1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* 29 * VM - Hardware Address Translation management for i386 and amd64 30 * 31 * Implementation of the interfaces described in <common/vm/hat.h> 32 * 33 * Nearly all the details of how the hardware is managed should not be 34 * visible outside this layer except for misc. machine specific functions 35 * that work in conjunction with this code. 36 * 37 * Routines used only inside of i86pc/vm start with hati_ for HAT Internal. 38 */ 39 40 #include <sys/machparam.h> 41 #include <sys/machsystm.h> 42 #include <sys/mman.h> 43 #include <sys/types.h> 44 #include <sys/systm.h> 45 #include <sys/cpuvar.h> 46 #include <sys/thread.h> 47 #include <sys/proc.h> 48 #include <sys/cpu.h> 49 #include <sys/kmem.h> 50 #include <sys/disp.h> 51 #include <sys/shm.h> 52 #include <sys/sysmacros.h> 53 #include <sys/machparam.h> 54 #include <sys/vmem.h> 55 #include <sys/vmsystm.h> 56 #include <sys/promif.h> 57 #include <sys/var.h> 58 #include <sys/x86_archext.h> 59 #include <sys/atomic.h> 60 #include <sys/bitmap.h> 61 #include <sys/controlregs.h> 62 #include <sys/bootconf.h> 63 #include <sys/bootsvcs.h> 64 #include <sys/bootinfo.h> 65 66 #include <vm/seg_kmem.h> 67 #include <vm/hat_i86.h> 68 #include <vm/as.h> 69 #include <vm/seg.h> 70 #include <vm/page.h> 71 #include <vm/seg_kp.h> 72 #include <vm/seg_kpm.h> 73 #include <vm/vm_dep.h> 74 #include <vm/kboot_mmu.h> 75 76 #include <sys/cmn_err.h> 77 78 /* 79 * Basic parameters for hat operation. 80 */ 81 struct hat_mmu_info mmu; 82 83 /* 84 * The page that is the kernel's top level pagetable. 85 * 86 * For 32 bit VLP support, the kernel hat will use the 1st 4 entries 87 * on this 4K page for its top level page table. The remaining groups of 88 * 4 entries are used for per processor copies of user VLP pagetables for 89 * running threads. See hat_switch() and reload_pae32() for details. 90 * 91 * vlp_page[0] - 0th level==2 PTE for kernel HAT (will be zero) 92 * vlp_page[1] - 1st level==2 PTE for kernel HAT (will be zero) 93 * vlp_page[2] - 2nd level==2 PTE for kernel HAT (zero for small memory) 94 * vlp_page[3] - 3rd level==2 PTE for kernel 95 * 96 * vlp_page[4] - 0th level==2 PTE for user thread on cpu 0 97 * vlp_page[5] - 1st level==2 PTE for user thread on cpu 0 98 * vlp_page[6] - 2nd level==2 PTE for user thread on cpu 0 99 * vlp_page[7] - probably copy of kernel PTE 100 * 101 * vlp_page[8] - 0th level==2 PTE for user thread on cpu 1 102 * vlp_page[9] - 1st level==2 PTE for user thread on cpu 1 103 * vlp_page[10] - 2nd level==2 PTE for user thread on cpu 1 104 * vlp_page[11] - probably copy of kernel PTE 105 * ... 106 * 107 * when / where the kernel PTE's are (entry 2 or 3 or none) depends 108 * on kernelbase. 109 */ 110 static x86pte_t *vlp_page; 111 112 /* 113 * forward declaration of internal utility routines 114 */ 115 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, 116 x86pte_t new); 117 118 /* 119 * The kernel address space exists in all HATs. To implement this the 120 * kernel reserves a fixed number of entries in every topmost level page 121 * table. The values are setup in hat_init() and then copied to every hat 122 * created by hat_alloc(). This means that kernelbase must be: 123 * 124 * 4Meg aligned for 32 bit kernels 125 * 512Gig aligned for x86_64 64 bit kernel 126 * 127 * The PAE 32 bit hat is handled as a special case. Otherwise requiring 1Gig 128 * alignment would use too much VA for the kernel. 129 * 130 */ 131 static uint_t khat_start; /* index of 1st entry in kernel's top ptable */ 132 static uint_t khat_entries; /* number of entries in kernel's top ptable */ 133 134 #if defined(__i386) 135 136 static htable_t *khat_pae32_htable = NULL; 137 static uint_t khat_pae32_start; 138 static uint_t khat_pae32_entries; 139 140 #endif 141 142 uint_t use_boot_reserve = 1; /* cleared after early boot process */ 143 uint_t can_steal_post_boot = 0; /* set late in boot to enable stealing */ 144 145 /* 146 * A cpuset for all cpus. This is used for kernel address cross calls, since 147 * the kernel addresses apply to all cpus. 148 */ 149 cpuset_t khat_cpuset; 150 151 /* 152 * management stuff for hat structures 153 */ 154 kmutex_t hat_list_lock; 155 kcondvar_t hat_list_cv; 156 kmem_cache_t *hat_cache; 157 kmem_cache_t *hat_hash_cache; 158 kmem_cache_t *vlp_hash_cache; 159 160 /* 161 * Simple statistics 162 */ 163 struct hatstats hatstat; 164 165 /* 166 * useful stuff for atomic access/clearing/setting REF/MOD/RO bits in page_t's. 167 */ 168 extern void atomic_orb(uchar_t *addr, uchar_t val); 169 extern void atomic_andb(uchar_t *addr, uchar_t val); 170 171 #define PP_GETRM(pp, rmmask) (pp->p_nrm & rmmask) 172 #define PP_ISMOD(pp) PP_GETRM(pp, P_MOD) 173 #define PP_ISREF(pp) PP_GETRM(pp, P_REF) 174 #define PP_ISRO(pp) PP_GETRM(pp, P_RO) 175 176 #define PP_SETRM(pp, rm) atomic_orb(&(pp->p_nrm), rm) 177 #define PP_SETMOD(pp) PP_SETRM(pp, P_MOD) 178 #define PP_SETREF(pp) PP_SETRM(pp, P_REF) 179 #define PP_SETRO(pp) PP_SETRM(pp, P_RO) 180 181 #define PP_CLRRM(pp, rm) atomic_andb(&(pp->p_nrm), ~(rm)) 182 #define PP_CLRMOD(pp) PP_CLRRM(pp, P_MOD) 183 #define PP_CLRREF(pp) PP_CLRRM(pp, P_REF) 184 #define PP_CLRRO(pp) PP_CLRRM(pp, P_RO) 185 #define PP_CLRALL(pp) PP_CLRRM(pp, P_MOD | P_REF | P_RO) 186 187 /* 188 * some useful tracing macros 189 */ 190 191 int hattrace = 0; 192 #ifdef DEBUG 193 194 #define HATIN(r, h, a, l) \ 195 if (hattrace) prom_printf("->%s hat=%p, adr=%p, len=%lx\n", #r, h, a, l) 196 197 #define HATOUT(r, h, a) \ 198 if (hattrace) prom_printf("<-%s hat=%p, adr=%p\n", #r, h, a) 199 #else 200 201 #define HATIN(r, h, a, l) 202 #define HATOUT(r, h, a) 203 204 #endif 205 206 207 /* 208 * kmem cache constructor for struct hat 209 */ 210 /*ARGSUSED*/ 211 static int 212 hati_constructor(void *buf, void *handle, int kmflags) 213 { 214 hat_t *hat = buf; 215 216 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 217 bzero(hat->hat_pages_mapped, 218 sizeof (pgcnt_t) * (mmu.max_page_level + 1)); 219 hat->hat_stats = 0; 220 hat->hat_flags = 0; 221 mutex_init(&hat->hat_switch_mutex, NULL, MUTEX_DRIVER, 222 (void *)ipltospl(DISP_LEVEL)); 223 CPUSET_ZERO(hat->hat_cpus); 224 hat->hat_htable = NULL; 225 hat->hat_ht_hash = NULL; 226 return (0); 227 } 228 229 /* 230 * Allocate a hat structure for as. We also create the top level 231 * htable and initialize it to contain the kernel hat entries. 232 */ 233 hat_t * 234 hat_alloc(struct as *as) 235 { 236 hat_t *hat; 237 htable_t *ht; /* top level htable */ 238 uint_t use_vlp; 239 240 /* 241 * Once we start creating user process HATs we can enable 242 * the htable_steal() code. 243 */ 244 if (can_steal_post_boot == 0) 245 can_steal_post_boot = 1; 246 247 ASSERT(AS_WRITE_HELD(as, &as->a_lock)); 248 hat = kmem_cache_alloc(hat_cache, KM_SLEEP); 249 hat->hat_as = as; 250 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 251 ASSERT(hat->hat_flags == 0); 252 253 /* 254 * a 32 bit process uses a VLP style hat when using PAE 255 */ 256 #if defined(__amd64) 257 use_vlp = (ttoproc(curthread)->p_model == DATAMODEL_ILP32); 258 #elif defined(__i386) 259 use_vlp = mmu.pae_hat; 260 #endif 261 if (use_vlp) { 262 hat->hat_flags = HAT_VLP; 263 bzero(hat->hat_vlp_ptes, VLP_SIZE); 264 } 265 266 /* 267 * Allocate the htable hash 268 */ 269 if ((hat->hat_flags & HAT_VLP)) { 270 hat->hat_num_hash = mmu.vlp_hash_cnt; 271 hat->hat_ht_hash = kmem_cache_alloc(vlp_hash_cache, KM_SLEEP); 272 } else { 273 hat->hat_num_hash = mmu.hash_cnt; 274 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP); 275 } 276 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *)); 277 278 /* 279 * Initialize Kernel HAT entries at the top of the top level page 280 * table for the new hat. 281 * 282 * Note that we don't call htable_release() for the top level, that 283 * happens when the hat is destroyed in hat_free_end() 284 */ 285 hat->hat_htable = NULL; 286 hat->hat_ht_cached = NULL; 287 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL); 288 289 if (!(hat->hat_flags & HAT_VLP)) 290 x86pte_copy(kas.a_hat->hat_htable, ht, khat_start, 291 khat_entries); 292 #if defined(__i386) 293 else if (khat_entries > 0) 294 bcopy(vlp_page + khat_start, hat->hat_vlp_ptes + khat_start, 295 khat_entries * sizeof (x86pte_t)); 296 #endif 297 hat->hat_htable = ht; 298 299 #if defined(__i386) 300 /* 301 * PAE32 HAT alignment is less restrictive than the others to keep 302 * the kernel from using too much VA. Because of this we may need 303 * one layer further down when kernelbase isn't 1Gig aligned. 304 * See hat_free_end() for the htable_release() that goes with this 305 * htable_create() 306 */ 307 if (khat_pae32_htable != NULL) { 308 ht = htable_create(hat, kernelbase, 309 khat_pae32_htable->ht_level, NULL); 310 x86pte_copy(khat_pae32_htable, ht, khat_pae32_start, 311 khat_pae32_entries); 312 ht->ht_valid_cnt = khat_pae32_entries; 313 } 314 #endif 315 316 /* 317 * Put it at the start of the global list of all hats (used by stealing) 318 * 319 * kas.a_hat is not in the list but is instead used to find the 320 * first and last items in the list. 321 * 322 * - kas.a_hat->hat_next points to the start of the user hats. 323 * The list ends where hat->hat_next == NULL 324 * 325 * - kas.a_hat->hat_prev points to the last of the user hats. 326 * The list begins where hat->hat_prev == NULL 327 */ 328 mutex_enter(&hat_list_lock); 329 hat->hat_prev = NULL; 330 hat->hat_next = kas.a_hat->hat_next; 331 if (hat->hat_next) 332 hat->hat_next->hat_prev = hat; 333 else 334 kas.a_hat->hat_prev = hat; 335 kas.a_hat->hat_next = hat; 336 mutex_exit(&hat_list_lock); 337 338 return (hat); 339 } 340 341 /* 342 * process has finished executing but as has not been cleaned up yet. 343 */ 344 /*ARGSUSED*/ 345 void 346 hat_free_start(hat_t *hat) 347 { 348 ASSERT(AS_WRITE_HELD(hat->hat_as, &hat->hat_as->a_lock)); 349 350 /* 351 * If the hat is currently a stealing victim, wait for the stealing 352 * to finish. Once we mark it as HAT_FREEING, htable_steal() 353 * won't look at its pagetables anymore. 354 */ 355 mutex_enter(&hat_list_lock); 356 while (hat->hat_flags & HAT_VICTIM) 357 cv_wait(&hat_list_cv, &hat_list_lock); 358 hat->hat_flags |= HAT_FREEING; 359 mutex_exit(&hat_list_lock); 360 } 361 362 /* 363 * An address space is being destroyed, so we destroy the associated hat. 364 */ 365 void 366 hat_free_end(hat_t *hat) 367 { 368 int i; 369 kmem_cache_t *cache; 370 371 #ifdef DEBUG 372 for (i = 0; i <= mmu.max_page_level; i++) 373 ASSERT(hat->hat_pages_mapped[i] == 0); 374 #endif 375 ASSERT(hat->hat_flags & HAT_FREEING); 376 377 /* 378 * must not be running on the given hat 379 */ 380 ASSERT(CPU->cpu_current_hat != hat); 381 382 /* 383 * Remove it from the list of HATs 384 */ 385 mutex_enter(&hat_list_lock); 386 if (hat->hat_prev) 387 hat->hat_prev->hat_next = hat->hat_next; 388 else 389 kas.a_hat->hat_next = hat->hat_next; 390 if (hat->hat_next) 391 hat->hat_next->hat_prev = hat->hat_prev; 392 else 393 kas.a_hat->hat_prev = hat->hat_prev; 394 mutex_exit(&hat_list_lock); 395 hat->hat_next = hat->hat_prev = NULL; 396 397 /* 398 * Make a pass through the htables freeing them all up. 399 */ 400 htable_purge_hat(hat); 401 402 /* 403 * Decide which kmem cache the hash table came from, then free it. 404 */ 405 if (hat->hat_flags & HAT_VLP) 406 cache = vlp_hash_cache; 407 else 408 cache = hat_hash_cache; 409 kmem_cache_free(cache, hat->hat_ht_hash); 410 hat->hat_ht_hash = NULL; 411 412 hat->hat_flags = 0; 413 kmem_cache_free(hat_cache, hat); 414 } 415 416 /* 417 * round kernelbase down to a supported value to use for _userlimit 418 * 419 * userlimit must be aligned down to an entry in the top level htable. 420 * The one exception is for 32 bit HAT's running PAE. 421 */ 422 uintptr_t 423 hat_kernelbase(uintptr_t va) 424 { 425 #if defined(__i386) 426 va &= LEVEL_MASK(1); 427 #endif 428 if (IN_VA_HOLE(va)) 429 panic("_userlimit %p will fall in VA hole\n", (void *)va); 430 return (va); 431 } 432 433 /* 434 * Initialize hat data structures based on processor MMU information. 435 */ 436 void 437 mmu_init(void) 438 { 439 uint_t max_htables; 440 uint_t pa_bits; 441 uint_t va_bits; 442 int i; 443 444 /* 445 * If CPU enabled the page table global bit, use it for the kernel 446 * This is bit 7 in CR4 (PGE - Page Global Enable). 447 */ 448 if ((x86_feature & X86_PGE) != 0 && (getcr4() & CR4_PGE) != 0) 449 mmu.pt_global = PT_GLOBAL; 450 451 /* 452 * Detect NX and PAE usage. 453 */ 454 mmu.pae_hat = kbm_pae_support; 455 if (kbm_nx_support) 456 mmu.pt_nx = PT_NX; 457 else 458 mmu.pt_nx = 0; 459 460 /* 461 * Use CPU info to set various MMU parameters 462 */ 463 cpuid_get_addrsize(CPU, &pa_bits, &va_bits); 464 465 if (va_bits < sizeof (void *) * NBBY) { 466 mmu.hole_start = (1ul << (va_bits - 1)); 467 mmu.hole_end = 0ul - mmu.hole_start - 1; 468 } else { 469 mmu.hole_end = 0; 470 mmu.hole_start = mmu.hole_end - 1; 471 } 472 #if defined(OPTERON_ERRATUM_121) 473 /* 474 * If erratum 121 has already been detected at this time, hole_start 475 * contains the value to be subtracted from mmu.hole_start. 476 */ 477 ASSERT(hole_start == 0 || opteron_erratum_121 != 0); 478 hole_start = mmu.hole_start - hole_start; 479 #else 480 hole_start = mmu.hole_start; 481 #endif 482 hole_end = mmu.hole_end; 483 484 mmu.highest_pfn = mmu_btop((1ull << pa_bits) - 1); 485 if (mmu.pae_hat == 0 && pa_bits > 32) 486 mmu.highest_pfn = PFN_4G - 1; 487 488 if (mmu.pae_hat) { 489 mmu.pte_size = 8; /* 8 byte PTEs */ 490 mmu.pte_size_shift = 3; 491 } else { 492 mmu.pte_size = 4; /* 4 byte PTEs */ 493 mmu.pte_size_shift = 2; 494 } 495 496 if (mmu.pae_hat && (x86_feature & X86_PAE) == 0) 497 panic("Processor does not support PAE"); 498 499 if ((x86_feature & X86_CX8) == 0) 500 panic("Processor does not support cmpxchg8b instruction"); 501 502 /* 503 * Initialize parameters based on the 64 or 32 bit kernels and 504 * for the 32 bit kernel decide if we should use PAE. 505 */ 506 if (kbm_largepage_support) 507 mmu.max_page_level = 1; 508 else 509 mmu.max_page_level = 0; 510 mmu_page_sizes = mmu.max_page_level + 1; 511 mmu_exported_page_sizes = mmu_page_sizes; 512 513 #if defined(__amd64) 514 515 mmu.num_level = 4; 516 mmu.max_level = 3; 517 mmu.ptes_per_table = 512; 518 mmu.top_level_count = 512; 519 520 mmu.level_shift[0] = 12; 521 mmu.level_shift[1] = 21; 522 mmu.level_shift[2] = 30; 523 mmu.level_shift[3] = 39; 524 525 #elif defined(__i386) 526 527 if (mmu.pae_hat) { 528 mmu.num_level = 3; 529 mmu.max_level = 2; 530 mmu.ptes_per_table = 512; 531 mmu.top_level_count = 4; 532 533 mmu.level_shift[0] = 12; 534 mmu.level_shift[1] = 21; 535 mmu.level_shift[2] = 30; 536 537 } else { 538 mmu.num_level = 2; 539 mmu.max_level = 1; 540 mmu.ptes_per_table = 1024; 541 mmu.top_level_count = 1024; 542 543 mmu.level_shift[0] = 12; 544 mmu.level_shift[1] = 22; 545 } 546 547 #endif /* __i386 */ 548 549 for (i = 0; i < mmu.num_level; ++i) { 550 mmu.level_size[i] = 1UL << mmu.level_shift[i]; 551 mmu.level_offset[i] = mmu.level_size[i] - 1; 552 mmu.level_mask[i] = ~mmu.level_offset[i]; 553 } 554 555 for (i = 0; i <= mmu.max_page_level; ++i) { 556 mmu.pte_bits[i] = PT_VALID; 557 if (i > 0) 558 mmu.pte_bits[i] |= PT_PAGESIZE; 559 } 560 561 /* 562 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level. 563 */ 564 for (i = 1; i < mmu.num_level; ++i) 565 mmu.ptp_bits[i] = PT_PTPBITS; 566 567 #if defined(__i386) 568 mmu.ptp_bits[2] = PT_VALID; 569 #endif 570 571 /* 572 * Compute how many hash table entries to have per process for htables. 573 * We start with 1 page's worth of entries. 574 * 575 * If physical memory is small, reduce the amount need to cover it. 576 */ 577 max_htables = physmax / mmu.ptes_per_table; 578 mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *); 579 while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables) 580 mmu.hash_cnt >>= 1; 581 mmu.vlp_hash_cnt = mmu.hash_cnt; 582 583 #if defined(__amd64) 584 /* 585 * If running in 64 bits and physical memory is large, 586 * increase the size of the cache to cover all of memory for 587 * a 64 bit process. 588 */ 589 #define HASH_MAX_LENGTH 4 590 while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables) 591 mmu.hash_cnt <<= 1; 592 #endif 593 } 594 595 596 /* 597 * initialize hat data structures 598 */ 599 void 600 hat_init() 601 { 602 #if defined(__i386) 603 /* 604 * _userlimit must be aligned correctly 605 */ 606 if ((_userlimit & LEVEL_MASK(1)) != _userlimit) { 607 prom_printf("hat_init(): _userlimit=%p, not aligned at %p\n", 608 (void *)_userlimit, (void *)LEVEL_SIZE(1)); 609 halt("hat_init(): Unable to continue"); 610 } 611 #endif 612 613 cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL); 614 615 /* 616 * initialize kmem caches 617 */ 618 htable_init(); 619 hment_init(); 620 621 hat_cache = kmem_cache_create("hat_t", 622 sizeof (hat_t), 0, hati_constructor, NULL, NULL, 623 NULL, 0, 0); 624 625 hat_hash_cache = kmem_cache_create("HatHash", 626 mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 627 NULL, 0, 0); 628 629 /* 630 * VLP hats can use a smaller hash table size on large memroy machines 631 */ 632 if (mmu.hash_cnt == mmu.vlp_hash_cnt) { 633 vlp_hash_cache = hat_hash_cache; 634 } else { 635 vlp_hash_cache = kmem_cache_create("HatVlpHash", 636 mmu.vlp_hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 637 NULL, 0, 0); 638 } 639 640 /* 641 * Set up the kernel's hat 642 */ 643 AS_LOCK_ENTER(&kas, &kas.a_lock, RW_WRITER); 644 kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP); 645 mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 646 kas.a_hat->hat_as = &kas; 647 kas.a_hat->hat_flags = 0; 648 AS_LOCK_EXIT(&kas, &kas.a_lock); 649 650 CPUSET_ZERO(khat_cpuset); 651 CPUSET_ADD(khat_cpuset, CPU->cpu_id); 652 653 /* 654 * The kernel hat's next pointer serves as the head of the hat list . 655 * The kernel hat's prev pointer tracks the last hat on the list for 656 * htable_steal() to use. 657 */ 658 kas.a_hat->hat_next = NULL; 659 kas.a_hat->hat_prev = NULL; 660 661 /* 662 * Allocate an htable hash bucket for the kernel 663 * XX64 - tune for 64 bit procs 664 */ 665 kas.a_hat->hat_num_hash = mmu.hash_cnt; 666 kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP); 667 bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *)); 668 669 /* 670 * zero out the top level and cached htable pointers 671 */ 672 kas.a_hat->hat_ht_cached = NULL; 673 kas.a_hat->hat_htable = NULL; 674 675 /* 676 * Pre-allocate hrm_hashtab before enabling the collection of 677 * refmod statistics. Allocating on the fly would mean us 678 * running the risk of suffering recursive mutex enters or 679 * deadlocks. 680 */ 681 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *), 682 KM_SLEEP); 683 } 684 685 /* 686 * Prepare CPU specific pagetables for VLP processes on 64 bit kernels. 687 * 688 * Each CPU has a set of 2 pagetables that are reused for any 32 bit 689 * process it runs. They are the top level pagetable, hci_vlp_l3ptes, and 690 * the next to top level table for the bottom 512 Gig, hci_vlp_l2ptes. 691 */ 692 /*ARGSUSED*/ 693 static void 694 hat_vlp_setup(struct cpu *cpu) 695 { 696 #if defined(__amd64) 697 struct hat_cpu_info *hci = cpu->cpu_hat_info; 698 pfn_t pfn; 699 700 /* 701 * allocate the level==2 page table for the bottom most 702 * 512Gig of address space (this is where 32 bit apps live) 703 */ 704 ASSERT(hci != NULL); 705 hci->hci_vlp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 706 707 /* 708 * Allocate a top level pagetable and copy the kernel's 709 * entries into it. Then link in hci_vlp_l2ptes in the 1st entry. 710 */ 711 hci->hci_vlp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 712 hci->hci_vlp_pfn = 713 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l3ptes); 714 ASSERT(hci->hci_vlp_pfn != PFN_INVALID); 715 bcopy(vlp_page + khat_start, hci->hci_vlp_l3ptes + khat_start, 716 khat_entries * sizeof (x86pte_t)); 717 718 pfn = hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l2ptes); 719 ASSERT(pfn != PFN_INVALID); 720 hci->hci_vlp_l3ptes[0] = MAKEPTP(pfn, 2); 721 #endif /* __amd64 */ 722 } 723 724 /*ARGSUSED*/ 725 static void 726 hat_vlp_teardown(cpu_t *cpu) 727 { 728 #if defined(__amd64) 729 struct hat_cpu_info *hci; 730 731 if ((hci = cpu->cpu_hat_info) == NULL) 732 return; 733 if (hci->hci_vlp_l2ptes) 734 kmem_free(hci->hci_vlp_l2ptes, MMU_PAGESIZE); 735 if (hci->hci_vlp_l3ptes) 736 kmem_free(hci->hci_vlp_l3ptes, MMU_PAGESIZE); 737 #endif /* __amd64 */ 738 } 739 740 /* 741 * Finish filling in the kernel hat. 742 * Pre fill in all top level kernel page table entries for the kernel's 743 * part of the address range. From this point on we can't use any new 744 * kernel large pages if they need PTE's at max_level 745 * 746 * create the kmap mappings. 747 */ 748 void 749 hat_init_finish(void) 750 { 751 htable_t *top = kas.a_hat->hat_htable; 752 htable_t *ht; 753 uint_t e; 754 x86pte_t pte; 755 uintptr_t va = kernelbase; 756 size_t size; 757 758 759 #if defined(__i386) 760 ASSERT((va & LEVEL_MASK(1)) == va); 761 762 /* 763 * Deal with kernelbase not 1Gig aligned for 32 bit PAE hats. 764 */ 765 if (!mmu.pae_hat || (va & LEVEL_OFFSET(mmu.max_level)) == 0) { 766 khat_pae32_htable = NULL; 767 } else { 768 ASSERT(mmu.max_level == 2); 769 ASSERT((va & LEVEL_OFFSET(mmu.max_level - 1)) == 0); 770 khat_pae32_htable = 771 htable_create(kas.a_hat, va, mmu.max_level - 1, NULL); 772 khat_pae32_start = htable_va2entry(va, khat_pae32_htable); 773 khat_pae32_entries = mmu.ptes_per_table - khat_pae32_start; 774 for (e = khat_pae32_start; e < mmu.ptes_per_table; 775 ++e, va += LEVEL_SIZE(mmu.max_level - 1)) { 776 pte = x86pte_get(khat_pae32_htable, e); 777 if (PTE_ISVALID(pte)) 778 continue; 779 ht = htable_create(kas.a_hat, va, mmu.max_level - 2, 780 NULL); 781 ASSERT(ht != NULL); 782 } 783 } 784 #endif 785 786 /* 787 * The kernel hat will need fixed values in the highest level 788 * ptable for copying to all other hat's. This implies 789 * alignment restrictions on _userlimit. 790 * 791 * Note we don't htable_release() these htables. This keeps them 792 * from ever being stolen or free'd. 793 * 794 * top_level_count is used instead of ptes_per_table, since 795 * on 32-bit PAE we only have 4 usable entries at the top level ptable. 796 */ 797 if (va == 0) 798 khat_start = mmu.top_level_count; 799 else 800 khat_start = htable_va2entry(va, kas.a_hat->hat_htable); 801 khat_entries = mmu.top_level_count - khat_start; 802 for (e = khat_start; e < mmu.top_level_count; 803 ++e, va += LEVEL_SIZE(mmu.max_level)) { 804 if (IN_HYPERVISOR_VA(va)) 805 continue; 806 pte = x86pte_get(top, e); 807 if (PTE_ISVALID(pte)) 808 continue; 809 ht = htable_create(kas.a_hat, va, mmu.max_level - 1, NULL); 810 ASSERT(ht != NULL); 811 } 812 813 /* 814 * We are now effectively running on the kernel hat. 815 * Clearing use_boot_reserve shuts off using the pre-allocated boot 816 * reserve for all HAT allocations. From here on, the reserves are 817 * only used when mapping in memory for the hat's own allocations. 818 */ 819 use_boot_reserve = 0; 820 htable_adjust_reserve(); 821 822 /* 823 * 32 bit kernels use only 4 of the 512 entries in its top level 824 * pagetable. We'll use the remainder for the "per CPU" page tables 825 * for VLP processes. 826 * 827 * We also map the top level kernel pagetable into the kernel to make 828 * it easy to use bcopy to initialize new address spaces. 829 */ 830 if (mmu.pae_hat) { 831 vlp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP); 832 hat_devload(kas.a_hat, (caddr_t)vlp_page, MMU_PAGESIZE, 833 kas.a_hat->hat_htable->ht_pfn, 834 PROT_WRITE | 835 PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK, 836 HAT_LOAD | HAT_LOAD_NOCONSIST); 837 } 838 hat_vlp_setup(CPU); 839 840 /* 841 * Create kmap (cached mappings of kernel PTEs) 842 * for 32 bit we map from segmap_start .. ekernelheap 843 * for 64 bit we map from segmap_start .. segmap_start + segmapsize; 844 */ 845 #if defined(__i386) 846 size = (uintptr_t)ekernelheap - segmap_start; 847 #elif defined(__amd64) 848 size = segmapsize; 849 #endif 850 hat_kmap_init((uintptr_t)segmap_start, size); 851 } 852 853 /* 854 * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references 855 * are 32 bit, so for safety we must use cas64() to install these. 856 */ 857 #ifdef __i386 858 static void 859 reload_pae32(hat_t *hat, cpu_t *cpu) 860 { 861 x86pte_t *src; 862 x86pte_t *dest; 863 x86pte_t pte; 864 int i; 865 866 /* 867 * Load the 4 entries of the level 2 page table into this 868 * cpu's range of the vlp_page and point cr3 at them. 869 */ 870 ASSERT(mmu.pae_hat); 871 src = hat->hat_vlp_ptes; 872 dest = vlp_page + (cpu->cpu_id + 1) * VLP_NUM_PTES; 873 for (i = 0; i < VLP_NUM_PTES; ++i) { 874 for (;;) { 875 pte = dest[i]; 876 if (pte == src[i]) 877 break; 878 if (cas64(dest + i, pte, src[i]) != src[i]) 879 break; 880 } 881 } 882 } 883 #endif 884 885 /* 886 * Switch to a new active hat, maintaining bit masks to track active CPUs. 887 */ 888 void 889 hat_switch(hat_t *hat) 890 { 891 uintptr_t newcr3; 892 cpu_t *cpu = CPU; 893 hat_t *old = cpu->cpu_current_hat; 894 895 /* 896 * set up this information first, so we don't miss any cross calls 897 */ 898 if (old != NULL) { 899 if (old == hat) 900 return; 901 if (old != kas.a_hat) 902 CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id); 903 } 904 905 /* 906 * Wait for any in flight pagetable invalidates on this hat to finish. 907 * This is a spin lock at DISP_LEVEL 908 */ 909 if (hat != kas.a_hat) { 910 mutex_enter(&hat->hat_switch_mutex); 911 CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id); 912 mutex_exit(&hat->hat_switch_mutex); 913 } 914 cpu->cpu_current_hat = hat; 915 916 /* 917 * now go ahead and load cr3 918 */ 919 if (hat->hat_flags & HAT_VLP) { 920 #if defined(__amd64) 921 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes; 922 923 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 924 newcr3 = MAKECR3(cpu->cpu_hat_info->hci_vlp_pfn); 925 #elif defined(__i386) 926 reload_pae32(hat, cpu); 927 newcr3 = MAKECR3(kas.a_hat->hat_htable->ht_pfn) + 928 (cpu->cpu_id + 1) * VLP_SIZE; 929 #endif 930 } else { 931 newcr3 = MAKECR3(hat->hat_htable->ht_pfn); 932 } 933 setcr3(newcr3); 934 ASSERT(cpu == CPU); 935 } 936 937 /* 938 * Utility to return a valid x86pte_t from protections, pfn, and level number 939 */ 940 static x86pte_t 941 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags) 942 { 943 x86pte_t pte; 944 uint_t cache_attr = attr & HAT_ORDER_MASK; 945 946 pte = MAKEPTE(pfn, level); 947 948 if (attr & PROT_WRITE) 949 PTE_SET(pte, PT_WRITABLE); 950 951 if (attr & PROT_USER) 952 PTE_SET(pte, PT_USER); 953 954 if (!(attr & PROT_EXEC)) 955 PTE_SET(pte, mmu.pt_nx); 956 957 /* 958 * Set the software bits used track ref/mod sync's and hments. 959 * If not using REF/MOD, set them to avoid h/w rewriting PTEs. 960 */ 961 if (flags & HAT_LOAD_NOCONSIST) 962 PTE_SET(pte, PT_NOCONSIST | PT_REF | PT_MOD); 963 else if (attr & HAT_NOSYNC) 964 PTE_SET(pte, PT_NOSYNC | PT_REF | PT_MOD); 965 966 /* 967 * Set the caching attributes in the PTE. The combination 968 * of attributes are poorly defined, so we pay attention 969 * to them in the given order. 970 * 971 * The test for HAT_STRICTORDER is different because it's defined 972 * as "0" - which was a stupid thing to do, but is too late to change! 973 */ 974 if (cache_attr == HAT_STRICTORDER) { 975 PTE_SET(pte, PT_NOCACHE); 976 /*LINTED [Lint hates empty ifs, but it's the obvious way to do this] */ 977 } else if (cache_attr & (HAT_UNORDERED_OK | HAT_STORECACHING_OK)) { 978 /* nothing to set */; 979 } else if (cache_attr & (HAT_MERGING_OK | HAT_LOADCACHING_OK)) { 980 PTE_SET(pte, PT_NOCACHE); 981 if (x86_feature & X86_PAT) 982 PTE_SET(pte, (level == 0) ? PT_PAT_4K : PT_PAT_LARGE); 983 else 984 PTE_SET(pte, PT_WRITETHRU); 985 } else { 986 panic("hati_mkpte(): bad caching attributes: %x\n", cache_attr); 987 } 988 989 return (pte); 990 } 991 992 /* 993 * Duplicate address translations of the parent to the child. 994 * This function really isn't used anymore. 995 */ 996 /*ARGSUSED*/ 997 int 998 hat_dup(hat_t *old, hat_t *new, caddr_t addr, size_t len, uint_t flag) 999 { 1000 ASSERT((uintptr_t)addr < kernelbase); 1001 ASSERT(new != kas.a_hat); 1002 ASSERT(old != kas.a_hat); 1003 return (0); 1004 } 1005 1006 /* 1007 * Allocate any hat resources required for a process being swapped in. 1008 */ 1009 /*ARGSUSED*/ 1010 void 1011 hat_swapin(hat_t *hat) 1012 { 1013 /* do nothing - we let everything fault back in */ 1014 } 1015 1016 /* 1017 * Unload all translations associated with an address space of a process 1018 * that is being swapped out. 1019 */ 1020 void 1021 hat_swapout(hat_t *hat) 1022 { 1023 uintptr_t vaddr = (uintptr_t)0; 1024 uintptr_t eaddr = _userlimit; 1025 htable_t *ht = NULL; 1026 level_t l; 1027 1028 /* 1029 * We can't just call hat_unload(hat, 0, _userlimit...) here, because 1030 * seg_spt and shared pagetables can't be swapped out. 1031 * Take a look at segspt_shmswapout() - it's a big no-op. 1032 * 1033 * Instead we'll walk through all the address space and unload 1034 * any mappings which we are sure are not shared, not locked. 1035 */ 1036 ASSERT(IS_PAGEALIGNED(vaddr)); 1037 ASSERT(IS_PAGEALIGNED(eaddr)); 1038 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1039 if ((uintptr_t)hat->hat_as->a_userlimit < eaddr) 1040 eaddr = (uintptr_t)hat->hat_as->a_userlimit; 1041 1042 while (vaddr < eaddr) { 1043 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1044 if (ht == NULL) 1045 break; 1046 1047 ASSERT(!IN_VA_HOLE(vaddr)); 1048 1049 /* 1050 * If the page table is shared skip its entire range. 1051 * This code knows that only level 0 page tables are shared 1052 */ 1053 l = ht->ht_level; 1054 if (ht->ht_flags & HTABLE_SHARED_PFN) { 1055 ASSERT(l == 0); 1056 vaddr = ht->ht_vaddr + LEVEL_SIZE(1); 1057 htable_release(ht); 1058 ht = NULL; 1059 continue; 1060 } 1061 1062 /* 1063 * If the page table has no locked entries, unload this one. 1064 */ 1065 if (ht->ht_lock_cnt == 0) 1066 hat_unload(hat, (caddr_t)vaddr, LEVEL_SIZE(l), 1067 HAT_UNLOAD_UNMAP); 1068 1069 /* 1070 * If we have a level 0 page table with locked entries, 1071 * skip the entire page table, otherwise skip just one entry. 1072 */ 1073 if (ht->ht_lock_cnt > 0 && l == 0) 1074 vaddr = ht->ht_vaddr + LEVEL_SIZE(1); 1075 else 1076 vaddr += LEVEL_SIZE(l); 1077 } 1078 if (ht) 1079 htable_release(ht); 1080 1081 /* 1082 * We're in swapout because the system is low on memory, so 1083 * go back and flush all the htables off the cached list. 1084 */ 1085 htable_purge_hat(hat); 1086 } 1087 1088 /* 1089 * returns number of bytes that have valid mappings in hat. 1090 */ 1091 size_t 1092 hat_get_mapped_size(hat_t *hat) 1093 { 1094 size_t total = 0; 1095 int l; 1096 1097 for (l = 0; l <= mmu.max_page_level; l++) 1098 total += (hat->hat_pages_mapped[l] << LEVEL_SHIFT(l)); 1099 1100 return (total); 1101 } 1102 1103 /* 1104 * enable/disable collection of stats for hat. 1105 */ 1106 int 1107 hat_stats_enable(hat_t *hat) 1108 { 1109 atomic_add_32(&hat->hat_stats, 1); 1110 return (1); 1111 } 1112 1113 void 1114 hat_stats_disable(hat_t *hat) 1115 { 1116 atomic_add_32(&hat->hat_stats, -1); 1117 } 1118 1119 /* 1120 * Utility to sync the ref/mod bits from a page table entry to the page_t 1121 * We must be holding the mapping list lock when this is called. 1122 */ 1123 static void 1124 hati_sync_pte_to_page(page_t *pp, x86pte_t pte, level_t level) 1125 { 1126 uint_t rm = 0; 1127 pgcnt_t pgcnt; 1128 1129 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 1130 return; 1131 1132 if (PTE_GET(pte, PT_REF)) 1133 rm |= P_REF; 1134 1135 if (PTE_GET(pte, PT_MOD)) 1136 rm |= P_MOD; 1137 1138 if (rm == 0) 1139 return; 1140 1141 /* 1142 * sync to all constituent pages of a large page 1143 */ 1144 ASSERT(x86_hm_held(pp)); 1145 pgcnt = page_get_pagecnt(level); 1146 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 1147 for (; pgcnt > 0; --pgcnt) { 1148 /* 1149 * hat_page_demote() can't decrease 1150 * pszc below this mapping size 1151 * since this large mapping existed after we 1152 * took mlist lock. 1153 */ 1154 ASSERT(pp->p_szc >= level); 1155 hat_page_setattr(pp, rm); 1156 ++pp; 1157 } 1158 } 1159 1160 /* 1161 * This the set of PTE bits for PFN, permissions and caching 1162 * that require a TLB flush (hat_tlb_inval) if changed on a HAT_LOAD_REMAP 1163 */ 1164 #define PT_REMAP_BITS \ 1165 (PT_PADDR | PT_NX | PT_WRITABLE | PT_WRITETHRU | \ 1166 PT_NOCACHE | PT_PAT_4K | PT_PAT_LARGE) 1167 1168 #define REMAPASSERT(EX) if (!(EX)) panic("hati_pte_map: " #EX) 1169 /* 1170 * Do the low-level work to get a mapping entered into a HAT's pagetables 1171 * and in the mapping list of the associated page_t. 1172 */ 1173 static int 1174 hati_pte_map( 1175 htable_t *ht, 1176 uint_t entry, 1177 page_t *pp, 1178 x86pte_t pte, 1179 int flags, 1180 void *pte_ptr) 1181 { 1182 hat_t *hat = ht->ht_hat; 1183 x86pte_t old_pte; 1184 level_t l = ht->ht_level; 1185 hment_t *hm; 1186 uint_t is_consist; 1187 int rv = 0; 1188 1189 /* 1190 * Is this a consistant (ie. need mapping list lock) mapping? 1191 */ 1192 is_consist = (pp != NULL && (flags & HAT_LOAD_NOCONSIST) == 0); 1193 1194 /* 1195 * Track locked mapping count in the htable. Do this first, 1196 * as we track locking even if there already is a mapping present. 1197 */ 1198 if ((flags & HAT_LOAD_LOCK) != 0 && hat != kas.a_hat) 1199 HTABLE_LOCK_INC(ht); 1200 1201 /* 1202 * Acquire the page's mapping list lock and get an hment to use. 1203 * Note that hment_prepare() might return NULL. 1204 */ 1205 if (is_consist) { 1206 x86_hm_enter(pp); 1207 hm = hment_prepare(ht, entry, pp); 1208 } 1209 1210 /* 1211 * Set the new pte, retrieving the old one at the same time. 1212 */ 1213 old_pte = x86pte_set(ht, entry, pte, pte_ptr); 1214 1215 /* 1216 * did we get a large page / page table collision? 1217 */ 1218 if (old_pte == LPAGE_ERROR) { 1219 rv = -1; 1220 goto done; 1221 } 1222 1223 /* 1224 * If the mapping didn't change there is nothing more to do. 1225 */ 1226 if (PTE_EQUIV(pte, old_pte)) 1227 goto done; 1228 1229 /* 1230 * Install a new mapping in the page's mapping list 1231 */ 1232 if (!PTE_ISVALID(old_pte)) { 1233 if (is_consist) { 1234 hment_assign(ht, entry, pp, hm); 1235 x86_hm_exit(pp); 1236 } else { 1237 ASSERT(flags & HAT_LOAD_NOCONSIST); 1238 } 1239 HTABLE_INC(ht->ht_valid_cnt); 1240 PGCNT_INC(hat, l); 1241 return (rv); 1242 } 1243 1244 /* 1245 * Remap's are more complicated: 1246 * - HAT_LOAD_REMAP must be specified if changing the pfn. 1247 * We also require that NOCONSIST be specified. 1248 * - Otherwise only permission or caching bits may change. 1249 */ 1250 if (!PTE_ISPAGE(old_pte, l)) 1251 panic("non-null/page mapping pte=" FMT_PTE, old_pte); 1252 1253 if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) { 1254 REMAPASSERT(flags & HAT_LOAD_REMAP); 1255 REMAPASSERT(flags & HAT_LOAD_NOCONSIST); 1256 REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 1257 REMAPASSERT(pf_is_memory(PTE2PFN(old_pte, l)) == 1258 pf_is_memory(PTE2PFN(pte, l))); 1259 REMAPASSERT(!is_consist); 1260 } 1261 1262 /* 1263 * We only let remaps change the bits for PFNs, permissions 1264 * or caching type. 1265 */ 1266 ASSERT(PTE_GET(old_pte, ~(PT_REMAP_BITS | PT_REF | PT_MOD)) == 1267 PTE_GET(pte, ~PT_REMAP_BITS)); 1268 1269 /* 1270 * We don't create any mapping list entries on a remap, so release 1271 * any allocated hment after we drop the mapping list lock. 1272 */ 1273 done: 1274 if (is_consist) { 1275 x86_hm_exit(pp); 1276 if (hm != NULL) 1277 hment_free(hm); 1278 } 1279 return (rv); 1280 } 1281 1282 /* 1283 * Internal routine to load a single page table entry. This only fails if 1284 * we attempt to overwrite a page table link with a large page. 1285 */ 1286 static int 1287 hati_load_common( 1288 hat_t *hat, 1289 uintptr_t va, 1290 page_t *pp, 1291 uint_t attr, 1292 uint_t flags, 1293 level_t level, 1294 pfn_t pfn) 1295 { 1296 htable_t *ht; 1297 uint_t entry; 1298 x86pte_t pte; 1299 int rv = 0; 1300 1301 /* 1302 * The number 16 is arbitrary and here to catch a recursion problem 1303 * early before we blow out the kernel stack. 1304 */ 1305 ++curthread->t_hatdepth; 1306 ASSERT(curthread->t_hatdepth < 16); 1307 1308 ASSERT(hat == kas.a_hat || 1309 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1310 1311 if (flags & HAT_LOAD_SHARE) 1312 hat->hat_flags |= HAT_SHARED; 1313 1314 /* 1315 * Find the page table that maps this page if it already exists. 1316 */ 1317 ht = htable_lookup(hat, va, level); 1318 1319 /* 1320 * We must have HAT_LOAD_NOCONSIST if page_t is NULL. 1321 */ 1322 if (pp == NULL) 1323 flags |= HAT_LOAD_NOCONSIST; 1324 1325 if (ht == NULL) { 1326 ht = htable_create(hat, va, level, NULL); 1327 ASSERT(ht != NULL); 1328 } 1329 entry = htable_va2entry(va, ht); 1330 1331 /* 1332 * a bunch of paranoid error checking 1333 */ 1334 ASSERT(ht->ht_busy > 0); 1335 if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht)) 1336 panic("hati_load_common: bad htable %p, va %p", ht, (void *)va); 1337 ASSERT(ht->ht_level == level); 1338 1339 /* 1340 * construct the new PTE 1341 */ 1342 if (hat == kas.a_hat) 1343 attr &= ~PROT_USER; 1344 pte = hati_mkpte(pfn, attr, level, flags); 1345 if (hat == kas.a_hat && va >= kernelbase) 1346 PTE_SET(pte, mmu.pt_global); 1347 1348 /* 1349 * establish the mapping 1350 */ 1351 rv = hati_pte_map(ht, entry, pp, pte, flags, NULL); 1352 1353 /* 1354 * release the htable and any reserves 1355 */ 1356 htable_release(ht); 1357 --curthread->t_hatdepth; 1358 return (rv); 1359 } 1360 1361 /* 1362 * special case of hat_memload to deal with some kernel addrs for performance 1363 */ 1364 static void 1365 hat_kmap_load( 1366 caddr_t addr, 1367 page_t *pp, 1368 uint_t attr, 1369 uint_t flags) 1370 { 1371 uintptr_t va = (uintptr_t)addr; 1372 x86pte_t pte; 1373 pfn_t pfn = page_pptonum(pp); 1374 pgcnt_t pg_off = mmu_btop(va - mmu.kmap_addr); 1375 htable_t *ht; 1376 uint_t entry; 1377 void *pte_ptr; 1378 1379 /* 1380 * construct the requested PTE 1381 */ 1382 attr &= ~PROT_USER; 1383 attr |= HAT_STORECACHING_OK; 1384 pte = hati_mkpte(pfn, attr, 0, flags); 1385 PTE_SET(pte, mmu.pt_global); 1386 1387 /* 1388 * Figure out the pte_ptr and htable and use common code to finish up 1389 */ 1390 if (mmu.pae_hat) 1391 pte_ptr = mmu.kmap_ptes + pg_off; 1392 else 1393 pte_ptr = (x86pte32_t *)mmu.kmap_ptes + pg_off; 1394 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) >> 1395 LEVEL_SHIFT(1)]; 1396 entry = htable_va2entry(va, ht); 1397 ++curthread->t_hatdepth; 1398 ASSERT(curthread->t_hatdepth < 16); 1399 (void) hati_pte_map(ht, entry, pp, pte, flags, pte_ptr); 1400 --curthread->t_hatdepth; 1401 } 1402 1403 /* 1404 * hat_memload() - load a translation to the given page struct 1405 * 1406 * Flags for hat_memload/hat_devload/hat_*attr. 1407 * 1408 * HAT_LOAD Default flags to load a translation to the page. 1409 * 1410 * HAT_LOAD_LOCK Lock down mapping resources; hat_map(), hat_memload(), 1411 * and hat_devload(). 1412 * 1413 * HAT_LOAD_NOCONSIST Do not add mapping to page_t mapping list. 1414 * sets PT_NOCONSIST 1415 * 1416 * HAT_LOAD_SHARE A flag to hat_memload() to indicate h/w page tables 1417 * that map some user pages (not kas) is shared by more 1418 * than one process (eg. ISM). 1419 * 1420 * HAT_LOAD_REMAP Reload a valid pte with a different page frame. 1421 * 1422 * HAT_NO_KALLOC Do not kmem_alloc while creating the mapping; at this 1423 * point, it's setting up mapping to allocate internal 1424 * hat layer data structures. This flag forces hat layer 1425 * to tap its reserves in order to prevent infinite 1426 * recursion. 1427 * 1428 * The following is a protection attribute (like PROT_READ, etc.) 1429 * 1430 * HAT_NOSYNC set PT_NOSYNC - this mapping's ref/mod bits 1431 * are never cleared. 1432 * 1433 * Installing new valid PTE's and creation of the mapping list 1434 * entry are controlled under the same lock. It's derived from the 1435 * page_t being mapped. 1436 */ 1437 static uint_t supported_memload_flags = 1438 HAT_LOAD | HAT_LOAD_LOCK | HAT_LOAD_ADV | HAT_LOAD_NOCONSIST | 1439 HAT_LOAD_SHARE | HAT_NO_KALLOC | HAT_LOAD_REMAP | HAT_LOAD_TEXT; 1440 1441 void 1442 hat_memload( 1443 hat_t *hat, 1444 caddr_t addr, 1445 page_t *pp, 1446 uint_t attr, 1447 uint_t flags) 1448 { 1449 uintptr_t va = (uintptr_t)addr; 1450 level_t level = 0; 1451 pfn_t pfn = page_pptonum(pp); 1452 1453 HATIN(hat_memload, hat, addr, (size_t)MMU_PAGESIZE); 1454 ASSERT(IS_PAGEALIGNED(va)); 1455 ASSERT(hat == kas.a_hat || va < _userlimit); 1456 ASSERT(hat == kas.a_hat || 1457 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1458 ASSERT((flags & supported_memload_flags) == flags); 1459 1460 ASSERT(!IN_VA_HOLE(va)); 1461 ASSERT(!PP_ISFREE(pp)); 1462 1463 /* 1464 * kernel address special case for performance. 1465 */ 1466 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 1467 ASSERT(hat == kas.a_hat); 1468 hat_kmap_load(addr, pp, attr, flags); 1469 return; 1470 } 1471 1472 /* 1473 * This is used for memory with normal caching enabled, so 1474 * always set HAT_STORECACHING_OK. 1475 */ 1476 attr |= HAT_STORECACHING_OK; 1477 if (hati_load_common(hat, va, pp, attr, flags, level, pfn) != 0) 1478 panic("unexpected hati_load_common() failure"); 1479 HATOUT(hat_memload, hat, addr); 1480 } 1481 1482 /* 1483 * Load the given array of page structs using large pages when possible 1484 */ 1485 void 1486 hat_memload_array( 1487 hat_t *hat, 1488 caddr_t addr, 1489 size_t len, 1490 page_t **pages, 1491 uint_t attr, 1492 uint_t flags) 1493 { 1494 uintptr_t va = (uintptr_t)addr; 1495 uintptr_t eaddr = va + len; 1496 level_t level; 1497 size_t pgsize; 1498 pgcnt_t pgindx = 0; 1499 pfn_t pfn; 1500 pgcnt_t i; 1501 1502 HATIN(hat_memload_array, hat, addr, len); 1503 ASSERT(IS_PAGEALIGNED(va)); 1504 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 1505 ASSERT(hat == kas.a_hat || 1506 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1507 ASSERT((flags & supported_memload_flags) == flags); 1508 1509 /* 1510 * memload is used for memory with full caching enabled, so 1511 * set HAT_STORECACHING_OK. 1512 */ 1513 attr |= HAT_STORECACHING_OK; 1514 1515 /* 1516 * handle all pages using largest possible pagesize 1517 */ 1518 while (va < eaddr) { 1519 /* 1520 * decide what level mapping to use (ie. pagesize) 1521 */ 1522 pfn = page_pptonum(pages[pgindx]); 1523 for (level = mmu.max_page_level; ; --level) { 1524 pgsize = LEVEL_SIZE(level); 1525 if (level == 0) 1526 break; 1527 1528 if (!IS_P2ALIGNED(va, pgsize) || 1529 (eaddr - va) < pgsize || 1530 !IS_P2ALIGNED(pfn_to_pa(pfn), pgsize)) 1531 continue; 1532 1533 /* 1534 * To use a large mapping of this size, all the 1535 * pages we are passed must be sequential subpages 1536 * of the large page. 1537 * hat_page_demote() can't change p_szc because 1538 * all pages are locked. 1539 */ 1540 if (pages[pgindx]->p_szc >= level) { 1541 for (i = 0; i < mmu_btop(pgsize); ++i) { 1542 if (pfn + i != 1543 page_pptonum(pages[pgindx + i])) 1544 break; 1545 ASSERT(pages[pgindx + i]->p_szc >= 1546 level); 1547 ASSERT(pages[pgindx] + i == 1548 pages[pgindx + i]); 1549 } 1550 if (i == mmu_btop(pgsize)) 1551 break; 1552 } 1553 } 1554 1555 /* 1556 * Load this page mapping. If the load fails, try a smaller 1557 * pagesize. 1558 */ 1559 ASSERT(!IN_VA_HOLE(va)); 1560 while (hati_load_common(hat, va, pages[pgindx], attr, 1561 flags, level, pfn) != 0) { 1562 if (level == 0) 1563 panic("unexpected hati_load_common() failure"); 1564 --level; 1565 pgsize = LEVEL_SIZE(level); 1566 } 1567 1568 /* 1569 * move to next page 1570 */ 1571 va += pgsize; 1572 pgindx += mmu_btop(pgsize); 1573 } 1574 HATOUT(hat_memload_array, hat, addr); 1575 } 1576 1577 /* 1578 * void hat_devload(hat, addr, len, pf, attr, flags) 1579 * load/lock the given page frame number 1580 * 1581 * Advisory ordering attributes. Apply only to device mappings. 1582 * 1583 * HAT_STRICTORDER: the CPU must issue the references in order, as the 1584 * programmer specified. This is the default. 1585 * HAT_UNORDERED_OK: the CPU may reorder the references (this is all kinds 1586 * of reordering; store or load with store or load). 1587 * HAT_MERGING_OK: merging and batching: the CPU may merge individual stores 1588 * to consecutive locations (for example, turn two consecutive byte 1589 * stores into one halfword store), and it may batch individual loads 1590 * (for example, turn two consecutive byte loads into one halfword load). 1591 * This also implies re-ordering. 1592 * HAT_LOADCACHING_OK: the CPU may cache the data it fetches and reuse it 1593 * until another store occurs. The default is to fetch new data 1594 * on every load. This also implies merging. 1595 * HAT_STORECACHING_OK: the CPU may keep the data in the cache and push it to 1596 * the device (perhaps with other data) at a later time. The default is 1597 * to push the data right away. This also implies load caching. 1598 * 1599 * Equivalent of hat_memload(), but can be used for device memory where 1600 * there are no page_t's and we support additional flags (write merging, etc). 1601 * Note that we can have large page mappings with this interface. 1602 */ 1603 int supported_devload_flags = HAT_LOAD | HAT_LOAD_LOCK | 1604 HAT_LOAD_NOCONSIST | HAT_STRICTORDER | HAT_UNORDERED_OK | 1605 HAT_MERGING_OK | HAT_LOADCACHING_OK | HAT_STORECACHING_OK; 1606 1607 void 1608 hat_devload( 1609 hat_t *hat, 1610 caddr_t addr, 1611 size_t len, 1612 pfn_t pfn, 1613 uint_t attr, 1614 int flags) 1615 { 1616 uintptr_t va = ALIGN2PAGE(addr); 1617 uintptr_t eva = va + len; 1618 level_t level; 1619 size_t pgsize; 1620 page_t *pp; 1621 int f; /* per PTE copy of flags - maybe modified */ 1622 uint_t a; /* per PTE copy of attr */ 1623 1624 HATIN(hat_devload, hat, addr, len); 1625 ASSERT(IS_PAGEALIGNED(va)); 1626 ASSERT(hat == kas.a_hat || eva <= _userlimit); 1627 ASSERT(hat == kas.a_hat || 1628 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1629 ASSERT((flags & supported_devload_flags) == flags); 1630 1631 /* 1632 * handle all pages 1633 */ 1634 while (va < eva) { 1635 1636 /* 1637 * decide what level mapping to use (ie. pagesize) 1638 */ 1639 for (level = mmu.max_page_level; ; --level) { 1640 pgsize = LEVEL_SIZE(level); 1641 if (level == 0) 1642 break; 1643 if (IS_P2ALIGNED(va, pgsize) && 1644 (eva - va) >= pgsize && 1645 IS_P2ALIGNED(pfn, mmu_btop(pgsize))) 1646 break; 1647 } 1648 1649 /* 1650 * If this is just memory then allow caching (this happens 1651 * for the nucleus pages) - though HAT_PLAT_NOCACHE can be used 1652 * to override that. If we don't have a page_t then make sure 1653 * NOCONSIST is set. 1654 */ 1655 a = attr; 1656 f = flags; 1657 if (pf_is_memory(pfn)) { 1658 if (!(a & HAT_PLAT_NOCACHE)) 1659 a |= HAT_STORECACHING_OK; 1660 1661 if (f & HAT_LOAD_NOCONSIST) 1662 pp = NULL; 1663 else 1664 pp = page_numtopp_nolock(pfn); 1665 } else { 1666 pp = NULL; 1667 f |= HAT_LOAD_NOCONSIST; 1668 } 1669 1670 /* 1671 * load this page mapping 1672 */ 1673 ASSERT(!IN_VA_HOLE(va)); 1674 while (hati_load_common(hat, va, pp, a, f, level, pfn) != 0) { 1675 if (level == 0) 1676 panic("unexpected hati_load_common() failure"); 1677 --level; 1678 pgsize = LEVEL_SIZE(level); 1679 } 1680 1681 /* 1682 * move to next page 1683 */ 1684 va += pgsize; 1685 pfn += mmu_btop(pgsize); 1686 } 1687 HATOUT(hat_devload, hat, addr); 1688 } 1689 1690 /* 1691 * void hat_unlock(hat, addr, len) 1692 * unlock the mappings to a given range of addresses 1693 * 1694 * Locks are tracked by ht_lock_cnt in the htable. 1695 */ 1696 void 1697 hat_unlock(hat_t *hat, caddr_t addr, size_t len) 1698 { 1699 uintptr_t vaddr = (uintptr_t)addr; 1700 uintptr_t eaddr = vaddr + len; 1701 htable_t *ht = NULL; 1702 1703 /* 1704 * kernel entries are always locked, we don't track lock counts 1705 */ 1706 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 1707 ASSERT(IS_PAGEALIGNED(vaddr)); 1708 ASSERT(IS_PAGEALIGNED(eaddr)); 1709 if (hat == kas.a_hat) 1710 return; 1711 if (eaddr > _userlimit) 1712 panic("hat_unlock() address out of range - above _userlimit"); 1713 1714 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1715 while (vaddr < eaddr) { 1716 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1717 if (ht == NULL) 1718 break; 1719 1720 ASSERT(!IN_VA_HOLE(vaddr)); 1721 1722 if (ht->ht_lock_cnt < 1) 1723 panic("hat_unlock(): lock_cnt < 1, " 1724 "htable=%p, vaddr=%p\n", ht, (caddr_t)vaddr); 1725 HTABLE_LOCK_DEC(ht); 1726 1727 vaddr += LEVEL_SIZE(ht->ht_level); 1728 } 1729 if (ht) 1730 htable_release(ht); 1731 } 1732 1733 /* 1734 * Cross call service routine to demap a virtual page on 1735 * the current CPU or flush all mappings in TLB. 1736 */ 1737 /*ARGSUSED*/ 1738 static int 1739 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3) 1740 { 1741 hat_t *hat = (hat_t *)a1; 1742 caddr_t addr = (caddr_t)a2; 1743 1744 /* 1745 * If the target hat isn't the kernel and this CPU isn't operating 1746 * in the target hat, we can ignore the cross call. 1747 */ 1748 if (hat != kas.a_hat && hat != CPU->cpu_current_hat) 1749 return (0); 1750 1751 /* 1752 * For a normal address, we just flush one page mapping 1753 */ 1754 if ((uintptr_t)addr != DEMAP_ALL_ADDR) { 1755 mmu_tlbflush_entry(addr); 1756 return (0); 1757 } 1758 1759 /* 1760 * Otherwise we reload cr3 to effect a complete TLB flush. 1761 * 1762 * A reload of cr3 on a VLP process also means we must also recopy in 1763 * the pte values from the struct hat 1764 */ 1765 if (hat->hat_flags & HAT_VLP) { 1766 #if defined(__amd64) 1767 x86pte_t *vlpptep = CPU->cpu_hat_info->hci_vlp_l2ptes; 1768 1769 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 1770 #elif defined(__i386) 1771 reload_pae32(hat, CPU); 1772 #endif 1773 } 1774 reload_cr3(); 1775 return (0); 1776 } 1777 1778 /* 1779 * Internal routine to do cross calls to invalidate a range of pages on 1780 * all CPUs using a given hat. 1781 */ 1782 void 1783 hat_tlb_inval(hat_t *hat, uintptr_t va) 1784 { 1785 extern int flushes_require_xcalls; /* from mp_startup.c */ 1786 cpuset_t justme; 1787 cpuset_t cpus_to_shootdown; 1788 1789 /* 1790 * If the hat is being destroyed, there are no more users, so 1791 * demap need not do anything. 1792 */ 1793 if (hat->hat_flags & HAT_FREEING) 1794 return; 1795 1796 /* 1797 * If demapping from a shared pagetable, we best demap the 1798 * entire set of user TLBs, since we don't know what addresses 1799 * these were shared at. 1800 */ 1801 if (hat->hat_flags & HAT_SHARED) { 1802 hat = kas.a_hat; 1803 va = DEMAP_ALL_ADDR; 1804 } 1805 1806 /* 1807 * if not running with multiple CPUs, don't use cross calls 1808 */ 1809 if (panicstr || !flushes_require_xcalls) { 1810 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 1811 return; 1812 } 1813 1814 1815 /* 1816 * Determine CPUs to shootdown. Kernel changes always do all CPUs. 1817 * Otherwise it's just CPUs currently executing in this hat. 1818 */ 1819 kpreempt_disable(); 1820 CPUSET_ONLY(justme, CPU->cpu_id); 1821 if (hat == kas.a_hat) 1822 cpus_to_shootdown = khat_cpuset; 1823 else 1824 cpus_to_shootdown = hat->hat_cpus; 1825 1826 if (CPUSET_ISNULL(cpus_to_shootdown) || 1827 CPUSET_ISEQUAL(cpus_to_shootdown, justme)) { 1828 1829 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 1830 1831 } else { 1832 1833 CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id); 1834 xc_call((xc_arg_t)hat, (xc_arg_t)va, NULL, X_CALL_HIPRI, 1835 cpus_to_shootdown, hati_demap_func); 1836 1837 } 1838 kpreempt_enable(); 1839 } 1840 1841 /* 1842 * Interior routine for HAT_UNLOADs from hat_unload_callback(), 1843 * hat_kmap_unload() OR from hat_steal() code. This routine doesn't 1844 * handle releasing of the htables. 1845 */ 1846 void 1847 hat_pte_unmap( 1848 htable_t *ht, 1849 uint_t entry, 1850 uint_t flags, 1851 x86pte_t old_pte, 1852 void *pte_ptr) 1853 { 1854 hat_t *hat = ht->ht_hat; 1855 hment_t *hm = NULL; 1856 page_t *pp = NULL; 1857 level_t l = ht->ht_level; 1858 pfn_t pfn; 1859 1860 /* 1861 * We always track the locking counts, even if nothing is unmapped 1862 */ 1863 if ((flags & HAT_UNLOAD_UNLOCK) != 0 && hat != kas.a_hat) { 1864 ASSERT(ht->ht_lock_cnt > 0); 1865 HTABLE_LOCK_DEC(ht); 1866 } 1867 1868 /* 1869 * Figure out which page's mapping list lock to acquire using the PFN 1870 * passed in "old" PTE. We then attempt to invalidate the PTE. 1871 * If another thread, probably a hat_pageunload, has asynchronously 1872 * unmapped/remapped this address we'll loop here. 1873 */ 1874 ASSERT(ht->ht_busy > 0); 1875 while (PTE_ISVALID(old_pte)) { 1876 pfn = PTE2PFN(old_pte, l); 1877 if (PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST) { 1878 pp = NULL; 1879 } else { 1880 pp = page_numtopp_nolock(pfn); 1881 if (pp == NULL) { 1882 panic("no page_t, not NOCONSIST: old_pte=" 1883 FMT_PTE " ht=%lx entry=0x%x pte_ptr=%lx", 1884 old_pte, (uintptr_t)ht, entry, 1885 (uintptr_t)pte_ptr); 1886 } 1887 x86_hm_enter(pp); 1888 } 1889 1890 /* 1891 * If freeing the address space, check that the PTE 1892 * hasn't changed, as the mappings are no longer in use by 1893 * any thread, invalidation is unnecessary. 1894 * If not freeing, do a full invalidate. 1895 */ 1896 if (hat->hat_flags & HAT_FREEING) 1897 old_pte = x86pte_get(ht, entry); 1898 else 1899 old_pte = x86pte_inval(ht, entry, old_pte, pte_ptr); 1900 1901 /* 1902 * If the page hadn't changed we've unmapped it and can proceed 1903 */ 1904 if (PTE_ISVALID(old_pte) && PTE2PFN(old_pte, l) == pfn) 1905 break; 1906 1907 /* 1908 * Otherwise, we'll have to retry with the current old_pte. 1909 * Drop the hment lock, since the pfn may have changed. 1910 */ 1911 if (pp != NULL) { 1912 x86_hm_exit(pp); 1913 pp = NULL; 1914 } else { 1915 ASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 1916 } 1917 } 1918 1919 /* 1920 * If the old mapping wasn't valid, there's nothing more to do 1921 */ 1922 if (!PTE_ISVALID(old_pte)) { 1923 if (pp != NULL) 1924 x86_hm_exit(pp); 1925 return; 1926 } 1927 1928 /* 1929 * Take care of syncing any MOD/REF bits and removing the hment. 1930 */ 1931 if (pp != NULL) { 1932 if (!(flags & HAT_UNLOAD_NOSYNC)) 1933 hati_sync_pte_to_page(pp, old_pte, l); 1934 hm = hment_remove(pp, ht, entry); 1935 x86_hm_exit(pp); 1936 if (hm != NULL) 1937 hment_free(hm); 1938 } 1939 1940 /* 1941 * Handle book keeping in the htable and hat 1942 */ 1943 ASSERT(ht->ht_valid_cnt > 0); 1944 HTABLE_DEC(ht->ht_valid_cnt); 1945 PGCNT_DEC(hat, l); 1946 } 1947 1948 /* 1949 * very cheap unload implementation to special case some kernel addresses 1950 */ 1951 static void 1952 hat_kmap_unload(caddr_t addr, size_t len, uint_t flags) 1953 { 1954 uintptr_t va = (uintptr_t)addr; 1955 uintptr_t eva = va + len; 1956 pgcnt_t pg_index; 1957 htable_t *ht; 1958 uint_t entry; 1959 x86pte_t *pte_ptr; 1960 x86pte_t old_pte; 1961 1962 for (; va < eva; va += MMU_PAGESIZE) { 1963 /* 1964 * Get the PTE 1965 */ 1966 pg_index = mmu_btop(va - mmu.kmap_addr); 1967 pte_ptr = PT_INDEX_PTR(mmu.kmap_ptes, pg_index); 1968 old_pte = GET_PTE(pte_ptr); 1969 1970 /* 1971 * get the htable / entry 1972 */ 1973 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) 1974 >> LEVEL_SHIFT(1)]; 1975 entry = htable_va2entry(va, ht); 1976 1977 /* 1978 * use mostly common code to unmap it. 1979 */ 1980 hat_pte_unmap(ht, entry, flags, old_pte, pte_ptr); 1981 } 1982 } 1983 1984 1985 /* 1986 * unload a range of virtual address space (no callback) 1987 */ 1988 void 1989 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 1990 { 1991 uintptr_t va = (uintptr_t)addr; 1992 1993 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 1994 1995 /* 1996 * special case for performance. 1997 */ 1998 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 1999 ASSERT(hat == kas.a_hat); 2000 hat_kmap_unload(addr, len, flags); 2001 } else { 2002 hat_unload_callback(hat, addr, len, flags, NULL); 2003 } 2004 } 2005 2006 /* 2007 * Do the callbacks for ranges being unloaded. 2008 */ 2009 typedef struct range_info { 2010 uintptr_t rng_va; 2011 ulong_t rng_cnt; 2012 level_t rng_level; 2013 } range_info_t; 2014 2015 static void 2016 handle_ranges(hat_callback_t *cb, uint_t cnt, range_info_t *range) 2017 { 2018 /* 2019 * do callbacks to upper level VM system 2020 */ 2021 while (cb != NULL && cnt > 0) { 2022 --cnt; 2023 cb->hcb_start_addr = (caddr_t)range[cnt].rng_va; 2024 cb->hcb_end_addr = cb->hcb_start_addr; 2025 cb->hcb_end_addr += 2026 range[cnt].rng_cnt << LEVEL_SIZE(range[cnt].rng_level); 2027 cb->hcb_function(cb); 2028 } 2029 } 2030 2031 /* 2032 * Unload a given range of addresses (has optional callback) 2033 * 2034 * Flags: 2035 * define HAT_UNLOAD 0x00 2036 * define HAT_UNLOAD_NOSYNC 0x02 2037 * define HAT_UNLOAD_UNLOCK 0x04 2038 * define HAT_UNLOAD_OTHER 0x08 - not used 2039 * define HAT_UNLOAD_UNMAP 0x10 - same as HAT_UNLOAD 2040 */ 2041 #define MAX_UNLOAD_CNT (8) 2042 void 2043 hat_unload_callback( 2044 hat_t *hat, 2045 caddr_t addr, 2046 size_t len, 2047 uint_t flags, 2048 hat_callback_t *cb) 2049 { 2050 uintptr_t vaddr = (uintptr_t)addr; 2051 uintptr_t eaddr = vaddr + len; 2052 htable_t *ht = NULL; 2053 uint_t entry; 2054 uintptr_t contig_va = (uintptr_t)-1L; 2055 range_info_t r[MAX_UNLOAD_CNT]; 2056 uint_t r_cnt = 0; 2057 x86pte_t old_pte; 2058 2059 HATIN(hat_unload_callback, hat, addr, len); 2060 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2061 ASSERT(IS_PAGEALIGNED(vaddr)); 2062 ASSERT(IS_PAGEALIGNED(eaddr)); 2063 2064 /* 2065 * Special case a single page being unloaded for speed. This happens 2066 * quite frequently, COW faults after a fork() for example. 2067 */ 2068 if (cb == NULL && len == MMU_PAGESIZE) { 2069 ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0); 2070 if (ht != NULL) { 2071 if (PTE_ISVALID(old_pte)) 2072 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2073 htable_release(ht); 2074 } 2075 return; 2076 } 2077 2078 while (vaddr < eaddr) { 2079 old_pte = htable_walk(hat, &ht, &vaddr, eaddr); 2080 if (ht == NULL) 2081 break; 2082 2083 ASSERT(!IN_VA_HOLE(vaddr)); 2084 2085 if (vaddr < (uintptr_t)addr) 2086 panic("hat_unload_callback(): unmap inside large page"); 2087 2088 /* 2089 * We'll do the call backs for contiguous ranges 2090 */ 2091 if (vaddr != contig_va || 2092 (r_cnt > 0 && r[r_cnt - 1].rng_level != ht->ht_level)) { 2093 if (r_cnt == MAX_UNLOAD_CNT) { 2094 handle_ranges(cb, r_cnt, r); 2095 r_cnt = 0; 2096 } 2097 r[r_cnt].rng_va = vaddr; 2098 r[r_cnt].rng_cnt = 0; 2099 r[r_cnt].rng_level = ht->ht_level; 2100 ++r_cnt; 2101 } 2102 2103 /* 2104 * Unload one mapping from the page tables. 2105 */ 2106 entry = htable_va2entry(vaddr, ht); 2107 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2108 ASSERT(ht->ht_level <= mmu.max_page_level); 2109 vaddr += LEVEL_SIZE(ht->ht_level); 2110 contig_va = vaddr; 2111 ++r[r_cnt - 1].rng_cnt; 2112 } 2113 if (ht) 2114 htable_release(ht); 2115 2116 /* 2117 * handle last range for callbacks 2118 */ 2119 if (r_cnt > 0) 2120 handle_ranges(cb, r_cnt, r); 2121 2122 HATOUT(hat_unload_callback, hat, addr); 2123 } 2124 2125 /* 2126 * synchronize mapping with software data structures 2127 * 2128 * This interface is currently only used by the working set monitor 2129 * driver. 2130 */ 2131 /*ARGSUSED*/ 2132 void 2133 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2134 { 2135 uintptr_t vaddr = (uintptr_t)addr; 2136 uintptr_t eaddr = vaddr + len; 2137 htable_t *ht = NULL; 2138 uint_t entry; 2139 x86pte_t pte; 2140 x86pte_t save_pte; 2141 x86pte_t new; 2142 page_t *pp; 2143 2144 ASSERT(!IN_VA_HOLE(vaddr)); 2145 ASSERT(IS_PAGEALIGNED(vaddr)); 2146 ASSERT(IS_PAGEALIGNED(eaddr)); 2147 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2148 2149 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2150 try_again: 2151 pte = htable_walk(hat, &ht, &vaddr, eaddr); 2152 if (ht == NULL) 2153 break; 2154 entry = htable_va2entry(vaddr, ht); 2155 2156 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2157 PTE_GET(pte, PT_REF | PT_MOD) == 0) 2158 continue; 2159 2160 /* 2161 * We need to acquire the mapping list lock to protect 2162 * against hat_pageunload(), hat_unload(), etc. 2163 */ 2164 pp = page_numtopp_nolock(PTE2PFN(pte, ht->ht_level)); 2165 if (pp == NULL) 2166 break; 2167 x86_hm_enter(pp); 2168 save_pte = pte; 2169 pte = x86pte_get(ht, entry); 2170 if (pte != save_pte) { 2171 x86_hm_exit(pp); 2172 goto try_again; 2173 } 2174 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2175 PTE_GET(pte, PT_REF | PT_MOD) == 0) { 2176 x86_hm_exit(pp); 2177 continue; 2178 } 2179 2180 /* 2181 * Need to clear ref or mod bits. We may compete with 2182 * hardware updating the R/M bits and have to try again. 2183 */ 2184 if (flags == HAT_SYNC_ZERORM) { 2185 new = pte; 2186 PTE_CLR(new, PT_REF | PT_MOD); 2187 pte = hati_update_pte(ht, entry, pte, new); 2188 if (pte != 0) { 2189 x86_hm_exit(pp); 2190 goto try_again; 2191 } 2192 } else { 2193 /* 2194 * sync the PTE to the page_t 2195 */ 2196 hati_sync_pte_to_page(pp, save_pte, ht->ht_level); 2197 } 2198 x86_hm_exit(pp); 2199 } 2200 if (ht) 2201 htable_release(ht); 2202 } 2203 2204 /* 2205 * void hat_map(hat, addr, len, flags) 2206 */ 2207 /*ARGSUSED*/ 2208 void 2209 hat_map(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2210 { 2211 /* does nothing */ 2212 } 2213 2214 /* 2215 * uint_t hat_getattr(hat, addr, *attr) 2216 * returns attr for <hat,addr> in *attr. returns 0 if there was a 2217 * mapping and *attr is valid, nonzero if there was no mapping and 2218 * *attr is not valid. 2219 */ 2220 uint_t 2221 hat_getattr(hat_t *hat, caddr_t addr, uint_t *attr) 2222 { 2223 uintptr_t vaddr = ALIGN2PAGE(addr); 2224 htable_t *ht = NULL; 2225 x86pte_t pte; 2226 2227 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2228 2229 if (IN_VA_HOLE(vaddr)) 2230 return ((uint_t)-1); 2231 2232 ht = htable_getpte(hat, vaddr, NULL, &pte, mmu.max_page_level); 2233 if (ht == NULL) 2234 return ((uint_t)-1); 2235 2236 if (!PTE_ISVALID(pte) || !PTE_ISPAGE(pte, ht->ht_level)) { 2237 htable_release(ht); 2238 return ((uint_t)-1); 2239 } 2240 2241 *attr = PROT_READ; 2242 if (PTE_GET(pte, PT_WRITABLE)) 2243 *attr |= PROT_WRITE; 2244 if (PTE_GET(pte, PT_USER)) 2245 *attr |= PROT_USER; 2246 if (!PTE_GET(pte, mmu.pt_nx)) 2247 *attr |= PROT_EXEC; 2248 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 2249 *attr |= HAT_NOSYNC; 2250 htable_release(ht); 2251 return (0); 2252 } 2253 2254 /* 2255 * hat_updateattr() applies the given attribute change to an existing mapping 2256 */ 2257 #define HAT_LOAD_ATTR 1 2258 #define HAT_SET_ATTR 2 2259 #define HAT_CLR_ATTR 3 2260 2261 static void 2262 hat_updateattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr, int what) 2263 { 2264 uintptr_t vaddr = (uintptr_t)addr; 2265 uintptr_t eaddr = (uintptr_t)addr + len; 2266 htable_t *ht = NULL; 2267 uint_t entry; 2268 x86pte_t oldpte, newpte; 2269 page_t *pp; 2270 2271 ASSERT(IS_PAGEALIGNED(vaddr)); 2272 ASSERT(IS_PAGEALIGNED(eaddr)); 2273 ASSERT(hat == kas.a_hat || 2274 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2275 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2276 try_again: 2277 oldpte = htable_walk(hat, &ht, &vaddr, eaddr); 2278 if (ht == NULL) 2279 break; 2280 if (PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOCONSIST) 2281 continue; 2282 2283 pp = page_numtopp_nolock(PTE2PFN(oldpte, ht->ht_level)); 2284 if (pp == NULL) 2285 continue; 2286 x86_hm_enter(pp); 2287 2288 newpte = oldpte; 2289 /* 2290 * We found a page table entry in the desired range, 2291 * figure out the new attributes. 2292 */ 2293 if (what == HAT_SET_ATTR || what == HAT_LOAD_ATTR) { 2294 if ((attr & PROT_WRITE) && 2295 !PTE_GET(oldpte, PT_WRITABLE)) 2296 newpte |= PT_WRITABLE; 2297 2298 if ((attr & HAT_NOSYNC) && 2299 PTE_GET(oldpte, PT_SOFTWARE) < PT_NOSYNC) 2300 newpte |= PT_NOSYNC; 2301 2302 if ((attr & PROT_EXEC) && PTE_GET(oldpte, mmu.pt_nx)) 2303 newpte &= ~mmu.pt_nx; 2304 } 2305 2306 if (what == HAT_LOAD_ATTR) { 2307 if (!(attr & PROT_WRITE) && 2308 PTE_GET(oldpte, PT_WRITABLE)) 2309 newpte &= ~PT_WRITABLE; 2310 2311 if (!(attr & HAT_NOSYNC) && 2312 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2313 newpte &= ~PT_SOFTWARE; 2314 2315 if (!(attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2316 newpte |= mmu.pt_nx; 2317 } 2318 2319 if (what == HAT_CLR_ATTR) { 2320 if ((attr & PROT_WRITE) && PTE_GET(oldpte, PT_WRITABLE)) 2321 newpte &= ~PT_WRITABLE; 2322 2323 if ((attr & HAT_NOSYNC) && 2324 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2325 newpte &= ~PT_SOFTWARE; 2326 2327 if ((attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2328 newpte |= mmu.pt_nx; 2329 } 2330 2331 /* 2332 * Ensure NOSYNC/NOCONSIST mappings have REF and MOD set. 2333 * x86pte_set() depends on this. 2334 */ 2335 if (PTE_GET(newpte, PT_SOFTWARE) >= PT_NOSYNC) 2336 newpte |= PT_REF | PT_MOD; 2337 2338 /* 2339 * what about PROT_READ or others? this code only handles: 2340 * EXEC, WRITE, NOSYNC 2341 */ 2342 2343 /* 2344 * If new PTE really changed, update the table. 2345 */ 2346 if (newpte != oldpte) { 2347 entry = htable_va2entry(vaddr, ht); 2348 oldpte = hati_update_pte(ht, entry, oldpte, newpte); 2349 if (oldpte != 0) { 2350 x86_hm_exit(pp); 2351 goto try_again; 2352 } 2353 } 2354 x86_hm_exit(pp); 2355 } 2356 if (ht) 2357 htable_release(ht); 2358 } 2359 2360 /* 2361 * Various wrappers for hat_updateattr() 2362 */ 2363 void 2364 hat_setattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2365 { 2366 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2367 hat_updateattr(hat, addr, len, attr, HAT_SET_ATTR); 2368 } 2369 2370 void 2371 hat_clrattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2372 { 2373 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2374 hat_updateattr(hat, addr, len, attr, HAT_CLR_ATTR); 2375 } 2376 2377 void 2378 hat_chgattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2379 { 2380 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2381 hat_updateattr(hat, addr, len, attr, HAT_LOAD_ATTR); 2382 } 2383 2384 void 2385 hat_chgprot(hat_t *hat, caddr_t addr, size_t len, uint_t vprot) 2386 { 2387 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2388 hat_updateattr(hat, addr, len, vprot & HAT_PROT_MASK, HAT_LOAD_ATTR); 2389 } 2390 2391 /* 2392 * size_t hat_getpagesize(hat, addr) 2393 * returns pagesize in bytes for <hat, addr>. returns -1 of there is 2394 * no mapping. This is an advisory call. 2395 */ 2396 ssize_t 2397 hat_getpagesize(hat_t *hat, caddr_t addr) 2398 { 2399 uintptr_t vaddr = ALIGN2PAGE(addr); 2400 htable_t *ht; 2401 size_t pagesize; 2402 2403 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2404 if (IN_VA_HOLE(vaddr)) 2405 return (-1); 2406 ht = htable_getpage(hat, vaddr, NULL); 2407 if (ht == NULL) 2408 return (-1); 2409 pagesize = LEVEL_SIZE(ht->ht_level); 2410 htable_release(ht); 2411 return (pagesize); 2412 } 2413 2414 2415 2416 /* 2417 * pfn_t hat_getpfnum(hat, addr) 2418 * returns pfn for <hat, addr> or PFN_INVALID if mapping is invalid. 2419 */ 2420 pfn_t 2421 hat_getpfnum(hat_t *hat, caddr_t addr) 2422 { 2423 uintptr_t vaddr = ALIGN2PAGE(addr); 2424 htable_t *ht; 2425 uint_t entry; 2426 pfn_t pfn = PFN_INVALID; 2427 2428 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2429 if (khat_running == 0) 2430 return (PFN_INVALID); 2431 2432 if (IN_VA_HOLE(vaddr)) 2433 return (PFN_INVALID); 2434 2435 /* 2436 * A very common use of hat_getpfnum() is from the DDI for kernel pages. 2437 * Use the kmap_ptes (which also covers the 32 bit heap) to speed 2438 * this up. 2439 */ 2440 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2441 x86pte_t pte; 2442 pgcnt_t pg_index; 2443 2444 pg_index = mmu_btop(vaddr - mmu.kmap_addr); 2445 pte = GET_PTE(PT_INDEX_PTR(mmu.kmap_ptes, pg_index)); 2446 if (!PTE_ISVALID(pte)) 2447 return (PFN_INVALID); 2448 /*LINTED [use of constant 0 causes a silly lint warning] */ 2449 return (PTE2PFN(pte, 0)); 2450 } 2451 2452 ht = htable_getpage(hat, vaddr, &entry); 2453 if (ht == NULL) 2454 return (PFN_INVALID); 2455 ASSERT(vaddr >= ht->ht_vaddr); 2456 ASSERT(vaddr <= HTABLE_LAST_PAGE(ht)); 2457 pfn = PTE2PFN(x86pte_get(ht, entry), ht->ht_level); 2458 if (ht->ht_level > 0) 2459 pfn += mmu_btop(vaddr & LEVEL_OFFSET(ht->ht_level)); 2460 htable_release(ht); 2461 return (pfn); 2462 } 2463 2464 /* 2465 * hat_getkpfnum() is an obsolete DDI routine, and its use is discouraged. 2466 * Use hat_getpfnum(kas.a_hat, ...) instead. 2467 * 2468 * We'd like to return PFN_INVALID if the mappings have underlying page_t's 2469 * but can't right now due to the fact that some software has grown to use 2470 * this interface incorrectly. So for now when the interface is misused, 2471 * return a warning to the user that in the future it won't work in the 2472 * way they're abusing it, and carry on. 2473 * 2474 * Note that hat_getkpfnum() is never supported on amd64. 2475 */ 2476 #if !defined(__amd64) 2477 pfn_t 2478 hat_getkpfnum(caddr_t addr) 2479 { 2480 pfn_t pfn; 2481 int badcaller = 0; 2482 2483 if (khat_running == 0) 2484 panic("hat_getkpfnum(): called too early\n"); 2485 if ((uintptr_t)addr < kernelbase) 2486 return (PFN_INVALID); 2487 2488 2489 if (segkpm && IS_KPM_ADDR(addr)) { 2490 badcaller = 1; 2491 pfn = hat_kpm_va2pfn(addr); 2492 } else { 2493 pfn = hat_getpfnum(kas.a_hat, addr); 2494 badcaller = pf_is_memory(pfn); 2495 } 2496 2497 if (badcaller) 2498 hat_getkpfnum_badcall(caller()); 2499 return (pfn); 2500 } 2501 #endif /* __amd64 */ 2502 2503 /* 2504 * int hat_probe(hat, addr) 2505 * return 0 if no valid mapping is present. Faster version 2506 * of hat_getattr in certain architectures. 2507 */ 2508 int 2509 hat_probe(hat_t *hat, caddr_t addr) 2510 { 2511 uintptr_t vaddr = ALIGN2PAGE(addr); 2512 uint_t entry; 2513 htable_t *ht; 2514 pgcnt_t pg_off; 2515 2516 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2517 ASSERT(hat == kas.a_hat || 2518 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2519 if (IN_VA_HOLE(vaddr)) 2520 return (0); 2521 2522 /* 2523 * Most common use of hat_probe is from segmap. We special case it 2524 * for performance. 2525 */ 2526 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2527 pg_off = mmu_btop(vaddr - mmu.kmap_addr); 2528 if (mmu.pae_hat) 2529 return (PTE_ISVALID(mmu.kmap_ptes[pg_off])); 2530 else 2531 return (PTE_ISVALID( 2532 ((x86pte32_t *)mmu.kmap_ptes)[pg_off])); 2533 } 2534 2535 ht = htable_getpage(hat, vaddr, &entry); 2536 if (ht == NULL) 2537 return (0); 2538 htable_release(ht); 2539 return (1); 2540 } 2541 2542 /* 2543 * Simple implementation of ISM. hat_share() is just like hat_memload_array(), 2544 * except that we use the ism_hat's existing mappings to determine the pages 2545 * and protections to use for this hat. In case we find a properly aligned 2546 * and sized pagetable of 4K mappings, we will attempt to share the pagetable 2547 * itself. 2548 */ 2549 /*ARGSUSED*/ 2550 int 2551 hat_share( 2552 hat_t *hat, 2553 caddr_t addr, 2554 hat_t *ism_hat, 2555 caddr_t src_addr, 2556 size_t len, /* almost useless value, see below.. */ 2557 uint_t ismszc) 2558 { 2559 uintptr_t vaddr_start = (uintptr_t)addr; 2560 uintptr_t vaddr; 2561 uintptr_t pt_vaddr; 2562 uintptr_t eaddr = vaddr_start + len; 2563 uintptr_t ism_addr_start = (uintptr_t)src_addr; 2564 uintptr_t ism_addr = ism_addr_start; 2565 uintptr_t e_ism_addr = ism_addr + len; 2566 htable_t *ism_ht = NULL; 2567 htable_t *ht; 2568 x86pte_t pte; 2569 page_t *pp; 2570 pfn_t pfn; 2571 level_t l; 2572 pgcnt_t pgcnt; 2573 uint_t prot; 2574 uint_t valid_cnt; 2575 2576 /* 2577 * We might be asked to share an empty DISM hat by as_dup() 2578 */ 2579 ASSERT(hat != kas.a_hat); 2580 ASSERT(eaddr <= _userlimit); 2581 if (!(ism_hat->hat_flags & HAT_SHARED)) { 2582 ASSERT(hat_get_mapped_size(ism_hat) == 0); 2583 return (0); 2584 } 2585 2586 /* 2587 * The SPT segment driver often passes us a size larger than there are 2588 * valid mappings. That's because it rounds the segment size up to a 2589 * large pagesize, even if the actual memory mapped by ism_hat is less. 2590 */ 2591 HATIN(hat_share, hat, addr, len); 2592 ASSERT(IS_PAGEALIGNED(vaddr_start)); 2593 ASSERT(IS_PAGEALIGNED(ism_addr_start)); 2594 ASSERT(ism_hat->hat_flags & HAT_SHARED); 2595 while (ism_addr < e_ism_addr) { 2596 /* 2597 * use htable_walk to get the next valid ISM mapping 2598 */ 2599 pte = htable_walk(ism_hat, &ism_ht, &ism_addr, e_ism_addr); 2600 if (ism_ht == NULL) 2601 break; 2602 2603 /* 2604 * Find the largest page size we can use, based on the 2605 * ISM mapping size, our address alignment and the remaining 2606 * map length. 2607 */ 2608 vaddr = vaddr_start + (ism_addr - ism_addr_start); 2609 for (l = ism_ht->ht_level; l > 0; --l) { 2610 if (LEVEL_SIZE(l) <= eaddr - vaddr && 2611 (vaddr & LEVEL_OFFSET(l)) == 0) 2612 break; 2613 } 2614 2615 /* 2616 * attempt to share the pagetable 2617 * 2618 * - only 4K pagetables are shared (ie. level == 0) 2619 * - the hat_share() length must cover the whole pagetable 2620 * - the shared address must align at level 1 2621 * - a shared PTE for this address already exists OR 2622 * - no page table for this address exists yet 2623 */ 2624 pt_vaddr = 2625 vaddr_start + (ism_ht->ht_vaddr - ism_addr_start); 2626 if (ism_ht->ht_level == 0 && 2627 ism_ht->ht_vaddr + LEVEL_SIZE(1) <= e_ism_addr && 2628 (pt_vaddr & LEVEL_OFFSET(1)) == 0) { 2629 2630 ht = htable_lookup(hat, pt_vaddr, 0); 2631 if (ht == NULL) 2632 ht = htable_create(hat, pt_vaddr, 0, ism_ht); 2633 2634 if (ht->ht_level > 0 || 2635 !(ht->ht_flags & HTABLE_SHARED_PFN)) { 2636 2637 htable_release(ht); 2638 2639 } else { 2640 2641 /* 2642 * share the page table 2643 */ 2644 ASSERT(ht->ht_level == 0); 2645 ASSERT(ht->ht_shares == ism_ht); 2646 valid_cnt = ism_ht->ht_valid_cnt; 2647 atomic_add_long(&hat->hat_pages_mapped[0], 2648 valid_cnt - ht->ht_valid_cnt); 2649 ht->ht_valid_cnt = valid_cnt; 2650 htable_release(ht); 2651 ism_addr = ism_ht->ht_vaddr + LEVEL_SIZE(1); 2652 htable_release(ism_ht); 2653 ism_ht = NULL; 2654 continue; 2655 } 2656 } 2657 2658 /* 2659 * Unable to share the page table. Instead we will 2660 * create new mappings from the values in the ISM mappings. 2661 * 2662 * The ISM mapping might be larger than the share area, 2663 * be careful to trunctate it if needed. 2664 */ 2665 if (eaddr - vaddr >= LEVEL_SIZE(ism_ht->ht_level)) { 2666 pgcnt = mmu_btop(LEVEL_SIZE(ism_ht->ht_level)); 2667 } else { 2668 pgcnt = mmu_btop(eaddr - vaddr); 2669 l = 0; 2670 } 2671 2672 pfn = PTE2PFN(pte, ism_ht->ht_level); 2673 ASSERT(pfn != PFN_INVALID); 2674 while (pgcnt > 0) { 2675 /* 2676 * Make a new pte for the PFN for this level. 2677 * Copy protections for the pte from the ISM pte. 2678 */ 2679 pp = page_numtopp_nolock(pfn); 2680 ASSERT(pp != NULL); 2681 2682 prot = PROT_USER | PROT_READ | HAT_UNORDERED_OK; 2683 if (PTE_GET(pte, PT_WRITABLE)) 2684 prot |= PROT_WRITE; 2685 if (!PTE_GET(pte, PT_NX)) 2686 prot |= PROT_EXEC; 2687 2688 /* 2689 * XX64 -- can shm ever be written to swap? 2690 * if not we could use HAT_NOSYNC here. 2691 */ 2692 while (hati_load_common(hat, vaddr, pp, prot, HAT_LOAD, 2693 l, pfn) != 0) { 2694 if (l == 0) 2695 panic("hati_load_common() failure"); 2696 --l; 2697 } 2698 2699 vaddr += LEVEL_SIZE(l); 2700 ism_addr += LEVEL_SIZE(l); 2701 pfn += mmu_btop(LEVEL_SIZE(l)); 2702 pgcnt -= mmu_btop(LEVEL_SIZE(l)); 2703 } 2704 } 2705 if (ism_ht != NULL) 2706 htable_release(ism_ht); 2707 2708 HATOUT(hat_share, hat, addr); 2709 return (0); 2710 } 2711 2712 2713 /* 2714 * hat_unshare() is similar to hat_unload_callback(), but 2715 * we have to look for empty shared pagetables. Note that 2716 * hat_unshare() is always invoked against an entire segment. 2717 */ 2718 /*ARGSUSED*/ 2719 void 2720 hat_unshare(hat_t *hat, caddr_t addr, size_t len, uint_t ismszc) 2721 { 2722 uintptr_t vaddr = (uintptr_t)addr; 2723 uintptr_t eaddr = vaddr + len; 2724 htable_t *ht = NULL; 2725 uint_t need_demaps = 0; 2726 2727 ASSERT(hat != kas.a_hat); 2728 ASSERT(eaddr <= _userlimit); 2729 HATIN(hat_unshare, hat, addr, len); 2730 ASSERT(IS_PAGEALIGNED(vaddr)); 2731 ASSERT(IS_PAGEALIGNED(eaddr)); 2732 2733 /* 2734 * First go through and remove any shared pagetables. 2735 * 2736 * Note that it's ok to delay the TLB shootdown till the entire range is 2737 * finished, because if hat_pageunload() were to unload a shared 2738 * pagetable page, its hat_tlb_inval() will do a global TLB invalidate. 2739 */ 2740 while (vaddr < eaddr) { 2741 ASSERT(!IN_VA_HOLE(vaddr)); 2742 /* 2743 * find the pagetable that would map the current address 2744 */ 2745 ht = htable_lookup(hat, vaddr, 0); 2746 if (ht != NULL) { 2747 if (ht->ht_flags & HTABLE_SHARED_PFN) { 2748 /* 2749 * clear mapped pages count, set valid_cnt to 0 2750 * and let htable_release() finish the job 2751 */ 2752 atomic_add_long(&hat->hat_pages_mapped[0], 2753 -ht->ht_valid_cnt); 2754 ht->ht_valid_cnt = 0; 2755 need_demaps = 1; 2756 } 2757 htable_release(ht); 2758 } 2759 vaddr = (vaddr & LEVEL_MASK(1)) + LEVEL_SIZE(1); 2760 } 2761 2762 /* 2763 * flush the TLBs - since we're probably dealing with MANY mappings 2764 * we do just one CR3 reload. 2765 */ 2766 if (!(hat->hat_flags & HAT_FREEING) && need_demaps) 2767 hat_tlb_inval(hat, DEMAP_ALL_ADDR); 2768 2769 /* 2770 * Now go back and clean up any unaligned mappings that 2771 * couldn't share pagetables. 2772 */ 2773 hat_unload(hat, addr, len, HAT_UNLOAD_UNMAP); 2774 2775 HATOUT(hat_unshare, hat, addr); 2776 } 2777 2778 2779 /* 2780 * hat_reserve() does nothing 2781 */ 2782 /*ARGSUSED*/ 2783 void 2784 hat_reserve(struct as *as, caddr_t addr, size_t len) 2785 { 2786 } 2787 2788 2789 /* 2790 * Called when all mappings to a page should have write permission removed. 2791 * Mostly stolem from hat_pagesync() 2792 */ 2793 static void 2794 hati_page_clrwrt(struct page *pp) 2795 { 2796 hment_t *hm = NULL; 2797 htable_t *ht; 2798 uint_t entry; 2799 x86pte_t old; 2800 x86pte_t new; 2801 uint_t pszc = 0; 2802 2803 next_size: 2804 /* 2805 * walk thru the mapping list clearing write permission 2806 */ 2807 x86_hm_enter(pp); 2808 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 2809 if (ht->ht_level < pszc) 2810 continue; 2811 old = x86pte_get(ht, entry); 2812 2813 for (;;) { 2814 /* 2815 * Is this mapping of interest? 2816 */ 2817 if (PTE2PFN(old, ht->ht_level) != pp->p_pagenum || 2818 PTE_GET(old, PT_WRITABLE) == 0) 2819 break; 2820 2821 /* 2822 * Clear ref/mod writable bits. This requires cross 2823 * calls to ensure any executing TLBs see cleared bits. 2824 */ 2825 new = old; 2826 PTE_CLR(new, PT_REF | PT_MOD | PT_WRITABLE); 2827 old = hati_update_pte(ht, entry, old, new); 2828 if (old != 0) 2829 continue; 2830 2831 break; 2832 } 2833 } 2834 x86_hm_exit(pp); 2835 while (pszc < pp->p_szc) { 2836 page_t *tpp; 2837 pszc++; 2838 tpp = PP_GROUPLEADER(pp, pszc); 2839 if (pp != tpp) { 2840 pp = tpp; 2841 goto next_size; 2842 } 2843 } 2844 } 2845 2846 /* 2847 * void hat_page_setattr(pp, flag) 2848 * void hat_page_clrattr(pp, flag) 2849 * used to set/clr ref/mod bits. 2850 */ 2851 void 2852 hat_page_setattr(struct page *pp, uint_t flag) 2853 { 2854 vnode_t *vp = pp->p_vnode; 2855 kmutex_t *vphm = NULL; 2856 page_t **listp; 2857 2858 if (PP_GETRM(pp, flag) == flag) 2859 return; 2860 2861 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 2862 vphm = page_vnode_mutex(vp); 2863 mutex_enter(vphm); 2864 } 2865 2866 PP_SETRM(pp, flag); 2867 2868 if (vphm != NULL) { 2869 2870 /* 2871 * Some File Systems examine v_pages for NULL w/o 2872 * grabbing the vphm mutex. Must not let it become NULL when 2873 * pp is the only page on the list. 2874 */ 2875 if (pp->p_vpnext != pp) { 2876 page_vpsub(&vp->v_pages, pp); 2877 if (vp->v_pages != NULL) 2878 listp = &vp->v_pages->p_vpprev->p_vpnext; 2879 else 2880 listp = &vp->v_pages; 2881 page_vpadd(listp, pp); 2882 } 2883 mutex_exit(vphm); 2884 } 2885 } 2886 2887 void 2888 hat_page_clrattr(struct page *pp, uint_t flag) 2889 { 2890 vnode_t *vp = pp->p_vnode; 2891 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 2892 2893 /* 2894 * Caller is expected to hold page's io lock for VMODSORT to work 2895 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod 2896 * bit is cleared. 2897 * We don't have assert to avoid tripping some existing third party 2898 * code. The dirty page is moved back to top of the v_page list 2899 * after IO is done in pvn_write_done(). 2900 */ 2901 PP_CLRRM(pp, flag); 2902 2903 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 2904 2905 /* 2906 * VMODSORT works by removing write permissions and getting 2907 * a fault when a page is made dirty. At this point 2908 * we need to remove write permission from all mappings 2909 * to this page. 2910 */ 2911 hati_page_clrwrt(pp); 2912 } 2913 } 2914 2915 /* 2916 * If flag is specified, returns 0 if attribute is disabled 2917 * and non zero if enabled. If flag specifes multiple attributs 2918 * then returns 0 if ALL atriibutes are disabled. This is an advisory 2919 * call. 2920 */ 2921 uint_t 2922 hat_page_getattr(struct page *pp, uint_t flag) 2923 { 2924 return (PP_GETRM(pp, flag)); 2925 } 2926 2927 2928 /* 2929 * common code used by hat_pageunload() and hment_steal() 2930 */ 2931 hment_t * 2932 hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry) 2933 { 2934 x86pte_t old_pte; 2935 pfn_t pfn = pp->p_pagenum; 2936 hment_t *hm; 2937 2938 /* 2939 * We need to acquire a hold on the htable in order to 2940 * do the invalidate. We know the htable must exist, since 2941 * unmap's don't release the htable until after removing any 2942 * hment. Having x86_hm_enter() keeps that from proceeding. 2943 */ 2944 htable_acquire(ht); 2945 2946 /* 2947 * Invalidate the PTE and remove the hment. 2948 */ 2949 old_pte = x86pte_inval(ht, entry, 0, NULL); 2950 if (PTE2PFN(old_pte, ht->ht_level) != pfn) { 2951 panic("x86pte_inval() failure found PTE = " FMT_PTE 2952 " pfn being unmapped is %lx ht=0x%lx entry=0x%x", 2953 old_pte, pfn, (uintptr_t)ht, entry); 2954 } 2955 2956 /* 2957 * Clean up all the htable information for this mapping 2958 */ 2959 ASSERT(ht->ht_valid_cnt > 0); 2960 HTABLE_DEC(ht->ht_valid_cnt); 2961 PGCNT_DEC(ht->ht_hat, ht->ht_level); 2962 2963 /* 2964 * sync ref/mod bits to the page_t 2965 */ 2966 if (PTE_GET(old_pte, PT_SOFTWARE) < PT_NOSYNC) 2967 hati_sync_pte_to_page(pp, old_pte, ht->ht_level); 2968 2969 /* 2970 * Remove the mapping list entry for this page. 2971 */ 2972 hm = hment_remove(pp, ht, entry); 2973 2974 /* 2975 * drop the mapping list lock so that we might free the 2976 * hment and htable. 2977 */ 2978 x86_hm_exit(pp); 2979 htable_release(ht); 2980 return (hm); 2981 } 2982 2983 extern int vpm_enable; 2984 /* 2985 * Unload all translations to a page. If the page is a subpage of a large 2986 * page, the large page mappings are also removed. 2987 * 2988 * The forceflags are unused. 2989 */ 2990 2991 /*ARGSUSED*/ 2992 static int 2993 hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag) 2994 { 2995 page_t *cur_pp = pp; 2996 hment_t *hm; 2997 hment_t *prev; 2998 htable_t *ht; 2999 uint_t entry; 3000 level_t level; 3001 3002 #if defined(__amd64) 3003 /* 3004 * clear the vpm ref. 3005 */ 3006 if (vpm_enable) { 3007 pp->p_vpmref = 0; 3008 } 3009 #endif 3010 /* 3011 * The loop with next_size handles pages with multiple pagesize mappings 3012 */ 3013 next_size: 3014 for (;;) { 3015 3016 /* 3017 * Get a mapping list entry 3018 */ 3019 x86_hm_enter(cur_pp); 3020 for (prev = NULL; ; prev = hm) { 3021 hm = hment_walk(cur_pp, &ht, &entry, prev); 3022 if (hm == NULL) { 3023 x86_hm_exit(cur_pp); 3024 3025 /* 3026 * If not part of a larger page, we're done. 3027 */ 3028 if (cur_pp->p_szc <= pg_szcd) { 3029 return (0); 3030 } 3031 3032 /* 3033 * Else check the next larger page size. 3034 * hat_page_demote() may decrease p_szc 3035 * but that's ok we'll just take an extra 3036 * trip discover there're no larger mappings 3037 * and return. 3038 */ 3039 ++pg_szcd; 3040 cur_pp = PP_GROUPLEADER(cur_pp, pg_szcd); 3041 goto next_size; 3042 } 3043 3044 /* 3045 * If this mapping size matches, remove it. 3046 */ 3047 level = ht->ht_level; 3048 if (level == pg_szcd) 3049 break; 3050 } 3051 3052 /* 3053 * Remove the mapping list entry for this page. 3054 * Note this does the x86_hm_exit() for us. 3055 */ 3056 hm = hati_page_unmap(cur_pp, ht, entry); 3057 if (hm != NULL) 3058 hment_free(hm); 3059 } 3060 } 3061 3062 int 3063 hat_pageunload(struct page *pp, uint_t forceflag) 3064 { 3065 ASSERT(PAGE_EXCL(pp)); 3066 return (hati_pageunload(pp, 0, forceflag)); 3067 } 3068 3069 /* 3070 * Unload all large mappings to pp and reduce by 1 p_szc field of every large 3071 * page level that included pp. 3072 * 3073 * pp must be locked EXCL. Even though no other constituent pages are locked 3074 * it's legal to unload large mappings to pp because all constituent pages of 3075 * large locked mappings have to be locked SHARED. therefore if we have EXCL 3076 * lock on one of constituent pages none of the large mappings to pp are 3077 * locked. 3078 * 3079 * Change (always decrease) p_szc field starting from the last constituent 3080 * page and ending with root constituent page so that root's pszc always shows 3081 * the area where hat_page_demote() may be active. 3082 * 3083 * This mechanism is only used for file system pages where it's not always 3084 * possible to get EXCL locks on all constituent pages to demote the size code 3085 * (as is done for anonymous or kernel large pages). 3086 */ 3087 void 3088 hat_page_demote(page_t *pp) 3089 { 3090 uint_t pszc; 3091 uint_t rszc; 3092 uint_t szc; 3093 page_t *rootpp; 3094 page_t *firstpp; 3095 page_t *lastpp; 3096 pgcnt_t pgcnt; 3097 3098 ASSERT(PAGE_EXCL(pp)); 3099 ASSERT(!PP_ISFREE(pp)); 3100 ASSERT(page_szc_lock_assert(pp)); 3101 3102 if (pp->p_szc == 0) 3103 return; 3104 3105 rootpp = PP_GROUPLEADER(pp, 1); 3106 (void) hati_pageunload(rootpp, 1, HAT_FORCE_PGUNLOAD); 3107 3108 /* 3109 * all large mappings to pp are gone 3110 * and no new can be setup since pp is locked exclusively. 3111 * 3112 * Lock the root to make sure there's only one hat_page_demote() 3113 * outstanding within the area of this root's pszc. 3114 * 3115 * Second potential hat_page_demote() is already eliminated by upper 3116 * VM layer via page_szc_lock() but we don't rely on it and use our 3117 * own locking (so that upper layer locking can be changed without 3118 * assumptions that hat depends on upper layer VM to prevent multiple 3119 * hat_page_demote() to be issued simultaneously to the same large 3120 * page). 3121 */ 3122 again: 3123 pszc = pp->p_szc; 3124 if (pszc == 0) 3125 return; 3126 rootpp = PP_GROUPLEADER(pp, pszc); 3127 x86_hm_enter(rootpp); 3128 /* 3129 * If root's p_szc is different from pszc we raced with another 3130 * hat_page_demote(). Drop the lock and try to find the root again. 3131 * If root's p_szc is greater than pszc previous hat_page_demote() is 3132 * not done yet. Take and release mlist lock of root's root to wait 3133 * for previous hat_page_demote() to complete. 3134 */ 3135 if ((rszc = rootpp->p_szc) != pszc) { 3136 x86_hm_exit(rootpp); 3137 if (rszc > pszc) { 3138 /* p_szc of a locked non free page can't increase */ 3139 ASSERT(pp != rootpp); 3140 3141 rootpp = PP_GROUPLEADER(rootpp, rszc); 3142 x86_hm_enter(rootpp); 3143 x86_hm_exit(rootpp); 3144 } 3145 goto again; 3146 } 3147 ASSERT(pp->p_szc == pszc); 3148 3149 /* 3150 * Decrement by 1 p_szc of every constituent page of a region that 3151 * covered pp. For example if original szc is 3 it gets changed to 2 3152 * everywhere except in region 2 that covered pp. Region 2 that 3153 * covered pp gets demoted to 1 everywhere except in region 1 that 3154 * covered pp. The region 1 that covered pp is demoted to region 3155 * 0. It's done this way because from region 3 we removed level 3 3156 * mappings, from region 2 that covered pp we removed level 2 mappings 3157 * and from region 1 that covered pp we removed level 1 mappings. All 3158 * changes are done from from high pfn's to low pfn's so that roots 3159 * are changed last allowing one to know the largest region where 3160 * hat_page_demote() is stil active by only looking at the root page. 3161 * 3162 * This algorithm is implemented in 2 while loops. First loop changes 3163 * p_szc of pages to the right of pp's level 1 region and second 3164 * loop changes p_szc of pages of level 1 region that covers pp 3165 * and all pages to the left of level 1 region that covers pp. 3166 * In the first loop p_szc keeps dropping with every iteration 3167 * and in the second loop it keeps increasing with every iteration. 3168 * 3169 * First loop description: Demote pages to the right of pp outside of 3170 * level 1 region that covers pp. In every iteration of the while 3171 * loop below find the last page of szc region and the first page of 3172 * (szc - 1) region that is immediately to the right of (szc - 1) 3173 * region that covers pp. From last such page to first such page 3174 * change every page's szc to szc - 1. Decrement szc and continue 3175 * looping until szc is 1. If pp belongs to the last (szc - 1) region 3176 * of szc region skip to the next iteration. 3177 */ 3178 szc = pszc; 3179 while (szc > 1) { 3180 lastpp = PP_GROUPLEADER(pp, szc); 3181 pgcnt = page_get_pagecnt(szc); 3182 lastpp += pgcnt - 1; 3183 firstpp = PP_GROUPLEADER(pp, (szc - 1)); 3184 pgcnt = page_get_pagecnt(szc - 1); 3185 if (lastpp - firstpp < pgcnt) { 3186 szc--; 3187 continue; 3188 } 3189 firstpp += pgcnt; 3190 while (lastpp != firstpp) { 3191 ASSERT(lastpp->p_szc == pszc); 3192 lastpp->p_szc = szc - 1; 3193 lastpp--; 3194 } 3195 firstpp->p_szc = szc - 1; 3196 szc--; 3197 } 3198 3199 /* 3200 * Second loop description: 3201 * First iteration changes p_szc to 0 of every 3202 * page of level 1 region that covers pp. 3203 * Subsequent iterations find last page of szc region 3204 * immediately to the left of szc region that covered pp 3205 * and first page of (szc + 1) region that covers pp. 3206 * From last to first page change p_szc of every page to szc. 3207 * Increment szc and continue looping until szc is pszc. 3208 * If pp belongs to the fist szc region of (szc + 1) region 3209 * skip to the next iteration. 3210 * 3211 */ 3212 szc = 0; 3213 while (szc < pszc) { 3214 firstpp = PP_GROUPLEADER(pp, (szc + 1)); 3215 if (szc == 0) { 3216 pgcnt = page_get_pagecnt(1); 3217 lastpp = firstpp + (pgcnt - 1); 3218 } else { 3219 lastpp = PP_GROUPLEADER(pp, szc); 3220 if (firstpp == lastpp) { 3221 szc++; 3222 continue; 3223 } 3224 lastpp--; 3225 pgcnt = page_get_pagecnt(szc); 3226 } 3227 while (lastpp != firstpp) { 3228 ASSERT(lastpp->p_szc == pszc); 3229 lastpp->p_szc = szc; 3230 lastpp--; 3231 } 3232 firstpp->p_szc = szc; 3233 if (firstpp == rootpp) 3234 break; 3235 szc++; 3236 } 3237 x86_hm_exit(rootpp); 3238 } 3239 3240 /* 3241 * get hw stats from hardware into page struct and reset hw stats 3242 * returns attributes of page 3243 * Flags for hat_pagesync, hat_getstat, hat_sync 3244 * 3245 * define HAT_SYNC_ZERORM 0x01 3246 * 3247 * Additional flags for hat_pagesync 3248 * 3249 * define HAT_SYNC_STOPON_REF 0x02 3250 * define HAT_SYNC_STOPON_MOD 0x04 3251 * define HAT_SYNC_STOPON_RM 0x06 3252 * define HAT_SYNC_STOPON_SHARED 0x08 3253 */ 3254 uint_t 3255 hat_pagesync(struct page *pp, uint_t flags) 3256 { 3257 hment_t *hm = NULL; 3258 htable_t *ht; 3259 uint_t entry; 3260 x86pte_t old, save_old; 3261 x86pte_t new; 3262 uchar_t nrmbits = P_REF|P_MOD|P_RO; 3263 extern ulong_t po_share; 3264 page_t *save_pp = pp; 3265 uint_t pszc = 0; 3266 3267 ASSERT(PAGE_LOCKED(pp) || panicstr); 3268 3269 if (PP_ISRO(pp) && (flags & HAT_SYNC_STOPON_MOD)) 3270 return (pp->p_nrm & nrmbits); 3271 3272 if ((flags & HAT_SYNC_ZERORM) == 0) { 3273 3274 if ((flags & HAT_SYNC_STOPON_REF) != 0 && PP_ISREF(pp)) 3275 return (pp->p_nrm & nrmbits); 3276 3277 if ((flags & HAT_SYNC_STOPON_MOD) != 0 && PP_ISMOD(pp)) 3278 return (pp->p_nrm & nrmbits); 3279 3280 if ((flags & HAT_SYNC_STOPON_SHARED) != 0 && 3281 hat_page_getshare(pp) > po_share) { 3282 if (PP_ISRO(pp)) 3283 PP_SETREF(pp); 3284 return (pp->p_nrm & nrmbits); 3285 } 3286 } 3287 3288 next_size: 3289 /* 3290 * walk thru the mapping list syncing (and clearing) ref/mod bits. 3291 */ 3292 x86_hm_enter(pp); 3293 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 3294 if (ht->ht_level < pszc) 3295 continue; 3296 old = x86pte_get(ht, entry); 3297 try_again: 3298 3299 ASSERT(PTE2PFN(old, ht->ht_level) == pp->p_pagenum); 3300 3301 if (PTE_GET(old, PT_REF | PT_MOD) == 0) 3302 continue; 3303 3304 save_old = old; 3305 if ((flags & HAT_SYNC_ZERORM) != 0) { 3306 3307 /* 3308 * Need to clear ref or mod bits. Need to demap 3309 * to make sure any executing TLBs see cleared bits. 3310 */ 3311 new = old; 3312 PTE_CLR(new, PT_REF | PT_MOD); 3313 old = hati_update_pte(ht, entry, old, new); 3314 if (old != 0) 3315 goto try_again; 3316 3317 old = save_old; 3318 } 3319 3320 /* 3321 * Sync the PTE 3322 */ 3323 if (!(flags & HAT_SYNC_ZERORM) && 3324 PTE_GET(old, PT_SOFTWARE) <= PT_NOSYNC) 3325 hati_sync_pte_to_page(pp, old, ht->ht_level); 3326 3327 /* 3328 * can stop short if we found a ref'd or mod'd page 3329 */ 3330 if ((flags & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp) || 3331 (flags & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)) { 3332 x86_hm_exit(pp); 3333 goto done; 3334 } 3335 } 3336 x86_hm_exit(pp); 3337 while (pszc < pp->p_szc) { 3338 page_t *tpp; 3339 pszc++; 3340 tpp = PP_GROUPLEADER(pp, pszc); 3341 if (pp != tpp) { 3342 pp = tpp; 3343 goto next_size; 3344 } 3345 } 3346 done: 3347 return (save_pp->p_nrm & nrmbits); 3348 } 3349 3350 /* 3351 * returns approx number of mappings to this pp. A return of 0 implies 3352 * there are no mappings to the page. 3353 */ 3354 ulong_t 3355 hat_page_getshare(page_t *pp) 3356 { 3357 uint_t cnt; 3358 cnt = hment_mapcnt(pp); 3359 #if defined(__amd64) 3360 if (vpm_enable && pp->p_vpmref) { 3361 cnt += 1; 3362 } 3363 #endif 3364 return (cnt); 3365 } 3366 3367 /* 3368 * hat_softlock isn't supported anymore 3369 */ 3370 /*ARGSUSED*/ 3371 faultcode_t 3372 hat_softlock( 3373 hat_t *hat, 3374 caddr_t addr, 3375 size_t *len, 3376 struct page **page_array, 3377 uint_t flags) 3378 { 3379 return (FC_NOSUPPORT); 3380 } 3381 3382 3383 3384 /* 3385 * Routine to expose supported HAT features to platform independent code. 3386 */ 3387 /*ARGSUSED*/ 3388 int 3389 hat_supported(enum hat_features feature, void *arg) 3390 { 3391 switch (feature) { 3392 3393 case HAT_SHARED_PT: /* this is really ISM */ 3394 return (1); 3395 3396 case HAT_DYNAMIC_ISM_UNMAP: 3397 return (0); 3398 3399 case HAT_VMODSORT: 3400 return (1); 3401 3402 default: 3403 panic("hat_supported() - unknown feature"); 3404 } 3405 return (0); 3406 } 3407 3408 /* 3409 * Called when a thread is exiting and has been switched to the kernel AS 3410 */ 3411 void 3412 hat_thread_exit(kthread_t *thd) 3413 { 3414 ASSERT(thd->t_procp->p_as == &kas); 3415 hat_switch(thd->t_procp->p_as->a_hat); 3416 } 3417 3418 /* 3419 * Setup the given brand new hat structure as the new HAT on this cpu's mmu. 3420 */ 3421 /*ARGSUSED*/ 3422 void 3423 hat_setup(hat_t *hat, int flags) 3424 { 3425 kpreempt_disable(); 3426 3427 hat_switch(hat); 3428 3429 kpreempt_enable(); 3430 } 3431 3432 /* 3433 * Prepare for a CPU private mapping for the given address. 3434 * 3435 * The address can only be used from a single CPU and can be remapped 3436 * using hat_mempte_remap(). Return the address of the PTE. 3437 * 3438 * We do the htable_create() if necessary and increment the valid count so 3439 * the htable can't disappear. We also hat_devload() the page table into 3440 * kernel so that the PTE is quickly accessed. 3441 */ 3442 hat_mempte_t 3443 hat_mempte_setup(caddr_t addr) 3444 { 3445 uintptr_t va = (uintptr_t)addr; 3446 htable_t *ht; 3447 uint_t entry; 3448 x86pte_t oldpte; 3449 hat_mempte_t p; 3450 3451 ASSERT(IS_PAGEALIGNED(va)); 3452 ASSERT(!IN_VA_HOLE(va)); 3453 ++curthread->t_hatdepth; 3454 ht = htable_getpte(kas.a_hat, va, &entry, &oldpte, 0); 3455 if (ht == NULL) { 3456 ht = htable_create(kas.a_hat, va, 0, NULL); 3457 entry = htable_va2entry(va, ht); 3458 ASSERT(ht->ht_level == 0); 3459 oldpte = x86pte_get(ht, entry); 3460 } 3461 if (PTE_ISVALID(oldpte)) 3462 panic("hat_mempte_setup(): address already mapped" 3463 "ht=%p, entry=%d, pte=" FMT_PTE, ht, entry, oldpte); 3464 3465 /* 3466 * increment ht_valid_cnt so that the pagetable can't disappear 3467 */ 3468 HTABLE_INC(ht->ht_valid_cnt); 3469 3470 /* 3471 * return the PTE physical address to the caller. 3472 */ 3473 htable_release(ht); 3474 p = PT_INDEX_PHYSADDR(pfn_to_pa(ht->ht_pfn), entry); 3475 --curthread->t_hatdepth; 3476 return (p); 3477 } 3478 3479 /* 3480 * Release a CPU private mapping for the given address. 3481 * We decrement the htable valid count so it might be destroyed. 3482 */ 3483 /*ARGSUSED1*/ 3484 void 3485 hat_mempte_release(caddr_t addr, hat_mempte_t pte_pa) 3486 { 3487 htable_t *ht; 3488 3489 /* 3490 * invalidate any left over mapping and decrement the htable valid count 3491 */ 3492 { 3493 x86pte_t *pteptr; 3494 3495 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3496 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3497 if (mmu.pae_hat) 3498 *pteptr = 0; 3499 else 3500 *(x86pte32_t *)pteptr = 0; 3501 mmu_tlbflush_entry(addr); 3502 x86pte_mapout(); 3503 } 3504 3505 ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0); 3506 if (ht == NULL) 3507 panic("hat_mempte_release(): invalid address"); 3508 ASSERT(ht->ht_level == 0); 3509 HTABLE_DEC(ht->ht_valid_cnt); 3510 htable_release(ht); 3511 } 3512 3513 /* 3514 * Apply a temporary CPU private mapping to a page. We flush the TLB only 3515 * on this CPU, so this ought to have been called with preemption disabled. 3516 */ 3517 void 3518 hat_mempte_remap( 3519 pfn_t pfn, 3520 caddr_t addr, 3521 hat_mempte_t pte_pa, 3522 uint_t attr, 3523 uint_t flags) 3524 { 3525 uintptr_t va = (uintptr_t)addr; 3526 x86pte_t pte; 3527 3528 /* 3529 * Remap the given PTE to the new page's PFN. Invalidate only 3530 * on this CPU. 3531 */ 3532 #ifdef DEBUG 3533 htable_t *ht; 3534 uint_t entry; 3535 3536 ASSERT(IS_PAGEALIGNED(va)); 3537 ASSERT(!IN_VA_HOLE(va)); 3538 ht = htable_getpte(kas.a_hat, va, &entry, NULL, 0); 3539 ASSERT(ht != NULL); 3540 ASSERT(ht->ht_level == 0); 3541 ASSERT(ht->ht_valid_cnt > 0); 3542 ASSERT(ht->ht_pfn == mmu_btop(pte_pa)); 3543 htable_release(ht); 3544 #endif 3545 pte = hati_mkpte(pfn, attr, 0, flags); 3546 { 3547 x86pte_t *pteptr; 3548 3549 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3550 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3551 if (mmu.pae_hat) 3552 *(x86pte_t *)pteptr = pte; 3553 else 3554 *(x86pte32_t *)pteptr = (x86pte32_t)pte; 3555 mmu_tlbflush_entry(addr); 3556 x86pte_mapout(); 3557 } 3558 } 3559 3560 3561 3562 /* 3563 * Hat locking functions 3564 * XXX - these two functions are currently being used by hatstats 3565 * they can be removed by using a per-as mutex for hatstats. 3566 */ 3567 void 3568 hat_enter(hat_t *hat) 3569 { 3570 mutex_enter(&hat->hat_mutex); 3571 } 3572 3573 void 3574 hat_exit(hat_t *hat) 3575 { 3576 mutex_exit(&hat->hat_mutex); 3577 } 3578 3579 /* 3580 * HAT part of cpu initialization. 3581 */ 3582 void 3583 hat_cpu_online(struct cpu *cpup) 3584 { 3585 if (cpup != CPU) { 3586 x86pte_cpu_init(cpup); 3587 hat_vlp_setup(cpup); 3588 } 3589 CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id); 3590 } 3591 3592 /* 3593 * HAT part of cpu deletion. 3594 * (currently, we only call this after the cpu is safely passivated.) 3595 */ 3596 void 3597 hat_cpu_offline(struct cpu *cpup) 3598 { 3599 ASSERT(cpup != CPU); 3600 3601 CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id); 3602 x86pte_cpu_fini(cpup); 3603 hat_vlp_teardown(cpup); 3604 } 3605 3606 /* 3607 * Function called after all CPUs are brought online. 3608 * Used to remove low address boot mappings. 3609 */ 3610 void 3611 clear_boot_mappings(uintptr_t low, uintptr_t high) 3612 { 3613 uintptr_t vaddr = low; 3614 htable_t *ht = NULL; 3615 level_t level; 3616 uint_t entry; 3617 x86pte_t pte; 3618 3619 /* 3620 * On 1st CPU we can unload the prom mappings, basically we blow away 3621 * all virtual mappings under _userlimit. 3622 */ 3623 while (vaddr < high) { 3624 pte = htable_walk(kas.a_hat, &ht, &vaddr, high); 3625 if (ht == NULL) 3626 break; 3627 3628 level = ht->ht_level; 3629 entry = htable_va2entry(vaddr, ht); 3630 ASSERT(level <= mmu.max_page_level); 3631 ASSERT(PTE_ISPAGE(pte, level)); 3632 3633 /* 3634 * Unload the mapping from the page tables. 3635 */ 3636 (void) x86pte_inval(ht, entry, 0, NULL); 3637 ASSERT(ht->ht_valid_cnt > 0); 3638 HTABLE_DEC(ht->ht_valid_cnt); 3639 PGCNT_DEC(ht->ht_hat, ht->ht_level); 3640 3641 vaddr += LEVEL_SIZE(ht->ht_level); 3642 } 3643 if (ht) 3644 htable_release(ht); 3645 } 3646 3647 /* 3648 * Atomically update a new translation for a single page. If the 3649 * currently installed PTE doesn't match the value we expect to find, 3650 * it's not updated and we return the PTE we found. 3651 * 3652 * If activating nosync or NOWRITE and the page was modified we need to sync 3653 * with the page_t. Also sync with page_t if clearing ref/mod bits. 3654 */ 3655 static x86pte_t 3656 hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, x86pte_t new) 3657 { 3658 page_t *pp; 3659 uint_t rm = 0; 3660 x86pte_t replaced; 3661 3662 if (PTE_GET(expected, PT_SOFTWARE) < PT_NOSYNC && 3663 PTE_GET(expected, PT_MOD | PT_REF) && 3664 (PTE_GET(new, PT_NOSYNC) || !PTE_GET(new, PT_WRITABLE) || 3665 !PTE_GET(new, PT_MOD | PT_REF))) { 3666 3667 ASSERT(!pfn_is_foreign(PTE2PFN(expected, ht->ht_level))); 3668 pp = page_numtopp_nolock(PTE2PFN(expected, ht->ht_level)); 3669 ASSERT(pp != NULL); 3670 if (PTE_GET(expected, PT_MOD)) 3671 rm |= P_MOD; 3672 if (PTE_GET(expected, PT_REF)) 3673 rm |= P_REF; 3674 PTE_CLR(new, PT_MOD | PT_REF); 3675 } 3676 3677 replaced = x86pte_update(ht, entry, expected, new); 3678 if (replaced != expected) 3679 return (replaced); 3680 3681 if (rm) { 3682 /* 3683 * sync to all constituent pages of a large page 3684 */ 3685 pgcnt_t pgcnt = page_get_pagecnt(ht->ht_level); 3686 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 3687 while (pgcnt-- > 0) { 3688 /* 3689 * hat_page_demote() can't decrease 3690 * pszc below this mapping size 3691 * since large mapping existed after we 3692 * took mlist lock. 3693 */ 3694 ASSERT(pp->p_szc >= ht->ht_level); 3695 hat_page_setattr(pp, rm); 3696 ++pp; 3697 } 3698 } 3699 3700 return (0); 3701 } 3702 3703 /* 3704 * Kernel Physical Mapping (kpm) facility 3705 * 3706 * Most of the routines needed to support segkpm are almost no-ops on the 3707 * x86 platform. We map in the entire segment when it is created and leave 3708 * it mapped in, so there is no additional work required to set up and tear 3709 * down individual mappings. All of these routines were created to support 3710 * SPARC platforms that have to avoid aliasing in their virtually indexed 3711 * caches. 3712 * 3713 * Most of the routines have sanity checks in them (e.g. verifying that the 3714 * passed-in page is locked). We don't actually care about most of these 3715 * checks on x86, but we leave them in place to identify problems in the 3716 * upper levels. 3717 */ 3718 3719 /* 3720 * Map in a locked page and return the vaddr. 3721 */ 3722 /*ARGSUSED*/ 3723 caddr_t 3724 hat_kpm_mapin(struct page *pp, struct kpme *kpme) 3725 { 3726 caddr_t vaddr; 3727 3728 #ifdef DEBUG 3729 if (kpm_enable == 0) { 3730 cmn_err(CE_WARN, "hat_kpm_mapin: kpm_enable not set\n"); 3731 return ((caddr_t)NULL); 3732 } 3733 3734 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 3735 cmn_err(CE_WARN, "hat_kpm_mapin: pp zero or not locked\n"); 3736 return ((caddr_t)NULL); 3737 } 3738 #endif 3739 3740 vaddr = hat_kpm_page2va(pp, 1); 3741 3742 return (vaddr); 3743 } 3744 3745 /* 3746 * Mapout a locked page. 3747 */ 3748 /*ARGSUSED*/ 3749 void 3750 hat_kpm_mapout(struct page *pp, struct kpme *kpme, caddr_t vaddr) 3751 { 3752 #ifdef DEBUG 3753 if (kpm_enable == 0) { 3754 cmn_err(CE_WARN, "hat_kpm_mapout: kpm_enable not set\n"); 3755 return; 3756 } 3757 3758 if (IS_KPM_ADDR(vaddr) == 0) { 3759 cmn_err(CE_WARN, "hat_kpm_mapout: no kpm address\n"); 3760 return; 3761 } 3762 3763 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 3764 cmn_err(CE_WARN, "hat_kpm_mapout: page zero or not locked\n"); 3765 return; 3766 } 3767 #endif 3768 } 3769 3770 /* 3771 * Return the kpm virtual address for a specific pfn 3772 */ 3773 caddr_t 3774 hat_kpm_pfn2va(pfn_t pfn) 3775 { 3776 uintptr_t vaddr = (uintptr_t)kpm_vbase + mmu_ptob(pfn); 3777 3778 return ((caddr_t)vaddr); 3779 } 3780 3781 /* 3782 * Return the kpm virtual address for the page at pp. 3783 */ 3784 /*ARGSUSED*/ 3785 caddr_t 3786 hat_kpm_page2va(struct page *pp, int checkswap) 3787 { 3788 return (hat_kpm_pfn2va(pp->p_pagenum)); 3789 } 3790 3791 /* 3792 * Return the page frame number for the kpm virtual address vaddr. 3793 */ 3794 pfn_t 3795 hat_kpm_va2pfn(caddr_t vaddr) 3796 { 3797 pfn_t pfn; 3798 3799 ASSERT(IS_KPM_ADDR(vaddr)); 3800 3801 pfn = (pfn_t)btop(vaddr - kpm_vbase); 3802 3803 return (pfn); 3804 } 3805 3806 3807 /* 3808 * Return the page for the kpm virtual address vaddr. 3809 */ 3810 page_t * 3811 hat_kpm_vaddr2page(caddr_t vaddr) 3812 { 3813 pfn_t pfn; 3814 3815 ASSERT(IS_KPM_ADDR(vaddr)); 3816 3817 pfn = hat_kpm_va2pfn(vaddr); 3818 3819 return (page_numtopp_nolock(pfn)); 3820 } 3821 3822 /* 3823 * hat_kpm_fault is called from segkpm_fault when we take a page fault on a 3824 * KPM page. This should never happen on x86 3825 */ 3826 int 3827 hat_kpm_fault(hat_t *hat, caddr_t vaddr) 3828 { 3829 panic("pagefault in seg_kpm. hat: 0x%p vaddr: 0x%p", hat, vaddr); 3830 3831 return (0); 3832 } 3833 3834 /*ARGSUSED*/ 3835 void 3836 hat_kpm_mseghash_clear(int nentries) 3837 {} 3838 3839 /*ARGSUSED*/ 3840 void 3841 hat_kpm_mseghash_update(pgcnt_t inx, struct memseg *msp) 3842 {} 3843