1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 1996, by Steve Passe
5 * Copyright (c) 2003, by Peter Wemm
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. The name of the developer may NOT be used to endorse or promote products
14 * derived from this software without specific prior written permission.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 #include "opt_acpi.h"
31 #include "opt_cpu.h"
32 #include "opt_ddb.h"
33 #include "opt_kstack_pages.h"
34 #include "opt_sched.h"
35 #include "opt_smp.h"
36
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/bus.h>
40 #include <sys/cpuset.h>
41 #include <sys/domainset.h>
42 #ifdef GPROF
43 #include <sys/gmon.h>
44 #endif
45 #include <sys/kdb.h>
46 #include <sys/kernel.h>
47 #include <sys/ktr.h>
48 #include <sys/lock.h>
49 #include <sys/malloc.h>
50 #include <sys/memrange.h>
51 #include <sys/mutex.h>
52 #include <sys/pcpu.h>
53 #include <sys/proc.h>
54 #include <sys/sched.h>
55 #include <sys/smp.h>
56 #include <sys/sysctl.h>
57
58 #include <vm/vm.h>
59 #include <vm/vm_param.h>
60 #include <vm/pmap.h>
61 #include <vm/vm_kern.h>
62 #include <vm/vm_extern.h>
63 #include <vm/vm_page.h>
64 #include <vm/vm_phys.h>
65
66 #include <x86/apicreg.h>
67 #include <machine/clock.h>
68 #include <machine/cputypes.h>
69 #include <machine/cpufunc.h>
70 #include <x86/mca.h>
71 #include <machine/md_var.h>
72 #include <machine/pcb.h>
73 #include <machine/psl.h>
74 #include <machine/smp.h>
75 #include <machine/specialreg.h>
76 #include <machine/tss.h>
77 #include <x86/ucode.h>
78 #include <machine/cpu.h>
79 #include <x86/init.h>
80
81 #ifdef DEV_ACPI
82 #include <contrib/dev/acpica/include/acpi.h>
83 #include <dev/acpica/acpivar.h>
84 #endif
85
86 #define WARMBOOT_TARGET 0
87 #define WARMBOOT_OFF (KERNBASE + 0x0467)
88 #define WARMBOOT_SEG (KERNBASE + 0x0469)
89
90 #define CMOS_REG (0x70)
91 #define CMOS_DATA (0x71)
92 #define BIOS_RESET (0x0f)
93 #define BIOS_WARM (0x0a)
94
95 #define GiB(v) (v ## ULL << 30)
96
97 #define AP_BOOTPT_SZ (PAGE_SIZE * 4)
98
99 /* Temporary variables for init_secondary() */
100 char *doublefault_stack;
101 char *mce_stack;
102 char *nmi_stack;
103 char *dbg_stack;
104 void *bootpcpu;
105
106 extern u_int mptramp_la57;
107 extern u_int mptramp_nx;
108
109 /*
110 * Local data and functions.
111 */
112
113 static int start_ap(int apic_id, vm_paddr_t boot_address);
114
115 /*
116 * Initialize the IPI handlers and start up the AP's.
117 */
118 void
cpu_mp_start(void)119 cpu_mp_start(void)
120 {
121 int i;
122
123 /* Initialize the logical ID to APIC ID table. */
124 for (i = 0; i < MAXCPU; i++) {
125 cpu_apic_ids[i] = -1;
126 }
127
128 /* Install an inter-CPU IPI for cache and TLB invalidations. */
129 setidt(IPI_INVLOP, pti ? IDTVEC(invlop_pti) : IDTVEC(invlop),
130 SDT_SYSIGT, SEL_KPL, 0);
131
132 /* Install an inter-CPU IPI for all-CPU rendezvous */
133 setidt(IPI_RENDEZVOUS, pti ? IDTVEC(rendezvous_pti) :
134 IDTVEC(rendezvous), SDT_SYSIGT, SEL_KPL, 0);
135
136 /* Install generic inter-CPU IPI handler */
137 setidt(IPI_BITMAP_VECTOR, pti ? IDTVEC(ipi_intr_bitmap_handler_pti) :
138 IDTVEC(ipi_intr_bitmap_handler), SDT_SYSIGT, SEL_KPL, 0);
139
140 /* Install an inter-CPU IPI for CPU stop/restart */
141 setidt(IPI_STOP, pti ? IDTVEC(cpustop_pti) : IDTVEC(cpustop),
142 SDT_SYSIGT, SEL_KPL, 0);
143
144 /* Install an inter-CPU IPI for CPU suspend/resume */
145 setidt(IPI_SUSPEND, pti ? IDTVEC(cpususpend_pti) : IDTVEC(cpususpend),
146 SDT_SYSIGT, SEL_KPL, 0);
147
148 /* Install an IPI for calling delayed SWI */
149 setidt(IPI_SWI, pti ? IDTVEC(ipi_swi_pti) : IDTVEC(ipi_swi),
150 SDT_SYSIGT, SEL_KPL, 0);
151
152 /* Set boot_cpu_id if needed. */
153 if (boot_cpu_id == -1) {
154 boot_cpu_id = PCPU_GET(apic_id);
155 cpu_info[boot_cpu_id].cpu_bsp = 1;
156 } else
157 KASSERT(boot_cpu_id == PCPU_GET(apic_id),
158 ("BSP's APIC ID doesn't match boot_cpu_id"));
159
160 /* Probe logical/physical core configuration. */
161 topo_probe();
162
163 assign_cpu_ids();
164
165 mptramp_la57 = la57;
166 mptramp_nx = pg_nx != 0;
167 MPASS(kernel_pmap->pm_cr3 < (1UL << 32));
168 mptramp_pagetables = kernel_pmap->pm_cr3;
169
170 /* Start each Application Processor */
171 init_ops.start_all_aps();
172
173 set_interrupt_apic_ids();
174
175 #if defined(DEV_ACPI) && MAXMEMDOM > 1
176 acpi_pxm_set_cpu_locality();
177 #endif
178 }
179
180 /*
181 * AP CPU's call this to initialize themselves.
182 */
183 void
init_secondary(void)184 init_secondary(void)
185 {
186 struct pcpu *pc;
187 struct nmi_pcpu *np;
188 struct user_segment_descriptor *gdt;
189 struct region_descriptor ap_gdt;
190 u_int64_t cr0;
191 int cpu, gsel_tss, x;
192
193 /* Set by the startup code for us to use */
194 cpu = bootAP;
195
196 /* Update microcode before doing anything else. */
197 ucode_load_ap(cpu);
198
199 /* Initialize the PCPU area. */
200 pc = bootpcpu;
201 pcpu_init(pc, cpu, sizeof(struct pcpu));
202 dpcpu_init(dpcpu, cpu);
203 pc->pc_apic_id = cpu_apic_ids[cpu];
204 pc->pc_prvspace = pc;
205 pc->pc_curthread = 0;
206 pc->pc_tssp = &pc->pc_common_tss;
207 pc->pc_rsp0 = 0;
208 pc->pc_pti_rsp0 = (((vm_offset_t)&pc->pc_pti_stack +
209 PC_PTI_STACK_SZ * sizeof(uint64_t)) & ~0xful);
210 gdt = pc->pc_gdt;
211 pc->pc_tss = (struct system_segment_descriptor *)&gdt[GPROC0_SEL];
212 pc->pc_fs32p = &gdt[GUFS32_SEL];
213 pc->pc_gs32p = &gdt[GUGS32_SEL];
214 pc->pc_ldt = (struct system_segment_descriptor *)&gdt[GUSERLDT_SEL];
215 pc->pc_ucr3_load_mask = PMAP_UCR3_NOMASK;
216 /* See comment in pmap_bootstrap(). */
217 pc->pc_pcid_next = PMAP_PCID_KERN + 2;
218 pc->pc_pcid_gen = 1;
219
220 pc->pc_smp_tlb_gen = 1;
221
222 /* Init tss */
223 pc->pc_common_tss = __pcpu[0].pc_common_tss;
224 pc->pc_common_tss.tss_iobase = sizeof(struct amd64tss) +
225 IOPERM_BITMAP_SIZE;
226 pc->pc_common_tss.tss_rsp0 = 0;
227
228 /* The doublefault stack runs on IST1. */
229 np = ((struct nmi_pcpu *)&doublefault_stack[DBLFAULT_STACK_SIZE]) - 1;
230 np->np_pcpu = (register_t)pc;
231 pc->pc_common_tss.tss_ist1 = (long)np;
232
233 /* The NMI stack runs on IST2. */
234 np = ((struct nmi_pcpu *)&nmi_stack[NMI_STACK_SIZE]) - 1;
235 np->np_pcpu = (register_t)pc;
236 pc->pc_common_tss.tss_ist2 = (long)np;
237
238 /* The MC# stack runs on IST3. */
239 np = ((struct nmi_pcpu *)&mce_stack[MCE_STACK_SIZE]) - 1;
240 np->np_pcpu = (register_t)pc;
241 pc->pc_common_tss.tss_ist3 = (long)np;
242
243 /* The DB# stack runs on IST4. */
244 np = ((struct nmi_pcpu *)&dbg_stack[DBG_STACK_SIZE]) - 1;
245 np->np_pcpu = (register_t)pc;
246 pc->pc_common_tss.tss_ist4 = (long)np;
247
248 /* Prepare private GDT */
249 gdt_segs[GPROC0_SEL].ssd_base = (long)&pc->pc_common_tss;
250 for (x = 0; x < NGDT; x++) {
251 if (x != GPROC0_SEL && x != GPROC0_SEL + 1 &&
252 x != GUSERLDT_SEL && x != GUSERLDT_SEL + 1)
253 ssdtosd(&gdt_segs[x], &gdt[x]);
254 }
255 ssdtosyssd(&gdt_segs[GPROC0_SEL],
256 (struct system_segment_descriptor *)&gdt[GPROC0_SEL]);
257 ap_gdt.rd_limit = NGDT * sizeof(gdt[0]) - 1;
258 ap_gdt.rd_base = (u_long)gdt;
259 lgdt(&ap_gdt); /* does magic intra-segment return */
260
261 wrmsr(MSR_FSBASE, 0); /* User value */
262 wrmsr(MSR_GSBASE, (uint64_t)pc);
263 wrmsr(MSR_KGSBASE, 0); /* User value */
264 fix_cpuid();
265
266 lidt(&r_idt);
267
268 gsel_tss = GSEL(GPROC0_SEL, SEL_KPL);
269 ltr(gsel_tss);
270
271 /*
272 * Set to a known state:
273 * Set by mpboot.s: CR0_PG, CR0_PE
274 * Set by cpu_setregs: CR0_NE, CR0_MP, CR0_TS, CR0_WP, CR0_AM
275 */
276 cr0 = rcr0();
277 cr0 &= ~(CR0_CD | CR0_NW | CR0_EM);
278 load_cr0(cr0);
279
280 amd64_conf_fast_syscall();
281
282 /* signal our startup to the BSP. */
283 mp_naps++;
284
285 /* Spin until the BSP releases the AP's. */
286 while (atomic_load_acq_int(&aps_ready) == 0)
287 ia32_pause();
288
289 init_secondary_tail();
290 }
291
292 /*******************************************************************
293 * local functions and data
294 */
295
296 #ifdef NUMA
297 static void
mp_realloc_pcpu(int cpuid,int domain)298 mp_realloc_pcpu(int cpuid, int domain)
299 {
300 vm_page_t m;
301 vm_offset_t oa, na;
302
303 oa = (vm_offset_t)&__pcpu[cpuid];
304 if (vm_phys_domain(pmap_kextract(oa)) == domain)
305 return;
306 m = vm_page_alloc_noobj_domain(domain, 0);
307 if (m == NULL)
308 return;
309 na = PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m));
310 pagecopy((void *)oa, (void *)na);
311 pmap_qenter((vm_offset_t)&__pcpu[cpuid], &m, 1);
312 /* XXX old pcpu page leaked. */
313 }
314 #endif
315
316 /*
317 * start each AP in our list
318 */
319 int
native_start_all_aps(void)320 native_start_all_aps(void)
321 {
322 vm_page_t m_boottramp, m_pml4, m_pdp, m_pd[4];
323 pml5_entry_t old_pml45;
324 pml4_entry_t *v_pml4;
325 pdp_entry_t *v_pdp;
326 pd_entry_t *v_pd;
327 vm_paddr_t boot_address;
328 u_int32_t mpbioswarmvec;
329 int apic_id, cpu, domain, i;
330 u_char mpbiosreason;
331
332 mtx_init(&ap_boot_mtx, "ap boot", NULL, MTX_SPIN);
333
334 MPASS(bootMP_size <= PAGE_SIZE);
335 m_boottramp = vm_page_alloc_noobj_contig(0, 1, 0,
336 (1ULL << 20), /* Trampoline should be below 1M for real mode */
337 PAGE_SIZE, 0, VM_MEMATTR_DEFAULT);
338 boot_address = VM_PAGE_TO_PHYS(m_boottramp);
339
340 /* Create a transient 1:1 mapping of low 4G */
341 if (la57) {
342 m_pml4 = pmap_page_alloc_below_4g(true);
343 v_pml4 = (pml4_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pml4));
344 } else {
345 v_pml4 = &kernel_pmap->pm_pmltop[0];
346 }
347 m_pdp = pmap_page_alloc_below_4g(true);
348 v_pdp = (pdp_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pdp));
349 m_pd[0] = pmap_page_alloc_below_4g(false);
350 v_pd = (pd_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pd[0]));
351 for (i = 0; i < NPDEPG; i++)
352 v_pd[i] = (i << PDRSHIFT) | X86_PG_V | X86_PG_RW | X86_PG_A |
353 X86_PG_M | PG_PS;
354 m_pd[1] = pmap_page_alloc_below_4g(false);
355 v_pd = (pd_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pd[1]));
356 for (i = 0; i < NPDEPG; i++)
357 v_pd[i] = (NBPDP + (i << PDRSHIFT)) | X86_PG_V | X86_PG_RW |
358 X86_PG_A | X86_PG_M | PG_PS;
359 m_pd[2] = pmap_page_alloc_below_4g(false);
360 v_pd = (pd_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pd[2]));
361 for (i = 0; i < NPDEPG; i++)
362 v_pd[i] = (2UL * NBPDP + (i << PDRSHIFT)) | X86_PG_V |
363 X86_PG_RW | X86_PG_A | X86_PG_M | PG_PS;
364 m_pd[3] = pmap_page_alloc_below_4g(false);
365 v_pd = (pd_entry_t *)PHYS_TO_DMAP(VM_PAGE_TO_PHYS(m_pd[3]));
366 for (i = 0; i < NPDEPG; i++)
367 v_pd[i] = (3UL * NBPDP + (i << PDRSHIFT)) | X86_PG_V |
368 X86_PG_RW | X86_PG_A | X86_PG_M | PG_PS;
369 v_pdp[0] = VM_PAGE_TO_PHYS(m_pd[0]) | X86_PG_V |
370 X86_PG_RW | X86_PG_A | X86_PG_M;
371 v_pdp[1] = VM_PAGE_TO_PHYS(m_pd[1]) | X86_PG_V |
372 X86_PG_RW | X86_PG_A | X86_PG_M;
373 v_pdp[2] = VM_PAGE_TO_PHYS(m_pd[2]) | X86_PG_V |
374 X86_PG_RW | X86_PG_A | X86_PG_M;
375 v_pdp[3] = VM_PAGE_TO_PHYS(m_pd[3]) | X86_PG_V |
376 X86_PG_RW | X86_PG_A | X86_PG_M;
377 old_pml45 = kernel_pmap->pm_pmltop[0];
378 if (la57) {
379 kernel_pmap->pm_pmltop[0] = VM_PAGE_TO_PHYS(m_pml4) |
380 X86_PG_V | X86_PG_RW | X86_PG_A | X86_PG_M;
381 }
382 v_pml4[0] = VM_PAGE_TO_PHYS(m_pdp) | X86_PG_V |
383 X86_PG_RW | X86_PG_A | X86_PG_M;
384 pmap_invalidate_all(kernel_pmap);
385
386 /* copy the AP 1st level boot code */
387 bcopy(mptramp_start, (void *)PHYS_TO_DMAP(boot_address), bootMP_size);
388 if (bootverbose)
389 printf("AP boot address %#lx\n", boot_address);
390
391 /* save the current value of the warm-start vector */
392 if (!efi_boot)
393 mpbioswarmvec = *((u_int32_t *) WARMBOOT_OFF);
394 outb(CMOS_REG, BIOS_RESET);
395 mpbiosreason = inb(CMOS_DATA);
396
397 /* setup a vector to our boot code */
398 if (!efi_boot) {
399 *((volatile u_short *)WARMBOOT_OFF) = WARMBOOT_TARGET;
400 *((volatile u_short *)WARMBOOT_SEG) = (boot_address >> 4);
401 }
402 outb(CMOS_REG, BIOS_RESET);
403 outb(CMOS_DATA, BIOS_WARM); /* 'warm-start' */
404
405 /* Relocate pcpu areas to the correct domain. */
406 #ifdef NUMA
407 if (vm_ndomains > 1)
408 for (cpu = 1; cpu < mp_ncpus; cpu++) {
409 apic_id = cpu_apic_ids[cpu];
410 domain = acpi_pxm_get_cpu_locality(apic_id);
411 mp_realloc_pcpu(cpu, domain);
412 }
413 #endif
414
415 /* start each AP */
416 domain = 0;
417 for (cpu = 1; cpu < mp_ncpus; cpu++) {
418 apic_id = cpu_apic_ids[cpu];
419 #ifdef NUMA
420 if (vm_ndomains > 1)
421 domain = acpi_pxm_get_cpu_locality(apic_id);
422 #endif
423 /* allocate and set up an idle stack data page */
424 bootstacks[cpu] = (void *)kmem_malloc(kstack_pages * PAGE_SIZE,
425 M_WAITOK | M_ZERO);
426 doublefault_stack = (char *)kmem_malloc(DBLFAULT_STACK_SIZE,
427 M_WAITOK | M_ZERO);
428 mce_stack = (char *)kmem_malloc(MCE_STACK_SIZE,
429 M_WAITOK | M_ZERO);
430 nmi_stack = (char *)kmem_malloc_domainset(
431 DOMAINSET_PREF(domain), NMI_STACK_SIZE, M_WAITOK | M_ZERO);
432 dbg_stack = (char *)kmem_malloc_domainset(
433 DOMAINSET_PREF(domain), DBG_STACK_SIZE, M_WAITOK | M_ZERO);
434 dpcpu = (void *)kmem_malloc_domainset(DOMAINSET_PREF(domain),
435 DPCPU_SIZE, M_WAITOK | M_ZERO);
436
437 bootpcpu = &__pcpu[cpu];
438 bootSTK = (char *)bootstacks[cpu] +
439 kstack_pages * PAGE_SIZE - 8;
440 bootAP = cpu;
441
442 /* attempt to start the Application Processor */
443 if (!start_ap(apic_id, boot_address)) {
444 /* restore the warmstart vector */
445 if (!efi_boot)
446 *(u_int32_t *)WARMBOOT_OFF = mpbioswarmvec;
447 panic("AP #%d (PHY# %d) failed!", cpu, apic_id);
448 }
449
450 CPU_SET(cpu, &all_cpus); /* record AP in CPU map */
451 }
452
453 /* restore the warmstart vector */
454 if (!efi_boot)
455 *(u_int32_t *)WARMBOOT_OFF = mpbioswarmvec;
456
457 outb(CMOS_REG, BIOS_RESET);
458 outb(CMOS_DATA, mpbiosreason);
459
460 /* Destroy transient 1:1 mapping */
461 kernel_pmap->pm_pmltop[0] = old_pml45;
462 invlpg(0);
463 if (la57)
464 vm_page_free(m_pml4);
465 vm_page_free(m_pd[3]);
466 vm_page_free(m_pd[2]);
467 vm_page_free(m_pd[1]);
468 vm_page_free(m_pd[0]);
469 vm_page_free(m_pdp);
470 vm_page_free(m_boottramp);
471
472 /* number of APs actually started */
473 return (mp_naps);
474 }
475
476 /*
477 * This function starts the AP (application processor) identified
478 * by the APIC ID 'physicalCpu'. It does quite a "song and dance"
479 * to accomplish this. This is necessary because of the nuances
480 * of the different hardware we might encounter. It isn't pretty,
481 * but it seems to work.
482 */
483 static int
start_ap(int apic_id,vm_paddr_t boot_address)484 start_ap(int apic_id, vm_paddr_t boot_address)
485 {
486 int vector, ms;
487 int cpus;
488
489 /* calculate the vector */
490 vector = (boot_address >> 12) & 0xff;
491
492 /* used as a watchpoint to signal AP startup */
493 cpus = mp_naps;
494
495 ipi_startup(apic_id, vector);
496
497 /* Wait up to 5 seconds for it to start. */
498 for (ms = 0; ms < 5000; ms++) {
499 if (mp_naps > cpus)
500 return 1; /* return SUCCESS */
501 DELAY(1000);
502 }
503 return 0; /* return FAILURE */
504 }
505
506 /*
507 * Flush the TLB on other CPU's
508 */
509
510 /*
511 * Invalidation request. PCPU pc_smp_tlb_op uses u_int instead of the
512 * enum to avoid both namespace and ABI issues (with enums).
513 */
514 enum invl_op_codes {
515 INVL_OP_TLB = 1,
516 INVL_OP_TLB_INVPCID = 2,
517 INVL_OP_TLB_INVPCID_PTI = 3,
518 INVL_OP_TLB_PCID = 4,
519 INVL_OP_PGRNG = 5,
520 INVL_OP_PGRNG_INVPCID = 6,
521 INVL_OP_PGRNG_PCID = 7,
522 INVL_OP_PG = 8,
523 INVL_OP_PG_INVPCID = 9,
524 INVL_OP_PG_PCID = 10,
525 INVL_OP_CACHE = 11,
526 };
527
528 /*
529 * These variables are initialized at startup to reflect how each of
530 * the different kinds of invalidations should be performed on the
531 * current machine and environment.
532 */
533 static enum invl_op_codes invl_op_tlb;
534 static enum invl_op_codes invl_op_pgrng;
535 static enum invl_op_codes invl_op_pg;
536
537 /*
538 * Scoreboard of IPI completion notifications from target to IPI initiator.
539 *
540 * Each CPU can initiate shootdown IPI independently from other CPUs.
541 * Initiator enters critical section, then fills its local PCPU
542 * shootdown info (pc_smp_tlb_ vars), then clears scoreboard generation
543 * at location (cpu, my_cpuid) for each target cpu. After that IPI is
544 * sent to all targets which scan for zeroed scoreboard generation
545 * words. Upon finding such word the shootdown data is read from
546 * corresponding cpu's pcpu, and generation is set. Meantime initiator
547 * loops waiting for all zeroed generations in scoreboard to update.
548 */
549 static uint32_t *invl_scoreboard;
550
551 static void
invl_scoreboard_init(void * arg __unused)552 invl_scoreboard_init(void *arg __unused)
553 {
554 u_int i;
555
556 invl_scoreboard = malloc(sizeof(uint32_t) * (mp_maxid + 1) *
557 (mp_maxid + 1), M_DEVBUF, M_WAITOK);
558 for (i = 0; i < (mp_maxid + 1) * (mp_maxid + 1); i++)
559 invl_scoreboard[i] = 1;
560
561 if (pmap_pcid_enabled) {
562 if (invpcid_works) {
563 if (pti)
564 invl_op_tlb = INVL_OP_TLB_INVPCID_PTI;
565 else
566 invl_op_tlb = INVL_OP_TLB_INVPCID;
567 invl_op_pgrng = INVL_OP_PGRNG_INVPCID;
568 invl_op_pg = INVL_OP_PG_INVPCID;
569 } else {
570 invl_op_tlb = INVL_OP_TLB_PCID;
571 invl_op_pgrng = INVL_OP_PGRNG_PCID;
572 invl_op_pg = INVL_OP_PG_PCID;
573 }
574 } else {
575 invl_op_tlb = INVL_OP_TLB;
576 invl_op_pgrng = INVL_OP_PGRNG;
577 invl_op_pg = INVL_OP_PG;
578 }
579 }
580 SYSINIT(invl_ops, SI_SUB_SMP - 1, SI_ORDER_ANY, invl_scoreboard_init, NULL);
581
582 static uint32_t *
invl_scoreboard_getcpu(u_int cpu)583 invl_scoreboard_getcpu(u_int cpu)
584 {
585 return (invl_scoreboard + cpu * (mp_maxid + 1));
586 }
587
588 static uint32_t *
invl_scoreboard_slot(u_int cpu)589 invl_scoreboard_slot(u_int cpu)
590 {
591 return (invl_scoreboard_getcpu(cpu) + PCPU_GET(cpuid));
592 }
593
594 /*
595 * Used by the pmap to request cache or TLB invalidation on local and
596 * remote processors. Mask provides the set of remote CPUs that are
597 * to be signalled with the invalidation IPI. As an optimization, the
598 * curcpu_cb callback is invoked on the calling CPU in a critical
599 * section while waiting for the remote CPUs to complete the operation.
600 *
601 * The callback function is called unconditionally on the caller's
602 * underlying processor, even when this processor is not set in the
603 * mask. So, the callback function must be prepared to handle such
604 * spurious invocations.
605 *
606 * Interrupts must be enabled when calling the function with smp
607 * started, to avoid deadlock with other IPIs that are protected with
608 * smp_ipi_mtx spinlock at the initiator side.
609 *
610 * Function must be called with the thread pinned, and it unpins on
611 * completion.
612 */
613 static void
smp_targeted_tlb_shootdown(pmap_t pmap,vm_offset_t addr1,vm_offset_t addr2,smp_invl_cb_t curcpu_cb,enum invl_op_codes op)614 smp_targeted_tlb_shootdown(pmap_t pmap, vm_offset_t addr1, vm_offset_t addr2,
615 smp_invl_cb_t curcpu_cb, enum invl_op_codes op)
616 {
617 cpuset_t mask;
618 uint32_t generation, *p_cpudone;
619 int cpu;
620 bool is_all;
621
622 /*
623 * It is not necessary to signal other CPUs while booting or
624 * when in the debugger.
625 */
626 if (__predict_false(kdb_active || KERNEL_PANICKED() || !smp_started))
627 goto local_cb;
628
629 KASSERT(curthread->td_pinned > 0, ("curthread not pinned"));
630
631 /*
632 * Make a stable copy of the set of CPUs on which the pmap is active.
633 * See if we have to interrupt other CPUs.
634 */
635 CPU_COPY(pmap_invalidate_cpu_mask(pmap), &mask);
636 is_all = CPU_CMP(&mask, &all_cpus) == 0;
637 CPU_CLR(curcpu, &mask);
638 if (CPU_EMPTY(&mask))
639 goto local_cb;
640
641 /*
642 * Initiator must have interrupts enabled, which prevents
643 * non-invalidation IPIs that take smp_ipi_mtx spinlock,
644 * from deadlocking with us. On the other hand, preemption
645 * must be disabled to pin initiator to the instance of the
646 * pcpu pc_smp_tlb data and scoreboard line.
647 */
648 KASSERT((read_rflags() & PSL_I) != 0,
649 ("smp_targeted_tlb_shootdown: interrupts disabled"));
650 critical_enter();
651
652 PCPU_SET(smp_tlb_addr1, addr1);
653 PCPU_SET(smp_tlb_addr2, addr2);
654 PCPU_SET(smp_tlb_pmap, pmap);
655 generation = PCPU_GET(smp_tlb_gen);
656 if (++generation == 0)
657 generation = 1;
658 PCPU_SET(smp_tlb_gen, generation);
659 PCPU_SET(smp_tlb_op, op);
660 /* Fence between filling smp_tlb fields and clearing scoreboard. */
661 atomic_thread_fence_rel();
662
663 CPU_FOREACH_ISSET(cpu, &mask) {
664 KASSERT(*invl_scoreboard_slot(cpu) != 0,
665 ("IPI scoreboard is zero, initiator %d target %d",
666 curcpu, cpu));
667 *invl_scoreboard_slot(cpu) = 0;
668 }
669
670 /*
671 * IPI acts as a fence between writing to the scoreboard above
672 * (zeroing slot) and reading from it below (wait for
673 * acknowledgment).
674 */
675 if (is_all) {
676 ipi_all_but_self(IPI_INVLOP);
677 } else {
678 ipi_selected(mask, IPI_INVLOP);
679 }
680 curcpu_cb(pmap, addr1, addr2);
681 CPU_FOREACH_ISSET(cpu, &mask) {
682 p_cpudone = invl_scoreboard_slot(cpu);
683 while (atomic_load_int(p_cpudone) != generation)
684 ia32_pause();
685 }
686
687 /*
688 * Unpin before leaving critical section. If the thread owes
689 * preemption, this allows scheduler to select thread on any
690 * CPU from its cpuset.
691 */
692 sched_unpin();
693 critical_exit();
694
695 return;
696
697 local_cb:
698 critical_enter();
699 curcpu_cb(pmap, addr1, addr2);
700 sched_unpin();
701 critical_exit();
702 }
703
704 void
smp_masked_invltlb(pmap_t pmap,smp_invl_cb_t curcpu_cb)705 smp_masked_invltlb(pmap_t pmap, smp_invl_cb_t curcpu_cb)
706 {
707 smp_targeted_tlb_shootdown(pmap, 0, 0, curcpu_cb, invl_op_tlb);
708 #ifdef COUNT_XINVLTLB_HITS
709 ipi_global++;
710 #endif
711 }
712
713 void
smp_masked_invlpg(vm_offset_t addr,pmap_t pmap,smp_invl_cb_t curcpu_cb)714 smp_masked_invlpg(vm_offset_t addr, pmap_t pmap, smp_invl_cb_t curcpu_cb)
715 {
716 smp_targeted_tlb_shootdown(pmap, addr, 0, curcpu_cb, invl_op_pg);
717 #ifdef COUNT_XINVLTLB_HITS
718 ipi_page++;
719 #endif
720 }
721
722 void
smp_masked_invlpg_range(vm_offset_t addr1,vm_offset_t addr2,pmap_t pmap,smp_invl_cb_t curcpu_cb)723 smp_masked_invlpg_range(vm_offset_t addr1, vm_offset_t addr2, pmap_t pmap,
724 smp_invl_cb_t curcpu_cb)
725 {
726 smp_targeted_tlb_shootdown(pmap, addr1, addr2, curcpu_cb,
727 invl_op_pgrng);
728 #ifdef COUNT_XINVLTLB_HITS
729 ipi_range++;
730 ipi_range_size += (addr2 - addr1) / PAGE_SIZE;
731 #endif
732 }
733
734 void
smp_cache_flush(smp_invl_cb_t curcpu_cb)735 smp_cache_flush(smp_invl_cb_t curcpu_cb)
736 {
737 smp_targeted_tlb_shootdown(kernel_pmap, 0, 0, curcpu_cb, INVL_OP_CACHE);
738 }
739
740 /*
741 * Handlers for TLB related IPIs
742 */
743 static void
invltlb_handler(pmap_t smp_tlb_pmap)744 invltlb_handler(pmap_t smp_tlb_pmap)
745 {
746 #ifdef COUNT_XINVLTLB_HITS
747 xhits_gbl[PCPU_GET(cpuid)]++;
748 #endif /* COUNT_XINVLTLB_HITS */
749 #ifdef COUNT_IPIS
750 (*ipi_invltlb_counts[PCPU_GET(cpuid)])++;
751 #endif /* COUNT_IPIS */
752
753 if (smp_tlb_pmap == kernel_pmap)
754 invltlb_glob();
755 else
756 invltlb();
757 }
758
759 static void
invltlb_invpcid_handler(pmap_t smp_tlb_pmap)760 invltlb_invpcid_handler(pmap_t smp_tlb_pmap)
761 {
762 struct invpcid_descr d;
763
764 #ifdef COUNT_XINVLTLB_HITS
765 xhits_gbl[PCPU_GET(cpuid)]++;
766 #endif /* COUNT_XINVLTLB_HITS */
767 #ifdef COUNT_IPIS
768 (*ipi_invltlb_counts[PCPU_GET(cpuid)])++;
769 #endif /* COUNT_IPIS */
770
771 d.pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid;
772 d.pad = 0;
773 d.addr = 0;
774 invpcid(&d, smp_tlb_pmap == kernel_pmap ? INVPCID_CTXGLOB :
775 INVPCID_CTX);
776 }
777
778 static void
invltlb_invpcid_pti_handler(pmap_t smp_tlb_pmap)779 invltlb_invpcid_pti_handler(pmap_t smp_tlb_pmap)
780 {
781 struct invpcid_descr d;
782
783 #ifdef COUNT_XINVLTLB_HITS
784 xhits_gbl[PCPU_GET(cpuid)]++;
785 #endif /* COUNT_XINVLTLB_HITS */
786 #ifdef COUNT_IPIS
787 (*ipi_invltlb_counts[PCPU_GET(cpuid)])++;
788 #endif /* COUNT_IPIS */
789
790 d.pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid;
791 d.pad = 0;
792 d.addr = 0;
793 if (smp_tlb_pmap == kernel_pmap) {
794 /*
795 * This invalidation actually needs to clear kernel
796 * mappings from the TLB in the current pmap, but
797 * since we were asked for the flush in the kernel
798 * pmap, achieve it by performing global flush.
799 */
800 invpcid(&d, INVPCID_CTXGLOB);
801 } else {
802 invpcid(&d, INVPCID_CTX);
803 if (smp_tlb_pmap == PCPU_GET(curpmap))
804 PCPU_SET(ucr3_load_mask, ~CR3_PCID_SAVE);
805 }
806 }
807
808 static void
invltlb_pcid_handler(pmap_t smp_tlb_pmap)809 invltlb_pcid_handler(pmap_t smp_tlb_pmap)
810 {
811 uint32_t pcid;
812
813 #ifdef COUNT_XINVLTLB_HITS
814 xhits_gbl[PCPU_GET(cpuid)]++;
815 #endif /* COUNT_XINVLTLB_HITS */
816 #ifdef COUNT_IPIS
817 (*ipi_invltlb_counts[PCPU_GET(cpuid)])++;
818 #endif /* COUNT_IPIS */
819
820 if (smp_tlb_pmap == kernel_pmap) {
821 invltlb_glob();
822 } else {
823 /*
824 * The current pmap might not be equal to
825 * smp_tlb_pmap. The clearing of the pm_gen in
826 * pmap_invalidate_all() takes care of TLB
827 * invalidation when switching to the pmap on this
828 * CPU.
829 */
830 if (smp_tlb_pmap == PCPU_GET(curpmap)) {
831 pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid;
832 load_cr3(smp_tlb_pmap->pm_cr3 | pcid);
833 if (smp_tlb_pmap->pm_ucr3 != PMAP_NO_CR3)
834 PCPU_SET(ucr3_load_mask, ~CR3_PCID_SAVE);
835 }
836 }
837 }
838
839 static void
invlpg_handler(vm_offset_t smp_tlb_addr1)840 invlpg_handler(vm_offset_t smp_tlb_addr1)
841 {
842 #ifdef COUNT_XINVLTLB_HITS
843 xhits_pg[PCPU_GET(cpuid)]++;
844 #endif /* COUNT_XINVLTLB_HITS */
845 #ifdef COUNT_IPIS
846 (*ipi_invlpg_counts[PCPU_GET(cpuid)])++;
847 #endif /* COUNT_IPIS */
848
849 invlpg(smp_tlb_addr1);
850 }
851
852 static void
invlpg_invpcid_handler(pmap_t smp_tlb_pmap,vm_offset_t smp_tlb_addr1)853 invlpg_invpcid_handler(pmap_t smp_tlb_pmap, vm_offset_t smp_tlb_addr1)
854 {
855 struct invpcid_descr d;
856
857 #ifdef COUNT_XINVLTLB_HITS
858 xhits_pg[PCPU_GET(cpuid)]++;
859 #endif /* COUNT_XINVLTLB_HITS */
860 #ifdef COUNT_IPIS
861 (*ipi_invlpg_counts[PCPU_GET(cpuid)])++;
862 #endif /* COUNT_IPIS */
863
864 pmap_invlpg(smp_tlb_pmap, smp_tlb_addr1);
865 if (smp_tlb_pmap == PCPU_GET(curpmap) &&
866 smp_tlb_pmap->pm_ucr3 != PMAP_NO_CR3 &&
867 PCPU_GET(ucr3_load_mask) == PMAP_UCR3_NOMASK) {
868 d.pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid |
869 PMAP_PCID_USER_PT;
870 d.pad = 0;
871 d.addr = smp_tlb_addr1;
872 invpcid(&d, INVPCID_ADDR);
873 }
874 }
875
876 static void
invlpg_pcid_handler(pmap_t smp_tlb_pmap,vm_offset_t smp_tlb_addr1)877 invlpg_pcid_handler(pmap_t smp_tlb_pmap, vm_offset_t smp_tlb_addr1)
878 {
879 uint64_t kcr3, ucr3;
880 uint32_t pcid;
881
882 #ifdef COUNT_XINVLTLB_HITS
883 xhits_pg[PCPU_GET(cpuid)]++;
884 #endif /* COUNT_XINVLTLB_HITS */
885 #ifdef COUNT_IPIS
886 (*ipi_invlpg_counts[PCPU_GET(cpuid)])++;
887 #endif /* COUNT_IPIS */
888
889 invlpg(smp_tlb_addr1);
890 if (smp_tlb_pmap == PCPU_GET(curpmap) &&
891 (ucr3 = smp_tlb_pmap->pm_ucr3) != PMAP_NO_CR3 &&
892 PCPU_GET(ucr3_load_mask) == PMAP_UCR3_NOMASK) {
893 pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid;
894 kcr3 = smp_tlb_pmap->pm_cr3 | pcid | CR3_PCID_SAVE;
895 ucr3 |= pcid | PMAP_PCID_USER_PT | CR3_PCID_SAVE;
896 pmap_pti_pcid_invlpg(ucr3, kcr3, smp_tlb_addr1);
897 }
898 }
899
900 static void
invlrng_handler(vm_offset_t smp_tlb_addr1,vm_offset_t smp_tlb_addr2)901 invlrng_handler(vm_offset_t smp_tlb_addr1, vm_offset_t smp_tlb_addr2)
902 {
903 vm_offset_t addr;
904
905 #ifdef COUNT_XINVLTLB_HITS
906 xhits_rng[PCPU_GET(cpuid)]++;
907 #endif /* COUNT_XINVLTLB_HITS */
908 #ifdef COUNT_IPIS
909 (*ipi_invlrng_counts[PCPU_GET(cpuid)])++;
910 #endif /* COUNT_IPIS */
911
912 addr = smp_tlb_addr1;
913 do {
914 invlpg(addr);
915 addr += PAGE_SIZE;
916 } while (addr < smp_tlb_addr2);
917 }
918
919 static void
invlrng_invpcid_handler(pmap_t smp_tlb_pmap,vm_offset_t smp_tlb_addr1,vm_offset_t smp_tlb_addr2)920 invlrng_invpcid_handler(pmap_t smp_tlb_pmap, vm_offset_t smp_tlb_addr1,
921 vm_offset_t smp_tlb_addr2)
922 {
923 struct invpcid_descr d;
924 vm_offset_t addr;
925
926 #ifdef COUNT_XINVLTLB_HITS
927 xhits_rng[PCPU_GET(cpuid)]++;
928 #endif /* COUNT_XINVLTLB_HITS */
929 #ifdef COUNT_IPIS
930 (*ipi_invlrng_counts[PCPU_GET(cpuid)])++;
931 #endif /* COUNT_IPIS */
932
933 addr = smp_tlb_addr1;
934 if (smp_tlb_pmap == kernel_pmap && PCPU_GET(pcid_invlpg_workaround)) {
935 struct invpcid_descr d = { 0 };
936
937 invpcid(&d, INVPCID_CTXGLOB);
938 } else {
939 do {
940 invlpg(addr);
941 addr += PAGE_SIZE;
942 } while (addr < smp_tlb_addr2);
943 }
944 if (smp_tlb_pmap == PCPU_GET(curpmap) &&
945 smp_tlb_pmap->pm_ucr3 != PMAP_NO_CR3 &&
946 PCPU_GET(ucr3_load_mask) == PMAP_UCR3_NOMASK) {
947 d.pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid |
948 PMAP_PCID_USER_PT;
949 d.pad = 0;
950 d.addr = smp_tlb_addr1;
951 do {
952 invpcid(&d, INVPCID_ADDR);
953 d.addr += PAGE_SIZE;
954 } while (d.addr < smp_tlb_addr2);
955 }
956 }
957
958 static void
invlrng_pcid_handler(pmap_t smp_tlb_pmap,vm_offset_t smp_tlb_addr1,vm_offset_t smp_tlb_addr2)959 invlrng_pcid_handler(pmap_t smp_tlb_pmap, vm_offset_t smp_tlb_addr1,
960 vm_offset_t smp_tlb_addr2)
961 {
962 vm_offset_t addr;
963 uint64_t kcr3, ucr3;
964 uint32_t pcid;
965
966 #ifdef COUNT_XINVLTLB_HITS
967 xhits_rng[PCPU_GET(cpuid)]++;
968 #endif /* COUNT_XINVLTLB_HITS */
969 #ifdef COUNT_IPIS
970 (*ipi_invlrng_counts[PCPU_GET(cpuid)])++;
971 #endif /* COUNT_IPIS */
972
973 addr = smp_tlb_addr1;
974 do {
975 invlpg(addr);
976 addr += PAGE_SIZE;
977 } while (addr < smp_tlb_addr2);
978 if (smp_tlb_pmap == PCPU_GET(curpmap) &&
979 (ucr3 = smp_tlb_pmap->pm_ucr3) != PMAP_NO_CR3 &&
980 PCPU_GET(ucr3_load_mask) == PMAP_UCR3_NOMASK) {
981 pcid = smp_tlb_pmap->pm_pcids[PCPU_GET(cpuid)].pm_pcid;
982 kcr3 = smp_tlb_pmap->pm_cr3 | pcid | CR3_PCID_SAVE;
983 ucr3 |= pcid | PMAP_PCID_USER_PT | CR3_PCID_SAVE;
984 pmap_pti_pcid_invlrng(ucr3, kcr3, smp_tlb_addr1, smp_tlb_addr2);
985 }
986 }
987
988 static void
invlcache_handler(void)989 invlcache_handler(void)
990 {
991 #ifdef COUNT_IPIS
992 (*ipi_invlcache_counts[PCPU_GET(cpuid)])++;
993 #endif /* COUNT_IPIS */
994 wbinvd();
995 }
996
997 static void
invlop_handler_one_req(enum invl_op_codes smp_tlb_op,pmap_t smp_tlb_pmap,vm_offset_t smp_tlb_addr1,vm_offset_t smp_tlb_addr2)998 invlop_handler_one_req(enum invl_op_codes smp_tlb_op, pmap_t smp_tlb_pmap,
999 vm_offset_t smp_tlb_addr1, vm_offset_t smp_tlb_addr2)
1000 {
1001 switch (smp_tlb_op) {
1002 case INVL_OP_TLB:
1003 invltlb_handler(smp_tlb_pmap);
1004 break;
1005 case INVL_OP_TLB_INVPCID:
1006 invltlb_invpcid_handler(smp_tlb_pmap);
1007 break;
1008 case INVL_OP_TLB_INVPCID_PTI:
1009 invltlb_invpcid_pti_handler(smp_tlb_pmap);
1010 break;
1011 case INVL_OP_TLB_PCID:
1012 invltlb_pcid_handler(smp_tlb_pmap);
1013 break;
1014 case INVL_OP_PGRNG:
1015 invlrng_handler(smp_tlb_addr1, smp_tlb_addr2);
1016 break;
1017 case INVL_OP_PGRNG_INVPCID:
1018 invlrng_invpcid_handler(smp_tlb_pmap, smp_tlb_addr1,
1019 smp_tlb_addr2);
1020 break;
1021 case INVL_OP_PGRNG_PCID:
1022 invlrng_pcid_handler(smp_tlb_pmap, smp_tlb_addr1,
1023 smp_tlb_addr2);
1024 break;
1025 case INVL_OP_PG:
1026 invlpg_handler(smp_tlb_addr1);
1027 break;
1028 case INVL_OP_PG_INVPCID:
1029 invlpg_invpcid_handler(smp_tlb_pmap, smp_tlb_addr1);
1030 break;
1031 case INVL_OP_PG_PCID:
1032 invlpg_pcid_handler(smp_tlb_pmap, smp_tlb_addr1);
1033 break;
1034 case INVL_OP_CACHE:
1035 invlcache_handler();
1036 break;
1037 default:
1038 __assert_unreachable();
1039 break;
1040 }
1041 }
1042
1043 void
invlop_handler(void)1044 invlop_handler(void)
1045 {
1046 struct pcpu *initiator_pc;
1047 pmap_t smp_tlb_pmap;
1048 vm_offset_t smp_tlb_addr1, smp_tlb_addr2;
1049 u_int initiator_cpu_id;
1050 enum invl_op_codes smp_tlb_op;
1051 uint32_t *scoreboard, smp_tlb_gen;
1052
1053 scoreboard = invl_scoreboard_getcpu(PCPU_GET(cpuid));
1054 for (;;) {
1055 for (initiator_cpu_id = 0; initiator_cpu_id <= mp_maxid;
1056 initiator_cpu_id++) {
1057 if (atomic_load_int(&scoreboard[initiator_cpu_id]) == 0)
1058 break;
1059 }
1060 if (initiator_cpu_id > mp_maxid)
1061 break;
1062 initiator_pc = cpuid_to_pcpu[initiator_cpu_id];
1063
1064 /*
1065 * This acquire fence and its corresponding release
1066 * fence in smp_targeted_tlb_shootdown() is between
1067 * reading zero scoreboard slot and accessing PCPU of
1068 * initiator for pc_smp_tlb values.
1069 */
1070 atomic_thread_fence_acq();
1071 smp_tlb_pmap = initiator_pc->pc_smp_tlb_pmap;
1072 smp_tlb_addr1 = initiator_pc->pc_smp_tlb_addr1;
1073 smp_tlb_addr2 = initiator_pc->pc_smp_tlb_addr2;
1074 smp_tlb_op = initiator_pc->pc_smp_tlb_op;
1075 smp_tlb_gen = initiator_pc->pc_smp_tlb_gen;
1076
1077 /*
1078 * Ensure that we do not make our scoreboard
1079 * notification visible to the initiator until the
1080 * pc_smp_tlb values are read. The corresponding
1081 * fence is implicitly provided by the barrier in the
1082 * IPI send operation before the APIC ICR register
1083 * write.
1084 *
1085 * As an optimization, the request is acknowledged
1086 * before the actual invalidation is performed. It is
1087 * safe because target CPU cannot return to userspace
1088 * before handler finishes. Only NMI can preempt the
1089 * handler, but NMI would see the kernel handler frame
1090 * and not touch not-invalidated user page table.
1091 */
1092 atomic_thread_fence_acq();
1093 atomic_store_int(&scoreboard[initiator_cpu_id], smp_tlb_gen);
1094
1095 invlop_handler_one_req(smp_tlb_op, smp_tlb_pmap, smp_tlb_addr1,
1096 smp_tlb_addr2);
1097 }
1098 }
1099