 hm = hment_walk(cur_pp, &ht, &entry, prev); 3397 if (hm == NULL) { 3398 x86_hm_exit(cur_pp); 3399 3400 /* 3401 * If not part of a larger page, we're done. 3402 */ 3403 if (cur_pp->p_szc <= pg_szcd) { 3404 XPV_ALLOW_MIGRATE(); 3405 return (0); 3406 } 3407 3408 /* 3409 * Else check the next larger page size. 3410 * hat_page_demote() may decrease p_szc 3411 * but that's ok we'll just take an extra 3412 * trip discover there're no larger mappings 3413 * and return. 3414 */ 3415 ++pg_szcd; 3416 cur_pp = PP_GROUPLEADER(cur_pp, pg_szcd); 3417 goto next_size; 3418 } 3419 3420 /* 3421 * If this mapping size matches, remove it. 3422 */ 3423 level = ht->ht_level; 3424 if (level == pg_szcd) 3425 break; 3426 } 3427 3428 /* 3429 * Remove the mapping list entry for this page. 3430 * Note this does the x86_hm_exit() for us. 3431 */ 3432 hm = hati_page_unmap(cur_pp, ht, entry); 3433 if (hm != NULL) 3434 hment_free(hm); 3435 } 3436 } 3437 3438 int 3439 hat_pageunload(struct page *pp, uint_t forceflag) 3440 { 3441 ASSERT(PAGE_EXCL(pp)); 3442 return (hati_pageunload(pp, 0, forceflag)); 3443 } 3444 3445 /* 3446 * Unload all large mappings to pp and reduce by 1 p_szc field of every large 3447 * page level that included pp. 3448 * 3449 * pp must be locked EXCL. Even though no other constituent pages are locked 3450 * it's legal to unload large mappings to pp because all constituent pages of 3451 * large locked mappings have to be locked SHARED. therefore if we have EXCL 3452 * lock on one of constituent pages none of the large mappings to pp are 3453 * locked. 3454 * 3455 * Change (always decrease) p_szc field starting from the last constituent 3456 * page and ending with root constituent page so that root's pszc always shows 3457 * the area where hat_page_demote() may be active. 3458 * 3459 * This mechanism is only used for file system pages where it's not always 3460 * possible to get EXCL locks on all constituent pages to demote the size code 3461 * (as is done for anonymous or kernel large pages). 3462 */ 3463 void 3464 hat_page_demote(page_t *pp) 3465 { 3466 uint_t pszc; 3467 uint_t rszc; 3468 uint_t szc; 3469 page_t *rootpp; 3470 page_t *firstpp; 3471 page_t *lastpp; 3472 pgcnt_t pgcnt; 3473 3474 ASSERT(PAGE_EXCL(pp)); 3475 ASSERT(!PP_ISFREE(pp)); 3476 ASSERT(page_szc_lock_assert(pp)); 3477 3478 if (pp->p_szc == 0) 3479 return; 3480 3481 rootpp = PP_GROUPLEADER(pp, 1); 3482 (void) hati_pageunload(rootpp, 1, HAT_FORCE_PGUNLOAD); 3483 3484 /* 3485 * all large mappings to pp are gone 3486 * and no new can be setup since pp is locked exclusively. 3487 * 3488 * Lock the root to make sure there's only one hat_page_demote() 3489 * outstanding within the area of this root's pszc. 3490 * 3491 * Second potential hat_page_demote() is already eliminated by upper 3492 * VM layer via page_szc_lock() but we don't rely on it and use our 3493 * own locking (so that upper layer locking can be changed without 3494 * assumptions that hat depends on upper layer VM to prevent multiple 3495 * hat_page_demote() to be issued simultaneously to the same large 3496 * page). 3497 */ 3498 again: 3499 pszc = pp->p_szc; 3500 if (pszc == 0) 3501 return; 3502 rootpp = PP_GROUPLEADER(pp, pszc); 3503 x86_hm_enter(rootpp); 3504 /* 3505 * If root's p_szc is different from pszc we raced with another 3506 * hat_page_demote(). Drop the lock and try to find the root again. 3507 * If root's p_szc is greater than pszc previous hat_page_demote() is 3508 * not done yet. Take and release mlist lock of root's root to wait 3509 * for previous hat_page_demote() to complete. 3510 */ 3511 if ((rszc = rootpp->p_szc) != pszc) { 3512 x86_hm_exit(rootpp); 3513 if (rszc > pszc) { 3514 /* p_szc of a locked non free page can't increase */ 3515 ASSERT(pp != rootpp); 3516 3517 rootpp = PP_GROUPLEADER(rootpp, rszc); 3518 x86_hm_enter(rootpp); 3519 x86_hm_exit(rootpp); 3520 } 3521 goto again; 3522 } 3523 ASSERT(pp->p_szc == pszc); 3524 3525 /* 3526 * Decrement by 1 p_szc of every constituent page of a region that 3527 * covered pp. For example if original szc is 3 it gets changed to 2 3528 * everywhere except in region 2 that covered pp. Region 2 that 3529 * covered pp gets demoted to 1 everywhere except in region 1 that 3530 * covered pp. The region 1 that covered pp is demoted to region 3531 * 0. It's done this way because from region 3 we removed level 3 3532 * mappings, from region 2 that covered pp we removed level 2 mappings 3533 * and from region 1 that covered pp we removed level 1 mappings. All 3534 * changes are done from from high pfn's to low pfn's so that roots 3535 * are changed last allowing one to know the largest region where 3536 * hat_page_demote() is stil active by only looking at the root page. 3537 * 3538 * This algorithm is implemented in 2 while loops. First loop changes 3539 * p_szc of pages to the right of pp's level 1 region and second 3540 * loop changes p_szc of pages of level 1 region that covers pp 3541 * and all pages to the left of level 1 region that covers pp. 3542 * In the first loop p_szc keeps dropping with every iteration 3543 * and in the second loop it keeps increasing with every iteration. 3544 * 3545 * First loop description: Demote pages to the right of pp outside of 3546 * level 1 region that covers pp. In every iteration of the while 3547 * loop below find the last page of szc region and the first page of 3548 * (szc - 1) region that is immediately to the right of (szc - 1) 3549 * region that covers pp. From last such page to first such page 3550 * change every page's szc to szc - 1. Decrement szc and continue 3551 * looping until szc is 1. If pp belongs to the last (szc - 1) region 3552 * of szc region skip to the next iteration. 3553 */ 3554 szc = pszc; 3555 while (szc > 1) { 3556 lastpp = PP_GROUPLEADER(pp, szc); 3557 pgcnt = page_get_pagecnt(szc); 3558 lastpp += pgcnt - 1; 3559 firstpp = PP_GROUPLEADER(pp, (szc - 1)); 3560 pgcnt = page_get_pagecnt(szc - 1); 3561 if (lastpp - firstpp < pgcnt) { 3562 szc--; 3563 continue; 3564 } 3565 firstpp += pgcnt; 3566 while (lastpp != firstpp) { 3567 ASSERT(lastpp->p_szc == pszc); 3568 lastpp->p_szc = szc - 1; 3569 lastpp--; 3570 } 3571 firstpp->p_szc = szc - 1; 3572 szc--; 3573 } 3574 3575 /* 3576 * Second loop description: 3577 * First iteration changes p_szc to 0 of every 3578 * page of level 1 region that covers pp. 3579 * Subsequent iterations find last page of szc region 3580 * immediately to the left of szc region that covered pp 3581 * and first page of (szc + 1) region that covers pp. 3582 * From last to first page change p_szc of every page to szc. 3583 * Increment szc and continue looping until szc is pszc. 3584 * If pp belongs to the fist szc region of (szc + 1) region 3585 * skip to the next iteration. 3586 * 3587 */ 3588 szc = 0; 3589 while (szc < pszc) { 3590 firstpp = PP_GROUPLEADER(pp, (szc + 1)); 3591 if (szc == 0) { 3592 pgcnt = page_get_pagecnt(1); 3593 lastpp = firstpp + (pgcnt - 1); 3594 } else { 3595 lastpp = PP_GROUPLEADER(pp, szc); 3596 if (firstpp == lastpp) { 3597 szc++; 3598 continue; 3599 } 3600 lastpp--; 3601 pgcnt = page_get_pagecnt(szc); 3602 } 3603 while (lastpp != firstpp) { 3604 ASSERT(lastpp->p_szc == pszc); 3605 lastpp->p_szc = szc; 3606 lastpp--; 3607 } 3608 firstpp->p_szc = szc; 3609 if (firstpp == rootpp) 3610 break; 3611 szc++; 3612 } 3613 x86_hm_exit(rootpp); 3614 } 3615 3616 /* 3617 * get hw stats from hardware into page struct and reset hw stats 3618 * returns attributes of page 3619 * Flags for hat_pagesync, hat_getstat, hat_sync 3620 * 3621 * define HAT_SYNC_ZERORM 0x01 3622 * 3623 * Additional flags for hat_pagesync 3624 * 3625 * define HAT_SYNC_STOPON_REF 0x02 3626 * define HAT_SYNC_STOPON_MOD 0x04 3627 * define HAT_SYNC_STOPON_RM 0x06 3628 * define HAT_SYNC_STOPON_SHARED 0x08 3629 */ 3630 uint_t 3631 hat_pagesync(struct page *pp, uint_t flags) 3632 { 3633 hment_t *hm = NULL; 3634 htable_t *ht; 3635 uint_t entry; 3636 x86pte_t old, save_old; 3637 x86pte_t new; 3638 uchar_t nrmbits = P_REF|P_MOD|P_RO; 3639 extern ulong_t po_share; 3640 page_t *save_pp = pp; 3641 uint_t pszc = 0; 3642 3643 ASSERT(PAGE_LOCKED(pp) || panicstr); 3644 3645 if (PP_ISRO(pp) && (flags & HAT_SYNC_STOPON_MOD)) 3646 return (pp->p_nrm & nrmbits); 3647 3648 if ((flags & HAT_SYNC_ZERORM) == 0) { 3649 3650 if ((flags & HAT_SYNC_STOPON_REF) != 0 && PP_ISREF(pp)) 3651 return (pp->p_nrm & nrmbits); 3652 3653 if ((flags & HAT_SYNC_STOPON_MOD) != 0 && PP_ISMOD(pp)) 3654 return (pp->p_nrm & nrmbits); 3655 3656 if ((flags & HAT_SYNC_STOPON_SHARED) != 0 && 3657 hat_page_getshare(pp) > po_share) { 3658 if (PP_ISRO(pp)) 3659 PP_SETREF(pp); 3660 return (pp->p_nrm & nrmbits); 3661 } 3662 } 3663 3664 XPV_DISALLOW_MIGRATE(); 3665 next_size: 3666 /* 3667 * walk thru the mapping list syncing (and clearing) ref/mod bits. 3668 */ 3669 x86_hm_enter(pp); 3670 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 3671 if (ht->ht_level < pszc) 3672 continue; 3673 old = x86pte_get(ht, entry); 3674 try_again: 3675 3676 ASSERT(PTE2PFN(old, ht->ht_level) == pp->p_pagenum); 3677 3678 if (PTE_GET(old, PT_REF | PT_MOD) == 0) 3679 continue; 3680 3681 save_old = old; 3682 if ((flags & HAT_SYNC_ZERORM) != 0) { 3683 3684 /* 3685 * Need to clear ref or mod bits. Need to demap 3686 * to make sure any executing TLBs see cleared bits. 3687 */ 3688 new = old; 3689 PTE_CLR(new, PT_REF | PT_MOD); 3690 old = hati_update_pte(ht, entry, old, new); 3691 if (old != 0) 3692 goto try_again; 3693 3694 old = save_old; 3695 } 3696 3697 /* 3698 * Sync the PTE 3699 */ 3700 if (!(flags & HAT_SYNC_ZERORM) && 3701 PTE_GET(old, PT_SOFTWARE) <= PT_NOSYNC) 3702 hati_sync_pte_to_page(pp, old, ht->ht_level); 3703 3704 /* 3705 * can stop short if we found a ref'd or mod'd page 3706 */ 3707 if ((flags & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp) || 3708 (flags & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)) { 3709 x86_hm_exit(pp); 3710 goto done; 3711 } 3712 } 3713 x86_hm_exit(pp); 3714 while (pszc < pp->p_szc) { 3715 page_t *tpp; 3716 pszc++; 3717 tpp = PP_GROUPLEADER(pp, pszc); 3718 if (pp != tpp) { 3719 pp = tpp; 3720 goto next_size; 3721 } 3722 } 3723 done: 3724 XPV_ALLOW_MIGRATE(); 3725 return (save_pp->p_nrm & nrmbits); 3726 } 3727 3728 /* 3729 * returns approx number of mappings to this pp. A return of 0 implies 3730 * there are no mappings to the page. 3731 */ 3732 ulong_t 3733 hat_page_getshare(page_t *pp) 3734 { 3735 uint_t cnt; 3736 cnt = hment_mapcnt(pp); 3737 #if defined(__amd64) 3738 if (vpm_enable && pp->p_vpmref) { 3739 cnt += 1; 3740 } 3741 #endif 3742 return (cnt); 3743 } 3744 3745 /* 3746 * Return 1 the number of mappings exceeds sh_thresh. Return 0 3747 * otherwise. 3748 */ 3749 int 3750 hat_page_checkshare(page_t *pp, ulong_t sh_thresh) 3751 { 3752 return (hat_page_getshare(pp) > sh_thresh); 3753 } 3754 3755 /* 3756 * hat_softlock isn't supported anymore 3757 */ 3758 /*ARGSUSED*/ 3759 faultcode_t 3760 hat_softlock( 3761 hat_t *hat, 3762 caddr_t addr, 3763 size_t *len, 3764 struct page **page_array, 3765 uint_t flags) 3766 { 3767 return (FC_NOSUPPORT); 3768 } 3769 3770 3771 3772 /* 3773 * Routine to expose supported HAT features to platform independent code. 3774 */ 3775 /*ARGSUSED*/ 3776 int 3777 hat_supported(enum hat_features feature, void *arg) 3778 { 3779 switch (feature) { 3780 3781 case HAT_SHARED_PT: /* this is really ISM */ 3782 return (1); 3783 3784 case HAT_DYNAMIC_ISM_UNMAP: 3785 return (0); 3786 3787 case HAT_VMODSORT: 3788 return (1); 3789 3790 case HAT_SHARED_REGIONS: 3791 return (0); 3792 3793 default: 3794 panic("hat_supported() - unknown feature"); 3795 } 3796 return (0); 3797 } 3798 3799 /* 3800 * Called when a thread is exiting and has been switched to the kernel AS 3801 */ 3802 void 3803 hat_thread_exit(kthread_t *thd) 3804 { 3805 ASSERT(thd->t_procp->p_as == &kas); 3806 XPV_DISALLOW_MIGRATE(); 3807 hat_switch(thd->t_procp->p_as->a_hat); 3808 XPV_ALLOW_MIGRATE(); 3809 } 3810 3811 /* 3812 * Setup the given brand new hat structure as the new HAT on this cpu's mmu. 3813 */ 3814 /*ARGSUSED*/ 3815 void 3816 hat_setup(hat_t *hat, int flags) 3817 { 3818 XPV_DISALLOW_MIGRATE(); 3819 kpreempt_disable(); 3820 3821 hat_switch(hat); 3822 3823 kpreempt_enable(); 3824 XPV_ALLOW_MIGRATE(); 3825 } 3826 3827 /* 3828 * Prepare for a CPU private mapping for the given address. 3829 * 3830 * The address can only be used from a single CPU and can be remapped 3831 * using hat_mempte_remap(). Return the address of the PTE. 3832 * 3833 * We do the htable_create() if necessary and increment the valid count so 3834 * the htable can't disappear. We also hat_devload() the page table into 3835 * kernel so that the PTE is quickly accessed. 3836 */ 3837 hat_mempte_t 3838 hat_mempte_setup(caddr_t addr) 3839 { 3840 uintptr_t va = (uintptr_t)addr; 3841 htable_t *ht; 3842 uint_t entry; 3843 x86pte_t oldpte; 3844 hat_mempte_t p; 3845 3846 ASSERT(IS_PAGEALIGNED(va)); 3847 ASSERT(!IN_VA_HOLE(va)); 3848 ++curthread->t_hatdepth; 3849 XPV_DISALLOW_MIGRATE(); 3850 ht = htable_getpte(kas.a_hat, va, &entry, &oldpte, 0); 3851 if (ht == NULL) { 3852 ht = htable_create(kas.a_hat, va, 0, NULL); 3853 entry = htable_va2entry(va, ht); 3854 ASSERT(ht->ht_level == 0); 3855 oldpte = x86pte_get(ht, entry); 3856 } 3857 if (PTE_ISVALID(oldpte)) 3858 panic("hat_mempte_setup(): address already mapped" 3859 "ht=%p, entry=%d, pte=" FMT_PTE, (void *)ht, entry, oldpte); 3860 3861 /* 3862 * increment ht_valid_cnt so that the pagetable can't disappear 3863 */ 3864 HTABLE_INC(ht->ht_valid_cnt); 3865 3866 /* 3867 * return the PTE physical address to the caller. 3868 */ 3869 htable_release(ht); 3870 XPV_ALLOW_MIGRATE(); 3871 p = PT_INDEX_PHYSADDR(pfn_to_pa(ht->ht_pfn), entry); 3872 --curthread->t_hatdepth; 3873 return (p); 3874 } 3875 3876 /* 3877 * Release a CPU private mapping for the given address. 3878 * We decrement the htable valid count so it might be destroyed. 3879 */ 3880 /*ARGSUSED1*/ 3881 void 3882 hat_mempte_release(caddr_t addr, hat_mempte_t pte_pa) 3883 { 3884 htable_t *ht; 3885 3886 XPV_DISALLOW_MIGRATE(); 3887 /* 3888 * invalidate any left over mapping and decrement the htable valid count 3889 */ 3890 #ifdef __xpv 3891 if (HYPERVISOR_update_va_mapping((uintptr_t)addr, 0, 3892 UVMF_INVLPG | UVMF_LOCAL)) 3893 panic("HYPERVISOR_update_va_mapping() failed"); 3894 #else 3895 { 3896 x86pte_t *pteptr; 3897 3898 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3899 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3900 if (mmu.pae_hat) 3901 *pteptr = 0; 3902 else 3903 *(x86pte32_t *)pteptr = 0; 3904 mmu_tlbflush_entry(addr); 3905 x86pte_mapout(); 3906 } 3907 #endif 3908 3909 ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0); 3910 if (ht == NULL) 3911 panic("hat_mempte_release(): invalid address"); 3912 ASSERT(ht->ht_level == 0); 3913 HTABLE_DEC(ht->ht_valid_cnt); 3914 htable_release(ht); 3915 XPV_ALLOW_MIGRATE(); 3916 } 3917 3918 /* 3919 * Apply a temporary CPU private mapping to a page. We flush the TLB only 3920 * on this CPU, so this ought to have been called with preemption disabled. 3921 */ 3922 void 3923 hat_mempte_remap( 3924 pfn_t pfn, 3925 caddr_t addr, 3926 hat_mempte_t pte_pa, 3927 uint_t attr, 3928 uint_t flags) 3929 { 3930 uintptr_t va = (uintptr_t)addr; 3931 x86pte_t pte; 3932 3933 /* 3934 * Remap the given PTE to the new page's PFN. Invalidate only 3935 * on this CPU. 3936 */ 3937 #ifdef DEBUG 3938 htable_t *ht; 3939 uint_t entry; 3940 3941 ASSERT(IS_PAGEALIGNED(va)); 3942 ASSERT(!IN_VA_HOLE(va)); 3943 ht = htable_getpte(kas.a_hat, va, &entry, NULL, 0); 3944 ASSERT(ht != NULL); 3945 ASSERT(ht->ht_level == 0); 3946 ASSERT(ht->ht_valid_cnt > 0); 3947 ASSERT(ht->ht_pfn == mmu_btop(pte_pa)); 3948 htable_release(ht); 3949 #endif 3950 XPV_DISALLOW_MIGRATE(); 3951 pte = hati_mkpte(pfn, attr, 0, flags); 3952 #ifdef __xpv 3953 if (HYPERVISOR_update_va_mapping(va, pte, UVMF_INVLPG | UVMF_LOCAL)) 3954 panic("HYPERVISOR_update_va_mapping() failed"); 3955 #else 3956 { 3957 x86pte_t *pteptr; 3958 3959 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3960 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3961 if (mmu.pae_hat) 3962 *(x86pte_t *)pteptr = pte; 3963 else 3964 *(x86pte32_t *)pteptr = (x86pte32_t)pte; 3965 mmu_tlbflush_entry(addr); 3966 x86pte_mapout(); 3967 } 3968 #endif 3969 XPV_ALLOW_MIGRATE(); 3970 } 3971 3972 3973 3974 /* 3975 * Hat locking functions 3976 * XXX - these two functions are currently being used by hatstats 3977 * they can be removed by using a per-as mutex for hatstats. 3978 */ 3979 void 3980 hat_enter(hat_t *hat) 3981 { 3982 mutex_enter(&hat->hat_mutex); 3983 } 3984 3985 void 3986 hat_exit(hat_t *hat) 3987 { 3988 mutex_exit(&hat->hat_mutex); 3989 } 3990 3991 /* 3992 * HAT part of cpu initialization. 3993 */ 3994 void 3995 hat_cpu_online(struct cpu *cpup) 3996 { 3997 if (cpup != CPU) { 3998 x86pte_cpu_init(cpup); 3999 hat_vlp_setup(cpup); 4000 } 4001 CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id); 4002 } 4003 4004 /* 4005 * HAT part of cpu deletion. 4006 * (currently, we only call this after the cpu is safely passivated.) 4007 */ 4008 void 4009 hat_cpu_offline(struct cpu *cpup) 4010 { 4011 ASSERT(cpup != CPU); 4012 4013 CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id); 4014 x86pte_cpu_fini(cpup); 4015 hat_vlp_teardown(cpup); 4016 } 4017 4018 /* 4019 * Function called after all CPUs are brought online. 4020 * Used to remove low address boot mappings. 4021 */ 4022 void 4023 clear_boot_mappings(uintptr_t low, uintptr_t high) 4024 { 4025 uintptr_t vaddr = low; 4026 htable_t *ht = NULL; 4027 level_t level; 4028 uint_t entry; 4029 x86pte_t pte; 4030 4031 /* 4032 * On 1st CPU we can unload the prom mappings, basically we blow away 4033 * all virtual mappings under _userlimit. 4034 */ 4035 while (vaddr < high) { 4036 pte = htable_walk(kas.a_hat, &ht, &vaddr, high); 4037 if (ht == NULL) 4038 break; 4039 4040 level = ht->ht_level; 4041 entry = htable_va2entry(vaddr, ht); 4042 ASSERT(level <= mmu.max_page_level); 4043 ASSERT(PTE_ISPAGE(pte, level)); 4044 4045 /* 4046 * Unload the mapping from the page tables. 4047 */ 4048 (void) x86pte_inval(ht, entry, 0, NULL); 4049 ASSERT(ht->ht_valid_cnt > 0); 4050 HTABLE_DEC(ht->ht_valid_cnt); 4051 PGCNT_DEC(ht->ht_hat, ht->ht_level); 4052 4053 vaddr += LEVEL_SIZE(ht->ht_level); 4054 } 4055 if (ht) 4056 htable_release(ht); 4057 } 4058 4059 /* 4060 * Atomically update a new translation for a single page. If the 4061 * currently installed PTE doesn't match the value we expect to find, 4062 * it's not updated and we return the PTE we found. 4063 * 4064 * If activating nosync or NOWRITE and the page was modified we need to sync 4065 * with the page_t. Also sync with page_t if clearing ref/mod bits. 4066 */ 4067 static x86pte_t 4068 hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, x86pte_t new) 4069 { 4070 page_t *pp; 4071 uint_t rm = 0; 4072 x86pte_t replaced; 4073 4074 if (PTE_GET(expected, PT_SOFTWARE) < PT_NOSYNC && 4075 PTE_GET(expected, PT_MOD | PT_REF) && 4076 (PTE_GET(new, PT_NOSYNC) || !PTE_GET(new, PT_WRITABLE) || 4077 !PTE_GET(new, PT_MOD | PT_REF))) { 4078 4079 ASSERT(!pfn_is_foreign(PTE2PFN(expected, ht->ht_level))); 4080 pp = page_numtopp_nolock(PTE2PFN(expected, ht->ht_level)); 4081 ASSERT(pp != NULL); 4082 if (PTE_GET(expected, PT_MOD)) 4083 rm |= P_MOD; 4084 if (PTE_GET(expected, PT_REF)) 4085 rm |= P_REF; 4086 PTE_CLR(new, PT_MOD | PT_REF); 4087 } 4088 4089 replaced = x86pte_update(ht, entry, expected, new); 4090 if (replaced != expected) 4091 return (replaced); 4092 4093 if (rm) { 4094 /* 4095 * sync to all constituent pages of a large page 4096 */ 4097 pgcnt_t pgcnt = page_get_pagecnt(ht->ht_level); 4098 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 4099 while (pgcnt-- > 0) { 4100 /* 4101 * hat_page_demote() can't decrease 4102 * pszc below this mapping size 4103 * since large mapping existed after we 4104 * took mlist lock. 4105 */ 4106 ASSERT(pp->p_szc >= ht->ht_level); 4107 hat_page_setattr(pp, rm); 4108 ++pp; 4109 } 4110 } 4111 4112 return (0); 4113 } 4114 4115 /* ARGSUSED */ 4116 void 4117 hat_join_srd(struct hat *hat, vnode_t *evp) 4118 { 4119 } 4120 4121 /* ARGSUSED */ 4122 hat_region_cookie_t 4123 hat_join_region(struct hat *hat, 4124 caddr_t r_saddr, 4125 size_t r_size, 4126 void *r_obj, 4127 u_offset_t r_objoff, 4128 uchar_t r_perm, 4129 uchar_t r_pgszc, 4130 hat_rgn_cb_func_t r_cb_function, 4131 uint_t flags) 4132 { 4133 panic("No shared region support on x86"); 4134 return (HAT_INVALID_REGION_COOKIE); 4135 } 4136 4137 /* ARGSUSED */ 4138 void 4139 hat_leave_region(struct hat *hat, hat_region_cookie_t rcookie, uint_t flags) 4140 { 4141 panic("No shared region support on x86"); 4142 } 4143 4144 /* ARGSUSED */ 4145 void 4146 hat_dup_region(struct hat *hat, hat_region_cookie_t rcookie) 4147 { 4148 panic("No shared region support on x86"); 4149 } 4150 4151 4152 /* 4153 * Kernel Physical Mapping (kpm) facility 4154 * 4155 * Most of the routines needed to support segkpm are almost no-ops on the 4156 * x86 platform. We map in the entire segment when it is created and leave 4157 * it mapped in, so there is no additional work required to set up and tear 4158 * down individual mappings. All of these routines were created to support 4159 * SPARC platforms that have to avoid aliasing in their virtually indexed 4160 * caches. 4161 * 4162 * Most of the routines have sanity checks in them (e.g. verifying that the 4163 * passed-in page is locked). We don't actually care about most of these 4164 * checks on x86, but we leave them in place to identify problems in the 4165 * upper levels. 4166 */ 4167 4168 /* 4169 * Map in a locked page and return the vaddr. 4170 */ 4171 /*ARGSUSED*/ 4172 caddr_t 4173 hat_kpm_mapin(struct page *pp, struct kpme *kpme) 4174 { 4175 caddr_t vaddr; 4176 4177 #ifdef DEBUG 4178 if (kpm_enable == 0) { 4179 cmn_err(CE_WARN, "hat_kpm_mapin: kpm_enable not set\n"); 4180 return ((caddr_t)NULL); 4181 } 4182 4183 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 4184 cmn_err(CE_WARN, "hat_kpm_mapin: pp zero or not locked\n"); 4185 return ((caddr_t)NULL); 4186 } 4187 #endif 4188 4189 vaddr = hat_kpm_page2va(pp, 1); 4190 4191 return (vaddr); 4192 } 4193 4194 /* 4195 * Mapout a locked page. 4196 */ 4197 /*ARGSUSED*/ 4198 void 4199 hat_kpm_mapout(struct page *pp, struct kpme *kpme, caddr_t vaddr) 4200 { 4201 #ifdef DEBUG 4202 if (kpm_enable == 0) { 4203 cmn_err(CE_WARN, "hat_kpm_mapout: kpm_enable not set\n"); 4204 return; 4205 } 4206 4207 if (IS_KPM_ADDR(vaddr) == 0) { 4208 cmn_err(CE_WARN, "hat_kpm_mapout: no kpm address\n"); 4209 return; 4210 } 4211 4212 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 4213 cmn_err(CE_WARN, "hat_kpm_mapout: page zero or not locked\n"); 4214 return; 4215 } 4216 #endif 4217 } 4218 4219 /* 4220 * Return the kpm virtual address for a specific pfn 4221 */ 4222 caddr_t 4223 hat_kpm_pfn2va(pfn_t pfn) 4224 { 4225 uintptr_t vaddr = (uintptr_t)kpm_vbase + mmu_ptob(pfn); 4226 4227 ASSERT(!pfn_is_foreign(pfn)); 4228 return ((caddr_t)vaddr); 4229 } 4230 4231 /* 4232 * Return the kpm virtual address for the page at pp. 4233 */ 4234 /*ARGSUSED*/ 4235 caddr_t 4236 hat_kpm_page2va(struct page *pp, int checkswap) 4237 { 4238 return (hat_kpm_pfn2va(pp->p_pagenum)); 4239 } 4240 4241 /* 4242 * Return the page frame number for the kpm virtual address vaddr. 4243 */ 4244 pfn_t 4245 hat_kpm_va2pfn(caddr_t vaddr) 4246 { 4247 pfn_t pfn; 4248 4249 ASSERT(IS_KPM_ADDR(vaddr)); 4250 4251 pfn = (pfn_t)btop(vaddr - kpm_vbase); 4252 4253 return (pfn); 4254 } 4255 4256 4257 /* 4258 * Return the page for the kpm virtual address vaddr. 4259 */ 4260 page_t * 4261 hat_kpm_vaddr2page(caddr_t vaddr) 4262 { 4263 pfn_t pfn; 4264 4265 ASSERT(IS_KPM_ADDR(vaddr)); 4266 4267 pfn = hat_kpm_va2pfn(vaddr); 4268 4269 return (page_numtopp_nolock(pfn)); 4270 } 4271 4272 /* 4273 * hat_kpm_fault is called from segkpm_fault when we take a page fault on a 4274 * KPM page. This should never happen on x86 4275 */ 4276 int 4277 hat_kpm_fault(hat_t *hat, caddr_t vaddr) 4278 { 4279 panic("pagefault in seg_kpm. hat: 0x%p vaddr: 0x%p", 4280 (void *)hat, (void *)vaddr); 4281 4282 return (0); 4283 } 4284 4285 /*ARGSUSED*/ 4286 void 4287 hat_kpm_mseghash_clear(int nentries) 4288 {} 4289 4290 /*ARGSUSED*/ 4291 void 4292 hat_kpm_mseghash_update(pgcnt_t inx, struct memseg *msp) 4293 {} 4294 4295 #ifdef __xpv 4296 /* 4297 * There are specific Hypervisor calls to establish and remove mappings 4298 * to grant table references and the privcmd driver. We have to ensure 4299 * that a page table actually exists. 4300 */ 4301 void 4302 hat_prepare_mapping(hat_t *hat, caddr_t addr, uint64_t *pte_ma) 4303 { 4304 maddr_t base_ma; 4305 htable_t *ht; 4306 uint_t entry; 4307 4308 ASSERT(IS_P2ALIGNED((uintptr_t)addr, MMU_PAGESIZE)); 4309 XPV_DISALLOW_MIGRATE(); 4310 ht = htable_create(hat, (uintptr_t)addr, 0, NULL); 4311 4312 /* 4313 * if an address for pte_ma is passed in, return the MA of the pte 4314 * for this specific address. This address is only valid as long 4315 * as the htable stays locked. 4316 */ 4317 if (pte_ma != NULL) { 4318 entry = htable_va2entry((uintptr_t)addr, ht); 4319 base_ma = pa_to_ma(ptob(ht->ht_pfn)); 4320 *pte_ma = base_ma + (entry << mmu.pte_size_shift); 4321 } 4322 XPV_ALLOW_MIGRATE(); 4323 } 4324 4325 void 4326 hat_release_mapping(hat_t *hat, caddr_t addr) 4327 { 4328 htable_t *ht; 4329 4330 ASSERT(IS_P2ALIGNED((uintptr_t)addr, MMU_PAGESIZE)); 4331 XPV_DISALLOW_MIGRATE(); 4332 ht = htable_lookup(hat, (uintptr_t)addr, 0); 4333 ASSERT(ht != NULL); 4334 ASSERT(ht->ht_busy >= 2); 4335 htable_release(ht); 4336 htable_release(ht); 4337 XPV_ALLOW_MIGRATE(); 4338 } 4339 #endif 4340