1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #pragma ident "%Z%%M% %I% %E% SMI" 27 28 /* 29 * VM - Hardware Address Translation management for i386 and amd64 30 * 31 * Implementation of the interfaces described in <common/vm/hat.h> 32 * 33 * Nearly all the details of how the hardware is managed should not be 34 * visible outside this layer except for misc. machine specific functions 35 * that work in conjunction with this code. 36 * 37 * Routines used only inside of i86pc/vm start with hati_ for HAT Internal. 38 */ 39 40 #include <sys/machparam.h> 41 #include <sys/machsystm.h> 42 #include <sys/mman.h> 43 #include <sys/types.h> 44 #include <sys/systm.h> 45 #include <sys/cpuvar.h> 46 #include <sys/thread.h> 47 #include <sys/proc.h> 48 #include <sys/cpu.h> 49 #include <sys/kmem.h> 50 #include <sys/disp.h> 51 #include <sys/shm.h> 52 #include <sys/sysmacros.h> 53 #include <sys/machparam.h> 54 #include <sys/vmem.h> 55 #include <sys/vmsystm.h> 56 #include <sys/promif.h> 57 #include <sys/var.h> 58 #include <sys/x86_archext.h> 59 #include <sys/atomic.h> 60 #include <sys/bitmap.h> 61 #include <sys/controlregs.h> 62 #include <sys/bootconf.h> 63 #include <sys/bootsvcs.h> 64 #include <sys/bootinfo.h> 65 66 #include <vm/seg_kmem.h> 67 #include <vm/hat_i86.h> 68 #include <vm/as.h> 69 #include <vm/seg.h> 70 #include <vm/page.h> 71 #include <vm/seg_kp.h> 72 #include <vm/seg_kpm.h> 73 #include <vm/vm_dep.h> 74 #include <vm/kboot_mmu.h> 75 76 #include <sys/cmn_err.h> 77 78 /* 79 * Basic parameters for hat operation. 80 */ 81 struct hat_mmu_info mmu; 82 83 /* 84 * The page that is the kernel's top level pagetable. 85 * 86 * For 32 bit VLP support, the kernel hat will use the 1st 4 entries 87 * on this 4K page for its top level page table. The remaining groups of 88 * 4 entries are used for per processor copies of user VLP pagetables for 89 * running threads. See hat_switch() and reload_pae32() for details. 90 * 91 * vlp_page[0] - 0th level==2 PTE for kernel HAT (will be zero) 92 * vlp_page[1] - 1st level==2 PTE for kernel HAT (will be zero) 93 * vlp_page[2] - 2nd level==2 PTE for kernel HAT (zero for small memory) 94 * vlp_page[3] - 3rd level==2 PTE for kernel 95 * 96 * vlp_page[4] - 0th level==2 PTE for user thread on cpu 0 97 * vlp_page[5] - 1st level==2 PTE for user thread on cpu 0 98 * vlp_page[6] - 2nd level==2 PTE for user thread on cpu 0 99 * vlp_page[7] - probably copy of kernel PTE 100 * 101 * vlp_page[8] - 0th level==2 PTE for user thread on cpu 1 102 * vlp_page[9] - 1st level==2 PTE for user thread on cpu 1 103 * vlp_page[10] - 2nd level==2 PTE for user thread on cpu 1 104 * vlp_page[11] - probably copy of kernel PTE 105 * ... 106 * 107 * when / where the kernel PTE's are (entry 2 or 3 or none) depends 108 * on kernelbase. 109 */ 110 static x86pte_t *vlp_page; 111 112 /* 113 * forward declaration of internal utility routines 114 */ 115 static x86pte_t hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, 116 x86pte_t new); 117 118 /* 119 * The kernel address space exists in all HATs. To implement this the 120 * kernel reserves a fixed number of entries in every topmost level page 121 * table. The values are setup in hat_init() and then copied to every hat 122 * created by hat_alloc(). This means that kernelbase must be: 123 * 124 * 4Meg aligned for 32 bit kernels 125 * 512Gig aligned for x86_64 64 bit kernel 126 * 127 * The PAE 32 bit hat is handled as a special case. Otherwise requiring 1Gig 128 * alignment would use too much VA for the kernel. 129 * 130 */ 131 static uint_t khat_start; /* index of 1st entry in kernel's top ptable */ 132 static uint_t khat_entries; /* number of entries in kernel's top ptable */ 133 134 #if defined(__i386) 135 136 static htable_t *khat_pae32_htable = NULL; 137 static uint_t khat_pae32_start; 138 static uint_t khat_pae32_entries; 139 140 #endif 141 142 uint_t use_boot_reserve = 1; /* cleared after early boot process */ 143 uint_t can_steal_post_boot = 0; /* set late in boot to enable stealing */ 144 145 /* 146 * A cpuset for all cpus. This is used for kernel address cross calls, since 147 * the kernel addresses apply to all cpus. 148 */ 149 cpuset_t khat_cpuset; 150 151 /* 152 * management stuff for hat structures 153 */ 154 kmutex_t hat_list_lock; 155 kcondvar_t hat_list_cv; 156 kmem_cache_t *hat_cache; 157 kmem_cache_t *hat_hash_cache; 158 kmem_cache_t *vlp_hash_cache; 159 160 /* 161 * Simple statistics 162 */ 163 struct hatstats hatstat; 164 165 /* 166 * useful stuff for atomic access/clearing/setting REF/MOD/RO bits in page_t's. 167 */ 168 extern void atomic_orb(uchar_t *addr, uchar_t val); 169 extern void atomic_andb(uchar_t *addr, uchar_t val); 170 171 #define PP_GETRM(pp, rmmask) (pp->p_nrm & rmmask) 172 #define PP_ISMOD(pp) PP_GETRM(pp, P_MOD) 173 #define PP_ISREF(pp) PP_GETRM(pp, P_REF) 174 #define PP_ISRO(pp) PP_GETRM(pp, P_RO) 175 176 #define PP_SETRM(pp, rm) atomic_orb(&(pp->p_nrm), rm) 177 #define PP_SETMOD(pp) PP_SETRM(pp, P_MOD) 178 #define PP_SETREF(pp) PP_SETRM(pp, P_REF) 179 #define PP_SETRO(pp) PP_SETRM(pp, P_RO) 180 181 #define PP_CLRRM(pp, rm) atomic_andb(&(pp->p_nrm), ~(rm)) 182 #define PP_CLRMOD(pp) PP_CLRRM(pp, P_MOD) 183 #define PP_CLRREF(pp) PP_CLRRM(pp, P_REF) 184 #define PP_CLRRO(pp) PP_CLRRM(pp, P_RO) 185 #define PP_CLRALL(pp) PP_CLRRM(pp, P_MOD | P_REF | P_RO) 186 187 /* 188 * some useful tracing macros 189 */ 190 191 int hattrace = 0; 192 #ifdef DEBUG 193 194 #define HATIN(r, h, a, l) \ 195 if (hattrace) prom_printf("->%s hat=%p, adr=%p, len=%lx\n", #r, h, a, l) 196 197 #define HATOUT(r, h, a) \ 198 if (hattrace) prom_printf("<-%s hat=%p, adr=%p\n", #r, h, a) 199 #else 200 201 #define HATIN(r, h, a, l) 202 #define HATOUT(r, h, a) 203 204 #endif 205 206 207 /* 208 * kmem cache constructor for struct hat 209 */ 210 /*ARGSUSED*/ 211 static int 212 hati_constructor(void *buf, void *handle, int kmflags) 213 { 214 hat_t *hat = buf; 215 216 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 217 bzero(hat->hat_pages_mapped, 218 sizeof (pgcnt_t) * (mmu.max_page_level + 1)); 219 hat->hat_stats = 0; 220 hat->hat_flags = 0; 221 mutex_init(&hat->hat_switch_mutex, NULL, MUTEX_DRIVER, 222 (void *)ipltospl(DISP_LEVEL)); 223 CPUSET_ZERO(hat->hat_cpus); 224 hat->hat_htable = NULL; 225 hat->hat_ht_hash = NULL; 226 return (0); 227 } 228 229 /* 230 * Allocate a hat structure for as. We also create the top level 231 * htable and initialize it to contain the kernel hat entries. 232 */ 233 hat_t * 234 hat_alloc(struct as *as) 235 { 236 hat_t *hat; 237 htable_t *ht; /* top level htable */ 238 uint_t use_vlp; 239 240 /* 241 * Once we start creating user process HATs we can enable 242 * the htable_steal() code. 243 */ 244 if (can_steal_post_boot == 0) 245 can_steal_post_boot = 1; 246 247 ASSERT(AS_WRITE_HELD(as, &as->a_lock)); 248 hat = kmem_cache_alloc(hat_cache, KM_SLEEP); 249 hat->hat_as = as; 250 mutex_init(&hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 251 ASSERT(hat->hat_flags == 0); 252 253 /* 254 * a 32 bit process uses a VLP style hat when using PAE 255 */ 256 #if defined(__amd64) 257 use_vlp = (ttoproc(curthread)->p_model == DATAMODEL_ILP32); 258 #elif defined(__i386) 259 use_vlp = mmu.pae_hat; 260 #endif 261 if (use_vlp) { 262 hat->hat_flags = HAT_VLP; 263 bzero(hat->hat_vlp_ptes, VLP_SIZE); 264 } 265 266 /* 267 * Allocate the htable hash 268 */ 269 if ((hat->hat_flags & HAT_VLP)) { 270 hat->hat_num_hash = mmu.vlp_hash_cnt; 271 hat->hat_ht_hash = kmem_cache_alloc(vlp_hash_cache, KM_SLEEP); 272 } else { 273 hat->hat_num_hash = mmu.hash_cnt; 274 hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_SLEEP); 275 } 276 bzero(hat->hat_ht_hash, hat->hat_num_hash * sizeof (htable_t *)); 277 278 /* 279 * Initialize Kernel HAT entries at the top of the top level page 280 * table for the new hat. 281 * 282 * Note that we don't call htable_release() for the top level, that 283 * happens when the hat is destroyed in hat_free_end() 284 */ 285 hat->hat_htable = NULL; 286 hat->hat_ht_cached = NULL; 287 ht = htable_create(hat, (uintptr_t)0, TOP_LEVEL(hat), NULL); 288 289 if (!(hat->hat_flags & HAT_VLP)) 290 x86pte_copy(kas.a_hat->hat_htable, ht, khat_start, 291 khat_entries); 292 #if defined(__i386) 293 else if (khat_entries > 0) 294 bcopy(vlp_page + khat_start, hat->hat_vlp_ptes + khat_start, 295 khat_entries * sizeof (x86pte_t)); 296 #endif 297 hat->hat_htable = ht; 298 299 #if defined(__i386) 300 /* 301 * PAE32 HAT alignment is less restrictive than the others to keep 302 * the kernel from using too much VA. Because of this we may need 303 * one layer further down when kernelbase isn't 1Gig aligned. 304 * See hat_free_end() for the htable_release() that goes with this 305 * htable_create() 306 */ 307 if (khat_pae32_htable != NULL) { 308 ht = htable_create(hat, kernelbase, 309 khat_pae32_htable->ht_level, NULL); 310 x86pte_copy(khat_pae32_htable, ht, khat_pae32_start, 311 khat_pae32_entries); 312 ht->ht_valid_cnt = khat_pae32_entries; 313 } 314 #endif 315 316 /* 317 * Put it at the start of the global list of all hats (used by stealing) 318 * 319 * kas.a_hat is not in the list but is instead used to find the 320 * first and last items in the list. 321 * 322 * - kas.a_hat->hat_next points to the start of the user hats. 323 * The list ends where hat->hat_next == NULL 324 * 325 * - kas.a_hat->hat_prev points to the last of the user hats. 326 * The list begins where hat->hat_prev == NULL 327 */ 328 mutex_enter(&hat_list_lock); 329 hat->hat_prev = NULL; 330 hat->hat_next = kas.a_hat->hat_next; 331 if (hat->hat_next) 332 hat->hat_next->hat_prev = hat; 333 else 334 kas.a_hat->hat_prev = hat; 335 kas.a_hat->hat_next = hat; 336 mutex_exit(&hat_list_lock); 337 338 return (hat); 339 } 340 341 /* 342 * process has finished executing but as has not been cleaned up yet. 343 */ 344 /*ARGSUSED*/ 345 void 346 hat_free_start(hat_t *hat) 347 { 348 ASSERT(AS_WRITE_HELD(hat->hat_as, &hat->hat_as->a_lock)); 349 350 /* 351 * If the hat is currently a stealing victim, wait for the stealing 352 * to finish. Once we mark it as HAT_FREEING, htable_steal() 353 * won't look at its pagetables anymore. 354 */ 355 mutex_enter(&hat_list_lock); 356 while (hat->hat_flags & HAT_VICTIM) 357 cv_wait(&hat_list_cv, &hat_list_lock); 358 hat->hat_flags |= HAT_FREEING; 359 mutex_exit(&hat_list_lock); 360 } 361 362 /* 363 * An address space is being destroyed, so we destroy the associated hat. 364 */ 365 void 366 hat_free_end(hat_t *hat) 367 { 368 int i; 369 kmem_cache_t *cache; 370 371 #ifdef DEBUG 372 for (i = 0; i <= mmu.max_page_level; i++) 373 ASSERT(hat->hat_pages_mapped[i] == 0); 374 #endif 375 ASSERT(hat->hat_flags & HAT_FREEING); 376 377 /* 378 * must not be running on the given hat 379 */ 380 ASSERT(CPU->cpu_current_hat != hat); 381 382 /* 383 * Remove it from the list of HATs 384 */ 385 mutex_enter(&hat_list_lock); 386 if (hat->hat_prev) 387 hat->hat_prev->hat_next = hat->hat_next; 388 else 389 kas.a_hat->hat_next = hat->hat_next; 390 if (hat->hat_next) 391 hat->hat_next->hat_prev = hat->hat_prev; 392 else 393 kas.a_hat->hat_prev = hat->hat_prev; 394 mutex_exit(&hat_list_lock); 395 hat->hat_next = hat->hat_prev = NULL; 396 397 /* 398 * Make a pass through the htables freeing them all up. 399 */ 400 htable_purge_hat(hat); 401 402 /* 403 * Decide which kmem cache the hash table came from, then free it. 404 */ 405 if (hat->hat_flags & HAT_VLP) 406 cache = vlp_hash_cache; 407 else 408 cache = hat_hash_cache; 409 kmem_cache_free(cache, hat->hat_ht_hash); 410 hat->hat_ht_hash = NULL; 411 412 hat->hat_flags = 0; 413 kmem_cache_free(hat_cache, hat); 414 } 415 416 /* 417 * round kernelbase down to a supported value to use for _userlimit 418 * 419 * userlimit must be aligned down to an entry in the top level htable. 420 * The one exception is for 32 bit HAT's running PAE. 421 */ 422 uintptr_t 423 hat_kernelbase(uintptr_t va) 424 { 425 #if defined(__i386) 426 va &= LEVEL_MASK(1); 427 #endif 428 if (IN_VA_HOLE(va)) 429 panic("_userlimit %p will fall in VA hole\n", (void *)va); 430 return (va); 431 } 432 433 /* 434 * Initialize hat data structures based on processor MMU information. 435 */ 436 void 437 mmu_init(void) 438 { 439 uint_t max_htables; 440 uint_t pa_bits; 441 uint_t va_bits; 442 int i; 443 444 /* 445 * If CPU enabled the page table global bit, use it for the kernel 446 * This is bit 7 in CR4 (PGE - Page Global Enable). 447 */ 448 if ((x86_feature & X86_PGE) != 0 && (getcr4() & CR4_PGE) != 0) 449 mmu.pt_global = PT_GLOBAL; 450 451 /* 452 * Detect NX and PAE usage. 453 */ 454 mmu.pae_hat = kbm_pae_support; 455 if (kbm_nx_support) 456 mmu.pt_nx = PT_NX; 457 else 458 mmu.pt_nx = 0; 459 460 /* 461 * Intel CPUs allow speculative caching (in TLB-like h/w) of 462 * entries in upper page tables even though there may not be 463 * any valid entries in lower tables. This implies we have to 464 * re-INVLPG at every upper page table entry invalidation. 465 */ 466 if (cpuid_getvendor(CPU) == X86_VENDOR_Intel) 467 mmu.inval_nonleaf = 1; 468 else 469 mmu.inval_nonleaf = 0; 470 /* 471 * Use CPU info to set various MMU parameters 472 */ 473 cpuid_get_addrsize(CPU, &pa_bits, &va_bits); 474 475 if (va_bits < sizeof (void *) * NBBY) { 476 mmu.hole_start = (1ul << (va_bits - 1)); 477 mmu.hole_end = 0ul - mmu.hole_start - 1; 478 } else { 479 mmu.hole_end = 0; 480 mmu.hole_start = mmu.hole_end - 1; 481 } 482 #if defined(OPTERON_ERRATUM_121) 483 /* 484 * If erratum 121 has already been detected at this time, hole_start 485 * contains the value to be subtracted from mmu.hole_start. 486 */ 487 ASSERT(hole_start == 0 || opteron_erratum_121 != 0); 488 hole_start = mmu.hole_start - hole_start; 489 #else 490 hole_start = mmu.hole_start; 491 #endif 492 hole_end = mmu.hole_end; 493 494 mmu.highest_pfn = mmu_btop((1ull << pa_bits) - 1); 495 if (mmu.pae_hat == 0 && pa_bits > 32) 496 mmu.highest_pfn = PFN_4G - 1; 497 498 if (mmu.pae_hat) { 499 mmu.pte_size = 8; /* 8 byte PTEs */ 500 mmu.pte_size_shift = 3; 501 } else { 502 mmu.pte_size = 4; /* 4 byte PTEs */ 503 mmu.pte_size_shift = 2; 504 } 505 506 if (mmu.pae_hat && (x86_feature & X86_PAE) == 0) 507 panic("Processor does not support PAE"); 508 509 if ((x86_feature & X86_CX8) == 0) 510 panic("Processor does not support cmpxchg8b instruction"); 511 512 /* 513 * Initialize parameters based on the 64 or 32 bit kernels and 514 * for the 32 bit kernel decide if we should use PAE. 515 */ 516 if (kbm_largepage_support) 517 mmu.max_page_level = 1; 518 else 519 mmu.max_page_level = 0; 520 mmu_page_sizes = mmu.max_page_level + 1; 521 mmu_exported_page_sizes = mmu_page_sizes; 522 523 #if defined(__amd64) 524 525 mmu.num_level = 4; 526 mmu.max_level = 3; 527 mmu.ptes_per_table = 512; 528 mmu.top_level_count = 512; 529 530 mmu.level_shift[0] = 12; 531 mmu.level_shift[1] = 21; 532 mmu.level_shift[2] = 30; 533 mmu.level_shift[3] = 39; 534 535 #elif defined(__i386) 536 537 if (mmu.pae_hat) { 538 mmu.num_level = 3; 539 mmu.max_level = 2; 540 mmu.ptes_per_table = 512; 541 mmu.top_level_count = 4; 542 543 mmu.level_shift[0] = 12; 544 mmu.level_shift[1] = 21; 545 mmu.level_shift[2] = 30; 546 547 } else { 548 mmu.num_level = 2; 549 mmu.max_level = 1; 550 mmu.ptes_per_table = 1024; 551 mmu.top_level_count = 1024; 552 553 mmu.level_shift[0] = 12; 554 mmu.level_shift[1] = 22; 555 } 556 557 #endif /* __i386 */ 558 559 for (i = 0; i < mmu.num_level; ++i) { 560 mmu.level_size[i] = 1UL << mmu.level_shift[i]; 561 mmu.level_offset[i] = mmu.level_size[i] - 1; 562 mmu.level_mask[i] = ~mmu.level_offset[i]; 563 } 564 565 for (i = 0; i <= mmu.max_page_level; ++i) { 566 mmu.pte_bits[i] = PT_VALID; 567 if (i > 0) 568 mmu.pte_bits[i] |= PT_PAGESIZE; 569 } 570 571 /* 572 * NOTE Legacy 32 bit PAE mode only has the P_VALID bit at top level. 573 */ 574 for (i = 1; i < mmu.num_level; ++i) 575 mmu.ptp_bits[i] = PT_PTPBITS; 576 577 #if defined(__i386) 578 mmu.ptp_bits[2] = PT_VALID; 579 #endif 580 581 /* 582 * Compute how many hash table entries to have per process for htables. 583 * We start with 1 page's worth of entries. 584 * 585 * If physical memory is small, reduce the amount need to cover it. 586 */ 587 max_htables = physmax / mmu.ptes_per_table; 588 mmu.hash_cnt = MMU_PAGESIZE / sizeof (htable_t *); 589 while (mmu.hash_cnt > 16 && mmu.hash_cnt >= max_htables) 590 mmu.hash_cnt >>= 1; 591 mmu.vlp_hash_cnt = mmu.hash_cnt; 592 593 #if defined(__amd64) 594 /* 595 * If running in 64 bits and physical memory is large, 596 * increase the size of the cache to cover all of memory for 597 * a 64 bit process. 598 */ 599 #define HASH_MAX_LENGTH 4 600 while (mmu.hash_cnt * HASH_MAX_LENGTH < max_htables) 601 mmu.hash_cnt <<= 1; 602 #endif 603 } 604 605 606 /* 607 * initialize hat data structures 608 */ 609 void 610 hat_init() 611 { 612 #if defined(__i386) 613 /* 614 * _userlimit must be aligned correctly 615 */ 616 if ((_userlimit & LEVEL_MASK(1)) != _userlimit) { 617 prom_printf("hat_init(): _userlimit=%p, not aligned at %p\n", 618 (void *)_userlimit, (void *)LEVEL_SIZE(1)); 619 halt("hat_init(): Unable to continue"); 620 } 621 #endif 622 623 cv_init(&hat_list_cv, NULL, CV_DEFAULT, NULL); 624 625 /* 626 * initialize kmem caches 627 */ 628 htable_init(); 629 hment_init(); 630 631 hat_cache = kmem_cache_create("hat_t", 632 sizeof (hat_t), 0, hati_constructor, NULL, NULL, 633 NULL, 0, 0); 634 635 hat_hash_cache = kmem_cache_create("HatHash", 636 mmu.hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 637 NULL, 0, 0); 638 639 /* 640 * VLP hats can use a smaller hash table size on large memroy machines 641 */ 642 if (mmu.hash_cnt == mmu.vlp_hash_cnt) { 643 vlp_hash_cache = hat_hash_cache; 644 } else { 645 vlp_hash_cache = kmem_cache_create("HatVlpHash", 646 mmu.vlp_hash_cnt * sizeof (htable_t *), 0, NULL, NULL, NULL, 647 NULL, 0, 0); 648 } 649 650 /* 651 * Set up the kernel's hat 652 */ 653 AS_LOCK_ENTER(&kas, &kas.a_lock, RW_WRITER); 654 kas.a_hat = kmem_cache_alloc(hat_cache, KM_NOSLEEP); 655 mutex_init(&kas.a_hat->hat_mutex, NULL, MUTEX_DEFAULT, NULL); 656 kas.a_hat->hat_as = &kas; 657 kas.a_hat->hat_flags = 0; 658 AS_LOCK_EXIT(&kas, &kas.a_lock); 659 660 CPUSET_ZERO(khat_cpuset); 661 CPUSET_ADD(khat_cpuset, CPU->cpu_id); 662 663 /* 664 * The kernel hat's next pointer serves as the head of the hat list . 665 * The kernel hat's prev pointer tracks the last hat on the list for 666 * htable_steal() to use. 667 */ 668 kas.a_hat->hat_next = NULL; 669 kas.a_hat->hat_prev = NULL; 670 671 /* 672 * Allocate an htable hash bucket for the kernel 673 * XX64 - tune for 64 bit procs 674 */ 675 kas.a_hat->hat_num_hash = mmu.hash_cnt; 676 kas.a_hat->hat_ht_hash = kmem_cache_alloc(hat_hash_cache, KM_NOSLEEP); 677 bzero(kas.a_hat->hat_ht_hash, mmu.hash_cnt * sizeof (htable_t *)); 678 679 /* 680 * zero out the top level and cached htable pointers 681 */ 682 kas.a_hat->hat_ht_cached = NULL; 683 kas.a_hat->hat_htable = NULL; 684 685 /* 686 * Pre-allocate hrm_hashtab before enabling the collection of 687 * refmod statistics. Allocating on the fly would mean us 688 * running the risk of suffering recursive mutex enters or 689 * deadlocks. 690 */ 691 hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *), 692 KM_SLEEP); 693 } 694 695 /* 696 * Prepare CPU specific pagetables for VLP processes on 64 bit kernels. 697 * 698 * Each CPU has a set of 2 pagetables that are reused for any 32 bit 699 * process it runs. They are the top level pagetable, hci_vlp_l3ptes, and 700 * the next to top level table for the bottom 512 Gig, hci_vlp_l2ptes. 701 */ 702 /*ARGSUSED*/ 703 static void 704 hat_vlp_setup(struct cpu *cpu) 705 { 706 #if defined(__amd64) 707 struct hat_cpu_info *hci = cpu->cpu_hat_info; 708 pfn_t pfn; 709 710 /* 711 * allocate the level==2 page table for the bottom most 712 * 512Gig of address space (this is where 32 bit apps live) 713 */ 714 ASSERT(hci != NULL); 715 hci->hci_vlp_l2ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 716 717 /* 718 * Allocate a top level pagetable and copy the kernel's 719 * entries into it. Then link in hci_vlp_l2ptes in the 1st entry. 720 */ 721 hci->hci_vlp_l3ptes = kmem_zalloc(MMU_PAGESIZE, KM_SLEEP); 722 hci->hci_vlp_pfn = 723 hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l3ptes); 724 ASSERT(hci->hci_vlp_pfn != PFN_INVALID); 725 bcopy(vlp_page + khat_start, hci->hci_vlp_l3ptes + khat_start, 726 khat_entries * sizeof (x86pte_t)); 727 728 pfn = hat_getpfnum(kas.a_hat, (caddr_t)hci->hci_vlp_l2ptes); 729 ASSERT(pfn != PFN_INVALID); 730 hci->hci_vlp_l3ptes[0] = MAKEPTP(pfn, 2); 731 #endif /* __amd64 */ 732 } 733 734 /*ARGSUSED*/ 735 static void 736 hat_vlp_teardown(cpu_t *cpu) 737 { 738 #if defined(__amd64) 739 struct hat_cpu_info *hci; 740 741 if ((hci = cpu->cpu_hat_info) == NULL) 742 return; 743 if (hci->hci_vlp_l2ptes) 744 kmem_free(hci->hci_vlp_l2ptes, MMU_PAGESIZE); 745 if (hci->hci_vlp_l3ptes) 746 kmem_free(hci->hci_vlp_l3ptes, MMU_PAGESIZE); 747 #endif /* __amd64 */ 748 } 749 750 /* 751 * Finish filling in the kernel hat. 752 * Pre fill in all top level kernel page table entries for the kernel's 753 * part of the address range. From this point on we can't use any new 754 * kernel large pages if they need PTE's at max_level 755 * 756 * create the kmap mappings. 757 */ 758 void 759 hat_init_finish(void) 760 { 761 htable_t *top = kas.a_hat->hat_htable; 762 htable_t *ht; 763 uint_t e; 764 x86pte_t pte; 765 uintptr_t va = kernelbase; 766 size_t size; 767 768 769 #if defined(__i386) 770 ASSERT((va & LEVEL_MASK(1)) == va); 771 772 /* 773 * Deal with kernelbase not 1Gig aligned for 32 bit PAE hats. 774 */ 775 if (!mmu.pae_hat || (va & LEVEL_OFFSET(mmu.max_level)) == 0) { 776 khat_pae32_htable = NULL; 777 } else { 778 ASSERT(mmu.max_level == 2); 779 ASSERT((va & LEVEL_OFFSET(mmu.max_level - 1)) == 0); 780 khat_pae32_htable = 781 htable_create(kas.a_hat, va, mmu.max_level - 1, NULL); 782 khat_pae32_start = htable_va2entry(va, khat_pae32_htable); 783 khat_pae32_entries = mmu.ptes_per_table - khat_pae32_start; 784 for (e = khat_pae32_start; e < mmu.ptes_per_table; 785 ++e, va += LEVEL_SIZE(mmu.max_level - 1)) { 786 pte = x86pte_get(khat_pae32_htable, e); 787 if (PTE_ISVALID(pte)) 788 continue; 789 ht = htable_create(kas.a_hat, va, mmu.max_level - 2, 790 NULL); 791 ASSERT(ht != NULL); 792 } 793 } 794 #endif 795 796 /* 797 * The kernel hat will need fixed values in the highest level 798 * ptable for copying to all other hat's. This implies 799 * alignment restrictions on _userlimit. 800 * 801 * Note we don't htable_release() these htables. This keeps them 802 * from ever being stolen or free'd. 803 * 804 * top_level_count is used instead of ptes_per_table, since 805 * on 32-bit PAE we only have 4 usable entries at the top level ptable. 806 */ 807 if (va == 0) 808 khat_start = mmu.top_level_count; 809 else 810 khat_start = htable_va2entry(va, kas.a_hat->hat_htable); 811 khat_entries = mmu.top_level_count - khat_start; 812 for (e = khat_start; e < mmu.top_level_count; 813 ++e, va += LEVEL_SIZE(mmu.max_level)) { 814 if (IN_HYPERVISOR_VA(va)) 815 continue; 816 pte = x86pte_get(top, e); 817 if (PTE_ISVALID(pte)) 818 continue; 819 ht = htable_create(kas.a_hat, va, mmu.max_level - 1, NULL); 820 ASSERT(ht != NULL); 821 } 822 823 /* 824 * We are now effectively running on the kernel hat. 825 * Clearing use_boot_reserve shuts off using the pre-allocated boot 826 * reserve for all HAT allocations. From here on, the reserves are 827 * only used when mapping in memory for the hat's own allocations. 828 */ 829 use_boot_reserve = 0; 830 htable_adjust_reserve(); 831 832 /* 833 * 32 bit kernels use only 4 of the 512 entries in its top level 834 * pagetable. We'll use the remainder for the "per CPU" page tables 835 * for VLP processes. 836 * 837 * We also map the top level kernel pagetable into the kernel to make 838 * it easy to use bcopy to initialize new address spaces. 839 */ 840 if (mmu.pae_hat) { 841 vlp_page = vmem_alloc(heap_arena, MMU_PAGESIZE, VM_SLEEP); 842 hat_devload(kas.a_hat, (caddr_t)vlp_page, MMU_PAGESIZE, 843 kas.a_hat->hat_htable->ht_pfn, 844 PROT_WRITE | 845 PROT_READ | HAT_NOSYNC | HAT_UNORDERED_OK, 846 HAT_LOAD | HAT_LOAD_NOCONSIST); 847 } 848 hat_vlp_setup(CPU); 849 850 /* 851 * Create kmap (cached mappings of kernel PTEs) 852 * for 32 bit we map from segmap_start .. ekernelheap 853 * for 64 bit we map from segmap_start .. segmap_start + segmapsize; 854 */ 855 #if defined(__i386) 856 size = (uintptr_t)ekernelheap - segmap_start; 857 #elif defined(__amd64) 858 size = segmapsize; 859 #endif 860 hat_kmap_init((uintptr_t)segmap_start, size); 861 } 862 863 /* 864 * On 32 bit PAE mode, PTE's are 64 bits, but ordinary atomic memory references 865 * are 32 bit, so for safety we must use cas64() to install these. 866 */ 867 #ifdef __i386 868 static void 869 reload_pae32(hat_t *hat, cpu_t *cpu) 870 { 871 x86pte_t *src; 872 x86pte_t *dest; 873 x86pte_t pte; 874 int i; 875 876 /* 877 * Load the 4 entries of the level 2 page table into this 878 * cpu's range of the vlp_page and point cr3 at them. 879 */ 880 ASSERT(mmu.pae_hat); 881 src = hat->hat_vlp_ptes; 882 dest = vlp_page + (cpu->cpu_id + 1) * VLP_NUM_PTES; 883 for (i = 0; i < VLP_NUM_PTES; ++i) { 884 for (;;) { 885 pte = dest[i]; 886 if (pte == src[i]) 887 break; 888 if (cas64(dest + i, pte, src[i]) != src[i]) 889 break; 890 } 891 } 892 } 893 #endif 894 895 /* 896 * Switch to a new active hat, maintaining bit masks to track active CPUs. 897 */ 898 void 899 hat_switch(hat_t *hat) 900 { 901 uintptr_t newcr3; 902 cpu_t *cpu = CPU; 903 hat_t *old = cpu->cpu_current_hat; 904 905 /* 906 * set up this information first, so we don't miss any cross calls 907 */ 908 if (old != NULL) { 909 if (old == hat) 910 return; 911 if (old != kas.a_hat) 912 CPUSET_ATOMIC_DEL(old->hat_cpus, cpu->cpu_id); 913 } 914 915 /* 916 * Wait for any in flight pagetable invalidates on this hat to finish. 917 * This is a spin lock at DISP_LEVEL 918 */ 919 if (hat != kas.a_hat) { 920 mutex_enter(&hat->hat_switch_mutex); 921 CPUSET_ATOMIC_ADD(hat->hat_cpus, cpu->cpu_id); 922 mutex_exit(&hat->hat_switch_mutex); 923 } 924 cpu->cpu_current_hat = hat; 925 926 /* 927 * now go ahead and load cr3 928 */ 929 if (hat->hat_flags & HAT_VLP) { 930 #if defined(__amd64) 931 x86pte_t *vlpptep = cpu->cpu_hat_info->hci_vlp_l2ptes; 932 933 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 934 newcr3 = MAKECR3(cpu->cpu_hat_info->hci_vlp_pfn); 935 #elif defined(__i386) 936 reload_pae32(hat, cpu); 937 newcr3 = MAKECR3(kas.a_hat->hat_htable->ht_pfn) + 938 (cpu->cpu_id + 1) * VLP_SIZE; 939 #endif 940 } else { 941 newcr3 = MAKECR3(hat->hat_htable->ht_pfn); 942 } 943 setcr3(newcr3); 944 ASSERT(cpu == CPU); 945 } 946 947 /* 948 * Utility to return a valid x86pte_t from protections, pfn, and level number 949 */ 950 static x86pte_t 951 hati_mkpte(pfn_t pfn, uint_t attr, level_t level, uint_t flags) 952 { 953 x86pte_t pte; 954 uint_t cache_attr = attr & HAT_ORDER_MASK; 955 956 pte = MAKEPTE(pfn, level); 957 958 if (attr & PROT_WRITE) 959 PTE_SET(pte, PT_WRITABLE); 960 961 if (attr & PROT_USER) 962 PTE_SET(pte, PT_USER); 963 964 if (!(attr & PROT_EXEC)) 965 PTE_SET(pte, mmu.pt_nx); 966 967 /* 968 * Set the software bits used track ref/mod sync's and hments. 969 * If not using REF/MOD, set them to avoid h/w rewriting PTEs. 970 */ 971 if (flags & HAT_LOAD_NOCONSIST) 972 PTE_SET(pte, PT_NOCONSIST | PT_REF | PT_MOD); 973 else if (attr & HAT_NOSYNC) 974 PTE_SET(pte, PT_NOSYNC | PT_REF | PT_MOD); 975 976 /* 977 * Set the caching attributes in the PTE. The combination 978 * of attributes are poorly defined, so we pay attention 979 * to them in the given order. 980 * 981 * The test for HAT_STRICTORDER is different because it's defined 982 * as "0" - which was a stupid thing to do, but is too late to change! 983 */ 984 if (cache_attr == HAT_STRICTORDER) { 985 PTE_SET(pte, PT_NOCACHE); 986 /*LINTED [Lint hates empty ifs, but it's the obvious way to do this] */ 987 } else if (cache_attr & (HAT_UNORDERED_OK | HAT_STORECACHING_OK)) { 988 /* nothing to set */; 989 } else if (cache_attr & (HAT_MERGING_OK | HAT_LOADCACHING_OK)) { 990 PTE_SET(pte, PT_NOCACHE); 991 if (x86_feature & X86_PAT) 992 PTE_SET(pte, (level == 0) ? PT_PAT_4K : PT_PAT_LARGE); 993 else 994 PTE_SET(pte, PT_WRITETHRU); 995 } else { 996 panic("hati_mkpte(): bad caching attributes: %x\n", cache_attr); 997 } 998 999 return (pte); 1000 } 1001 1002 /* 1003 * Duplicate address translations of the parent to the child. 1004 * This function really isn't used anymore. 1005 */ 1006 /*ARGSUSED*/ 1007 int 1008 hat_dup(hat_t *old, hat_t *new, caddr_t addr, size_t len, uint_t flag) 1009 { 1010 ASSERT((uintptr_t)addr < kernelbase); 1011 ASSERT(new != kas.a_hat); 1012 ASSERT(old != kas.a_hat); 1013 return (0); 1014 } 1015 1016 /* 1017 * Allocate any hat resources required for a process being swapped in. 1018 */ 1019 /*ARGSUSED*/ 1020 void 1021 hat_swapin(hat_t *hat) 1022 { 1023 /* do nothing - we let everything fault back in */ 1024 } 1025 1026 /* 1027 * Unload all translations associated with an address space of a process 1028 * that is being swapped out. 1029 */ 1030 void 1031 hat_swapout(hat_t *hat) 1032 { 1033 uintptr_t vaddr = (uintptr_t)0; 1034 uintptr_t eaddr = _userlimit; 1035 htable_t *ht = NULL; 1036 level_t l; 1037 1038 /* 1039 * We can't just call hat_unload(hat, 0, _userlimit...) here, because 1040 * seg_spt and shared pagetables can't be swapped out. 1041 * Take a look at segspt_shmswapout() - it's a big no-op. 1042 * 1043 * Instead we'll walk through all the address space and unload 1044 * any mappings which we are sure are not shared, not locked. 1045 */ 1046 ASSERT(IS_PAGEALIGNED(vaddr)); 1047 ASSERT(IS_PAGEALIGNED(eaddr)); 1048 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1049 if ((uintptr_t)hat->hat_as->a_userlimit < eaddr) 1050 eaddr = (uintptr_t)hat->hat_as->a_userlimit; 1051 1052 while (vaddr < eaddr) { 1053 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1054 if (ht == NULL) 1055 break; 1056 1057 ASSERT(!IN_VA_HOLE(vaddr)); 1058 1059 /* 1060 * If the page table is shared skip its entire range. 1061 * This code knows that only level 0 page tables are shared 1062 */ 1063 l = ht->ht_level; 1064 if (ht->ht_flags & HTABLE_SHARED_PFN) { 1065 ASSERT(l == 0); 1066 vaddr = ht->ht_vaddr + LEVEL_SIZE(1); 1067 htable_release(ht); 1068 ht = NULL; 1069 continue; 1070 } 1071 1072 /* 1073 * If the page table has no locked entries, unload this one. 1074 */ 1075 if (ht->ht_lock_cnt == 0) 1076 hat_unload(hat, (caddr_t)vaddr, LEVEL_SIZE(l), 1077 HAT_UNLOAD_UNMAP); 1078 1079 /* 1080 * If we have a level 0 page table with locked entries, 1081 * skip the entire page table, otherwise skip just one entry. 1082 */ 1083 if (ht->ht_lock_cnt > 0 && l == 0) 1084 vaddr = ht->ht_vaddr + LEVEL_SIZE(1); 1085 else 1086 vaddr += LEVEL_SIZE(l); 1087 } 1088 if (ht) 1089 htable_release(ht); 1090 1091 /* 1092 * We're in swapout because the system is low on memory, so 1093 * go back and flush all the htables off the cached list. 1094 */ 1095 htable_purge_hat(hat); 1096 } 1097 1098 /* 1099 * returns number of bytes that have valid mappings in hat. 1100 */ 1101 size_t 1102 hat_get_mapped_size(hat_t *hat) 1103 { 1104 size_t total = 0; 1105 int l; 1106 1107 for (l = 0; l <= mmu.max_page_level; l++) 1108 total += (hat->hat_pages_mapped[l] << LEVEL_SHIFT(l)); 1109 1110 return (total); 1111 } 1112 1113 /* 1114 * enable/disable collection of stats for hat. 1115 */ 1116 int 1117 hat_stats_enable(hat_t *hat) 1118 { 1119 atomic_add_32(&hat->hat_stats, 1); 1120 return (1); 1121 } 1122 1123 void 1124 hat_stats_disable(hat_t *hat) 1125 { 1126 atomic_add_32(&hat->hat_stats, -1); 1127 } 1128 1129 /* 1130 * Utility to sync the ref/mod bits from a page table entry to the page_t 1131 * We must be holding the mapping list lock when this is called. 1132 */ 1133 static void 1134 hati_sync_pte_to_page(page_t *pp, x86pte_t pte, level_t level) 1135 { 1136 uint_t rm = 0; 1137 pgcnt_t pgcnt; 1138 1139 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 1140 return; 1141 1142 if (PTE_GET(pte, PT_REF)) 1143 rm |= P_REF; 1144 1145 if (PTE_GET(pte, PT_MOD)) 1146 rm |= P_MOD; 1147 1148 if (rm == 0) 1149 return; 1150 1151 /* 1152 * sync to all constituent pages of a large page 1153 */ 1154 ASSERT(x86_hm_held(pp)); 1155 pgcnt = page_get_pagecnt(level); 1156 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 1157 for (; pgcnt > 0; --pgcnt) { 1158 /* 1159 * hat_page_demote() can't decrease 1160 * pszc below this mapping size 1161 * since this large mapping existed after we 1162 * took mlist lock. 1163 */ 1164 ASSERT(pp->p_szc >= level); 1165 hat_page_setattr(pp, rm); 1166 ++pp; 1167 } 1168 } 1169 1170 /* 1171 * This the set of PTE bits for PFN, permissions and caching 1172 * that require a TLB flush (hat_tlb_inval) if changed on a HAT_LOAD_REMAP 1173 */ 1174 #define PT_REMAP_BITS \ 1175 (PT_PADDR | PT_NX | PT_WRITABLE | PT_WRITETHRU | \ 1176 PT_NOCACHE | PT_PAT_4K | PT_PAT_LARGE) 1177 1178 #define REMAPASSERT(EX) if (!(EX)) panic("hati_pte_map: " #EX) 1179 /* 1180 * Do the low-level work to get a mapping entered into a HAT's pagetables 1181 * and in the mapping list of the associated page_t. 1182 */ 1183 static int 1184 hati_pte_map( 1185 htable_t *ht, 1186 uint_t entry, 1187 page_t *pp, 1188 x86pte_t pte, 1189 int flags, 1190 void *pte_ptr) 1191 { 1192 hat_t *hat = ht->ht_hat; 1193 x86pte_t old_pte; 1194 level_t l = ht->ht_level; 1195 hment_t *hm; 1196 uint_t is_consist; 1197 int rv = 0; 1198 1199 /* 1200 * Is this a consistant (ie. need mapping list lock) mapping? 1201 */ 1202 is_consist = (pp != NULL && (flags & HAT_LOAD_NOCONSIST) == 0); 1203 1204 /* 1205 * Track locked mapping count in the htable. Do this first, 1206 * as we track locking even if there already is a mapping present. 1207 */ 1208 if ((flags & HAT_LOAD_LOCK) != 0 && hat != kas.a_hat) 1209 HTABLE_LOCK_INC(ht); 1210 1211 /* 1212 * Acquire the page's mapping list lock and get an hment to use. 1213 * Note that hment_prepare() might return NULL. 1214 */ 1215 if (is_consist) { 1216 x86_hm_enter(pp); 1217 hm = hment_prepare(ht, entry, pp); 1218 } 1219 1220 /* 1221 * Set the new pte, retrieving the old one at the same time. 1222 */ 1223 old_pte = x86pte_set(ht, entry, pte, pte_ptr); 1224 1225 /* 1226 * did we get a large page / page table collision? 1227 */ 1228 if (old_pte == LPAGE_ERROR) { 1229 rv = -1; 1230 goto done; 1231 } 1232 1233 /* 1234 * If the mapping didn't change there is nothing more to do. 1235 */ 1236 if (PTE_EQUIV(pte, old_pte)) 1237 goto done; 1238 1239 /* 1240 * Install a new mapping in the page's mapping list 1241 */ 1242 if (!PTE_ISVALID(old_pte)) { 1243 if (is_consist) { 1244 hment_assign(ht, entry, pp, hm); 1245 x86_hm_exit(pp); 1246 } else { 1247 ASSERT(flags & HAT_LOAD_NOCONSIST); 1248 } 1249 HTABLE_INC(ht->ht_valid_cnt); 1250 PGCNT_INC(hat, l); 1251 return (rv); 1252 } 1253 1254 /* 1255 * Remap's are more complicated: 1256 * - HAT_LOAD_REMAP must be specified if changing the pfn. 1257 * We also require that NOCONSIST be specified. 1258 * - Otherwise only permission or caching bits may change. 1259 */ 1260 if (!PTE_ISPAGE(old_pte, l)) 1261 panic("non-null/page mapping pte=" FMT_PTE, old_pte); 1262 1263 if (PTE2PFN(old_pte, l) != PTE2PFN(pte, l)) { 1264 REMAPASSERT(flags & HAT_LOAD_REMAP); 1265 REMAPASSERT(flags & HAT_LOAD_NOCONSIST); 1266 REMAPASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 1267 REMAPASSERT(pf_is_memory(PTE2PFN(old_pte, l)) == 1268 pf_is_memory(PTE2PFN(pte, l))); 1269 REMAPASSERT(!is_consist); 1270 } 1271 1272 /* 1273 * We only let remaps change the bits for PFNs, permissions 1274 * or caching type. 1275 */ 1276 ASSERT(PTE_GET(old_pte, ~(PT_REMAP_BITS | PT_REF | PT_MOD)) == 1277 PTE_GET(pte, ~PT_REMAP_BITS)); 1278 1279 /* 1280 * We don't create any mapping list entries on a remap, so release 1281 * any allocated hment after we drop the mapping list lock. 1282 */ 1283 done: 1284 if (is_consist) { 1285 x86_hm_exit(pp); 1286 if (hm != NULL) 1287 hment_free(hm); 1288 } 1289 return (rv); 1290 } 1291 1292 /* 1293 * Internal routine to load a single page table entry. This only fails if 1294 * we attempt to overwrite a page table link with a large page. 1295 */ 1296 static int 1297 hati_load_common( 1298 hat_t *hat, 1299 uintptr_t va, 1300 page_t *pp, 1301 uint_t attr, 1302 uint_t flags, 1303 level_t level, 1304 pfn_t pfn) 1305 { 1306 htable_t *ht; 1307 uint_t entry; 1308 x86pte_t pte; 1309 int rv = 0; 1310 1311 /* 1312 * The number 16 is arbitrary and here to catch a recursion problem 1313 * early before we blow out the kernel stack. 1314 */ 1315 ++curthread->t_hatdepth; 1316 ASSERT(curthread->t_hatdepth < 16); 1317 1318 ASSERT(hat == kas.a_hat || 1319 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1320 1321 if (flags & HAT_LOAD_SHARE) 1322 hat->hat_flags |= HAT_SHARED; 1323 1324 /* 1325 * Find the page table that maps this page if it already exists. 1326 */ 1327 ht = htable_lookup(hat, va, level); 1328 1329 /* 1330 * We must have HAT_LOAD_NOCONSIST if page_t is NULL. 1331 */ 1332 if (pp == NULL) 1333 flags |= HAT_LOAD_NOCONSIST; 1334 1335 if (ht == NULL) { 1336 ht = htable_create(hat, va, level, NULL); 1337 ASSERT(ht != NULL); 1338 } 1339 entry = htable_va2entry(va, ht); 1340 1341 /* 1342 * a bunch of paranoid error checking 1343 */ 1344 ASSERT(ht->ht_busy > 0); 1345 if (ht->ht_vaddr > va || va > HTABLE_LAST_PAGE(ht)) 1346 panic("hati_load_common: bad htable %p, va %p", ht, (void *)va); 1347 ASSERT(ht->ht_level == level); 1348 1349 /* 1350 * construct the new PTE 1351 */ 1352 if (hat == kas.a_hat) 1353 attr &= ~PROT_USER; 1354 pte = hati_mkpte(pfn, attr, level, flags); 1355 if (hat == kas.a_hat && va >= kernelbase) 1356 PTE_SET(pte, mmu.pt_global); 1357 1358 /* 1359 * establish the mapping 1360 */ 1361 rv = hati_pte_map(ht, entry, pp, pte, flags, NULL); 1362 1363 /* 1364 * release the htable and any reserves 1365 */ 1366 htable_release(ht); 1367 --curthread->t_hatdepth; 1368 return (rv); 1369 } 1370 1371 /* 1372 * special case of hat_memload to deal with some kernel addrs for performance 1373 */ 1374 static void 1375 hat_kmap_load( 1376 caddr_t addr, 1377 page_t *pp, 1378 uint_t attr, 1379 uint_t flags) 1380 { 1381 uintptr_t va = (uintptr_t)addr; 1382 x86pte_t pte; 1383 pfn_t pfn = page_pptonum(pp); 1384 pgcnt_t pg_off = mmu_btop(va - mmu.kmap_addr); 1385 htable_t *ht; 1386 uint_t entry; 1387 void *pte_ptr; 1388 1389 /* 1390 * construct the requested PTE 1391 */ 1392 attr &= ~PROT_USER; 1393 attr |= HAT_STORECACHING_OK; 1394 pte = hati_mkpte(pfn, attr, 0, flags); 1395 PTE_SET(pte, mmu.pt_global); 1396 1397 /* 1398 * Figure out the pte_ptr and htable and use common code to finish up 1399 */ 1400 if (mmu.pae_hat) 1401 pte_ptr = mmu.kmap_ptes + pg_off; 1402 else 1403 pte_ptr = (x86pte32_t *)mmu.kmap_ptes + pg_off; 1404 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) >> 1405 LEVEL_SHIFT(1)]; 1406 entry = htable_va2entry(va, ht); 1407 ++curthread->t_hatdepth; 1408 ASSERT(curthread->t_hatdepth < 16); 1409 (void) hati_pte_map(ht, entry, pp, pte, flags, pte_ptr); 1410 --curthread->t_hatdepth; 1411 } 1412 1413 /* 1414 * hat_memload() - load a translation to the given page struct 1415 * 1416 * Flags for hat_memload/hat_devload/hat_*attr. 1417 * 1418 * HAT_LOAD Default flags to load a translation to the page. 1419 * 1420 * HAT_LOAD_LOCK Lock down mapping resources; hat_map(), hat_memload(), 1421 * and hat_devload(). 1422 * 1423 * HAT_LOAD_NOCONSIST Do not add mapping to page_t mapping list. 1424 * sets PT_NOCONSIST 1425 * 1426 * HAT_LOAD_SHARE A flag to hat_memload() to indicate h/w page tables 1427 * that map some user pages (not kas) is shared by more 1428 * than one process (eg. ISM). 1429 * 1430 * HAT_LOAD_REMAP Reload a valid pte with a different page frame. 1431 * 1432 * HAT_NO_KALLOC Do not kmem_alloc while creating the mapping; at this 1433 * point, it's setting up mapping to allocate internal 1434 * hat layer data structures. This flag forces hat layer 1435 * to tap its reserves in order to prevent infinite 1436 * recursion. 1437 * 1438 * The following is a protection attribute (like PROT_READ, etc.) 1439 * 1440 * HAT_NOSYNC set PT_NOSYNC - this mapping's ref/mod bits 1441 * are never cleared. 1442 * 1443 * Installing new valid PTE's and creation of the mapping list 1444 * entry are controlled under the same lock. It's derived from the 1445 * page_t being mapped. 1446 */ 1447 static uint_t supported_memload_flags = 1448 HAT_LOAD | HAT_LOAD_LOCK | HAT_LOAD_ADV | HAT_LOAD_NOCONSIST | 1449 HAT_LOAD_SHARE | HAT_NO_KALLOC | HAT_LOAD_REMAP | HAT_LOAD_TEXT; 1450 1451 void 1452 hat_memload( 1453 hat_t *hat, 1454 caddr_t addr, 1455 page_t *pp, 1456 uint_t attr, 1457 uint_t flags) 1458 { 1459 uintptr_t va = (uintptr_t)addr; 1460 level_t level = 0; 1461 pfn_t pfn = page_pptonum(pp); 1462 1463 HATIN(hat_memload, hat, addr, (size_t)MMU_PAGESIZE); 1464 ASSERT(IS_PAGEALIGNED(va)); 1465 ASSERT(hat == kas.a_hat || va < _userlimit); 1466 ASSERT(hat == kas.a_hat || 1467 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1468 ASSERT((flags & supported_memload_flags) == flags); 1469 1470 ASSERT(!IN_VA_HOLE(va)); 1471 ASSERT(!PP_ISFREE(pp)); 1472 1473 /* 1474 * kernel address special case for performance. 1475 */ 1476 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 1477 ASSERT(hat == kas.a_hat); 1478 hat_kmap_load(addr, pp, attr, flags); 1479 return; 1480 } 1481 1482 /* 1483 * This is used for memory with normal caching enabled, so 1484 * always set HAT_STORECACHING_OK. 1485 */ 1486 attr |= HAT_STORECACHING_OK; 1487 if (hati_load_common(hat, va, pp, attr, flags, level, pfn) != 0) 1488 panic("unexpected hati_load_common() failure"); 1489 HATOUT(hat_memload, hat, addr); 1490 } 1491 1492 /* 1493 * Load the given array of page structs using large pages when possible 1494 */ 1495 void 1496 hat_memload_array( 1497 hat_t *hat, 1498 caddr_t addr, 1499 size_t len, 1500 page_t **pages, 1501 uint_t attr, 1502 uint_t flags) 1503 { 1504 uintptr_t va = (uintptr_t)addr; 1505 uintptr_t eaddr = va + len; 1506 level_t level; 1507 size_t pgsize; 1508 pgcnt_t pgindx = 0; 1509 pfn_t pfn; 1510 pgcnt_t i; 1511 1512 HATIN(hat_memload_array, hat, addr, len); 1513 ASSERT(IS_PAGEALIGNED(va)); 1514 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 1515 ASSERT(hat == kas.a_hat || 1516 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1517 ASSERT((flags & supported_memload_flags) == flags); 1518 1519 /* 1520 * memload is used for memory with full caching enabled, so 1521 * set HAT_STORECACHING_OK. 1522 */ 1523 attr |= HAT_STORECACHING_OK; 1524 1525 /* 1526 * handle all pages using largest possible pagesize 1527 */ 1528 while (va < eaddr) { 1529 /* 1530 * decide what level mapping to use (ie. pagesize) 1531 */ 1532 pfn = page_pptonum(pages[pgindx]); 1533 for (level = mmu.max_page_level; ; --level) { 1534 pgsize = LEVEL_SIZE(level); 1535 if (level == 0) 1536 break; 1537 1538 if (!IS_P2ALIGNED(va, pgsize) || 1539 (eaddr - va) < pgsize || 1540 !IS_P2ALIGNED(pfn_to_pa(pfn), pgsize)) 1541 continue; 1542 1543 /* 1544 * To use a large mapping of this size, all the 1545 * pages we are passed must be sequential subpages 1546 * of the large page. 1547 * hat_page_demote() can't change p_szc because 1548 * all pages are locked. 1549 */ 1550 if (pages[pgindx]->p_szc >= level) { 1551 for (i = 0; i < mmu_btop(pgsize); ++i) { 1552 if (pfn + i != 1553 page_pptonum(pages[pgindx + i])) 1554 break; 1555 ASSERT(pages[pgindx + i]->p_szc >= 1556 level); 1557 ASSERT(pages[pgindx] + i == 1558 pages[pgindx + i]); 1559 } 1560 if (i == mmu_btop(pgsize)) 1561 break; 1562 } 1563 } 1564 1565 /* 1566 * Load this page mapping. If the load fails, try a smaller 1567 * pagesize. 1568 */ 1569 ASSERT(!IN_VA_HOLE(va)); 1570 while (hati_load_common(hat, va, pages[pgindx], attr, 1571 flags, level, pfn) != 0) { 1572 if (level == 0) 1573 panic("unexpected hati_load_common() failure"); 1574 --level; 1575 pgsize = LEVEL_SIZE(level); 1576 } 1577 1578 /* 1579 * move to next page 1580 */ 1581 va += pgsize; 1582 pgindx += mmu_btop(pgsize); 1583 } 1584 HATOUT(hat_memload_array, hat, addr); 1585 } 1586 1587 /* 1588 * void hat_devload(hat, addr, len, pf, attr, flags) 1589 * load/lock the given page frame number 1590 * 1591 * Advisory ordering attributes. Apply only to device mappings. 1592 * 1593 * HAT_STRICTORDER: the CPU must issue the references in order, as the 1594 * programmer specified. This is the default. 1595 * HAT_UNORDERED_OK: the CPU may reorder the references (this is all kinds 1596 * of reordering; store or load with store or load). 1597 * HAT_MERGING_OK: merging and batching: the CPU may merge individual stores 1598 * to consecutive locations (for example, turn two consecutive byte 1599 * stores into one halfword store), and it may batch individual loads 1600 * (for example, turn two consecutive byte loads into one halfword load). 1601 * This also implies re-ordering. 1602 * HAT_LOADCACHING_OK: the CPU may cache the data it fetches and reuse it 1603 * until another store occurs. The default is to fetch new data 1604 * on every load. This also implies merging. 1605 * HAT_STORECACHING_OK: the CPU may keep the data in the cache and push it to 1606 * the device (perhaps with other data) at a later time. The default is 1607 * to push the data right away. This also implies load caching. 1608 * 1609 * Equivalent of hat_memload(), but can be used for device memory where 1610 * there are no page_t's and we support additional flags (write merging, etc). 1611 * Note that we can have large page mappings with this interface. 1612 */ 1613 int supported_devload_flags = HAT_LOAD | HAT_LOAD_LOCK | 1614 HAT_LOAD_NOCONSIST | HAT_STRICTORDER | HAT_UNORDERED_OK | 1615 HAT_MERGING_OK | HAT_LOADCACHING_OK | HAT_STORECACHING_OK; 1616 1617 void 1618 hat_devload( 1619 hat_t *hat, 1620 caddr_t addr, 1621 size_t len, 1622 pfn_t pfn, 1623 uint_t attr, 1624 int flags) 1625 { 1626 uintptr_t va = ALIGN2PAGE(addr); 1627 uintptr_t eva = va + len; 1628 level_t level; 1629 size_t pgsize; 1630 page_t *pp; 1631 int f; /* per PTE copy of flags - maybe modified */ 1632 uint_t a; /* per PTE copy of attr */ 1633 1634 HATIN(hat_devload, hat, addr, len); 1635 ASSERT(IS_PAGEALIGNED(va)); 1636 ASSERT(hat == kas.a_hat || eva <= _userlimit); 1637 ASSERT(hat == kas.a_hat || 1638 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1639 ASSERT((flags & supported_devload_flags) == flags); 1640 1641 /* 1642 * handle all pages 1643 */ 1644 while (va < eva) { 1645 1646 /* 1647 * decide what level mapping to use (ie. pagesize) 1648 */ 1649 for (level = mmu.max_page_level; ; --level) { 1650 pgsize = LEVEL_SIZE(level); 1651 if (level == 0) 1652 break; 1653 if (IS_P2ALIGNED(va, pgsize) && 1654 (eva - va) >= pgsize && 1655 IS_P2ALIGNED(pfn, mmu_btop(pgsize))) 1656 break; 1657 } 1658 1659 /* 1660 * If this is just memory then allow caching (this happens 1661 * for the nucleus pages) - though HAT_PLAT_NOCACHE can be used 1662 * to override that. If we don't have a page_t then make sure 1663 * NOCONSIST is set. 1664 */ 1665 a = attr; 1666 f = flags; 1667 if (pf_is_memory(pfn)) { 1668 if (!(a & HAT_PLAT_NOCACHE)) 1669 a |= HAT_STORECACHING_OK; 1670 1671 if (f & HAT_LOAD_NOCONSIST) 1672 pp = NULL; 1673 else 1674 pp = page_numtopp_nolock(pfn); 1675 } else { 1676 pp = NULL; 1677 f |= HAT_LOAD_NOCONSIST; 1678 } 1679 1680 /* 1681 * load this page mapping 1682 */ 1683 ASSERT(!IN_VA_HOLE(va)); 1684 while (hati_load_common(hat, va, pp, a, f, level, pfn) != 0) { 1685 if (level == 0) 1686 panic("unexpected hati_load_common() failure"); 1687 --level; 1688 pgsize = LEVEL_SIZE(level); 1689 } 1690 1691 /* 1692 * move to next page 1693 */ 1694 va += pgsize; 1695 pfn += mmu_btop(pgsize); 1696 } 1697 HATOUT(hat_devload, hat, addr); 1698 } 1699 1700 /* 1701 * void hat_unlock(hat, addr, len) 1702 * unlock the mappings to a given range of addresses 1703 * 1704 * Locks are tracked by ht_lock_cnt in the htable. 1705 */ 1706 void 1707 hat_unlock(hat_t *hat, caddr_t addr, size_t len) 1708 { 1709 uintptr_t vaddr = (uintptr_t)addr; 1710 uintptr_t eaddr = vaddr + len; 1711 htable_t *ht = NULL; 1712 1713 /* 1714 * kernel entries are always locked, we don't track lock counts 1715 */ 1716 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 1717 ASSERT(IS_PAGEALIGNED(vaddr)); 1718 ASSERT(IS_PAGEALIGNED(eaddr)); 1719 if (hat == kas.a_hat) 1720 return; 1721 if (eaddr > _userlimit) 1722 panic("hat_unlock() address out of range - above _userlimit"); 1723 1724 ASSERT(AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 1725 while (vaddr < eaddr) { 1726 (void) htable_walk(hat, &ht, &vaddr, eaddr); 1727 if (ht == NULL) 1728 break; 1729 1730 ASSERT(!IN_VA_HOLE(vaddr)); 1731 1732 if (ht->ht_lock_cnt < 1) 1733 panic("hat_unlock(): lock_cnt < 1, " 1734 "htable=%p, vaddr=%p\n", ht, (caddr_t)vaddr); 1735 HTABLE_LOCK_DEC(ht); 1736 1737 vaddr += LEVEL_SIZE(ht->ht_level); 1738 } 1739 if (ht) 1740 htable_release(ht); 1741 } 1742 1743 /* 1744 * Cross call service routine to demap a virtual page on 1745 * the current CPU or flush all mappings in TLB. 1746 */ 1747 /*ARGSUSED*/ 1748 static int 1749 hati_demap_func(xc_arg_t a1, xc_arg_t a2, xc_arg_t a3) 1750 { 1751 hat_t *hat = (hat_t *)a1; 1752 caddr_t addr = (caddr_t)a2; 1753 1754 /* 1755 * If the target hat isn't the kernel and this CPU isn't operating 1756 * in the target hat, we can ignore the cross call. 1757 */ 1758 if (hat != kas.a_hat && hat != CPU->cpu_current_hat) 1759 return (0); 1760 1761 /* 1762 * For a normal address, we just flush one page mapping 1763 */ 1764 if ((uintptr_t)addr != DEMAP_ALL_ADDR) { 1765 mmu_tlbflush_entry(addr); 1766 return (0); 1767 } 1768 1769 /* 1770 * Otherwise we reload cr3 to effect a complete TLB flush. 1771 * 1772 * A reload of cr3 on a VLP process also means we must also recopy in 1773 * the pte values from the struct hat 1774 */ 1775 if (hat->hat_flags & HAT_VLP) { 1776 #if defined(__amd64) 1777 x86pte_t *vlpptep = CPU->cpu_hat_info->hci_vlp_l2ptes; 1778 1779 VLP_COPY(hat->hat_vlp_ptes, vlpptep); 1780 #elif defined(__i386) 1781 reload_pae32(hat, CPU); 1782 #endif 1783 } 1784 reload_cr3(); 1785 return (0); 1786 } 1787 1788 /* 1789 * Internal routine to do cross calls to invalidate a range of pages on 1790 * all CPUs using a given hat. 1791 */ 1792 void 1793 hat_tlb_inval(hat_t *hat, uintptr_t va) 1794 { 1795 extern int flushes_require_xcalls; /* from mp_startup.c */ 1796 cpuset_t justme; 1797 cpuset_t cpus_to_shootdown; 1798 1799 /* 1800 * If the hat is being destroyed, there are no more users, so 1801 * demap need not do anything. 1802 */ 1803 if (hat->hat_flags & HAT_FREEING) 1804 return; 1805 1806 /* 1807 * If demapping from a shared pagetable, we best demap the 1808 * entire set of user TLBs, since we don't know what addresses 1809 * these were shared at. 1810 */ 1811 if (hat->hat_flags & HAT_SHARED) { 1812 hat = kas.a_hat; 1813 va = DEMAP_ALL_ADDR; 1814 } 1815 1816 /* 1817 * if not running with multiple CPUs, don't use cross calls 1818 */ 1819 if (panicstr || !flushes_require_xcalls) { 1820 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 1821 return; 1822 } 1823 1824 1825 /* 1826 * Determine CPUs to shootdown. Kernel changes always do all CPUs. 1827 * Otherwise it's just CPUs currently executing in this hat. 1828 */ 1829 kpreempt_disable(); 1830 CPUSET_ONLY(justme, CPU->cpu_id); 1831 if (hat == kas.a_hat) 1832 cpus_to_shootdown = khat_cpuset; 1833 else 1834 cpus_to_shootdown = hat->hat_cpus; 1835 1836 if (CPUSET_ISNULL(cpus_to_shootdown) || 1837 CPUSET_ISEQUAL(cpus_to_shootdown, justme)) { 1838 1839 (void) hati_demap_func((xc_arg_t)hat, (xc_arg_t)va, NULL); 1840 1841 } else { 1842 1843 CPUSET_ADD(cpus_to_shootdown, CPU->cpu_id); 1844 xc_call((xc_arg_t)hat, (xc_arg_t)va, NULL, X_CALL_HIPRI, 1845 cpus_to_shootdown, hati_demap_func); 1846 1847 } 1848 kpreempt_enable(); 1849 } 1850 1851 /* 1852 * Interior routine for HAT_UNLOADs from hat_unload_callback(), 1853 * hat_kmap_unload() OR from hat_steal() code. This routine doesn't 1854 * handle releasing of the htables. 1855 */ 1856 void 1857 hat_pte_unmap( 1858 htable_t *ht, 1859 uint_t entry, 1860 uint_t flags, 1861 x86pte_t old_pte, 1862 void *pte_ptr) 1863 { 1864 hat_t *hat = ht->ht_hat; 1865 hment_t *hm = NULL; 1866 page_t *pp = NULL; 1867 level_t l = ht->ht_level; 1868 pfn_t pfn; 1869 1870 /* 1871 * We always track the locking counts, even if nothing is unmapped 1872 */ 1873 if ((flags & HAT_UNLOAD_UNLOCK) != 0 && hat != kas.a_hat) { 1874 ASSERT(ht->ht_lock_cnt > 0); 1875 HTABLE_LOCK_DEC(ht); 1876 } 1877 1878 /* 1879 * Figure out which page's mapping list lock to acquire using the PFN 1880 * passed in "old" PTE. We then attempt to invalidate the PTE. 1881 * If another thread, probably a hat_pageunload, has asynchronously 1882 * unmapped/remapped this address we'll loop here. 1883 */ 1884 ASSERT(ht->ht_busy > 0); 1885 while (PTE_ISVALID(old_pte)) { 1886 pfn = PTE2PFN(old_pte, l); 1887 if (PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST) { 1888 pp = NULL; 1889 } else { 1890 pp = page_numtopp_nolock(pfn); 1891 if (pp == NULL) { 1892 panic("no page_t, not NOCONSIST: old_pte=" 1893 FMT_PTE " ht=%lx entry=0x%x pte_ptr=%lx", 1894 old_pte, (uintptr_t)ht, entry, 1895 (uintptr_t)pte_ptr); 1896 } 1897 x86_hm_enter(pp); 1898 } 1899 1900 /* 1901 * If freeing the address space, check that the PTE 1902 * hasn't changed, as the mappings are no longer in use by 1903 * any thread, invalidation is unnecessary. 1904 * If not freeing, do a full invalidate. 1905 */ 1906 if (hat->hat_flags & HAT_FREEING) 1907 old_pte = x86pte_get(ht, entry); 1908 else 1909 old_pte = x86pte_inval(ht, entry, old_pte, pte_ptr); 1910 1911 /* 1912 * If the page hadn't changed we've unmapped it and can proceed 1913 */ 1914 if (PTE_ISVALID(old_pte) && PTE2PFN(old_pte, l) == pfn) 1915 break; 1916 1917 /* 1918 * Otherwise, we'll have to retry with the current old_pte. 1919 * Drop the hment lock, since the pfn may have changed. 1920 */ 1921 if (pp != NULL) { 1922 x86_hm_exit(pp); 1923 pp = NULL; 1924 } else { 1925 ASSERT(PTE_GET(old_pte, PT_SOFTWARE) >= PT_NOCONSIST); 1926 } 1927 } 1928 1929 /* 1930 * If the old mapping wasn't valid, there's nothing more to do 1931 */ 1932 if (!PTE_ISVALID(old_pte)) { 1933 if (pp != NULL) 1934 x86_hm_exit(pp); 1935 return; 1936 } 1937 1938 /* 1939 * Take care of syncing any MOD/REF bits and removing the hment. 1940 */ 1941 if (pp != NULL) { 1942 if (!(flags & HAT_UNLOAD_NOSYNC)) 1943 hati_sync_pte_to_page(pp, old_pte, l); 1944 hm = hment_remove(pp, ht, entry); 1945 x86_hm_exit(pp); 1946 if (hm != NULL) 1947 hment_free(hm); 1948 } 1949 1950 /* 1951 * Handle book keeping in the htable and hat 1952 */ 1953 ASSERT(ht->ht_valid_cnt > 0); 1954 HTABLE_DEC(ht->ht_valid_cnt); 1955 PGCNT_DEC(hat, l); 1956 } 1957 1958 /* 1959 * very cheap unload implementation to special case some kernel addresses 1960 */ 1961 static void 1962 hat_kmap_unload(caddr_t addr, size_t len, uint_t flags) 1963 { 1964 uintptr_t va = (uintptr_t)addr; 1965 uintptr_t eva = va + len; 1966 pgcnt_t pg_index; 1967 htable_t *ht; 1968 uint_t entry; 1969 x86pte_t *pte_ptr; 1970 x86pte_t old_pte; 1971 1972 for (; va < eva; va += MMU_PAGESIZE) { 1973 /* 1974 * Get the PTE 1975 */ 1976 pg_index = mmu_btop(va - mmu.kmap_addr); 1977 pte_ptr = PT_INDEX_PTR(mmu.kmap_ptes, pg_index); 1978 old_pte = GET_PTE(pte_ptr); 1979 1980 /* 1981 * get the htable / entry 1982 */ 1983 ht = mmu.kmap_htables[(va - mmu.kmap_htables[0]->ht_vaddr) 1984 >> LEVEL_SHIFT(1)]; 1985 entry = htable_va2entry(va, ht); 1986 1987 /* 1988 * use mostly common code to unmap it. 1989 */ 1990 hat_pte_unmap(ht, entry, flags, old_pte, pte_ptr); 1991 } 1992 } 1993 1994 1995 /* 1996 * unload a range of virtual address space (no callback) 1997 */ 1998 void 1999 hat_unload(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2000 { 2001 uintptr_t va = (uintptr_t)addr; 2002 2003 ASSERT(hat == kas.a_hat || va + len <= _userlimit); 2004 2005 /* 2006 * special case for performance. 2007 */ 2008 if (mmu.kmap_addr <= va && va < mmu.kmap_eaddr) { 2009 ASSERT(hat == kas.a_hat); 2010 hat_kmap_unload(addr, len, flags); 2011 } else { 2012 hat_unload_callback(hat, addr, len, flags, NULL); 2013 } 2014 } 2015 2016 /* 2017 * Do the callbacks for ranges being unloaded. 2018 */ 2019 typedef struct range_info { 2020 uintptr_t rng_va; 2021 ulong_t rng_cnt; 2022 level_t rng_level; 2023 } range_info_t; 2024 2025 static void 2026 handle_ranges(hat_callback_t *cb, uint_t cnt, range_info_t *range) 2027 { 2028 /* 2029 * do callbacks to upper level VM system 2030 */ 2031 while (cb != NULL && cnt > 0) { 2032 --cnt; 2033 cb->hcb_start_addr = (caddr_t)range[cnt].rng_va; 2034 cb->hcb_end_addr = cb->hcb_start_addr; 2035 cb->hcb_end_addr += 2036 range[cnt].rng_cnt << LEVEL_SIZE(range[cnt].rng_level); 2037 cb->hcb_function(cb); 2038 } 2039 } 2040 2041 /* 2042 * Unload a given range of addresses (has optional callback) 2043 * 2044 * Flags: 2045 * define HAT_UNLOAD 0x00 2046 * define HAT_UNLOAD_NOSYNC 0x02 2047 * define HAT_UNLOAD_UNLOCK 0x04 2048 * define HAT_UNLOAD_OTHER 0x08 - not used 2049 * define HAT_UNLOAD_UNMAP 0x10 - same as HAT_UNLOAD 2050 */ 2051 #define MAX_UNLOAD_CNT (8) 2052 void 2053 hat_unload_callback( 2054 hat_t *hat, 2055 caddr_t addr, 2056 size_t len, 2057 uint_t flags, 2058 hat_callback_t *cb) 2059 { 2060 uintptr_t vaddr = (uintptr_t)addr; 2061 uintptr_t eaddr = vaddr + len; 2062 htable_t *ht = NULL; 2063 uint_t entry; 2064 uintptr_t contig_va = (uintptr_t)-1L; 2065 range_info_t r[MAX_UNLOAD_CNT]; 2066 uint_t r_cnt = 0; 2067 x86pte_t old_pte; 2068 2069 HATIN(hat_unload_callback, hat, addr, len); 2070 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2071 ASSERT(IS_PAGEALIGNED(vaddr)); 2072 ASSERT(IS_PAGEALIGNED(eaddr)); 2073 2074 /* 2075 * Special case a single page being unloaded for speed. This happens 2076 * quite frequently, COW faults after a fork() for example. 2077 */ 2078 if (cb == NULL && len == MMU_PAGESIZE) { 2079 ht = htable_getpte(hat, vaddr, &entry, &old_pte, 0); 2080 if (ht != NULL) { 2081 if (PTE_ISVALID(old_pte)) 2082 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2083 htable_release(ht); 2084 } 2085 return; 2086 } 2087 2088 while (vaddr < eaddr) { 2089 old_pte = htable_walk(hat, &ht, &vaddr, eaddr); 2090 if (ht == NULL) 2091 break; 2092 2093 ASSERT(!IN_VA_HOLE(vaddr)); 2094 2095 if (vaddr < (uintptr_t)addr) 2096 panic("hat_unload_callback(): unmap inside large page"); 2097 2098 /* 2099 * We'll do the call backs for contiguous ranges 2100 */ 2101 if (vaddr != contig_va || 2102 (r_cnt > 0 && r[r_cnt - 1].rng_level != ht->ht_level)) { 2103 if (r_cnt == MAX_UNLOAD_CNT) { 2104 handle_ranges(cb, r_cnt, r); 2105 r_cnt = 0; 2106 } 2107 r[r_cnt].rng_va = vaddr; 2108 r[r_cnt].rng_cnt = 0; 2109 r[r_cnt].rng_level = ht->ht_level; 2110 ++r_cnt; 2111 } 2112 2113 /* 2114 * Unload one mapping from the page tables. 2115 */ 2116 entry = htable_va2entry(vaddr, ht); 2117 hat_pte_unmap(ht, entry, flags, old_pte, NULL); 2118 ASSERT(ht->ht_level <= mmu.max_page_level); 2119 vaddr += LEVEL_SIZE(ht->ht_level); 2120 contig_va = vaddr; 2121 ++r[r_cnt - 1].rng_cnt; 2122 } 2123 if (ht) 2124 htable_release(ht); 2125 2126 /* 2127 * handle last range for callbacks 2128 */ 2129 if (r_cnt > 0) 2130 handle_ranges(cb, r_cnt, r); 2131 2132 HATOUT(hat_unload_callback, hat, addr); 2133 } 2134 2135 /* 2136 * synchronize mapping with software data structures 2137 * 2138 * This interface is currently only used by the working set monitor 2139 * driver. 2140 */ 2141 /*ARGSUSED*/ 2142 void 2143 hat_sync(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2144 { 2145 uintptr_t vaddr = (uintptr_t)addr; 2146 uintptr_t eaddr = vaddr + len; 2147 htable_t *ht = NULL; 2148 uint_t entry; 2149 x86pte_t pte; 2150 x86pte_t save_pte; 2151 x86pte_t new; 2152 page_t *pp; 2153 2154 ASSERT(!IN_VA_HOLE(vaddr)); 2155 ASSERT(IS_PAGEALIGNED(vaddr)); 2156 ASSERT(IS_PAGEALIGNED(eaddr)); 2157 ASSERT(hat == kas.a_hat || eaddr <= _userlimit); 2158 2159 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2160 try_again: 2161 pte = htable_walk(hat, &ht, &vaddr, eaddr); 2162 if (ht == NULL) 2163 break; 2164 entry = htable_va2entry(vaddr, ht); 2165 2166 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2167 PTE_GET(pte, PT_REF | PT_MOD) == 0) 2168 continue; 2169 2170 /* 2171 * We need to acquire the mapping list lock to protect 2172 * against hat_pageunload(), hat_unload(), etc. 2173 */ 2174 pp = page_numtopp_nolock(PTE2PFN(pte, ht->ht_level)); 2175 if (pp == NULL) 2176 break; 2177 x86_hm_enter(pp); 2178 save_pte = pte; 2179 pte = x86pte_get(ht, entry); 2180 if (pte != save_pte) { 2181 x86_hm_exit(pp); 2182 goto try_again; 2183 } 2184 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC || 2185 PTE_GET(pte, PT_REF | PT_MOD) == 0) { 2186 x86_hm_exit(pp); 2187 continue; 2188 } 2189 2190 /* 2191 * Need to clear ref or mod bits. We may compete with 2192 * hardware updating the R/M bits and have to try again. 2193 */ 2194 if (flags == HAT_SYNC_ZERORM) { 2195 new = pte; 2196 PTE_CLR(new, PT_REF | PT_MOD); 2197 pte = hati_update_pte(ht, entry, pte, new); 2198 if (pte != 0) { 2199 x86_hm_exit(pp); 2200 goto try_again; 2201 } 2202 } else { 2203 /* 2204 * sync the PTE to the page_t 2205 */ 2206 hati_sync_pte_to_page(pp, save_pte, ht->ht_level); 2207 } 2208 x86_hm_exit(pp); 2209 } 2210 if (ht) 2211 htable_release(ht); 2212 } 2213 2214 /* 2215 * void hat_map(hat, addr, len, flags) 2216 */ 2217 /*ARGSUSED*/ 2218 void 2219 hat_map(hat_t *hat, caddr_t addr, size_t len, uint_t flags) 2220 { 2221 /* does nothing */ 2222 } 2223 2224 /* 2225 * uint_t hat_getattr(hat, addr, *attr) 2226 * returns attr for <hat,addr> in *attr. returns 0 if there was a 2227 * mapping and *attr is valid, nonzero if there was no mapping and 2228 * *attr is not valid. 2229 */ 2230 uint_t 2231 hat_getattr(hat_t *hat, caddr_t addr, uint_t *attr) 2232 { 2233 uintptr_t vaddr = ALIGN2PAGE(addr); 2234 htable_t *ht = NULL; 2235 x86pte_t pte; 2236 2237 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2238 2239 if (IN_VA_HOLE(vaddr)) 2240 return ((uint_t)-1); 2241 2242 ht = htable_getpte(hat, vaddr, NULL, &pte, mmu.max_page_level); 2243 if (ht == NULL) 2244 return ((uint_t)-1); 2245 2246 if (!PTE_ISVALID(pte) || !PTE_ISPAGE(pte, ht->ht_level)) { 2247 htable_release(ht); 2248 return ((uint_t)-1); 2249 } 2250 2251 *attr = PROT_READ; 2252 if (PTE_GET(pte, PT_WRITABLE)) 2253 *attr |= PROT_WRITE; 2254 if (PTE_GET(pte, PT_USER)) 2255 *attr |= PROT_USER; 2256 if (!PTE_GET(pte, mmu.pt_nx)) 2257 *attr |= PROT_EXEC; 2258 if (PTE_GET(pte, PT_SOFTWARE) >= PT_NOSYNC) 2259 *attr |= HAT_NOSYNC; 2260 htable_release(ht); 2261 return (0); 2262 } 2263 2264 /* 2265 * hat_updateattr() applies the given attribute change to an existing mapping 2266 */ 2267 #define HAT_LOAD_ATTR 1 2268 #define HAT_SET_ATTR 2 2269 #define HAT_CLR_ATTR 3 2270 2271 static void 2272 hat_updateattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr, int what) 2273 { 2274 uintptr_t vaddr = (uintptr_t)addr; 2275 uintptr_t eaddr = (uintptr_t)addr + len; 2276 htable_t *ht = NULL; 2277 uint_t entry; 2278 x86pte_t oldpte, newpte; 2279 page_t *pp; 2280 2281 ASSERT(IS_PAGEALIGNED(vaddr)); 2282 ASSERT(IS_PAGEALIGNED(eaddr)); 2283 ASSERT(hat == kas.a_hat || 2284 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2285 for (; vaddr < eaddr; vaddr += LEVEL_SIZE(ht->ht_level)) { 2286 try_again: 2287 oldpte = htable_walk(hat, &ht, &vaddr, eaddr); 2288 if (ht == NULL) 2289 break; 2290 if (PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOCONSIST) 2291 continue; 2292 2293 pp = page_numtopp_nolock(PTE2PFN(oldpte, ht->ht_level)); 2294 if (pp == NULL) 2295 continue; 2296 x86_hm_enter(pp); 2297 2298 newpte = oldpte; 2299 /* 2300 * We found a page table entry in the desired range, 2301 * figure out the new attributes. 2302 */ 2303 if (what == HAT_SET_ATTR || what == HAT_LOAD_ATTR) { 2304 if ((attr & PROT_WRITE) && 2305 !PTE_GET(oldpte, PT_WRITABLE)) 2306 newpte |= PT_WRITABLE; 2307 2308 if ((attr & HAT_NOSYNC) && 2309 PTE_GET(oldpte, PT_SOFTWARE) < PT_NOSYNC) 2310 newpte |= PT_NOSYNC; 2311 2312 if ((attr & PROT_EXEC) && PTE_GET(oldpte, mmu.pt_nx)) 2313 newpte &= ~mmu.pt_nx; 2314 } 2315 2316 if (what == HAT_LOAD_ATTR) { 2317 if (!(attr & PROT_WRITE) && 2318 PTE_GET(oldpte, PT_WRITABLE)) 2319 newpte &= ~PT_WRITABLE; 2320 2321 if (!(attr & HAT_NOSYNC) && 2322 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2323 newpte &= ~PT_SOFTWARE; 2324 2325 if (!(attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2326 newpte |= mmu.pt_nx; 2327 } 2328 2329 if (what == HAT_CLR_ATTR) { 2330 if ((attr & PROT_WRITE) && PTE_GET(oldpte, PT_WRITABLE)) 2331 newpte &= ~PT_WRITABLE; 2332 2333 if ((attr & HAT_NOSYNC) && 2334 PTE_GET(oldpte, PT_SOFTWARE) >= PT_NOSYNC) 2335 newpte &= ~PT_SOFTWARE; 2336 2337 if ((attr & PROT_EXEC) && !PTE_GET(oldpte, mmu.pt_nx)) 2338 newpte |= mmu.pt_nx; 2339 } 2340 2341 /* 2342 * Ensure NOSYNC/NOCONSIST mappings have REF and MOD set. 2343 * x86pte_set() depends on this. 2344 */ 2345 if (PTE_GET(newpte, PT_SOFTWARE) >= PT_NOSYNC) 2346 newpte |= PT_REF | PT_MOD; 2347 2348 /* 2349 * what about PROT_READ or others? this code only handles: 2350 * EXEC, WRITE, NOSYNC 2351 */ 2352 2353 /* 2354 * If new PTE really changed, update the table. 2355 */ 2356 if (newpte != oldpte) { 2357 entry = htable_va2entry(vaddr, ht); 2358 oldpte = hati_update_pte(ht, entry, oldpte, newpte); 2359 if (oldpte != 0) { 2360 x86_hm_exit(pp); 2361 goto try_again; 2362 } 2363 } 2364 x86_hm_exit(pp); 2365 } 2366 if (ht) 2367 htable_release(ht); 2368 } 2369 2370 /* 2371 * Various wrappers for hat_updateattr() 2372 */ 2373 void 2374 hat_setattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2375 { 2376 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2377 hat_updateattr(hat, addr, len, attr, HAT_SET_ATTR); 2378 } 2379 2380 void 2381 hat_clrattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2382 { 2383 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2384 hat_updateattr(hat, addr, len, attr, HAT_CLR_ATTR); 2385 } 2386 2387 void 2388 hat_chgattr(hat_t *hat, caddr_t addr, size_t len, uint_t attr) 2389 { 2390 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2391 hat_updateattr(hat, addr, len, attr, HAT_LOAD_ATTR); 2392 } 2393 2394 void 2395 hat_chgprot(hat_t *hat, caddr_t addr, size_t len, uint_t vprot) 2396 { 2397 ASSERT(hat == kas.a_hat || (uintptr_t)addr + len <= _userlimit); 2398 hat_updateattr(hat, addr, len, vprot & HAT_PROT_MASK, HAT_LOAD_ATTR); 2399 } 2400 2401 /* 2402 * size_t hat_getpagesize(hat, addr) 2403 * returns pagesize in bytes for <hat, addr>. returns -1 of there is 2404 * no mapping. This is an advisory call. 2405 */ 2406 ssize_t 2407 hat_getpagesize(hat_t *hat, caddr_t addr) 2408 { 2409 uintptr_t vaddr = ALIGN2PAGE(addr); 2410 htable_t *ht; 2411 size_t pagesize; 2412 2413 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2414 if (IN_VA_HOLE(vaddr)) 2415 return (-1); 2416 ht = htable_getpage(hat, vaddr, NULL); 2417 if (ht == NULL) 2418 return (-1); 2419 pagesize = LEVEL_SIZE(ht->ht_level); 2420 htable_release(ht); 2421 return (pagesize); 2422 } 2423 2424 2425 2426 /* 2427 * pfn_t hat_getpfnum(hat, addr) 2428 * returns pfn for <hat, addr> or PFN_INVALID if mapping is invalid. 2429 */ 2430 pfn_t 2431 hat_getpfnum(hat_t *hat, caddr_t addr) 2432 { 2433 uintptr_t vaddr = ALIGN2PAGE(addr); 2434 htable_t *ht; 2435 uint_t entry; 2436 pfn_t pfn = PFN_INVALID; 2437 2438 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2439 if (khat_running == 0) 2440 return (PFN_INVALID); 2441 2442 if (IN_VA_HOLE(vaddr)) 2443 return (PFN_INVALID); 2444 2445 /* 2446 * A very common use of hat_getpfnum() is from the DDI for kernel pages. 2447 * Use the kmap_ptes (which also covers the 32 bit heap) to speed 2448 * this up. 2449 */ 2450 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2451 x86pte_t pte; 2452 pgcnt_t pg_index; 2453 2454 pg_index = mmu_btop(vaddr - mmu.kmap_addr); 2455 pte = GET_PTE(PT_INDEX_PTR(mmu.kmap_ptes, pg_index)); 2456 if (!PTE_ISVALID(pte)) 2457 return (PFN_INVALID); 2458 /*LINTED [use of constant 0 causes a silly lint warning] */ 2459 return (PTE2PFN(pte, 0)); 2460 } 2461 2462 ht = htable_getpage(hat, vaddr, &entry); 2463 if (ht == NULL) 2464 return (PFN_INVALID); 2465 ASSERT(vaddr >= ht->ht_vaddr); 2466 ASSERT(vaddr <= HTABLE_LAST_PAGE(ht)); 2467 pfn = PTE2PFN(x86pte_get(ht, entry), ht->ht_level); 2468 if (ht->ht_level > 0) 2469 pfn += mmu_btop(vaddr & LEVEL_OFFSET(ht->ht_level)); 2470 htable_release(ht); 2471 return (pfn); 2472 } 2473 2474 /* 2475 * hat_getkpfnum() is an obsolete DDI routine, and its use is discouraged. 2476 * Use hat_getpfnum(kas.a_hat, ...) instead. 2477 * 2478 * We'd like to return PFN_INVALID if the mappings have underlying page_t's 2479 * but can't right now due to the fact that some software has grown to use 2480 * this interface incorrectly. So for now when the interface is misused, 2481 * return a warning to the user that in the future it won't work in the 2482 * way they're abusing it, and carry on. 2483 * 2484 * Note that hat_getkpfnum() is never supported on amd64. 2485 */ 2486 #if !defined(__amd64) 2487 pfn_t 2488 hat_getkpfnum(caddr_t addr) 2489 { 2490 pfn_t pfn; 2491 int badcaller = 0; 2492 2493 if (khat_running == 0) 2494 panic("hat_getkpfnum(): called too early\n"); 2495 if ((uintptr_t)addr < kernelbase) 2496 return (PFN_INVALID); 2497 2498 2499 if (segkpm && IS_KPM_ADDR(addr)) { 2500 badcaller = 1; 2501 pfn = hat_kpm_va2pfn(addr); 2502 } else { 2503 pfn = hat_getpfnum(kas.a_hat, addr); 2504 badcaller = pf_is_memory(pfn); 2505 } 2506 2507 if (badcaller) 2508 hat_getkpfnum_badcall(caller()); 2509 return (pfn); 2510 } 2511 #endif /* __amd64 */ 2512 2513 /* 2514 * int hat_probe(hat, addr) 2515 * return 0 if no valid mapping is present. Faster version 2516 * of hat_getattr in certain architectures. 2517 */ 2518 int 2519 hat_probe(hat_t *hat, caddr_t addr) 2520 { 2521 uintptr_t vaddr = ALIGN2PAGE(addr); 2522 uint_t entry; 2523 htable_t *ht; 2524 pgcnt_t pg_off; 2525 2526 ASSERT(hat == kas.a_hat || vaddr <= _userlimit); 2527 ASSERT(hat == kas.a_hat || 2528 AS_LOCK_HELD(hat->hat_as, &hat->hat_as->a_lock)); 2529 if (IN_VA_HOLE(vaddr)) 2530 return (0); 2531 2532 /* 2533 * Most common use of hat_probe is from segmap. We special case it 2534 * for performance. 2535 */ 2536 if (mmu.kmap_addr <= vaddr && vaddr < mmu.kmap_eaddr) { 2537 pg_off = mmu_btop(vaddr - mmu.kmap_addr); 2538 if (mmu.pae_hat) 2539 return (PTE_ISVALID(mmu.kmap_ptes[pg_off])); 2540 else 2541 return (PTE_ISVALID( 2542 ((x86pte32_t *)mmu.kmap_ptes)[pg_off])); 2543 } 2544 2545 ht = htable_getpage(hat, vaddr, &entry); 2546 if (ht == NULL) 2547 return (0); 2548 htable_release(ht); 2549 return (1); 2550 } 2551 2552 /* 2553 * Simple implementation of ISM. hat_share() is just like hat_memload_array(), 2554 * except that we use the ism_hat's existing mappings to determine the pages 2555 * and protections to use for this hat. In case we find a properly aligned 2556 * and sized pagetable of 4K mappings, we will attempt to share the pagetable 2557 * itself. 2558 */ 2559 /*ARGSUSED*/ 2560 int 2561 hat_share( 2562 hat_t *hat, 2563 caddr_t addr, 2564 hat_t *ism_hat, 2565 caddr_t src_addr, 2566 size_t len, /* almost useless value, see below.. */ 2567 uint_t ismszc) 2568 { 2569 uintptr_t vaddr_start = (uintptr_t)addr; 2570 uintptr_t vaddr; 2571 uintptr_t pt_vaddr; 2572 uintptr_t eaddr = vaddr_start + len; 2573 uintptr_t ism_addr_start = (uintptr_t)src_addr; 2574 uintptr_t ism_addr = ism_addr_start; 2575 uintptr_t e_ism_addr = ism_addr + len; 2576 htable_t *ism_ht = NULL; 2577 htable_t *ht; 2578 x86pte_t pte; 2579 page_t *pp; 2580 pfn_t pfn; 2581 level_t l; 2582 pgcnt_t pgcnt; 2583 uint_t prot; 2584 uint_t valid_cnt; 2585 2586 /* 2587 * We might be asked to share an empty DISM hat by as_dup() 2588 */ 2589 ASSERT(hat != kas.a_hat); 2590 ASSERT(eaddr <= _userlimit); 2591 if (!(ism_hat->hat_flags & HAT_SHARED)) { 2592 ASSERT(hat_get_mapped_size(ism_hat) == 0); 2593 return (0); 2594 } 2595 2596 /* 2597 * The SPT segment driver often passes us a size larger than there are 2598 * valid mappings. That's because it rounds the segment size up to a 2599 * large pagesize, even if the actual memory mapped by ism_hat is less. 2600 */ 2601 HATIN(hat_share, hat, addr, len); 2602 ASSERT(IS_PAGEALIGNED(vaddr_start)); 2603 ASSERT(IS_PAGEALIGNED(ism_addr_start)); 2604 ASSERT(ism_hat->hat_flags & HAT_SHARED); 2605 while (ism_addr < e_ism_addr) { 2606 /* 2607 * use htable_walk to get the next valid ISM mapping 2608 */ 2609 pte = htable_walk(ism_hat, &ism_ht, &ism_addr, e_ism_addr); 2610 if (ism_ht == NULL) 2611 break; 2612 2613 /* 2614 * Find the largest page size we can use, based on the 2615 * ISM mapping size, our address alignment and the remaining 2616 * map length. 2617 */ 2618 vaddr = vaddr_start + (ism_addr - ism_addr_start); 2619 for (l = ism_ht->ht_level; l > 0; --l) { 2620 if (LEVEL_SIZE(l) <= eaddr - vaddr && 2621 (vaddr & LEVEL_OFFSET(l)) == 0) 2622 break; 2623 } 2624 2625 /* 2626 * attempt to share the pagetable 2627 * 2628 * - only 4K pagetables are shared (ie. level == 0) 2629 * - the hat_share() length must cover the whole pagetable 2630 * - the shared address must align at level 1 2631 * - a shared PTE for this address already exists OR 2632 * - no page table for this address exists yet 2633 */ 2634 pt_vaddr = 2635 vaddr_start + (ism_ht->ht_vaddr - ism_addr_start); 2636 if (ism_ht->ht_level == 0 && 2637 ism_ht->ht_vaddr + LEVEL_SIZE(1) <= e_ism_addr && 2638 (pt_vaddr & LEVEL_OFFSET(1)) == 0) { 2639 2640 ht = htable_lookup(hat, pt_vaddr, 0); 2641 if (ht == NULL) 2642 ht = htable_create(hat, pt_vaddr, 0, ism_ht); 2643 2644 if (ht->ht_level > 0 || 2645 !(ht->ht_flags & HTABLE_SHARED_PFN)) { 2646 2647 htable_release(ht); 2648 2649 } else { 2650 2651 /* 2652 * share the page table 2653 */ 2654 ASSERT(ht->ht_level == 0); 2655 ASSERT(ht->ht_shares == ism_ht); 2656 valid_cnt = ism_ht->ht_valid_cnt; 2657 atomic_add_long(&hat->hat_pages_mapped[0], 2658 valid_cnt - ht->ht_valid_cnt); 2659 ht->ht_valid_cnt = valid_cnt; 2660 htable_release(ht); 2661 ism_addr = ism_ht->ht_vaddr + LEVEL_SIZE(1); 2662 htable_release(ism_ht); 2663 ism_ht = NULL; 2664 continue; 2665 } 2666 } 2667 2668 /* 2669 * Unable to share the page table. Instead we will 2670 * create new mappings from the values in the ISM mappings. 2671 * 2672 * The ISM mapping might be larger than the share area, 2673 * be careful to trunctate it if needed. 2674 */ 2675 if (eaddr - vaddr >= LEVEL_SIZE(ism_ht->ht_level)) { 2676 pgcnt = mmu_btop(LEVEL_SIZE(ism_ht->ht_level)); 2677 } else { 2678 pgcnt = mmu_btop(eaddr - vaddr); 2679 l = 0; 2680 } 2681 2682 pfn = PTE2PFN(pte, ism_ht->ht_level); 2683 ASSERT(pfn != PFN_INVALID); 2684 while (pgcnt > 0) { 2685 /* 2686 * Make a new pte for the PFN for this level. 2687 * Copy protections for the pte from the ISM pte. 2688 */ 2689 pp = page_numtopp_nolock(pfn); 2690 ASSERT(pp != NULL); 2691 2692 prot = PROT_USER | PROT_READ | HAT_UNORDERED_OK; 2693 if (PTE_GET(pte, PT_WRITABLE)) 2694 prot |= PROT_WRITE; 2695 if (!PTE_GET(pte, PT_NX)) 2696 prot |= PROT_EXEC; 2697 2698 /* 2699 * XX64 -- can shm ever be written to swap? 2700 * if not we could use HAT_NOSYNC here. 2701 */ 2702 while (hati_load_common(hat, vaddr, pp, prot, HAT_LOAD, 2703 l, pfn) != 0) { 2704 if (l == 0) 2705 panic("hati_load_common() failure"); 2706 --l; 2707 } 2708 2709 vaddr += LEVEL_SIZE(l); 2710 ism_addr += LEVEL_SIZE(l); 2711 pfn += mmu_btop(LEVEL_SIZE(l)); 2712 pgcnt -= mmu_btop(LEVEL_SIZE(l)); 2713 } 2714 } 2715 if (ism_ht != NULL) 2716 htable_release(ism_ht); 2717 2718 HATOUT(hat_share, hat, addr); 2719 return (0); 2720 } 2721 2722 2723 /* 2724 * hat_unshare() is similar to hat_unload_callback(), but 2725 * we have to look for empty shared pagetables. Note that 2726 * hat_unshare() is always invoked against an entire segment. 2727 */ 2728 /*ARGSUSED*/ 2729 void 2730 hat_unshare(hat_t *hat, caddr_t addr, size_t len, uint_t ismszc) 2731 { 2732 uintptr_t vaddr = (uintptr_t)addr; 2733 uintptr_t eaddr = vaddr + len; 2734 htable_t *ht = NULL; 2735 uint_t need_demaps = 0; 2736 2737 ASSERT(hat != kas.a_hat); 2738 ASSERT(eaddr <= _userlimit); 2739 HATIN(hat_unshare, hat, addr, len); 2740 ASSERT(IS_PAGEALIGNED(vaddr)); 2741 ASSERT(IS_PAGEALIGNED(eaddr)); 2742 2743 /* 2744 * First go through and remove any shared pagetables. 2745 * 2746 * Note that it's ok to delay the TLB shootdown till the entire range is 2747 * finished, because if hat_pageunload() were to unload a shared 2748 * pagetable page, its hat_tlb_inval() will do a global TLB invalidate. 2749 */ 2750 while (vaddr < eaddr) { 2751 ASSERT(!IN_VA_HOLE(vaddr)); 2752 /* 2753 * find the pagetable that would map the current address 2754 */ 2755 ht = htable_lookup(hat, vaddr, 0); 2756 if (ht != NULL) { 2757 if (ht->ht_flags & HTABLE_SHARED_PFN) { 2758 /* 2759 * clear mapped pages count, set valid_cnt to 0 2760 * and let htable_release() finish the job 2761 */ 2762 atomic_add_long(&hat->hat_pages_mapped[0], 2763 -ht->ht_valid_cnt); 2764 ht->ht_valid_cnt = 0; 2765 need_demaps = 1; 2766 } 2767 htable_release(ht); 2768 } 2769 vaddr = (vaddr & LEVEL_MASK(1)) + LEVEL_SIZE(1); 2770 } 2771 2772 /* 2773 * flush the TLBs - since we're probably dealing with MANY mappings 2774 * we do just one CR3 reload. 2775 */ 2776 if (!(hat->hat_flags & HAT_FREEING) && need_demaps) 2777 hat_tlb_inval(hat, DEMAP_ALL_ADDR); 2778 2779 /* 2780 * Now go back and clean up any unaligned mappings that 2781 * couldn't share pagetables. 2782 */ 2783 hat_unload(hat, addr, len, HAT_UNLOAD_UNMAP); 2784 2785 HATOUT(hat_unshare, hat, addr); 2786 } 2787 2788 2789 /* 2790 * hat_reserve() does nothing 2791 */ 2792 /*ARGSUSED*/ 2793 void 2794 hat_reserve(struct as *as, caddr_t addr, size_t len) 2795 { 2796 } 2797 2798 2799 /* 2800 * Called when all mappings to a page should have write permission removed. 2801 * Mostly stolem from hat_pagesync() 2802 */ 2803 static void 2804 hati_page_clrwrt(struct page *pp) 2805 { 2806 hment_t *hm = NULL; 2807 htable_t *ht; 2808 uint_t entry; 2809 x86pte_t old; 2810 x86pte_t new; 2811 uint_t pszc = 0; 2812 2813 next_size: 2814 /* 2815 * walk thru the mapping list clearing write permission 2816 */ 2817 x86_hm_enter(pp); 2818 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 2819 if (ht->ht_level < pszc) 2820 continue; 2821 old = x86pte_get(ht, entry); 2822 2823 for (;;) { 2824 /* 2825 * Is this mapping of interest? 2826 */ 2827 if (PTE2PFN(old, ht->ht_level) != pp->p_pagenum || 2828 PTE_GET(old, PT_WRITABLE) == 0) 2829 break; 2830 2831 /* 2832 * Clear ref/mod writable bits. This requires cross 2833 * calls to ensure any executing TLBs see cleared bits. 2834 */ 2835 new = old; 2836 PTE_CLR(new, PT_REF | PT_MOD | PT_WRITABLE); 2837 old = hati_update_pte(ht, entry, old, new); 2838 if (old != 0) 2839 continue; 2840 2841 break; 2842 } 2843 } 2844 x86_hm_exit(pp); 2845 while (pszc < pp->p_szc) { 2846 page_t *tpp; 2847 pszc++; 2848 tpp = PP_GROUPLEADER(pp, pszc); 2849 if (pp != tpp) { 2850 pp = tpp; 2851 goto next_size; 2852 } 2853 } 2854 } 2855 2856 /* 2857 * void hat_page_setattr(pp, flag) 2858 * void hat_page_clrattr(pp, flag) 2859 * used to set/clr ref/mod bits. 2860 */ 2861 void 2862 hat_page_setattr(struct page *pp, uint_t flag) 2863 { 2864 vnode_t *vp = pp->p_vnode; 2865 kmutex_t *vphm = NULL; 2866 page_t **listp; 2867 2868 if (PP_GETRM(pp, flag) == flag) 2869 return; 2870 2871 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 2872 vphm = page_vnode_mutex(vp); 2873 mutex_enter(vphm); 2874 } 2875 2876 PP_SETRM(pp, flag); 2877 2878 if (vphm != NULL) { 2879 2880 /* 2881 * Some File Systems examine v_pages for NULL w/o 2882 * grabbing the vphm mutex. Must not let it become NULL when 2883 * pp is the only page on the list. 2884 */ 2885 if (pp->p_vpnext != pp) { 2886 page_vpsub(&vp->v_pages, pp); 2887 if (vp->v_pages != NULL) 2888 listp = &vp->v_pages->p_vpprev->p_vpnext; 2889 else 2890 listp = &vp->v_pages; 2891 page_vpadd(listp, pp); 2892 } 2893 mutex_exit(vphm); 2894 } 2895 } 2896 2897 void 2898 hat_page_clrattr(struct page *pp, uint_t flag) 2899 { 2900 vnode_t *vp = pp->p_vnode; 2901 ASSERT(!(flag & ~(P_MOD | P_REF | P_RO))); 2902 2903 /* 2904 * Caller is expected to hold page's io lock for VMODSORT to work 2905 * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod 2906 * bit is cleared. 2907 * We don't have assert to avoid tripping some existing third party 2908 * code. The dirty page is moved back to top of the v_page list 2909 * after IO is done in pvn_write_done(). 2910 */ 2911 PP_CLRRM(pp, flag); 2912 2913 if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) { 2914 2915 /* 2916 * VMODSORT works by removing write permissions and getting 2917 * a fault when a page is made dirty. At this point 2918 * we need to remove write permission from all mappings 2919 * to this page. 2920 */ 2921 hati_page_clrwrt(pp); 2922 } 2923 } 2924 2925 /* 2926 * If flag is specified, returns 0 if attribute is disabled 2927 * and non zero if enabled. If flag specifes multiple attributs 2928 * then returns 0 if ALL atriibutes are disabled. This is an advisory 2929 * call. 2930 */ 2931 uint_t 2932 hat_page_getattr(struct page *pp, uint_t flag) 2933 { 2934 return (PP_GETRM(pp, flag)); 2935 } 2936 2937 2938 /* 2939 * common code used by hat_pageunload() and hment_steal() 2940 */ 2941 hment_t * 2942 hati_page_unmap(page_t *pp, htable_t *ht, uint_t entry) 2943 { 2944 x86pte_t old_pte; 2945 pfn_t pfn = pp->p_pagenum; 2946 hment_t *hm; 2947 2948 /* 2949 * We need to acquire a hold on the htable in order to 2950 * do the invalidate. We know the htable must exist, since 2951 * unmap's don't release the htable until after removing any 2952 * hment. Having x86_hm_enter() keeps that from proceeding. 2953 */ 2954 htable_acquire(ht); 2955 2956 /* 2957 * Invalidate the PTE and remove the hment. 2958 */ 2959 old_pte = x86pte_inval(ht, entry, 0, NULL); 2960 if (PTE2PFN(old_pte, ht->ht_level) != pfn) { 2961 panic("x86pte_inval() failure found PTE = " FMT_PTE 2962 " pfn being unmapped is %lx ht=0x%lx entry=0x%x", 2963 old_pte, pfn, (uintptr_t)ht, entry); 2964 } 2965 2966 /* 2967 * Clean up all the htable information for this mapping 2968 */ 2969 ASSERT(ht->ht_valid_cnt > 0); 2970 HTABLE_DEC(ht->ht_valid_cnt); 2971 PGCNT_DEC(ht->ht_hat, ht->ht_level); 2972 2973 /* 2974 * sync ref/mod bits to the page_t 2975 */ 2976 if (PTE_GET(old_pte, PT_SOFTWARE) < PT_NOSYNC) 2977 hati_sync_pte_to_page(pp, old_pte, ht->ht_level); 2978 2979 /* 2980 * Remove the mapping list entry for this page. 2981 */ 2982 hm = hment_remove(pp, ht, entry); 2983 2984 /* 2985 * drop the mapping list lock so that we might free the 2986 * hment and htable. 2987 */ 2988 x86_hm_exit(pp); 2989 htable_release(ht); 2990 return (hm); 2991 } 2992 2993 extern int vpm_enable; 2994 /* 2995 * Unload all translations to a page. If the page is a subpage of a large 2996 * page, the large page mappings are also removed. 2997 * 2998 * The forceflags are unused. 2999 */ 3000 3001 /*ARGSUSED*/ 3002 static int 3003 hati_pageunload(struct page *pp, uint_t pg_szcd, uint_t forceflag) 3004 { 3005 page_t *cur_pp = pp; 3006 hment_t *hm; 3007 hment_t *prev; 3008 htable_t *ht; 3009 uint_t entry; 3010 level_t level; 3011 3012 #if defined(__amd64) 3013 /* 3014 * clear the vpm ref. 3015 */ 3016 if (vpm_enable) { 3017 pp->p_vpmref = 0; 3018 } 3019 #endif 3020 /* 3021 * The loop with next_size handles pages with multiple pagesize mappings 3022 */ 3023 next_size: 3024 for (;;) { 3025 3026 /* 3027 * Get a mapping list entry 3028 */ 3029 x86_hm_enter(cur_pp); 3030 for (prev = NULL; ; prev = hm) { 3031 hm = hment_walk(cur_pp, &ht, &entry, prev); 3032 if (hm == NULL) { 3033 x86_hm_exit(cur_pp); 3034 3035 /* 3036 * If not part of a larger page, we're done. 3037 */ 3038 if (cur_pp->p_szc <= pg_szcd) { 3039 return (0); 3040 } 3041 3042 /* 3043 * Else check the next larger page size. 3044 * hat_page_demote() may decrease p_szc 3045 * but that's ok we'll just take an extra 3046 * trip discover there're no larger mappings 3047 * and return. 3048 */ 3049 ++pg_szcd; 3050 cur_pp = PP_GROUPLEADER(cur_pp, pg_szcd); 3051 goto next_size; 3052 } 3053 3054 /* 3055 * If this mapping size matches, remove it. 3056 */ 3057 level = ht->ht_level; 3058 if (level == pg_szcd) 3059 break; 3060 } 3061 3062 /* 3063 * Remove the mapping list entry for this page. 3064 * Note this does the x86_hm_exit() for us. 3065 */ 3066 hm = hati_page_unmap(cur_pp, ht, entry); 3067 if (hm != NULL) 3068 hment_free(hm); 3069 } 3070 } 3071 3072 int 3073 hat_pageunload(struct page *pp, uint_t forceflag) 3074 { 3075 ASSERT(PAGE_EXCL(pp)); 3076 return (hati_pageunload(pp, 0, forceflag)); 3077 } 3078 3079 /* 3080 * Unload all large mappings to pp and reduce by 1 p_szc field of every large 3081 * page level that included pp. 3082 * 3083 * pp must be locked EXCL. Even though no other constituent pages are locked 3084 * it's legal to unload large mappings to pp because all constituent pages of 3085 * large locked mappings have to be locked SHARED. therefore if we have EXCL 3086 * lock on one of constituent pages none of the large mappings to pp are 3087 * locked. 3088 * 3089 * Change (always decrease) p_szc field starting from the last constituent 3090 * page and ending with root constituent page so that root's pszc always shows 3091 * the area where hat_page_demote() may be active. 3092 * 3093 * This mechanism is only used for file system pages where it's not always 3094 * possible to get EXCL locks on all constituent pages to demote the size code 3095 * (as is done for anonymous or kernel large pages). 3096 */ 3097 void 3098 hat_page_demote(page_t *pp) 3099 { 3100 uint_t pszc; 3101 uint_t rszc; 3102 uint_t szc; 3103 page_t *rootpp; 3104 page_t *firstpp; 3105 page_t *lastpp; 3106 pgcnt_t pgcnt; 3107 3108 ASSERT(PAGE_EXCL(pp)); 3109 ASSERT(!PP_ISFREE(pp)); 3110 ASSERT(page_szc_lock_assert(pp)); 3111 3112 if (pp->p_szc == 0) 3113 return; 3114 3115 rootpp = PP_GROUPLEADER(pp, 1); 3116 (void) hati_pageunload(rootpp, 1, HAT_FORCE_PGUNLOAD); 3117 3118 /* 3119 * all large mappings to pp are gone 3120 * and no new can be setup since pp is locked exclusively. 3121 * 3122 * Lock the root to make sure there's only one hat_page_demote() 3123 * outstanding within the area of this root's pszc. 3124 * 3125 * Second potential hat_page_demote() is already eliminated by upper 3126 * VM layer via page_szc_lock() but we don't rely on it and use our 3127 * own locking (so that upper layer locking can be changed without 3128 * assumptions that hat depends on upper layer VM to prevent multiple 3129 * hat_page_demote() to be issued simultaneously to the same large 3130 * page). 3131 */ 3132 again: 3133 pszc = pp->p_szc; 3134 if (pszc == 0) 3135 return; 3136 rootpp = PP_GROUPLEADER(pp, pszc); 3137 x86_hm_enter(rootpp); 3138 /* 3139 * If root's p_szc is different from pszc we raced with another 3140 * hat_page_demote(). Drop the lock and try to find the root again. 3141 * If root's p_szc is greater than pszc previous hat_page_demote() is 3142 * not done yet. Take and release mlist lock of root's root to wait 3143 * for previous hat_page_demote() to complete. 3144 */ 3145 if ((rszc = rootpp->p_szc) != pszc) { 3146 x86_hm_exit(rootpp); 3147 if (rszc > pszc) { 3148 /* p_szc of a locked non free page can't increase */ 3149 ASSERT(pp != rootpp); 3150 3151 rootpp = PP_GROUPLEADER(rootpp, rszc); 3152 x86_hm_enter(rootpp); 3153 x86_hm_exit(rootpp); 3154 } 3155 goto again; 3156 } 3157 ASSERT(pp->p_szc == pszc); 3158 3159 /* 3160 * Decrement by 1 p_szc of every constituent page of a region that 3161 * covered pp. For example if original szc is 3 it gets changed to 2 3162 * everywhere except in region 2 that covered pp. Region 2 that 3163 * covered pp gets demoted to 1 everywhere except in region 1 that 3164 * covered pp. The region 1 that covered pp is demoted to region 3165 * 0. It's done this way because from region 3 we removed level 3 3166 * mappings, from region 2 that covered pp we removed level 2 mappings 3167 * and from region 1 that covered pp we removed level 1 mappings. All 3168 * changes are done from from high pfn's to low pfn's so that roots 3169 * are changed last allowing one to know the largest region where 3170 * hat_page_demote() is stil active by only looking at the root page. 3171 * 3172 * This algorithm is implemented in 2 while loops. First loop changes 3173 * p_szc of pages to the right of pp's level 1 region and second 3174 * loop changes p_szc of pages of level 1 region that covers pp 3175 * and all pages to the left of level 1 region that covers pp. 3176 * In the first loop p_szc keeps dropping with every iteration 3177 * and in the second loop it keeps increasing with every iteration. 3178 * 3179 * First loop description: Demote pages to the right of pp outside of 3180 * level 1 region that covers pp. In every iteration of the while 3181 * loop below find the last page of szc region and the first page of 3182 * (szc - 1) region that is immediately to the right of (szc - 1) 3183 * region that covers pp. From last such page to first such page 3184 * change every page's szc to szc - 1. Decrement szc and continue 3185 * looping until szc is 1. If pp belongs to the last (szc - 1) region 3186 * of szc region skip to the next iteration. 3187 */ 3188 szc = pszc; 3189 while (szc > 1) { 3190 lastpp = PP_GROUPLEADER(pp, szc); 3191 pgcnt = page_get_pagecnt(szc); 3192 lastpp += pgcnt - 1; 3193 firstpp = PP_GROUPLEADER(pp, (szc - 1)); 3194 pgcnt = page_get_pagecnt(szc - 1); 3195 if (lastpp - firstpp < pgcnt) { 3196 szc--; 3197 continue; 3198 } 3199 firstpp += pgcnt; 3200 while (lastpp != firstpp) { 3201 ASSERT(lastpp->p_szc == pszc); 3202 lastpp->p_szc = szc - 1; 3203 lastpp--; 3204 } 3205 firstpp->p_szc = szc - 1; 3206 szc--; 3207 } 3208 3209 /* 3210 * Second loop description: 3211 * First iteration changes p_szc to 0 of every 3212 * page of level 1 region that covers pp. 3213 * Subsequent iterations find last page of szc region 3214 * immediately to the left of szc region that covered pp 3215 * and first page of (szc + 1) region that covers pp. 3216 * From last to first page change p_szc of every page to szc. 3217 * Increment szc and continue looping until szc is pszc. 3218 * If pp belongs to the fist szc region of (szc + 1) region 3219 * skip to the next iteration. 3220 * 3221 */ 3222 szc = 0; 3223 while (szc < pszc) { 3224 firstpp = PP_GROUPLEADER(pp, (szc + 1)); 3225 if (szc == 0) { 3226 pgcnt = page_get_pagecnt(1); 3227 lastpp = firstpp + (pgcnt - 1); 3228 } else { 3229 lastpp = PP_GROUPLEADER(pp, szc); 3230 if (firstpp == lastpp) { 3231 szc++; 3232 continue; 3233 } 3234 lastpp--; 3235 pgcnt = page_get_pagecnt(szc); 3236 } 3237 while (lastpp != firstpp) { 3238 ASSERT(lastpp->p_szc == pszc); 3239 lastpp->p_szc = szc; 3240 lastpp--; 3241 } 3242 firstpp->p_szc = szc; 3243 if (firstpp == rootpp) 3244 break; 3245 szc++; 3246 } 3247 x86_hm_exit(rootpp); 3248 } 3249 3250 /* 3251 * get hw stats from hardware into page struct and reset hw stats 3252 * returns attributes of page 3253 * Flags for hat_pagesync, hat_getstat, hat_sync 3254 * 3255 * define HAT_SYNC_ZERORM 0x01 3256 * 3257 * Additional flags for hat_pagesync 3258 * 3259 * define HAT_SYNC_STOPON_REF 0x02 3260 * define HAT_SYNC_STOPON_MOD 0x04 3261 * define HAT_SYNC_STOPON_RM 0x06 3262 * define HAT_SYNC_STOPON_SHARED 0x08 3263 */ 3264 uint_t 3265 hat_pagesync(struct page *pp, uint_t flags) 3266 { 3267 hment_t *hm = NULL; 3268 htable_t *ht; 3269 uint_t entry; 3270 x86pte_t old, save_old; 3271 x86pte_t new; 3272 uchar_t nrmbits = P_REF|P_MOD|P_RO; 3273 extern ulong_t po_share; 3274 page_t *save_pp = pp; 3275 uint_t pszc = 0; 3276 3277 ASSERT(PAGE_LOCKED(pp) || panicstr); 3278 3279 if (PP_ISRO(pp) && (flags & HAT_SYNC_STOPON_MOD)) 3280 return (pp->p_nrm & nrmbits); 3281 3282 if ((flags & HAT_SYNC_ZERORM) == 0) { 3283 3284 if ((flags & HAT_SYNC_STOPON_REF) != 0 && PP_ISREF(pp)) 3285 return (pp->p_nrm & nrmbits); 3286 3287 if ((flags & HAT_SYNC_STOPON_MOD) != 0 && PP_ISMOD(pp)) 3288 return (pp->p_nrm & nrmbits); 3289 3290 if ((flags & HAT_SYNC_STOPON_SHARED) != 0 && 3291 hat_page_getshare(pp) > po_share) { 3292 if (PP_ISRO(pp)) 3293 PP_SETREF(pp); 3294 return (pp->p_nrm & nrmbits); 3295 } 3296 } 3297 3298 next_size: 3299 /* 3300 * walk thru the mapping list syncing (and clearing) ref/mod bits. 3301 */ 3302 x86_hm_enter(pp); 3303 while ((hm = hment_walk(pp, &ht, &entry, hm)) != NULL) { 3304 if (ht->ht_level < pszc) 3305 continue; 3306 old = x86pte_get(ht, entry); 3307 try_again: 3308 3309 ASSERT(PTE2PFN(old, ht->ht_level) == pp->p_pagenum); 3310 3311 if (PTE_GET(old, PT_REF | PT_MOD) == 0) 3312 continue; 3313 3314 save_old = old; 3315 if ((flags & HAT_SYNC_ZERORM) != 0) { 3316 3317 /* 3318 * Need to clear ref or mod bits. Need to demap 3319 * to make sure any executing TLBs see cleared bits. 3320 */ 3321 new = old; 3322 PTE_CLR(new, PT_REF | PT_MOD); 3323 old = hati_update_pte(ht, entry, old, new); 3324 if (old != 0) 3325 goto try_again; 3326 3327 old = save_old; 3328 } 3329 3330 /* 3331 * Sync the PTE 3332 */ 3333 if (!(flags & HAT_SYNC_ZERORM) && 3334 PTE_GET(old, PT_SOFTWARE) <= PT_NOSYNC) 3335 hati_sync_pte_to_page(pp, old, ht->ht_level); 3336 3337 /* 3338 * can stop short if we found a ref'd or mod'd page 3339 */ 3340 if ((flags & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp) || 3341 (flags & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)) { 3342 x86_hm_exit(pp); 3343 goto done; 3344 } 3345 } 3346 x86_hm_exit(pp); 3347 while (pszc < pp->p_szc) { 3348 page_t *tpp; 3349 pszc++; 3350 tpp = PP_GROUPLEADER(pp, pszc); 3351 if (pp != tpp) { 3352 pp = tpp; 3353 goto next_size; 3354 } 3355 } 3356 done: 3357 return (save_pp->p_nrm & nrmbits); 3358 } 3359 3360 /* 3361 * returns approx number of mappings to this pp. A return of 0 implies 3362 * there are no mappings to the page. 3363 */ 3364 ulong_t 3365 hat_page_getshare(page_t *pp) 3366 { 3367 uint_t cnt; 3368 cnt = hment_mapcnt(pp); 3369 #if defined(__amd64) 3370 if (vpm_enable && pp->p_vpmref) { 3371 cnt += 1; 3372 } 3373 #endif 3374 return (cnt); 3375 } 3376 3377 /* 3378 * hat_softlock isn't supported anymore 3379 */ 3380 /*ARGSUSED*/ 3381 faultcode_t 3382 hat_softlock( 3383 hat_t *hat, 3384 caddr_t addr, 3385 size_t *len, 3386 struct page **page_array, 3387 uint_t flags) 3388 { 3389 return (FC_NOSUPPORT); 3390 } 3391 3392 3393 3394 /* 3395 * Routine to expose supported HAT features to platform independent code. 3396 */ 3397 /*ARGSUSED*/ 3398 int 3399 hat_supported(enum hat_features feature, void *arg) 3400 { 3401 switch (feature) { 3402 3403 case HAT_SHARED_PT: /* this is really ISM */ 3404 return (1); 3405 3406 case HAT_DYNAMIC_ISM_UNMAP: 3407 return (0); 3408 3409 case HAT_VMODSORT: 3410 return (1); 3411 3412 default: 3413 panic("hat_supported() - unknown feature"); 3414 } 3415 return (0); 3416 } 3417 3418 /* 3419 * Called when a thread is exiting and has been switched to the kernel AS 3420 */ 3421 void 3422 hat_thread_exit(kthread_t *thd) 3423 { 3424 ASSERT(thd->t_procp->p_as == &kas); 3425 hat_switch(thd->t_procp->p_as->a_hat); 3426 } 3427 3428 /* 3429 * Setup the given brand new hat structure as the new HAT on this cpu's mmu. 3430 */ 3431 /*ARGSUSED*/ 3432 void 3433 hat_setup(hat_t *hat, int flags) 3434 { 3435 kpreempt_disable(); 3436 3437 hat_switch(hat); 3438 3439 kpreempt_enable(); 3440 } 3441 3442 /* 3443 * Prepare for a CPU private mapping for the given address. 3444 * 3445 * The address can only be used from a single CPU and can be remapped 3446 * using hat_mempte_remap(). Return the address of the PTE. 3447 * 3448 * We do the htable_create() if necessary and increment the valid count so 3449 * the htable can't disappear. We also hat_devload() the page table into 3450 * kernel so that the PTE is quickly accessed. 3451 */ 3452 hat_mempte_t 3453 hat_mempte_setup(caddr_t addr) 3454 { 3455 uintptr_t va = (uintptr_t)addr; 3456 htable_t *ht; 3457 uint_t entry; 3458 x86pte_t oldpte; 3459 hat_mempte_t p; 3460 3461 ASSERT(IS_PAGEALIGNED(va)); 3462 ASSERT(!IN_VA_HOLE(va)); 3463 ++curthread->t_hatdepth; 3464 ht = htable_getpte(kas.a_hat, va, &entry, &oldpte, 0); 3465 if (ht == NULL) { 3466 ht = htable_create(kas.a_hat, va, 0, NULL); 3467 entry = htable_va2entry(va, ht); 3468 ASSERT(ht->ht_level == 0); 3469 oldpte = x86pte_get(ht, entry); 3470 } 3471 if (PTE_ISVALID(oldpte)) 3472 panic("hat_mempte_setup(): address already mapped" 3473 "ht=%p, entry=%d, pte=" FMT_PTE, ht, entry, oldpte); 3474 3475 /* 3476 * increment ht_valid_cnt so that the pagetable can't disappear 3477 */ 3478 HTABLE_INC(ht->ht_valid_cnt); 3479 3480 /* 3481 * return the PTE physical address to the caller. 3482 */ 3483 htable_release(ht); 3484 p = PT_INDEX_PHYSADDR(pfn_to_pa(ht->ht_pfn), entry); 3485 --curthread->t_hatdepth; 3486 return (p); 3487 } 3488 3489 /* 3490 * Release a CPU private mapping for the given address. 3491 * We decrement the htable valid count so it might be destroyed. 3492 */ 3493 /*ARGSUSED1*/ 3494 void 3495 hat_mempte_release(caddr_t addr, hat_mempte_t pte_pa) 3496 { 3497 htable_t *ht; 3498 3499 /* 3500 * invalidate any left over mapping and decrement the htable valid count 3501 */ 3502 { 3503 x86pte_t *pteptr; 3504 3505 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3506 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3507 if (mmu.pae_hat) 3508 *pteptr = 0; 3509 else 3510 *(x86pte32_t *)pteptr = 0; 3511 mmu_tlbflush_entry(addr); 3512 x86pte_mapout(); 3513 } 3514 3515 ht = htable_getpte(kas.a_hat, ALIGN2PAGE(addr), NULL, NULL, 0); 3516 if (ht == NULL) 3517 panic("hat_mempte_release(): invalid address"); 3518 ASSERT(ht->ht_level == 0); 3519 HTABLE_DEC(ht->ht_valid_cnt); 3520 htable_release(ht); 3521 } 3522 3523 /* 3524 * Apply a temporary CPU private mapping to a page. We flush the TLB only 3525 * on this CPU, so this ought to have been called with preemption disabled. 3526 */ 3527 void 3528 hat_mempte_remap( 3529 pfn_t pfn, 3530 caddr_t addr, 3531 hat_mempte_t pte_pa, 3532 uint_t attr, 3533 uint_t flags) 3534 { 3535 uintptr_t va = (uintptr_t)addr; 3536 x86pte_t pte; 3537 3538 /* 3539 * Remap the given PTE to the new page's PFN. Invalidate only 3540 * on this CPU. 3541 */ 3542 #ifdef DEBUG 3543 htable_t *ht; 3544 uint_t entry; 3545 3546 ASSERT(IS_PAGEALIGNED(va)); 3547 ASSERT(!IN_VA_HOLE(va)); 3548 ht = htable_getpte(kas.a_hat, va, &entry, NULL, 0); 3549 ASSERT(ht != NULL); 3550 ASSERT(ht->ht_level == 0); 3551 ASSERT(ht->ht_valid_cnt > 0); 3552 ASSERT(ht->ht_pfn == mmu_btop(pte_pa)); 3553 htable_release(ht); 3554 #endif 3555 pte = hati_mkpte(pfn, attr, 0, flags); 3556 { 3557 x86pte_t *pteptr; 3558 3559 pteptr = x86pte_mapin(mmu_btop(pte_pa), 3560 (pte_pa & MMU_PAGEOFFSET) >> mmu.pte_size_shift, NULL); 3561 if (mmu.pae_hat) 3562 *(x86pte_t *)pteptr = pte; 3563 else 3564 *(x86pte32_t *)pteptr = (x86pte32_t)pte; 3565 mmu_tlbflush_entry(addr); 3566 x86pte_mapout(); 3567 } 3568 } 3569 3570 3571 3572 /* 3573 * Hat locking functions 3574 * XXX - these two functions are currently being used by hatstats 3575 * they can be removed by using a per-as mutex for hatstats. 3576 */ 3577 void 3578 hat_enter(hat_t *hat) 3579 { 3580 mutex_enter(&hat->hat_mutex); 3581 } 3582 3583 void 3584 hat_exit(hat_t *hat) 3585 { 3586 mutex_exit(&hat->hat_mutex); 3587 } 3588 3589 /* 3590 * HAT part of cpu initialization. 3591 */ 3592 void 3593 hat_cpu_online(struct cpu *cpup) 3594 { 3595 if (cpup != CPU) { 3596 x86pte_cpu_init(cpup); 3597 hat_vlp_setup(cpup); 3598 } 3599 CPUSET_ATOMIC_ADD(khat_cpuset, cpup->cpu_id); 3600 } 3601 3602 /* 3603 * HAT part of cpu deletion. 3604 * (currently, we only call this after the cpu is safely passivated.) 3605 */ 3606 void 3607 hat_cpu_offline(struct cpu *cpup) 3608 { 3609 ASSERT(cpup != CPU); 3610 3611 CPUSET_ATOMIC_DEL(khat_cpuset, cpup->cpu_id); 3612 x86pte_cpu_fini(cpup); 3613 hat_vlp_teardown(cpup); 3614 } 3615 3616 /* 3617 * Function called after all CPUs are brought online. 3618 * Used to remove low address boot mappings. 3619 */ 3620 void 3621 clear_boot_mappings(uintptr_t low, uintptr_t high) 3622 { 3623 uintptr_t vaddr = low; 3624 htable_t *ht = NULL; 3625 level_t level; 3626 uint_t entry; 3627 x86pte_t pte; 3628 3629 /* 3630 * On 1st CPU we can unload the prom mappings, basically we blow away 3631 * all virtual mappings under _userlimit. 3632 */ 3633 while (vaddr < high) { 3634 pte = htable_walk(kas.a_hat, &ht, &vaddr, high); 3635 if (ht == NULL) 3636 break; 3637 3638 level = ht->ht_level; 3639 entry = htable_va2entry(vaddr, ht); 3640 ASSERT(level <= mmu.max_page_level); 3641 ASSERT(PTE_ISPAGE(pte, level)); 3642 3643 /* 3644 * Unload the mapping from the page tables. 3645 */ 3646 (void) x86pte_inval(ht, entry, 0, NULL); 3647 ASSERT(ht->ht_valid_cnt > 0); 3648 HTABLE_DEC(ht->ht_valid_cnt); 3649 PGCNT_DEC(ht->ht_hat, ht->ht_level); 3650 3651 vaddr += LEVEL_SIZE(ht->ht_level); 3652 } 3653 if (ht) 3654 htable_release(ht); 3655 } 3656 3657 /* 3658 * Atomically update a new translation for a single page. If the 3659 * currently installed PTE doesn't match the value we expect to find, 3660 * it's not updated and we return the PTE we found. 3661 * 3662 * If activating nosync or NOWRITE and the page was modified we need to sync 3663 * with the page_t. Also sync with page_t if clearing ref/mod bits. 3664 */ 3665 static x86pte_t 3666 hati_update_pte(htable_t *ht, uint_t entry, x86pte_t expected, x86pte_t new) 3667 { 3668 page_t *pp; 3669 uint_t rm = 0; 3670 x86pte_t replaced; 3671 3672 if (PTE_GET(expected, PT_SOFTWARE) < PT_NOSYNC && 3673 PTE_GET(expected, PT_MOD | PT_REF) && 3674 (PTE_GET(new, PT_NOSYNC) || !PTE_GET(new, PT_WRITABLE) || 3675 !PTE_GET(new, PT_MOD | PT_REF))) { 3676 3677 ASSERT(!pfn_is_foreign(PTE2PFN(expected, ht->ht_level))); 3678 pp = page_numtopp_nolock(PTE2PFN(expected, ht->ht_level)); 3679 ASSERT(pp != NULL); 3680 if (PTE_GET(expected, PT_MOD)) 3681 rm |= P_MOD; 3682 if (PTE_GET(expected, PT_REF)) 3683 rm |= P_REF; 3684 PTE_CLR(new, PT_MOD | PT_REF); 3685 } 3686 3687 replaced = x86pte_update(ht, entry, expected, new); 3688 if (replaced != expected) 3689 return (replaced); 3690 3691 if (rm) { 3692 /* 3693 * sync to all constituent pages of a large page 3694 */ 3695 pgcnt_t pgcnt = page_get_pagecnt(ht->ht_level); 3696 ASSERT(IS_P2ALIGNED(pp->p_pagenum, pgcnt)); 3697 while (pgcnt-- > 0) { 3698 /* 3699 * hat_page_demote() can't decrease 3700 * pszc below this mapping size 3701 * since large mapping existed after we 3702 * took mlist lock. 3703 */ 3704 ASSERT(pp->p_szc >= ht->ht_level); 3705 hat_page_setattr(pp, rm); 3706 ++pp; 3707 } 3708 } 3709 3710 return (0); 3711 } 3712 3713 /* 3714 * Kernel Physical Mapping (kpm) facility 3715 * 3716 * Most of the routines needed to support segkpm are almost no-ops on the 3717 * x86 platform. We map in the entire segment when it is created and leave 3718 * it mapped in, so there is no additional work required to set up and tear 3719 * down individual mappings. All of these routines were created to support 3720 * SPARC platforms that have to avoid aliasing in their virtually indexed 3721 * caches. 3722 * 3723 * Most of the routines have sanity checks in them (e.g. verifying that the 3724 * passed-in page is locked). We don't actually care about most of these 3725 * checks on x86, but we leave them in place to identify problems in the 3726 * upper levels. 3727 */ 3728 3729 /* 3730 * Map in a locked page and return the vaddr. 3731 */ 3732 /*ARGSUSED*/ 3733 caddr_t 3734 hat_kpm_mapin(struct page *pp, struct kpme *kpme) 3735 { 3736 caddr_t vaddr; 3737 3738 #ifdef DEBUG 3739 if (kpm_enable == 0) { 3740 cmn_err(CE_WARN, "hat_kpm_mapin: kpm_enable not set\n"); 3741 return ((caddr_t)NULL); 3742 } 3743 3744 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 3745 cmn_err(CE_WARN, "hat_kpm_mapin: pp zero or not locked\n"); 3746 return ((caddr_t)NULL); 3747 } 3748 #endif 3749 3750 vaddr = hat_kpm_page2va(pp, 1); 3751 3752 return (vaddr); 3753 } 3754 3755 /* 3756 * Mapout a locked page. 3757 */ 3758 /*ARGSUSED*/ 3759 void 3760 hat_kpm_mapout(struct page *pp, struct kpme *kpme, caddr_t vaddr) 3761 { 3762 #ifdef DEBUG 3763 if (kpm_enable == 0) { 3764 cmn_err(CE_WARN, "hat_kpm_mapout: kpm_enable not set\n"); 3765 return; 3766 } 3767 3768 if (IS_KPM_ADDR(vaddr) == 0) { 3769 cmn_err(CE_WARN, "hat_kpm_mapout: no kpm address\n"); 3770 return; 3771 } 3772 3773 if (pp == NULL || PAGE_LOCKED(pp) == 0) { 3774 cmn_err(CE_WARN, "hat_kpm_mapout: page zero or not locked\n"); 3775 return; 3776 } 3777 #endif 3778 } 3779 3780 /* 3781 * Return the kpm virtual address for a specific pfn 3782 */ 3783 caddr_t 3784 hat_kpm_pfn2va(pfn_t pfn) 3785 { 3786 uintptr_t vaddr = (uintptr_t)kpm_vbase + mmu_ptob(pfn); 3787 3788 return ((caddr_t)vaddr); 3789 } 3790 3791 /* 3792 * Return the kpm virtual address for the page at pp. 3793 */ 3794 /*ARGSUSED*/ 3795 caddr_t 3796 hat_kpm_page2va(struct page *pp, int checkswap) 3797 { 3798 return (hat_kpm_pfn2va(pp->p_pagenum)); 3799 } 3800 3801 /* 3802 * Return the page frame number for the kpm virtual address vaddr. 3803 */ 3804 pfn_t 3805 hat_kpm_va2pfn(caddr_t vaddr) 3806 { 3807 pfn_t pfn; 3808 3809 ASSERT(IS_KPM_ADDR(vaddr)); 3810 3811 pfn = (pfn_t)btop(vaddr - kpm_vbase); 3812 3813 return (pfn); 3814 } 3815 3816 3817 /* 3818 * Return the page for the kpm virtual address vaddr. 3819 */ 3820 page_t * 3821 hat_kpm_vaddr2page(caddr_t vaddr) 3822 { 3823 pfn_t pfn; 3824 3825 ASSERT(IS_KPM_ADDR(vaddr)); 3826 3827 pfn = hat_kpm_va2pfn(vaddr); 3828 3829 return (page_numtopp_nolock(pfn)); 3830 } 3831 3832 /* 3833 * hat_kpm_fault is called from segkpm_fault when we take a page fault on a 3834 * KPM page. This should never happen on x86 3835 */ 3836 int 3837 hat_kpm_fault(hat_t *hat, caddr_t vaddr) 3838 { 3839 panic("pagefault in seg_kpm. hat: 0x%p vaddr: 0x%p", hat, vaddr); 3840 3841 return (0); 3842 } 3843 3844 /*ARGSUSED*/ 3845 void 3846 hat_kpm_mseghash_clear(int nentries) 3847 {} 3848 3849 /*ARGSUSED*/ 3850 void 3851 hat_kpm_mseghash_update(pgcnt_t inx, struct memseg *msp) 3852 {} 3853