1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 /*
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  */
  27 
  28 /*
  29  * VM - Hardware Address Translation management for Spitfire MMU.
  30  *
  31  * This file implements the machine specific hardware translation
  32  * needed by the VM system.  The machine independent interface is
  33  * described in <vm/hat.h> while the machine dependent interface
  34  * and data structures are described in <vm/hat_sfmmu.h>.
  35  *
  36  * The hat layer manages the address translation hardware as a cache
  37  * driven by calls from the higher levels in the VM system.
  38  */
  39 
  40 #include <sys/types.h>
  41 #include <sys/kstat.h>
  42 #include <vm/hat.h>
  43 #include <vm/hat_sfmmu.h>
  44 #include <vm/page.h>
  45 #include <sys/pte.h>
  46 #include <sys/systm.h>
  47 #include <sys/mman.h>
  48 #include <sys/sysmacros.h>
  49 #include <sys/machparam.h>
  50 #include <sys/vtrace.h>
  51 #include <sys/kmem.h>
  52 #include <sys/mmu.h>
  53 #include <sys/cmn_err.h>
  54 #include <sys/cpu.h>
  55 #include <sys/cpuvar.h>
  56 #include <sys/debug.h>
  57 #include <sys/lgrp.h>
  58 #include <sys/archsystm.h>
  59 #include <sys/machsystm.h>
  60 #include <sys/vmsystm.h>
  61 #include <vm/as.h>
  62 #include <vm/seg.h>
  63 #include <vm/seg_kp.h>
  64 #include <vm/seg_kmem.h>
  65 #include <vm/seg_kpm.h>
  66 #include <vm/rm.h>
  67 #include <sys/t_lock.h>
  68 #include <sys/obpdefs.h>
  69 #include <sys/vm_machparam.h>
  70 #include <sys/var.h>
  71 #include <sys/trap.h>
  72 #include <sys/machtrap.h>
  73 #include <sys/scb.h>
  74 #include <sys/bitmap.h>
  75 #include <sys/machlock.h>
  76 #include <sys/membar.h>
  77 #include <sys/atomic.h>
  78 #include <sys/cpu_module.h>
  79 #include <sys/prom_debug.h>
  80 #include <sys/ksynch.h>
  81 #include <sys/mem_config.h>
  82 #include <sys/mem_cage.h>
  83 #include <vm/vm_dep.h>
  84 #include <sys/fpu/fpusystm.h>
  85 #include <vm/mach_kpm.h>
  86 #include <sys/callb.h>
  87 
  88 #ifdef  DEBUG
  89 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)                     \
  90         if (SFMMU_IS_SHMERID_VALID(rid)) {                              \
  91                 caddr_t _eaddr = (saddr) + (len);                       \
  92                 sf_srd_t *_srdp;                                        \
  93                 sf_region_t *_rgnp;                                     \
  94                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                       \
  95                 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid));       \
  96                 ASSERT((hat) != ksfmmup);                               \
  97                 _srdp = (hat)->sfmmu_srdp;                           \
  98                 ASSERT(_srdp != NULL);                                  \
  99                 ASSERT(_srdp->srd_refcnt != 0);                              \
 100                 _rgnp = _srdp->srd_hmergnp[(rid)];                   \
 101                 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid);               \
 102                 ASSERT(_rgnp->rgn_refcnt != 0);                              \
 103                 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
 104                 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 105                     SFMMU_REGION_HME);                                  \
 106                 ASSERT((saddr) >= _rgnp->rgn_saddr);                      \
 107                 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 108                 ASSERT(_eaddr > _rgnp->rgn_saddr);                        \
 109                 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 110         }
 111 
 112 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)              \
 113 {                                                                        \
 114                 caddr_t _hsva;                                           \
 115                 caddr_t _heva;                                           \
 116                 caddr_t _rsva;                                           \
 117                 caddr_t _reva;                                           \
 118                 int     _ttesz = get_hblk_ttesz(hmeblkp);                \
 119                 int     _flagtte;                                        \
 120                 ASSERT((srdp)->srd_refcnt != 0);                      \
 121                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                        \
 122                 ASSERT((rgnp)->rgn_id == rid);                                \
 123                 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE));         \
 124                 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 125                     SFMMU_REGION_HME);                                   \
 126                 ASSERT(_ttesz <= (rgnp)->rgn_pgszc);                       \
 127                 _hsva = (caddr_t)get_hblk_base(hmeblkp);                 \
 128                 _heva = get_hblk_endaddr(hmeblkp);                       \
 129                 _rsva = (caddr_t)P2ALIGN(                                \
 130                     (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES);    \
 131                 _reva = (caddr_t)P2ROUNDUP(                              \
 132                     (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size),     \
 133                     HBLK_MIN_BYTES);                                     \
 134                 ASSERT(_hsva >= _rsva);                                       \
 135                 ASSERT(_hsva < _reva);                                        \
 136                 ASSERT(_heva > _rsva);                                        \
 137                 ASSERT(_heva <= _reva);                                       \
 138                 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ :  \
 139                         _ttesz;                                          \
 140                 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte));             \
 141 }
 142 
 143 #else /* DEBUG */
 144 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
 145 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
 146 #endif /* DEBUG */
 147 
 148 #if defined(SF_ERRATA_57)
 149 extern caddr_t errata57_limit;
 150 #endif
 151 
 152 #define HME8BLK_SZ_RND          ((roundup(HME8BLK_SZ, sizeof (int64_t))) /  \
 153                                 (sizeof (int64_t)))
 154 #define HBLK_RESERVE            ((struct hme_blk *)hblk_reserve)
 155 
 156 #define HBLK_RESERVE_CNT        128
 157 #define HBLK_RESERVE_MIN        20
 158 
 159 static struct hme_blk           *freehblkp;
 160 static kmutex_t                 freehblkp_lock;
 161 static int                      freehblkcnt;
 162 
 163 static int64_t                  hblk_reserve[HME8BLK_SZ_RND];
 164 static kmutex_t                 hblk_reserve_lock;
 165 static kthread_t                *hblk_reserve_thread;
 166 
 167 static nucleus_hblk8_info_t     nucleus_hblk8;
 168 static nucleus_hblk1_info_t     nucleus_hblk1;
 169 
 170 /*
 171  * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
 172  * after the initial phase of removing an hmeblk from the hash chain, see
 173  * the detailed comment in sfmmu_hblk_hash_rm() for further details.
 174  */
 175 static cpu_hme_pend_t           *cpu_hme_pend;
 176 static uint_t                   cpu_hme_pend_thresh;
 177 /*
 178  * SFMMU specific hat functions
 179  */
 180 void    hat_pagecachectl(struct page *, int);
 181 
 182 /* flags for hat_pagecachectl */
 183 #define HAT_CACHE       0x1
 184 #define HAT_UNCACHE     0x2
 185 #define HAT_TMPNC       0x4
 186 
 187 /*
 188  * Flag to allow the creation of non-cacheable translations
 189  * to system memory. It is off by default. At the moment this
 190  * flag is used by the ecache error injector. The error injector
 191  * will turn it on when creating such a translation then shut it
 192  * off when it's finished.
 193  */
 194 
 195 int     sfmmu_allow_nc_trans = 0;
 196 
 197 /*
 198  * Flag to disable large page support.
 199  *      value of 1 => disable all large pages.
 200  *      bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
 201  *
 202  * For example, use the value 0x4 to disable 512K pages.
 203  *
 204  */
 205 #define LARGE_PAGES_OFF         0x1
 206 
 207 /*
 208  * The disable_large_pages and disable_ism_large_pages variables control
 209  * hat_memload_array and the page sizes to be used by ISM and the kernel.
 210  *
 211  * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
 212  * are only used to control which OOB pages to use at upper VM segment creation
 213  * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
 214  * Their values may come from platform or CPU specific code to disable page
 215  * sizes that should not be used.
 216  *
 217  * WARNING: 512K pages are currently not supported for ISM/DISM.
 218  */
 219 uint_t  disable_large_pages = 0;
 220 uint_t  disable_ism_large_pages = (1 << TTE512K);
 221 uint_t  disable_auto_data_large_pages = 0;
 222 uint_t  disable_auto_text_large_pages = 0;
 223 
 224 /*
 225  * Private sfmmu data structures for hat management
 226  */
 227 static struct kmem_cache *sfmmuid_cache;
 228 static struct kmem_cache *mmuctxdom_cache;
 229 
 230 /*
 231  * Private sfmmu data structures for tsb management
 232  */
 233 static struct kmem_cache *sfmmu_tsbinfo_cache;
 234 static struct kmem_cache *sfmmu_tsb8k_cache;
 235 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
 236 static vmem_t *kmem_bigtsb_arena;
 237 static vmem_t *kmem_tsb_arena;
 238 
 239 /*
 240  * sfmmu static variables for hmeblk resource management.
 241  */
 242 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
 243 static struct kmem_cache *sfmmu8_cache;
 244 static struct kmem_cache *sfmmu1_cache;
 245 static struct kmem_cache *pa_hment_cache;
 246 
 247 static kmutex_t         ism_mlist_lock; /* mutex for ism mapping list */
 248 /*
 249  * private data for ism
 250  */
 251 static struct kmem_cache *ism_blk_cache;
 252 static struct kmem_cache *ism_ment_cache;
 253 #define ISMID_STARTADDR NULL
 254 
 255 /*
 256  * Region management data structures and function declarations.
 257  */
 258 
 259 static void     sfmmu_leave_srd(sfmmu_t *);
 260 static int      sfmmu_srdcache_constructor(void *, void *, int);
 261 static void     sfmmu_srdcache_destructor(void *, void *);
 262 static int      sfmmu_rgncache_constructor(void *, void *, int);
 263 static void     sfmmu_rgncache_destructor(void *, void *);
 264 static int      sfrgnmap_isnull(sf_region_map_t *);
 265 static int      sfhmergnmap_isnull(sf_hmeregion_map_t *);
 266 static int      sfmmu_scdcache_constructor(void *, void *, int);
 267 static void     sfmmu_scdcache_destructor(void *, void *);
 268 static void     sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
 269     size_t, void *, u_offset_t);
 270 
 271 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
 272 static sf_srd_bucket_t *srd_buckets;
 273 static struct kmem_cache *srd_cache;
 274 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
 275 static struct kmem_cache *region_cache;
 276 static struct kmem_cache *scd_cache;
 277 
 278 #ifdef sun4v
 279 int use_bigtsb_arena = 1;
 280 #else
 281 int use_bigtsb_arena = 0;
 282 #endif
 283 
 284 /* External /etc/system tunable, for turning on&off the shctx support */
 285 int disable_shctx = 0;
 286 /* Internal variable, set by MD if the HW supports shctx feature */
 287 int shctx_on = 0;
 288 
 289 #ifdef DEBUG
 290 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
 291 #endif
 292 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
 293 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
 294 
 295 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
 296 static void sfmmu_find_scd(sfmmu_t *);
 297 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
 298 static void sfmmu_finish_join_scd(sfmmu_t *);
 299 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
 300 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
 301 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
 302 static void sfmmu_free_scd_tsbs(sfmmu_t *);
 303 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
 304 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
 305 static void sfmmu_ism_hatflags(sfmmu_t *, int);
 306 static int sfmmu_srd_lock_held(sf_srd_t *);
 307 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
 308 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
 309 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
 310 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
 311 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
 312 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
 313 
 314 /*
 315  * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
 316  * HAT flags, synchronizing TLB/TSB coherency, and context management.
 317  * The lock is hashed on the sfmmup since the case where we need to lock
 318  * all processes is rare but does occur (e.g. we need to unload a shared
 319  * mapping from all processes using the mapping).  We have a lot of buckets,
 320  * and each slab of sfmmu_t's can use about a quarter of them, giving us
 321  * a fairly good distribution without wasting too much space and overhead
 322  * when we have to grab them all.
 323  */
 324 #define SFMMU_NUM_LOCK  128             /* must be power of two */
 325 hatlock_t       hat_lock[SFMMU_NUM_LOCK];
 326 
 327 /*
 328  * Hash algorithm optimized for a small number of slabs.
 329  *  7 is (highbit((sizeof sfmmu_t)) - 1)
 330  * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
 331  * kmem_cache, and thus they will be sequential within that cache.  In
 332  * addition, each new slab will have a different "color" up to cache_maxcolor
 333  * which will skew the hashing for each successive slab which is allocated.
 334  * If the size of sfmmu_t changed to a larger size, this algorithm may need
 335  * to be revisited.
 336  */
 337 #define TSB_HASH_SHIFT_BITS (7)
 338 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
 339 
 340 #ifdef DEBUG
 341 int tsb_hash_debug = 0;
 342 #define TSB_HASH(sfmmup)        \
 343         (tsb_hash_debug ? &hat_lock[0] : \
 344         &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
 345 #else   /* DEBUG */
 346 #define TSB_HASH(sfmmup)        &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
 347 #endif  /* DEBUG */
 348 
 349 
 350 /* sfmmu_replace_tsb() return codes. */
 351 typedef enum tsb_replace_rc {
 352         TSB_SUCCESS,
 353         TSB_ALLOCFAIL,
 354         TSB_LOSTRACE,
 355         TSB_ALREADY_SWAPPED,
 356         TSB_CANTGROW
 357 } tsb_replace_rc_t;
 358 
 359 /*
 360  * Flags for TSB allocation routines.
 361  */
 362 #define TSB_ALLOC       0x01
 363 #define TSB_FORCEALLOC  0x02
 364 #define TSB_GROW        0x04
 365 #define TSB_SHRINK      0x08
 366 #define TSB_SWAPIN      0x10
 367 
 368 /*
 369  * Support for HAT callbacks.
 370  */
 371 #define SFMMU_MAX_RELOC_CALLBACKS       10
 372 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
 373 static id_t sfmmu_cb_nextid = 0;
 374 static id_t sfmmu_tsb_cb_id;
 375 struct sfmmu_callback *sfmmu_cb_table;
 376 
 377 kmutex_t        kpr_mutex;
 378 kmutex_t        kpr_suspendlock;
 379 kthread_t       *kreloc_thread;
 380 
 381 /*
 382  * Enable VA->PA translation sanity checking on DEBUG kernels.
 383  * Disabled by default.  This is incompatible with some
 384  * drivers (error injector, RSM) so if it breaks you get
 385  * to keep both pieces.
 386  */
 387 int hat_check_vtop = 0;
 388 
 389 /*
 390  * Private sfmmu routines (prototypes)
 391  */
 392 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
 393 static struct   hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
 394                         struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
 395                         uint_t);
 396 static caddr_t  sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
 397                         caddr_t, demap_range_t *, uint_t);
 398 static caddr_t  sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
 399                         caddr_t, int);
 400 static void     sfmmu_hblk_free(struct hme_blk **);
 401 static void     sfmmu_hblks_list_purge(struct hme_blk **, int);
 402 static uint_t   sfmmu_get_free_hblk(struct hme_blk **, uint_t);
 403 static uint_t   sfmmu_put_free_hblk(struct hme_blk *, uint_t);
 404 static struct hme_blk *sfmmu_hblk_steal(int);
 405 static int      sfmmu_steal_this_hblk(struct hmehash_bucket *,
 406                         struct hme_blk *, uint64_t, struct hme_blk *);
 407 static caddr_t  sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
 408 
 409 static void     hat_do_memload_array(struct hat *, caddr_t, size_t,
 410                     struct page **, uint_t, uint_t, uint_t);
 411 static void     hat_do_memload(struct hat *, caddr_t, struct page *,
 412                     uint_t, uint_t, uint_t);
 413 static void     sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
 414                     uint_t, uint_t, pgcnt_t, uint_t);
 415 void            sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
 416                         uint_t);
 417 static int      sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
 418                         uint_t, uint_t);
 419 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
 420                                         caddr_t, int, uint_t);
 421 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
 422                         struct hmehash_bucket *, caddr_t, uint_t, uint_t,
 423                         uint_t);
 424 static int      sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
 425                         caddr_t, page_t **, uint_t, uint_t);
 426 static void     sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
 427 
 428 static int      sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
 429 static pfn_t    sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
 430 void            sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
 431 #ifdef VAC
 432 static void     sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
 433 static int      sfmmu_vacconflict_array(caddr_t, page_t *, int *);
 434 int     tst_tnc(page_t *pp, pgcnt_t);
 435 void    conv_tnc(page_t *pp, int);
 436 #endif
 437 
 438 static void     sfmmu_get_ctx(sfmmu_t *);
 439 static void     sfmmu_free_sfmmu(sfmmu_t *);
 440 
 441 static void     sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
 442 static void     sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
 443 
 444 cpuset_t        sfmmu_pageunload(page_t *, struct sf_hment *, int);
 445 static void     hat_pagereload(struct page *, struct page *);
 446 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
 447 #ifdef VAC
 448 void    sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
 449 static void     sfmmu_page_cache(page_t *, int, int, int);
 450 #endif
 451 
 452 cpuset_t        sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
 453     struct hme_blk *, int);
 454 static void     sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 455                         pfn_t, int, int, int, int);
 456 static void     sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 457                         pfn_t, int);
 458 static void     sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
 459 static void     sfmmu_tlb_range_demap(demap_range_t *);
 460 static void     sfmmu_invalidate_ctx(sfmmu_t *);
 461 static void     sfmmu_sync_mmustate(sfmmu_t *);
 462 
 463 static void     sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
 464 static int      sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
 465                         sfmmu_t *);
 466 static void     sfmmu_tsb_free(struct tsb_info *);
 467 static void     sfmmu_tsbinfo_free(struct tsb_info *);
 468 static int      sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
 469                         sfmmu_t *);
 470 static void     sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
 471 static void     sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
 472 static int      sfmmu_select_tsb_szc(pgcnt_t);
 473 static void     sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
 474 #define         sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
 475         sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
 476 #define         sfmmu_unload_tsb(sfmmup, vaddr, szc)    \
 477         sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
 478 static void     sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
 479 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
 480     hatlock_t *, uint_t);
 481 static void     sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
 482 
 483 #ifdef VAC
 484 void    sfmmu_cache_flush(pfn_t, int);
 485 void    sfmmu_cache_flushcolor(int, pfn_t);
 486 #endif
 487 static caddr_t  sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
 488                         caddr_t, demap_range_t *, uint_t, int);
 489 
 490 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
 491 static uint_t   sfmmu_ptov_attr(tte_t *);
 492 static caddr_t  sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
 493                         caddr_t, demap_range_t *, uint_t);
 494 static uint_t   sfmmu_vtop_prot(uint_t, uint_t *);
 495 static int      sfmmu_idcache_constructor(void *, void *, int);
 496 static void     sfmmu_idcache_destructor(void *, void *);
 497 static int      sfmmu_hblkcache_constructor(void *, void *, int);
 498 static void     sfmmu_hblkcache_destructor(void *, void *);
 499 static void     sfmmu_hblkcache_reclaim(void *);
 500 static void     sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
 501                         struct hmehash_bucket *);
 502 static void     sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
 503                         struct hme_blk *, struct hme_blk **, int);
 504 static void     sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
 505                         uint64_t);
 506 static struct hme_blk *sfmmu_check_pending_hblks(int);
 507 static void     sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
 508 static void     sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
 509 static void     sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
 510                         int, caddr_t *);
 511 static void     sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
 512 
 513 static void     sfmmu_rm_large_mappings(page_t *, int);
 514 
 515 static void     hat_lock_init(void);
 516 static void     hat_kstat_init(void);
 517 static int      sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
 518 static void     sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
 519 static  int     sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
 520 static void     sfmmu_check_page_sizes(sfmmu_t *, int);
 521 int     fnd_mapping_sz(page_t *);
 522 static void     iment_add(struct ism_ment *,  struct hat *);
 523 static void     iment_sub(struct ism_ment *, struct hat *);
 524 static pgcnt_t  ism_tsb_entries(sfmmu_t *, int szc);
 525 extern void     sfmmu_setup_tsbinfo(sfmmu_t *);
 526 extern void     sfmmu_clear_utsbinfo(void);
 527 
 528 static void             sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
 529 
 530 extern int vpm_enable;
 531 
 532 /* kpm globals */
 533 #ifdef  DEBUG
 534 /*
 535  * Enable trap level tsbmiss handling
 536  */
 537 int     kpm_tsbmtl = 1;
 538 
 539 /*
 540  * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
 541  * required TLB shootdowns in this case, so handle w/ care. Off by default.
 542  */
 543 int     kpm_tlb_flush;
 544 #endif  /* DEBUG */
 545 
 546 static void     *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
 547 
 548 #ifdef DEBUG
 549 static void     sfmmu_check_hblk_flist();
 550 #endif
 551 
 552 /*
 553  * Semi-private sfmmu data structures.  Some of them are initialize in
 554  * startup or in hat_init. Some of them are private but accessed by
 555  * assembly code or mach_sfmmu.c
 556  */
 557 struct hmehash_bucket *uhme_hash;       /* user hmeblk hash table */
 558 struct hmehash_bucket *khme_hash;       /* kernel hmeblk hash table */
 559 uint64_t        uhme_hash_pa;           /* PA of uhme_hash */
 560 uint64_t        khme_hash_pa;           /* PA of khme_hash */
 561 int             uhmehash_num;           /* # of buckets in user hash table */
 562 int             khmehash_num;           /* # of buckets in kernel hash table */
 563 
 564 uint_t          max_mmu_ctxdoms = 0;    /* max context domains in the system */
 565 mmu_ctx_t       **mmu_ctxs_tbl;         /* global array of context domains */
 566 uint64_t        mmu_saved_gnum = 0;     /* to init incoming MMUs' gnums */
 567 
 568 #define DEFAULT_NUM_CTXS_PER_MMU 8192
 569 static uint_t   nctxs = DEFAULT_NUM_CTXS_PER_MMU;
 570 
 571 int             cache;                  /* describes system cache */
 572 
 573 caddr_t         ktsb_base;              /* kernel 8k-indexed tsb base address */
 574 uint64_t        ktsb_pbase;             /* kernel 8k-indexed tsb phys address */
 575 int             ktsb_szcode;            /* kernel 8k-indexed tsb size code */
 576 int             ktsb_sz;                /* kernel 8k-indexed tsb size */
 577 
 578 caddr_t         ktsb4m_base;            /* kernel 4m-indexed tsb base address */
 579 uint64_t        ktsb4m_pbase;           /* kernel 4m-indexed tsb phys address */
 580 int             ktsb4m_szcode;          /* kernel 4m-indexed tsb size code */
 581 int             ktsb4m_sz;              /* kernel 4m-indexed tsb size */
 582 
 583 uint64_t        kpm_tsbbase;            /* kernel seg_kpm 4M TSB base address */
 584 int             kpm_tsbsz;              /* kernel seg_kpm 4M TSB size code */
 585 uint64_t        kpmsm_tsbbase;          /* kernel seg_kpm 8K TSB base address */
 586 int             kpmsm_tsbsz;            /* kernel seg_kpm 8K TSB size code */
 587 
 588 #ifndef sun4v
 589 int             utsb_dtlb_ttenum = -1;  /* index in TLB for utsb locked TTE */
 590 int             utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
 591 int             dtlb_resv_ttenum;       /* index in TLB of first reserved TTE */
 592 caddr_t         utsb_vabase;            /* reserved kernel virtual memory */
 593 caddr_t         utsb4m_vabase;          /* for trap handler TSB accesses */
 594 #endif /* sun4v */
 595 uint64_t        tsb_alloc_bytes = 0;    /* bytes allocated to TSBs */
 596 vmem_t          *kmem_tsb_default_arena[NLGRPS_MAX];    /* For dynamic TSBs */
 597 vmem_t          *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
 598 
 599 /*
 600  * Size to use for TSB slabs.  Future platforms that support page sizes
 601  * larger than 4M may wish to change these values, and provide their own
 602  * assembly macros for building and decoding the TSB base register contents.
 603  * Note disable_large_pages will override the value set here.
 604  */
 605 static  uint_t tsb_slab_ttesz = TTE4M;
 606 size_t  tsb_slab_size = MMU_PAGESIZE4M;
 607 uint_t  tsb_slab_shift = MMU_PAGESHIFT4M;
 608 /* PFN mask for TTE */
 609 size_t  tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
 610 
 611 /*
 612  * Size to use for TSB slabs.  These are used only when 256M tsb arenas
 613  * exist.
 614  */
 615 static uint_t   bigtsb_slab_ttesz = TTE256M;
 616 static size_t   bigtsb_slab_size = MMU_PAGESIZE256M;
 617 static uint_t   bigtsb_slab_shift = MMU_PAGESHIFT256M;
 618 /* 256M page alignment for 8K pfn */
 619 static size_t   bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
 620 
 621 /* largest TSB size to grow to, will be smaller on smaller memory systems */
 622 static int      tsb_max_growsize = 0;
 623 
 624 /*
 625  * Tunable parameters dealing with TSB policies.
 626  */
 627 
 628 /*
 629  * This undocumented tunable forces all 8K TSBs to be allocated from
 630  * the kernel heap rather than from the kmem_tsb_default_arena arenas.
 631  */
 632 #ifdef  DEBUG
 633 int     tsb_forceheap = 0;
 634 #endif  /* DEBUG */
 635 
 636 /*
 637  * Decide whether to use per-lgroup arenas, or one global set of
 638  * TSB arenas.  The default is not to break up per-lgroup, since
 639  * most platforms don't recognize any tangible benefit from it.
 640  */
 641 int     tsb_lgrp_affinity = 0;
 642 
 643 /*
 644  * Used for growing the TSB based on the process RSS.
 645  * tsb_rss_factor is based on the smallest TSB, and is
 646  * shifted by the TSB size to determine if we need to grow.
 647  * The default will grow the TSB if the number of TTEs for
 648  * this page size exceeds 75% of the number of TSB entries,
 649  * which should _almost_ eliminate all conflict misses
 650  * (at the expense of using up lots and lots of memory).
 651  */
 652 #define TSB_RSS_FACTOR          (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
 653 #define SFMMU_RSS_TSBSIZE(tsbszc)       (tsb_rss_factor << tsbszc)
 654 #define SELECT_TSB_SIZECODE(pgcnt) ( \
 655         (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
 656         default_tsb_size)
 657 #define TSB_OK_SHRINK() \
 658         (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
 659 #define TSB_OK_GROW()   \
 660         (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
 661 
 662 int     enable_tsb_rss_sizing = 1;
 663 int     tsb_rss_factor  = (int)TSB_RSS_FACTOR;
 664 
 665 /* which TSB size code to use for new address spaces or if rss sizing off */
 666 int default_tsb_size = TSB_8K_SZCODE;
 667 
 668 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
 669 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
 670 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT        32
 671 
 672 #ifdef DEBUG
 673 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
 674 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
 675 static int tsb_alloc_mtbf = 0;  /* fail allocation every n attempts */
 676 static int tsb_alloc_fail_mtbf = 0;
 677 static int tsb_alloc_count = 0;
 678 #endif /* DEBUG */
 679 
 680 /* if set to 1, will remap valid TTEs when growing TSB. */
 681 int tsb_remap_ttes = 1;
 682 
 683 /*
 684  * If we have more than this many mappings, allocate a second TSB.
 685  * This default is chosen because the I/D fully associative TLBs are
 686  * assumed to have at least 8 available entries. Platforms with a
 687  * larger fully-associative TLB could probably override the default.
 688  */
 689 
 690 #ifdef sun4v
 691 int tsb_sectsb_threshold = 0;
 692 #else
 693 int tsb_sectsb_threshold = 8;
 694 #endif
 695 
 696 /*
 697  * kstat data
 698  */
 699 struct sfmmu_global_stat sfmmu_global_stat;
 700 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
 701 
 702 /*
 703  * Global data
 704  */
 705 sfmmu_t         *ksfmmup;               /* kernel's hat id */
 706 
 707 #ifdef DEBUG
 708 static void     chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
 709 #endif
 710 
 711 /* sfmmu locking operations */
 712 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
 713 static int      sfmmu_mlspl_held(struct page *, int);
 714 
 715 kmutex_t *sfmmu_page_enter(page_t *);
 716 void    sfmmu_page_exit(kmutex_t *);
 717 int     sfmmu_page_spl_held(struct page *);
 718 
 719 /* sfmmu internal locking operations - accessed directly */
 720 static void     sfmmu_mlist_reloc_enter(page_t *, page_t *,
 721                                 kmutex_t **, kmutex_t **);
 722 static void     sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
 723 static hatlock_t *
 724                 sfmmu_hat_enter(sfmmu_t *);
 725 static hatlock_t *
 726                 sfmmu_hat_tryenter(sfmmu_t *);
 727 static void     sfmmu_hat_exit(hatlock_t *);
 728 static void     sfmmu_hat_lock_all(void);
 729 static void     sfmmu_hat_unlock_all(void);
 730 static void     sfmmu_ismhat_enter(sfmmu_t *, int);
 731 static void     sfmmu_ismhat_exit(sfmmu_t *, int);
 732 
 733 kpm_hlk_t       *kpmp_table;
 734 uint_t          kpmp_table_sz;  /* must be a power of 2 */
 735 uchar_t         kpmp_shift;
 736 
 737 kpm_shlk_t      *kpmp_stable;
 738 uint_t          kpmp_stable_sz; /* must be a power of 2 */
 739 
 740 /*
 741  * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
 742  * SPL_SHIFT is log2(SPL_TABLE_SIZE).
 743  */
 744 #if ((2*NCPU_P2) > 128)
 745 #define SPL_SHIFT       ((unsigned)(NCPU_LOG2 + 1))
 746 #else
 747 #define SPL_SHIFT       7U
 748 #endif
 749 #define SPL_TABLE_SIZE  (1U << SPL_SHIFT)
 750 #define SPL_MASK        (SPL_TABLE_SIZE - 1)
 751 
 752 /*
 753  * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
 754  * and by multiples of SPL_SHIFT to get as many varied bits as we can.
 755  */
 756 #define SPL_INDEX(pp) \
 757         ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
 758         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
 759         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
 760         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
 761         SPL_MASK)
 762 
 763 #define SPL_HASH(pp)    \
 764         (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
 765 
 766 static  pad_mutex_t     sfmmu_page_lock[SPL_TABLE_SIZE];
 767 
 768 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
 769 
 770 #define MML_TABLE_SIZE  SPL_TABLE_SIZE
 771 #define MLIST_HASH(pp)  (&mml_table[SPL_INDEX(pp)].pad_mutex)
 772 
 773 static pad_mutex_t      mml_table[MML_TABLE_SIZE];
 774 
 775 /*
 776  * hat_unload_callback() will group together callbacks in order
 777  * to avoid xt_sync() calls.  This is the maximum size of the group.
 778  */
 779 #define MAX_CB_ADDR     32
 780 
 781 tte_t   hw_tte;
 782 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
 783 
 784 static char     *mmu_ctx_kstat_names[] = {
 785         "mmu_ctx_tsb_exceptions",
 786         "mmu_ctx_tsb_raise_exception",
 787         "mmu_ctx_wrap_around",
 788 };
 789 
 790 /*
 791  * Wrapper for vmem_xalloc since vmem_create only allows limited
 792  * parameters for vm_source_alloc functions.  This function allows us
 793  * to specify alignment consistent with the size of the object being
 794  * allocated.
 795  */
 796 static void *
 797 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
 798 {
 799         return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
 800 }
 801 
 802 /* Common code for setting tsb_alloc_hiwater. */
 803 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages)      tsb_alloc_hiwater = \
 804                 ptob(pages) / tsb_alloc_hiwater_factor
 805 
 806 /*
 807  * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
 808  * a single TSB.  physmem is the number of physical pages so we need physmem 8K
 809  * TTEs to represent all those physical pages.  We round this up by using
 810  * 1<<highbit().  To figure out which size code to use, remember that the size
 811  * code is just an amount to shift the smallest TSB size to get the size of
 812  * this TSB.  So we subtract that size, TSB_START_SIZE, from highbit() (or
 813  * highbit() - 1) to get the size code for the smallest TSB that can represent
 814  * all of physical memory, while erring on the side of too much.
 815  *
 816  * Restrict tsb_max_growsize to make sure that:
 817  *      1) TSBs can't grow larger than the TSB slab size
 818  *      2) TSBs can't grow larger than UTSB_MAX_SZCODE.
 819  */
 820 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) {                             \
 821         int     _i, _szc, _slabszc, _tsbszc;                            \
 822                                                                         \
 823         _i = highbit(pages);                                            \
 824         if ((1 << (_i - 1)) == (pages))                                   \
 825                 _i--;           /* 2^n case, round down */              \
 826         _szc = _i - TSB_START_SIZE;                                     \
 827         _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
 828         _tsbszc = MIN(_szc, _slabszc);                                  \
 829         tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE);               \
 830 }
 831 
 832 /*
 833  * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
 834  * tsb_info which handles that TTE size.
 835  */
 836 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) {                  \
 837         (tsbinfop) = (sfmmup)->sfmmu_tsb;                            \
 838         ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) ||                \
 839             sfmmu_hat_lock_held(sfmmup));                               \
 840         if ((tte_szc) >= TTE4M)      {                                       \
 841                 ASSERT((tsbinfop) != NULL);                             \
 842                 (tsbinfop) = (tsbinfop)->tsb_next;                   \
 843         }                                                               \
 844 }
 845 
 846 /*
 847  * Macro to use to unload entries from the TSB.
 848  * It has knowledge of which page sizes get replicated in the TSB
 849  * and will call the appropriate unload routine for the appropriate size.
 850  */
 851 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat)         \
 852 {                                                                       \
 853         int ttesz = get_hblk_ttesz(hmeblkp);                            \
 854         if (ttesz == TTE8K || ttesz == TTE4M) {                         \
 855                 sfmmu_unload_tsb(sfmmup, addr, ttesz);                  \
 856         } else {                                                        \
 857                 caddr_t sva = ismhat ? addr :                           \
 858                     (caddr_t)get_hblk_base(hmeblkp);                    \
 859                 caddr_t eva = sva + get_hblk_span(hmeblkp);             \
 860                 ASSERT(addr >= sva && addr < eva);                        \
 861                 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz);        \
 862         }                                                               \
 863 }
 864 
 865 
 866 /* Update tsb_alloc_hiwater after memory is configured. */
 867 /*ARGSUSED*/
 868 static void
 869 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
 870 {
 871         /* Assumes physmem has already been updated. */
 872         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 873         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 874 }
 875 
 876 /*
 877  * Update tsb_alloc_hiwater before memory is deleted.  We'll do nothing here
 878  * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
 879  * deleted.
 880  */
 881 /*ARGSUSED*/
 882 static int
 883 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
 884 {
 885         return (0);
 886 }
 887 
 888 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
 889 /*ARGSUSED*/
 890 static void
 891 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
 892 {
 893         /*
 894          * Whether the delete was cancelled or not, just go ahead and update
 895          * tsb_alloc_hiwater and tsb_max_growsize.
 896          */
 897         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 898         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 899 }
 900 
 901 static kphysm_setup_vector_t sfmmu_update_vec = {
 902         KPHYSM_SETUP_VECTOR_VERSION,    /* version */
 903         sfmmu_update_post_add,          /* post_add */
 904         sfmmu_update_pre_del,           /* pre_del */
 905         sfmmu_update_post_del           /* post_del */
 906 };
 907 
 908 
 909 /*
 910  * HME_BLK HASH PRIMITIVES
 911  */
 912 
 913 /*
 914  * Enter a hme on the mapping list for page pp.
 915  * When large pages are more prevalent in the system we might want to
 916  * keep the mapping list in ascending order by the hment size. For now,
 917  * small pages are more frequent, so don't slow it down.
 918  */
 919 #define HME_ADD(hme, pp)                                        \
 920 {                                                               \
 921         ASSERT(sfmmu_mlist_held(pp));                           \
 922                                                                 \
 923         hme->hme_prev = NULL;                                        \
 924         hme->hme_next = pp->p_mapping;                            \
 925         hme->hme_page = pp;                                  \
 926         if (pp->p_mapping) {                                 \
 927                 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
 928                 ASSERT(pp->p_share > 0);                  \
 929         } else  {                                               \
 930                 /* EMPTY */                                     \
 931                 ASSERT(pp->p_share == 0);                    \
 932         }                                                       \
 933         pp->p_mapping = hme;                                 \
 934         pp->p_share++;                                               \
 935 }
 936 
 937 /*
 938  * Enter a hme on the mapping list for page pp.
 939  * If we are unmapping a large translation, we need to make sure that the
 940  * change is reflect in the corresponding bit of the p_index field.
 941  */
 942 #define HME_SUB(hme, pp)                                        \
 943 {                                                               \
 944         ASSERT(sfmmu_mlist_held(pp));                           \
 945         ASSERT(hme->hme_page == pp || IS_PAHME(hme));                \
 946                                                                 \
 947         if (pp->p_mapping == NULL) {                         \
 948                 panic("hme_remove - no mappings");              \
 949         }                                                       \
 950                                                                 \
 951         membar_stst();  /* ensure previous stores finish */     \
 952                                                                 \
 953         ASSERT(pp->p_share > 0);                          \
 954         pp->p_share--;                                               \
 955                                                                 \
 956         if (hme->hme_prev) {                                 \
 957                 ASSERT(pp->p_mapping != hme);                        \
 958                 ASSERT(hme->hme_prev->hme_page == pp ||           \
 959                         IS_PAHME(hme->hme_prev));            \
 960                 hme->hme_prev->hme_next = hme->hme_next;       \
 961         } else {                                                \
 962                 ASSERT(pp->p_mapping == hme);                        \
 963                 pp->p_mapping = hme->hme_next;                    \
 964                 ASSERT((pp->p_mapping == NULL) ?             \
 965                         (pp->p_share == 0) : 1);             \
 966         }                                                       \
 967                                                                 \
 968         if (hme->hme_next) {                                 \
 969                 ASSERT(hme->hme_next->hme_page == pp ||           \
 970                         IS_PAHME(hme->hme_next));            \
 971                 hme->hme_next->hme_prev = hme->hme_prev;       \
 972         }                                                       \
 973                                                                 \
 974         /* zero out the entry */                                \
 975         hme->hme_next = NULL;                                        \
 976         hme->hme_prev = NULL;                                        \
 977         hme->hme_page = NULL;                                        \
 978                                                                 \
 979         if (hme_size(hme) > TTE8K) {                         \
 980                 /* remove mappings for remainder of large pg */ \
 981                 sfmmu_rm_large_mappings(pp, hme_size(hme));     \
 982         }                                                       \
 983 }
 984 
 985 /*
 986  * This function returns the hment given the hme_blk and a vaddr.
 987  * It assumes addr has already been checked to belong to hme_blk's
 988  * range.
 989  */
 990 #define HBLKTOHME(hment, hmeblkp, addr)                                 \
 991 {                                                                       \
 992         int index;                                                      \
 993         HBLKTOHME_IDX(hment, hmeblkp, addr, index)                      \
 994 }
 995 
 996 /*
 997  * Version of HBLKTOHME that also returns the index in hmeblkp
 998  * of the hment.
 999  */
1000 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx)                        \
1001 {                                                                       \
1002         ASSERT(in_hblk_range((hmeblkp), (addr)));                       \
1003                                                                         \
1004         if (get_hblk_ttesz(hmeblkp) == TTE8K) {                         \
1005                 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1006         } else                                                          \
1007                 idx = 0;                                                \
1008                                                                         \
1009         (hment) = &(hmeblkp)->hblk_hme[idx];                             \
1010 }
1011 
1012 /*
1013  * Disable any page sizes not supported by the CPU
1014  */
1015 void
1016 hat_init_pagesizes()
1017 {
1018         int             i;
1019 
1020         mmu_exported_page_sizes = 0;
1021         for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1022 
1023                 szc_2_userszc[i] = (uint_t)-1;
1024                 userszc_2_szc[i] = (uint_t)-1;
1025 
1026                 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1027                         disable_large_pages |= (1 << i);
1028                 } else {
1029                         szc_2_userszc[i] = mmu_exported_page_sizes;
1030                         userszc_2_szc[mmu_exported_page_sizes] = i;
1031                         mmu_exported_page_sizes++;
1032                 }
1033         }
1034 
1035         disable_ism_large_pages |= disable_large_pages;
1036         disable_auto_data_large_pages = disable_large_pages;
1037         disable_auto_text_large_pages = disable_large_pages;
1038 
1039         /*
1040          * Initialize mmu-specific large page sizes.
1041          */
1042         if (&mmu_large_pages_disabled) {
1043                 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1044                 disable_ism_large_pages |=
1045                     mmu_large_pages_disabled(HAT_LOAD_SHARE);
1046                 disable_auto_data_large_pages |=
1047                     mmu_large_pages_disabled(HAT_AUTO_DATA);
1048                 disable_auto_text_large_pages |=
1049                     mmu_large_pages_disabled(HAT_AUTO_TEXT);
1050         }
1051 }
1052 
1053 /*
1054  * Initialize the hardware address translation structures.
1055  */
1056 void
1057 hat_init(void)
1058 {
1059         int             i;
1060         uint_t          sz;
1061         size_t          size;
1062 
1063         hat_lock_init();
1064         hat_kstat_init();
1065 
1066         /*
1067          * Hardware-only bits in a TTE
1068          */
1069         MAKE_TTE_MASK(&hw_tte);
1070 
1071         hat_init_pagesizes();
1072 
1073         /* Initialize the hash locks */
1074         for (i = 0; i < khmehash_num; i++) {
1075                 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1076                     MUTEX_DEFAULT, NULL);
1077                 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1078         }
1079         for (i = 0; i < uhmehash_num; i++) {
1080                 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1081                     MUTEX_DEFAULT, NULL);
1082                 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1083         }
1084         khmehash_num--;         /* make sure counter starts from 0 */
1085         uhmehash_num--;         /* make sure counter starts from 0 */
1086 
1087         /*
1088          * Allocate context domain structures.
1089          *
1090          * A platform may choose to modify max_mmu_ctxdoms in
1091          * set_platform_defaults(). If a platform does not define
1092          * a set_platform_defaults() or does not choose to modify
1093          * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1094          *
1095          * For all platforms that have CPUs sharing MMUs, this
1096          * value must be defined.
1097          */
1098         if (max_mmu_ctxdoms == 0)
1099                 max_mmu_ctxdoms = max_ncpus;
1100 
1101         size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1102         mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1103 
1104         /* mmu_ctx_t is 64 bytes aligned */
1105         mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1106             sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1107         /*
1108          * MMU context domain initialization for the Boot CPU.
1109          * This needs the context domains array allocated above.
1110          */
1111         mutex_enter(&cpu_lock);
1112         sfmmu_cpu_init(CPU);
1113         mutex_exit(&cpu_lock);
1114 
1115         /*
1116          * Intialize ism mapping list lock.
1117          */
1118 
1119         mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1120 
1121         /*
1122          * Each sfmmu structure carries an array of MMU context info
1123          * structures, one per context domain. The size of this array depends
1124          * on the maximum number of context domains. So, the size of the
1125          * sfmmu structure varies per platform.
1126          *
1127          * sfmmu is allocated from static arena, because trap
1128          * handler at TL > 0 is not allowed to touch kernel relocatable
1129          * memory. sfmmu's alignment is changed to 64 bytes from
1130          * default 8 bytes, as the lower 6 bits will be used to pass
1131          * pgcnt to vtag_flush_pgcnt_tl1.
1132          */
1133         size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1134 
1135         sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1136             64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1137             NULL, NULL, static_arena, 0);
1138 
1139         sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1140             sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1141 
1142         /*
1143          * Since we only use the tsb8k cache to "borrow" pages for TSBs
1144          * from the heap when low on memory or when TSB_FORCEALLOC is
1145          * specified, don't use magazines to cache them--we want to return
1146          * them to the system as quickly as possible.
1147          */
1148         sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1149             MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1150             static_arena, KMC_NOMAGAZINE);
1151 
1152         /*
1153          * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1154          * memory, which corresponds to the old static reserve for TSBs.
1155          * tsb_alloc_hiwater_factor defaults to 32.  This caps the amount of
1156          * memory we'll allocate for TSB slabs; beyond this point TSB
1157          * allocations will be taken from the kernel heap (via
1158          * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1159          * consumer.
1160          */
1161         if (tsb_alloc_hiwater_factor == 0) {
1162                 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1163         }
1164         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1165 
1166         for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1167                 if (!(disable_large_pages & (1 << sz)))
1168                         break;
1169         }
1170 
1171         if (sz < tsb_slab_ttesz) {
1172                 tsb_slab_ttesz = sz;
1173                 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1174                 tsb_slab_size = 1 << tsb_slab_shift;
1175                 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1176                 use_bigtsb_arena = 0;
1177         } else if (use_bigtsb_arena &&
1178             (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1179                 use_bigtsb_arena = 0;
1180         }
1181 
1182         if (!use_bigtsb_arena) {
1183                 bigtsb_slab_shift = tsb_slab_shift;
1184         }
1185         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1186 
1187         /*
1188          * On smaller memory systems, allocate TSB memory in smaller chunks
1189          * than the default 4M slab size. We also honor disable_large_pages
1190          * here.
1191          *
1192          * The trap handlers need to be patched with the final slab shift,
1193          * since they need to be able to construct the TSB pointer at runtime.
1194          */
1195         if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1196             !(disable_large_pages & (1 << TTE512K))) {
1197                 tsb_slab_ttesz = TTE512K;
1198                 tsb_slab_shift = MMU_PAGESHIFT512K;
1199                 tsb_slab_size = MMU_PAGESIZE512K;
1200                 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1201                 use_bigtsb_arena = 0;
1202         }
1203 
1204         if (!use_bigtsb_arena) {
1205                 bigtsb_slab_ttesz = tsb_slab_ttesz;
1206                 bigtsb_slab_shift = tsb_slab_shift;
1207                 bigtsb_slab_size = tsb_slab_size;
1208                 bigtsb_slab_mask = tsb_slab_mask;
1209         }
1210 
1211 
1212         /*
1213          * Set up memory callback to update tsb_alloc_hiwater and
1214          * tsb_max_growsize.
1215          */
1216         i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1217         ASSERT(i == 0);
1218 
1219         /*
1220          * kmem_tsb_arena is the source from which large TSB slabs are
1221          * drawn.  The quantum of this arena corresponds to the largest
1222          * TSB size we can dynamically allocate for user processes.
1223          * Currently it must also be a supported page size since we
1224          * use exactly one translation entry to map each slab page.
1225          *
1226          * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1227          * which most TSBs are allocated.  Since most TSB allocations are
1228          * typically 8K we have a kmem cache we stack on top of each
1229          * kmem_tsb_default_arena to speed up those allocations.
1230          *
1231          * Note the two-level scheme of arenas is required only
1232          * because vmem_create doesn't allow us to specify alignment
1233          * requirements.  If this ever changes the code could be
1234          * simplified to use only one level of arenas.
1235          *
1236          * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1237          * will be provided in addition to the 4M kmem_tsb_arena.
1238          */
1239         if (use_bigtsb_arena) {
1240                 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1241                     bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1242                     vmem_xfree, heap_arena, 0, VM_SLEEP);
1243         }
1244 
1245         kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1246             sfmmu_vmem_xalloc_aligned_wrapper,
1247             vmem_xfree, heap_arena, 0, VM_SLEEP);
1248 
1249         if (tsb_lgrp_affinity) {
1250                 char s[50];
1251                 for (i = 0; i < NLGRPS_MAX; i++) {
1252                         if (use_bigtsb_arena) {
1253                                 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1254                                 kmem_bigtsb_default_arena[i] = vmem_create(s,
1255                                     NULL, 0, 2 * tsb_slab_size,
1256                                     sfmmu_tsb_segkmem_alloc,
1257                                     sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1258                                     0, VM_SLEEP | VM_BESTFIT);
1259                         }
1260 
1261                         (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1262                         kmem_tsb_default_arena[i] = vmem_create(s,
1263                             NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1264                             sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1265                             VM_SLEEP | VM_BESTFIT);
1266 
1267                         (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1268                         sfmmu_tsb_cache[i] = kmem_cache_create(s,
1269                             PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1270                             kmem_tsb_default_arena[i], 0);
1271                 }
1272         } else {
1273                 if (use_bigtsb_arena) {
1274                         kmem_bigtsb_default_arena[0] =
1275                             vmem_create("kmem_bigtsb_default", NULL, 0,
1276                             2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1277                             sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1278                             VM_SLEEP | VM_BESTFIT);
1279                 }
1280 
1281                 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1282                     NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1283                     sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1284                     VM_SLEEP | VM_BESTFIT);
1285                 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1286                     PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1287                     kmem_tsb_default_arena[0], 0);
1288         }
1289 
1290         sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1291             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1292             sfmmu_hblkcache_destructor,
1293             sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1294             hat_memload_arena, KMC_NOHASH);
1295 
1296         hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1297             segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1298             VMC_DUMPSAFE | VM_SLEEP);
1299 
1300         sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1301             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1302             sfmmu_hblkcache_destructor,
1303             NULL, (void *)HME1BLK_SZ,
1304             hat_memload1_arena, KMC_NOHASH);
1305 
1306         pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1307             0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1308 
1309         ism_blk_cache = kmem_cache_create("ism_blk_cache",
1310             sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1311             NULL, NULL, static_arena, KMC_NOHASH);
1312 
1313         ism_ment_cache = kmem_cache_create("ism_ment_cache",
1314             sizeof (ism_ment_t), 0, NULL, NULL,
1315             NULL, NULL, NULL, 0);
1316 
1317         /*
1318          * We grab the first hat for the kernel,
1319          */
1320         AS_LOCK_ENTER(&kas, RW_WRITER);
1321         kas.a_hat = hat_alloc(&kas);
1322         AS_LOCK_EXIT(&kas);
1323 
1324         /*
1325          * Initialize hblk_reserve.
1326          */
1327         ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1328             va_to_pa((caddr_t)hblk_reserve);
1329 
1330 #ifndef UTSB_PHYS
1331         /*
1332          * Reserve some kernel virtual address space for the locked TTEs
1333          * that allow us to probe the TSB from TL>0.
1334          */
1335         utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1336             0, 0, NULL, NULL, VM_SLEEP);
1337         utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1338             0, 0, NULL, NULL, VM_SLEEP);
1339 #endif
1340 
1341 #ifdef VAC
1342         /*
1343          * The big page VAC handling code assumes VAC
1344          * will not be bigger than the smallest big
1345          * page- which is 64K.
1346          */
1347         if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1348                 cmn_err(CE_PANIC, "VAC too big!");
1349         }
1350 #endif
1351 
1352         uhme_hash_pa = va_to_pa(uhme_hash);
1353         khme_hash_pa = va_to_pa(khme_hash);
1354 
1355         /*
1356          * Initialize relocation locks. kpr_suspendlock is held
1357          * at PIL_MAX to prevent interrupts from pinning the holder
1358          * of a suspended TTE which may access it leading to a
1359          * deadlock condition.
1360          */
1361         mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1362         mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1363 
1364         /*
1365          * If Shared context support is disabled via /etc/system
1366          * set shctx_on to 0 here if it was set to 1 earlier in boot
1367          * sequence by cpu module initialization code.
1368          */
1369         if (shctx_on && disable_shctx) {
1370                 shctx_on = 0;
1371         }
1372 
1373         if (shctx_on) {
1374                 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1375                     sizeof (srd_buckets[0]), KM_SLEEP);
1376                 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1377                         mutex_init(&srd_buckets[i].srdb_lock, NULL,
1378                             MUTEX_DEFAULT, NULL);
1379                 }
1380 
1381                 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1382                     0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1383                     NULL, NULL, NULL, 0);
1384                 region_cache = kmem_cache_create("region_cache",
1385                     sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1386                     sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1387                 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1388                     0, sfmmu_scdcache_constructor,  sfmmu_scdcache_destructor,
1389                     NULL, NULL, NULL, 0);
1390         }
1391 
1392         /*
1393          * Pre-allocate hrm_hashtab before enabling the collection of
1394          * refmod statistics.  Allocating on the fly would mean us
1395          * running the risk of suffering recursive mutex enters or
1396          * deadlocks.
1397          */
1398         hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1399             KM_SLEEP);
1400 
1401         /* Allocate per-cpu pending freelist of hmeblks */
1402         cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1403             KM_SLEEP);
1404         cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1405             (uintptr_t)cpu_hme_pend, 64);
1406 
1407         for (i = 0; i < NCPU; i++) {
1408                 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1409                     NULL);
1410         }
1411 
1412         if (cpu_hme_pend_thresh == 0) {
1413                 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1414         }
1415 }
1416 
1417 /*
1418  * Initialize locking for the hat layer, called early during boot.
1419  */
1420 static void
1421 hat_lock_init()
1422 {
1423         int i;
1424 
1425         /*
1426          * initialize the array of mutexes protecting a page's mapping
1427          * list and p_nrm field.
1428          */
1429         for (i = 0; i < MML_TABLE_SIZE; i++)
1430                 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1431 
1432         if (kpm_enable) {
1433                 for (i = 0; i < kpmp_table_sz; i++) {
1434                         mutex_init(&kpmp_table[i].khl_mutex, NULL,
1435                             MUTEX_DEFAULT, NULL);
1436                 }
1437         }
1438 
1439         /*
1440          * Initialize array of mutex locks that protects sfmmu fields and
1441          * TSB lists.
1442          */
1443         for (i = 0; i < SFMMU_NUM_LOCK; i++)
1444                 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1445                     NULL);
1446 }
1447 
1448 #define SFMMU_KERNEL_MAXVA \
1449         (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1450 
1451 /*
1452  * Allocate a hat structure.
1453  * Called when an address space first uses a hat.
1454  */
1455 struct hat *
1456 hat_alloc(struct as *as)
1457 {
1458         sfmmu_t *sfmmup;
1459         int i;
1460         uint64_t cnum;
1461         extern uint_t get_color_start(struct as *);
1462 
1463         ASSERT(AS_WRITE_HELD(as));
1464         sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1465         sfmmup->sfmmu_as = as;
1466         sfmmup->sfmmu_flags = 0;
1467         sfmmup->sfmmu_tteflags = 0;
1468         sfmmup->sfmmu_rtteflags = 0;
1469         LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1470 
1471         if (as == &kas) {
1472                 ksfmmup = sfmmup;
1473                 sfmmup->sfmmu_cext = 0;
1474                 cnum = KCONTEXT;
1475 
1476                 sfmmup->sfmmu_clrstart = 0;
1477                 sfmmup->sfmmu_tsb = NULL;
1478                 /*
1479                  * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1480                  * to setup tsb_info for ksfmmup.
1481                  */
1482         } else {
1483 
1484                 /*
1485                  * Just set to invalid ctx. When it faults, it will
1486                  * get a valid ctx. This would avoid the situation
1487                  * where we get a ctx, but it gets stolen and then
1488                  * we fault when we try to run and so have to get
1489                  * another ctx.
1490                  */
1491                 sfmmup->sfmmu_cext = 0;
1492                 cnum = INVALID_CONTEXT;
1493 
1494                 /* initialize original physical page coloring bin */
1495                 sfmmup->sfmmu_clrstart = get_color_start(as);
1496 #ifdef DEBUG
1497                 if (tsb_random_size) {
1498                         uint32_t randval = (uint32_t)gettick() >> 4;
1499                         int size = randval % (tsb_max_growsize + 1);
1500 
1501                         /* chose a random tsb size for stress testing */
1502                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1503                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1504                 } else
1505 #endif /* DEBUG */
1506                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1507                             default_tsb_size,
1508                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1509                 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1510                 ASSERT(sfmmup->sfmmu_tsb != NULL);
1511         }
1512 
1513         ASSERT(max_mmu_ctxdoms > 0);
1514         for (i = 0; i < max_mmu_ctxdoms; i++) {
1515                 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1516                 sfmmup->sfmmu_ctxs[i].gnum = 0;
1517         }
1518 
1519         for (i = 0; i < max_mmu_page_sizes; i++) {
1520                 sfmmup->sfmmu_ttecnt[i] = 0;
1521                 sfmmup->sfmmu_scdrttecnt[i] = 0;
1522                 sfmmup->sfmmu_ismttecnt[i] = 0;
1523                 sfmmup->sfmmu_scdismttecnt[i] = 0;
1524                 sfmmup->sfmmu_pgsz[i] = TTE8K;
1525         }
1526         sfmmup->sfmmu_tsb0_4minflcnt = 0;
1527         sfmmup->sfmmu_iblk = NULL;
1528         sfmmup->sfmmu_ismhat = 0;
1529         sfmmup->sfmmu_scdhat = 0;
1530         sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1531         if (sfmmup == ksfmmup) {
1532                 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1533         } else {
1534                 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1535         }
1536         sfmmup->sfmmu_free = 0;
1537         sfmmup->sfmmu_rmstat = 0;
1538         sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1539         cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1540         sfmmup->sfmmu_srdp = NULL;
1541         SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1542         bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1543         sfmmup->sfmmu_scdp = NULL;
1544         sfmmup->sfmmu_scd_link.next = NULL;
1545         sfmmup->sfmmu_scd_link.prev = NULL;
1546         return (sfmmup);
1547 }
1548 
1549 /*
1550  * Create per-MMU context domain kstats for a given MMU ctx.
1551  */
1552 static void
1553 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1554 {
1555         mmu_ctx_stat_t  stat;
1556         kstat_t         *mmu_kstat;
1557 
1558         ASSERT(MUTEX_HELD(&cpu_lock));
1559         ASSERT(mmu_ctxp->mmu_kstat == NULL);
1560 
1561         mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1562             "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1563 
1564         if (mmu_kstat == NULL) {
1565                 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1566                     mmu_ctxp->mmu_idx);
1567         } else {
1568                 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1569                 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1570                         kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1571                             mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1572                 mmu_ctxp->mmu_kstat = mmu_kstat;
1573                 kstat_install(mmu_kstat);
1574         }
1575 }
1576 
1577 /*
1578  * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1579  * context domain information for a given CPU. If a platform does not
1580  * specify that interface, then the function below is used instead to return
1581  * default information. The defaults are as follows:
1582  *
1583  *      - The number of MMU context IDs supported on any CPU in the
1584  *        system is 8K.
1585  *      - There is one MMU context domain per CPU.
1586  */
1587 /*ARGSUSED*/
1588 static void
1589 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1590 {
1591         infop->mmu_nctxs = nctxs;
1592         infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1593 }
1594 
1595 /*
1596  * Called during CPU initialization to set the MMU context-related information
1597  * for a CPU.
1598  *
1599  * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1600  */
1601 void
1602 sfmmu_cpu_init(cpu_t *cp)
1603 {
1604         mmu_ctx_info_t  info;
1605         mmu_ctx_t       *mmu_ctxp;
1606 
1607         ASSERT(MUTEX_HELD(&cpu_lock));
1608 
1609         if (&plat_cpuid_to_mmu_ctx_info == NULL)
1610                 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1611         else
1612                 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1613 
1614         ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1615 
1616         if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1617                 /* Each mmu_ctx is cacheline aligned. */
1618                 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1619                 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1620 
1621                 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1622                     (void *)ipltospl(DISP_LEVEL));
1623                 mmu_ctxp->mmu_idx = info.mmu_idx;
1624                 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1625                 /*
1626                  * Globally for lifetime of a system,
1627                  * gnum must always increase.
1628                  * mmu_saved_gnum is protected by the cpu_lock.
1629                  */
1630                 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1631                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1632 
1633                 sfmmu_mmu_kstat_create(mmu_ctxp);
1634 
1635                 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1636         } else {
1637                 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1638                 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1639         }
1640 
1641         /*
1642          * The mmu_lock is acquired here to prevent races with
1643          * the wrap-around code.
1644          */
1645         mutex_enter(&mmu_ctxp->mmu_lock);
1646 
1647 
1648         mmu_ctxp->mmu_ncpus++;
1649         CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1650         CPU_MMU_IDX(cp) = info.mmu_idx;
1651         CPU_MMU_CTXP(cp) = mmu_ctxp;
1652 
1653         mutex_exit(&mmu_ctxp->mmu_lock);
1654 }
1655 
1656 static void
1657 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1658 {
1659         ASSERT(MUTEX_HELD(&cpu_lock));
1660         ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1661 
1662         mutex_destroy(&mmu_ctxp->mmu_lock);
1663 
1664         if (mmu_ctxp->mmu_kstat)
1665                 kstat_delete(mmu_ctxp->mmu_kstat);
1666 
1667         /* mmu_saved_gnum is protected by the cpu_lock. */
1668         if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1669                 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1670 
1671         kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1672 }
1673 
1674 /*
1675  * Called to perform MMU context-related cleanup for a CPU.
1676  */
1677 void
1678 sfmmu_cpu_cleanup(cpu_t *cp)
1679 {
1680         mmu_ctx_t       *mmu_ctxp;
1681 
1682         ASSERT(MUTEX_HELD(&cpu_lock));
1683 
1684         mmu_ctxp = CPU_MMU_CTXP(cp);
1685         ASSERT(mmu_ctxp != NULL);
1686 
1687         /*
1688          * The mmu_lock is acquired here to prevent races with
1689          * the wrap-around code.
1690          */
1691         mutex_enter(&mmu_ctxp->mmu_lock);
1692 
1693         CPU_MMU_CTXP(cp) = NULL;
1694 
1695         CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1696         if (--mmu_ctxp->mmu_ncpus == 0) {
1697                 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1698                 mutex_exit(&mmu_ctxp->mmu_lock);
1699                 sfmmu_ctxdom_free(mmu_ctxp);
1700                 return;
1701         }
1702 
1703         mutex_exit(&mmu_ctxp->mmu_lock);
1704 }
1705 
1706 uint_t
1707 sfmmu_ctxdom_nctxs(int idx)
1708 {
1709         return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1710 }
1711 
1712 #ifdef sun4v
1713 /*
1714  * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1715  * consistant after suspend/resume on system that can resume on a different
1716  * hardware than it was suspended.
1717  *
1718  * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1719  * from being allocated.  It acquires all hat_locks, which blocks most access to
1720  * context data, except for a few cases that are handled separately or are
1721  * harmless.  It wraps each domain to increment gnum and invalidate on-CPU
1722  * contexts, and forces cnum to its max.  As a result of this call all user
1723  * threads that are running on CPUs trap and try to perform wrap around but
1724  * can't because hat_locks are taken.  Threads that were not on CPUs but started
1725  * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1726  * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1727  * on hat_lock trying to wrap.  sfmmu_ctxdom_lock() must be called before CPUs
1728  * are paused, else it could deadlock acquiring locks held by paused CPUs.
1729  *
1730  * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1731  * the CPUs that had them.  It must be called after CPUs have been paused. This
1732  * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1733  * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1734  * runs with interrupts disabled.  When CPUs are later resumed, they may enter
1735  * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1736  * return failure.  Or, they will be blocked trying to acquire hat_lock. Thus
1737  * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1738  * accessing the old context domains.
1739  *
1740  * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1741  * allocates new context domains based on hardware layout.  It initializes
1742  * every CPU that had context domain before migration to have one again.
1743  * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1744  * could deadlock acquiring locks held by paused CPUs.
1745  *
1746  * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1747  * acquire new context ids and continue execution.
1748  *
1749  * Therefore functions should be called in the following order:
1750  *       suspend_routine()
1751  *              sfmmu_ctxdom_lock()
1752  *              pause_cpus()
1753  *              suspend()
1754  *                      if (suspend failed)
1755  *                              sfmmu_ctxdom_unlock()
1756  *              ...
1757  *              sfmmu_ctxdom_remove()
1758  *              resume_cpus()
1759  *              sfmmu_ctxdom_update()
1760  *              sfmmu_ctxdom_unlock()
1761  */
1762 static cpuset_t sfmmu_ctxdoms_pset;
1763 
1764 void
1765 sfmmu_ctxdoms_remove()
1766 {
1767         processorid_t   id;
1768         cpu_t           *cp;
1769 
1770         /*
1771          * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1772          * be restored post-migration. A CPU may be powered off and not have a
1773          * domain, for example.
1774          */
1775         CPUSET_ZERO(sfmmu_ctxdoms_pset);
1776 
1777         for (id = 0; id < NCPU; id++) {
1778                 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1779                         CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1780                         CPU_MMU_CTXP(cp) = NULL;
1781                 }
1782         }
1783 }
1784 
1785 void
1786 sfmmu_ctxdoms_lock(void)
1787 {
1788         int             idx;
1789         mmu_ctx_t       *mmu_ctxp;
1790 
1791         sfmmu_hat_lock_all();
1792 
1793         /*
1794          * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1795          * hat_lock is always taken before calling it.
1796          *
1797          * For each domain, set mmu_cnum to max so no more contexts can be
1798          * allocated, and wrap to flush on-CPU contexts and force threads to
1799          * acquire a new context when we later drop hat_lock after migration.
1800          * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1801          * but the latter uses CAS and will miscompare and not overwrite it.
1802          */
1803         kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1804         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1805                 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1806                         mutex_enter(&mmu_ctxp->mmu_lock);
1807                         mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1808                         /* make sure updated cnum visible */
1809                         membar_enter();
1810                         mutex_exit(&mmu_ctxp->mmu_lock);
1811                         sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1812                 }
1813         }
1814         kpreempt_enable();
1815 }
1816 
1817 void
1818 sfmmu_ctxdoms_unlock(void)
1819 {
1820         sfmmu_hat_unlock_all();
1821 }
1822 
1823 void
1824 sfmmu_ctxdoms_update(void)
1825 {
1826         processorid_t   id;
1827         cpu_t           *cp;
1828         uint_t          idx;
1829         mmu_ctx_t       *mmu_ctxp;
1830 
1831         /*
1832          * Free all context domains.  As side effect, this increases
1833          * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1834          * init gnum in the new domains, which therefore will be larger than the
1835          * sfmmu gnum for any process, guaranteeing that every process will see
1836          * a new generation and allocate a new context regardless of what new
1837          * domain it runs in.
1838          */
1839         mutex_enter(&cpu_lock);
1840 
1841         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1842                 if (mmu_ctxs_tbl[idx] != NULL) {
1843                         mmu_ctxp = mmu_ctxs_tbl[idx];
1844                         mmu_ctxs_tbl[idx] = NULL;
1845                         sfmmu_ctxdom_free(mmu_ctxp);
1846                 }
1847         }
1848 
1849         for (id = 0; id < NCPU; id++) {
1850                 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1851                     (cp = cpu[id]) != NULL)
1852                         sfmmu_cpu_init(cp);
1853         }
1854         mutex_exit(&cpu_lock);
1855 }
1856 #endif
1857 
1858 /*
1859  * Hat_setup, makes an address space context the current active one.
1860  * In sfmmu this translates to setting the secondary context with the
1861  * corresponding context.
1862  */
1863 void
1864 hat_setup(struct hat *sfmmup, int allocflag)
1865 {
1866         hatlock_t *hatlockp;
1867 
1868         /* Init needs some special treatment. */
1869         if (allocflag == HAT_INIT) {
1870                 /*
1871                  * Make sure that we have
1872                  * 1. a TSB
1873                  * 2. a valid ctx that doesn't get stolen after this point.
1874                  */
1875                 hatlockp = sfmmu_hat_enter(sfmmup);
1876 
1877                 /*
1878                  * Swap in the TSB.  hat_init() allocates tsbinfos without
1879                  * TSBs, but we need one for init, since the kernel does some
1880                  * special things to set up its stack and needs the TSB to
1881                  * resolve page faults.
1882                  */
1883                 sfmmu_tsb_swapin(sfmmup, hatlockp);
1884 
1885                 sfmmu_get_ctx(sfmmup);
1886 
1887                 sfmmu_hat_exit(hatlockp);
1888         } else {
1889                 ASSERT(allocflag == HAT_ALLOC);
1890 
1891                 hatlockp = sfmmu_hat_enter(sfmmup);
1892                 kpreempt_disable();
1893 
1894                 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1895                 /*
1896                  * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1897                  * pagesize bits don't matter in this case since we are passing
1898                  * INVALID_CONTEXT to it.
1899                  * Compatibility Note: hw takes care of MMU_SCONTEXT1
1900                  */
1901                 sfmmu_setctx_sec(INVALID_CONTEXT);
1902                 sfmmu_clear_utsbinfo();
1903 
1904                 kpreempt_enable();
1905                 sfmmu_hat_exit(hatlockp);
1906         }
1907 }
1908 
1909 /*
1910  * Free all the translation resources for the specified address space.
1911  * Called from as_free when an address space is being destroyed.
1912  */
1913 void
1914 hat_free_start(struct hat *sfmmup)
1915 {
1916         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1917         ASSERT(sfmmup != ksfmmup);
1918 
1919         sfmmup->sfmmu_free = 1;
1920         if (sfmmup->sfmmu_scdp != NULL) {
1921                 sfmmu_leave_scd(sfmmup, 0);
1922         }
1923 
1924         ASSERT(sfmmup->sfmmu_scdp == NULL);
1925 }
1926 
1927 void
1928 hat_free_end(struct hat *sfmmup)
1929 {
1930         int i;
1931 
1932         ASSERT(sfmmup->sfmmu_free == 1);
1933         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1934         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1935         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1936         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1937         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1938         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1939 
1940         if (sfmmup->sfmmu_rmstat) {
1941                 hat_freestat(sfmmup->sfmmu_as, NULL);
1942         }
1943 
1944         while (sfmmup->sfmmu_tsb != NULL) {
1945                 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1946                 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1947                 sfmmup->sfmmu_tsb = next;
1948         }
1949 
1950         if (sfmmup->sfmmu_srdp != NULL) {
1951                 sfmmu_leave_srd(sfmmup);
1952                 ASSERT(sfmmup->sfmmu_srdp == NULL);
1953                 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1954                         if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1955                                 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1956                                     SFMMU_L2_HMERLINKS_SIZE);
1957                                 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1958                         }
1959                 }
1960         }
1961         sfmmu_free_sfmmu(sfmmup);
1962 
1963 #ifdef DEBUG
1964         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1965                 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1966         }
1967 #endif
1968 
1969         kmem_cache_free(sfmmuid_cache, sfmmup);
1970 }
1971 
1972 /*
1973  * Set up any translation structures, for the specified address space,
1974  * that are needed or preferred when the process is being swapped in.
1975  */
1976 /* ARGSUSED */
1977 void
1978 hat_swapin(struct hat *hat)
1979 {
1980 }
1981 
1982 /*
1983  * Free all of the translation resources, for the specified address space,
1984  * that can be freed while the process is swapped out. Called from as_swapout.
1985  * Also, free up the ctx that this process was using.
1986  */
1987 void
1988 hat_swapout(struct hat *sfmmup)
1989 {
1990         struct hmehash_bucket *hmebp;
1991         struct hme_blk *hmeblkp;
1992         struct hme_blk *pr_hblk = NULL;
1993         struct hme_blk *nx_hblk;
1994         int i;
1995         struct hme_blk *list = NULL;
1996         hatlock_t *hatlockp;
1997         struct tsb_info *tsbinfop;
1998         struct free_tsb {
1999                 struct free_tsb *next;
2000                 struct tsb_info *tsbinfop;
2001         };                      /* free list of TSBs */
2002         struct free_tsb *freelist, *last, *next;
2003 
2004         SFMMU_STAT(sf_swapout);
2005 
2006         /*
2007          * There is no way to go from an as to all its translations in sfmmu.
2008          * Here is one of the times when we take the big hit and traverse
2009          * the hash looking for hme_blks to free up.  Not only do we free up
2010          * this as hme_blks but all those that are free.  We are obviously
2011          * swapping because we need memory so let's free up as much
2012          * as we can.
2013          *
2014          * Note that we don't flush TLB/TSB here -- it's not necessary
2015          * because:
2016          *  1) we free the ctx we're using and throw away the TSB(s);
2017          *  2) processes aren't runnable while being swapped out.
2018          */
2019         ASSERT(sfmmup != KHATID);
2020         for (i = 0; i <= UHMEHASH_SZ; i++) {
2021                 hmebp = &uhme_hash[i];
2022                 SFMMU_HASH_LOCK(hmebp);
2023                 hmeblkp = hmebp->hmeblkp;
2024                 pr_hblk = NULL;
2025                 while (hmeblkp) {
2026 
2027                         if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2028                             !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2029                                 ASSERT(!hmeblkp->hblk_shared);
2030                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2031                                     (caddr_t)get_hblk_base(hmeblkp),
2032                                     get_hblk_endaddr(hmeblkp),
2033                                     NULL, HAT_UNLOAD);
2034                         }
2035                         nx_hblk = hmeblkp->hblk_next;
2036                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2037                                 ASSERT(!hmeblkp->hblk_lckcnt);
2038                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2039                                     &list, 0);
2040                         } else {
2041                                 pr_hblk = hmeblkp;
2042                         }
2043                         hmeblkp = nx_hblk;
2044                 }
2045                 SFMMU_HASH_UNLOCK(hmebp);
2046         }
2047 
2048         sfmmu_hblks_list_purge(&list, 0);
2049 
2050         /*
2051          * Now free up the ctx so that others can reuse it.
2052          */
2053         hatlockp = sfmmu_hat_enter(sfmmup);
2054 
2055         sfmmu_invalidate_ctx(sfmmup);
2056 
2057         /*
2058          * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2059          * If TSBs were never swapped in, just return.
2060          * This implies that we don't support partial swapping
2061          * of TSBs -- either all are swapped out, or none are.
2062          *
2063          * We must hold the HAT lock here to prevent racing with another
2064          * thread trying to unmap TTEs from the TSB or running the post-
2065          * relocator after relocating the TSB's memory.  Unfortunately, we
2066          * can't free memory while holding the HAT lock or we could
2067          * deadlock, so we build a list of TSBs to be freed after marking
2068          * the tsbinfos as swapped out and free them after dropping the
2069          * lock.
2070          */
2071         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2072                 sfmmu_hat_exit(hatlockp);
2073                 return;
2074         }
2075 
2076         SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2077         last = freelist = NULL;
2078         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2079             tsbinfop = tsbinfop->tsb_next) {
2080                 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2081 
2082                 /*
2083                  * Cast the TSB into a struct free_tsb and put it on the free
2084                  * list.
2085                  */
2086                 if (freelist == NULL) {
2087                         last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2088                 } else {
2089                         last->next = (struct free_tsb *)tsbinfop->tsb_va;
2090                         last = last->next;
2091                 }
2092                 last->next = NULL;
2093                 last->tsbinfop = tsbinfop;
2094                 tsbinfop->tsb_flags |= TSB_SWAPPED;
2095                 /*
2096                  * Zero out the TTE to clear the valid bit.
2097                  * Note we can't use a value like 0xbad because we want to
2098                  * ensure diagnostic bits are NEVER set on TTEs that might
2099                  * be loaded.  The intent is to catch any invalid access
2100                  * to the swapped TSB, such as a thread running with a valid
2101                  * context without first calling sfmmu_tsb_swapin() to
2102                  * allocate TSB memory.
2103                  */
2104                 tsbinfop->tsb_tte.ll = 0;
2105         }
2106 
2107         /* Now we can drop the lock and free the TSB memory. */
2108         sfmmu_hat_exit(hatlockp);
2109         for (; freelist != NULL; freelist = next) {
2110                 next = freelist->next;
2111                 sfmmu_tsb_free(freelist->tsbinfop);
2112         }
2113 }
2114 
2115 /*
2116  * Duplicate the translations of an as into another newas
2117  */
2118 /* ARGSUSED */
2119 int
2120 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2121         uint_t flag)
2122 {
2123         sf_srd_t *srdp;
2124         sf_scd_t *scdp;
2125         int i;
2126         extern uint_t get_color_start(struct as *);
2127 
2128         ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2129             (flag == HAT_DUP_SRD));
2130         ASSERT(hat != ksfmmup);
2131         ASSERT(newhat != ksfmmup);
2132         ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2133 
2134         if (flag == HAT_DUP_COW) {
2135                 panic("hat_dup: HAT_DUP_COW not supported");
2136         }
2137 
2138         if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2139                 ASSERT(srdp->srd_evp != NULL);
2140                 VN_HOLD(srdp->srd_evp);
2141                 ASSERT(srdp->srd_refcnt > 0);
2142                 newhat->sfmmu_srdp = srdp;
2143                 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2144         }
2145 
2146         /*
2147          * HAT_DUP_ALL flag is used after as duplication is done.
2148          */
2149         if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2150                 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2151                 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2152                 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2153                         newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2154                 }
2155 
2156                 /* check if need to join scd */
2157                 if ((scdp = hat->sfmmu_scdp) != NULL &&
2158                     newhat->sfmmu_scdp != scdp) {
2159                         int ret;
2160                         SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2161                             &scdp->scd_region_map, ret);
2162                         ASSERT(ret);
2163                         sfmmu_join_scd(scdp, newhat);
2164                         ASSERT(newhat->sfmmu_scdp == scdp &&
2165                             scdp->scd_refcnt >= 2);
2166                         for (i = 0; i < max_mmu_page_sizes; i++) {
2167                                 newhat->sfmmu_ismttecnt[i] =
2168                                     hat->sfmmu_ismttecnt[i];
2169                                 newhat->sfmmu_scdismttecnt[i] =
2170                                     hat->sfmmu_scdismttecnt[i];
2171                         }
2172                 }
2173 
2174                 sfmmu_check_page_sizes(newhat, 1);
2175         }
2176 
2177         if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2178             update_proc_pgcolorbase_after_fork != 0) {
2179                 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2180         }
2181         return (0);
2182 }
2183 
2184 void
2185 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2186         uint_t attr, uint_t flags)
2187 {
2188         hat_do_memload(hat, addr, pp, attr, flags,
2189             SFMMU_INVALID_SHMERID);
2190 }
2191 
2192 void
2193 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2194         uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2195 {
2196         uint_t rid;
2197         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2198                 hat_do_memload(hat, addr, pp, attr, flags,
2199                     SFMMU_INVALID_SHMERID);
2200                 return;
2201         }
2202         rid = (uint_t)((uint64_t)rcookie);
2203         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2204         hat_do_memload(hat, addr, pp, attr, flags, rid);
2205 }
2206 
2207 /*
2208  * Set up addr to map to page pp with protection prot.
2209  * As an optimization we also load the TSB with the
2210  * corresponding tte but it is no big deal if  the tte gets kicked out.
2211  */
2212 static void
2213 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2214         uint_t attr, uint_t flags, uint_t rid)
2215 {
2216         tte_t tte;
2217 
2218 
2219         ASSERT(hat != NULL);
2220         ASSERT(PAGE_LOCKED(pp));
2221         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2222         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2223         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2224         SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2225 
2226         if (PP_ISFREE(pp)) {
2227                 panic("hat_memload: loading a mapping to free page %p",
2228                     (void *)pp);
2229         }
2230 
2231         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2232 
2233         if (flags & ~SFMMU_LOAD_ALLFLAG)
2234                 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2235                     flags & ~SFMMU_LOAD_ALLFLAG);
2236 
2237         if (hat->sfmmu_rmstat)
2238                 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2239 
2240 #if defined(SF_ERRATA_57)
2241         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2242             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2243             !(flags & HAT_LOAD_SHARE)) {
2244                 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2245                     " page executable");
2246                 attr &= ~PROT_EXEC;
2247         }
2248 #endif
2249 
2250         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2251         (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2252 
2253         /*
2254          * Check TSB and TLB page sizes.
2255          */
2256         if ((flags & HAT_LOAD_SHARE) == 0) {
2257                 sfmmu_check_page_sizes(hat, 1);
2258         }
2259 }
2260 
2261 /*
2262  * hat_devload can be called to map real memory (e.g.
2263  * /dev/kmem) and even though hat_devload will determine pf is
2264  * for memory, it will be unable to get a shared lock on the
2265  * page (because someone else has it exclusively) and will
2266  * pass dp = NULL.  If tteload doesn't get a non-NULL
2267  * page pointer it can't cache memory.
2268  */
2269 void
2270 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2271         uint_t attr, int flags)
2272 {
2273         tte_t tte;
2274         struct page *pp = NULL;
2275         int use_lgpg = 0;
2276 
2277         ASSERT(hat != NULL);
2278 
2279         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2280         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2281         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2282         if (len == 0)
2283                 panic("hat_devload: zero len");
2284         if (flags & ~SFMMU_LOAD_ALLFLAG)
2285                 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2286                     flags & ~SFMMU_LOAD_ALLFLAG);
2287 
2288 #if defined(SF_ERRATA_57)
2289         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2290             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2291             !(flags & HAT_LOAD_SHARE)) {
2292                 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2293                     " page executable");
2294                 attr &= ~PROT_EXEC;
2295         }
2296 #endif
2297 
2298         /*
2299          * If it's a memory page find its pp
2300          */
2301         if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2302                 pp = page_numtopp_nolock(pfn);
2303                 if (pp == NULL) {
2304                         flags |= HAT_LOAD_NOCONSIST;
2305                 } else {
2306                         if (PP_ISFREE(pp)) {
2307                                 panic("hat_memload: loading "
2308                                     "a mapping to free page %p",
2309                                     (void *)pp);
2310                         }
2311                         if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2312                                 panic("hat_memload: loading a mapping "
2313                                     "to unlocked relocatable page %p",
2314                                     (void *)pp);
2315                         }
2316                         ASSERT(len == MMU_PAGESIZE);
2317                 }
2318         }
2319 
2320         if (hat->sfmmu_rmstat)
2321                 hat_resvstat(len, hat->sfmmu_as, addr);
2322 
2323         if (flags & HAT_LOAD_NOCONSIST) {
2324                 attr |= SFMMU_UNCACHEVTTE;
2325                 use_lgpg = 1;
2326         }
2327         if (!pf_is_memory(pfn)) {
2328                 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2329                 use_lgpg = 1;
2330                 switch (attr & HAT_ORDER_MASK) {
2331                         case HAT_STRICTORDER:
2332                         case HAT_UNORDERED_OK:
2333                                 /*
2334                                  * we set the side effect bit for all non
2335                                  * memory mappings unless merging is ok
2336                                  */
2337                                 attr |= SFMMU_SIDEFFECT;
2338                                 break;
2339                         case HAT_MERGING_OK:
2340                         case HAT_LOADCACHING_OK:
2341                         case HAT_STORECACHING_OK:
2342                                 break;
2343                         default:
2344                                 panic("hat_devload: bad attr");
2345                                 break;
2346                 }
2347         }
2348         while (len) {
2349                 if (!use_lgpg) {
2350                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2351                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2352                             flags, SFMMU_INVALID_SHMERID);
2353                         len -= MMU_PAGESIZE;
2354                         addr += MMU_PAGESIZE;
2355                         pfn++;
2356                         continue;
2357                 }
2358                 /*
2359                  *  try to use large pages, check va/pa alignments
2360                  *  Note that 32M/256M page sizes are not (yet) supported.
2361                  */
2362                 if ((len >= MMU_PAGESIZE4M) &&
2363                     !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2364                     !(disable_large_pages & (1 << TTE4M)) &&
2365                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2366                         sfmmu_memtte(&tte, pfn, attr, TTE4M);
2367                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2368                             flags, SFMMU_INVALID_SHMERID);
2369                         len -= MMU_PAGESIZE4M;
2370                         addr += MMU_PAGESIZE4M;
2371                         pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2372                 } else if ((len >= MMU_PAGESIZE512K) &&
2373                     !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2374                     !(disable_large_pages & (1 << TTE512K)) &&
2375                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2376                         sfmmu_memtte(&tte, pfn, attr, TTE512K);
2377                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2378                             flags, SFMMU_INVALID_SHMERID);
2379                         len -= MMU_PAGESIZE512K;
2380                         addr += MMU_PAGESIZE512K;
2381                         pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2382                 } else if ((len >= MMU_PAGESIZE64K) &&
2383                     !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2384                     !(disable_large_pages & (1 << TTE64K)) &&
2385                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2386                         sfmmu_memtte(&tte, pfn, attr, TTE64K);
2387                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2388                             flags, SFMMU_INVALID_SHMERID);
2389                         len -= MMU_PAGESIZE64K;
2390                         addr += MMU_PAGESIZE64K;
2391                         pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2392                 } else {
2393                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2394                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2395                             flags, SFMMU_INVALID_SHMERID);
2396                         len -= MMU_PAGESIZE;
2397                         addr += MMU_PAGESIZE;
2398                         pfn++;
2399                 }
2400         }
2401 
2402         /*
2403          * Check TSB and TLB page sizes.
2404          */
2405         if ((flags & HAT_LOAD_SHARE) == 0) {
2406                 sfmmu_check_page_sizes(hat, 1);
2407         }
2408 }
2409 
2410 void
2411 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2412         struct page **pps, uint_t attr, uint_t flags)
2413 {
2414         hat_do_memload_array(hat, addr, len, pps, attr, flags,
2415             SFMMU_INVALID_SHMERID);
2416 }
2417 
2418 void
2419 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2420         struct page **pps, uint_t attr, uint_t flags,
2421         hat_region_cookie_t rcookie)
2422 {
2423         uint_t rid;
2424         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2425                 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2426                     SFMMU_INVALID_SHMERID);
2427                 return;
2428         }
2429         rid = (uint_t)((uint64_t)rcookie);
2430         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2431         hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2432 }
2433 
2434 /*
2435  * Map the largest extend possible out of the page array. The array may NOT
2436  * be in order.  The largest possible mapping a page can have
2437  * is specified in the p_szc field.  The p_szc field
2438  * cannot change as long as there any mappings (large or small)
2439  * to any of the pages that make up the large page. (ie. any
2440  * promotion/demotion of page size is not up to the hat but up to
2441  * the page free list manager).  The array
2442  * should consist of properly aligned contigous pages that are
2443  * part of a big page for a large mapping to be created.
2444  */
2445 static void
2446 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2447         struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2448 {
2449         int  ttesz;
2450         size_t mapsz;
2451         pgcnt_t numpg, npgs;
2452         tte_t tte;
2453         page_t *pp;
2454         uint_t large_pages_disable;
2455 
2456         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2457         SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2458 
2459         if (hat->sfmmu_rmstat)
2460                 hat_resvstat(len, hat->sfmmu_as, addr);
2461 
2462 #if defined(SF_ERRATA_57)
2463         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2464             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2465             !(flags & HAT_LOAD_SHARE)) {
2466                 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2467                     "user page executable");
2468                 attr &= ~PROT_EXEC;
2469         }
2470 #endif
2471 
2472         /* Get number of pages */
2473         npgs = len >> MMU_PAGESHIFT;
2474 
2475         if (flags & HAT_LOAD_SHARE) {
2476                 large_pages_disable = disable_ism_large_pages;
2477         } else {
2478                 large_pages_disable = disable_large_pages;
2479         }
2480 
2481         if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2482                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2483                     rid);
2484                 return;
2485         }
2486 
2487         while (npgs >= NHMENTS) {
2488                 pp = *pps;
2489                 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2490                         /*
2491                          * Check if this page size is disabled.
2492                          */
2493                         if (large_pages_disable & (1 << ttesz))
2494                                 continue;
2495 
2496                         numpg = TTEPAGES(ttesz);
2497                         mapsz = numpg << MMU_PAGESHIFT;
2498                         if ((npgs >= numpg) &&
2499                             IS_P2ALIGNED(addr, mapsz) &&
2500                             IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2501                                 /*
2502                                  * At this point we have enough pages and
2503                                  * we know the virtual address and the pfn
2504                                  * are properly aligned.  We still need
2505                                  * to check for physical contiguity but since
2506                                  * it is very likely that this is the case
2507                                  * we will assume they are so and undo
2508                                  * the request if necessary.  It would
2509                                  * be great if we could get a hint flag
2510                                  * like HAT_CONTIG which would tell us
2511                                  * the pages are contigous for sure.
2512                                  */
2513                                 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2514                                     attr, ttesz);
2515                                 if (!sfmmu_tteload_array(hat, &tte, addr,
2516                                     pps, flags, rid)) {
2517                                         break;
2518                                 }
2519                         }
2520                 }
2521                 if (ttesz == TTE8K) {
2522                         /*
2523                          * We were not able to map array using a large page
2524                          * batch a hmeblk or fraction at a time.
2525                          */
2526                         numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2527                             & (NHMENTS-1);
2528                         numpg = NHMENTS - numpg;
2529                         ASSERT(numpg <= npgs);
2530                         mapsz = numpg * MMU_PAGESIZE;
2531                         sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2532                             numpg, rid);
2533                 }
2534                 addr += mapsz;
2535                 npgs -= numpg;
2536                 pps += numpg;
2537         }
2538 
2539         if (npgs) {
2540                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2541                     rid);
2542         }
2543 
2544         /*
2545          * Check TSB and TLB page sizes.
2546          */
2547         if ((flags & HAT_LOAD_SHARE) == 0) {
2548                 sfmmu_check_page_sizes(hat, 1);
2549         }
2550 }
2551 
2552 /*
2553  * Function tries to batch 8K pages into the same hme blk.
2554  */
2555 static void
2556 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2557                     uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2558 {
2559         tte_t   tte;
2560         page_t *pp;
2561         struct hmehash_bucket *hmebp;
2562         struct hme_blk *hmeblkp;
2563         int     index;
2564 
2565         while (npgs) {
2566                 /*
2567                  * Acquire the hash bucket.
2568                  */
2569                 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2570                     rid);
2571                 ASSERT(hmebp);
2572 
2573                 /*
2574                  * Find the hment block.
2575                  */
2576                 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2577                     TTE8K, flags, rid);
2578                 ASSERT(hmeblkp);
2579 
2580                 do {
2581                         /*
2582                          * Make the tte.
2583                          */
2584                         pp = *pps;
2585                         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2586 
2587                         /*
2588                          * Add the translation.
2589                          */
2590                         (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2591                             vaddr, pps, flags, rid);
2592 
2593                         /*
2594                          * Goto next page.
2595                          */
2596                         pps++;
2597                         npgs--;
2598 
2599                         /*
2600                          * Goto next address.
2601                          */
2602                         vaddr += MMU_PAGESIZE;
2603 
2604                         /*
2605                          * Don't crossover into a different hmentblk.
2606                          */
2607                         index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2608                             (NHMENTS-1));
2609 
2610                 } while (index != 0 && npgs != 0);
2611 
2612                 /*
2613                  * Release the hash bucket.
2614                  */
2615 
2616                 sfmmu_tteload_release_hashbucket(hmebp);
2617         }
2618 }
2619 
2620 /*
2621  * Construct a tte for a page:
2622  *
2623  * tte_valid = 1
2624  * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2625  * tte_size = size
2626  * tte_nfo = attr & HAT_NOFAULT
2627  * tte_ie = attr & HAT_STRUCTURE_LE
2628  * tte_hmenum = hmenum
2629  * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2630  * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2631  * tte_ref = 1 (optimization)
2632  * tte_wr_perm = attr & PROT_WRITE;
2633  * tte_no_sync = attr & HAT_NOSYNC
2634  * tte_lock = attr & SFMMU_LOCKTTE
2635  * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2636  * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2637  * tte_e = attr & SFMMU_SIDEFFECT
2638  * tte_priv = !(attr & PROT_USER)
2639  * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2640  * tte_glb = 0
2641  */
2642 void
2643 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2644 {
2645         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2646 
2647         ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2648         ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2649 
2650         if (TTE_IS_NOSYNC(ttep)) {
2651                 TTE_SET_REF(ttep);
2652                 if (TTE_IS_WRITABLE(ttep)) {
2653                         TTE_SET_MOD(ttep);
2654                 }
2655         }
2656         if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2657                 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2658         }
2659 }
2660 
2661 /*
2662  * This function will add a translation to the hme_blk and allocate the
2663  * hme_blk if one does not exist.
2664  * If a page structure is specified then it will add the
2665  * corresponding hment to the mapping list.
2666  * It will also update the hmenum field for the tte.
2667  *
2668  * Currently this function is only used for kernel mappings.
2669  * So pass invalid region to sfmmu_tteload_array().
2670  */
2671 void
2672 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2673         uint_t flags)
2674 {
2675         ASSERT(sfmmup == ksfmmup);
2676         (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2677             SFMMU_INVALID_SHMERID);
2678 }
2679 
2680 /*
2681  * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2682  * Assumes that a particular page size may only be resident in one TSB.
2683  */
2684 static void
2685 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2686 {
2687         struct tsb_info *tsbinfop = NULL;
2688         uint64_t tag;
2689         struct tsbe *tsbe_addr;
2690         uint64_t tsb_base;
2691         uint_t tsb_size;
2692         int vpshift = MMU_PAGESHIFT;
2693         int phys = 0;
2694 
2695         if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2696                 phys = ktsb_phys;
2697                 if (ttesz >= TTE4M) {
2698 #ifndef sun4v
2699                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2700 #endif
2701                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2702                         tsb_size = ktsb4m_szcode;
2703                 } else {
2704                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2705                         tsb_size = ktsb_szcode;
2706                 }
2707         } else {
2708                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2709 
2710                 /*
2711                  * If there isn't a TSB for this page size, or the TSB is
2712                  * swapped out, there is nothing to do.  Note that the latter
2713                  * case seems impossible but can occur if hat_pageunload()
2714                  * is called on an ISM mapping while the process is swapped
2715                  * out.
2716                  */
2717                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2718                         return;
2719 
2720                 /*
2721                  * If another thread is in the middle of relocating a TSB
2722                  * we can't unload the entry so set a flag so that the
2723                  * TSB will be flushed before it can be accessed by the
2724                  * process.
2725                  */
2726                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2727                         if (ttep == NULL)
2728                                 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2729                         return;
2730                 }
2731 #if defined(UTSB_PHYS)
2732                 phys = 1;
2733                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2734 #else
2735                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2736 #endif
2737                 tsb_size = tsbinfop->tsb_szc;
2738         }
2739         if (ttesz >= TTE4M)
2740                 vpshift = MMU_PAGESHIFT4M;
2741 
2742         tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2743         tag = sfmmu_make_tsbtag(vaddr);
2744 
2745         if (ttep == NULL) {
2746                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2747         } else {
2748                 if (ttesz >= TTE4M) {
2749                         SFMMU_STAT(sf_tsb_load4m);
2750                 } else {
2751                         SFMMU_STAT(sf_tsb_load8k);
2752                 }
2753 
2754                 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2755         }
2756 }
2757 
2758 /*
2759  * Unmap all entries from [start, end) matching the given page size.
2760  *
2761  * This function is used primarily to unmap replicated 64K or 512K entries
2762  * from the TSB that are inserted using the base page size TSB pointer, but
2763  * it may also be called to unmap a range of addresses from the TSB.
2764  */
2765 void
2766 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2767 {
2768         struct tsb_info *tsbinfop;
2769         uint64_t tag;
2770         struct tsbe *tsbe_addr;
2771         caddr_t vaddr;
2772         uint64_t tsb_base;
2773         int vpshift, vpgsz;
2774         uint_t tsb_size;
2775         int phys = 0;
2776 
2777         /*
2778          * Assumptions:
2779          *  If ttesz == 8K, 64K or 512K, we walk through the range 8K
2780          *  at a time shooting down any valid entries we encounter.
2781          *
2782          *  If ttesz >= 4M we walk the range 4M at a time shooting
2783          *  down any valid mappings we find.
2784          */
2785         if (sfmmup == ksfmmup) {
2786                 phys = ktsb_phys;
2787                 if (ttesz >= TTE4M) {
2788 #ifndef sun4v
2789                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2790 #endif
2791                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2792                         tsb_size = ktsb4m_szcode;
2793                 } else {
2794                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2795                         tsb_size = ktsb_szcode;
2796                 }
2797         } else {
2798                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2799 
2800                 /*
2801                  * If there isn't a TSB for this page size, or the TSB is
2802                  * swapped out, there is nothing to do.  Note that the latter
2803                  * case seems impossible but can occur if hat_pageunload()
2804                  * is called on an ISM mapping while the process is swapped
2805                  * out.
2806                  */
2807                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2808                         return;
2809 
2810                 /*
2811                  * If another thread is in the middle of relocating a TSB
2812                  * we can't unload the entry so set a flag so that the
2813                  * TSB will be flushed before it can be accessed by the
2814                  * process.
2815                  */
2816                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2817                         tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2818                         return;
2819                 }
2820 #if defined(UTSB_PHYS)
2821                 phys = 1;
2822                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2823 #else
2824                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2825 #endif
2826                 tsb_size = tsbinfop->tsb_szc;
2827         }
2828         if (ttesz >= TTE4M) {
2829                 vpshift = MMU_PAGESHIFT4M;
2830                 vpgsz = MMU_PAGESIZE4M;
2831         } else {
2832                 vpshift = MMU_PAGESHIFT;
2833                 vpgsz = MMU_PAGESIZE;
2834         }
2835 
2836         for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2837                 tag = sfmmu_make_tsbtag(vaddr);
2838                 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2839                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2840         }
2841 }
2842 
2843 /*
2844  * Select the optimum TSB size given the number of mappings
2845  * that need to be cached.
2846  */
2847 static int
2848 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2849 {
2850         int szc = 0;
2851 
2852 #ifdef DEBUG
2853         if (tsb_grow_stress) {
2854                 uint32_t randval = (uint32_t)gettick() >> 4;
2855                 return (randval % (tsb_max_growsize + 1));
2856         }
2857 #endif  /* DEBUG */
2858 
2859         while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2860                 szc++;
2861         return (szc);
2862 }
2863 
2864 /*
2865  * This function will add a translation to the hme_blk and allocate the
2866  * hme_blk if one does not exist.
2867  * If a page structure is specified then it will add the
2868  * corresponding hment to the mapping list.
2869  * It will also update the hmenum field for the tte.
2870  * Furthermore, it attempts to create a large page translation
2871  * for <addr,hat> at page array pps.  It assumes addr and first
2872  * pp is correctly aligned.  It returns 0 if successful and 1 otherwise.
2873  */
2874 static int
2875 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2876         page_t **pps, uint_t flags, uint_t rid)
2877 {
2878         struct hmehash_bucket *hmebp;
2879         struct hme_blk *hmeblkp;
2880         int     ret;
2881         uint_t  size;
2882 
2883         /*
2884          * Get mapping size.
2885          */
2886         size = TTE_CSZ(ttep);
2887         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2888 
2889         /*
2890          * Acquire the hash bucket.
2891          */
2892         hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2893         ASSERT(hmebp);
2894 
2895         /*
2896          * Find the hment block.
2897          */
2898         hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2899             rid);
2900         ASSERT(hmeblkp);
2901 
2902         /*
2903          * Add the translation.
2904          */
2905         ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2906             rid);
2907 
2908         /*
2909          * Release the hash bucket.
2910          */
2911         sfmmu_tteload_release_hashbucket(hmebp);
2912 
2913         return (ret);
2914 }
2915 
2916 /*
2917  * Function locks and returns a pointer to the hash bucket for vaddr and size.
2918  */
2919 static struct hmehash_bucket *
2920 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2921     uint_t rid)
2922 {
2923         struct hmehash_bucket *hmebp;
2924         int hmeshift;
2925         void *htagid = sfmmutohtagid(sfmmup, rid);
2926 
2927         ASSERT(htagid != NULL);
2928 
2929         hmeshift = HME_HASH_SHIFT(size);
2930 
2931         hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2932 
2933         SFMMU_HASH_LOCK(hmebp);
2934 
2935         return (hmebp);
2936 }
2937 
2938 /*
2939  * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2940  * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2941  * allocated.
2942  */
2943 static struct hme_blk *
2944 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2945         caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2946 {
2947         hmeblk_tag hblktag;
2948         int hmeshift;
2949         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2950 
2951         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2952 
2953         hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2954         ASSERT(hblktag.htag_id != NULL);
2955         hmeshift = HME_HASH_SHIFT(size);
2956         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2957         hblktag.htag_rehash = HME_HASH_REHASH(size);
2958         hblktag.htag_rid = rid;
2959 
2960 ttearray_realloc:
2961 
2962         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2963 
2964         /*
2965          * We block until hblk_reserve_lock is released; it's held by
2966          * the thread, temporarily using hblk_reserve, until hblk_reserve is
2967          * replaced by a hblk from sfmmu8_cache.
2968          */
2969         if (hmeblkp == (struct hme_blk *)hblk_reserve &&
2970             hblk_reserve_thread != curthread) {
2971                 SFMMU_HASH_UNLOCK(hmebp);
2972                 mutex_enter(&hblk_reserve_lock);
2973                 mutex_exit(&hblk_reserve_lock);
2974                 SFMMU_STAT(sf_hblk_reserve_hit);
2975                 SFMMU_HASH_LOCK(hmebp);
2976                 goto ttearray_realloc;
2977         }
2978 
2979         if (hmeblkp == NULL) {
2980                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
2981                     hblktag, flags, rid);
2982                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2983                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2984         } else {
2985                 /*
2986                  * It is possible for 8k and 64k hblks to collide since they
2987                  * have the same rehash value. This is because we
2988                  * lazily free hblks and 8K/64K blks could be lingering.
2989                  * If we find size mismatch we free the block and & try again.
2990                  */
2991                 if (get_hblk_ttesz(hmeblkp) != size) {
2992                         ASSERT(!hmeblkp->hblk_vcnt);
2993                         ASSERT(!hmeblkp->hblk_hmecnt);
2994                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2995                             &list, 0);
2996                         goto ttearray_realloc;
2997                 }
2998                 if (hmeblkp->hblk_shw_bit) {
2999                         /*
3000                          * if the hblk was previously used as a shadow hblk then
3001                          * we will change it to a normal hblk
3002                          */
3003                         ASSERT(!hmeblkp->hblk_shared);
3004                         if (hmeblkp->hblk_shw_mask) {
3005                                 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3006                                 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3007                                 goto ttearray_realloc;
3008                         } else {
3009                                 hmeblkp->hblk_shw_bit = 0;
3010                         }
3011                 }
3012                 SFMMU_STAT(sf_hblk_hit);
3013         }
3014 
3015         /*
3016          * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3017          * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3018          * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3019          * just add these hmeblks to the per-cpu pending queue.
3020          */
3021         sfmmu_hblks_list_purge(&list, 1);
3022 
3023         ASSERT(get_hblk_ttesz(hmeblkp) == size);
3024         ASSERT(!hmeblkp->hblk_shw_bit);
3025         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3026         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3027         ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3028 
3029         return (hmeblkp);
3030 }
3031 
3032 /*
3033  * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3034  * otherwise.
3035  */
3036 static int
3037 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3038         caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3039 {
3040         page_t *pp = *pps;
3041         int hmenum, size, remap;
3042         tte_t tteold, flush_tte;
3043 #ifdef DEBUG
3044         tte_t orig_old;
3045 #endif /* DEBUG */
3046         struct sf_hment *sfhme;
3047         kmutex_t *pml, *pmtx;
3048         hatlock_t *hatlockp;
3049         int myflt;
3050 
3051         /*
3052          * remove this panic when we decide to let user virtual address
3053          * space be >= USERLIMIT.
3054          */
3055         if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3056                 panic("user addr %p in kernel space", (void *)vaddr);
3057 #if defined(TTE_IS_GLOBAL)
3058         if (TTE_IS_GLOBAL(ttep))
3059                 panic("sfmmu_tteload: creating global tte");
3060 #endif
3061 
3062 #ifdef DEBUG
3063         if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3064             !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3065                 panic("sfmmu_tteload: non cacheable memory tte");
3066 #endif /* DEBUG */
3067 
3068         /* don't simulate dirty bit for writeable ISM/DISM mappings */
3069         if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3070                 TTE_SET_REF(ttep);
3071                 TTE_SET_MOD(ttep);
3072         }
3073 
3074         if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3075             !TTE_IS_MOD(ttep)) {
3076                 /*
3077                  * Don't load TSB for dummy as in ISM.  Also don't preload
3078                  * the TSB if the TTE isn't writable since we're likely to
3079                  * fault on it again -- preloading can be fairly expensive.
3080                  */
3081                 flags |= SFMMU_NO_TSBLOAD;
3082         }
3083 
3084         size = TTE_CSZ(ttep);
3085         switch (size) {
3086         case TTE8K:
3087                 SFMMU_STAT(sf_tteload8k);
3088                 break;
3089         case TTE64K:
3090                 SFMMU_STAT(sf_tteload64k);
3091                 break;
3092         case TTE512K:
3093                 SFMMU_STAT(sf_tteload512k);
3094                 break;
3095         case TTE4M:
3096                 SFMMU_STAT(sf_tteload4m);
3097                 break;
3098         case (TTE32M):
3099                 SFMMU_STAT(sf_tteload32m);
3100                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3101                 break;
3102         case (TTE256M):
3103                 SFMMU_STAT(sf_tteload256m);
3104                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3105                 break;
3106         }
3107 
3108         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3109         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3110         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3111         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3112 
3113         HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3114 
3115         /*
3116          * Need to grab mlist lock here so that pageunload
3117          * will not change tte behind us.
3118          */
3119         if (pp) {
3120                 pml = sfmmu_mlist_enter(pp);
3121         }
3122 
3123         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3124         /*
3125          * Look for corresponding hment and if valid verify
3126          * pfns are equal.
3127          */
3128         remap = TTE_IS_VALID(&tteold);
3129         if (remap) {
3130                 pfn_t   new_pfn, old_pfn;
3131 
3132                 old_pfn = TTE_TO_PFN(vaddr, &tteold);
3133                 new_pfn = TTE_TO_PFN(vaddr, ttep);
3134 
3135                 if (flags & HAT_LOAD_REMAP) {
3136                         /* make sure we are remapping same type of pages */
3137                         if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3138                                 panic("sfmmu_tteload - tte remap io<->memory");
3139                         }
3140                         if (old_pfn != new_pfn &&
3141                             (pp != NULL || sfhme->hme_page != NULL)) {
3142                                 panic("sfmmu_tteload - tte remap pp != NULL");
3143                         }
3144                 } else if (old_pfn != new_pfn) {
3145                         panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3146                             (void *)hmeblkp);
3147                 }
3148                 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3149         }
3150 
3151         if (pp) {
3152                 if (size == TTE8K) {
3153 #ifdef VAC
3154                         /*
3155                          * Handle VAC consistency
3156                          */
3157                         if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3158                                 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3159                         }
3160 #endif
3161 
3162                         if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3163                                 pmtx = sfmmu_page_enter(pp);
3164                                 PP_CLRRO(pp);
3165                                 sfmmu_page_exit(pmtx);
3166                         } else if (!PP_ISMAPPED(pp) &&
3167                             (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3168                                 pmtx = sfmmu_page_enter(pp);
3169                                 if (!(PP_ISMOD(pp))) {
3170                                         PP_SETRO(pp);
3171                                 }
3172                                 sfmmu_page_exit(pmtx);
3173                         }
3174 
3175                 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3176                         /*
3177                          * sfmmu_pagearray_setup failed so return
3178                          */
3179                         sfmmu_mlist_exit(pml);
3180                         return (1);
3181                 }
3182         }
3183 
3184         /*
3185          * Make sure hment is not on a mapping list.
3186          */
3187         ASSERT(remap || (sfhme->hme_page == NULL));
3188 
3189         /* if it is not a remap then hme->next better be NULL */
3190         ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3191 
3192         if (flags & HAT_LOAD_LOCK) {
3193                 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3194                         panic("too high lckcnt-hmeblk %p",
3195                             (void *)hmeblkp);
3196                 }
3197                 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3198 
3199                 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3200         }
3201 
3202 #ifdef VAC
3203         if (pp && PP_ISNC(pp)) {
3204                 /*
3205                  * If the physical page is marked to be uncacheable, like
3206                  * by a vac conflict, make sure the new mapping is also
3207                  * uncacheable.
3208                  */
3209                 TTE_CLR_VCACHEABLE(ttep);
3210                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3211         }
3212 #endif
3213         ttep->tte_hmenum = hmenum;
3214 
3215 #ifdef DEBUG
3216         orig_old = tteold;
3217 #endif /* DEBUG */
3218 
3219         while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3220                 if ((sfmmup == KHATID) &&
3221                     (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3222                         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3223                 }
3224 #ifdef DEBUG
3225                 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3226 #endif /* DEBUG */
3227         }
3228         ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3229 
3230         if (!TTE_IS_VALID(&tteold)) {
3231 
3232                 atomic_inc_16(&hmeblkp->hblk_vcnt);
3233                 if (rid == SFMMU_INVALID_SHMERID) {
3234                         atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3235                 } else {
3236                         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3237                         sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3238                         /*
3239                          * We already accounted for region ttecnt's in sfmmu
3240                          * during hat_join_region() processing. Here we
3241                          * only update ttecnt's in region struture.
3242                          */
3243                         atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3244                 }
3245         }
3246 
3247         myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3248         if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3249             sfmmup != ksfmmup) {
3250                 uchar_t tteflag = 1 << size;
3251                 if (rid == SFMMU_INVALID_SHMERID) {
3252                         if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3253                                 hatlockp = sfmmu_hat_enter(sfmmup);
3254                                 sfmmup->sfmmu_tteflags |= tteflag;
3255                                 sfmmu_hat_exit(hatlockp);
3256                         }
3257                 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3258                         hatlockp = sfmmu_hat_enter(sfmmup);
3259                         sfmmup->sfmmu_rtteflags |= tteflag;
3260                         sfmmu_hat_exit(hatlockp);
3261                 }
3262                 /*
3263                  * Update the current CPU tsbmiss area, so the current thread
3264                  * won't need to take the tsbmiss for the new pagesize.
3265                  * The other threads in the process will update their tsb
3266                  * miss area lazily in sfmmu_tsbmiss_exception() when they
3267                  * fail to find the translation for a newly added pagesize.
3268                  */
3269                 if (size > TTE64K && myflt) {
3270                         struct tsbmiss *tsbmp;
3271                         kpreempt_disable();
3272                         tsbmp = &tsbmiss_area[CPU->cpu_id];
3273                         if (rid == SFMMU_INVALID_SHMERID) {
3274                                 if (!(tsbmp->uhat_tteflags & tteflag)) {
3275                                         tsbmp->uhat_tteflags |= tteflag;
3276                                 }
3277                         } else {
3278                                 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3279                                         tsbmp->uhat_rtteflags |= tteflag;
3280                                 }
3281                         }
3282                         kpreempt_enable();
3283                 }
3284         }
3285 
3286         if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3287             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3288                 hatlockp = sfmmu_hat_enter(sfmmup);
3289                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3290                 sfmmu_hat_exit(hatlockp);
3291         }
3292 
3293         flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3294             hw_tte.tte_intlo;
3295         flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3296             hw_tte.tte_inthi;
3297 
3298         if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3299                 /*
3300                  * If remap and new tte differs from old tte we need
3301                  * to sync the mod bit and flush TLB/TSB.  We don't
3302                  * need to sync ref bit because we currently always set
3303                  * ref bit in tteload.
3304                  */
3305                 ASSERT(TTE_IS_REF(ttep));
3306                 if (TTE_IS_MOD(&tteold)) {
3307                         sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3308                 }
3309                 /*
3310                  * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3311                  * hmes are only used for read only text. Adding this code for
3312                  * completeness and future use of shared hmeblks with writable
3313                  * mappings of VMODSORT vnodes.
3314                  */
3315                 if (hmeblkp->hblk_shared) {
3316                         cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3317                             sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3318                         xt_sync(cpuset);
3319                         SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3320                 } else {
3321                         sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3322                         xt_sync(sfmmup->sfmmu_cpusran);
3323                 }
3324         }
3325 
3326         if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3327                 /*
3328                  * We only preload 8K and 4M mappings into the TSB, since
3329                  * 64K and 512K mappings are replicated and hence don't
3330                  * have a single, unique TSB entry. Ditto for 32M/256M.
3331                  */
3332                 if (size == TTE8K || size == TTE4M) {
3333                         sf_scd_t *scdp;
3334                         hatlockp = sfmmu_hat_enter(sfmmup);
3335                         /*
3336                          * Don't preload private TSB if the mapping is used
3337                          * by the shctx in the SCD.
3338                          */
3339                         scdp = sfmmup->sfmmu_scdp;
3340                         if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3341                             !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3342                                 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3343                                     size);
3344                         }
3345                         sfmmu_hat_exit(hatlockp);
3346                 }
3347         }
3348         if (pp) {
3349                 if (!remap) {
3350                         HME_ADD(sfhme, pp);
3351                         atomic_inc_16(&hmeblkp->hblk_hmecnt);
3352                         ASSERT(hmeblkp->hblk_hmecnt > 0);
3353 
3354                         /*
3355                          * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3356                          * see pageunload() for comment.
3357                          */
3358                 }
3359                 sfmmu_mlist_exit(pml);
3360         }
3361 
3362         return (0);
3363 }
3364 /*
3365  * Function unlocks hash bucket.
3366  */
3367 static void
3368 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3369 {
3370         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3371         SFMMU_HASH_UNLOCK(hmebp);
3372 }
3373 
3374 /*
3375  * function which checks and sets up page array for a large
3376  * translation.  Will set p_vcolor, p_index, p_ro fields.
3377  * Assumes addr and pfnum of first page are properly aligned.
3378  * Will check for physical contiguity. If check fails it return
3379  * non null.
3380  */
3381 static int
3382 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3383 {
3384         int     i, index, ttesz;
3385         pfn_t   pfnum;
3386         pgcnt_t npgs;
3387         page_t *pp, *pp1;
3388         kmutex_t *pmtx;
3389 #ifdef VAC
3390         int osz;
3391         int cflags = 0;
3392         int vac_err = 0;
3393 #endif
3394         int newidx = 0;
3395 
3396         ttesz = TTE_CSZ(ttep);
3397 
3398         ASSERT(ttesz > TTE8K);
3399 
3400         npgs = TTEPAGES(ttesz);
3401         index = PAGESZ_TO_INDEX(ttesz);
3402 
3403         pfnum = (*pps)->p_pagenum;
3404         ASSERT(IS_P2ALIGNED(pfnum, npgs));
3405 
3406         /*
3407          * Save the first pp so we can do HAT_TMPNC at the end.
3408          */
3409         pp1 = *pps;
3410 #ifdef VAC
3411         osz = fnd_mapping_sz(pp1);
3412 #endif
3413 
3414         for (i = 0; i < npgs; i++, pps++) {
3415                 pp = *pps;
3416                 ASSERT(PAGE_LOCKED(pp));
3417                 ASSERT(pp->p_szc >= ttesz);
3418                 ASSERT(pp->p_szc == pp1->p_szc);
3419                 ASSERT(sfmmu_mlist_held(pp));
3420 
3421                 /*
3422                  * XXX is it possible to maintain P_RO on the root only?
3423                  */
3424                 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3425                         pmtx = sfmmu_page_enter(pp);
3426                         PP_CLRRO(pp);
3427                         sfmmu_page_exit(pmtx);
3428                 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3429                     !PP_ISMOD(pp)) {
3430                         pmtx = sfmmu_page_enter(pp);
3431                         if (!(PP_ISMOD(pp))) {
3432                                 PP_SETRO(pp);
3433                         }
3434                         sfmmu_page_exit(pmtx);
3435                 }
3436 
3437                 /*
3438                  * If this is a remap we skip vac & contiguity checks.
3439                  */
3440                 if (remap)
3441                         continue;
3442 
3443                 /*
3444                  * set p_vcolor and detect any vac conflicts.
3445                  */
3446 #ifdef VAC
3447                 if (vac_err == 0) {
3448                         vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3449 
3450                 }
3451 #endif
3452 
3453                 /*
3454                  * Save current index in case we need to undo it.
3455                  * Note: "PAGESZ_TO_INDEX(sz)   (1 << (sz))"
3456                  *      "SFMMU_INDEX_SHIFT      6"
3457                  *       "SFMMU_INDEX_MASK      ((1 << SFMMU_INDEX_SHIFT) - 1)"
3458                  *       "PP_MAPINDEX(p_index)  (p_index & SFMMU_INDEX_MASK)"
3459                  *
3460                  * So:  index = PAGESZ_TO_INDEX(ttesz);
3461                  *      if ttesz == 1 then index = 0x2
3462                  *                  2 then index = 0x4
3463                  *                  3 then index = 0x8
3464                  *                  4 then index = 0x10
3465                  *                  5 then index = 0x20
3466                  * The code below checks if it's a new pagesize (ie, newidx)
3467                  * in case we need to take it back out of p_index,
3468                  * and then or's the new index into the existing index.
3469                  */
3470                 if ((PP_MAPINDEX(pp) & index) == 0)
3471                         newidx = 1;
3472                 pp->p_index = (PP_MAPINDEX(pp) | index);
3473 
3474                 /*
3475                  * contiguity check
3476                  */
3477                 if (pp->p_pagenum != pfnum) {
3478                         /*
3479                          * If we fail the contiguity test then
3480                          * the only thing we need to fix is the p_index field.
3481                          * We might get a few extra flushes but since this
3482                          * path is rare that is ok.  The p_ro field will
3483                          * get automatically fixed on the next tteload to
3484                          * the page.  NO TNC bit is set yet.
3485                          */
3486                         while (i >= 0) {
3487                                 pp = *pps;
3488                                 if (newidx)
3489                                         pp->p_index = (PP_MAPINDEX(pp) &
3490                                             ~index);
3491                                 pps--;
3492                                 i--;
3493                         }
3494                         return (1);
3495                 }
3496                 pfnum++;
3497                 addr += MMU_PAGESIZE;
3498         }
3499 
3500 #ifdef VAC
3501         if (vac_err) {
3502                 if (ttesz > osz) {
3503                         /*
3504                          * There are some smaller mappings that causes vac
3505                          * conflicts. Convert all existing small mappings to
3506                          * TNC.
3507                          */
3508                         SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3509                         sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3510                             npgs);
3511                 } else {
3512                         /* EMPTY */
3513                         /*
3514                          * If there exists an big page mapping,
3515                          * that means the whole existing big page
3516                          * has TNC setting already. No need to covert to
3517                          * TNC again.
3518                          */
3519                         ASSERT(PP_ISTNC(pp1));
3520                 }
3521         }
3522 #endif  /* VAC */
3523 
3524         return (0);
3525 }
3526 
3527 #ifdef VAC
3528 /*
3529  * Routine that detects vac consistency for a large page. It also
3530  * sets virtual color for all pp's for this big mapping.
3531  */
3532 static int
3533 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3534 {
3535         int vcolor, ocolor;
3536 
3537         ASSERT(sfmmu_mlist_held(pp));
3538 
3539         if (PP_ISNC(pp)) {
3540                 return (HAT_TMPNC);
3541         }
3542 
3543         vcolor = addr_to_vcolor(addr);
3544         if (PP_NEWPAGE(pp)) {
3545                 PP_SET_VCOLOR(pp, vcolor);
3546                 return (0);
3547         }
3548 
3549         ocolor = PP_GET_VCOLOR(pp);
3550         if (ocolor == vcolor) {
3551                 return (0);
3552         }
3553 
3554         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3555                 /*
3556                  * Previous user of page had a differnet color
3557                  * but since there are no current users
3558                  * we just flush the cache and change the color.
3559                  * As an optimization for large pages we flush the
3560                  * entire cache of that color and set a flag.
3561                  */
3562                 SFMMU_STAT(sf_pgcolor_conflict);
3563                 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3564                         CacheColor_SetFlushed(*cflags, ocolor);
3565                         sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3566                 }
3567                 PP_SET_VCOLOR(pp, vcolor);
3568                 return (0);
3569         }
3570 
3571         /*
3572          * We got a real conflict with a current mapping.
3573          * set flags to start unencaching all mappings
3574          * and return failure so we restart looping
3575          * the pp array from the beginning.
3576          */
3577         return (HAT_TMPNC);
3578 }
3579 #endif  /* VAC */
3580 
3581 /*
3582  * creates a large page shadow hmeblk for a tte.
3583  * The purpose of this routine is to allow us to do quick unloads because
3584  * the vm layer can easily pass a very large but sparsely populated range.
3585  */
3586 static struct hme_blk *
3587 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3588 {
3589         struct hmehash_bucket *hmebp;
3590         hmeblk_tag hblktag;
3591         int hmeshift, size, vshift;
3592         uint_t shw_mask, newshw_mask;
3593         struct hme_blk *hmeblkp;
3594 
3595         ASSERT(sfmmup != KHATID);
3596         if (mmu_page_sizes == max_mmu_page_sizes) {
3597                 ASSERT(ttesz < TTE256M);
3598         } else {
3599                 ASSERT(ttesz < TTE4M);
3600                 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3601                 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3602         }
3603 
3604         if (ttesz == TTE8K) {
3605                 size = TTE512K;
3606         } else {
3607                 size = ++ttesz;
3608         }
3609 
3610         hblktag.htag_id = sfmmup;
3611         hmeshift = HME_HASH_SHIFT(size);
3612         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3613         hblktag.htag_rehash = HME_HASH_REHASH(size);
3614         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3615         hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3616 
3617         SFMMU_HASH_LOCK(hmebp);
3618 
3619         HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3620         ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3621         if (hmeblkp == NULL) {
3622                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3623                     hblktag, flags, SFMMU_INVALID_SHMERID);
3624         }
3625         ASSERT(hmeblkp);
3626         if (!hmeblkp->hblk_shw_mask) {
3627                 /*
3628                  * if this is a unused hblk it was just allocated or could
3629                  * potentially be a previous large page hblk so we need to
3630                  * set the shadow bit.
3631                  */
3632                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3633                 hmeblkp->hblk_shw_bit = 1;
3634         } else if (hmeblkp->hblk_shw_bit == 0) {
3635                 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3636                     (void *)hmeblkp);
3637         }
3638         ASSERT(hmeblkp->hblk_shw_bit == 1);
3639         ASSERT(!hmeblkp->hblk_shared);
3640         vshift = vaddr_to_vshift(hblktag, vaddr, size);
3641         ASSERT(vshift < 8);
3642         /*
3643          * Atomically set shw mask bit
3644          */
3645         do {
3646                 shw_mask = hmeblkp->hblk_shw_mask;
3647                 newshw_mask = shw_mask | (1 << vshift);
3648                 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3649                     newshw_mask);
3650         } while (newshw_mask != shw_mask);
3651 
3652         SFMMU_HASH_UNLOCK(hmebp);
3653 
3654         return (hmeblkp);
3655 }
3656 
3657 /*
3658  * This routine cleanup a previous shadow hmeblk and changes it to
3659  * a regular hblk.  This happens rarely but it is possible
3660  * when a process wants to use large pages and there are hblks still
3661  * lying around from the previous as that used these hmeblks.
3662  * The alternative was to cleanup the shadow hblks at unload time
3663  * but since so few user processes actually use large pages, it is
3664  * better to be lazy and cleanup at this time.
3665  */
3666 static void
3667 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3668         struct hmehash_bucket *hmebp)
3669 {
3670         caddr_t addr, endaddr;
3671         int hashno, size;
3672 
3673         ASSERT(hmeblkp->hblk_shw_bit);
3674         ASSERT(!hmeblkp->hblk_shared);
3675 
3676         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3677 
3678         if (!hmeblkp->hblk_shw_mask) {
3679                 hmeblkp->hblk_shw_bit = 0;
3680                 return;
3681         }
3682         addr = (caddr_t)get_hblk_base(hmeblkp);
3683         endaddr = get_hblk_endaddr(hmeblkp);
3684         size = get_hblk_ttesz(hmeblkp);
3685         hashno = size - 1;
3686         ASSERT(hashno > 0);
3687         SFMMU_HASH_UNLOCK(hmebp);
3688 
3689         sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3690 
3691         SFMMU_HASH_LOCK(hmebp);
3692 }
3693 
3694 static void
3695 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3696         int hashno)
3697 {
3698         int hmeshift, shadow = 0;
3699         hmeblk_tag hblktag;
3700         struct hmehash_bucket *hmebp;
3701         struct hme_blk *hmeblkp;
3702         struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3703 
3704         ASSERT(hashno > 0);
3705         hblktag.htag_id = sfmmup;
3706         hblktag.htag_rehash = hashno;
3707         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3708 
3709         hmeshift = HME_HASH_SHIFT(hashno);
3710 
3711         while (addr < endaddr) {
3712                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3713                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3714                 SFMMU_HASH_LOCK(hmebp);
3715                 /* inline HME_HASH_SEARCH */
3716                 hmeblkp = hmebp->hmeblkp;
3717                 pr_hblk = NULL;
3718                 while (hmeblkp) {
3719                         if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3720                                 /* found hme_blk */
3721                                 ASSERT(!hmeblkp->hblk_shared);
3722                                 if (hmeblkp->hblk_shw_bit) {
3723                                         if (hmeblkp->hblk_shw_mask) {
3724                                                 shadow = 1;
3725                                                 sfmmu_shadow_hcleanup(sfmmup,
3726                                                     hmeblkp, hmebp);
3727                                                 break;
3728                                         } else {
3729                                                 hmeblkp->hblk_shw_bit = 0;
3730                                         }
3731                                 }
3732 
3733                                 /*
3734                                  * Hblk_hmecnt and hblk_vcnt could be non zero
3735                                  * since hblk_unload() does not gurantee that.
3736                                  *
3737                                  * XXX - this could cause tteload() to spin
3738                                  * where sfmmu_shadow_hcleanup() is called.
3739                                  */
3740                         }
3741 
3742                         nx_hblk = hmeblkp->hblk_next;
3743                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3744                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3745                                     &list, 0);
3746                         } else {
3747                                 pr_hblk = hmeblkp;
3748                         }
3749                         hmeblkp = nx_hblk;
3750                 }
3751 
3752                 SFMMU_HASH_UNLOCK(hmebp);
3753 
3754                 if (shadow) {
3755                         /*
3756                          * We found another shadow hblk so cleaned its
3757                          * children.  We need to go back and cleanup
3758                          * the original hblk so we don't change the
3759                          * addr.
3760                          */
3761                         shadow = 0;
3762                 } else {
3763                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
3764                             (1 << hmeshift));
3765                 }
3766         }
3767         sfmmu_hblks_list_purge(&list, 0);
3768 }
3769 
3770 /*
3771  * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3772  * may still linger on after pageunload.
3773  */
3774 static void
3775 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3776 {
3777         int hmeshift;
3778         hmeblk_tag hblktag;
3779         struct hmehash_bucket *hmebp;
3780         struct hme_blk *hmeblkp;
3781         struct hme_blk *pr_hblk;
3782         struct hme_blk *list = NULL;
3783 
3784         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3785         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3786 
3787         hmeshift = HME_HASH_SHIFT(ttesz);
3788         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3789         hblktag.htag_rehash = ttesz;
3790         hblktag.htag_rid = rid;
3791         hblktag.htag_id = srdp;
3792         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3793 
3794         SFMMU_HASH_LOCK(hmebp);
3795         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3796         if (hmeblkp != NULL) {
3797                 ASSERT(hmeblkp->hblk_shared);
3798                 ASSERT(!hmeblkp->hblk_shw_bit);
3799                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3800                         panic("sfmmu_cleanup_rhblk: valid hmeblk");
3801                 }
3802                 ASSERT(!hmeblkp->hblk_lckcnt);
3803                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3804                     &list, 0);
3805         }
3806         SFMMU_HASH_UNLOCK(hmebp);
3807         sfmmu_hblks_list_purge(&list, 0);
3808 }
3809 
3810 /* ARGSUSED */
3811 static void
3812 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3813     size_t r_size, void *r_obj, u_offset_t r_objoff)
3814 {
3815 }
3816 
3817 /*
3818  * Searches for an hmeblk which maps addr, then unloads this mapping
3819  * and updates *eaddrp, if the hmeblk is found.
3820  */
3821 static void
3822 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3823     caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3824 {
3825         int hmeshift;
3826         hmeblk_tag hblktag;
3827         struct hmehash_bucket *hmebp;
3828         struct hme_blk *hmeblkp;
3829         struct hme_blk *pr_hblk;
3830         struct hme_blk *list = NULL;
3831 
3832         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3833         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3834         ASSERT(ttesz >= HBLK_MIN_TTESZ);
3835 
3836         hmeshift = HME_HASH_SHIFT(ttesz);
3837         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3838         hblktag.htag_rehash = ttesz;
3839         hblktag.htag_rid = rid;
3840         hblktag.htag_id = srdp;
3841         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3842 
3843         SFMMU_HASH_LOCK(hmebp);
3844         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3845         if (hmeblkp != NULL) {
3846                 ASSERT(hmeblkp->hblk_shared);
3847                 ASSERT(!hmeblkp->hblk_lckcnt);
3848                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3849                         *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3850                             eaddr, NULL, HAT_UNLOAD);
3851                         ASSERT(*eaddrp > addr);
3852                 }
3853                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3854                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3855                     &list, 0);
3856         }
3857         SFMMU_HASH_UNLOCK(hmebp);
3858         sfmmu_hblks_list_purge(&list, 0);
3859 }
3860 
3861 static void
3862 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3863 {
3864         int ttesz = rgnp->rgn_pgszc;
3865         size_t rsz = rgnp->rgn_size;
3866         caddr_t rsaddr = rgnp->rgn_saddr;
3867         caddr_t readdr = rsaddr + rsz;
3868         caddr_t rhsaddr;
3869         caddr_t va;
3870         uint_t rid = rgnp->rgn_id;
3871         caddr_t cbsaddr;
3872         caddr_t cbeaddr;
3873         hat_rgn_cb_func_t rcbfunc;
3874         ulong_t cnt;
3875 
3876         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3877         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3878 
3879         ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3880         ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3881         if (ttesz < HBLK_MIN_TTESZ) {
3882                 ttesz = HBLK_MIN_TTESZ;
3883                 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3884         } else {
3885                 rhsaddr = rsaddr;
3886         }
3887 
3888         if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3889                 rcbfunc = sfmmu_rgn_cb_noop;
3890         }
3891 
3892         while (ttesz >= HBLK_MIN_TTESZ) {
3893                 cbsaddr = rsaddr;
3894                 cbeaddr = rsaddr;
3895                 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3896                         ttesz--;
3897                         continue;
3898                 }
3899                 cnt = 0;
3900                 va = rsaddr;
3901                 while (va < readdr) {
3902                         ASSERT(va >= rhsaddr);
3903                         if (va != cbeaddr) {
3904                                 if (cbeaddr != cbsaddr) {
3905                                         ASSERT(cbeaddr > cbsaddr);
3906                                         (*rcbfunc)(cbsaddr, cbeaddr,
3907                                             rsaddr, rsz, rgnp->rgn_obj,
3908                                             rgnp->rgn_objoff);
3909                                 }
3910                                 cbsaddr = va;
3911                                 cbeaddr = va;
3912                         }
3913                         sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3914                             ttesz, &cbeaddr);
3915                         cnt++;
3916                         va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3917                 }
3918                 if (cbeaddr != cbsaddr) {
3919                         ASSERT(cbeaddr > cbsaddr);
3920                         (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3921                             rsz, rgnp->rgn_obj,
3922                             rgnp->rgn_objoff);
3923                 }
3924                 ttesz--;
3925         }
3926 }
3927 
3928 /*
3929  * Release one hardware address translation lock on the given address range.
3930  */
3931 void
3932 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3933 {
3934         struct hmehash_bucket *hmebp;
3935         hmeblk_tag hblktag;
3936         int hmeshift, hashno = 1;
3937         struct hme_blk *hmeblkp, *list = NULL;
3938         caddr_t endaddr;
3939 
3940         ASSERT(sfmmup != NULL);
3941 
3942         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3943         ASSERT((len & MMU_PAGEOFFSET) == 0);
3944         endaddr = addr + len;
3945         hblktag.htag_id = sfmmup;
3946         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3947 
3948         /*
3949          * Spitfire supports 4 page sizes.
3950          * Most pages are expected to be of the smallest page size (8K) and
3951          * these will not need to be rehashed. 64K pages also don't need to be
3952          * rehashed because an hmeblk spans 64K of address space. 512K pages
3953          * might need 1 rehash and and 4M pages might need 2 rehashes.
3954          */
3955         while (addr < endaddr) {
3956                 hmeshift = HME_HASH_SHIFT(hashno);
3957                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3958                 hblktag.htag_rehash = hashno;
3959                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3960 
3961                 SFMMU_HASH_LOCK(hmebp);
3962 
3963                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3964                 if (hmeblkp != NULL) {
3965                         ASSERT(!hmeblkp->hblk_shared);
3966                         /*
3967                          * If we encounter a shadow hmeblk then
3968                          * we know there are no valid hmeblks mapping
3969                          * this address at this size or larger.
3970                          * Just increment address by the smallest
3971                          * page size.
3972                          */
3973                         if (hmeblkp->hblk_shw_bit) {
3974                                 addr += MMU_PAGESIZE;
3975                         } else {
3976                                 addr = sfmmu_hblk_unlock(hmeblkp, addr,
3977                                     endaddr);
3978                         }
3979                         SFMMU_HASH_UNLOCK(hmebp);
3980                         hashno = 1;
3981                         continue;
3982                 }
3983                 SFMMU_HASH_UNLOCK(hmebp);
3984 
3985                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
3986                         /*
3987                          * We have traversed the whole list and rehashed
3988                          * if necessary without finding the address to unlock
3989                          * which should never happen.
3990                          */
3991                         panic("sfmmu_unlock: addr not found. "
3992                             "addr %p hat %p", (void *)addr, (void *)sfmmup);
3993                 } else {
3994                         hashno++;
3995                 }
3996         }
3997 
3998         sfmmu_hblks_list_purge(&list, 0);
3999 }
4000 
4001 void
4002 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4003     hat_region_cookie_t rcookie)
4004 {
4005         sf_srd_t *srdp;
4006         sf_region_t *rgnp;
4007         int ttesz;
4008         uint_t rid;
4009         caddr_t eaddr;
4010         caddr_t va;
4011         int hmeshift;
4012         hmeblk_tag hblktag;
4013         struct hmehash_bucket *hmebp;
4014         struct hme_blk *hmeblkp;
4015         struct hme_blk *pr_hblk;
4016         struct hme_blk *list;
4017 
4018         if (rcookie == HAT_INVALID_REGION_COOKIE) {
4019                 hat_unlock(sfmmup, addr, len);
4020                 return;
4021         }
4022 
4023         ASSERT(sfmmup != NULL);
4024         ASSERT(sfmmup != ksfmmup);
4025 
4026         srdp = sfmmup->sfmmu_srdp;
4027         rid = (uint_t)((uint64_t)rcookie);
4028         VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
4029         eaddr = addr + len;
4030         va = addr;
4031         list = NULL;
4032         rgnp = srdp->srd_hmergnp[rid];
4033         SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4034 
4035         ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4036         ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4037         if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4038                 ttesz = HBLK_MIN_TTESZ;
4039         } else {
4040                 ttesz = rgnp->rgn_pgszc;
4041         }
4042         while (va < eaddr) {
4043                 while (ttesz < rgnp->rgn_pgszc &&
4044                     IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4045                         ttesz++;
4046                 }
4047                 while (ttesz >= HBLK_MIN_TTESZ) {
4048                         if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4049                                 ttesz--;
4050                                 continue;
4051                         }
4052                         hmeshift = HME_HASH_SHIFT(ttesz);
4053                         hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4054                         hblktag.htag_rehash = ttesz;
4055                         hblktag.htag_rid = rid;
4056                         hblktag.htag_id = srdp;
4057                         hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4058                         SFMMU_HASH_LOCK(hmebp);
4059                         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4060                             &list);
4061                         if (hmeblkp == NULL) {
4062                                 SFMMU_HASH_UNLOCK(hmebp);
4063                                 ttesz--;
4064                                 continue;
4065                         }
4066                         ASSERT(hmeblkp->hblk_shared);
4067                         va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4068                         ASSERT(va >= eaddr ||
4069                             IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4070                         SFMMU_HASH_UNLOCK(hmebp);
4071                         break;
4072                 }
4073                 if (ttesz < HBLK_MIN_TTESZ) {
4074                         panic("hat_unlock_region: addr not found "
4075                             "addr %p hat %p", (void *)va, (void *)sfmmup);
4076                 }
4077         }
4078         sfmmu_hblks_list_purge(&list, 0);
4079 }
4080 
4081 /*
4082  * Function to unlock a range of addresses in an hmeblk.  It returns the
4083  * next address that needs to be unlocked.
4084  * Should be called with the hash lock held.
4085  */
4086 static caddr_t
4087 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4088 {
4089         struct sf_hment *sfhme;
4090         tte_t tteold, ttemod;
4091         int ttesz, ret;
4092 
4093         ASSERT(in_hblk_range(hmeblkp, addr));
4094         ASSERT(hmeblkp->hblk_shw_bit == 0);
4095 
4096         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4097         ttesz = get_hblk_ttesz(hmeblkp);
4098 
4099         HBLKTOHME(sfhme, hmeblkp, addr);
4100         while (addr < endaddr) {
4101 readtte:
4102                 sfmmu_copytte(&sfhme->hme_tte, &tteold);
4103                 if (TTE_IS_VALID(&tteold)) {
4104 
4105                         ttemod = tteold;
4106 
4107                         ret = sfmmu_modifytte_try(&tteold, &ttemod,
4108                             &sfhme->hme_tte);
4109 
4110                         if (ret < 0)
4111                                 goto readtte;
4112 
4113                         if (hmeblkp->hblk_lckcnt == 0)
4114                                 panic("zero hblk lckcnt");
4115 
4116                         if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4117                             (uintptr_t)endaddr)
4118                                 panic("can't unlock large tte");
4119 
4120                         ASSERT(hmeblkp->hblk_lckcnt > 0);
4121                         atomic_dec_32(&hmeblkp->hblk_lckcnt);
4122                         HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4123                 } else {
4124                         panic("sfmmu_hblk_unlock: invalid tte");
4125                 }
4126                 addr += TTEBYTES(ttesz);
4127                 sfhme++;
4128         }
4129         return (addr);
4130 }
4131 
4132 /*
4133  * Physical Address Mapping Framework
4134  *
4135  * General rules:
4136  *
4137  * (1) Applies only to seg_kmem memory pages. To make things easier,
4138  *     seg_kpm addresses are also accepted by the routines, but nothing
4139  *     is done with them since by definition their PA mappings are static.
4140  * (2) hat_add_callback() may only be called while holding the page lock
4141  *     SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4142  *     or passing HAC_PAGELOCK flag.
4143  * (3) prehandler() and posthandler() may not call hat_add_callback() or
4144  *     hat_delete_callback(), nor should they allocate memory. Post quiesce
4145  *     callbacks may not sleep or acquire adaptive mutex locks.
4146  * (4) Either prehandler() or posthandler() (but not both) may be specified
4147  *     as being NULL.  Specifying an errhandler() is optional.
4148  *
4149  * Details of using the framework:
4150  *
4151  * registering a callback (hat_register_callback())
4152  *
4153  *      Pass prehandler, posthandler, errhandler addresses
4154  *      as described below. If capture_cpus argument is nonzero,
4155  *      suspend callback to the prehandler will occur with CPUs
4156  *      captured and executing xc_loop() and CPUs will remain
4157  *      captured until after the posthandler suspend callback
4158  *      occurs.
4159  *
4160  * adding a callback (hat_add_callback())
4161  *
4162  *      as_pagelock();
4163  *      hat_add_callback();
4164  *      save returned pfn in private data structures or program registers;
4165  *      as_pageunlock();
4166  *
4167  * prehandler()
4168  *
4169  *      Stop all accesses by physical address to this memory page.
4170  *      Called twice: the first, PRESUSPEND, is a context safe to acquire
4171  *      adaptive locks. The second, SUSPEND, is called at high PIL with
4172  *      CPUs captured so adaptive locks may NOT be acquired (and all spin
4173  *      locks must be XCALL_PIL or higher locks).
4174  *
4175  *      May return the following errors:
4176  *              EIO:    A fatal error has occurred. This will result in panic.
4177  *              EAGAIN: The page cannot be suspended. This will fail the
4178  *                      relocation.
4179  *              0:      Success.
4180  *
4181  * posthandler()
4182  *
4183  *      Save new pfn in private data structures or program registers;
4184  *      not allowed to fail (non-zero return values will result in panic).
4185  *
4186  * errhandler()
4187  *
4188  *      called when an error occurs related to the callback.  Currently
4189  *      the only such error is HAT_CB_ERR_LEAKED which indicates that
4190  *      a page is being freed, but there are still outstanding callback(s)
4191  *      registered on the page.
4192  *
4193  * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4194  *
4195  *      stop using physical address
4196  *      hat_delete_callback();
4197  *
4198  */
4199 
4200 /*
4201  * Register a callback class.  Each subsystem should do this once and
4202  * cache the id_t returned for use in setting up and tearing down callbacks.
4203  *
4204  * There is no facility for removing callback IDs once they are created;
4205  * the "key" should be unique for each module, so in case a module is unloaded
4206  * and subsequently re-loaded, we can recycle the module's previous entry.
4207  */
4208 id_t
4209 hat_register_callback(int key,
4210         int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4211         int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4212         int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4213         int capture_cpus)
4214 {
4215         id_t id;
4216 
4217         /*
4218          * Search the table for a pre-existing callback associated with
4219          * the identifier "key".  If one exists, we re-use that entry in
4220          * the table for this instance, otherwise we assign the next
4221          * available table slot.
4222          */
4223         for (id = 0; id < sfmmu_max_cb_id; id++) {
4224                 if (sfmmu_cb_table[id].key == key)
4225                         break;
4226         }
4227 
4228         if (id == sfmmu_max_cb_id) {
4229                 id = sfmmu_cb_nextid++;
4230                 if (id >= sfmmu_max_cb_id)
4231                         panic("hat_register_callback: out of callback IDs");
4232         }
4233 
4234         ASSERT(prehandler != NULL || posthandler != NULL);
4235 
4236         sfmmu_cb_table[id].key = key;
4237         sfmmu_cb_table[id].prehandler = prehandler;
4238         sfmmu_cb_table[id].posthandler = posthandler;
4239         sfmmu_cb_table[id].errhandler = errhandler;
4240         sfmmu_cb_table[id].capture_cpus = capture_cpus;
4241 
4242         return (id);
4243 }
4244 
4245 #define HAC_COOKIE_NONE (void *)-1
4246 
4247 /*
4248  * Add relocation callbacks to the specified addr/len which will be called
4249  * when relocating the associated page. See the description of pre and
4250  * posthandler above for more details.
4251  *
4252  * If HAC_PAGELOCK is included in flags, the underlying memory page is
4253  * locked internally so the caller must be able to deal with the callback
4254  * running even before this function has returned.  If HAC_PAGELOCK is not
4255  * set, it is assumed that the underlying memory pages are locked.
4256  *
4257  * Since the caller must track the individual page boundaries anyway,
4258  * we only allow a callback to be added to a single page (large
4259  * or small).  Thus [addr, addr + len) MUST be contained within a single
4260  * page.
4261  *
4262  * Registering multiple callbacks on the same [addr, addr+len) is supported,
4263  * _provided_that_ a unique parameter is specified for each callback.
4264  * If multiple callbacks are registered on the same range the callback will
4265  * be invoked with each unique parameter. Registering the same callback with
4266  * the same argument more than once will result in corrupted kernel state.
4267  *
4268  * Returns the pfn of the underlying kernel page in *rpfn
4269  * on success, or PFN_INVALID on failure.
4270  *
4271  * cookiep (if passed) provides storage space for an opaque cookie
4272  * to return later to hat_delete_callback(). This cookie makes the callback
4273  * deletion significantly quicker by avoiding a potentially lengthy hash
4274  * search.
4275  *
4276  * Returns values:
4277  *    0:      success
4278  *    ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4279  *    EINVAL: callback ID is not valid
4280  *    ENXIO:  ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4281  *            space
4282  *    ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4283  */
4284 int
4285 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4286         void *pvt, pfn_t *rpfn, void **cookiep)
4287 {
4288         struct          hmehash_bucket *hmebp;
4289         hmeblk_tag      hblktag;
4290         struct hme_blk  *hmeblkp;
4291         int             hmeshift, hashno;
4292         caddr_t         saddr, eaddr, baseaddr;
4293         struct pa_hment *pahmep;
4294         struct sf_hment *sfhmep, *osfhmep;
4295         kmutex_t        *pml;
4296         tte_t           tte;
4297         page_t          *pp;
4298         vnode_t         *vp;
4299         u_offset_t      off;
4300         pfn_t           pfn;
4301         int             kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4302         int             locked = 0;
4303 
4304         /*
4305          * For KPM mappings, just return the physical address since we
4306          * don't need to register any callbacks.
4307          */
4308         if (IS_KPM_ADDR(vaddr)) {
4309                 uint64_t paddr;
4310                 SFMMU_KPM_VTOP(vaddr, paddr);
4311                 *rpfn = btop(paddr);
4312                 if (cookiep != NULL)
4313                         *cookiep = HAC_COOKIE_NONE;
4314                 return (0);
4315         }
4316 
4317         if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4318                 *rpfn = PFN_INVALID;
4319                 return (EINVAL);
4320         }
4321 
4322         if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4323                 *rpfn = PFN_INVALID;
4324                 return (ENOMEM);
4325         }
4326 
4327         sfhmep = &pahmep->sfment;
4328 
4329         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4330         eaddr = saddr + len;
4331 
4332 rehash:
4333         /* Find the mapping(s) for this page */
4334         for (hashno = TTE64K, hmeblkp = NULL;
4335             hmeblkp == NULL && hashno <= mmu_hashcnt;
4336             hashno++) {
4337                 hmeshift = HME_HASH_SHIFT(hashno);
4338                 hblktag.htag_id = ksfmmup;
4339                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4340                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4341                 hblktag.htag_rehash = hashno;
4342                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4343 
4344                 SFMMU_HASH_LOCK(hmebp);
4345 
4346                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4347 
4348                 if (hmeblkp == NULL)
4349                         SFMMU_HASH_UNLOCK(hmebp);
4350         }
4351 
4352         if (hmeblkp == NULL) {
4353                 kmem_cache_free(pa_hment_cache, pahmep);
4354                 *rpfn = PFN_INVALID;
4355                 return (ENXIO);
4356         }
4357 
4358         ASSERT(!hmeblkp->hblk_shared);
4359 
4360         HBLKTOHME(osfhmep, hmeblkp, saddr);
4361         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4362 
4363         if (!TTE_IS_VALID(&tte)) {
4364                 SFMMU_HASH_UNLOCK(hmebp);
4365                 kmem_cache_free(pa_hment_cache, pahmep);
4366                 *rpfn = PFN_INVALID;
4367                 return (ENXIO);
4368         }
4369 
4370         /*
4371          * Make sure the boundaries for the callback fall within this
4372          * single mapping.
4373          */
4374         baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4375         ASSERT(saddr >= baseaddr);
4376         if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4377                 SFMMU_HASH_UNLOCK(hmebp);
4378                 kmem_cache_free(pa_hment_cache, pahmep);
4379                 *rpfn = PFN_INVALID;
4380                 return (ERANGE);
4381         }
4382 
4383         pfn = sfmmu_ttetopfn(&tte, vaddr);
4384 
4385         /*
4386          * The pfn may not have a page_t underneath in which case we
4387          * just return it. This can happen if we are doing I/O to a
4388          * static portion of the kernel's address space, for instance.
4389          */
4390         pp = osfhmep->hme_page;
4391         if (pp == NULL) {
4392                 SFMMU_HASH_UNLOCK(hmebp);
4393                 kmem_cache_free(pa_hment_cache, pahmep);
4394                 *rpfn = pfn;
4395                 if (cookiep)
4396                         *cookiep = HAC_COOKIE_NONE;
4397                 return (0);
4398         }
4399         ASSERT(pp == PP_PAGEROOT(pp));
4400 
4401         vp = pp->p_vnode;
4402         off = pp->p_offset;
4403 
4404         pml = sfmmu_mlist_enter(pp);
4405 
4406         if (flags & HAC_PAGELOCK) {
4407                 if (!page_trylock(pp, SE_SHARED)) {
4408                         /*
4409                          * Somebody is holding SE_EXCL lock. Might
4410                          * even be hat_page_relocate(). Drop all
4411                          * our locks, lookup the page in &kvp, and
4412                          * retry. If it doesn't exist in &kvp and &zvp,
4413                          * then we must be dealing with a kernel mapped
4414                          * page which doesn't actually belong to
4415                          * segkmem so we punt.
4416                          */
4417                         sfmmu_mlist_exit(pml);
4418                         SFMMU_HASH_UNLOCK(hmebp);
4419                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4420 
4421                         /* check zvp before giving up */
4422                         if (pp == NULL)
4423                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4424                                     SE_SHARED);
4425 
4426                         /* Okay, we didn't find it, give up */
4427                         if (pp == NULL) {
4428                                 kmem_cache_free(pa_hment_cache, pahmep);
4429                                 *rpfn = pfn;
4430                                 if (cookiep)
4431                                         *cookiep = HAC_COOKIE_NONE;
4432                                 return (0);
4433                         }
4434                         page_unlock(pp);
4435                         goto rehash;
4436                 }
4437                 locked = 1;
4438         }
4439 
4440         if (!PAGE_LOCKED(pp) && !panicstr)
4441                 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4442 
4443         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4444             pp->p_offset != off) {
4445                 /*
4446                  * The page moved before we got our hands on it.  Drop
4447                  * all the locks and try again.
4448                  */
4449                 ASSERT((flags & HAC_PAGELOCK) != 0);
4450                 sfmmu_mlist_exit(pml);
4451                 SFMMU_HASH_UNLOCK(hmebp);
4452                 page_unlock(pp);
4453                 locked = 0;
4454                 goto rehash;
4455         }
4456 
4457         if (!VN_ISKAS(vp)) {
4458                 /*
4459                  * This is not a segkmem page but another page which
4460                  * has been kernel mapped. It had better have at least
4461                  * a share lock on it. Return the pfn.
4462                  */
4463                 sfmmu_mlist_exit(pml);
4464                 SFMMU_HASH_UNLOCK(hmebp);
4465                 if (locked)
4466                         page_unlock(pp);
4467                 kmem_cache_free(pa_hment_cache, pahmep);
4468                 ASSERT(PAGE_LOCKED(pp));
4469                 *rpfn = pfn;
4470                 if (cookiep)
4471                         *cookiep = HAC_COOKIE_NONE;
4472                 return (0);
4473         }
4474 
4475         /*
4476          * Setup this pa_hment and link its embedded dummy sf_hment into
4477          * the mapping list.
4478          */
4479         pp->p_share++;
4480         pahmep->cb_id = callback_id;
4481         pahmep->addr = vaddr;
4482         pahmep->len = len;
4483         pahmep->refcnt = 1;
4484         pahmep->flags = 0;
4485         pahmep->pvt = pvt;
4486 
4487         sfhmep->hme_tte.ll = 0;
4488         sfhmep->hme_data = pahmep;
4489         sfhmep->hme_prev = osfhmep;
4490         sfhmep->hme_next = osfhmep->hme_next;
4491 
4492         if (osfhmep->hme_next)
4493                 osfhmep->hme_next->hme_prev = sfhmep;
4494 
4495         osfhmep->hme_next = sfhmep;
4496 
4497         sfmmu_mlist_exit(pml);
4498         SFMMU_HASH_UNLOCK(hmebp);
4499 
4500         if (locked)
4501                 page_unlock(pp);
4502 
4503         *rpfn = pfn;
4504         if (cookiep)
4505                 *cookiep = (void *)pahmep;
4506 
4507         return (0);
4508 }
4509 
4510 /*
4511  * Remove the relocation callbacks from the specified addr/len.
4512  */
4513 void
4514 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4515         void *cookie)
4516 {
4517         struct          hmehash_bucket *hmebp;
4518         hmeblk_tag      hblktag;
4519         struct hme_blk  *hmeblkp;
4520         int             hmeshift, hashno;
4521         caddr_t         saddr;
4522         struct pa_hment *pahmep;
4523         struct sf_hment *sfhmep, *osfhmep;
4524         kmutex_t        *pml;
4525         tte_t           tte;
4526         page_t          *pp;
4527         vnode_t         *vp;
4528         u_offset_t      off;
4529         int             locked = 0;
4530 
4531         /*
4532          * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4533          * remove so just return.
4534          */
4535         if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4536                 return;
4537 
4538         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4539 
4540 rehash:
4541         /* Find the mapping(s) for this page */
4542         for (hashno = TTE64K, hmeblkp = NULL;
4543             hmeblkp == NULL && hashno <= mmu_hashcnt;
4544             hashno++) {
4545                 hmeshift = HME_HASH_SHIFT(hashno);
4546                 hblktag.htag_id = ksfmmup;
4547                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4548                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4549                 hblktag.htag_rehash = hashno;
4550                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4551 
4552                 SFMMU_HASH_LOCK(hmebp);
4553 
4554                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4555 
4556                 if (hmeblkp == NULL)
4557                         SFMMU_HASH_UNLOCK(hmebp);
4558         }
4559 
4560         if (hmeblkp == NULL)
4561                 return;
4562 
4563         ASSERT(!hmeblkp->hblk_shared);
4564 
4565         HBLKTOHME(osfhmep, hmeblkp, saddr);
4566 
4567         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4568         if (!TTE_IS_VALID(&tte)) {
4569                 SFMMU_HASH_UNLOCK(hmebp);
4570                 return;
4571         }
4572 
4573         pp = osfhmep->hme_page;
4574         if (pp == NULL) {
4575                 SFMMU_HASH_UNLOCK(hmebp);
4576                 ASSERT(cookie == NULL);
4577                 return;
4578         }
4579 
4580         vp = pp->p_vnode;
4581         off = pp->p_offset;
4582 
4583         pml = sfmmu_mlist_enter(pp);
4584 
4585         if (flags & HAC_PAGELOCK) {
4586                 if (!page_trylock(pp, SE_SHARED)) {
4587                         /*
4588                          * Somebody is holding SE_EXCL lock. Might
4589                          * even be hat_page_relocate(). Drop all
4590                          * our locks, lookup the page in &kvp, and
4591                          * retry. If it doesn't exist in &kvp and &zvp,
4592                          * then we must be dealing with a kernel mapped
4593                          * page which doesn't actually belong to
4594                          * segkmem so we punt.
4595                          */
4596                         sfmmu_mlist_exit(pml);
4597                         SFMMU_HASH_UNLOCK(hmebp);
4598                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4599                         /* check zvp before giving up */
4600                         if (pp == NULL)
4601                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4602                                     SE_SHARED);
4603 
4604                         if (pp == NULL) {
4605                                 ASSERT(cookie == NULL);
4606                                 return;
4607                         }
4608                         page_unlock(pp);
4609                         goto rehash;
4610                 }
4611                 locked = 1;
4612         }
4613 
4614         ASSERT(PAGE_LOCKED(pp));
4615 
4616         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4617             pp->p_offset != off) {
4618                 /*
4619                  * The page moved before we got our hands on it.  Drop
4620                  * all the locks and try again.
4621                  */
4622                 ASSERT((flags & HAC_PAGELOCK) != 0);
4623                 sfmmu_mlist_exit(pml);
4624                 SFMMU_HASH_UNLOCK(hmebp);
4625                 page_unlock(pp);
4626                 locked = 0;
4627                 goto rehash;
4628         }
4629 
4630         if (!VN_ISKAS(vp)) {
4631                 /*
4632                  * This is not a segkmem page but another page which
4633                  * has been kernel mapped.
4634                  */
4635                 sfmmu_mlist_exit(pml);
4636                 SFMMU_HASH_UNLOCK(hmebp);
4637                 if (locked)
4638                         page_unlock(pp);
4639                 ASSERT(cookie == NULL);
4640                 return;
4641         }
4642 
4643         if (cookie != NULL) {
4644                 pahmep = (struct pa_hment *)cookie;
4645                 sfhmep = &pahmep->sfment;
4646         } else {
4647                 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4648                     sfhmep = sfhmep->hme_next) {
4649 
4650                         /*
4651                          * skip va<->pa mappings
4652                          */
4653                         if (!IS_PAHME(sfhmep))
4654                                 continue;
4655 
4656                         pahmep = sfhmep->hme_data;
4657                         ASSERT(pahmep != NULL);
4658 
4659                         /*
4660                          * if pa_hment matches, remove it
4661                          */
4662                         if ((pahmep->pvt == pvt) &&
4663                             (pahmep->addr == vaddr) &&
4664                             (pahmep->len == len)) {
4665                                 break;
4666                         }
4667                 }
4668         }
4669 
4670         if (sfhmep == NULL) {
4671                 if (!panicstr) {
4672                         panic("hat_delete_callback: pa_hment not found, pp %p",
4673                             (void *)pp);
4674                 }
4675                 return;
4676         }
4677 
4678         /*
4679          * Note: at this point a valid kernel mapping must still be
4680          * present on this page.
4681          */
4682         pp->p_share--;
4683         if (pp->p_share <= 0)
4684                 panic("hat_delete_callback: zero p_share");
4685 
4686         if (--pahmep->refcnt == 0) {
4687                 if (pahmep->flags != 0)
4688                         panic("hat_delete_callback: pa_hment is busy");
4689 
4690                 /*
4691                  * Remove sfhmep from the mapping list for the page.
4692                  */
4693                 if (sfhmep->hme_prev) {
4694                         sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4695                 } else {
4696                         pp->p_mapping = sfhmep->hme_next;
4697                 }
4698 
4699                 if (sfhmep->hme_next)
4700                         sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4701 
4702                 sfmmu_mlist_exit(pml);
4703                 SFMMU_HASH_UNLOCK(hmebp);
4704 
4705                 if (locked)
4706                         page_unlock(pp);
4707 
4708                 kmem_cache_free(pa_hment_cache, pahmep);
4709                 return;
4710         }
4711 
4712         sfmmu_mlist_exit(pml);
4713         SFMMU_HASH_UNLOCK(hmebp);
4714         if (locked)
4715                 page_unlock(pp);
4716 }
4717 
4718 /*
4719  * hat_probe returns 1 if the translation for the address 'addr' is
4720  * loaded, zero otherwise.
4721  *
4722  * hat_probe should be used only for advisorary purposes because it may
4723  * occasionally return the wrong value. The implementation must guarantee that
4724  * returning the wrong value is a very rare event. hat_probe is used
4725  * to implement optimizations in the segment drivers.
4726  *
4727  */
4728 int
4729 hat_probe(struct hat *sfmmup, caddr_t addr)
4730 {
4731         pfn_t pfn;
4732         tte_t tte;
4733 
4734         ASSERT(sfmmup != NULL);
4735 
4736         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4737 
4738         if (sfmmup == ksfmmup) {
4739                 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4740                     == PFN_SUSPENDED) {
4741                         sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4742                 }
4743         } else {
4744                 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4745         }
4746 
4747         if (pfn != PFN_INVALID)
4748                 return (1);
4749         else
4750                 return (0);
4751 }
4752 
4753 ssize_t
4754 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4755 {
4756         tte_t tte;
4757 
4758         if (sfmmup == ksfmmup) {
4759                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4760                         return (-1);
4761                 }
4762         } else {
4763                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4764                         return (-1);
4765                 }
4766         }
4767 
4768         ASSERT(TTE_IS_VALID(&tte));
4769         return (TTEBYTES(TTE_CSZ(&tte)));
4770 }
4771 
4772 uint_t
4773 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4774 {
4775         tte_t tte;
4776 
4777         if (sfmmup == ksfmmup) {
4778                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4779                         tte.ll = 0;
4780                 }
4781         } else {
4782                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4783                         tte.ll = 0;
4784                 }
4785         }
4786         if (TTE_IS_VALID(&tte)) {
4787                 *attr = sfmmu_ptov_attr(&tte);
4788                 return (0);
4789         }
4790         *attr = 0;
4791         return ((uint_t)0xffffffff);
4792 }
4793 
4794 /*
4795  * Enables more attributes on specified address range (ie. logical OR)
4796  */
4797 void
4798 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4799 {
4800         ASSERT(hat->sfmmu_as != NULL);
4801 
4802         sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4803 }
4804 
4805 /*
4806  * Assigns attributes to the specified address range.  All the attributes
4807  * are specified.
4808  */
4809 void
4810 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4811 {
4812         ASSERT(hat->sfmmu_as != NULL);
4813 
4814         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4815 }
4816 
4817 /*
4818  * Remove attributes on the specified address range (ie. loginal NAND)
4819  */
4820 void
4821 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4822 {
4823         ASSERT(hat->sfmmu_as != NULL);
4824 
4825         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4826 }
4827 
4828 /*
4829  * Change attributes on an address range to that specified by attr and mode.
4830  */
4831 static void
4832 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4833         int mode)
4834 {
4835         struct hmehash_bucket *hmebp;
4836         hmeblk_tag hblktag;
4837         int hmeshift, hashno = 1;
4838         struct hme_blk *hmeblkp, *list = NULL;
4839         caddr_t endaddr;
4840         cpuset_t cpuset;
4841         demap_range_t dmr;
4842 
4843         CPUSET_ZERO(cpuset);
4844 
4845         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4846         ASSERT((len & MMU_PAGEOFFSET) == 0);
4847         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4848 
4849         if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4850             ((addr + len) > (caddr_t)USERLIMIT)) {
4851                 panic("user addr %p in kernel space",
4852                     (void *)addr);
4853         }
4854 
4855         endaddr = addr + len;
4856         hblktag.htag_id = sfmmup;
4857         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4858         DEMAP_RANGE_INIT(sfmmup, &dmr);
4859 
4860         while (addr < endaddr) {
4861                 hmeshift = HME_HASH_SHIFT(hashno);
4862                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4863                 hblktag.htag_rehash = hashno;
4864                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4865 
4866                 SFMMU_HASH_LOCK(hmebp);
4867 
4868                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4869                 if (hmeblkp != NULL) {
4870                         ASSERT(!hmeblkp->hblk_shared);
4871                         /*
4872                          * We've encountered a shadow hmeblk so skip the range
4873                          * of the next smaller mapping size.
4874                          */
4875                         if (hmeblkp->hblk_shw_bit) {
4876                                 ASSERT(sfmmup != ksfmmup);
4877                                 ASSERT(hashno > 1);
4878                                 addr = (caddr_t)P2END((uintptr_t)addr,
4879                                     TTEBYTES(hashno - 1));
4880                         } else {
4881                                 addr = sfmmu_hblk_chgattr(sfmmup,
4882                                     hmeblkp, addr, endaddr, &dmr, attr, mode);
4883                         }
4884                         SFMMU_HASH_UNLOCK(hmebp);
4885                         hashno = 1;
4886                         continue;
4887                 }
4888                 SFMMU_HASH_UNLOCK(hmebp);
4889 
4890                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4891                         /*
4892                          * We have traversed the whole list and rehashed
4893                          * if necessary without finding the address to chgattr.
4894                          * This is ok, so we increment the address by the
4895                          * smallest hmeblk range for kernel mappings or for
4896                          * user mappings with no large pages, and the largest
4897                          * hmeblk range, to account for shadow hmeblks, for
4898                          * user mappings with large pages and continue.
4899                          */
4900                         if (sfmmup == ksfmmup)
4901                                 addr = (caddr_t)P2END((uintptr_t)addr,
4902                                     TTEBYTES(1));
4903                         else
4904                                 addr = (caddr_t)P2END((uintptr_t)addr,
4905                                     TTEBYTES(hashno));
4906                         hashno = 1;
4907                 } else {
4908                         hashno++;
4909                 }
4910         }
4911 
4912         sfmmu_hblks_list_purge(&list, 0);
4913         DEMAP_RANGE_FLUSH(&dmr);
4914         cpuset = sfmmup->sfmmu_cpusran;
4915         xt_sync(cpuset);
4916 }
4917 
4918 /*
4919  * This function chgattr on a range of addresses in an hmeblk.  It returns the
4920  * next addres that needs to be chgattr.
4921  * It should be called with the hash lock held.
4922  * XXX It should be possible to optimize chgattr by not flushing every time but
4923  * on the other hand:
4924  * 1. do one flush crosscall.
4925  * 2. only flush if we are increasing permissions (make sure this will work)
4926  */
4927 static caddr_t
4928 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
4929         caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
4930 {
4931         tte_t tte, tteattr, tteflags, ttemod;
4932         struct sf_hment *sfhmep;
4933         int ttesz;
4934         struct page *pp = NULL;
4935         kmutex_t *pml, *pmtx;
4936         int ret;
4937         int use_demap_range;
4938 #if defined(SF_ERRATA_57)
4939         int check_exec;
4940 #endif
4941 
4942         ASSERT(in_hblk_range(hmeblkp, addr));
4943         ASSERT(hmeblkp->hblk_shw_bit == 0);
4944         ASSERT(!hmeblkp->hblk_shared);
4945 
4946         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4947         ttesz = get_hblk_ttesz(hmeblkp);
4948 
4949         /*
4950          * Flush the current demap region if addresses have been
4951          * skipped or the page size doesn't match.
4952          */
4953         use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
4954         if (use_demap_range) {
4955                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
4956         } else if (dmrp != NULL) {
4957                 DEMAP_RANGE_FLUSH(dmrp);
4958         }
4959 
4960         tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
4961 #if defined(SF_ERRATA_57)
4962         check_exec = (sfmmup != ksfmmup) &&
4963             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
4964             TTE_IS_EXECUTABLE(&tteattr);
4965 #endif
4966         HBLKTOHME(sfhmep, hmeblkp, addr);
4967         while (addr < endaddr) {
4968                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
4969                 if (TTE_IS_VALID(&tte)) {
4970                         if ((tte.ll & tteflags.ll) == tteattr.ll) {
4971                                 /*
4972                                  * if the new attr is the same as old
4973                                  * continue
4974                                  */
4975                                 goto next_addr;
4976                         }
4977                         if (!TTE_IS_WRITABLE(&tteattr)) {
4978                                 /*
4979                                  * make sure we clear hw modify bit if we
4980                                  * removing write protections
4981                                  */
4982                                 tteflags.tte_intlo |= TTE_HWWR_INT;
4983                         }
4984 
4985                         pml = NULL;
4986                         pp = sfhmep->hme_page;
4987                         if (pp) {
4988                                 pml = sfmmu_mlist_enter(pp);
4989                         }
4990 
4991                         if (pp != sfhmep->hme_page) {
4992                                 /*
4993                                  * tte must have been unloaded.
4994                                  */
4995                                 ASSERT(pml);
4996                                 sfmmu_mlist_exit(pml);
4997                                 continue;
4998                         }
4999 
5000                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5001 
5002                         ttemod = tte;
5003                         ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5004                         ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5005 
5006 #if defined(SF_ERRATA_57)
5007                         if (check_exec && addr < errata57_limit)
5008                                 ttemod.tte_exec_perm = 0;
5009 #endif
5010                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5011                             &sfhmep->hme_tte);
5012 
5013                         if (ret < 0) {
5014                                 /* tte changed underneath us */
5015                                 if (pml) {
5016                                         sfmmu_mlist_exit(pml);
5017                                 }
5018                                 continue;
5019                         }
5020 
5021                         if (tteflags.tte_intlo & TTE_HWWR_INT) {
5022                                 /*
5023                                  * need to sync if we are clearing modify bit.
5024                                  */
5025                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5026                         }
5027 
5028                         if (pp && PP_ISRO(pp)) {
5029                                 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5030                                         pmtx = sfmmu_page_enter(pp);
5031                                         PP_CLRRO(pp);
5032                                         sfmmu_page_exit(pmtx);
5033                                 }
5034                         }
5035 
5036                         if (ret > 0 && use_demap_range) {
5037                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5038                         } else if (ret > 0) {
5039                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5040                         }
5041 
5042                         if (pml) {
5043                                 sfmmu_mlist_exit(pml);
5044                         }
5045                 }
5046 next_addr:
5047                 addr += TTEBYTES(ttesz);
5048                 sfhmep++;
5049                 DEMAP_RANGE_NEXTPG(dmrp);
5050         }
5051         return (addr);
5052 }
5053 
5054 /*
5055  * This routine converts virtual attributes to physical ones.  It will
5056  * update the tteflags field with the tte mask corresponding to the attributes
5057  * affected and it returns the new attributes.  It will also clear the modify
5058  * bit if we are taking away write permission.  This is necessary since the
5059  * modify bit is the hardware permission bit and we need to clear it in order
5060  * to detect write faults.
5061  */
5062 static uint64_t
5063 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5064 {
5065         tte_t ttevalue;
5066 
5067         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5068 
5069         switch (mode) {
5070         case SFMMU_CHGATTR:
5071                 /* all attributes specified */
5072                 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5073                 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5074                 ttemaskp->tte_inthi = TTEINTHI_ATTR;
5075                 ttemaskp->tte_intlo = TTEINTLO_ATTR;
5076                 break;
5077         case SFMMU_SETATTR:
5078                 ASSERT(!(attr & ~HAT_PROT_MASK));
5079                 ttemaskp->ll = 0;
5080                 ttevalue.ll = 0;
5081                 /*
5082                  * a valid tte implies exec and read for sfmmu
5083                  * so no need to do anything about them.
5084                  * since priviledged access implies user access
5085                  * PROT_USER doesn't make sense either.
5086                  */
5087                 if (attr & PROT_WRITE) {
5088                         ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5089                         ttevalue.tte_intlo |= TTE_WRPRM_INT;
5090                 }
5091                 break;
5092         case SFMMU_CLRATTR:
5093                 /* attributes will be nand with current ones */
5094                 if (attr & ~(PROT_WRITE | PROT_USER)) {
5095                         panic("sfmmu: attr %x not supported", attr);
5096                 }
5097                 ttemaskp->ll = 0;
5098                 ttevalue.ll = 0;
5099                 if (attr & PROT_WRITE) {
5100                         /* clear both writable and modify bit */
5101                         ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5102                 }
5103                 if (attr & PROT_USER) {
5104                         ttemaskp->tte_intlo |= TTE_PRIV_INT;
5105                         ttevalue.tte_intlo |= TTE_PRIV_INT;
5106                 }
5107                 break;
5108         default:
5109                 panic("sfmmu_vtop_attr: bad mode %x", mode);
5110         }
5111         ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5112         return (ttevalue.ll);
5113 }
5114 
5115 static uint_t
5116 sfmmu_ptov_attr(tte_t *ttep)
5117 {
5118         uint_t attr;
5119 
5120         ASSERT(TTE_IS_VALID(ttep));
5121 
5122         attr = PROT_READ;
5123 
5124         if (TTE_IS_WRITABLE(ttep)) {
5125                 attr |= PROT_WRITE;
5126         }
5127         if (TTE_IS_EXECUTABLE(ttep)) {
5128                 attr |= PROT_EXEC;
5129         }
5130         if (!TTE_IS_PRIVILEGED(ttep)) {
5131                 attr |= PROT_USER;
5132         }
5133         if (TTE_IS_NFO(ttep)) {
5134                 attr |= HAT_NOFAULT;
5135         }
5136         if (TTE_IS_NOSYNC(ttep)) {
5137                 attr |= HAT_NOSYNC;
5138         }
5139         if (TTE_IS_SIDEFFECT(ttep)) {
5140                 attr |= SFMMU_SIDEFFECT;
5141         }
5142         if (!TTE_IS_VCACHEABLE(ttep)) {
5143                 attr |= SFMMU_UNCACHEVTTE;
5144         }
5145         if (!TTE_IS_PCACHEABLE(ttep)) {
5146                 attr |= SFMMU_UNCACHEPTTE;
5147         }
5148         return (attr);
5149 }
5150 
5151 /*
5152  * hat_chgprot is a deprecated hat call.  New segment drivers
5153  * should store all attributes and use hat_*attr calls.
5154  *
5155  * Change the protections in the virtual address range
5156  * given to the specified virtual protection.  If vprot is ~PROT_WRITE,
5157  * then remove write permission, leaving the other
5158  * permissions unchanged.  If vprot is ~PROT_USER, remove user permissions.
5159  *
5160  */
5161 void
5162 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5163 {
5164         struct hmehash_bucket *hmebp;
5165         hmeblk_tag hblktag;
5166         int hmeshift, hashno = 1;
5167         struct hme_blk *hmeblkp, *list = NULL;
5168         caddr_t endaddr;
5169         cpuset_t cpuset;
5170         demap_range_t dmr;
5171 
5172         ASSERT((len & MMU_PAGEOFFSET) == 0);
5173         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5174 
5175         ASSERT(sfmmup->sfmmu_as != NULL);
5176 
5177         CPUSET_ZERO(cpuset);
5178 
5179         if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5180             ((addr + len) > (caddr_t)USERLIMIT)) {
5181                 panic("user addr %p vprot %x in kernel space",
5182                     (void *)addr, vprot);
5183         }
5184         endaddr = addr + len;
5185         hblktag.htag_id = sfmmup;
5186         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5187         DEMAP_RANGE_INIT(sfmmup, &dmr);
5188 
5189         while (addr < endaddr) {
5190                 hmeshift = HME_HASH_SHIFT(hashno);
5191                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5192                 hblktag.htag_rehash = hashno;
5193                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5194 
5195                 SFMMU_HASH_LOCK(hmebp);
5196 
5197                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5198                 if (hmeblkp != NULL) {
5199                         ASSERT(!hmeblkp->hblk_shared);
5200                         /*
5201                          * We've encountered a shadow hmeblk so skip the range
5202                          * of the next smaller mapping size.
5203                          */
5204                         if (hmeblkp->hblk_shw_bit) {
5205                                 ASSERT(sfmmup != ksfmmup);
5206                                 ASSERT(hashno > 1);
5207                                 addr = (caddr_t)P2END((uintptr_t)addr,
5208                                     TTEBYTES(hashno - 1));
5209                         } else {
5210                                 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5211                                     addr, endaddr, &dmr, vprot);
5212                         }
5213                         SFMMU_HASH_UNLOCK(hmebp);
5214                         hashno = 1;
5215                         continue;
5216                 }
5217                 SFMMU_HASH_UNLOCK(hmebp);
5218 
5219                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5220                         /*
5221                          * We have traversed the whole list and rehashed
5222                          * if necessary without finding the address to chgprot.
5223                          * This is ok so we increment the address by the
5224                          * smallest hmeblk range for kernel mappings and the
5225                          * largest hmeblk range, to account for shadow hmeblks,
5226                          * for user mappings and continue.
5227                          */
5228                         if (sfmmup == ksfmmup)
5229                                 addr = (caddr_t)P2END((uintptr_t)addr,
5230                                     TTEBYTES(1));
5231                         else
5232                                 addr = (caddr_t)P2END((uintptr_t)addr,
5233                                     TTEBYTES(hashno));
5234                         hashno = 1;
5235                 } else {
5236                         hashno++;
5237                 }
5238         }
5239 
5240         sfmmu_hblks_list_purge(&list, 0);
5241         DEMAP_RANGE_FLUSH(&dmr);
5242         cpuset = sfmmup->sfmmu_cpusran;
5243         xt_sync(cpuset);
5244 }
5245 
5246 /*
5247  * This function chgprots a range of addresses in an hmeblk.  It returns the
5248  * next addres that needs to be chgprot.
5249  * It should be called with the hash lock held.
5250  * XXX It shold be possible to optimize chgprot by not flushing every time but
5251  * on the other hand:
5252  * 1. do one flush crosscall.
5253  * 2. only flush if we are increasing permissions (make sure this will work)
5254  */
5255 static caddr_t
5256 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5257         caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5258 {
5259         uint_t pprot;
5260         tte_t tte, ttemod;
5261         struct sf_hment *sfhmep;
5262         uint_t tteflags;
5263         int ttesz;
5264         struct page *pp = NULL;
5265         kmutex_t *pml, *pmtx;
5266         int ret;
5267         int use_demap_range;
5268 #if defined(SF_ERRATA_57)
5269         int check_exec;
5270 #endif
5271 
5272         ASSERT(in_hblk_range(hmeblkp, addr));
5273         ASSERT(hmeblkp->hblk_shw_bit == 0);
5274         ASSERT(!hmeblkp->hblk_shared);
5275 
5276 #ifdef DEBUG
5277         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5278             (endaddr < get_hblk_endaddr(hmeblkp))) {
5279                 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5280         }
5281 #endif /* DEBUG */
5282 
5283         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5284         ttesz = get_hblk_ttesz(hmeblkp);
5285 
5286         pprot = sfmmu_vtop_prot(vprot, &tteflags);
5287 #if defined(SF_ERRATA_57)
5288         check_exec = (sfmmup != ksfmmup) &&
5289             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5290             ((vprot & PROT_EXEC) == PROT_EXEC);
5291 #endif
5292         HBLKTOHME(sfhmep, hmeblkp, addr);
5293 
5294         /*
5295          * Flush the current demap region if addresses have been
5296          * skipped or the page size doesn't match.
5297          */
5298         use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5299         if (use_demap_range) {
5300                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5301         } else if (dmrp != NULL) {
5302                 DEMAP_RANGE_FLUSH(dmrp);
5303         }
5304 
5305         while (addr < endaddr) {
5306                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5307                 if (TTE_IS_VALID(&tte)) {
5308                         if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5309                                 /*
5310                                  * if the new protection is the same as old
5311                                  * continue
5312                                  */
5313                                 goto next_addr;
5314                         }
5315                         pml = NULL;
5316                         pp = sfhmep->hme_page;
5317                         if (pp) {
5318                                 pml = sfmmu_mlist_enter(pp);
5319                         }
5320                         if (pp != sfhmep->hme_page) {
5321                                 /*
5322                                  * tte most have been unloaded
5323                                  * underneath us.  Recheck
5324                                  */
5325                                 ASSERT(pml);
5326                                 sfmmu_mlist_exit(pml);
5327                                 continue;
5328                         }
5329 
5330                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5331 
5332                         ttemod = tte;
5333                         TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5334 #if defined(SF_ERRATA_57)
5335                         if (check_exec && addr < errata57_limit)
5336                                 ttemod.tte_exec_perm = 0;
5337 #endif
5338                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5339                             &sfhmep->hme_tte);
5340 
5341                         if (ret < 0) {
5342                                 /* tte changed underneath us */
5343                                 if (pml) {
5344                                         sfmmu_mlist_exit(pml);
5345                                 }
5346                                 continue;
5347                         }
5348 
5349                         if (tteflags & TTE_HWWR_INT) {
5350                                 /*
5351                                  * need to sync if we are clearing modify bit.
5352                                  */
5353                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5354                         }
5355 
5356                         if (pp && PP_ISRO(pp)) {
5357                                 if (pprot & TTE_WRPRM_INT) {
5358                                         pmtx = sfmmu_page_enter(pp);
5359                                         PP_CLRRO(pp);
5360                                         sfmmu_page_exit(pmtx);
5361                                 }
5362                         }
5363 
5364                         if (ret > 0 && use_demap_range) {
5365                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5366                         } else if (ret > 0) {
5367                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5368                         }
5369 
5370                         if (pml) {
5371                                 sfmmu_mlist_exit(pml);
5372                         }
5373                 }
5374 next_addr:
5375                 addr += TTEBYTES(ttesz);
5376                 sfhmep++;
5377                 DEMAP_RANGE_NEXTPG(dmrp);
5378         }
5379         return (addr);
5380 }
5381 
5382 /*
5383  * This routine is deprecated and should only be used by hat_chgprot.
5384  * The correct routine is sfmmu_vtop_attr.
5385  * This routine converts virtual page protections to physical ones.  It will
5386  * update the tteflags field with the tte mask corresponding to the protections
5387  * affected and it returns the new protections.  It will also clear the modify
5388  * bit if we are taking away write permission.  This is necessary since the
5389  * modify bit is the hardware permission bit and we need to clear it in order
5390  * to detect write faults.
5391  * It accepts the following special protections:
5392  * ~PROT_WRITE = remove write permissions.
5393  * ~PROT_USER = remove user permissions.
5394  */
5395 static uint_t
5396 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5397 {
5398         if (vprot == (uint_t)~PROT_WRITE) {
5399                 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5400                 return (0);             /* will cause wrprm to be cleared */
5401         }
5402         if (vprot == (uint_t)~PROT_USER) {
5403                 *tteflagsp = TTE_PRIV_INT;
5404                 return (0);             /* will cause privprm to be cleared */
5405         }
5406         if ((vprot == 0) || (vprot == PROT_USER) ||
5407             ((vprot & PROT_ALL) != vprot)) {
5408                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5409         }
5410 
5411         switch (vprot) {
5412         case (PROT_READ):
5413         case (PROT_EXEC):
5414         case (PROT_EXEC | PROT_READ):
5415                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5416                 return (TTE_PRIV_INT);          /* set prv and clr wrt */
5417         case (PROT_WRITE):
5418         case (PROT_WRITE | PROT_READ):
5419         case (PROT_EXEC | PROT_WRITE):
5420         case (PROT_EXEC | PROT_WRITE | PROT_READ):
5421                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5422                 return (TTE_PRIV_INT | TTE_WRPRM_INT);  /* set prv and wrt */
5423         case (PROT_USER | PROT_READ):
5424         case (PROT_USER | PROT_EXEC):
5425         case (PROT_USER | PROT_EXEC | PROT_READ):
5426                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5427                 return (0);                     /* clr prv and wrt */
5428         case (PROT_USER | PROT_WRITE):
5429         case (PROT_USER | PROT_WRITE | PROT_READ):
5430         case (PROT_USER | PROT_EXEC | PROT_WRITE):
5431         case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5432                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5433                 return (TTE_WRPRM_INT);         /* clr prv and set wrt */
5434         default:
5435                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5436         }
5437         return (0);
5438 }
5439 
5440 /*
5441  * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5442  * the normal algorithm would take too long for a very large VA range with
5443  * few real mappings. This routine just walks thru all HMEs in the global
5444  * hash table to find and remove mappings.
5445  */
5446 static void
5447 hat_unload_large_virtual(
5448         struct hat              *sfmmup,
5449         caddr_t                 startaddr,
5450         size_t                  len,
5451         uint_t                  flags,
5452         hat_callback_t          *callback)
5453 {
5454         struct hmehash_bucket *hmebp;
5455         struct hme_blk *hmeblkp;
5456         struct hme_blk *pr_hblk = NULL;
5457         struct hme_blk *nx_hblk;
5458         struct hme_blk *list = NULL;
5459         int i;
5460         demap_range_t dmr, *dmrp;
5461         cpuset_t cpuset;
5462         caddr_t endaddr = startaddr + len;
5463         caddr_t sa;
5464         caddr_t ea;
5465         caddr_t cb_sa[MAX_CB_ADDR];
5466         caddr_t cb_ea[MAX_CB_ADDR];
5467         int     addr_cnt = 0;
5468         int     a = 0;
5469 
5470         if (sfmmup->sfmmu_free) {
5471                 dmrp = NULL;
5472         } else {
5473                 dmrp = &dmr;
5474                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5475         }
5476 
5477         /*
5478          * Loop through all the hash buckets of HME blocks looking for matches.
5479          */
5480         for (i = 0; i <= UHMEHASH_SZ; i++) {
5481                 hmebp = &uhme_hash[i];
5482                 SFMMU_HASH_LOCK(hmebp);
5483                 hmeblkp = hmebp->hmeblkp;
5484                 pr_hblk = NULL;
5485                 while (hmeblkp) {
5486                         nx_hblk = hmeblkp->hblk_next;
5487 
5488                         /*
5489                          * skip if not this context, if a shadow block or
5490                          * if the mapping is not in the requested range
5491                          */
5492                         if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5493                             hmeblkp->hblk_shw_bit ||
5494                             (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5495                             (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5496                                 pr_hblk = hmeblkp;
5497                                 goto next_block;
5498                         }
5499 
5500                         ASSERT(!hmeblkp->hblk_shared);
5501                         /*
5502                          * unload if there are any current valid mappings
5503                          */
5504                         if (hmeblkp->hblk_vcnt != 0 ||
5505                             hmeblkp->hblk_hmecnt != 0)
5506                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5507                                     sa, ea, dmrp, flags);
5508 
5509                         /*
5510                          * on unmap we also release the HME block itself, once
5511                          * all mappings are gone.
5512                          */
5513                         if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5514                             !hmeblkp->hblk_vcnt &&
5515                             !hmeblkp->hblk_hmecnt) {
5516                                 ASSERT(!hmeblkp->hblk_lckcnt);
5517                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5518                                     &list, 0);
5519                         } else {
5520                                 pr_hblk = hmeblkp;
5521                         }
5522 
5523                         if (callback == NULL)
5524                                 goto next_block;
5525 
5526                         /*
5527                          * HME blocks may span more than one page, but we may be
5528                          * unmapping only one page, so check for a smaller range
5529                          * for the callback
5530                          */
5531                         if (sa < startaddr)
5532                                 sa = startaddr;
5533                         if (--ea > endaddr)
5534                                 ea = endaddr - 1;
5535 
5536                         cb_sa[addr_cnt] = sa;
5537                         cb_ea[addr_cnt] = ea;
5538                         if (++addr_cnt == MAX_CB_ADDR) {
5539                                 if (dmrp != NULL) {
5540                                         DEMAP_RANGE_FLUSH(dmrp);
5541                                         cpuset = sfmmup->sfmmu_cpusran;
5542                                         xt_sync(cpuset);
5543                                 }
5544 
5545                                 for (a = 0; a < MAX_CB_ADDR; ++a) {
5546                                         callback->hcb_start_addr = cb_sa[a];
5547                                         callback->hcb_end_addr = cb_ea[a];
5548                                         callback->hcb_function(callback);
5549                                 }
5550                                 addr_cnt = 0;
5551                         }
5552 
5553 next_block:
5554                         hmeblkp = nx_hblk;
5555                 }
5556                 SFMMU_HASH_UNLOCK(hmebp);
5557         }
5558 
5559         sfmmu_hblks_list_purge(&list, 0);
5560         if (dmrp != NULL) {
5561                 DEMAP_RANGE_FLUSH(dmrp);
5562                 cpuset = sfmmup->sfmmu_cpusran;
5563                 xt_sync(cpuset);
5564         }
5565 
5566         for (a = 0; a < addr_cnt; ++a) {
5567                 callback->hcb_start_addr = cb_sa[a];
5568                 callback->hcb_end_addr = cb_ea[a];
5569                 callback->hcb_function(callback);
5570         }
5571 
5572         /*
5573          * Check TSB and TLB page sizes if the process isn't exiting.
5574          */
5575         if (!sfmmup->sfmmu_free)
5576                 sfmmu_check_page_sizes(sfmmup, 0);
5577 }
5578 
5579 /*
5580  * Unload all the mappings in the range [addr..addr+len). addr and len must
5581  * be MMU_PAGESIZE aligned.
5582  */
5583 
5584 extern struct seg *segkmap;
5585 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5586 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5587 
5588 
5589 void
5590 hat_unload_callback(
5591         struct hat *sfmmup,
5592         caddr_t addr,
5593         size_t len,
5594         uint_t flags,
5595         hat_callback_t *callback)
5596 {
5597         struct hmehash_bucket *hmebp;
5598         hmeblk_tag hblktag;
5599         int hmeshift, hashno, iskernel;
5600         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5601         caddr_t endaddr;
5602         cpuset_t cpuset;
5603         int addr_count = 0;
5604         int a;
5605         caddr_t cb_start_addr[MAX_CB_ADDR];
5606         caddr_t cb_end_addr[MAX_CB_ADDR];
5607         int issegkmap = ISSEGKMAP(sfmmup, addr);
5608         demap_range_t dmr, *dmrp;
5609 
5610         ASSERT(sfmmup->sfmmu_as != NULL);
5611 
5612         ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5613             AS_LOCK_HELD(sfmmup->sfmmu_as));
5614 
5615         ASSERT(sfmmup != NULL);
5616         ASSERT((len & MMU_PAGEOFFSET) == 0);
5617         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5618 
5619         /*
5620          * Probing through a large VA range (say 63 bits) will be slow, even
5621          * at 4 Meg steps between the probes. So, when the virtual address range
5622          * is very large, search the HME entries for what to unload.
5623          *
5624          *      len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5625          *
5626          *      UHMEHASH_SZ is number of hash buckets to examine
5627          *
5628          */
5629         if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5630                 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5631                 return;
5632         }
5633 
5634         CPUSET_ZERO(cpuset);
5635 
5636         /*
5637          * If the process is exiting, we can save a lot of fuss since
5638          * we'll flush the TLB when we free the ctx anyway.
5639          */
5640         if (sfmmup->sfmmu_free) {
5641                 dmrp = NULL;
5642         } else {
5643                 dmrp = &dmr;
5644                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5645         }
5646 
5647         endaddr = addr + len;
5648         hblktag.htag_id = sfmmup;
5649         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5650 
5651         /*
5652          * It is likely for the vm to call unload over a wide range of
5653          * addresses that are actually very sparsely populated by
5654          * translations.  In order to speed this up the sfmmu hat supports
5655          * the concept of shadow hmeblks. Dummy large page hmeblks that
5656          * correspond to actual small translations are allocated at tteload
5657          * time and are referred to as shadow hmeblks.  Now, during unload
5658          * time, we first check if we have a shadow hmeblk for that
5659          * translation.  The absence of one means the corresponding address
5660          * range is empty and can be skipped.
5661          *
5662          * The kernel is an exception to above statement and that is why
5663          * we don't use shadow hmeblks and hash starting from the smallest
5664          * page size.
5665          */
5666         if (sfmmup == KHATID) {
5667                 iskernel = 1;
5668                 hashno = TTE64K;
5669         } else {
5670                 iskernel = 0;
5671                 if (mmu_page_sizes == max_mmu_page_sizes) {
5672                         hashno = TTE256M;
5673                 } else {
5674                         hashno = TTE4M;
5675                 }
5676         }
5677         while (addr < endaddr) {
5678                 hmeshift = HME_HASH_SHIFT(hashno);
5679                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5680                 hblktag.htag_rehash = hashno;
5681                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5682 
5683                 SFMMU_HASH_LOCK(hmebp);
5684 
5685                 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5686                 if (hmeblkp == NULL) {
5687                         /*
5688                          * didn't find an hmeblk. skip the appropiate
5689                          * address range.
5690                          */
5691                         SFMMU_HASH_UNLOCK(hmebp);
5692                         if (iskernel) {
5693                                 if (hashno < mmu_hashcnt) {
5694                                         hashno++;
5695                                         continue;
5696                                 } else {
5697                                         hashno = TTE64K;
5698                                         addr = (caddr_t)roundup((uintptr_t)addr
5699                                             + 1, MMU_PAGESIZE64K);
5700                                         continue;
5701                                 }
5702                         }
5703                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5704                             (1 << hmeshift));
5705                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5706                                 ASSERT(hashno == TTE64K);
5707                                 continue;
5708                         }
5709                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5710                                 hashno = TTE512K;
5711                                 continue;
5712                         }
5713                         if (mmu_page_sizes == max_mmu_page_sizes) {
5714                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5715                                         hashno = TTE4M;
5716                                         continue;
5717                                 }
5718                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5719                                         hashno = TTE32M;
5720                                         continue;
5721                                 }
5722                                 hashno = TTE256M;
5723                                 continue;
5724                         } else {
5725                                 hashno = TTE4M;
5726                                 continue;
5727                         }
5728                 }
5729                 ASSERT(hmeblkp);
5730                 ASSERT(!hmeblkp->hblk_shared);
5731                 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5732                         /*
5733                          * If the valid count is zero we can skip the range
5734                          * mapped by this hmeblk.
5735                          * We free hblks in the case of HAT_UNMAP.  HAT_UNMAP
5736                          * is used by segment drivers as a hint
5737                          * that the mapping resource won't be used any longer.
5738                          * The best example of this is during exit().
5739                          */
5740                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5741                             get_hblk_span(hmeblkp));
5742                         if ((flags & HAT_UNLOAD_UNMAP) ||
5743                             (iskernel && !issegkmap)) {
5744                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5745                                     &list, 0);
5746                         }
5747                         SFMMU_HASH_UNLOCK(hmebp);
5748 
5749                         if (iskernel) {
5750                                 hashno = TTE64K;
5751                                 continue;
5752                         }
5753                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5754                                 ASSERT(hashno == TTE64K);
5755                                 continue;
5756                         }
5757                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5758                                 hashno = TTE512K;
5759                                 continue;
5760                         }
5761                         if (mmu_page_sizes == max_mmu_page_sizes) {
5762                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5763                                         hashno = TTE4M;
5764                                         continue;
5765                                 }
5766                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5767                                         hashno = TTE32M;
5768                                         continue;
5769                                 }
5770                                 hashno = TTE256M;
5771                                 continue;
5772                         } else {
5773                                 hashno = TTE4M;
5774                                 continue;
5775                         }
5776                 }
5777                 if (hmeblkp->hblk_shw_bit) {
5778                         /*
5779                          * If we encounter a shadow hmeblk we know there is
5780                          * smaller sized hmeblks mapping the same address space.
5781                          * Decrement the hash size and rehash.
5782                          */
5783                         ASSERT(sfmmup != KHATID);
5784                         hashno--;
5785                         SFMMU_HASH_UNLOCK(hmebp);
5786                         continue;
5787                 }
5788 
5789                 /*
5790                  * track callback address ranges.
5791                  * only start a new range when it's not contiguous
5792                  */
5793                 if (callback != NULL) {
5794                         if (addr_count > 0 &&
5795                             addr == cb_end_addr[addr_count - 1])
5796                                 --addr_count;
5797                         else
5798                                 cb_start_addr[addr_count] = addr;
5799                 }
5800 
5801                 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5802                     dmrp, flags);
5803 
5804                 if (callback != NULL)
5805                         cb_end_addr[addr_count++] = addr;
5806 
5807                 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5808                     !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5809                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5810                 }
5811                 SFMMU_HASH_UNLOCK(hmebp);
5812 
5813                 /*
5814                  * Notify our caller as to exactly which pages
5815                  * have been unloaded. We do these in clumps,
5816                  * to minimize the number of xt_sync()s that need to occur.
5817                  */
5818                 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5819                         if (dmrp != NULL) {
5820                                 DEMAP_RANGE_FLUSH(dmrp);
5821                                 cpuset = sfmmup->sfmmu_cpusran;
5822                                 xt_sync(cpuset);
5823                         }
5824 
5825                         for (a = 0; a < MAX_CB_ADDR; ++a) {
5826                                 callback->hcb_start_addr = cb_start_addr[a];
5827                                 callback->hcb_end_addr = cb_end_addr[a];
5828                                 callback->hcb_function(callback);
5829                         }
5830                         addr_count = 0;
5831                 }
5832                 if (iskernel) {
5833                         hashno = TTE64K;
5834                         continue;
5835                 }
5836                 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5837                         ASSERT(hashno == TTE64K);
5838                         continue;
5839                 }
5840                 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5841                         hashno = TTE512K;
5842                         continue;
5843                 }
5844                 if (mmu_page_sizes == max_mmu_page_sizes) {
5845                         if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5846                                 hashno = TTE4M;
5847                                 continue;
5848                         }
5849                         if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5850                                 hashno = TTE32M;
5851                                 continue;
5852                         }
5853                         hashno = TTE256M;
5854                 } else {
5855                         hashno = TTE4M;
5856                 }
5857         }
5858 
5859         sfmmu_hblks_list_purge(&list, 0);
5860         if (dmrp != NULL) {
5861                 DEMAP_RANGE_FLUSH(dmrp);
5862                 cpuset = sfmmup->sfmmu_cpusran;
5863                 xt_sync(cpuset);
5864         }
5865         if (callback && addr_count != 0) {
5866                 for (a = 0; a < addr_count; ++a) {
5867                         callback->hcb_start_addr = cb_start_addr[a];
5868                         callback->hcb_end_addr = cb_end_addr[a];
5869                         callback->hcb_function(callback);
5870                 }
5871         }
5872 
5873         /*
5874          * Check TSB and TLB page sizes if the process isn't exiting.
5875          */
5876         if (!sfmmup->sfmmu_free)
5877                 sfmmu_check_page_sizes(sfmmup, 0);
5878 }
5879 
5880 /*
5881  * Unload all the mappings in the range [addr..addr+len). addr and len must
5882  * be MMU_PAGESIZE aligned.
5883  */
5884 void
5885 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5886 {
5887         hat_unload_callback(sfmmup, addr, len, flags, NULL);
5888 }
5889 
5890 
5891 /*
5892  * Find the largest mapping size for this page.
5893  */
5894 int
5895 fnd_mapping_sz(page_t *pp)
5896 {
5897         int sz;
5898         int p_index;
5899 
5900         p_index = PP_MAPINDEX(pp);
5901 
5902         sz = 0;
5903         p_index >>= 1;    /* don't care about 8K bit */
5904         for (; p_index; p_index >>= 1) {
5905                 sz++;
5906         }
5907 
5908         return (sz);
5909 }
5910 
5911 /*
5912  * This function unloads a range of addresses for an hmeblk.
5913  * It returns the next address to be unloaded.
5914  * It should be called with the hash lock held.
5915  */
5916 static caddr_t
5917 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5918         caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
5919 {
5920         tte_t   tte, ttemod;
5921         struct  sf_hment *sfhmep;
5922         int     ttesz;
5923         long    ttecnt;
5924         page_t *pp;
5925         kmutex_t *pml;
5926         int ret;
5927         int use_demap_range;
5928 
5929         ASSERT(in_hblk_range(hmeblkp, addr));
5930         ASSERT(!hmeblkp->hblk_shw_bit);
5931         ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
5932         ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
5933         ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
5934 
5935 #ifdef DEBUG
5936         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5937             (endaddr < get_hblk_endaddr(hmeblkp))) {
5938                 panic("sfmmu_hblk_unload: partial unload of large page");
5939         }
5940 #endif /* DEBUG */
5941 
5942         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5943         ttesz = get_hblk_ttesz(hmeblkp);
5944 
5945         use_demap_range = ((dmrp == NULL) ||
5946             (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
5947 
5948         if (use_demap_range) {
5949                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5950         } else if (dmrp != NULL) {
5951                 DEMAP_RANGE_FLUSH(dmrp);
5952         }
5953         ttecnt = 0;
5954         HBLKTOHME(sfhmep, hmeblkp, addr);
5955 
5956         while (addr < endaddr) {
5957                 pml = NULL;
5958                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5959                 if (TTE_IS_VALID(&tte)) {
5960                         pp = sfhmep->hme_page;
5961                         if (pp != NULL) {
5962                                 pml = sfmmu_mlist_enter(pp);
5963                         }
5964 
5965                         /*
5966                          * Verify if hme still points to 'pp' now that
5967                          * we have p_mapping lock.
5968                          */
5969                         if (sfhmep->hme_page != pp) {
5970                                 if (pp != NULL && sfhmep->hme_page != NULL) {
5971                                         ASSERT(pml != NULL);
5972                                         sfmmu_mlist_exit(pml);
5973                                         /* Re-start this iteration. */
5974                                         continue;
5975                                 }
5976                                 ASSERT((pp != NULL) &&
5977                                     (sfhmep->hme_page == NULL));
5978                                 goto tte_unloaded;
5979                         }
5980 
5981                         /*
5982                          * This point on we have both HASH and p_mapping
5983                          * lock.
5984                          */
5985                         ASSERT(pp == sfhmep->hme_page);
5986                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5987 
5988                         /*
5989                          * We need to loop on modify tte because it is
5990                          * possible for pagesync to come along and
5991                          * change the software bits beneath us.
5992                          *
5993                          * Page_unload can also invalidate the tte after
5994                          * we read tte outside of p_mapping lock.
5995                          */
5996 again:
5997                         ttemod = tte;
5998 
5999                         TTE_SET_INVALID(&ttemod);
6000                         ret = sfmmu_modifytte_try(&tte, &ttemod,
6001                             &sfhmep->hme_tte);
6002 
6003                         if (ret <= 0) {
6004                                 if (TTE_IS_VALID(&tte)) {
6005                                         ASSERT(ret < 0);
6006                                         goto again;
6007                                 }
6008                                 if (pp != NULL) {
6009                                         panic("sfmmu_hblk_unload: pp = 0x%p "
6010                                             "tte became invalid under mlist"
6011                                             " lock = 0x%p", (void *)pp,
6012                                             (void *)pml);
6013                                 }
6014                                 continue;
6015                         }
6016 
6017                         if (!(flags & HAT_UNLOAD_NOSYNC)) {
6018                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6019                         }
6020 
6021                         /*
6022                          * Ok- we invalidated the tte. Do the rest of the job.
6023                          */
6024                         ttecnt++;
6025 
6026                         if (flags & HAT_UNLOAD_UNLOCK) {
6027                                 ASSERT(hmeblkp->hblk_lckcnt > 0);
6028                                 atomic_dec_32(&hmeblkp->hblk_lckcnt);
6029                                 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6030                         }
6031 
6032                         /*
6033                          * Normally we would need to flush the page
6034                          * from the virtual cache at this point in
6035                          * order to prevent a potential cache alias
6036                          * inconsistency.
6037                          * The particular scenario we need to worry
6038                          * about is:
6039                          * Given:  va1 and va2 are two virtual address
6040                          * that alias and map the same physical
6041                          * address.
6042                          * 1.   mapping exists from va1 to pa and data
6043                          * has been read into the cache.
6044                          * 2.   unload va1.
6045                          * 3.   load va2 and modify data using va2.
6046                          * 4    unload va2.
6047                          * 5.   load va1 and reference data.  Unless we
6048                          * flush the data cache when we unload we will
6049                          * get stale data.
6050                          * Fortunately, page coloring eliminates the
6051                          * above scenario by remembering the color a
6052                          * physical page was last or is currently
6053                          * mapped to.  Now, we delay the flush until
6054                          * the loading of translations.  Only when the
6055                          * new translation is of a different color
6056                          * are we forced to flush.
6057                          */
6058                         if (use_demap_range) {
6059                                 /*
6060                                  * Mark this page as needing a demap.
6061                                  */
6062                                 DEMAP_RANGE_MARKPG(dmrp, addr);
6063                         } else {
6064                                 ASSERT(sfmmup != NULL);
6065                                 ASSERT(!hmeblkp->hblk_shared);
6066                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6067                                     sfmmup->sfmmu_free, 0);
6068                         }
6069 
6070                         if (pp) {
6071                                 /*
6072                                  * Remove the hment from the mapping list
6073                                  */
6074                                 ASSERT(hmeblkp->hblk_hmecnt > 0);
6075 
6076                                 /*
6077                                  * Again, we cannot
6078                                  * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6079                                  */
6080                                 HME_SUB(sfhmep, pp);
6081                                 membar_stst();
6082                                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
6083                         }
6084 
6085                         ASSERT(hmeblkp->hblk_vcnt > 0);
6086                         atomic_dec_16(&hmeblkp->hblk_vcnt);
6087 
6088                         ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6089                             !hmeblkp->hblk_lckcnt);
6090 
6091 #ifdef VAC
6092                         if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6093                                 if (PP_ISTNC(pp)) {
6094                                         /*
6095                                          * If page was temporary
6096                                          * uncached, try to recache
6097                                          * it. Note that HME_SUB() was
6098                                          * called above so p_index and
6099                                          * mlist had been updated.
6100                                          */
6101                                         conv_tnc(pp, ttesz);
6102                                 } else if (pp->p_mapping == NULL) {
6103                                         ASSERT(kpm_enable);
6104                                         /*
6105                                          * Page is marked to be in VAC conflict
6106                                          * to an existing kpm mapping and/or is
6107                                          * kpm mapped using only the regular
6108                                          * pagesize.
6109                                          */
6110                                         sfmmu_kpm_hme_unload(pp);
6111                                 }
6112                         }
6113 #endif  /* VAC */
6114                 } else if ((pp = sfhmep->hme_page) != NULL) {
6115                                 /*
6116                                  * TTE is invalid but the hme
6117                                  * still exists. let pageunload
6118                                  * complete its job.
6119                                  */
6120                                 ASSERT(pml == NULL);
6121                                 pml = sfmmu_mlist_enter(pp);
6122                                 if (sfhmep->hme_page != NULL) {
6123                                         sfmmu_mlist_exit(pml);
6124                                         continue;
6125                                 }
6126                                 ASSERT(sfhmep->hme_page == NULL);
6127                 } else if (hmeblkp->hblk_hmecnt != 0) {
6128                         /*
6129                          * pageunload may have not finished decrementing
6130                          * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6131                          * wait for pageunload to finish. Rely on pageunload
6132                          * to decrement hblk_hmecnt after hblk_vcnt.
6133                          */
6134                         pfn_t pfn = TTE_TO_TTEPFN(&tte);
6135                         ASSERT(pml == NULL);
6136                         if (pf_is_memory(pfn)) {
6137                                 pp = page_numtopp_nolock(pfn);
6138                                 if (pp != NULL) {
6139                                         pml = sfmmu_mlist_enter(pp);
6140                                         sfmmu_mlist_exit(pml);
6141                                         pml = NULL;
6142                                 }
6143                         }
6144                 }
6145 
6146 tte_unloaded:
6147                 /*
6148                  * At this point, the tte we are looking at
6149                  * should be unloaded, and hme has been unlinked
6150                  * from page too. This is important because in
6151                  * pageunload, it does ttesync() then HME_SUB.
6152                  * We need to make sure HME_SUB has been completed
6153                  * so we know ttesync() has been completed. Otherwise,
6154                  * at exit time, after return from hat layer, VM will
6155                  * release as structure which hat_setstat() (called
6156                  * by ttesync()) needs.
6157                  */
6158 #ifdef DEBUG
6159                 {
6160                         tte_t   dtte;
6161 
6162                         ASSERT(sfhmep->hme_page == NULL);
6163 
6164                         sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6165                         ASSERT(!TTE_IS_VALID(&dtte));
6166                 }
6167 #endif
6168 
6169                 if (pml) {
6170                         sfmmu_mlist_exit(pml);
6171                 }
6172 
6173                 addr += TTEBYTES(ttesz);
6174                 sfhmep++;
6175                 DEMAP_RANGE_NEXTPG(dmrp);
6176         }
6177         /*
6178          * For shared hmeblks this routine is only called when region is freed
6179          * and no longer referenced.  So no need to decrement ttecnt
6180          * in the region structure here.
6181          */
6182         if (ttecnt > 0 && sfmmup != NULL) {
6183                 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6184         }
6185         return (addr);
6186 }
6187 
6188 /*
6189  * Invalidate a virtual address range for the local CPU.
6190  * For best performance ensure that the va range is completely
6191  * mapped, otherwise the entire TLB will be flushed.
6192  */
6193 void
6194 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6195 {
6196         ssize_t sz;
6197         caddr_t endva = va + size;
6198 
6199         while (va < endva) {
6200                 sz = hat_getpagesize(sfmmup, va);
6201                 if (sz < 0) {
6202                         vtag_flushall();
6203                         break;
6204                 }
6205                 vtag_flushpage(va, (uint64_t)sfmmup);
6206                 va += sz;
6207         }
6208 }
6209 
6210 /*
6211  * Synchronize all the mappings in the range [addr..addr+len).
6212  * Can be called with clearflag having two states:
6213  * HAT_SYNC_DONTZERO means just return the rm stats
6214  * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6215  */
6216 void
6217 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6218 {
6219         struct hmehash_bucket *hmebp;
6220         hmeblk_tag hblktag;
6221         int hmeshift, hashno = 1;
6222         struct hme_blk *hmeblkp, *list = NULL;
6223         caddr_t endaddr;
6224         cpuset_t cpuset;
6225 
6226         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6227         ASSERT((len & MMU_PAGEOFFSET) == 0);
6228         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6229             (clearflag == HAT_SYNC_ZERORM));
6230 
6231         CPUSET_ZERO(cpuset);
6232 
6233         endaddr = addr + len;
6234         hblktag.htag_id = sfmmup;
6235         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6236 
6237         /*
6238          * Spitfire supports 4 page sizes.
6239          * Most pages are expected to be of the smallest page
6240          * size (8K) and these will not need to be rehashed. 64K
6241          * pages also don't need to be rehashed because the an hmeblk
6242          * spans 64K of address space. 512K pages might need 1 rehash and
6243          * and 4M pages 2 rehashes.
6244          */
6245         while (addr < endaddr) {
6246                 hmeshift = HME_HASH_SHIFT(hashno);
6247                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6248                 hblktag.htag_rehash = hashno;
6249                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6250 
6251                 SFMMU_HASH_LOCK(hmebp);
6252 
6253                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6254                 if (hmeblkp != NULL) {
6255                         ASSERT(!hmeblkp->hblk_shared);
6256                         /*
6257                          * We've encountered a shadow hmeblk so skip the range
6258                          * of the next smaller mapping size.
6259                          */
6260                         if (hmeblkp->hblk_shw_bit) {
6261                                 ASSERT(sfmmup != ksfmmup);
6262                                 ASSERT(hashno > 1);
6263                                 addr = (caddr_t)P2END((uintptr_t)addr,
6264                                     TTEBYTES(hashno - 1));
6265                         } else {
6266                                 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6267                                     addr, endaddr, clearflag);
6268                         }
6269                         SFMMU_HASH_UNLOCK(hmebp);
6270                         hashno = 1;
6271                         continue;
6272                 }
6273                 SFMMU_HASH_UNLOCK(hmebp);
6274 
6275                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6276                         /*
6277                          * We have traversed the whole list and rehashed
6278                          * if necessary without finding the address to sync.
6279                          * This is ok so we increment the address by the
6280                          * smallest hmeblk range for kernel mappings and the
6281                          * largest hmeblk range, to account for shadow hmeblks,
6282                          * for user mappings and continue.
6283                          */
6284                         if (sfmmup == ksfmmup)
6285                                 addr = (caddr_t)P2END((uintptr_t)addr,
6286                                     TTEBYTES(1));
6287                         else
6288                                 addr = (caddr_t)P2END((uintptr_t)addr,
6289                                     TTEBYTES(hashno));
6290                         hashno = 1;
6291                 } else {
6292                         hashno++;
6293                 }
6294         }
6295         sfmmu_hblks_list_purge(&list, 0);
6296         cpuset = sfmmup->sfmmu_cpusran;
6297         xt_sync(cpuset);
6298 }
6299 
6300 static caddr_t
6301 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6302         caddr_t endaddr, int clearflag)
6303 {
6304         tte_t   tte, ttemod;
6305         struct sf_hment *sfhmep;
6306         int ttesz;
6307         struct page *pp;
6308         kmutex_t *pml;
6309         int ret;
6310 
6311         ASSERT(hmeblkp->hblk_shw_bit == 0);
6312         ASSERT(!hmeblkp->hblk_shared);
6313 
6314         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6315 
6316         ttesz = get_hblk_ttesz(hmeblkp);
6317         HBLKTOHME(sfhmep, hmeblkp, addr);
6318 
6319         while (addr < endaddr) {
6320                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6321                 if (TTE_IS_VALID(&tte)) {
6322                         pml = NULL;
6323                         pp = sfhmep->hme_page;
6324                         if (pp) {
6325                                 pml = sfmmu_mlist_enter(pp);
6326                         }
6327                         if (pp != sfhmep->hme_page) {
6328                                 /*
6329                                  * tte most have been unloaded
6330                                  * underneath us.  Recheck
6331                                  */
6332                                 ASSERT(pml);
6333                                 sfmmu_mlist_exit(pml);
6334                                 continue;
6335                         }
6336 
6337                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6338 
6339                         if (clearflag == HAT_SYNC_ZERORM) {
6340                                 ttemod = tte;
6341                                 TTE_CLR_RM(&ttemod);
6342                                 ret = sfmmu_modifytte_try(&tte, &ttemod,
6343                                     &sfhmep->hme_tte);
6344                                 if (ret < 0) {
6345                                         if (pml) {
6346                                                 sfmmu_mlist_exit(pml);
6347                                         }
6348                                         continue;
6349                                 }
6350 
6351                                 if (ret > 0) {
6352                                         sfmmu_tlb_demap(addr, sfmmup,
6353                                             hmeblkp, 0, 0);
6354                                 }
6355                         }
6356                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
6357                         if (pml) {
6358                                 sfmmu_mlist_exit(pml);
6359                         }
6360                 }
6361                 addr += TTEBYTES(ttesz);
6362                 sfhmep++;
6363         }
6364         return (addr);
6365 }
6366 
6367 /*
6368  * This function will sync a tte to the page struct and it will
6369  * update the hat stats. Currently it allows us to pass a NULL pp
6370  * and we will simply update the stats.  We may want to change this
6371  * so we only keep stats for pages backed by pp's.
6372  */
6373 static void
6374 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6375 {
6376         uint_t rm = 0;
6377         int     sz;
6378         pgcnt_t npgs;
6379 
6380         ASSERT(TTE_IS_VALID(ttep));
6381 
6382         if (TTE_IS_NOSYNC(ttep)) {
6383                 return;
6384         }
6385 
6386         if (TTE_IS_REF(ttep))  {
6387                 rm = P_REF;
6388         }
6389         if (TTE_IS_MOD(ttep))  {
6390                 rm |= P_MOD;
6391         }
6392 
6393         if (rm == 0) {
6394                 return;
6395         }
6396 
6397         sz = TTE_CSZ(ttep);
6398         if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6399                 int i;
6400                 caddr_t vaddr = addr;
6401 
6402                 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6403                         hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6404                 }
6405 
6406         }
6407 
6408         /*
6409          * XXX I want to use cas to update nrm bits but they
6410          * currently belong in common/vm and not in hat where
6411          * they should be.
6412          * The nrm bits are protected by the same mutex as
6413          * the one that protects the page's mapping list.
6414          */
6415         if (!pp)
6416                 return;
6417         ASSERT(sfmmu_mlist_held(pp));
6418         /*
6419          * If the tte is for a large page, we need to sync all the
6420          * pages covered by the tte.
6421          */
6422         if (sz != TTE8K) {
6423                 ASSERT(pp->p_szc != 0);
6424                 pp = PP_GROUPLEADER(pp, sz);
6425                 ASSERT(sfmmu_mlist_held(pp));
6426         }
6427 
6428         /* Get number of pages from tte size. */
6429         npgs = TTEPAGES(sz);
6430 
6431         do {
6432                 ASSERT(pp);
6433                 ASSERT(sfmmu_mlist_held(pp));
6434                 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6435                     ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6436                         hat_page_setattr(pp, rm);
6437 
6438                 /*
6439                  * Are we done? If not, we must have a large mapping.
6440                  * For large mappings we need to sync the rest of the pages
6441                  * covered by this tte; goto the next page.
6442                  */
6443         } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6444 }
6445 
6446 /*
6447  * Execute pre-callback handler of each pa_hment linked to pp
6448  *
6449  * Inputs:
6450  *   flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6451  *   capture_cpus: pointer to return value (below)
6452  *
6453  * Returns:
6454  *   Propagates the subsystem callback return values back to the caller;
6455  *   returns 0 on success.  If capture_cpus is non-NULL, the value returned
6456  *   is zero if all of the pa_hments are of a type that do not require
6457  *   capturing CPUs prior to suspending the mapping, else it is 1.
6458  */
6459 static int
6460 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6461 {
6462         struct sf_hment *sfhmep;
6463         struct pa_hment *pahmep;
6464         int (*f)(caddr_t, uint_t, uint_t, void *);
6465         int             ret;
6466         id_t            id;
6467         int             locked = 0;
6468         kmutex_t        *pml;
6469 
6470         ASSERT(PAGE_EXCL(pp));
6471         if (!sfmmu_mlist_held(pp)) {
6472                 pml = sfmmu_mlist_enter(pp);
6473                 locked = 1;
6474         }
6475 
6476         if (capture_cpus)
6477                 *capture_cpus = 0;
6478 
6479 top:
6480         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6481                 /*
6482                  * skip sf_hments corresponding to VA<->PA mappings;
6483                  * for pa_hment's, hme_tte.ll is zero
6484                  */
6485                 if (!IS_PAHME(sfhmep))
6486                         continue;
6487 
6488                 pahmep = sfhmep->hme_data;
6489                 ASSERT(pahmep != NULL);
6490 
6491                 /*
6492                  * skip if pre-handler has been called earlier in this loop
6493                  */
6494                 if (pahmep->flags & flag)
6495                         continue;
6496 
6497                 id = pahmep->cb_id;
6498                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6499                 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6500                         *capture_cpus = 1;
6501                 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6502                         pahmep->flags |= flag;
6503                         continue;
6504                 }
6505 
6506                 /*
6507                  * Drop the mapping list lock to avoid locking order issues.
6508                  */
6509                 if (locked)
6510                         sfmmu_mlist_exit(pml);
6511 
6512                 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6513                 if (ret != 0)
6514                         return (ret);   /* caller must do the cleanup */
6515 
6516                 if (locked) {
6517                         pml = sfmmu_mlist_enter(pp);
6518                         pahmep->flags |= flag;
6519                         goto top;
6520                 }
6521 
6522                 pahmep->flags |= flag;
6523         }
6524 
6525         if (locked)
6526                 sfmmu_mlist_exit(pml);
6527 
6528         return (0);
6529 }
6530 
6531 /*
6532  * Execute post-callback handler of each pa_hment linked to pp
6533  *
6534  * Same overall assumptions and restrictions apply as for
6535  * hat_pageprocess_precallbacks().
6536  */
6537 static void
6538 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6539 {
6540         pfn_t pgpfn = pp->p_pagenum;
6541         pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6542         pfn_t newpfn;
6543         struct sf_hment *sfhmep;
6544         struct pa_hment *pahmep;
6545         int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6546         id_t    id;
6547         int     locked = 0;
6548         kmutex_t *pml;
6549 
6550         ASSERT(PAGE_EXCL(pp));
6551         if (!sfmmu_mlist_held(pp)) {
6552                 pml = sfmmu_mlist_enter(pp);
6553                 locked = 1;
6554         }
6555 
6556 top:
6557         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6558                 /*
6559                  * skip sf_hments corresponding to VA<->PA mappings;
6560                  * for pa_hment's, hme_tte.ll is zero
6561                  */
6562                 if (!IS_PAHME(sfhmep))
6563                         continue;
6564 
6565                 pahmep = sfhmep->hme_data;
6566                 ASSERT(pahmep != NULL);
6567 
6568                 if ((pahmep->flags & flag) == 0)
6569                         continue;
6570 
6571                 pahmep->flags &= ~flag;
6572 
6573                 id = pahmep->cb_id;
6574                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6575                 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6576                         continue;
6577 
6578                 /*
6579                  * Convert the base page PFN into the constituent PFN
6580                  * which is needed by the callback handler.
6581                  */
6582                 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6583 
6584                 /*
6585                  * Drop the mapping list lock to avoid locking order issues.
6586                  */
6587                 if (locked)
6588                         sfmmu_mlist_exit(pml);
6589 
6590                 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6591                     != 0)
6592                         panic("sfmmu: posthandler failed");
6593 
6594                 if (locked) {
6595                         pml = sfmmu_mlist_enter(pp);
6596                         goto top;
6597                 }
6598         }
6599 
6600         if (locked)
6601                 sfmmu_mlist_exit(pml);
6602 }
6603 
6604 /*
6605  * Suspend locked kernel mapping
6606  */
6607 void
6608 hat_pagesuspend(struct page *pp)
6609 {
6610         struct sf_hment *sfhmep;
6611         sfmmu_t *sfmmup;
6612         tte_t tte, ttemod;
6613         struct hme_blk *hmeblkp;
6614         caddr_t addr;
6615         int index, cons;
6616         cpuset_t cpuset;
6617 
6618         ASSERT(PAGE_EXCL(pp));
6619         ASSERT(sfmmu_mlist_held(pp));
6620 
6621         mutex_enter(&kpr_suspendlock);
6622 
6623         /*
6624          * We're about to suspend a kernel mapping so mark this thread as
6625          * non-traceable by DTrace. This prevents us from running into issues
6626          * with probe context trying to touch a suspended page
6627          * in the relocation codepath itself.
6628          */
6629         curthread->t_flag |= T_DONTDTRACE;
6630 
6631         index = PP_MAPINDEX(pp);
6632         cons = TTE8K;
6633 
6634 retry:
6635         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6636 
6637                 if (IS_PAHME(sfhmep))
6638                         continue;
6639 
6640                 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6641                         continue;
6642 
6643                 /*
6644                  * Loop until we successfully set the suspend bit in
6645                  * the TTE.
6646                  */
6647 again:
6648                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6649                 ASSERT(TTE_IS_VALID(&tte));
6650 
6651                 ttemod = tte;
6652                 TTE_SET_SUSPEND(&ttemod);
6653                 if (sfmmu_modifytte_try(&tte, &ttemod,
6654                     &sfhmep->hme_tte) < 0)
6655                         goto again;
6656 
6657                 /*
6658                  * Invalidate TSB entry
6659                  */
6660                 hmeblkp = sfmmu_hmetohblk(sfhmep);
6661 
6662                 sfmmup = hblktosfmmu(hmeblkp);
6663                 ASSERT(sfmmup == ksfmmup);
6664                 ASSERT(!hmeblkp->hblk_shared);
6665 
6666                 addr = tte_to_vaddr(hmeblkp, tte);
6667 
6668                 /*
6669                  * No need to make sure that the TSB for this sfmmu is
6670                  * not being relocated since it is ksfmmup and thus it
6671                  * will never be relocated.
6672                  */
6673                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6674 
6675                 /*
6676                  * Update xcall stats
6677                  */
6678                 cpuset = cpu_ready_set;
6679                 CPUSET_DEL(cpuset, CPU->cpu_id);
6680 
6681                 /* LINTED: constant in conditional context */
6682                 SFMMU_XCALL_STATS(ksfmmup);
6683 
6684                 /*
6685                  * Flush TLB entry on remote CPU's
6686                  */
6687                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6688                     (uint64_t)ksfmmup);
6689                 xt_sync(cpuset);
6690 
6691                 /*
6692                  * Flush TLB entry on local CPU
6693                  */
6694                 vtag_flushpage(addr, (uint64_t)ksfmmup);
6695         }
6696 
6697         while (index != 0) {
6698                 index = index >> 1;
6699                 if (index != 0)
6700                         cons++;
6701                 if (index & 0x1) {
6702                         pp = PP_GROUPLEADER(pp, cons);
6703                         goto retry;
6704                 }
6705         }
6706 }
6707 
6708 #ifdef  DEBUG
6709 
6710 #define N_PRLE  1024
6711 struct prle {
6712         page_t *targ;
6713         page_t *repl;
6714         int status;
6715         int pausecpus;
6716         hrtime_t whence;
6717 };
6718 
6719 static struct prle page_relocate_log[N_PRLE];
6720 static int prl_entry;
6721 static kmutex_t prl_mutex;
6722 
6723 #define PAGE_RELOCATE_LOG(t, r, s, p)                                   \
6724         mutex_enter(&prl_mutex);                                    \
6725         page_relocate_log[prl_entry].targ = *(t);                       \
6726         page_relocate_log[prl_entry].repl = *(r);                       \
6727         page_relocate_log[prl_entry].status = (s);                      \
6728         page_relocate_log[prl_entry].pausecpus = (p);                   \
6729         page_relocate_log[prl_entry].whence = gethrtime();              \
6730         prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1;     \
6731         mutex_exit(&prl_mutex);
6732 
6733 #else   /* !DEBUG */
6734 #define PAGE_RELOCATE_LOG(t, r, s, p)
6735 #endif
6736 
6737 /*
6738  * Core Kernel Page Relocation Algorithm
6739  *
6740  * Input:
6741  *
6742  * target :     constituent pages are SE_EXCL locked.
6743  * replacement: constituent pages are SE_EXCL locked.
6744  *
6745  * Output:
6746  *
6747  * nrelocp:     number of pages relocated
6748  */
6749 int
6750 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6751 {
6752         page_t          *targ, *repl;
6753         page_t          *tpp, *rpp;
6754         kmutex_t        *low, *high;
6755         spgcnt_t        npages, i;
6756         page_t          *pl = NULL;
6757         int             old_pil;
6758         cpuset_t        cpuset;
6759         int             cap_cpus;
6760         int             ret;
6761 #ifdef VAC
6762         int             cflags = 0;
6763 #endif
6764 
6765         if (!kcage_on || PP_ISNORELOC(*target)) {
6766                 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6767                 return (EAGAIN);
6768         }
6769 
6770         mutex_enter(&kpr_mutex);
6771         kreloc_thread = curthread;
6772 
6773         targ = *target;
6774         repl = *replacement;
6775         ASSERT(repl != NULL);
6776         ASSERT(targ->p_szc == repl->p_szc);
6777 
6778         npages = page_get_pagecnt(targ->p_szc);
6779 
6780         /*
6781          * unload VA<->PA mappings that are not locked
6782          */
6783         tpp = targ;
6784         for (i = 0; i < npages; i++) {
6785                 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6786                 tpp++;
6787         }
6788 
6789         /*
6790          * Do "presuspend" callbacks, in a context from which we can still
6791          * block as needed. Note that we don't hold the mapping list lock
6792          * of "targ" at this point due to potential locking order issues;
6793          * we assume that between the hat_pageunload() above and holding
6794          * the SE_EXCL lock that the mapping list *cannot* change at this
6795          * point.
6796          */
6797         ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6798         if (ret != 0) {
6799                 /*
6800                  * EIO translates to fatal error, for all others cleanup
6801                  * and return EAGAIN.
6802                  */
6803                 ASSERT(ret != EIO);
6804                 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6805                 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6806                 kreloc_thread = NULL;
6807                 mutex_exit(&kpr_mutex);
6808                 return (EAGAIN);
6809         }
6810 
6811         /*
6812          * acquire p_mapping list lock for both the target and replacement
6813          * root pages.
6814          *
6815          * low and high refer to the need to grab the mlist locks in a
6816          * specific order in order to prevent race conditions.  Thus the
6817          * lower lock must be grabbed before the higher lock.
6818          *
6819          * This will block hat_unload's accessing p_mapping list.  Since
6820          * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6821          * blocked.  Thus, no one else will be accessing the p_mapping list
6822          * while we suspend and reload the locked mapping below.
6823          */
6824         tpp = targ;
6825         rpp = repl;
6826         sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6827 
6828         kpreempt_disable();
6829 
6830         /*
6831          * We raise our PIL to 13 so that we don't get captured by
6832          * another CPU or pinned by an interrupt thread.  We can't go to
6833          * PIL 14 since the nexus driver(s) may need to interrupt at
6834          * that level in the case of IOMMU pseudo mappings.
6835          */
6836         cpuset = cpu_ready_set;
6837         CPUSET_DEL(cpuset, CPU->cpu_id);
6838         if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6839                 old_pil = splr(XCALL_PIL);
6840         } else {
6841                 old_pil = -1;
6842                 xc_attention(cpuset);
6843         }
6844         ASSERT(getpil() == XCALL_PIL);
6845 
6846         /*
6847          * Now do suspend callbacks. In the case of an IOMMU mapping
6848          * this will suspend all DMA activity to the page while it is
6849          * being relocated. Since we are well above LOCK_LEVEL and CPUs
6850          * may be captured at this point we should have acquired any needed
6851          * locks in the presuspend callback.
6852          */
6853         ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6854         if (ret != 0) {
6855                 repl = targ;
6856                 goto suspend_fail;
6857         }
6858 
6859         /*
6860          * Raise the PIL yet again, this time to block all high-level
6861          * interrupts on this CPU. This is necessary to prevent an
6862          * interrupt routine from pinning the thread which holds the
6863          * mapping suspended and then touching the suspended page.
6864          *
6865          * Once the page is suspended we also need to be careful to
6866          * avoid calling any functions which touch any seg_kmem memory
6867          * since that memory may be backed by the very page we are
6868          * relocating in here!
6869          */
6870         hat_pagesuspend(targ);
6871 
6872         /*
6873          * Now that we are confident everybody has stopped using this page,
6874          * copy the page contents.  Note we use a physical copy to prevent
6875          * locking issues and to avoid fpRAS because we can't handle it in
6876          * this context.
6877          */
6878         for (i = 0; i < npages; i++, tpp++, rpp++) {
6879 #ifdef VAC
6880                 /*
6881                  * If the replacement has a different vcolor than
6882                  * the one being replacd, we need to handle VAC
6883                  * consistency for it just as we were setting up
6884                  * a new mapping to it.
6885                  */
6886                 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6887                     (tpp->p_vcolor != rpp->p_vcolor) &&
6888                     !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6889                         CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6890                         sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6891                             rpp->p_pagenum);
6892                 }
6893 #endif
6894                 /*
6895                  * Copy the contents of the page.
6896                  */
6897                 ppcopy_kernel(tpp, rpp);
6898         }
6899 
6900         tpp = targ;
6901         rpp = repl;
6902         for (i = 0; i < npages; i++, tpp++, rpp++) {
6903                 /*
6904                  * Copy attributes.  VAC consistency was handled above,
6905                  * if required.
6906                  */
6907                 rpp->p_nrm = tpp->p_nrm;
6908                 tpp->p_nrm = 0;
6909                 rpp->p_index = tpp->p_index;
6910                 tpp->p_index = 0;
6911 #ifdef VAC
6912                 rpp->p_vcolor = tpp->p_vcolor;
6913 #endif
6914         }
6915 
6916         /*
6917          * First, unsuspend the page, if we set the suspend bit, and transfer
6918          * the mapping list from the target page to the replacement page.
6919          * Next process postcallbacks; since pa_hment's are linked only to the
6920          * p_mapping list of root page, we don't iterate over the constituent
6921          * pages.
6922          */
6923         hat_pagereload(targ, repl);
6924 
6925 suspend_fail:
6926         hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
6927 
6928         /*
6929          * Now lower our PIL and release any captured CPUs since we
6930          * are out of the "danger zone".  After this it will again be
6931          * safe to acquire adaptive mutex locks, or to drop them...
6932          */
6933         if (old_pil != -1) {
6934                 splx(old_pil);
6935         } else {
6936                 xc_dismissed(cpuset);
6937         }
6938 
6939         kpreempt_enable();
6940 
6941         sfmmu_mlist_reloc_exit(low, high);
6942 
6943         /*
6944          * Postsuspend callbacks should drop any locks held across
6945          * the suspend callbacks.  As before, we don't hold the mapping
6946          * list lock at this point.. our assumption is that the mapping
6947          * list still can't change due to our holding SE_EXCL lock and
6948          * there being no unlocked mappings left. Hence the restriction
6949          * on calling context to hat_delete_callback()
6950          */
6951         hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
6952         if (ret != 0) {
6953                 /*
6954                  * The second presuspend call failed: we got here through
6955                  * the suspend_fail label above.
6956                  */
6957                 ASSERT(ret != EIO);
6958                 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
6959                 kreloc_thread = NULL;
6960                 mutex_exit(&kpr_mutex);
6961                 return (EAGAIN);
6962         }
6963 
6964         /*
6965          * Now that we're out of the performance critical section we can
6966          * take care of updating the hash table, since we still
6967          * hold all the pages locked SE_EXCL at this point we
6968          * needn't worry about things changing out from under us.
6969          */
6970         tpp = targ;
6971         rpp = repl;
6972         for (i = 0; i < npages; i++, tpp++, rpp++) {
6973 
6974                 /*
6975                  * replace targ with replacement in page_hash table
6976                  */
6977                 targ = tpp;
6978                 page_relocate_hash(rpp, targ);
6979 
6980                 /*
6981                  * concatenate target; caller of platform_page_relocate()
6982                  * expects target to be concatenated after returning.
6983                  */
6984                 ASSERT(targ->p_next == targ);
6985                 ASSERT(targ->p_prev == targ);
6986                 page_list_concat(&pl, &targ);
6987         }
6988 
6989         ASSERT(*target == pl);
6990         *nrelocp = npages;
6991         PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
6992         kreloc_thread = NULL;
6993         mutex_exit(&kpr_mutex);
6994         return (0);
6995 }
6996 
6997 /*
6998  * Called when stray pa_hments are found attached to a page which is
6999  * being freed.  Notify the subsystem which attached the pa_hment of
7000  * the error if it registered a suitable handler, else panic.
7001  */
7002 static void
7003 sfmmu_pahment_leaked(struct pa_hment *pahmep)
7004 {
7005         id_t cb_id = pahmep->cb_id;
7006 
7007         ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
7008         if (sfmmu_cb_table[cb_id].errhandler != NULL) {
7009                 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7010                     HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7011                         return;         /* non-fatal */
7012         }
7013         panic("pa_hment leaked: 0x%p", (void *)pahmep);
7014 }
7015 
7016 /*
7017  * Remove all mappings to page 'pp'.
7018  */
7019 int
7020 hat_pageunload(struct page *pp, uint_t forceflag)
7021 {
7022         struct page *origpp = pp;
7023         struct sf_hment *sfhme, *tmphme;
7024         struct hme_blk *hmeblkp;
7025         kmutex_t *pml;
7026 #ifdef VAC
7027         kmutex_t *pmtx;
7028 #endif
7029         cpuset_t cpuset, tset;
7030         int index, cons;
7031         int pa_hments;
7032 
7033         ASSERT(PAGE_EXCL(pp));
7034 
7035         tmphme = NULL;
7036         pa_hments = 0;
7037         CPUSET_ZERO(cpuset);
7038 
7039         pml = sfmmu_mlist_enter(pp);
7040 
7041 #ifdef VAC
7042         if (pp->p_kpmref)
7043                 sfmmu_kpm_pageunload(pp);
7044         ASSERT(!PP_ISMAPPED_KPM(pp));
7045 #endif
7046         /*
7047          * Clear vpm reference. Since the page is exclusively locked
7048          * vpm cannot be referencing it.
7049          */
7050         if (vpm_enable) {
7051                 pp->p_vpmref = 0;
7052         }
7053 
7054         index = PP_MAPINDEX(pp);
7055         cons = TTE8K;
7056 retry:
7057         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7058                 tmphme = sfhme->hme_next;
7059 
7060                 if (IS_PAHME(sfhme)) {
7061                         ASSERT(sfhme->hme_data != NULL);
7062                         pa_hments++;
7063                         continue;
7064                 }
7065 
7066                 hmeblkp = sfmmu_hmetohblk(sfhme);
7067 
7068                 /*
7069                  * If there are kernel mappings don't unload them, they will
7070                  * be suspended.
7071                  */
7072                 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7073                     hmeblkp->hblk_tag.htag_id == ksfmmup)
7074                         continue;
7075 
7076                 tset = sfmmu_pageunload(pp, sfhme, cons);
7077                 CPUSET_OR(cpuset, tset);
7078         }
7079 
7080         while (index != 0) {
7081                 index = index >> 1;
7082                 if (index != 0)
7083                         cons++;
7084                 if (index & 0x1) {
7085                         /* Go to leading page */
7086                         pp = PP_GROUPLEADER(pp, cons);
7087                         ASSERT(sfmmu_mlist_held(pp));
7088                         goto retry;
7089                 }
7090         }
7091 
7092         /*
7093          * cpuset may be empty if the page was only mapped by segkpm,
7094          * in which case we won't actually cross-trap.
7095          */
7096         xt_sync(cpuset);
7097 
7098         /*
7099          * The page should have no mappings at this point, unless
7100          * we were called from hat_page_relocate() in which case we
7101          * leave the locked mappings which will be suspended later.
7102          */
7103         ASSERT(!PP_ISMAPPED(origpp) || pa_hments ||
7104             (forceflag == SFMMU_KERNEL_RELOC));
7105 
7106 #ifdef VAC
7107         if (PP_ISTNC(pp)) {
7108                 if (cons == TTE8K) {
7109                         pmtx = sfmmu_page_enter(pp);
7110                         PP_CLRTNC(pp);
7111                         sfmmu_page_exit(pmtx);
7112                 } else {
7113                         conv_tnc(pp, cons);
7114                 }
7115         }
7116 #endif  /* VAC */
7117 
7118         if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7119                 /*
7120                  * Unlink any pa_hments and free them, calling back
7121                  * the responsible subsystem to notify it of the error.
7122                  * This can occur in situations such as drivers leaking
7123                  * DMA handles: naughty, but common enough that we'd like
7124                  * to keep the system running rather than bringing it
7125                  * down with an obscure error like "pa_hment leaked"
7126                  * which doesn't aid the user in debugging their driver.
7127                  */
7128                 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7129                         tmphme = sfhme->hme_next;
7130                         if (IS_PAHME(sfhme)) {
7131                                 struct pa_hment *pahmep = sfhme->hme_data;
7132                                 sfmmu_pahment_leaked(pahmep);
7133                                 HME_SUB(sfhme, pp);
7134                                 kmem_cache_free(pa_hment_cache, pahmep);
7135                         }
7136                 }
7137 
7138                 ASSERT(!PP_ISMAPPED(origpp));
7139         }
7140 
7141         sfmmu_mlist_exit(pml);
7142 
7143         return (0);
7144 }
7145 
7146 cpuset_t
7147 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7148 {
7149         struct hme_blk *hmeblkp;
7150         sfmmu_t *sfmmup;
7151         tte_t tte, ttemod;
7152 #ifdef DEBUG
7153         tte_t orig_old;
7154 #endif /* DEBUG */
7155         caddr_t addr;
7156         int ttesz;
7157         int ret;
7158         cpuset_t cpuset;
7159 
7160         ASSERT(pp != NULL);
7161         ASSERT(sfmmu_mlist_held(pp));
7162         ASSERT(!PP_ISKAS(pp));
7163 
7164         CPUSET_ZERO(cpuset);
7165 
7166         hmeblkp = sfmmu_hmetohblk(sfhme);
7167 
7168 readtte:
7169         sfmmu_copytte(&sfhme->hme_tte, &tte);
7170         if (TTE_IS_VALID(&tte)) {
7171                 sfmmup = hblktosfmmu(hmeblkp);
7172                 ttesz = get_hblk_ttesz(hmeblkp);
7173                 /*
7174                  * Only unload mappings of 'cons' size.
7175                  */
7176                 if (ttesz != cons)
7177                         return (cpuset);
7178 
7179                 /*
7180                  * Note that we have p_mapping lock, but no hash lock here.
7181                  * hblk_unload() has to have both hash lock AND p_mapping
7182                  * lock before it tries to modify tte. So, the tte could
7183                  * not become invalid in the sfmmu_modifytte_try() below.
7184                  */
7185                 ttemod = tte;
7186 #ifdef DEBUG
7187                 orig_old = tte;
7188 #endif /* DEBUG */
7189 
7190                 TTE_SET_INVALID(&ttemod);
7191                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7192                 if (ret < 0) {
7193 #ifdef DEBUG
7194                         /* only R/M bits can change. */
7195                         chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7196 #endif /* DEBUG */
7197                         goto readtte;
7198                 }
7199 
7200                 if (ret == 0) {
7201                         panic("pageunload: cas failed?");
7202                 }
7203 
7204                 addr = tte_to_vaddr(hmeblkp, tte);
7205 
7206                 if (hmeblkp->hblk_shared) {
7207                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7208                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
7209                         sf_region_t *rgnp;
7210                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7211                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7212                         ASSERT(srdp != NULL);
7213                         rgnp = srdp->srd_hmergnp[rid];
7214                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7215                         cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7216                         sfmmu_ttesync(NULL, addr, &tte, pp);
7217                         ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7218                         atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7219                 } else {
7220                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
7221                         atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7222 
7223                         /*
7224                          * We need to flush the page from the virtual cache
7225                          * in order to prevent a virtual cache alias
7226                          * inconsistency. The particular scenario we need
7227                          * to worry about is:
7228                          * Given:  va1 and va2 are two virtual address that
7229                          * alias and will map the same physical address.
7230                          * 1.   mapping exists from va1 to pa and data has
7231                          *      been read into the cache.
7232                          * 2.   unload va1.
7233                          * 3.   load va2 and modify data using va2.
7234                          * 4    unload va2.
7235                          * 5.   load va1 and reference data.  Unless we flush
7236                          *      the data cache when we unload we will get
7237                          *      stale data.
7238                          * This scenario is taken care of by using virtual
7239                          * page coloring.
7240                          */
7241                         if (sfmmup->sfmmu_ismhat) {
7242                                 /*
7243                                  * Flush TSBs, TLBs and caches
7244                                  * of every process
7245                                  * sharing this ism segment.
7246                                  */
7247                                 sfmmu_hat_lock_all();
7248                                 mutex_enter(&ism_mlist_lock);
7249                                 kpreempt_disable();
7250                                 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7251                                     pp->p_pagenum, CACHE_NO_FLUSH);
7252                                 kpreempt_enable();
7253                                 mutex_exit(&ism_mlist_lock);
7254                                 sfmmu_hat_unlock_all();
7255                                 cpuset = cpu_ready_set;
7256                         } else {
7257                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7258                                 cpuset = sfmmup->sfmmu_cpusran;
7259                         }
7260                 }
7261 
7262                 /*
7263                  * Hme_sub has to run after ttesync() and a_rss update.
7264                  * See hblk_unload().
7265                  */
7266                 HME_SUB(sfhme, pp);
7267                 membar_stst();
7268 
7269                 /*
7270                  * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7271                  * since pteload may have done a HME_ADD() right after
7272                  * we did the HME_SUB() above. Hmecnt is now maintained
7273                  * by cas only. no lock guranteed its value. The only
7274                  * gurantee we have is the hmecnt should not be less than
7275                  * what it should be so the hblk will not be taken away.
7276                  * It's also important that we decremented the hmecnt after
7277                  * we are done with hmeblkp so that this hmeblk won't be
7278                  * stolen.
7279                  */
7280                 ASSERT(hmeblkp->hblk_hmecnt > 0);
7281                 ASSERT(hmeblkp->hblk_vcnt > 0);
7282                 atomic_dec_16(&hmeblkp->hblk_vcnt);
7283                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7284                 /*
7285                  * This is bug 4063182.
7286                  * XXX: fixme
7287                  * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7288                  *      !hmeblkp->hblk_lckcnt);
7289                  */
7290         } else {
7291                 panic("invalid tte? pp %p &tte %p",
7292                     (void *)pp, (void *)&tte);
7293         }
7294 
7295         return (cpuset);
7296 }
7297 
7298 /*
7299  * While relocating a kernel page, this function will move the mappings
7300  * from tpp to dpp and modify any associated data with these mappings.
7301  * It also unsuspends the suspended kernel mapping.
7302  */
7303 static void
7304 hat_pagereload(struct page *tpp, struct page *dpp)
7305 {
7306         struct sf_hment *sfhme;
7307         tte_t tte, ttemod;
7308         int index, cons;
7309 
7310         ASSERT(getpil() == PIL_MAX);
7311         ASSERT(sfmmu_mlist_held(tpp));
7312         ASSERT(sfmmu_mlist_held(dpp));
7313 
7314         index = PP_MAPINDEX(tpp);
7315         cons = TTE8K;
7316 
7317         /* Update real mappings to the page */
7318 retry:
7319         for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7320                 if (IS_PAHME(sfhme))
7321                         continue;
7322                 sfmmu_copytte(&sfhme->hme_tte, &tte);
7323                 ttemod = tte;
7324 
7325                 /*
7326                  * replace old pfn with new pfn in TTE
7327                  */
7328                 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7329 
7330                 /*
7331                  * clear suspend bit
7332                  */
7333                 ASSERT(TTE_IS_SUSPEND(&ttemod));
7334                 TTE_CLR_SUSPEND(&ttemod);
7335 
7336                 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7337                         panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7338 
7339                 /*
7340                  * set hme_page point to new page
7341                  */
7342                 sfhme->hme_page = dpp;
7343         }
7344 
7345         /*
7346          * move p_mapping list from old page to new page
7347          */
7348         dpp->p_mapping = tpp->p_mapping;
7349         tpp->p_mapping = NULL;
7350         dpp->p_share = tpp->p_share;
7351         tpp->p_share = 0;
7352 
7353         while (index != 0) {
7354                 index = index >> 1;
7355                 if (index != 0)
7356                         cons++;
7357                 if (index & 0x1) {
7358                         tpp = PP_GROUPLEADER(tpp, cons);
7359                         dpp = PP_GROUPLEADER(dpp, cons);
7360                         goto retry;
7361                 }
7362         }
7363 
7364         curthread->t_flag &= ~T_DONTDTRACE;
7365         mutex_exit(&kpr_suspendlock);
7366 }
7367 
7368 uint_t
7369 hat_pagesync(struct page *pp, uint_t clearflag)
7370 {
7371         struct sf_hment *sfhme, *tmphme = NULL;
7372         struct hme_blk *hmeblkp;
7373         kmutex_t *pml;
7374         cpuset_t cpuset, tset;
7375         int     index, cons;
7376         extern  ulong_t po_share;
7377         page_t  *save_pp = pp;
7378         int     stop_on_sh = 0;
7379         uint_t  shcnt;
7380 
7381         CPUSET_ZERO(cpuset);
7382 
7383         if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7384                 return (PP_GENERIC_ATTR(pp));
7385         }
7386 
7387         if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7388                 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7389                         return (PP_GENERIC_ATTR(pp));
7390                 }
7391                 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7392                         return (PP_GENERIC_ATTR(pp));
7393                 }
7394                 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7395                         if (pp->p_share > po_share) {
7396                                 hat_page_setattr(pp, P_REF);
7397                                 return (PP_GENERIC_ATTR(pp));
7398                         }
7399                         stop_on_sh = 1;
7400                         shcnt = 0;
7401                 }
7402         }
7403 
7404         clearflag &= ~HAT_SYNC_STOPON_SHARED;
7405         pml = sfmmu_mlist_enter(pp);
7406         index = PP_MAPINDEX(pp);
7407         cons = TTE8K;
7408 retry:
7409         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7410                 /*
7411                  * We need to save the next hment on the list since
7412                  * it is possible for pagesync to remove an invalid hment
7413                  * from the list.
7414                  */
7415                 tmphme = sfhme->hme_next;
7416                 if (IS_PAHME(sfhme))
7417                         continue;
7418                 /*
7419                  * If we are looking for large mappings and this hme doesn't
7420                  * reach the range we are seeking, just ignore it.
7421                  */
7422                 hmeblkp = sfmmu_hmetohblk(sfhme);
7423 
7424                 if (hme_size(sfhme) < cons)
7425                         continue;
7426 
7427                 if (stop_on_sh) {
7428                         if (hmeblkp->hblk_shared) {
7429                                 sf_srd_t *srdp = hblktosrd(hmeblkp);
7430                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7431                                 sf_region_t *rgnp;
7432                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7433                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7434                                 ASSERT(srdp != NULL);
7435                                 rgnp = srdp->srd_hmergnp[rid];
7436                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7437                                     rgnp, rid);
7438                                 shcnt += rgnp->rgn_refcnt;
7439                         } else {
7440                                 shcnt++;
7441                         }
7442                         if (shcnt > po_share) {
7443                                 /*
7444                                  * tell the pager to spare the page this time
7445                                  * around.
7446                                  */
7447                                 hat_page_setattr(save_pp, P_REF);
7448                                 index = 0;
7449                                 break;
7450                         }
7451                 }
7452                 tset = sfmmu_pagesync(pp, sfhme,
7453                     clearflag & ~HAT_SYNC_STOPON_RM);
7454                 CPUSET_OR(cpuset, tset);
7455 
7456                 /*
7457                  * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7458                  * as the "ref" or "mod" is set or share cnt exceeds po_share.
7459                  */
7460                 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7461                     (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7462                     ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7463                         index = 0;
7464                         break;
7465                 }
7466         }
7467 
7468         while (index) {
7469                 index = index >> 1;
7470                 cons++;
7471                 if (index & 0x1) {
7472                         /* Go to leading page */
7473                         pp = PP_GROUPLEADER(pp, cons);
7474                         goto retry;
7475                 }
7476         }
7477 
7478         xt_sync(cpuset);
7479         sfmmu_mlist_exit(pml);
7480         return (PP_GENERIC_ATTR(save_pp));
7481 }
7482 
7483 /*
7484  * Get all the hardware dependent attributes for a page struct
7485  */
7486 static cpuset_t
7487 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7488         uint_t clearflag)
7489 {
7490         caddr_t addr;
7491         tte_t tte, ttemod;
7492         struct hme_blk *hmeblkp;
7493         int ret;
7494         sfmmu_t *sfmmup;
7495         cpuset_t cpuset;
7496 
7497         ASSERT(pp != NULL);
7498         ASSERT(sfmmu_mlist_held(pp));
7499         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7500             (clearflag == HAT_SYNC_ZERORM));
7501 
7502         SFMMU_STAT(sf_pagesync);
7503 
7504         CPUSET_ZERO(cpuset);
7505 
7506 sfmmu_pagesync_retry:
7507 
7508         sfmmu_copytte(&sfhme->hme_tte, &tte);
7509         if (TTE_IS_VALID(&tte)) {
7510                 hmeblkp = sfmmu_hmetohblk(sfhme);
7511                 sfmmup = hblktosfmmu(hmeblkp);
7512                 addr = tte_to_vaddr(hmeblkp, tte);
7513                 if (clearflag == HAT_SYNC_ZERORM) {
7514                         ttemod = tte;
7515                         TTE_CLR_RM(&ttemod);
7516                         ret = sfmmu_modifytte_try(&tte, &ttemod,
7517                             &sfhme->hme_tte);
7518                         if (ret < 0) {
7519                                 /*
7520                                  * cas failed and the new value is not what
7521                                  * we want.
7522                                  */
7523                                 goto sfmmu_pagesync_retry;
7524                         }
7525 
7526                         if (ret > 0) {
7527                                 /* we win the cas */
7528                                 if (hmeblkp->hblk_shared) {
7529                                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7530                                         uint_t rid =
7531                                             hmeblkp->hblk_tag.htag_rid;
7532                                         sf_region_t *rgnp;
7533                                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7534                                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7535                                         ASSERT(srdp != NULL);
7536                                         rgnp = srdp->srd_hmergnp[rid];
7537                                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7538                                             srdp, rgnp, rid);
7539                                         cpuset = sfmmu_rgntlb_demap(addr,
7540                                             rgnp, hmeblkp, 1);
7541                                 } else {
7542                                         sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7543                                             0, 0);
7544                                         cpuset = sfmmup->sfmmu_cpusran;
7545                                 }
7546                         }
7547                 }
7548                 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7549                     &tte, pp);
7550         }
7551         return (cpuset);
7552 }
7553 
7554 /*
7555  * Remove write permission from a mappings to a page, so that
7556  * we can detect the next modification of it. This requires modifying
7557  * the TTE then invalidating (demap) any TLB entry using that TTE.
7558  * This code is similar to sfmmu_pagesync().
7559  */
7560 static cpuset_t
7561 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7562 {
7563         caddr_t addr;
7564         tte_t tte;
7565         tte_t ttemod;
7566         struct hme_blk *hmeblkp;
7567         int ret;
7568         sfmmu_t *sfmmup;
7569         cpuset_t cpuset;
7570 
7571         ASSERT(pp != NULL);
7572         ASSERT(sfmmu_mlist_held(pp));
7573 
7574         CPUSET_ZERO(cpuset);
7575         SFMMU_STAT(sf_clrwrt);
7576 
7577 retry:
7578 
7579         sfmmu_copytte(&sfhme->hme_tte, &tte);
7580         if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7581                 hmeblkp = sfmmu_hmetohblk(sfhme);
7582                 sfmmup = hblktosfmmu(hmeblkp);
7583                 addr = tte_to_vaddr(hmeblkp, tte);
7584 
7585                 ttemod = tte;
7586                 TTE_CLR_WRT(&ttemod);
7587                 TTE_CLR_MOD(&ttemod);
7588                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7589 
7590                 /*
7591                  * if cas failed and the new value is not what
7592                  * we want retry
7593                  */
7594                 if (ret < 0)
7595                         goto retry;
7596 
7597                 /* we win the cas */
7598                 if (ret > 0) {
7599                         if (hmeblkp->hblk_shared) {
7600                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7601                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7602                                 sf_region_t *rgnp;
7603                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7604                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7605                                 ASSERT(srdp != NULL);
7606                                 rgnp = srdp->srd_hmergnp[rid];
7607                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7608                                     srdp, rgnp, rid);
7609                                 cpuset = sfmmu_rgntlb_demap(addr,
7610                                     rgnp, hmeblkp, 1);
7611                         } else {
7612                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7613                                 cpuset = sfmmup->sfmmu_cpusran;
7614                         }
7615                 }
7616         }
7617 
7618         return (cpuset);
7619 }
7620 
7621 /*
7622  * Walk all mappings of a page, removing write permission and clearing the
7623  * ref/mod bits. This code is similar to hat_pagesync()
7624  */
7625 static void
7626 hat_page_clrwrt(page_t *pp)
7627 {
7628         struct sf_hment *sfhme;
7629         struct sf_hment *tmphme = NULL;
7630         kmutex_t *pml;
7631         cpuset_t cpuset;
7632         cpuset_t tset;
7633         int     index;
7634         int      cons;
7635 
7636         CPUSET_ZERO(cpuset);
7637 
7638         pml = sfmmu_mlist_enter(pp);
7639         index = PP_MAPINDEX(pp);
7640         cons = TTE8K;
7641 retry:
7642         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7643                 tmphme = sfhme->hme_next;
7644 
7645                 /*
7646                  * If we are looking for large mappings and this hme doesn't
7647                  * reach the range we are seeking, just ignore its.
7648                  */
7649 
7650                 if (hme_size(sfhme) < cons)
7651                         continue;
7652 
7653                 tset = sfmmu_pageclrwrt(pp, sfhme);
7654                 CPUSET_OR(cpuset, tset);
7655         }
7656 
7657         while (index) {
7658                 index = index >> 1;
7659                 cons++;
7660                 if (index & 0x1) {
7661                         /* Go to leading page */
7662                         pp = PP_GROUPLEADER(pp, cons);
7663                         goto retry;
7664                 }
7665         }
7666 
7667         xt_sync(cpuset);
7668         sfmmu_mlist_exit(pml);
7669 }
7670 
7671 /*
7672  * Set the given REF/MOD/RO bits for the given page.
7673  * For a vnode with a sorted v_pages list, we need to change
7674  * the attributes and the v_pages list together under page_vnode_mutex.
7675  */
7676 void
7677 hat_page_setattr(page_t *pp, uint_t flag)
7678 {
7679         vnode_t         *vp = pp->p_vnode;
7680         page_t          **listp;
7681         kmutex_t        *pmtx;
7682         kmutex_t        *vphm = NULL;
7683         int             noshuffle;
7684 
7685         noshuffle = flag & P_NSH;
7686         flag &= ~P_NSH;
7687 
7688         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7689 
7690         /*
7691          * nothing to do if attribute already set
7692          */
7693         if ((pp->p_nrm & flag) == flag)
7694                 return;
7695 
7696         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7697             !noshuffle) {
7698                 vphm = page_vnode_mutex(vp);
7699                 mutex_enter(vphm);
7700         }
7701 
7702         pmtx = sfmmu_page_enter(pp);
7703         pp->p_nrm |= flag;
7704         sfmmu_page_exit(pmtx);
7705 
7706         if (vphm != NULL) {
7707                 /*
7708                  * Some File Systems examine v_pages for NULL w/o
7709                  * grabbing the vphm mutex. Must not let it become NULL when
7710                  * pp is the only page on the list.
7711                  */
7712                 if (pp->p_vpnext != pp) {
7713                         page_vpsub(&vp->v_pages, pp);
7714                         if (vp->v_pages != NULL)
7715                                 listp = &vp->v_pages->p_vpprev->p_vpnext;
7716                         else
7717                                 listp = &vp->v_pages;
7718                         page_vpadd(listp, pp);
7719                 }
7720                 mutex_exit(vphm);
7721         }
7722 }
7723 
7724 void
7725 hat_page_clrattr(page_t *pp, uint_t flag)
7726 {
7727         vnode_t         *vp = pp->p_vnode;
7728         kmutex_t        *pmtx;
7729 
7730         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7731 
7732         pmtx = sfmmu_page_enter(pp);
7733 
7734         /*
7735          * Caller is expected to hold page's io lock for VMODSORT to work
7736          * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7737          * bit is cleared.
7738          * We don't have assert to avoid tripping some existing third party
7739          * code. The dirty page is moved back to top of the v_page list
7740          * after IO is done in pvn_write_done().
7741          */
7742         pp->p_nrm &= ~flag;
7743         sfmmu_page_exit(pmtx);
7744 
7745         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7746 
7747                 /*
7748                  * VMODSORT works by removing write permissions and getting
7749                  * a fault when a page is made dirty. At this point
7750                  * we need to remove write permission from all mappings
7751                  * to this page.
7752                  */
7753                 hat_page_clrwrt(pp);
7754         }
7755 }
7756 
7757 uint_t
7758 hat_page_getattr(page_t *pp, uint_t flag)
7759 {
7760         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7761         return ((uint_t)(pp->p_nrm & flag));
7762 }
7763 
7764 /*
7765  * DEBUG kernels: verify that a kernel va<->pa translation
7766  * is safe by checking the underlying page_t is in a page
7767  * relocation-safe state.
7768  */
7769 #ifdef  DEBUG
7770 void
7771 sfmmu_check_kpfn(pfn_t pfn)
7772 {
7773         page_t *pp;
7774         int index, cons;
7775 
7776         if (hat_check_vtop == 0)
7777                 return;
7778 
7779         if (kvseg.s_base == NULL || panicstr)
7780                 return;
7781 
7782         pp = page_numtopp_nolock(pfn);
7783         if (!pp)
7784                 return;
7785 
7786         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7787                 return;
7788 
7789         /*
7790          * Handed a large kernel page, we dig up the root page since we
7791          * know the root page might have the lock also.
7792          */
7793         if (pp->p_szc != 0) {
7794                 index = PP_MAPINDEX(pp);
7795                 cons = TTE8K;
7796 again:
7797                 while (index != 0) {
7798                         index >>= 1;
7799                         if (index != 0)
7800                                 cons++;
7801                         if (index & 0x1) {
7802                                 pp = PP_GROUPLEADER(pp, cons);
7803                                 goto again;
7804                         }
7805                 }
7806         }
7807 
7808         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7809                 return;
7810 
7811         /*
7812          * Pages need to be locked or allocated "permanent" (either from
7813          * static_arena arena or explicitly setting PG_NORELOC when calling
7814          * page_create_va()) for VA->PA translations to be valid.
7815          */
7816         if (!PP_ISNORELOC(pp))
7817                 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7818                     (void *)pp);
7819         else
7820                 panic("Illegal VA->PA translation, pp 0x%p not locked",
7821                     (void *)pp);
7822 }
7823 #endif  /* DEBUG */
7824 
7825 /*
7826  * Returns a page frame number for a given virtual address.
7827  * Returns PFN_INVALID to indicate an invalid mapping
7828  */
7829 pfn_t
7830 hat_getpfnum(struct hat *hat, caddr_t addr)
7831 {
7832         pfn_t pfn;
7833         tte_t tte;
7834 
7835         /*
7836          * We would like to
7837          * ASSERT(AS_LOCK_HELD(as));
7838          * but we can't because the iommu driver will call this
7839          * routine at interrupt time and it can't grab the as lock
7840          * or it will deadlock: A thread could have the as lock
7841          * and be waiting for io.  The io can't complete
7842          * because the interrupt thread is blocked trying to grab
7843          * the as lock.
7844          */
7845 
7846         if (hat == ksfmmup) {
7847                 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7848                         ASSERT(segkmem_lpszc > 0);
7849                         pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7850                         if (pfn != PFN_INVALID) {
7851                                 sfmmu_check_kpfn(pfn);
7852                                 return (pfn);
7853                         }
7854                 } else if (segkpm && IS_KPM_ADDR(addr)) {
7855                         return (sfmmu_kpm_vatopfn(addr));
7856                 }
7857                 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7858                     == PFN_SUSPENDED) {
7859                         sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7860                 }
7861                 sfmmu_check_kpfn(pfn);
7862                 return (pfn);
7863         } else {
7864                 return (sfmmu_uvatopfn(addr, hat, NULL));
7865         }
7866 }
7867 
7868 /*
7869  * This routine will return both pfn and tte for the vaddr.
7870  */
7871 static pfn_t
7872 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
7873 {
7874         struct hmehash_bucket *hmebp;
7875         hmeblk_tag hblktag;
7876         int hmeshift, hashno = 1;
7877         struct hme_blk *hmeblkp = NULL;
7878         tte_t tte;
7879 
7880         struct sf_hment *sfhmep;
7881         pfn_t pfn;
7882 
7883         /* support for ISM */
7884         ism_map_t       *ism_map;
7885         ism_blk_t       *ism_blkp;
7886         int             i;
7887         sfmmu_t *ism_hatid = NULL;
7888         sfmmu_t *locked_hatid = NULL;
7889         sfmmu_t *sv_sfmmup = sfmmup;
7890         caddr_t sv_vaddr = vaddr;
7891         sf_srd_t *srdp;
7892 
7893         if (ttep == NULL) {
7894                 ttep = &tte;
7895         } else {
7896                 ttep->ll = 0;
7897         }
7898 
7899         ASSERT(sfmmup != ksfmmup);
7900         SFMMU_STAT(sf_user_vtop);
7901         /*
7902          * Set ism_hatid if vaddr falls in a ISM segment.
7903          */
7904         ism_blkp = sfmmup->sfmmu_iblk;
7905         if (ism_blkp != NULL) {
7906                 sfmmu_ismhat_enter(sfmmup, 0);
7907                 locked_hatid = sfmmup;
7908         }
7909         while (ism_blkp != NULL && ism_hatid == NULL) {
7910                 ism_map = ism_blkp->iblk_maps;
7911                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
7912                         if (vaddr >= ism_start(ism_map[i]) &&
7913                             vaddr < ism_end(ism_map[i])) {
7914                                 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
7915                                 vaddr = (caddr_t)(vaddr -
7916                                     ism_start(ism_map[i]));
7917                                 break;
7918                         }
7919                 }
7920                 ism_blkp = ism_blkp->iblk_next;
7921         }
7922         if (locked_hatid) {
7923                 sfmmu_ismhat_exit(locked_hatid, 0);
7924         }
7925 
7926         hblktag.htag_id = sfmmup;
7927         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
7928         do {
7929                 hmeshift = HME_HASH_SHIFT(hashno);
7930                 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
7931                 hblktag.htag_rehash = hashno;
7932                 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
7933 
7934                 SFMMU_HASH_LOCK(hmebp);
7935 
7936                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
7937                 if (hmeblkp != NULL) {
7938                         ASSERT(!hmeblkp->hblk_shared);
7939                         HBLKTOHME(sfhmep, hmeblkp, vaddr);
7940                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7941                         SFMMU_HASH_UNLOCK(hmebp);
7942                         if (TTE_IS_VALID(ttep)) {
7943                                 pfn = TTE_TO_PFN(vaddr, ttep);
7944                                 return (pfn);
7945                         }
7946                         break;
7947                 }
7948                 SFMMU_HASH_UNLOCK(hmebp);
7949                 hashno++;
7950         } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
7951 
7952         if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
7953                 return (PFN_INVALID);
7954         }
7955         srdp = sv_sfmmup->sfmmu_srdp;
7956         ASSERT(srdp != NULL);
7957         ASSERT(srdp->srd_refcnt != 0);
7958         hblktag.htag_id = srdp;
7959         hashno = 1;
7960         do {
7961                 hmeshift = HME_HASH_SHIFT(hashno);
7962                 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
7963                 hblktag.htag_rehash = hashno;
7964                 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
7965 
7966                 SFMMU_HASH_LOCK(hmebp);
7967                 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
7968                     hmeblkp = hmeblkp->hblk_next) {
7969                         uint_t rid;
7970                         sf_region_t *rgnp;
7971                         caddr_t rsaddr;
7972                         caddr_t readdr;
7973 
7974                         if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
7975                             sv_sfmmup->sfmmu_hmeregion_map)) {
7976                                 continue;
7977                         }
7978                         ASSERT(hmeblkp->hblk_shared);
7979                         rid = hmeblkp->hblk_tag.htag_rid;
7980                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7981                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7982                         rgnp = srdp->srd_hmergnp[rid];
7983                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7984                         HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
7985                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7986                         rsaddr = rgnp->rgn_saddr;
7987                         readdr = rsaddr + rgnp->rgn_size;
7988 #ifdef DEBUG
7989                         if (TTE_IS_VALID(ttep) ||
7990                             get_hblk_ttesz(hmeblkp) > TTE8K) {
7991                                 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
7992                                 ASSERT(eva > sv_vaddr);
7993                                 ASSERT(sv_vaddr >= rsaddr);
7994                                 ASSERT(sv_vaddr < readdr);
7995                                 ASSERT(eva <= readdr);
7996                         }
7997 #endif /* DEBUG */
7998                         /*
7999                          * Continue the search if we
8000                          * found an invalid 8K tte outside of the area
8001                          * covered by this hmeblk's region.
8002                          */
8003                         if (TTE_IS_VALID(ttep)) {
8004                                 SFMMU_HASH_UNLOCK(hmebp);
8005                                 pfn = TTE_TO_PFN(sv_vaddr, ttep);
8006                                 return (pfn);
8007                         } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
8008                             (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
8009                                 SFMMU_HASH_UNLOCK(hmebp);
8010                                 pfn = PFN_INVALID;
8011                                 return (pfn);
8012                         }
8013                 }
8014                 SFMMU_HASH_UNLOCK(hmebp);
8015                 hashno++;
8016         } while (hashno <= mmu_hashcnt);
8017         return (PFN_INVALID);
8018 }
8019 
8020 
8021 /*
8022  * For compatability with AT&T and later optimizations
8023  */
8024 /* ARGSUSED */
8025 void
8026 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8027 {
8028         ASSERT(hat != NULL);
8029 }
8030 
8031 /*
8032  * Return the number of mappings to a particular page.  This number is an
8033  * approximation of the number of people sharing the page.
8034  *
8035  * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8036  * hat_page_checkshare() can be used to compare threshold to share
8037  * count that reflects the number of region sharers albeit at higher cost.
8038  */
8039 ulong_t
8040 hat_page_getshare(page_t *pp)
8041 {
8042         page_t *spp = pp;       /* start page */
8043         kmutex_t *pml;
8044         ulong_t cnt;
8045         int index, sz = TTE64K;
8046 
8047         /*
8048          * We need to grab the mlist lock to make sure any outstanding
8049          * load/unloads complete.  Otherwise we could return zero
8050          * even though the unload(s) hasn't finished yet.
8051          */
8052         pml = sfmmu_mlist_enter(spp);
8053         cnt = spp->p_share;
8054 
8055 #ifdef VAC
8056         if (kpm_enable)
8057                 cnt += spp->p_kpmref;
8058 #endif
8059         if (vpm_enable && pp->p_vpmref) {
8060                 cnt += 1;
8061         }
8062 
8063         /*
8064          * If we have any large mappings, we count the number of
8065          * mappings that this large page is part of.
8066          */
8067         index = PP_MAPINDEX(spp);
8068         index >>= 1;
8069         while (index) {
8070                 pp = PP_GROUPLEADER(spp, sz);
8071                 if ((index & 0x1) && pp != spp) {
8072                         cnt += pp->p_share;
8073                         spp = pp;
8074                 }
8075                 index >>= 1;
8076                 sz++;
8077         }
8078         sfmmu_mlist_exit(pml);
8079         return (cnt);
8080 }
8081 
8082 /*
8083  * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8084  * otherwise. Count shared hmeblks by region's refcnt.
8085  */
8086 int
8087 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8088 {
8089         kmutex_t *pml;
8090         ulong_t cnt = 0;
8091         int index, sz = TTE8K;
8092         struct sf_hment *sfhme, *tmphme = NULL;
8093         struct hme_blk *hmeblkp;
8094 
8095         pml = sfmmu_mlist_enter(pp);
8096 
8097 #ifdef VAC
8098         if (kpm_enable)
8099                 cnt = pp->p_kpmref;
8100 #endif
8101 
8102         if (vpm_enable && pp->p_vpmref) {
8103                 cnt += 1;
8104         }
8105 
8106         if (pp->p_share + cnt > sh_thresh) {
8107                 sfmmu_mlist_exit(pml);
8108                 return (1);
8109         }
8110 
8111         index = PP_MAPINDEX(pp);
8112 
8113 again:
8114         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8115                 tmphme = sfhme->hme_next;
8116                 if (IS_PAHME(sfhme)) {
8117                         continue;
8118                 }
8119 
8120                 hmeblkp = sfmmu_hmetohblk(sfhme);
8121                 if (hme_size(sfhme) != sz) {
8122                         continue;
8123                 }
8124 
8125                 if (hmeblkp->hblk_shared) {
8126                         sf_srd_t *srdp = hblktosrd(hmeblkp);
8127                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
8128                         sf_region_t *rgnp;
8129                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8130                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8131                         ASSERT(srdp != NULL);
8132                         rgnp = srdp->srd_hmergnp[rid];
8133                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8134                             rgnp, rid);
8135                         cnt += rgnp->rgn_refcnt;
8136                 } else {
8137                         cnt++;
8138                 }
8139                 if (cnt > sh_thresh) {
8140                         sfmmu_mlist_exit(pml);
8141                         return (1);
8142                 }
8143         }
8144 
8145         index >>= 1;
8146         sz++;
8147         while (index) {
8148                 pp = PP_GROUPLEADER(pp, sz);
8149                 ASSERT(sfmmu_mlist_held(pp));
8150                 if (index & 0x1) {
8151                         goto again;
8152                 }
8153                 index >>= 1;
8154                 sz++;
8155         }
8156         sfmmu_mlist_exit(pml);
8157         return (0);
8158 }
8159 
8160 /*
8161  * Unload all large mappings to the pp and reset the p_szc field of every
8162  * constituent page according to the remaining mappings.
8163  *
8164  * pp must be locked SE_EXCL. Even though no other constituent pages are
8165  * locked it's legal to unload the large mappings to the pp because all
8166  * constituent pages of large locked mappings have to be locked SE_SHARED.
8167  * This means if we have SE_EXCL lock on one of constituent pages none of the
8168  * large mappings to pp are locked.
8169  *
8170  * Decrease p_szc field starting from the last constituent page and ending
8171  * with the root page. This method is used because other threads rely on the
8172  * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8173  * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8174  * ensures that p_szc changes of the constituent pages appears atomic for all
8175  * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8176  *
8177  * This mechanism is only used for file system pages where it's not always
8178  * possible to get SE_EXCL locks on all constituent pages to demote the size
8179  * code (as is done for anonymous or kernel large pages).
8180  *
8181  * See more comments in front of sfmmu_mlspl_enter().
8182  */
8183 void
8184 hat_page_demote(page_t *pp)
8185 {
8186         int index;
8187         int sz;
8188         cpuset_t cpuset;
8189         int sync = 0;
8190         page_t *rootpp;
8191         struct sf_hment *sfhme;
8192         struct sf_hment *tmphme = NULL;
8193         struct hme_blk *hmeblkp;
8194         uint_t pszc;
8195         page_t *lastpp;
8196         cpuset_t tset;
8197         pgcnt_t npgs;
8198         kmutex_t *pml;
8199         kmutex_t *pmtx = NULL;
8200 
8201         ASSERT(PAGE_EXCL(pp));
8202         ASSERT(!PP_ISFREE(pp));
8203         ASSERT(!PP_ISKAS(pp));
8204         ASSERT(page_szc_lock_assert(pp));
8205         pml = sfmmu_mlist_enter(pp);
8206 
8207         pszc = pp->p_szc;
8208         if (pszc == 0) {
8209                 goto out;
8210         }
8211 
8212         index = PP_MAPINDEX(pp) >> 1;
8213 
8214         if (index) {
8215                 CPUSET_ZERO(cpuset);
8216                 sz = TTE64K;
8217                 sync = 1;
8218         }
8219 
8220         while (index) {
8221                 if (!(index & 0x1)) {
8222                         index >>= 1;
8223                         sz++;
8224                         continue;
8225                 }
8226                 ASSERT(sz <= pszc);
8227                 rootpp = PP_GROUPLEADER(pp, sz);
8228                 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8229                         tmphme = sfhme->hme_next;
8230                         ASSERT(!IS_PAHME(sfhme));
8231                         hmeblkp = sfmmu_hmetohblk(sfhme);
8232                         if (hme_size(sfhme) != sz) {
8233                                 continue;
8234                         }
8235                         tset = sfmmu_pageunload(rootpp, sfhme, sz);
8236                         CPUSET_OR(cpuset, tset);
8237                 }
8238                 if (index >>= 1) {
8239                         sz++;
8240                 }
8241         }
8242 
8243         ASSERT(!PP_ISMAPPED_LARGE(pp));
8244 
8245         if (sync) {
8246                 xt_sync(cpuset);
8247 #ifdef VAC
8248                 if (PP_ISTNC(pp)) {
8249                         conv_tnc(rootpp, sz);
8250                 }
8251 #endif  /* VAC */
8252         }
8253 
8254         pmtx = sfmmu_page_enter(pp);
8255 
8256         ASSERT(pp->p_szc == pszc);
8257         rootpp = PP_PAGEROOT(pp);
8258         ASSERT(rootpp->p_szc == pszc);
8259         lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8260 
8261         while (lastpp != rootpp) {
8262                 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8263                 ASSERT(sz < pszc);
8264                 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8265                 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8266                 while (--npgs > 0) {
8267                         lastpp->p_szc = (uchar_t)sz;
8268                         lastpp = PP_PAGEPREV(lastpp);
8269                 }
8270                 if (sz) {
8271                         /*
8272                          * make sure before current root's pszc
8273                          * is updated all updates to constituent pages pszc
8274                          * fields are globally visible.
8275                          */
8276                         membar_producer();
8277                 }
8278                 lastpp->p_szc = sz;
8279                 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8280                 if (lastpp != rootpp) {
8281                         lastpp = PP_PAGEPREV(lastpp);
8282                 }
8283         }
8284         if (sz == 0) {
8285                 /* the loop above doesn't cover this case */
8286                 rootpp->p_szc = 0;
8287         }
8288 out:
8289         ASSERT(pp->p_szc == 0);
8290         if (pmtx != NULL) {
8291                 sfmmu_page_exit(pmtx);
8292         }
8293         sfmmu_mlist_exit(pml);
8294 }
8295 
8296 /*
8297  * Refresh the HAT ismttecnt[] element for size szc.
8298  * Caller must have set ISM busy flag to prevent mapping
8299  * lists from changing while we're traversing them.
8300  */
8301 pgcnt_t
8302 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8303 {
8304         ism_blk_t       *ism_blkp = sfmmup->sfmmu_iblk;
8305         ism_map_t       *ism_map;
8306         pgcnt_t         npgs = 0;
8307         pgcnt_t         npgs_scd = 0;
8308         int             j;
8309         sf_scd_t        *scdp;
8310         uchar_t         rid;
8311 
8312         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8313         scdp = sfmmup->sfmmu_scdp;
8314 
8315         for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8316                 ism_map = ism_blkp->iblk_maps;
8317                 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8318                         rid = ism_map[j].imap_rid;
8319                         ASSERT(rid == SFMMU_INVALID_ISMRID ||
8320                             rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8321 
8322                         if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8323                             SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8324                                 /* ISM is in sfmmup's SCD */
8325                                 npgs_scd +=
8326                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8327                         } else {
8328                                 /* ISMs is not in SCD */
8329                                 npgs +=
8330                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8331                         }
8332                 }
8333         }
8334         sfmmup->sfmmu_ismttecnt[szc] = npgs;
8335         sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8336         return (npgs);
8337 }
8338 
8339 /*
8340  * Yield the memory claim requirement for an address space.
8341  *
8342  * This is currently implemented as the number of bytes that have active
8343  * hardware translations that have page structures.  Therefore, it can
8344  * underestimate the traditional resident set size, eg, if the
8345  * physical page is present and the hardware translation is missing;
8346  * and it can overestimate the rss, eg, if there are active
8347  * translations to a frame buffer with page structs.
8348  * Also, it does not take sharing into account.
8349  *
8350  * Note that we don't acquire locks here since this function is most often
8351  * called from the clock thread.
8352  */
8353 size_t
8354 hat_get_mapped_size(struct hat *hat)
8355 {
8356         size_t          assize = 0;
8357         int             i;
8358 
8359         if (hat == NULL)
8360                 return (0);
8361 
8362         for (i = 0; i < mmu_page_sizes; i++)
8363                 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8364                     (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8365 
8366         if (hat->sfmmu_iblk == NULL)
8367                 return (assize);
8368 
8369         for (i = 0; i < mmu_page_sizes; i++)
8370                 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8371                     (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8372 
8373         return (assize);
8374 }
8375 
8376 int
8377 hat_stats_enable(struct hat *hat)
8378 {
8379         hatlock_t       *hatlockp;
8380 
8381         hatlockp = sfmmu_hat_enter(hat);
8382         hat->sfmmu_rmstat++;
8383         sfmmu_hat_exit(hatlockp);
8384         return (1);
8385 }
8386 
8387 void
8388 hat_stats_disable(struct hat *hat)
8389 {
8390         hatlock_t       *hatlockp;
8391 
8392         hatlockp = sfmmu_hat_enter(hat);
8393         hat->sfmmu_rmstat--;
8394         sfmmu_hat_exit(hatlockp);
8395 }
8396 
8397 /*
8398  * Routines for entering or removing  ourselves from the
8399  * ism_hat's mapping list. This is used for both private and
8400  * SCD hats.
8401  */
8402 static void
8403 iment_add(struct ism_ment *iment,  struct hat *ism_hat)
8404 {
8405         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8406 
8407         iment->iment_prev = NULL;
8408         iment->iment_next = ism_hat->sfmmu_iment;
8409         if (ism_hat->sfmmu_iment) {
8410                 ism_hat->sfmmu_iment->iment_prev = iment;
8411         }
8412         ism_hat->sfmmu_iment = iment;
8413 }
8414 
8415 static void
8416 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8417 {
8418         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8419 
8420         if (ism_hat->sfmmu_iment == NULL) {
8421                 panic("ism map entry remove - no entries");
8422         }
8423 
8424         if (iment->iment_prev) {
8425                 ASSERT(ism_hat->sfmmu_iment != iment);
8426                 iment->iment_prev->iment_next = iment->iment_next;
8427         } else {
8428                 ASSERT(ism_hat->sfmmu_iment == iment);
8429                 ism_hat->sfmmu_iment = iment->iment_next;
8430         }
8431 
8432         if (iment->iment_next) {
8433                 iment->iment_next->iment_prev = iment->iment_prev;
8434         }
8435 
8436         /*
8437          * zero out the entry
8438          */
8439         iment->iment_next = NULL;
8440         iment->iment_prev = NULL;
8441         iment->iment_hat =  NULL;
8442         iment->iment_base_va = 0;
8443 }
8444 
8445 /*
8446  * Hat_share()/unshare() return an (non-zero) error
8447  * when saddr and daddr are not properly aligned.
8448  *
8449  * The top level mapping element determines the alignment
8450  * requirement for saddr and daddr, depending on different
8451  * architectures.
8452  *
8453  * When hat_share()/unshare() are not supported,
8454  * HATOP_SHARE()/UNSHARE() return 0
8455  */
8456 int
8457 hat_share(struct hat *sfmmup, caddr_t addr,
8458         struct hat *ism_hatid, caddr_t sptaddr, size_t len, uint_t ismszc)
8459 {
8460         ism_blk_t       *ism_blkp;
8461         ism_blk_t       *new_iblk;
8462         ism_map_t       *ism_map;
8463         ism_ment_t      *ism_ment;
8464         int             i, added;
8465         hatlock_t       *hatlockp;
8466         int             reload_mmu = 0;
8467         uint_t          ismshift = page_get_shift(ismszc);
8468         size_t          ismpgsz = page_get_pagesize(ismszc);
8469         uint_t          ismmask = (uint_t)ismpgsz - 1;
8470         size_t          sh_size = ISM_SHIFT(ismshift, len);
8471         ushort_t        ismhatflag;
8472         hat_region_cookie_t rcookie;
8473         sf_scd_t        *old_scdp;
8474 
8475 #ifdef DEBUG
8476         caddr_t         eaddr = addr + len;
8477 #endif /* DEBUG */
8478 
8479         ASSERT(ism_hatid != NULL && sfmmup != NULL);
8480         ASSERT(sptaddr == ISMID_STARTADDR);
8481         /*
8482          * Check the alignment.
8483          */
8484         if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8485                 return (EINVAL);
8486 
8487         /*
8488          * Check size alignment.
8489          */
8490         if (!ISM_ALIGNED(ismshift, len))
8491                 return (EINVAL);
8492 
8493         /*
8494          * Allocate ism_ment for the ism_hat's mapping list, and an
8495          * ism map blk in case we need one.  We must do our
8496          * allocations before acquiring locks to prevent a deadlock
8497          * in the kmem allocator on the mapping list lock.
8498          */
8499         new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8500         ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8501 
8502         /*
8503          * Serialize ISM mappings with the ISM busy flag, and also the
8504          * trap handlers.
8505          */
8506         sfmmu_ismhat_enter(sfmmup, 0);
8507 
8508         /*
8509          * Allocate an ism map blk if necessary.
8510          */
8511         if (sfmmup->sfmmu_iblk == NULL) {
8512                 sfmmup->sfmmu_iblk = new_iblk;
8513                 bzero(new_iblk, sizeof (*new_iblk));
8514                 new_iblk->iblk_nextpa = (uint64_t)-1;
8515                 membar_stst();  /* make sure next ptr visible to all CPUs */
8516                 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8517                 reload_mmu = 1;
8518                 new_iblk = NULL;
8519         }
8520 
8521 #ifdef DEBUG
8522         /*
8523          * Make sure mapping does not already exist.
8524          */
8525         ism_blkp = sfmmup->sfmmu_iblk;
8526         while (ism_blkp != NULL) {
8527                 ism_map = ism_blkp->iblk_maps;
8528                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8529                         if ((addr >= ism_start(ism_map[i]) &&
8530                             addr < ism_end(ism_map[i])) ||
8531                             eaddr > ism_start(ism_map[i]) &&
8532                             eaddr <= ism_end(ism_map[i])) {
8533                                 panic("sfmmu_share: Already mapped!");
8534                         }
8535                 }
8536                 ism_blkp = ism_blkp->iblk_next;
8537         }
8538 #endif /* DEBUG */
8539 
8540         ASSERT(ismszc >= TTE4M);
8541         if (ismszc == TTE4M) {
8542                 ismhatflag = HAT_4M_FLAG;
8543         } else if (ismszc == TTE32M) {
8544                 ismhatflag = HAT_32M_FLAG;
8545         } else if (ismszc == TTE256M) {
8546                 ismhatflag = HAT_256M_FLAG;
8547         }
8548         /*
8549          * Add mapping to first available mapping slot.
8550          */
8551         ism_blkp = sfmmup->sfmmu_iblk;
8552         added = 0;
8553         while (!added) {
8554                 ism_map = ism_blkp->iblk_maps;
8555                 for (i = 0; i < ISM_MAP_SLOTS; i++)  {
8556                         if (ism_map[i].imap_ismhat == NULL) {
8557 
8558                                 ism_map[i].imap_ismhat = ism_hatid;
8559                                 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8560                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8561                                 ism_map[i].imap_hatflags = ismhatflag;
8562                                 ism_map[i].imap_sz_mask = ismmask;
8563                                 /*
8564                                  * imap_seg is checked in ISM_CHECK to see if
8565                                  * non-NULL, then other info assumed valid.
8566                                  */
8567                                 membar_stst();
8568                                 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8569                                 ism_map[i].imap_ment = ism_ment;
8570 
8571                                 /*
8572                                  * Now add ourselves to the ism_hat's
8573                                  * mapping list.
8574                                  */
8575                                 ism_ment->iment_hat = sfmmup;
8576                                 ism_ment->iment_base_va = addr;
8577                                 ism_hatid->sfmmu_ismhat = 1;
8578                                 mutex_enter(&ism_mlist_lock);
8579                                 iment_add(ism_ment, ism_hatid);
8580                                 mutex_exit(&ism_mlist_lock);
8581                                 added = 1;
8582                                 break;
8583                         }
8584                 }
8585                 if (!added && ism_blkp->iblk_next == NULL) {
8586                         ism_blkp->iblk_next = new_iblk;
8587                         new_iblk = NULL;
8588                         bzero(ism_blkp->iblk_next,
8589                             sizeof (*ism_blkp->iblk_next));
8590                         ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8591                         membar_stst();
8592                         ism_blkp->iblk_nextpa =
8593                             va_to_pa((caddr_t)ism_blkp->iblk_next);
8594                 }
8595                 ism_blkp = ism_blkp->iblk_next;
8596         }
8597 
8598         /*
8599          * After calling hat_join_region, sfmmup may join a new SCD or
8600          * move from the old scd to a new scd, in which case, we want to
8601          * shrink the sfmmup's private tsb size, i.e., pass shrink to
8602          * sfmmu_check_page_sizes at the end of this routine.
8603          */
8604         old_scdp = sfmmup->sfmmu_scdp;
8605 
8606         rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8607             PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8608         if (rcookie != HAT_INVALID_REGION_COOKIE) {
8609                 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8610         }
8611         /*
8612          * Update our counters for this sfmmup's ism mappings.
8613          */
8614         for (i = 0; i <= ismszc; i++) {
8615                 if (!(disable_ism_large_pages & (1 << i)))
8616                         (void) ism_tsb_entries(sfmmup, i);
8617         }
8618 
8619         /*
8620          * For ISM and DISM we do not support 512K pages, so we only only
8621          * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8622          * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8623          *
8624          * Need to set 32M/256M ISM flags to make sure
8625          * sfmmu_check_page_sizes() enables them on Panther.
8626          */
8627         ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8628 
8629         switch (ismszc) {
8630         case TTE256M:
8631                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8632                         hatlockp = sfmmu_hat_enter(sfmmup);
8633                         SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8634                         sfmmu_hat_exit(hatlockp);
8635                 }
8636                 break;
8637         case TTE32M:
8638                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8639                         hatlockp = sfmmu_hat_enter(sfmmup);
8640                         SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8641                         sfmmu_hat_exit(hatlockp);
8642                 }
8643                 break;
8644         default:
8645                 break;
8646         }
8647 
8648         /*
8649          * If we updated the ismblkpa for this HAT we must make
8650          * sure all CPUs running this process reload their tsbmiss area.
8651          * Otherwise they will fail to load the mappings in the tsbmiss
8652          * handler and will loop calling pagefault().
8653          */
8654         if (reload_mmu) {
8655                 hatlockp = sfmmu_hat_enter(sfmmup);
8656                 sfmmu_sync_mmustate(sfmmup);
8657                 sfmmu_hat_exit(hatlockp);
8658         }
8659 
8660         sfmmu_ismhat_exit(sfmmup, 0);
8661 
8662         /*
8663          * Free up ismblk if we didn't use it.
8664          */
8665         if (new_iblk != NULL)
8666                 kmem_cache_free(ism_blk_cache, new_iblk);
8667 
8668         /*
8669          * Check TSB and TLB page sizes.
8670          */
8671         if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8672                 sfmmu_check_page_sizes(sfmmup, 0);
8673         } else {
8674                 sfmmu_check_page_sizes(sfmmup, 1);
8675         }
8676         return (0);
8677 }
8678 
8679 /*
8680  * hat_unshare removes exactly one ism_map from
8681  * this process's as.  It expects multiple calls
8682  * to hat_unshare for multiple shm segments.
8683  */
8684 void
8685 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8686 {
8687         ism_map_t       *ism_map;
8688         ism_ment_t      *free_ment = NULL;
8689         ism_blk_t       *ism_blkp;
8690         struct hat      *ism_hatid;
8691         int             found, i;
8692         hatlock_t       *hatlockp;
8693         struct tsb_info *tsbinfo;
8694         uint_t          ismshift = page_get_shift(ismszc);
8695         size_t          sh_size = ISM_SHIFT(ismshift, len);
8696         uchar_t         ism_rid;
8697         sf_scd_t        *old_scdp;
8698 
8699         ASSERT(ISM_ALIGNED(ismshift, addr));
8700         ASSERT(ISM_ALIGNED(ismshift, len));
8701         ASSERT(sfmmup != NULL);
8702         ASSERT(sfmmup != ksfmmup);
8703 
8704         ASSERT(sfmmup->sfmmu_as != NULL);
8705 
8706         /*
8707          * Make sure that during the entire time ISM mappings are removed,
8708          * the trap handlers serialize behind us, and that no one else
8709          * can be mucking with ISM mappings.  This also lets us get away
8710          * with not doing expensive cross calls to flush the TLB -- we
8711          * just discard the context, flush the entire TSB, and call it
8712          * a day.
8713          */
8714         sfmmu_ismhat_enter(sfmmup, 0);
8715 
8716         /*
8717          * Remove the mapping.
8718          *
8719          * We can't have any holes in the ism map.
8720          * The tsb miss code while searching the ism map will
8721          * stop on an empty map slot.  So we must move
8722          * everyone past the hole up 1 if any.
8723          *
8724          * Also empty ism map blks are not freed until the
8725          * process exits. This is to prevent a MT race condition
8726          * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8727          */
8728         found = 0;
8729         ism_blkp = sfmmup->sfmmu_iblk;
8730         while (!found && ism_blkp != NULL) {
8731                 ism_map = ism_blkp->iblk_maps;
8732                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8733                         if (addr == ism_start(ism_map[i]) &&
8734                             sh_size == (size_t)(ism_size(ism_map[i]))) {
8735                                 found = 1;
8736                                 break;
8737                         }
8738                 }
8739                 if (!found)
8740                         ism_blkp = ism_blkp->iblk_next;
8741         }
8742 
8743         if (found) {
8744                 ism_hatid = ism_map[i].imap_ismhat;
8745                 ism_rid = ism_map[i].imap_rid;
8746                 ASSERT(ism_hatid != NULL);
8747                 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8748 
8749                 /*
8750                  * After hat_leave_region, the sfmmup may leave SCD,
8751                  * in which case, we want to grow the private tsb size when
8752                  * calling sfmmu_check_page_sizes at the end of the routine.
8753                  */
8754                 old_scdp = sfmmup->sfmmu_scdp;
8755                 /*
8756                  * Then remove ourselves from the region.
8757                  */
8758                 if (ism_rid != SFMMU_INVALID_ISMRID) {
8759                         hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8760                             HAT_REGION_ISM);
8761                 }
8762 
8763                 /*
8764                  * And now guarantee that any other cpu
8765                  * that tries to process an ISM miss
8766                  * will go to tl=0.
8767                  */
8768                 hatlockp = sfmmu_hat_enter(sfmmup);
8769                 sfmmu_invalidate_ctx(sfmmup);
8770                 sfmmu_hat_exit(hatlockp);
8771 
8772                 /*
8773                  * Remove ourselves from the ism mapping list.
8774                  */
8775                 mutex_enter(&ism_mlist_lock);
8776                 iment_sub(ism_map[i].imap_ment, ism_hatid);
8777                 mutex_exit(&ism_mlist_lock);
8778                 free_ment = ism_map[i].imap_ment;
8779 
8780                 /*
8781                  * We delete the ism map by copying
8782                  * the next map over the current one.
8783                  * We will take the next one in the maps
8784                  * array or from the next ism_blk.
8785                  */
8786                 while (ism_blkp != NULL) {
8787                         ism_map = ism_blkp->iblk_maps;
8788                         while (i < (ISM_MAP_SLOTS - 1)) {
8789                                 ism_map[i] = ism_map[i + 1];
8790                                 i++;
8791                         }
8792                         /* i == (ISM_MAP_SLOTS - 1) */
8793                         ism_blkp = ism_blkp->iblk_next;
8794                         if (ism_blkp != NULL) {
8795                                 ism_map[i] = ism_blkp->iblk_maps[0];
8796                                 i = 0;
8797                         } else {
8798                                 ism_map[i].imap_seg = 0;
8799                                 ism_map[i].imap_vb_shift = 0;
8800                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8801                                 ism_map[i].imap_hatflags = 0;
8802                                 ism_map[i].imap_sz_mask = 0;
8803                                 ism_map[i].imap_ismhat = NULL;
8804                                 ism_map[i].imap_ment = NULL;
8805                         }
8806                 }
8807 
8808                 /*
8809                  * Now flush entire TSB for the process, since
8810                  * demapping page by page can be too expensive.
8811                  * We don't have to flush the TLB here anymore
8812                  * since we switch to a new TLB ctx instead.
8813                  * Also, there is no need to flush if the process
8814                  * is exiting since the TSB will be freed later.
8815                  */
8816                 if (!sfmmup->sfmmu_free) {
8817                         hatlockp = sfmmu_hat_enter(sfmmup);
8818                         for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8819                             tsbinfo = tsbinfo->tsb_next) {
8820                                 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8821                                         continue;
8822                                 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8823                                         tsbinfo->tsb_flags |=
8824                                             TSB_FLUSH_NEEDED;
8825                                         continue;
8826                                 }
8827 
8828                                 sfmmu_inv_tsb(tsbinfo->tsb_va,
8829                                     TSB_BYTES(tsbinfo->tsb_szc));
8830                         }
8831                         sfmmu_hat_exit(hatlockp);
8832                 }
8833         }
8834 
8835         /*
8836          * Update our counters for this sfmmup's ism mappings.
8837          */
8838         for (i = 0; i <= ismszc; i++) {
8839                 if (!(disable_ism_large_pages & (1 << i)))
8840                         (void) ism_tsb_entries(sfmmup, i);
8841         }
8842 
8843         sfmmu_ismhat_exit(sfmmup, 0);
8844 
8845         /*
8846          * We must do our freeing here after dropping locks
8847          * to prevent a deadlock in the kmem allocator on the
8848          * mapping list lock.
8849          */
8850         if (free_ment != NULL)
8851                 kmem_cache_free(ism_ment_cache, free_ment);
8852 
8853         /*
8854          * Check TSB and TLB page sizes if the process isn't exiting.
8855          */
8856         if (!sfmmup->sfmmu_free) {
8857                 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
8858                         sfmmu_check_page_sizes(sfmmup, 1);
8859                 } else {
8860                         sfmmu_check_page_sizes(sfmmup, 0);
8861                 }
8862         }
8863 }
8864 
8865 /* ARGSUSED */
8866 static int
8867 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
8868 {
8869         /* void *buf is sfmmu_t pointer */
8870         bzero(buf, sizeof (sfmmu_t));
8871 
8872         return (0);
8873 }
8874 
8875 /* ARGSUSED */
8876 static void
8877 sfmmu_idcache_destructor(void *buf, void *cdrarg)
8878 {
8879         /* void *buf is sfmmu_t pointer */
8880 }
8881 
8882 /*
8883  * setup kmem hmeblks by bzeroing all members and initializing the nextpa
8884  * field to be the pa of this hmeblk
8885  */
8886 /* ARGSUSED */
8887 static int
8888 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
8889 {
8890         struct hme_blk *hmeblkp;
8891 
8892         bzero(buf, (size_t)cdrarg);
8893         hmeblkp = (struct hme_blk *)buf;
8894         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
8895 
8896 #ifdef  HBLK_TRACE
8897         mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
8898 #endif  /* HBLK_TRACE */
8899 
8900         return (0);
8901 }
8902 
8903 /* ARGSUSED */
8904 static void
8905 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
8906 {
8907 
8908 #ifdef  HBLK_TRACE
8909 
8910         struct hme_blk *hmeblkp;
8911 
8912         hmeblkp = (struct hme_blk *)buf;
8913         mutex_destroy(&hmeblkp->hblk_audit_lock);
8914 
8915 #endif  /* HBLK_TRACE */
8916 }
8917 
8918 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
8919 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
8920 /*
8921  * The kmem allocator will callback into our reclaim routine when the system
8922  * is running low in memory.  We traverse the hash and free up all unused but
8923  * still cached hme_blks.  We also traverse the free list and free them up
8924  * as well.
8925  */
8926 /*ARGSUSED*/
8927 static void
8928 sfmmu_hblkcache_reclaim(void *cdrarg)
8929 {
8930         int i;
8931         struct hmehash_bucket *hmebp;
8932         struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
8933         static struct hmehash_bucket *uhmehash_reclaim_hand;
8934         static struct hmehash_bucket *khmehash_reclaim_hand;
8935         struct hme_blk *list = NULL, *last_hmeblkp;
8936         cpuset_t cpuset = cpu_ready_set;
8937         cpu_hme_pend_t *cpuhp;
8938 
8939         /* Free up hmeblks on the cpu pending lists */
8940         for (i = 0; i < NCPU; i++) {
8941                 cpuhp = &cpu_hme_pend[i];
8942                 if (cpuhp->chp_listp != NULL)  {
8943                         mutex_enter(&cpuhp->chp_mutex);
8944                         if (cpuhp->chp_listp == NULL) {
8945                                 mutex_exit(&cpuhp->chp_mutex);
8946                                 continue;
8947                         }
8948                         for (last_hmeblkp = cpuhp->chp_listp;
8949                             last_hmeblkp->hblk_next != NULL;
8950                             last_hmeblkp = last_hmeblkp->hblk_next)
8951                                 ;
8952                         last_hmeblkp->hblk_next = list;
8953                         list = cpuhp->chp_listp;
8954                         cpuhp->chp_listp = NULL;
8955                         cpuhp->chp_count = 0;
8956                         mutex_exit(&cpuhp->chp_mutex);
8957                 }
8958 
8959         }
8960 
8961         if (list != NULL) {
8962                 kpreempt_disable();
8963                 CPUSET_DEL(cpuset, CPU->cpu_id);
8964                 xt_sync(cpuset);
8965                 xt_sync(cpuset);
8966                 kpreempt_enable();
8967                 sfmmu_hblk_free(&list);
8968                 list = NULL;
8969         }
8970 
8971         hmebp = uhmehash_reclaim_hand;
8972         if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
8973                 uhmehash_reclaim_hand = hmebp = uhme_hash;
8974         uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8975 
8976         for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8977                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8978                         hmeblkp = hmebp->hmeblkp;
8979                         pr_hblk = NULL;
8980                         while (hmeblkp) {
8981                                 nx_hblk = hmeblkp->hblk_next;
8982                                 if (!hmeblkp->hblk_vcnt &&
8983                                     !hmeblkp->hblk_hmecnt) {
8984                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8985                                             pr_hblk, &list, 0);
8986                                 } else {
8987                                         pr_hblk = hmeblkp;
8988                                 }
8989                                 hmeblkp = nx_hblk;
8990                         }
8991                         SFMMU_HASH_UNLOCK(hmebp);
8992                 }
8993                 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
8994                         hmebp = uhme_hash;
8995         }
8996 
8997         hmebp = khmehash_reclaim_hand;
8998         if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
8999                 khmehash_reclaim_hand = hmebp = khme_hash;
9000         khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
9001 
9002         for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
9003                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
9004                         hmeblkp = hmebp->hmeblkp;
9005                         pr_hblk = NULL;
9006                         while (hmeblkp) {
9007                                 nx_hblk = hmeblkp->hblk_next;
9008                                 if (!hmeblkp->hblk_vcnt &&
9009                                     !hmeblkp->hblk_hmecnt) {
9010                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9011                                             pr_hblk, &list, 0);
9012                                 } else {
9013                                         pr_hblk = hmeblkp;
9014                                 }
9015                                 hmeblkp = nx_hblk;
9016                         }
9017                         SFMMU_HASH_UNLOCK(hmebp);
9018                 }
9019                 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9020                         hmebp = khme_hash;
9021         }
9022         sfmmu_hblks_list_purge(&list, 0);
9023 }
9024 
9025 /*
9026  * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9027  * same goes for sfmmu_get_addrvcolor().
9028  *
9029  * This function will return the virtual color for the specified page. The
9030  * virtual color corresponds to this page current mapping or its last mapping.
9031  * It is used by memory allocators to choose addresses with the correct
9032  * alignment so vac consistency is automatically maintained.  If the page
9033  * has no color it returns -1.
9034  */
9035 /*ARGSUSED*/
9036 int
9037 sfmmu_get_ppvcolor(struct page *pp)
9038 {
9039 #ifdef VAC
9040         int color;
9041 
9042         if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9043                 return (-1);
9044         }
9045         color = PP_GET_VCOLOR(pp);
9046         ASSERT(color < mmu_btop(shm_alignment));
9047         return (color);
9048 #else
9049         return (-1);
9050 #endif  /* VAC */
9051 }
9052 
9053 /*
9054  * This function will return the desired alignment for vac consistency
9055  * (vac color) given a virtual address.  If no vac is present it returns -1.
9056  */
9057 /*ARGSUSED*/
9058 int
9059 sfmmu_get_addrvcolor(caddr_t vaddr)
9060 {
9061 #ifdef VAC
9062         if (cache & CACHE_VAC) {
9063                 return (addr_to_vcolor(vaddr));
9064         } else {
9065                 return (-1);
9066         }
9067 #else
9068         return (-1);
9069 #endif  /* VAC */
9070 }
9071 
9072 #ifdef VAC
9073 /*
9074  * Check for conflicts.
9075  * A conflict exists if the new and existent mappings do not match in
9076  * their "shm_alignment fields. If conflicts exist, the existant mappings
9077  * are flushed unless one of them is locked. If one of them is locked, then
9078  * the mappings are flushed and converted to non-cacheable mappings.
9079  */
9080 static void
9081 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9082 {
9083         struct hat *tmphat;
9084         struct sf_hment *sfhmep, *tmphme = NULL;
9085         struct hme_blk *hmeblkp;
9086         int vcolor;
9087         tte_t tte;
9088 
9089         ASSERT(sfmmu_mlist_held(pp));
9090         ASSERT(!PP_ISNC(pp));           /* page better be cacheable */
9091 
9092         vcolor = addr_to_vcolor(addr);
9093         if (PP_NEWPAGE(pp)) {
9094                 PP_SET_VCOLOR(pp, vcolor);
9095                 return;
9096         }
9097 
9098         if (PP_GET_VCOLOR(pp) == vcolor) {
9099                 return;
9100         }
9101 
9102         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9103                 /*
9104                  * Previous user of page had a different color
9105                  * but since there are no current users
9106                  * we just flush the cache and change the color.
9107                  */
9108                 SFMMU_STAT(sf_pgcolor_conflict);
9109                 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9110                 PP_SET_VCOLOR(pp, vcolor);
9111                 return;
9112         }
9113 
9114         /*
9115          * If we get here we have a vac conflict with a current
9116          * mapping.  VAC conflict policy is as follows.
9117          * - The default is to unload the other mappings unless:
9118          * - If we have a large mapping we uncache the page.
9119          * We need to uncache the rest of the large page too.
9120          * - If any of the mappings are locked we uncache the page.
9121          * - If the requested mapping is inconsistent
9122          * with another mapping and that mapping
9123          * is in the same address space we have to
9124          * make it non-cached.  The default thing
9125          * to do is unload the inconsistent mapping
9126          * but if they are in the same address space
9127          * we run the risk of unmapping the pc or the
9128          * stack which we will use as we return to the user,
9129          * in which case we can then fault on the thing
9130          * we just unloaded and get into an infinite loop.
9131          */
9132         if (PP_ISMAPPED_LARGE(pp)) {
9133                 int sz;
9134 
9135                 /*
9136                  * Existing mapping is for big pages. We don't unload
9137                  * existing big mappings to satisfy new mappings.
9138                  * Always convert all mappings to TNC.
9139                  */
9140                 sz = fnd_mapping_sz(pp);
9141                 pp = PP_GROUPLEADER(pp, sz);
9142                 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9143                 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9144                     TTEPAGES(sz));
9145 
9146                 return;
9147         }
9148 
9149         /*
9150          * check if any mapping is in same as or if it is locked
9151          * since in that case we need to uncache.
9152          */
9153         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9154                 tmphme = sfhmep->hme_next;
9155                 if (IS_PAHME(sfhmep))
9156                         continue;
9157                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9158                 tmphat = hblktosfmmu(hmeblkp);
9159                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9160                 ASSERT(TTE_IS_VALID(&tte));
9161                 if (hmeblkp->hblk_shared || tmphat == hat ||
9162                     hmeblkp->hblk_lckcnt) {
9163                         /*
9164                          * We have an uncache conflict
9165                          */
9166                         SFMMU_STAT(sf_uncache_conflict);
9167                         sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9168                         return;
9169                 }
9170         }
9171 
9172         /*
9173          * We have an unload conflict
9174          * We have already checked for LARGE mappings, therefore
9175          * the remaining mapping(s) must be TTE8K.
9176          */
9177         SFMMU_STAT(sf_unload_conflict);
9178 
9179         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9180                 tmphme = sfhmep->hme_next;
9181                 if (IS_PAHME(sfhmep))
9182                         continue;
9183                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9184                 ASSERT(!hmeblkp->hblk_shared);
9185                 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9186         }
9187 
9188         if (PP_ISMAPPED_KPM(pp))
9189                 sfmmu_kpm_vac_unload(pp, addr);
9190 
9191         /*
9192          * Unloads only do TLB flushes so we need to flush the
9193          * cache here.
9194          */
9195         sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9196         PP_SET_VCOLOR(pp, vcolor);
9197 }
9198 
9199 /*
9200  * Whenever a mapping is unloaded and the page is in TNC state,
9201  * we see if the page can be made cacheable again. 'pp' is
9202  * the page that we just unloaded a mapping from, the size
9203  * of mapping that was unloaded is 'ottesz'.
9204  * Remark:
9205  * The recache policy for mpss pages can leave a performance problem
9206  * under the following circumstances:
9207  * . A large page in uncached mode has just been unmapped.
9208  * . All constituent pages are TNC due to a conflicting small mapping.
9209  * . There are many other, non conflicting, small mappings around for
9210  *   a lot of the constituent pages.
9211  * . We're called w/ the "old" groupleader page and the old ottesz,
9212  *   but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9213  *   we end up w/ TTE8K or npages == 1.
9214  * . We call tst_tnc w/ the old groupleader only, and if there is no
9215  *   conflict, we re-cache only this page.
9216  * . All other small mappings are not checked and will be left in TNC mode.
9217  * The problem is not very serious because:
9218  * . mpss is actually only defined for heap and stack, so the probability
9219  *   is not very high that a large page mapping exists in parallel to a small
9220  *   one (this is possible, but seems to be bad programming style in the
9221  *   appl).
9222  * . The problem gets a little bit more serious, when those TNC pages
9223  *   have to be mapped into kernel space, e.g. for networking.
9224  * . When VAC alias conflicts occur in applications, this is regarded
9225  *   as an application bug. So if kstat's show them, the appl should
9226  *   be changed anyway.
9227  */
9228 void
9229 conv_tnc(page_t *pp, int ottesz)
9230 {
9231         int cursz, dosz;
9232         pgcnt_t curnpgs, dopgs;
9233         pgcnt_t pg64k;
9234         page_t *pp2;
9235 
9236         /*
9237          * Determine how big a range we check for TNC and find
9238          * leader page. cursz is the size of the biggest
9239          * mapping that still exist on 'pp'.
9240          */
9241         if (PP_ISMAPPED_LARGE(pp)) {
9242                 cursz = fnd_mapping_sz(pp);
9243         } else {
9244                 cursz = TTE8K;
9245         }
9246 
9247         if (ottesz >= cursz) {
9248                 dosz = ottesz;
9249                 pp2 = pp;
9250         } else {
9251                 dosz = cursz;
9252                 pp2 = PP_GROUPLEADER(pp, dosz);
9253         }
9254 
9255         pg64k = TTEPAGES(TTE64K);
9256         dopgs = TTEPAGES(dosz);
9257 
9258         ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9259 
9260         while (dopgs != 0) {
9261                 curnpgs = TTEPAGES(cursz);
9262                 if (tst_tnc(pp2, curnpgs)) {
9263                         SFMMU_STAT_ADD(sf_recache, curnpgs);
9264                         sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9265                             curnpgs);
9266                 }
9267 
9268                 ASSERT(dopgs >= curnpgs);
9269                 dopgs -= curnpgs;
9270 
9271                 if (dopgs == 0) {
9272                         break;
9273                 }
9274 
9275                 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9276                 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9277                         cursz = fnd_mapping_sz(pp2);
9278                 } else {
9279                         cursz = TTE8K;
9280                 }
9281         }
9282 }
9283 
9284 /*
9285  * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9286  * returns 0 otherwise. Note that oaddr argument is valid for only
9287  * 8k pages.
9288  */
9289 int
9290 tst_tnc(page_t *pp, pgcnt_t npages)
9291 {
9292         struct  sf_hment *sfhme;
9293         struct  hme_blk *hmeblkp;
9294         tte_t   tte;
9295         caddr_t vaddr;
9296         int     clr_valid = 0;
9297         int     color, color1, bcolor;
9298         int     i, ncolors;
9299 
9300         ASSERT(pp != NULL);
9301         ASSERT(!(cache & CACHE_WRITEBACK));
9302 
9303         if (npages > 1) {
9304                 ncolors = CACHE_NUM_COLOR;
9305         }
9306 
9307         for (i = 0; i < npages; i++) {
9308                 ASSERT(sfmmu_mlist_held(pp));
9309                 ASSERT(PP_ISTNC(pp));
9310                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9311 
9312                 if (PP_ISPNC(pp)) {
9313                         return (0);
9314                 }
9315 
9316                 clr_valid = 0;
9317                 if (PP_ISMAPPED_KPM(pp)) {
9318                         caddr_t kpmvaddr;
9319 
9320                         ASSERT(kpm_enable);
9321                         kpmvaddr = hat_kpm_page2va(pp, 1);
9322                         ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9323                         color1 = addr_to_vcolor(kpmvaddr);
9324                         clr_valid = 1;
9325                 }
9326 
9327                 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9328                         if (IS_PAHME(sfhme))
9329                                 continue;
9330                         hmeblkp = sfmmu_hmetohblk(sfhme);
9331 
9332                         sfmmu_copytte(&sfhme->hme_tte, &tte);
9333                         ASSERT(TTE_IS_VALID(&tte));
9334 
9335                         vaddr = tte_to_vaddr(hmeblkp, tte);
9336                         color = addr_to_vcolor(vaddr);
9337 
9338                         if (npages > 1) {
9339                                 /*
9340                                  * If there is a big mapping, make sure
9341                                  * 8K mapping is consistent with the big
9342                                  * mapping.
9343                                  */
9344                                 bcolor = i % ncolors;
9345                                 if (color != bcolor) {
9346                                         return (0);
9347                                 }
9348                         }
9349                         if (!clr_valid) {
9350                                 clr_valid = 1;
9351                                 color1 = color;
9352                         }
9353 
9354                         if (color1 != color) {
9355                                 return (0);
9356                         }
9357                 }
9358 
9359                 pp = PP_PAGENEXT(pp);
9360         }
9361 
9362         return (1);
9363 }
9364 
9365 void
9366 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9367         pgcnt_t npages)
9368 {
9369         kmutex_t *pmtx;
9370         int i, ncolors, bcolor;
9371         kpm_hlk_t *kpmp;
9372         cpuset_t cpuset;
9373 
9374         ASSERT(pp != NULL);
9375         ASSERT(!(cache & CACHE_WRITEBACK));
9376 
9377         kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9378         pmtx = sfmmu_page_enter(pp);
9379 
9380         /*
9381          * Fast path caching single unmapped page
9382          */
9383         if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9384             flags == HAT_CACHE) {
9385                 PP_CLRTNC(pp);
9386                 PP_CLRPNC(pp);
9387                 sfmmu_page_exit(pmtx);
9388                 sfmmu_kpm_kpmp_exit(kpmp);
9389                 return;
9390         }
9391 
9392         /*
9393          * We need to capture all cpus in order to change cacheability
9394          * because we can't allow one cpu to access the same physical
9395          * page using a cacheable and a non-cachebale mapping at the same
9396          * time. Since we may end up walking the ism mapping list
9397          * have to grab it's lock now since we can't after all the
9398          * cpus have been captured.
9399          */
9400         sfmmu_hat_lock_all();
9401         mutex_enter(&ism_mlist_lock);
9402         kpreempt_disable();
9403         cpuset = cpu_ready_set;
9404         xc_attention(cpuset);
9405 
9406         if (npages > 1) {
9407                 /*
9408                  * Make sure all colors are flushed since the
9409                  * sfmmu_page_cache() only flushes one color-
9410                  * it does not know big pages.
9411                  */
9412                 ncolors = CACHE_NUM_COLOR;
9413                 if (flags & HAT_TMPNC) {
9414                         for (i = 0; i < ncolors; i++) {
9415                                 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9416                         }
9417                         cache_flush_flag = CACHE_NO_FLUSH;
9418                 }
9419         }
9420 
9421         for (i = 0; i < npages; i++) {
9422 
9423                 ASSERT(sfmmu_mlist_held(pp));
9424 
9425                 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9426 
9427                         if (npages > 1) {
9428                                 bcolor = i % ncolors;
9429                         } else {
9430                                 bcolor = NO_VCOLOR;
9431                         }
9432 
9433                         sfmmu_page_cache(pp, flags, cache_flush_flag,
9434                             bcolor);
9435                 }
9436 
9437                 pp = PP_PAGENEXT(pp);
9438         }
9439 
9440         xt_sync(cpuset);
9441         xc_dismissed(cpuset);
9442         mutex_exit(&ism_mlist_lock);
9443         sfmmu_hat_unlock_all();
9444         sfmmu_page_exit(pmtx);
9445         sfmmu_kpm_kpmp_exit(kpmp);
9446         kpreempt_enable();
9447 }
9448 
9449 /*
9450  * This function changes the virtual cacheability of all mappings to a
9451  * particular page.  When changing from uncache to cacheable the mappings will
9452  * only be changed if all of them have the same virtual color.
9453  * We need to flush the cache in all cpus.  It is possible that
9454  * a process referenced a page as cacheable but has sinced exited
9455  * and cleared the mapping list.  We still to flush it but have no
9456  * state so all cpus is the only alternative.
9457  */
9458 static void
9459 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9460 {
9461         struct  sf_hment *sfhme;
9462         struct  hme_blk *hmeblkp;
9463         sfmmu_t *sfmmup;
9464         tte_t   tte, ttemod;
9465         caddr_t vaddr;
9466         int     ret, color;
9467         pfn_t   pfn;
9468 
9469         color = bcolor;
9470         pfn = pp->p_pagenum;
9471 
9472         for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9473 
9474                 if (IS_PAHME(sfhme))
9475                         continue;
9476                 hmeblkp = sfmmu_hmetohblk(sfhme);
9477 
9478                 sfmmu_copytte(&sfhme->hme_tte, &tte);
9479                 ASSERT(TTE_IS_VALID(&tte));
9480                 vaddr = tte_to_vaddr(hmeblkp, tte);
9481                 color = addr_to_vcolor(vaddr);
9482 
9483 #ifdef DEBUG
9484                 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9485                         ASSERT(color == bcolor);
9486                 }
9487 #endif
9488 
9489                 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9490 
9491                 ttemod = tte;
9492                 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9493                         TTE_CLR_VCACHEABLE(&ttemod);
9494                 } else {        /* flags & HAT_CACHE */
9495                         TTE_SET_VCACHEABLE(&ttemod);
9496                 }
9497                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9498                 if (ret < 0) {
9499                         /*
9500                          * Since all cpus are captured modifytte should not
9501                          * fail.
9502                          */
9503                         panic("sfmmu_page_cache: write to tte failed");
9504                 }
9505 
9506                 sfmmup = hblktosfmmu(hmeblkp);
9507                 if (cache_flush_flag == CACHE_FLUSH) {
9508                         /*
9509                          * Flush TSBs, TLBs and caches
9510                          */
9511                         if (hmeblkp->hblk_shared) {
9512                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9513                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9514                                 sf_region_t *rgnp;
9515                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9516                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9517                                 ASSERT(srdp != NULL);
9518                                 rgnp = srdp->srd_hmergnp[rid];
9519                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9520                                     srdp, rgnp, rid);
9521                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9522                                     hmeblkp, 0);
9523                                 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9524                         } else if (sfmmup->sfmmu_ismhat) {
9525                                 if (flags & HAT_CACHE) {
9526                                         SFMMU_STAT(sf_ism_recache);
9527                                 } else {
9528                                         SFMMU_STAT(sf_ism_uncache);
9529                                 }
9530                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9531                                     pfn, CACHE_FLUSH);
9532                         } else {
9533                                 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9534                                     pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9535                         }
9536 
9537                         /*
9538                          * all cache entries belonging to this pfn are
9539                          * now flushed.
9540                          */
9541                         cache_flush_flag = CACHE_NO_FLUSH;
9542                 } else {
9543                         /*
9544                          * Flush only TSBs and TLBs.
9545                          */
9546                         if (hmeblkp->hblk_shared) {
9547                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9548                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9549                                 sf_region_t *rgnp;
9550                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9551                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9552                                 ASSERT(srdp != NULL);
9553                                 rgnp = srdp->srd_hmergnp[rid];
9554                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9555                                     srdp, rgnp, rid);
9556                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9557                                     hmeblkp, 0);
9558                         } else if (sfmmup->sfmmu_ismhat) {
9559                                 if (flags & HAT_CACHE) {
9560                                         SFMMU_STAT(sf_ism_recache);
9561                                 } else {
9562                                         SFMMU_STAT(sf_ism_uncache);
9563                                 }
9564                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9565                                     pfn, CACHE_NO_FLUSH);
9566                         } else {
9567                                 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9568                         }
9569                 }
9570         }
9571 
9572         if (PP_ISMAPPED_KPM(pp))
9573                 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9574 
9575         switch (flags) {
9576 
9577                 default:
9578                         panic("sfmmu_pagecache: unknown flags");
9579                         break;
9580 
9581                 case HAT_CACHE:
9582                         PP_CLRTNC(pp);
9583                         PP_CLRPNC(pp);
9584                         PP_SET_VCOLOR(pp, color);
9585                         break;
9586 
9587                 case HAT_TMPNC:
9588                         PP_SETTNC(pp);
9589                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9590                         break;
9591 
9592                 case HAT_UNCACHE:
9593                         PP_SETPNC(pp);
9594                         PP_CLRTNC(pp);
9595                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9596                         break;
9597         }
9598 }
9599 #endif  /* VAC */
9600 
9601 
9602 /*
9603  * Wrapper routine used to return a context.
9604  *
9605  * It's the responsibility of the caller to guarantee that the
9606  * process serializes on calls here by taking the HAT lock for
9607  * the hat.
9608  *
9609  */
9610 static void
9611 sfmmu_get_ctx(sfmmu_t *sfmmup)
9612 {
9613         mmu_ctx_t *mmu_ctxp;
9614         uint_t pstate_save;
9615         int ret;
9616 
9617         ASSERT(sfmmu_hat_lock_held(sfmmup));
9618         ASSERT(sfmmup != ksfmmup);
9619 
9620         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9621                 sfmmu_setup_tsbinfo(sfmmup);
9622                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9623         }
9624 
9625         kpreempt_disable();
9626 
9627         mmu_ctxp = CPU_MMU_CTXP(CPU);
9628         ASSERT(mmu_ctxp);
9629         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9630         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9631 
9632         /*
9633          * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9634          */
9635         if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9636                 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9637 
9638         /*
9639          * Let the MMU set up the page sizes to use for
9640          * this context in the TLB. Don't program 2nd dtlb for ism hat.
9641          */
9642         if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9643                 mmu_set_ctx_page_sizes(sfmmup);
9644         }
9645 
9646         /*
9647          * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9648          * interrupts disabled to prevent race condition with wrap-around
9649          * ctx invalidatation. In sun4v, ctx invalidation also involves
9650          * a HV call to set the number of TSBs to 0. If interrupts are not
9651          * disabled until after sfmmu_load_mmustate is complete TSBs may
9652          * become assigned to INVALID_CONTEXT. This is not allowed.
9653          */
9654         pstate_save = sfmmu_disable_intrs();
9655 
9656         if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9657             sfmmup->sfmmu_scdp != NULL) {
9658                 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9659                 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9660                 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9661                 /* debug purpose only */
9662                 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9663                     != INVALID_CONTEXT);
9664         }
9665         sfmmu_load_mmustate(sfmmup);
9666 
9667         sfmmu_enable_intrs(pstate_save);
9668 
9669         kpreempt_enable();
9670 }
9671 
9672 /*
9673  * When all cnums are used up in a MMU, cnum will wrap around to the
9674  * next generation and start from 2.
9675  */
9676 static void
9677 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9678 {
9679 
9680         /* caller must have disabled the preemption */
9681         ASSERT(curthread->t_preempt >= 1);
9682         ASSERT(mmu_ctxp != NULL);
9683 
9684         /* acquire Per-MMU (PM) spin lock */
9685         mutex_enter(&mmu_ctxp->mmu_lock);
9686 
9687         /* re-check to see if wrap-around is needed */
9688         if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9689                 goto done;
9690 
9691         SFMMU_MMU_STAT(mmu_wrap_around);
9692 
9693         /* update gnum */
9694         ASSERT(mmu_ctxp->mmu_gnum != 0);
9695         mmu_ctxp->mmu_gnum++;
9696         if (mmu_ctxp->mmu_gnum == 0 ||
9697             mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9698                 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9699                     (void *)mmu_ctxp);
9700         }
9701 
9702         if (mmu_ctxp->mmu_ncpus > 1) {
9703                 cpuset_t cpuset;
9704 
9705                 membar_enter(); /* make sure updated gnum visible */
9706 
9707                 SFMMU_XCALL_STATS(NULL);
9708 
9709                 /* xcall to others on the same MMU to invalidate ctx */
9710                 cpuset = mmu_ctxp->mmu_cpuset;
9711                 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9712                 CPUSET_DEL(cpuset, CPU->cpu_id);
9713                 CPUSET_AND(cpuset, cpu_ready_set);
9714 
9715                 /*
9716                  * Pass in INVALID_CONTEXT as the first parameter to
9717                  * sfmmu_raise_tsb_exception, which invalidates the context
9718                  * of any process running on the CPUs in the MMU.
9719                  */
9720                 xt_some(cpuset, sfmmu_raise_tsb_exception,
9721                     INVALID_CONTEXT, INVALID_CONTEXT);
9722                 xt_sync(cpuset);
9723 
9724                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9725         }
9726 
9727         if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9728                 sfmmu_setctx_sec(INVALID_CONTEXT);
9729                 sfmmu_clear_utsbinfo();
9730         }
9731 
9732         /*
9733          * No xcall is needed here. For sun4u systems all CPUs in context
9734          * domain share a single physical MMU therefore it's enough to flush
9735          * TLB on local CPU. On sun4v systems we use 1 global context
9736          * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9737          * handler. Note that vtag_flushall_uctxs() is called
9738          * for Ultra II machine, where the equivalent flushall functionality
9739          * is implemented in SW, and only user ctx TLB entries are flushed.
9740          */
9741         if (&vtag_flushall_uctxs != NULL) {
9742                 vtag_flushall_uctxs();
9743         } else {
9744                 vtag_flushall();
9745         }
9746 
9747         /* reset mmu cnum, skips cnum 0 and 1 */
9748         if (reset_cnum == B_TRUE)
9749                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9750 
9751 done:
9752         mutex_exit(&mmu_ctxp->mmu_lock);
9753 }
9754 
9755 
9756 /*
9757  * For multi-threaded process, set the process context to INVALID_CONTEXT
9758  * so that it faults and reloads the MMU state from TL=0. For single-threaded
9759  * process, we can just load the MMU state directly without having to
9760  * set context invalid. Caller must hold the hat lock since we don't
9761  * acquire it here.
9762  */
9763 static void
9764 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9765 {
9766         uint_t cnum;
9767         uint_t pstate_save;
9768 
9769         ASSERT(sfmmup != ksfmmup);
9770         ASSERT(sfmmu_hat_lock_held(sfmmup));
9771 
9772         kpreempt_disable();
9773 
9774         /*
9775          * We check whether the pass'ed-in sfmmup is the same as the
9776          * current running proc. This is to makes sure the current proc
9777          * stays single-threaded if it already is.
9778          */
9779         if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9780             (curthread->t_procp->p_lwpcnt == 1)) {
9781                 /* single-thread */
9782                 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9783                 if (cnum != INVALID_CONTEXT) {
9784                         uint_t curcnum;
9785                         /*
9786                          * Disable interrupts to prevent race condition
9787                          * with sfmmu_ctx_wrap_around ctx invalidation.
9788                          * In sun4v, ctx invalidation involves setting
9789                          * TSB to NULL, hence, interrupts should be disabled
9790                          * untill after sfmmu_load_mmustate is completed.
9791                          */
9792                         pstate_save = sfmmu_disable_intrs();
9793                         curcnum = sfmmu_getctx_sec();
9794                         if (curcnum == cnum)
9795                                 sfmmu_load_mmustate(sfmmup);
9796                         sfmmu_enable_intrs(pstate_save);
9797                         ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9798                 }
9799         } else {
9800                 /*
9801                  * multi-thread
9802                  * or when sfmmup is not the same as the curproc.
9803                  */
9804                 sfmmu_invalidate_ctx(sfmmup);
9805         }
9806 
9807         kpreempt_enable();
9808 }
9809 
9810 
9811 /*
9812  * Replace the specified TSB with a new TSB.  This function gets called when
9813  * we grow, shrink or swapin a TSB.  When swapping in a TSB (TSB_SWAPIN), the
9814  * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9815  * (8K).
9816  *
9817  * Caller must hold the HAT lock, but should assume any tsb_info
9818  * pointers it has are no longer valid after calling this function.
9819  *
9820  * Return values:
9821  *      TSB_ALLOCFAIL   Failed to allocate a TSB, due to memory constraints
9822  *      TSB_LOSTRACE    HAT is busy, i.e. another thread is already doing
9823  *                      something to this tsbinfo/TSB
9824  *      TSB_SUCCESS     Operation succeeded
9825  */
9826 static tsb_replace_rc_t
9827 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
9828     hatlock_t *hatlockp, uint_t flags)
9829 {
9830         struct tsb_info *new_tsbinfo = NULL;
9831         struct tsb_info *curtsb, *prevtsb;
9832         uint_t tte_sz_mask;
9833         int i;
9834 
9835         ASSERT(sfmmup != ksfmmup);
9836         ASSERT(sfmmup->sfmmu_ismhat == 0);
9837         ASSERT(sfmmu_hat_lock_held(sfmmup));
9838         ASSERT(szc <= tsb_max_growsize);
9839 
9840         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
9841                 return (TSB_LOSTRACE);
9842 
9843         /*
9844          * Find the tsb_info ahead of this one in the list, and
9845          * also make sure that the tsb_info passed in really
9846          * exists!
9847          */
9848         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9849             curtsb != old_tsbinfo && curtsb != NULL;
9850             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9851                 ;
9852         ASSERT(curtsb != NULL);
9853 
9854         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9855                 /*
9856                  * The process is swapped out, so just set the new size
9857                  * code.  When it swaps back in, we'll allocate a new one
9858                  * of the new chosen size.
9859                  */
9860                 curtsb->tsb_szc = szc;
9861                 return (TSB_SUCCESS);
9862         }
9863         SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
9864 
9865         tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
9866 
9867         /*
9868          * All initialization is done inside of sfmmu_tsbinfo_alloc().
9869          * If we fail to allocate a TSB, exit.
9870          *
9871          * If tsb grows with new tsb size > 4M and old tsb size < 4M,
9872          * then try 4M slab after the initial alloc fails.
9873          *
9874          * If tsb swapin with tsb size > 4M, then try 4M after the
9875          * initial alloc fails.
9876          */
9877         sfmmu_hat_exit(hatlockp);
9878         if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
9879             tte_sz_mask, flags, sfmmup) &&
9880             (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
9881             (!(flags & TSB_SWAPIN) &&
9882             (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
9883             sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
9884             tte_sz_mask, flags, sfmmup))) {
9885                 (void) sfmmu_hat_enter(sfmmup);
9886                 if (!(flags & TSB_SWAPIN))
9887                         SFMMU_STAT(sf_tsb_resize_failures);
9888                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9889                 return (TSB_ALLOCFAIL);
9890         }
9891         (void) sfmmu_hat_enter(sfmmup);
9892 
9893         /*
9894          * Re-check to make sure somebody else didn't muck with us while we
9895          * didn't hold the HAT lock.  If the process swapped out, fine, just
9896          * exit; this can happen if we try to shrink the TSB from the context
9897          * of another process (such as on an ISM unmap), though it is rare.
9898          */
9899         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9900                 SFMMU_STAT(sf_tsb_resize_failures);
9901                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9902                 sfmmu_hat_exit(hatlockp);
9903                 sfmmu_tsbinfo_free(new_tsbinfo);
9904                 (void) sfmmu_hat_enter(sfmmup);
9905                 return (TSB_LOSTRACE);
9906         }
9907 
9908 #ifdef  DEBUG
9909         /* Reverify that the tsb_info still exists.. for debugging only */
9910         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9911             curtsb != old_tsbinfo && curtsb != NULL;
9912             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9913                 ;
9914         ASSERT(curtsb != NULL);
9915 #endif  /* DEBUG */
9916 
9917         /*
9918          * Quiesce any CPUs running this process on their next TLB miss
9919          * so they atomically see the new tsb_info.  We temporarily set the
9920          * context to invalid context so new threads that come on processor
9921          * after we do the xcall to cpusran will also serialize behind the
9922          * HAT lock on TLB miss and will see the new TSB.  Since this short
9923          * race with a new thread coming on processor is relatively rare,
9924          * this synchronization mechanism should be cheaper than always
9925          * pausing all CPUs for the duration of the setup, which is what
9926          * the old implementation did.  This is particuarly true if we are
9927          * copying a huge chunk of memory around during that window.
9928          *
9929          * The memory barriers are to make sure things stay consistent
9930          * with resume() since it does not hold the HAT lock while
9931          * walking the list of tsb_info structures.
9932          */
9933         if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
9934                 /* The TSB is either growing or shrinking. */
9935                 sfmmu_invalidate_ctx(sfmmup);
9936         } else {
9937                 /*
9938                  * It is illegal to swap in TSBs from a process other
9939                  * than a process being swapped in.  This in turn
9940                  * implies we do not have a valid MMU context here
9941                  * since a process needs one to resolve translation
9942                  * misses.
9943                  */
9944                 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
9945         }
9946 
9947 #ifdef DEBUG
9948         ASSERT(max_mmu_ctxdoms > 0);
9949 
9950         /*
9951          * Process should have INVALID_CONTEXT on all MMUs
9952          */
9953         for (i = 0; i < max_mmu_ctxdoms; i++) {
9954 
9955                 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
9956         }
9957 #endif
9958 
9959         new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
9960         membar_stst();  /* strict ordering required */
9961         if (prevtsb)
9962                 prevtsb->tsb_next = new_tsbinfo;
9963         else
9964                 sfmmup->sfmmu_tsb = new_tsbinfo;
9965         membar_enter(); /* make sure new TSB globally visible */
9966 
9967         /*
9968          * We need to migrate TSB entries from the old TSB to the new TSB
9969          * if tsb_remap_ttes is set and the TSB is growing.
9970          */
9971         if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
9972                 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
9973 
9974         SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9975 
9976         /*
9977          * Drop the HAT lock to free our old tsb_info.
9978          */
9979         sfmmu_hat_exit(hatlockp);
9980 
9981         if ((flags & TSB_GROW) == TSB_GROW) {
9982                 SFMMU_STAT(sf_tsb_grow);
9983         } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
9984                 SFMMU_STAT(sf_tsb_shrink);
9985         }
9986 
9987         sfmmu_tsbinfo_free(old_tsbinfo);
9988 
9989         (void) sfmmu_hat_enter(sfmmup);
9990         return (TSB_SUCCESS);
9991 }
9992 
9993 /*
9994  * This function will re-program hat pgsz array, and invalidate the
9995  * process' context, forcing the process to switch to another
9996  * context on the next TLB miss, and therefore start using the
9997  * TLB that is reprogrammed for the new page sizes.
9998  */
9999 void
10000 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
10001 {
10002         int i;
10003         hatlock_t *hatlockp = NULL;
10004 
10005         hatlockp = sfmmu_hat_enter(sfmmup);
10006         /* USIII+-IV+ optimization, requires hat lock */
10007         if (tmp_pgsz) {
10008                 for (i = 0; i < mmu_page_sizes; i++)
10009                         sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
10010         }
10011         SFMMU_STAT(sf_tlb_reprog_pgsz);
10012 
10013         sfmmu_invalidate_ctx(sfmmup);
10014 
10015         sfmmu_hat_exit(hatlockp);
10016 }
10017 
10018 /*
10019  * The scd_rttecnt field in the SCD must be updated to take account of the
10020  * regions which it contains.
10021  */
10022 static void
10023 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10024 {
10025         uint_t rid;
10026         uint_t i, j;
10027         ulong_t w;
10028         sf_region_t *rgnp;
10029 
10030         ASSERT(srdp != NULL);
10031 
10032         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10033                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10034                         continue;
10035                 }
10036 
10037                 j = 0;
10038                 while (w) {
10039                         if (!(w & 0x1)) {
10040                                 j++;
10041                                 w >>= 1;
10042                                 continue;
10043                         }
10044                         rid = (i << BT_ULSHIFT) | j;
10045                         j++;
10046                         w >>= 1;
10047 
10048                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10049                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10050                         rgnp = srdp->srd_hmergnp[rid];
10051                         ASSERT(rgnp->rgn_refcnt > 0);
10052                         ASSERT(rgnp->rgn_id == rid);
10053 
10054                         scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10055                             rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10056 
10057                         /*
10058                          * Maintain the tsb0 inflation cnt for the regions
10059                          * in the SCD.
10060                          */
10061                         if (rgnp->rgn_pgszc >= TTE4M) {
10062                                 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10063                                     rgnp->rgn_size >>
10064                                     (TTE_PAGE_SHIFT(TTE8K) + 2);
10065                         }
10066                 }
10067         }
10068 }
10069 
10070 /*
10071  * This function assumes that there are either four or six supported page
10072  * sizes and at most two programmable TLBs, so we need to decide which
10073  * page sizes are most important and then tell the MMU layer so it
10074  * can adjust the TLB page sizes accordingly (if supported).
10075  *
10076  * If these assumptions change, this function will need to be
10077  * updated to support whatever the new limits are.
10078  *
10079  * The growing flag is nonzero if we are growing the address space,
10080  * and zero if it is shrinking.  This allows us to decide whether
10081  * to grow or shrink our TSB, depending upon available memory
10082  * conditions.
10083  */
10084 static void
10085 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10086 {
10087         uint64_t ttecnt[MMU_PAGE_SIZES];
10088         uint64_t tte8k_cnt, tte4m_cnt;
10089         uint8_t i;
10090         int sectsb_thresh;
10091 
10092         /*
10093          * Kernel threads, processes with small address spaces not using
10094          * large pages, and dummy ISM HATs need not apply.
10095          */
10096         if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10097                 return;
10098 
10099         if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10100             sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10101                 return;
10102 
10103         for (i = 0; i < mmu_page_sizes; i++) {
10104                 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10105                     sfmmup->sfmmu_ismttecnt[i];
10106         }
10107 
10108         /* Check pagesizes in use, and possibly reprogram DTLB. */
10109         if (&mmu_check_page_sizes)
10110                 mmu_check_page_sizes(sfmmup, ttecnt);
10111 
10112         /*
10113          * Calculate the number of 8k ttes to represent the span of these
10114          * pages.
10115          */
10116         tte8k_cnt = ttecnt[TTE8K] +
10117             (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10118             (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10119         if (mmu_page_sizes == max_mmu_page_sizes) {
10120                 tte4m_cnt = ttecnt[TTE4M] +
10121                     (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10122                     (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10123         } else {
10124                 tte4m_cnt = ttecnt[TTE4M];
10125         }
10126 
10127         /*
10128          * Inflate tte8k_cnt to allow for region large page allocation failure.
10129          */
10130         tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10131 
10132         /*
10133          * Inflate TSB sizes by a factor of 2 if this process
10134          * uses 4M text pages to minimize extra conflict misses
10135          * in the first TSB since without counting text pages
10136          * 8K TSB may become too small.
10137          *
10138          * Also double the size of the second TSB to minimize
10139          * extra conflict misses due to competition between 4M text pages
10140          * and data pages.
10141          *
10142          * We need to adjust the second TSB allocation threshold by the
10143          * inflation factor, since there is no point in creating a second
10144          * TSB when we know all the mappings can fit in the I/D TLBs.
10145          */
10146         sectsb_thresh = tsb_sectsb_threshold;
10147         if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10148                 tte8k_cnt <<= 1;
10149                 tte4m_cnt <<= 1;
10150                 sectsb_thresh <<= 1;
10151         }
10152 
10153         /*
10154          * Check to see if our TSB is the right size; we may need to
10155          * grow or shrink it.  If the process is small, our work is
10156          * finished at this point.
10157          */
10158         if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10159                 return;
10160         }
10161         sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10162 }
10163 
10164 static void
10165 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10166         uint64_t tte4m_cnt, int sectsb_thresh)
10167 {
10168         int tsb_bits;
10169         uint_t tsb_szc;
10170         struct tsb_info *tsbinfop;
10171         hatlock_t *hatlockp = NULL;
10172 
10173         hatlockp = sfmmu_hat_enter(sfmmup);
10174         ASSERT(hatlockp != NULL);
10175         tsbinfop = sfmmup->sfmmu_tsb;
10176         ASSERT(tsbinfop != NULL);
10177 
10178         /*
10179          * If we're growing, select the size based on RSS.  If we're
10180          * shrinking, leave some room so we don't have to turn around and
10181          * grow again immediately.
10182          */
10183         if (growing)
10184                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10185         else
10186                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10187 
10188         if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10189             (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10190                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10191                     hatlockp, TSB_SHRINK);
10192         } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10193                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10194                     hatlockp, TSB_GROW);
10195         }
10196         tsbinfop = sfmmup->sfmmu_tsb;
10197 
10198         /*
10199          * With the TLB and first TSB out of the way, we need to see if
10200          * we need a second TSB for 4M pages.  If we managed to reprogram
10201          * the TLB page sizes above, the process will start using this new
10202          * TSB right away; otherwise, it will start using it on the next
10203          * context switch.  Either way, it's no big deal so there's no
10204          * synchronization with the trap handlers here unless we grow the
10205          * TSB (in which case it's required to prevent using the old one
10206          * after it's freed). Note: second tsb is required for 32M/256M
10207          * page sizes.
10208          */
10209         if (tte4m_cnt > sectsb_thresh) {
10210                 /*
10211                  * If we're growing, select the size based on RSS.  If we're
10212                  * shrinking, leave some room so we don't have to turn
10213                  * around and grow again immediately.
10214                  */
10215                 if (growing)
10216                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10217                 else
10218                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10219                 if (tsbinfop->tsb_next == NULL) {
10220                         struct tsb_info *newtsb;
10221                         int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10222                             0 : TSB_ALLOC;
10223 
10224                         sfmmu_hat_exit(hatlockp);
10225 
10226                         /*
10227                          * Try to allocate a TSB for 4[32|256]M pages.  If we
10228                          * can't get the size we want, retry w/a minimum sized
10229                          * TSB.  If that still didn't work, give up; we can
10230                          * still run without one.
10231                          */
10232                         tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10233                             TSB4M|TSB32M|TSB256M:TSB4M;
10234                         if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10235                             allocflags, sfmmup)) &&
10236                             (tsb_szc <= TSB_4M_SZCODE ||
10237                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10238                             tsb_bits, allocflags, sfmmup)) &&
10239                             sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10240                             tsb_bits, allocflags, sfmmup)) {
10241                                 return;
10242                         }
10243 
10244                         hatlockp = sfmmu_hat_enter(sfmmup);
10245 
10246                         sfmmu_invalidate_ctx(sfmmup);
10247 
10248                         if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10249                                 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10250                                 SFMMU_STAT(sf_tsb_sectsb_create);
10251                                 sfmmu_hat_exit(hatlockp);
10252                                 return;
10253                         } else {
10254                                 /*
10255                                  * It's annoying, but possible for us
10256                                  * to get here.. we dropped the HAT lock
10257                                  * because of locking order in the kmem
10258                                  * allocator, and while we were off getting
10259                                  * our memory, some other thread decided to
10260                                  * do us a favor and won the race to get a
10261                                  * second TSB for this process.  Sigh.
10262                                  */
10263                                 sfmmu_hat_exit(hatlockp);
10264                                 sfmmu_tsbinfo_free(newtsb);
10265                                 return;
10266                         }
10267                 }
10268 
10269                 /*
10270                  * We have a second TSB, see if it's big enough.
10271                  */
10272                 tsbinfop = tsbinfop->tsb_next;
10273 
10274                 /*
10275                  * Check to see if our second TSB is the right size;
10276                  * we may need to grow or shrink it.
10277                  * To prevent thrashing (e.g. growing the TSB on a
10278                  * subsequent map operation), only try to shrink if
10279                  * the TSB reach exceeds twice the virtual address
10280                  * space size.
10281                  */
10282                 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10283                     (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10284                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10285                             tsb_szc, hatlockp, TSB_SHRINK);
10286                 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10287                     TSB_OK_GROW()) {
10288                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10289                             tsb_szc, hatlockp, TSB_GROW);
10290                 }
10291         }
10292 
10293         sfmmu_hat_exit(hatlockp);
10294 }
10295 
10296 /*
10297  * Free up a sfmmu
10298  * Since the sfmmu is currently embedded in the hat struct we simply zero
10299  * out our fields and free up the ism map blk list if any.
10300  */
10301 static void
10302 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10303 {
10304         ism_blk_t       *blkp, *nx_blkp;
10305 #ifdef  DEBUG
10306         ism_map_t       *map;
10307         int             i;
10308 #endif
10309 
10310         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10311         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10312         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10313         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10314         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10315         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10316         ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10317 
10318         sfmmup->sfmmu_free = 0;
10319         sfmmup->sfmmu_ismhat = 0;
10320 
10321         blkp = sfmmup->sfmmu_iblk;
10322         sfmmup->sfmmu_iblk = NULL;
10323 
10324         while (blkp) {
10325 #ifdef  DEBUG
10326                 map = blkp->iblk_maps;
10327                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10328                         ASSERT(map[i].imap_seg == 0);
10329                         ASSERT(map[i].imap_ismhat == NULL);
10330                         ASSERT(map[i].imap_ment == NULL);
10331                 }
10332 #endif
10333                 nx_blkp = blkp->iblk_next;
10334                 blkp->iblk_next = NULL;
10335                 blkp->iblk_nextpa = (uint64_t)-1;
10336                 kmem_cache_free(ism_blk_cache, blkp);
10337                 blkp = nx_blkp;
10338         }
10339 }
10340 
10341 /*
10342  * Locking primitves accessed by HATLOCK macros
10343  */
10344 
10345 #define SFMMU_SPL_MTX   (0x0)
10346 #define SFMMU_ML_MTX    (0x1)
10347 
10348 #define SFMMU_MLSPL_MTX(type, pg)       (((type) == SFMMU_SPL_MTX) ? \
10349                                             SPL_HASH(pg) : MLIST_HASH(pg))
10350 
10351 kmutex_t *
10352 sfmmu_page_enter(struct page *pp)
10353 {
10354         return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10355 }
10356 
10357 void
10358 sfmmu_page_exit(kmutex_t *spl)
10359 {
10360         mutex_exit(spl);
10361 }
10362 
10363 int
10364 sfmmu_page_spl_held(struct page *pp)
10365 {
10366         return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10367 }
10368 
10369 kmutex_t *
10370 sfmmu_mlist_enter(struct page *pp)
10371 {
10372         return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10373 }
10374 
10375 void
10376 sfmmu_mlist_exit(kmutex_t *mml)
10377 {
10378         mutex_exit(mml);
10379 }
10380 
10381 int
10382 sfmmu_mlist_held(struct page *pp)
10383 {
10384 
10385         return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10386 }
10387 
10388 /*
10389  * Common code for sfmmu_mlist_enter() and sfmmu_page_enter().  For
10390  * sfmmu_mlist_enter() case mml_table lock array is used and for
10391  * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10392  *
10393  * The lock is taken on a root page so that it protects an operation on all
10394  * constituent pages of a large page pp belongs to.
10395  *
10396  * The routine takes a lock from the appropriate array. The lock is determined
10397  * by hashing the root page. After taking the lock this routine checks if the
10398  * root page has the same size code that was used to determine the root (i.e
10399  * that root hasn't changed).  If root page has the expected p_szc field we
10400  * have the right lock and it's returned to the caller. If root's p_szc
10401  * decreased we release the lock and retry from the beginning.  This case can
10402  * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10403  * value and taking the lock. The number of retries due to p_szc decrease is
10404  * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10405  * determined by hashing pp itself.
10406  *
10407  * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10408  * possible that p_szc can increase. To increase p_szc a thread has to lock
10409  * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10410  * callers that don't hold a page locked recheck if hmeblk through which pp
10411  * was found still maps this pp.  If it doesn't map it anymore returned lock
10412  * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10413  * p_szc increase after taking the lock it returns this lock without further
10414  * retries because in this case the caller doesn't care about which lock was
10415  * taken. The caller will drop it right away.
10416  *
10417  * After the routine returns it's guaranteed that hat_page_demote() can't
10418  * change p_szc field of any of constituent pages of a large page pp belongs
10419  * to as long as pp was either locked at least SHARED prior to this call or
10420  * the caller finds that hment that pointed to this pp still references this
10421  * pp (this also assumes that the caller holds hme hash bucket lock so that
10422  * the same pp can't be remapped into the same hmeblk after it was unmapped by
10423  * hat_pageunload()).
10424  */
10425 static kmutex_t *
10426 sfmmu_mlspl_enter(struct page *pp, int type)
10427 {
10428         kmutex_t        *mtx;
10429         uint_t          prev_rszc = UINT_MAX;
10430         page_t          *rootpp;
10431         uint_t          szc;
10432         uint_t          rszc;
10433         uint_t          pszc = pp->p_szc;
10434 
10435         ASSERT(pp != NULL);
10436 
10437 again:
10438         if (pszc == 0) {
10439                 mtx = SFMMU_MLSPL_MTX(type, pp);
10440                 mutex_enter(mtx);
10441                 return (mtx);
10442         }
10443 
10444         /* The lock lives in the root page */
10445         rootpp = PP_GROUPLEADER(pp, pszc);
10446         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10447         mutex_enter(mtx);
10448 
10449         /*
10450          * Return mml in the following 3 cases:
10451          *
10452          * 1) If pp itself is root since if its p_szc decreased before we took
10453          * the lock pp is still the root of smaller szc page. And if its p_szc
10454          * increased it doesn't matter what lock we return (see comment in
10455          * front of this routine).
10456          *
10457          * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10458          * large page we have the right lock since any previous potential
10459          * hat_page_demote() is done demoting from greater than current root's
10460          * p_szc because hat_page_demote() changes root's p_szc last. No
10461          * further hat_page_demote() can start or be in progress since it
10462          * would need the same lock we currently hold.
10463          *
10464          * 3) If rootpp's p_szc increased since previous iteration it doesn't
10465          * matter what lock we return (see comment in front of this routine).
10466          */
10467         if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10468             rszc >= prev_rszc) {
10469                 return (mtx);
10470         }
10471 
10472         /*
10473          * hat_page_demote() could have decreased root's p_szc.
10474          * In this case pp's p_szc must also be smaller than pszc.
10475          * Retry.
10476          */
10477         if (rszc < pszc) {
10478                 szc = pp->p_szc;
10479                 if (szc < pszc) {
10480                         mutex_exit(mtx);
10481                         pszc = szc;
10482                         goto again;
10483                 }
10484                 /*
10485                  * pp's p_szc increased after it was decreased.
10486                  * page cannot be mapped. Return current lock. The caller
10487                  * will drop it right away.
10488                  */
10489                 return (mtx);
10490         }
10491 
10492         /*
10493          * root's p_szc is greater than pp's p_szc.
10494          * hat_page_demote() is not done with all pages
10495          * yet. Wait for it to complete.
10496          */
10497         mutex_exit(mtx);
10498         rootpp = PP_GROUPLEADER(rootpp, rszc);
10499         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10500         mutex_enter(mtx);
10501         mutex_exit(mtx);
10502         prev_rszc = rszc;
10503         goto again;
10504 }
10505 
10506 static int
10507 sfmmu_mlspl_held(struct page *pp, int type)
10508 {
10509         kmutex_t        *mtx;
10510 
10511         ASSERT(pp != NULL);
10512         /* The lock lives in the root page */
10513         pp = PP_PAGEROOT(pp);
10514         ASSERT(pp != NULL);
10515 
10516         mtx = SFMMU_MLSPL_MTX(type, pp);
10517         return (MUTEX_HELD(mtx));
10518 }
10519 
10520 static uint_t
10521 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10522 {
10523         struct  hme_blk *hblkp;
10524 
10525 
10526         if (freehblkp != NULL) {
10527                 mutex_enter(&freehblkp_lock);
10528                 if (freehblkp != NULL) {
10529                         /*
10530                          * If the current thread is owning hblk_reserve OR
10531                          * critical request from sfmmu_hblk_steal()
10532                          * let it succeed even if freehblkcnt is really low.
10533                          */
10534                         if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10535                                 SFMMU_STAT(sf_get_free_throttle);
10536                                 mutex_exit(&freehblkp_lock);
10537                                 return (0);
10538                         }
10539                         freehblkcnt--;
10540                         *hmeblkpp = freehblkp;
10541                         hblkp = *hmeblkpp;
10542                         freehblkp = hblkp->hblk_next;
10543                         mutex_exit(&freehblkp_lock);
10544                         hblkp->hblk_next = NULL;
10545                         SFMMU_STAT(sf_get_free_success);
10546 
10547                         ASSERT(hblkp->hblk_hmecnt == 0);
10548                         ASSERT(hblkp->hblk_vcnt == 0);
10549                         ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10550 
10551                         return (1);
10552                 }
10553                 mutex_exit(&freehblkp_lock);
10554         }
10555 
10556         /* Check cpu hblk pending queues */
10557         if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10558                 hblkp = *hmeblkpp;
10559                 hblkp->hblk_next = NULL;
10560                 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10561 
10562                 ASSERT(hblkp->hblk_hmecnt == 0);
10563                 ASSERT(hblkp->hblk_vcnt == 0);
10564 
10565                 return (1);
10566         }
10567 
10568         SFMMU_STAT(sf_get_free_fail);
10569         return (0);
10570 }
10571 
10572 static uint_t
10573 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10574 {
10575         struct  hme_blk *hblkp;
10576 
10577         ASSERT(hmeblkp->hblk_hmecnt == 0);
10578         ASSERT(hmeblkp->hblk_vcnt == 0);
10579         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10580 
10581         /*
10582          * If the current thread is mapping into kernel space,
10583          * let it succede even if freehblkcnt is max
10584          * so that it will avoid freeing it to kmem.
10585          * This will prevent stack overflow due to
10586          * possible recursion since kmem_cache_free()
10587          * might require creation of a slab which
10588          * in turn needs an hmeblk to map that slab;
10589          * let's break this vicious chain at the first
10590          * opportunity.
10591          */
10592         if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10593                 mutex_enter(&freehblkp_lock);
10594                 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10595                         SFMMU_STAT(sf_put_free_success);
10596                         freehblkcnt++;
10597                         hmeblkp->hblk_next = freehblkp;
10598                         freehblkp = hmeblkp;
10599                         mutex_exit(&freehblkp_lock);
10600                         return (1);
10601                 }
10602                 mutex_exit(&freehblkp_lock);
10603         }
10604 
10605         /*
10606          * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10607          * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10608          * we are not in the process of mapping into kernel space.
10609          */
10610         ASSERT(!critical);
10611         while (freehblkcnt > HBLK_RESERVE_CNT) {
10612                 mutex_enter(&freehblkp_lock);
10613                 if (freehblkcnt > HBLK_RESERVE_CNT) {
10614                         freehblkcnt--;
10615                         hblkp = freehblkp;
10616                         freehblkp = hblkp->hblk_next;
10617                         mutex_exit(&freehblkp_lock);
10618                         ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10619                         kmem_cache_free(sfmmu8_cache, hblkp);
10620                         continue;
10621                 }
10622                 mutex_exit(&freehblkp_lock);
10623         }
10624         SFMMU_STAT(sf_put_free_fail);
10625         return (0);
10626 }
10627 
10628 static void
10629 sfmmu_hblk_swap(struct hme_blk *new)
10630 {
10631         struct hme_blk *old, *hblkp, *prev;
10632         uint64_t newpa;
10633         caddr_t base, vaddr, endaddr;
10634         struct hmehash_bucket *hmebp;
10635         struct sf_hment *osfhme, *nsfhme;
10636         page_t *pp;
10637         kmutex_t *pml;
10638         tte_t tte;
10639         struct hme_blk *list = NULL;
10640 
10641 #ifdef  DEBUG
10642         hmeblk_tag              hblktag;
10643         struct hme_blk          *found;
10644 #endif
10645         old = HBLK_RESERVE;
10646         ASSERT(!old->hblk_shared);
10647 
10648         /*
10649          * save pa before bcopy clobbers it
10650          */
10651         newpa = new->hblk_nextpa;
10652 
10653         base = (caddr_t)get_hblk_base(old);
10654         endaddr = base + get_hblk_span(old);
10655 
10656         /*
10657          * acquire hash bucket lock.
10658          */
10659         hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10660             SFMMU_INVALID_SHMERID);
10661 
10662         /*
10663          * copy contents from old to new
10664          */
10665         bcopy((void *)old, (void *)new, HME8BLK_SZ);
10666 
10667         /*
10668          * add new to hash chain
10669          */
10670         sfmmu_hblk_hash_add(hmebp, new, newpa);
10671 
10672         /*
10673          * search hash chain for hblk_reserve; this needs to be performed
10674          * after adding new, otherwise prev won't correspond to the hblk which
10675          * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10676          * remove old later.
10677          */
10678         for (prev = NULL,
10679             hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10680             prev = hblkp, hblkp = hblkp->hblk_next)
10681                 ;
10682 
10683         if (hblkp != old)
10684                 panic("sfmmu_hblk_swap: hblk_reserve not found");
10685 
10686         /*
10687          * p_mapping list is still pointing to hments in hblk_reserve;
10688          * fix up p_mapping list so that they point to hments in new.
10689          *
10690          * Since all these mappings are created by hblk_reserve_thread
10691          * on the way and it's using at least one of the buffers from each of
10692          * the newly minted slabs, there is no danger of any of these
10693          * mappings getting unloaded by another thread.
10694          *
10695          * tsbmiss could only modify ref/mod bits of hments in old/new.
10696          * Since all of these hments hold mappings established by segkmem
10697          * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10698          * have no meaning for the mappings in hblk_reserve.  hments in
10699          * old and new are identical except for ref/mod bits.
10700          */
10701         for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10702 
10703                 HBLKTOHME(osfhme, old, vaddr);
10704                 sfmmu_copytte(&osfhme->hme_tte, &tte);
10705 
10706                 if (TTE_IS_VALID(&tte)) {
10707                         if ((pp = osfhme->hme_page) == NULL)
10708                                 panic("sfmmu_hblk_swap: page not mapped");
10709 
10710                         pml = sfmmu_mlist_enter(pp);
10711 
10712                         if (pp != osfhme->hme_page)
10713                                 panic("sfmmu_hblk_swap: mapping changed");
10714 
10715                         HBLKTOHME(nsfhme, new, vaddr);
10716 
10717                         HME_ADD(nsfhme, pp);
10718                         HME_SUB(osfhme, pp);
10719 
10720                         sfmmu_mlist_exit(pml);
10721                 }
10722         }
10723 
10724         /*
10725          * remove old from hash chain
10726          */
10727         sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10728 
10729 #ifdef  DEBUG
10730 
10731         hblktag.htag_id = ksfmmup;
10732         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10733         hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10734         hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10735         HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10736 
10737         if (found != new)
10738                 panic("sfmmu_hblk_swap: new hblk not found");
10739 #endif
10740 
10741         SFMMU_HASH_UNLOCK(hmebp);
10742 
10743         /*
10744          * Reset hblk_reserve
10745          */
10746         bzero((void *)old, HME8BLK_SZ);
10747         old->hblk_nextpa = va_to_pa((caddr_t)old);
10748 }
10749 
10750 /*
10751  * Grab the mlist mutex for both pages passed in.
10752  *
10753  * low and high will be returned as pointers to the mutexes for these pages.
10754  * low refers to the mutex residing in the lower bin of the mlist hash, while
10755  * high refers to the mutex residing in the higher bin of the mlist hash.  This
10756  * is due to the locking order restrictions on the same thread grabbing
10757  * multiple mlist mutexes.  The low lock must be acquired before the high lock.
10758  *
10759  * If both pages hash to the same mutex, only grab that single mutex, and
10760  * high will be returned as NULL
10761  * If the pages hash to different bins in the hash, grab the lower addressed
10762  * lock first and then the higher addressed lock in order to follow the locking
10763  * rules involved with the same thread grabbing multiple mlist mutexes.
10764  * low and high will both have non-NULL values.
10765  */
10766 static void
10767 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10768     kmutex_t **low, kmutex_t **high)
10769 {
10770         kmutex_t        *mml_targ, *mml_repl;
10771 
10772         /*
10773          * no need to do the dance around szc as in sfmmu_mlist_enter()
10774          * because this routine is only called by hat_page_relocate() and all
10775          * targ and repl pages are already locked EXCL so szc can't change.
10776          */
10777 
10778         mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10779         mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10780 
10781         if (mml_targ == mml_repl) {
10782                 *low = mml_targ;
10783                 *high = NULL;
10784         } else {
10785                 if (mml_targ < mml_repl) {
10786                         *low = mml_targ;
10787                         *high = mml_repl;
10788                 } else {
10789                         *low = mml_repl;
10790                         *high = mml_targ;
10791                 }
10792         }
10793 
10794         mutex_enter(*low);
10795         if (*high)
10796                 mutex_enter(*high);
10797 }
10798 
10799 static void
10800 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10801 {
10802         if (high)
10803                 mutex_exit(high);
10804         mutex_exit(low);
10805 }
10806 
10807 static hatlock_t *
10808 sfmmu_hat_enter(sfmmu_t *sfmmup)
10809 {
10810         hatlock_t       *hatlockp;
10811 
10812         if (sfmmup != ksfmmup) {
10813                 hatlockp = TSB_HASH(sfmmup);
10814                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10815                 return (hatlockp);
10816         }
10817         return (NULL);
10818 }
10819 
10820 static hatlock_t *
10821 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
10822 {
10823         hatlock_t       *hatlockp;
10824 
10825         if (sfmmup != ksfmmup) {
10826                 hatlockp = TSB_HASH(sfmmup);
10827                 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
10828                         return (NULL);
10829                 return (hatlockp);
10830         }
10831         return (NULL);
10832 }
10833 
10834 static void
10835 sfmmu_hat_exit(hatlock_t *hatlockp)
10836 {
10837         if (hatlockp != NULL)
10838                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
10839 }
10840 
10841 static void
10842 sfmmu_hat_lock_all(void)
10843 {
10844         int i;
10845         for (i = 0; i < SFMMU_NUM_LOCK; i++)
10846                 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
10847 }
10848 
10849 static void
10850 sfmmu_hat_unlock_all(void)
10851 {
10852         int i;
10853         for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
10854                 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
10855 }
10856 
10857 int
10858 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
10859 {
10860         ASSERT(sfmmup != ksfmmup);
10861         return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
10862 }
10863 
10864 /*
10865  * Locking primitives to provide consistency between ISM unmap
10866  * and other operations.  Since ISM unmap can take a long time, we
10867  * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
10868  * contention on the hatlock buckets while ISM segments are being
10869  * unmapped.  The tradeoff is that the flags don't prevent priority
10870  * inversion from occurring, so we must request kernel priority in
10871  * case we have to sleep to keep from getting buried while holding
10872  * the HAT_ISMBUSY flag set, which in turn could block other kernel
10873  * threads from running (for example, in sfmmu_uvatopfn()).
10874  */
10875 static void
10876 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
10877 {
10878         hatlock_t *hatlockp;
10879 
10880         THREAD_KPRI_REQUEST();
10881         if (!hatlock_held)
10882                 hatlockp = sfmmu_hat_enter(sfmmup);
10883         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
10884                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
10885         SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
10886         if (!hatlock_held)
10887                 sfmmu_hat_exit(hatlockp);
10888 }
10889 
10890 static void
10891 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
10892 {
10893         hatlock_t *hatlockp;
10894 
10895         if (!hatlock_held)
10896                 hatlockp = sfmmu_hat_enter(sfmmup);
10897         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
10898         SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
10899         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
10900         if (!hatlock_held)
10901                 sfmmu_hat_exit(hatlockp);
10902         THREAD_KPRI_RELEASE();
10903 }
10904 
10905 /*
10906  *
10907  * Algorithm:
10908  *
10909  * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
10910  *      hblks.
10911  *
10912  * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
10913  *
10914  *              (a) try to return an hblk from reserve pool of free hblks;
10915  *              (b) if the reserve pool is empty, acquire hblk_reserve_lock
10916  *                  and return hblk_reserve.
10917  *
10918  * (3) call kmem_cache_alloc() to allocate hblk;
10919  *
10920  *              (a) if hblk_reserve_lock is held by the current thread,
10921  *                  atomically replace hblk_reserve by the hblk that is
10922  *                  returned by kmem_cache_alloc; release hblk_reserve_lock
10923  *                  and call kmem_cache_alloc() again.
10924  *              (b) if reserve pool is not full, add the hblk that is
10925  *                  returned by kmem_cache_alloc to reserve pool and
10926  *                  call kmem_cache_alloc again.
10927  *
10928  */
10929 static struct hme_blk *
10930 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
10931         struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
10932         uint_t flags, uint_t rid)
10933 {
10934         struct hme_blk *hmeblkp = NULL;
10935         struct hme_blk *newhblkp;
10936         struct hme_blk *shw_hblkp = NULL;
10937         struct kmem_cache *sfmmu_cache = NULL;
10938         uint64_t hblkpa;
10939         ulong_t index;
10940         uint_t owner;           /* set to 1 if using hblk_reserve */
10941         uint_t forcefree;
10942         int sleep;
10943         sf_srd_t *srdp;
10944         sf_region_t *rgnp;
10945 
10946         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
10947         ASSERT(hblktag.htag_rid == rid);
10948         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
10949         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
10950             IS_P2ALIGNED(vaddr, TTEBYTES(size)));
10951 
10952         /*
10953          * If segkmem is not created yet, allocate from static hmeblks
10954          * created at the end of startup_modules().  See the block comment
10955          * in startup_modules() describing how we estimate the number of
10956          * static hmeblks that will be needed during re-map.
10957          */
10958         if (!hblk_alloc_dynamic) {
10959 
10960                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10961 
10962                 if (size == TTE8K) {
10963                         index = nucleus_hblk8.index;
10964                         if (index >= nucleus_hblk8.len) {
10965                                 /*
10966                                  * If we panic here, see startup_modules() to
10967                                  * make sure that we are calculating the
10968                                  * number of hblk8's that we need correctly.
10969                                  */
10970                                 prom_panic("no nucleus hblk8 to allocate");
10971                         }
10972                         hmeblkp =
10973                             (struct hme_blk *)&nucleus_hblk8.list[index];
10974                         nucleus_hblk8.index++;
10975                         SFMMU_STAT(sf_hblk8_nalloc);
10976                 } else {
10977                         index = nucleus_hblk1.index;
10978                         if (nucleus_hblk1.index >= nucleus_hblk1.len) {
10979                                 /*
10980                                  * If we panic here, see startup_modules().
10981                                  * Most likely you need to update the
10982                                  * calculation of the number of hblk1 elements
10983                                  * that the kernel needs to boot.
10984                                  */
10985                                 prom_panic("no nucleus hblk1 to allocate");
10986                         }
10987                         hmeblkp =
10988                             (struct hme_blk *)&nucleus_hblk1.list[index];
10989                         nucleus_hblk1.index++;
10990                         SFMMU_STAT(sf_hblk1_nalloc);
10991                 }
10992 
10993                 goto hblk_init;
10994         }
10995 
10996         SFMMU_HASH_UNLOCK(hmebp);
10997 
10998         if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
10999                 if (mmu_page_sizes == max_mmu_page_sizes) {
11000                         if (size < TTE256M)
11001                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11002                                     size, flags);
11003                 } else {
11004                         if (size < TTE4M)
11005                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
11006                                     size, flags);
11007                 }
11008         } else if (SFMMU_IS_SHMERID_VALID(rid)) {
11009                 /*
11010                  * Shared hmes use per region bitmaps in rgn_hmeflag
11011                  * rather than shadow hmeblks to keep track of the
11012                  * mapping sizes which have been allocated for the region.
11013                  * Here we cleanup old invalid hmeblks with this rid,
11014                  * which may be left around by pageunload().
11015                  */
11016                 int ttesz;
11017                 caddr_t va;
11018                 caddr_t eva = vaddr + TTEBYTES(size);
11019 
11020                 ASSERT(sfmmup != KHATID);
11021 
11022                 srdp = sfmmup->sfmmu_srdp;
11023                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11024                 rgnp = srdp->srd_hmergnp[rid];
11025                 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11026                 ASSERT(rgnp->rgn_refcnt != 0);
11027                 ASSERT(size <= rgnp->rgn_pgszc);
11028 
11029                 ttesz = HBLK_MIN_TTESZ;
11030                 do {
11031                         if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11032                                 continue;
11033                         }
11034 
11035                         if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11036                                 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11037                         } else if (ttesz < size) {
11038                                 for (va = vaddr; va < eva;
11039                                     va += TTEBYTES(ttesz)) {
11040                                         sfmmu_cleanup_rhblk(srdp, va, rid,
11041                                             ttesz);
11042                                 }
11043                         }
11044                 } while (++ttesz <= rgnp->rgn_pgszc);
11045         }
11046 
11047 fill_hblk:
11048         owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11049 
11050         if (owner && size == TTE8K) {
11051 
11052                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11053                 /*
11054                  * We are really in a tight spot. We already own
11055                  * hblk_reserve and we need another hblk.  In anticipation
11056                  * of this kind of scenario, we specifically set aside
11057                  * HBLK_RESERVE_MIN number of hblks to be used exclusively
11058                  * by owner of hblk_reserve.
11059                  */
11060                 SFMMU_STAT(sf_hblk_recurse_cnt);
11061 
11062                 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11063                         panic("sfmmu_hblk_alloc: reserve list is empty");
11064 
11065                 goto hblk_verify;
11066         }
11067 
11068         ASSERT(!owner);
11069 
11070         if ((flags & HAT_NO_KALLOC) == 0) {
11071 
11072                 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11073                 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11074 
11075                 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11076                         hmeblkp = sfmmu_hblk_steal(size);
11077                 } else {
11078                         /*
11079                          * if we are the owner of hblk_reserve,
11080                          * swap hblk_reserve with hmeblkp and
11081                          * start a fresh life.  Hope things go
11082                          * better this time.
11083                          */
11084                         if (hblk_reserve_thread == curthread) {
11085                                 ASSERT(sfmmu_cache == sfmmu8_cache);
11086                                 sfmmu_hblk_swap(hmeblkp);
11087                                 hblk_reserve_thread = NULL;
11088                                 mutex_exit(&hblk_reserve_lock);
11089                                 goto fill_hblk;
11090                         }
11091                         /*
11092                          * let's donate this hblk to our reserve list if
11093                          * we are not mapping kernel range
11094                          */
11095                         if (size == TTE8K && sfmmup != KHATID) {
11096                                 if (sfmmu_put_free_hblk(hmeblkp, 0))
11097                                         goto fill_hblk;
11098                         }
11099                 }
11100         } else {
11101                 /*
11102                  * We are here to map the slab in sfmmu8_cache; let's
11103                  * check if we could tap our reserve list; if successful,
11104                  * this will avoid the pain of going thru sfmmu_hblk_swap
11105                  */
11106                 SFMMU_STAT(sf_hblk_slab_cnt);
11107                 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11108                         /*
11109                          * let's start hblk_reserve dance
11110                          */
11111                         SFMMU_STAT(sf_hblk_reserve_cnt);
11112                         owner = 1;
11113                         mutex_enter(&hblk_reserve_lock);
11114                         hmeblkp = HBLK_RESERVE;
11115                         hblk_reserve_thread = curthread;
11116                 }
11117         }
11118 
11119 hblk_verify:
11120         ASSERT(hmeblkp != NULL);
11121         set_hblk_sz(hmeblkp, size);
11122         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11123         SFMMU_HASH_LOCK(hmebp);
11124         HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11125         if (newhblkp != NULL) {
11126                 SFMMU_HASH_UNLOCK(hmebp);
11127                 if (hmeblkp != HBLK_RESERVE) {
11128                         /*
11129                          * This is really tricky!
11130                          *
11131                          * vmem_alloc(vmem_seg_arena)
11132                          *  vmem_alloc(vmem_internal_arena)
11133                          *   segkmem_alloc(heap_arena)
11134                          *    vmem_alloc(heap_arena)
11135                          *    page_create()
11136                          *    hat_memload()
11137                          *      kmem_cache_free()
11138                          *       kmem_cache_alloc()
11139                          *        kmem_slab_create()
11140                          *         vmem_alloc(kmem_internal_arena)
11141                          *          segkmem_alloc(heap_arena)
11142                          *              vmem_alloc(heap_arena)
11143                          *              page_create()
11144                          *              hat_memload()
11145                          *                kmem_cache_free()
11146                          *              ...
11147                          *
11148                          * Thus, hat_memload() could call kmem_cache_free
11149                          * for enough number of times that we could easily
11150                          * hit the bottom of the stack or run out of reserve
11151                          * list of vmem_seg structs.  So, we must donate
11152                          * this hblk to reserve list if it's allocated
11153                          * from sfmmu8_cache *and* mapping kernel range.
11154                          * We don't need to worry about freeing hmeblk1's
11155                          * to kmem since they don't map any kmem slabs.
11156                          *
11157                          * Note: When segkmem supports largepages, we must
11158                          * free hmeblk1's to reserve list as well.
11159                          */
11160                         forcefree = (sfmmup == KHATID) ? 1 : 0;
11161                         if (size == TTE8K &&
11162                             sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11163                                 goto re_verify;
11164                         }
11165                         ASSERT(sfmmup != KHATID);
11166                         kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11167                 } else {
11168                         /*
11169                          * Hey! we don't need hblk_reserve any more.
11170                          */
11171                         ASSERT(owner);
11172                         hblk_reserve_thread = NULL;
11173                         mutex_exit(&hblk_reserve_lock);
11174                         owner = 0;
11175                 }
11176 re_verify:
11177                 /*
11178                  * let's check if the goodies are still present
11179                  */
11180                 SFMMU_HASH_LOCK(hmebp);
11181                 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11182                 if (newhblkp != NULL) {
11183                         /*
11184                          * return newhblkp if it's not hblk_reserve;
11185                          * if newhblkp is hblk_reserve, return it
11186                          * _only if_ we are the owner of hblk_reserve.
11187                          */
11188                         if (newhblkp != HBLK_RESERVE || owner) {
11189                                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11190                                     newhblkp->hblk_shared);
11191                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11192                                     !newhblkp->hblk_shared);
11193                                 return (newhblkp);
11194                         } else {
11195                                 /*
11196                                  * we just hit hblk_reserve in the hash and
11197                                  * we are not the owner of that;
11198                                  *
11199                                  * block until hblk_reserve_thread completes
11200                                  * swapping hblk_reserve and try the dance
11201                                  * once again.
11202                                  */
11203                                 SFMMU_HASH_UNLOCK(hmebp);
11204                                 mutex_enter(&hblk_reserve_lock);
11205                                 mutex_exit(&hblk_reserve_lock);
11206                                 SFMMU_STAT(sf_hblk_reserve_hit);
11207                                 goto fill_hblk;
11208                         }
11209                 } else {
11210                         /*
11211                          * it's no more! try the dance once again.
11212                          */
11213                         SFMMU_HASH_UNLOCK(hmebp);
11214                         goto fill_hblk;
11215                 }
11216         }
11217 
11218 hblk_init:
11219         if (SFMMU_IS_SHMERID_VALID(rid)) {
11220                 uint16_t tteflag = 0x1 <<
11221                     ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11222 
11223                 if (!(rgnp->rgn_hmeflags & tteflag)) {
11224                         atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11225                 }
11226                 hmeblkp->hblk_shared = 1;
11227         } else {
11228                 hmeblkp->hblk_shared = 0;
11229         }
11230         set_hblk_sz(hmeblkp, size);
11231         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11232         hmeblkp->hblk_next = (struct hme_blk *)NULL;
11233         hmeblkp->hblk_tag = hblktag;
11234         hmeblkp->hblk_shadow = shw_hblkp;
11235         hblkpa = hmeblkp->hblk_nextpa;
11236         hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11237 
11238         ASSERT(get_hblk_ttesz(hmeblkp) == size);
11239         ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11240         ASSERT(hmeblkp->hblk_hmecnt == 0);
11241         ASSERT(hmeblkp->hblk_vcnt == 0);
11242         ASSERT(hmeblkp->hblk_lckcnt == 0);
11243         ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11244         sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11245         return (hmeblkp);
11246 }
11247 
11248 /*
11249  * This function cleans up the hme_blk and returns it to the free list.
11250  */
11251 /* ARGSUSED */
11252 static void
11253 sfmmu_hblk_free(struct hme_blk **listp)
11254 {
11255         struct hme_blk *hmeblkp, *next_hmeblkp;
11256         int             size;
11257         uint_t          critical;
11258         uint64_t        hblkpa;
11259 
11260         ASSERT(*listp != NULL);
11261 
11262         hmeblkp = *listp;
11263         while (hmeblkp != NULL) {
11264                 next_hmeblkp = hmeblkp->hblk_next;
11265                 ASSERT(!hmeblkp->hblk_hmecnt);
11266                 ASSERT(!hmeblkp->hblk_vcnt);
11267                 ASSERT(!hmeblkp->hblk_lckcnt);
11268                 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11269                 ASSERT(hmeblkp->hblk_shared == 0);
11270                 ASSERT(hmeblkp->hblk_shw_bit == 0);
11271                 ASSERT(hmeblkp->hblk_shadow == NULL);
11272 
11273                 hblkpa = va_to_pa((caddr_t)hmeblkp);
11274                 ASSERT(hblkpa != (uint64_t)-1);
11275                 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11276 
11277                 size = get_hblk_ttesz(hmeblkp);
11278                 hmeblkp->hblk_next = NULL;
11279                 hmeblkp->hblk_nextpa = hblkpa;
11280 
11281                 if (hmeblkp->hblk_nuc_bit == 0) {
11282 
11283                         if (size != TTE8K ||
11284                             !sfmmu_put_free_hblk(hmeblkp, critical))
11285                                 kmem_cache_free(get_hblk_cache(hmeblkp),
11286                                     hmeblkp);
11287                 }
11288                 hmeblkp = next_hmeblkp;
11289         }
11290 }
11291 
11292 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11293 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11294 
11295 static uint_t sfmmu_hblk_steal_twice;
11296 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11297 
11298 /*
11299  * Steal a hmeblk from user or kernel hme hash lists.
11300  * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11301  * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11302  * tap into critical reserve of freehblkp.
11303  * Note: We remain looping in this routine until we find one.
11304  */
11305 static struct hme_blk *
11306 sfmmu_hblk_steal(int size)
11307 {
11308         static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11309         struct hmehash_bucket *hmebp;
11310         struct hme_blk *hmeblkp = NULL, *pr_hblk;
11311         uint64_t hblkpa;
11312         int i;
11313         uint_t loop_cnt = 0, critical;
11314 
11315         for (;;) {
11316                 /* Check cpu hblk pending queues */
11317                 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11318                         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11319                         ASSERT(hmeblkp->hblk_hmecnt == 0);
11320                         ASSERT(hmeblkp->hblk_vcnt == 0);
11321                         return (hmeblkp);
11322                 }
11323 
11324                 if (size == TTE8K) {
11325                         critical =
11326                             (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11327                         if (sfmmu_get_free_hblk(&hmeblkp, critical))
11328                                 return (hmeblkp);
11329                 }
11330 
11331                 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11332                     uhmehash_steal_hand;
11333                 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11334 
11335                 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11336                     BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11337                         SFMMU_HASH_LOCK(hmebp);
11338                         hmeblkp = hmebp->hmeblkp;
11339                         hblkpa = hmebp->hmeh_nextpa;
11340                         pr_hblk = NULL;
11341                         while (hmeblkp) {
11342                                 /*
11343                                  * check if it is a hmeblk that is not locked
11344                                  * and not shared. skip shadow hmeblks with
11345                                  * shadow_mask set i.e valid count non zero.
11346                                  */
11347                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11348                                     (hmeblkp->hblk_shw_bit == 0 ||
11349                                     hmeblkp->hblk_vcnt == 0) &&
11350                                     (hmeblkp->hblk_lckcnt == 0)) {
11351                                         /*
11352                                          * there is a high probability that we
11353                                          * will find a free one. search some
11354                                          * buckets for a free hmeblk initially
11355                                          * before unloading a valid hmeblk.
11356                                          */
11357                                         if ((hmeblkp->hblk_vcnt == 0 &&
11358                                             hmeblkp->hblk_hmecnt == 0) || (i >=
11359                                             BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11360                                                 if (sfmmu_steal_this_hblk(hmebp,
11361                                                     hmeblkp, hblkpa, pr_hblk)) {
11362                                                         /*
11363                                                          * Hblk is unloaded
11364                                                          * successfully
11365                                                          */
11366                                                         break;
11367                                                 }
11368                                         }
11369                                 }
11370                                 pr_hblk = hmeblkp;
11371                                 hblkpa = hmeblkp->hblk_nextpa;
11372                                 hmeblkp = hmeblkp->hblk_next;
11373                         }
11374 
11375                         SFMMU_HASH_UNLOCK(hmebp);
11376                         if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11377                                 hmebp = uhme_hash;
11378                 }
11379                 uhmehash_steal_hand = hmebp;
11380 
11381                 if (hmeblkp != NULL)
11382                         break;
11383 
11384                 /*
11385                  * in the worst case, look for a free one in the kernel
11386                  * hash table.
11387                  */
11388                 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11389                         SFMMU_HASH_LOCK(hmebp);
11390                         hmeblkp = hmebp->hmeblkp;
11391                         hblkpa = hmebp->hmeh_nextpa;
11392                         pr_hblk = NULL;
11393                         while (hmeblkp) {
11394                                 /*
11395                                  * check if it is free hmeblk
11396                                  */
11397                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11398                                     (hmeblkp->hblk_lckcnt == 0) &&
11399                                     (hmeblkp->hblk_vcnt == 0) &&
11400                                     (hmeblkp->hblk_hmecnt == 0)) {
11401                                         if (sfmmu_steal_this_hblk(hmebp,
11402                                             hmeblkp, hblkpa, pr_hblk)) {
11403                                                 break;
11404                                         } else {
11405                                                 /*
11406                                                  * Cannot fail since we have
11407                                                  * hash lock.
11408                                                  */
11409                                                 panic("fail to steal?");
11410                                         }
11411                                 }
11412 
11413                                 pr_hblk = hmeblkp;
11414                                 hblkpa = hmeblkp->hblk_nextpa;
11415                                 hmeblkp = hmeblkp->hblk_next;
11416                         }
11417 
11418                         SFMMU_HASH_UNLOCK(hmebp);
11419                         if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11420                                 hmebp = khme_hash;
11421                 }
11422 
11423                 if (hmeblkp != NULL)
11424                         break;
11425                 sfmmu_hblk_steal_twice++;
11426         }
11427         return (hmeblkp);
11428 }
11429 
11430 /*
11431  * This routine does real work to prepare a hblk to be "stolen" by
11432  * unloading the mappings, updating shadow counts ....
11433  * It returns 1 if the block is ready to be reused (stolen), or 0
11434  * means the block cannot be stolen yet- pageunload is still working
11435  * on this hblk.
11436  */
11437 static int
11438 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11439         uint64_t hblkpa, struct hme_blk *pr_hblk)
11440 {
11441         int shw_size, vshift;
11442         struct hme_blk *shw_hblkp;
11443         caddr_t vaddr;
11444         uint_t shw_mask, newshw_mask;
11445         struct hme_blk *list = NULL;
11446 
11447         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11448 
11449         /*
11450          * check if the hmeblk is free, unload if necessary
11451          */
11452         if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11453                 sfmmu_t *sfmmup;
11454                 demap_range_t dmr;
11455 
11456                 sfmmup = hblktosfmmu(hmeblkp);
11457                 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11458                         return (0);
11459                 }
11460                 DEMAP_RANGE_INIT(sfmmup, &dmr);
11461                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11462                     (caddr_t)get_hblk_base(hmeblkp),
11463                     get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11464                 DEMAP_RANGE_FLUSH(&dmr);
11465                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11466                         /*
11467                          * Pageunload is working on the same hblk.
11468                          */
11469                         return (0);
11470                 }
11471 
11472                 sfmmu_hblk_steal_unload_count++;
11473         }
11474 
11475         ASSERT(hmeblkp->hblk_lckcnt == 0);
11476         ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11477 
11478         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11479         hmeblkp->hblk_nextpa = hblkpa;
11480 
11481         shw_hblkp = hmeblkp->hblk_shadow;
11482         if (shw_hblkp) {
11483                 ASSERT(!hmeblkp->hblk_shared);
11484                 shw_size = get_hblk_ttesz(shw_hblkp);
11485                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11486                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11487                 ASSERT(vshift < 8);
11488                 /*
11489                  * Atomically clear shadow mask bit
11490                  */
11491                 do {
11492                         shw_mask = shw_hblkp->hblk_shw_mask;
11493                         ASSERT(shw_mask & (1 << vshift));
11494                         newshw_mask = shw_mask & ~(1 << vshift);
11495                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11496                             shw_mask, newshw_mask);
11497                 } while (newshw_mask != shw_mask);
11498                 hmeblkp->hblk_shadow = NULL;
11499         }
11500 
11501         /*
11502          * remove shadow bit if we are stealing an unused shadow hmeblk.
11503          * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11504          * we are indeed allocating a shadow hmeblk.
11505          */
11506         hmeblkp->hblk_shw_bit = 0;
11507 
11508         if (hmeblkp->hblk_shared) {
11509                 sf_srd_t        *srdp;
11510                 sf_region_t     *rgnp;
11511                 uint_t          rid;
11512 
11513                 srdp = hblktosrd(hmeblkp);
11514                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11515                 rid = hmeblkp->hblk_tag.htag_rid;
11516                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11517                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11518                 rgnp = srdp->srd_hmergnp[rid];
11519                 ASSERT(rgnp != NULL);
11520                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11521                 hmeblkp->hblk_shared = 0;
11522         }
11523 
11524         sfmmu_hblk_steal_count++;
11525         SFMMU_STAT(sf_steal_count);
11526 
11527         return (1);
11528 }
11529 
11530 struct hme_blk *
11531 sfmmu_hmetohblk(struct sf_hment *sfhme)
11532 {
11533         struct hme_blk *hmeblkp;
11534         struct sf_hment *sfhme0;
11535         struct hme_blk *hblk_dummy = 0;
11536 
11537         /*
11538          * No dummy sf_hments, please.
11539          */
11540         ASSERT(sfhme->hme_tte.ll != 0);
11541 
11542         sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11543         hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11544             (uintptr_t)&hblk_dummy->hblk_hme[0]);
11545 
11546         return (hmeblkp);
11547 }
11548 
11549 /*
11550  * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11551  * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11552  * KM_SLEEP allocation.
11553  *
11554  * Return 0 on success, -1 otherwise.
11555  */
11556 static void
11557 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11558 {
11559         struct tsb_info *tsbinfop, *next;
11560         tsb_replace_rc_t rc;
11561         boolean_t gotfirst = B_FALSE;
11562 
11563         ASSERT(sfmmup != ksfmmup);
11564         ASSERT(sfmmu_hat_lock_held(sfmmup));
11565 
11566         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11567                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11568         }
11569 
11570         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11571                 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11572         } else {
11573                 return;
11574         }
11575 
11576         ASSERT(sfmmup->sfmmu_tsb != NULL);
11577 
11578         /*
11579          * Loop over all tsbinfo's replacing them with ones that actually have
11580          * a TSB.  If any of the replacements ever fail, bail out of the loop.
11581          */
11582         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11583                 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11584                 next = tsbinfop->tsb_next;
11585                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11586                     hatlockp, TSB_SWAPIN);
11587                 if (rc != TSB_SUCCESS) {
11588                         break;
11589                 }
11590                 gotfirst = B_TRUE;
11591         }
11592 
11593         switch (rc) {
11594         case TSB_SUCCESS:
11595                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11596                 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11597                 return;
11598         case TSB_LOSTRACE:
11599                 break;
11600         case TSB_ALLOCFAIL:
11601                 break;
11602         default:
11603                 panic("sfmmu_replace_tsb returned unrecognized failure code "
11604                     "%d", rc);
11605         }
11606 
11607         /*
11608          * In this case, we failed to get one of our TSBs.  If we failed to
11609          * get the first TSB, get one of minimum size (8KB).  Walk the list
11610          * and throw away the tsbinfos, starting where the allocation failed;
11611          * we can get by with just one TSB as long as we don't leave the
11612          * SWAPPED tsbinfo structures lying around.
11613          */
11614         tsbinfop = sfmmup->sfmmu_tsb;
11615         next = tsbinfop->tsb_next;
11616         tsbinfop->tsb_next = NULL;
11617 
11618         sfmmu_hat_exit(hatlockp);
11619         for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11620                 next = tsbinfop->tsb_next;
11621                 sfmmu_tsbinfo_free(tsbinfop);
11622         }
11623         hatlockp = sfmmu_hat_enter(sfmmup);
11624 
11625         /*
11626          * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11627          * pages.
11628          */
11629         if (!gotfirst) {
11630                 tsbinfop = sfmmup->sfmmu_tsb;
11631                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11632                     hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11633                 ASSERT(rc == TSB_SUCCESS);
11634         }
11635 
11636         SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11637         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11638 }
11639 
11640 static int
11641 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11642 {
11643         ulong_t bix = 0;
11644         uint_t rid;
11645         sf_region_t *rgnp;
11646 
11647         ASSERT(srdp != NULL);
11648         ASSERT(srdp->srd_refcnt != 0);
11649 
11650         w <<= BT_ULSHIFT;
11651         while (bmw) {
11652                 if (!(bmw & 0x1)) {
11653                         bix++;
11654                         bmw >>= 1;
11655                         continue;
11656                 }
11657                 rid = w | bix;
11658                 rgnp = srdp->srd_hmergnp[rid];
11659                 ASSERT(rgnp->rgn_refcnt > 0);
11660                 ASSERT(rgnp->rgn_id == rid);
11661                 if (addr < rgnp->rgn_saddr ||
11662                     addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11663                         bix++;
11664                         bmw >>= 1;
11665                 } else {
11666                         return (1);
11667                 }
11668         }
11669         return (0);
11670 }
11671 
11672 /*
11673  * Handle exceptions for low level tsb_handler.
11674  *
11675  * There are many scenarios that could land us here:
11676  *
11677  * If the context is invalid we land here. The context can be invalid
11678  * for 3 reasons: 1) we couldn't allocate a new context and now need to
11679  * perform a wrap around operation in order to allocate a new context.
11680  * 2) Context was invalidated to change pagesize programming 3) ISMs or
11681  * TSBs configuration is changeing for this process and we are forced into
11682  * here to do a syncronization operation. If the context is valid we can
11683  * be here from window trap hanlder. In this case just call trap to handle
11684  * the fault.
11685  *
11686  * Note that the process will run in INVALID_CONTEXT before
11687  * faulting into here and subsequently loading the MMU registers
11688  * (including the TSB base register) associated with this process.
11689  * For this reason, the trap handlers must all test for
11690  * INVALID_CONTEXT before attempting to access any registers other
11691  * than the context registers.
11692  */
11693 void
11694 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11695 {
11696         sfmmu_t *sfmmup, *shsfmmup;
11697         uint_t ctxtype;
11698         klwp_id_t lwp;
11699         char lwp_save_state;
11700         hatlock_t *hatlockp, *shatlockp;
11701         struct tsb_info *tsbinfop;
11702         struct tsbmiss *tsbmp;
11703         sf_scd_t *scdp;
11704 
11705         SFMMU_STAT(sf_tsb_exceptions);
11706         SFMMU_MMU_STAT(mmu_tsb_exceptions);
11707         sfmmup = astosfmmu(curthread->t_procp->p_as);
11708         /*
11709          * note that in sun4u, tagacces register contains ctxnum
11710          * while sun4v passes ctxtype in the tagaccess register.
11711          */
11712         ctxtype = tagaccess & TAGACC_CTX_MASK;
11713 
11714         ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11715         ASSERT(sfmmup->sfmmu_ismhat == 0);
11716         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11717             ctxtype == INVALID_CONTEXT);
11718 
11719         if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11720                 /*
11721                  * We may land here because shme bitmap and pagesize
11722                  * flags are updated lazily in tsbmiss area on other cpus.
11723                  * If we detect here that tsbmiss area is out of sync with
11724                  * sfmmu update it and retry the trapped instruction.
11725                  * Otherwise call trap().
11726                  */
11727                 int ret = 0;
11728                 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11729                 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11730 
11731                 /*
11732                  * Must set lwp state to LWP_SYS before
11733                  * trying to acquire any adaptive lock
11734                  */
11735                 lwp = ttolwp(curthread);
11736                 ASSERT(lwp);
11737                 lwp_save_state = lwp->lwp_state;
11738                 lwp->lwp_state = LWP_SYS;
11739 
11740                 hatlockp = sfmmu_hat_enter(sfmmup);
11741                 kpreempt_disable();
11742                 tsbmp = &tsbmiss_area[CPU->cpu_id];
11743                 ASSERT(sfmmup == tsbmp->usfmmup);
11744                 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11745                     ~tteflag_mask) ||
11746                     ((tsbmp->uhat_rtteflags ^  sfmmup->sfmmu_rtteflags) &
11747                     ~tteflag_mask)) {
11748                         tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11749                         tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11750                         ret = 1;
11751                 }
11752                 if (sfmmup->sfmmu_srdp != NULL) {
11753                         ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11754                         ulong_t *tm = tsbmp->shmermap;
11755                         ulong_t i;
11756                         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11757                                 ulong_t d = tm[i] ^ sm[i];
11758                                 if (d) {
11759                                         if (d & sm[i]) {
11760                                                 if (!ret && sfmmu_is_rgnva(
11761                                                     sfmmup->sfmmu_srdp,
11762                                                     addr, i, d & sm[i])) {
11763                                                         ret = 1;
11764                                                 }
11765                                         }
11766                                         tm[i] = sm[i];
11767                                 }
11768                         }
11769                 }
11770                 kpreempt_enable();
11771                 sfmmu_hat_exit(hatlockp);
11772                 lwp->lwp_state = lwp_save_state;
11773                 if (ret) {
11774                         return;
11775                 }
11776         } else if (ctxtype == INVALID_CONTEXT) {
11777                 /*
11778                  * First, make sure we come out of here with a valid ctx,
11779                  * since if we don't get one we'll simply loop on the
11780                  * faulting instruction.
11781                  *
11782                  * If the ISM mappings are changing, the TSB is relocated,
11783                  * the process is swapped, the process is joining SCD or
11784                  * leaving SCD or shared regions we serialize behind the
11785                  * controlling thread with hat lock, sfmmu_flags and
11786                  * sfmmu_tsb_cv condition variable.
11787                  */
11788 
11789                 /*
11790                  * Must set lwp state to LWP_SYS before
11791                  * trying to acquire any adaptive lock
11792                  */
11793                 lwp = ttolwp(curthread);
11794                 ASSERT(lwp);
11795                 lwp_save_state = lwp->lwp_state;
11796                 lwp->lwp_state = LWP_SYS;
11797 
11798                 hatlockp = sfmmu_hat_enter(sfmmup);
11799 retry:
11800                 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11801                         shsfmmup = scdp->scd_sfmmup;
11802                         ASSERT(shsfmmup != NULL);
11803 
11804                         for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11805                             tsbinfop = tsbinfop->tsb_next) {
11806                                 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11807                                         /* drop the private hat lock */
11808                                         sfmmu_hat_exit(hatlockp);
11809                                         /* acquire the shared hat lock */
11810                                         shatlockp = sfmmu_hat_enter(shsfmmup);
11811                                         /*
11812                                          * recheck to see if anything changed
11813                                          * after we drop the private hat lock.
11814                                          */
11815                                         if (sfmmup->sfmmu_scdp == scdp &&
11816                                             shsfmmup == scdp->scd_sfmmup) {
11817                                                 sfmmu_tsb_chk_reloc(shsfmmup,
11818                                                     shatlockp);
11819                                         }
11820                                         sfmmu_hat_exit(shatlockp);
11821                                         hatlockp = sfmmu_hat_enter(sfmmup);
11822                                         goto retry;
11823                                 }
11824                         }
11825                 }
11826 
11827                 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
11828                     tsbinfop = tsbinfop->tsb_next) {
11829                         if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11830                                 cv_wait(&sfmmup->sfmmu_tsb_cv,
11831                                     HATLOCK_MUTEXP(hatlockp));
11832                                 goto retry;
11833                         }
11834                 }
11835 
11836                 /*
11837                  * Wait for ISM maps to be updated.
11838                  */
11839                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11840                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11841                             HATLOCK_MUTEXP(hatlockp));
11842                         goto retry;
11843                 }
11844 
11845                 /* Is this process joining an SCD? */
11846                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11847                         /*
11848                          * Flush private TSB and setup shared TSB.
11849                          * sfmmu_finish_join_scd() does not drop the
11850                          * hat lock.
11851                          */
11852                         sfmmu_finish_join_scd(sfmmup);
11853                         SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
11854                 }
11855 
11856                 /*
11857                  * If we're swapping in, get TSB(s).  Note that we must do
11858                  * this before we get a ctx or load the MMU state.  Once
11859                  * we swap in we have to recheck to make sure the TSB(s) and
11860                  * ISM mappings didn't change while we slept.
11861                  */
11862                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11863                         sfmmu_tsb_swapin(sfmmup, hatlockp);
11864                         goto retry;
11865                 }
11866 
11867                 sfmmu_get_ctx(sfmmup);
11868 
11869                 sfmmu_hat_exit(hatlockp);
11870                 /*
11871                  * Must restore lwp_state if not calling
11872                  * trap() for further processing. Restore
11873                  * it anyway.
11874                  */
11875                 lwp->lwp_state = lwp_save_state;
11876                 return;
11877         }
11878         trap(rp, (caddr_t)tagaccess, traptype, 0);
11879 }
11880 
11881 static void
11882 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11883 {
11884         struct tsb_info *tp;
11885 
11886         ASSERT(sfmmu_hat_lock_held(sfmmup));
11887 
11888         for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
11889                 if (tp->tsb_flags & TSB_RELOC_FLAG) {
11890                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11891                             HATLOCK_MUTEXP(hatlockp));
11892                         break;
11893                 }
11894         }
11895 }
11896 
11897 /*
11898  * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
11899  * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
11900  * rather than spinning to avoid send mondo timeouts with
11901  * interrupts enabled. When the lock is acquired it is immediately
11902  * released and we return back to sfmmu_vatopfn just after
11903  * the GET_TTE call.
11904  */
11905 void
11906 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
11907 {
11908         struct page     **pp;
11909 
11910         (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11911         as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11912 }
11913 
11914 /*
11915  * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
11916  * TTE_SUSPENDED bit set in tte. We do this so that we can handle
11917  * cross traps which cannot be handled while spinning in the
11918  * trap handlers. Simply enter and exit the kpr_suspendlock spin
11919  * mutex, which is held by the holder of the suspend bit, and then
11920  * retry the trapped instruction after unwinding.
11921  */
11922 /*ARGSUSED*/
11923 void
11924 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
11925 {
11926         ASSERT(curthread != kreloc_thread);
11927         mutex_enter(&kpr_suspendlock);
11928         mutex_exit(&kpr_suspendlock);
11929 }
11930 
11931 /*
11932  * This routine could be optimized to reduce the number of xcalls by flushing
11933  * the entire TLBs if region reference count is above some threshold but the
11934  * tradeoff will depend on the size of the TLB. So for now flush the specific
11935  * page a context at a time.
11936  *
11937  * If uselocks is 0 then it's called after all cpus were captured and all the
11938  * hat locks were taken. In this case don't take the region lock by relying on
11939  * the order of list region update operations in hat_join_region(),
11940  * hat_leave_region() and hat_dup_region(). The ordering in those routines
11941  * guarantees that list is always forward walkable and reaches active sfmmus
11942  * regardless of where xc_attention() captures a cpu.
11943  */
11944 cpuset_t
11945 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
11946     struct hme_blk *hmeblkp, int uselocks)
11947 {
11948         sfmmu_t *sfmmup;
11949         cpuset_t cpuset;
11950         cpuset_t rcpuset;
11951         hatlock_t *hatlockp;
11952         uint_t rid = rgnp->rgn_id;
11953         sf_rgn_link_t *rlink;
11954         sf_scd_t *scdp;
11955 
11956         ASSERT(hmeblkp->hblk_shared);
11957         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11958         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11959 
11960         CPUSET_ZERO(rcpuset);
11961         if (uselocks) {
11962                 mutex_enter(&rgnp->rgn_mutex);
11963         }
11964         sfmmup = rgnp->rgn_sfmmu_head;
11965         while (sfmmup != NULL) {
11966                 if (uselocks) {
11967                         hatlockp = sfmmu_hat_enter(sfmmup);
11968                 }
11969 
11970                 /*
11971                  * When an SCD is created the SCD hat is linked on the sfmmu
11972                  * region lists for each hme region which is part of the
11973                  * SCD. If we find an SCD hat, when walking these lists,
11974                  * then we flush the shared TSBs, if we find a private hat,
11975                  * which is part of an SCD, but where the region
11976                  * is not part of the SCD then we flush the private TSBs.
11977                  */
11978                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11979                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11980                         scdp = sfmmup->sfmmu_scdp;
11981                         if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
11982                                 if (uselocks) {
11983                                         sfmmu_hat_exit(hatlockp);
11984                                 }
11985                                 goto next;
11986                         }
11987                 }
11988 
11989                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
11990 
11991                 kpreempt_disable();
11992                 cpuset = sfmmup->sfmmu_cpusran;
11993                 CPUSET_AND(cpuset, cpu_ready_set);
11994                 CPUSET_DEL(cpuset, CPU->cpu_id);
11995                 SFMMU_XCALL_STATS(sfmmup);
11996                 xt_some(cpuset, vtag_flushpage_tl1,
11997                     (uint64_t)addr, (uint64_t)sfmmup);
11998                 vtag_flushpage(addr, (uint64_t)sfmmup);
11999                 if (uselocks) {
12000                         sfmmu_hat_exit(hatlockp);
12001                 }
12002                 kpreempt_enable();
12003                 CPUSET_OR(rcpuset, cpuset);
12004 
12005 next:
12006                 /* LINTED: constant in conditional context */
12007                 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
12008                 ASSERT(rlink != NULL);
12009                 sfmmup = rlink->next;
12010         }
12011         if (uselocks) {
12012                 mutex_exit(&rgnp->rgn_mutex);
12013         }
12014         return (rcpuset);
12015 }
12016 
12017 /*
12018  * This routine takes an sfmmu pointer and the va for an adddress in an
12019  * ISM region as input and returns the corresponding region id in ism_rid.
12020  * The return value of 1 indicates that a region has been found and ism_rid
12021  * is valid, otherwise 0 is returned.
12022  */
12023 static int
12024 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12025 {
12026         ism_blk_t       *ism_blkp;
12027         int             i;
12028         ism_map_t       *ism_map;
12029 #ifdef DEBUG
12030         struct hat      *ism_hatid;
12031 #endif
12032         ASSERT(sfmmu_hat_lock_held(sfmmup));
12033 
12034         ism_blkp = sfmmup->sfmmu_iblk;
12035         while (ism_blkp != NULL) {
12036                 ism_map = ism_blkp->iblk_maps;
12037                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12038                         if ((va >= ism_start(ism_map[i])) &&
12039                             (va < ism_end(ism_map[i]))) {
12040 
12041                                 *ism_rid = ism_map[i].imap_rid;
12042 #ifdef DEBUG
12043                                 ism_hatid = ism_map[i].imap_ismhat;
12044                                 ASSERT(ism_hatid == ism_sfmmup);
12045                                 ASSERT(ism_hatid->sfmmu_ismhat);
12046 #endif
12047                                 return (1);
12048                         }
12049                 }
12050                 ism_blkp = ism_blkp->iblk_next;
12051         }
12052         return (0);
12053 }
12054 
12055 /*
12056  * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12057  * This routine may be called with all cpu's captured. Therefore, the
12058  * caller is responsible for holding all locks and disabling kernel
12059  * preemption.
12060  */
12061 /* ARGSUSED */
12062 static void
12063 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12064         struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12065 {
12066         cpuset_t        cpuset;
12067         caddr_t         va;
12068         ism_ment_t      *ment;
12069         sfmmu_t         *sfmmup;
12070 #ifdef VAC
12071         int             vcolor;
12072 #endif
12073 
12074         sf_scd_t        *scdp;
12075         uint_t          ism_rid;
12076 
12077         ASSERT(!hmeblkp->hblk_shared);
12078         /*
12079          * Walk the ism_hat's mapping list and flush the page
12080          * from every hat sharing this ism_hat. This routine
12081          * may be called while all cpu's have been captured.
12082          * Therefore we can't attempt to grab any locks. For now
12083          * this means we will protect the ism mapping list under
12084          * a single lock which will be grabbed by the caller.
12085          * If hat_share/unshare scalibility becomes a performance
12086          * problem then we may need to re-think ism mapping list locking.
12087          */
12088         ASSERT(ism_sfmmup->sfmmu_ismhat);
12089         ASSERT(MUTEX_HELD(&ism_mlist_lock));
12090         addr = addr - ISMID_STARTADDR;
12091 
12092         for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12093 
12094                 sfmmup = ment->iment_hat;
12095 
12096                 va = ment->iment_base_va;
12097                 va = (caddr_t)((uintptr_t)va  + (uintptr_t)addr);
12098 
12099                 /*
12100                  * When an SCD is created the SCD hat is linked on the ism
12101                  * mapping lists for each ISM segment which is part of the
12102                  * SCD. If we find an SCD hat, when walking these lists,
12103                  * then we flush the shared TSBs, if we find a private hat,
12104                  * which is part of an SCD, but where the region
12105                  * corresponding to this va is not part of the SCD then we
12106                  * flush the private TSBs.
12107                  */
12108                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12109                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12110                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12111                         if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12112                             &ism_rid)) {
12113                                 cmn_err(CE_PANIC,
12114                                     "can't find matching ISM rid!");
12115                         }
12116 
12117                         scdp = sfmmup->sfmmu_scdp;
12118                         if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12119                             SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12120                             ism_rid)) {
12121                                 continue;
12122                         }
12123                 }
12124                 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12125 
12126                 cpuset = sfmmup->sfmmu_cpusran;
12127                 CPUSET_AND(cpuset, cpu_ready_set);
12128                 CPUSET_DEL(cpuset, CPU->cpu_id);
12129                 SFMMU_XCALL_STATS(sfmmup);
12130                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12131                     (uint64_t)sfmmup);
12132                 vtag_flushpage(va, (uint64_t)sfmmup);
12133 
12134 #ifdef VAC
12135                 /*
12136                  * Flush D$
12137                  * When flushing D$ we must flush all
12138                  * cpu's. See sfmmu_cache_flush().
12139                  */
12140                 if (cache_flush_flag == CACHE_FLUSH) {
12141                         cpuset = cpu_ready_set;
12142                         CPUSET_DEL(cpuset, CPU->cpu_id);
12143 
12144                         SFMMU_XCALL_STATS(sfmmup);
12145                         vcolor = addr_to_vcolor(va);
12146                         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12147                         vac_flushpage(pfnum, vcolor);
12148                 }
12149 #endif  /* VAC */
12150         }
12151 }
12152 
12153 /*
12154  * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12155  * a particular virtual address and ctx.  If noflush is set we do not
12156  * flush the TLB/TSB.  This function may or may not be called with the
12157  * HAT lock held.
12158  */
12159 static void
12160 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12161         pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12162         int hat_lock_held)
12163 {
12164 #ifdef VAC
12165         int vcolor;
12166 #endif
12167         cpuset_t cpuset;
12168         hatlock_t *hatlockp;
12169 
12170         ASSERT(!hmeblkp->hblk_shared);
12171 
12172 #if defined(lint) && !defined(VAC)
12173         pfnum = pfnum;
12174         cpu_flag = cpu_flag;
12175         cache_flush_flag = cache_flush_flag;
12176 #endif
12177 
12178         /*
12179          * There is no longer a need to protect against ctx being
12180          * stolen here since we don't store the ctx in the TSB anymore.
12181          */
12182 #ifdef VAC
12183         vcolor = addr_to_vcolor(addr);
12184 #endif
12185 
12186         /*
12187          * We must hold the hat lock during the flush of TLB,
12188          * to avoid a race with sfmmu_invalidate_ctx(), where
12189          * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12190          * causing TLB demap routine to skip flush on that MMU.
12191          * If the context on a MMU has already been set to
12192          * INVALID_CONTEXT, we just get an extra flush on
12193          * that MMU.
12194          */
12195         if (!hat_lock_held && !tlb_noflush)
12196                 hatlockp = sfmmu_hat_enter(sfmmup);
12197 
12198         kpreempt_disable();
12199         if (!tlb_noflush) {
12200                 /*
12201                  * Flush the TSB and TLB.
12202                  */
12203                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12204 
12205                 cpuset = sfmmup->sfmmu_cpusran;
12206                 CPUSET_AND(cpuset, cpu_ready_set);
12207                 CPUSET_DEL(cpuset, CPU->cpu_id);
12208 
12209                 SFMMU_XCALL_STATS(sfmmup);
12210 
12211                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12212                     (uint64_t)sfmmup);
12213 
12214                 vtag_flushpage(addr, (uint64_t)sfmmup);
12215         }
12216 
12217         if (!hat_lock_held && !tlb_noflush)
12218                 sfmmu_hat_exit(hatlockp);
12219 
12220 #ifdef VAC
12221         /*
12222          * Flush the D$
12223          *
12224          * Even if the ctx is stolen, we need to flush the
12225          * cache. Our ctx stealer only flushes the TLBs.
12226          */
12227         if (cache_flush_flag == CACHE_FLUSH) {
12228                 if (cpu_flag & FLUSH_ALL_CPUS) {
12229                         cpuset = cpu_ready_set;
12230                 } else {
12231                         cpuset = sfmmup->sfmmu_cpusran;
12232                         CPUSET_AND(cpuset, cpu_ready_set);
12233                 }
12234                 CPUSET_DEL(cpuset, CPU->cpu_id);
12235                 SFMMU_XCALL_STATS(sfmmup);
12236                 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12237                 vac_flushpage(pfnum, vcolor);
12238         }
12239 #endif  /* VAC */
12240         kpreempt_enable();
12241 }
12242 
12243 /*
12244  * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12245  * address and ctx.  If noflush is set we do not currently do anything.
12246  * This function may or may not be called with the HAT lock held.
12247  */
12248 static void
12249 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12250         int tlb_noflush, int hat_lock_held)
12251 {
12252         cpuset_t cpuset;
12253         hatlock_t *hatlockp;
12254 
12255         ASSERT(!hmeblkp->hblk_shared);
12256 
12257         /*
12258          * If the process is exiting we have nothing to do.
12259          */
12260         if (tlb_noflush)
12261                 return;
12262 
12263         /*
12264          * Flush TSB.
12265          */
12266         if (!hat_lock_held)
12267                 hatlockp = sfmmu_hat_enter(sfmmup);
12268         SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12269 
12270         kpreempt_disable();
12271 
12272         cpuset = sfmmup->sfmmu_cpusran;
12273         CPUSET_AND(cpuset, cpu_ready_set);
12274         CPUSET_DEL(cpuset, CPU->cpu_id);
12275 
12276         SFMMU_XCALL_STATS(sfmmup);
12277         xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12278 
12279         vtag_flushpage(addr, (uint64_t)sfmmup);
12280 
12281         if (!hat_lock_held)
12282                 sfmmu_hat_exit(hatlockp);
12283 
12284         kpreempt_enable();
12285 
12286 }
12287 
12288 /*
12289  * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12290  * call handler that can flush a range of pages to save on xcalls.
12291  */
12292 static int sfmmu_xcall_save;
12293 
12294 /*
12295  * this routine is never used for demaping addresses backed by SRD hmeblks.
12296  */
12297 static void
12298 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12299 {
12300         sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12301         hatlock_t *hatlockp;
12302         cpuset_t cpuset;
12303         uint64_t sfmmu_pgcnt;
12304         pgcnt_t pgcnt = 0;
12305         int pgunload = 0;
12306         int dirtypg = 0;
12307         caddr_t addr = dmrp->dmr_addr;
12308         caddr_t eaddr;
12309         uint64_t bitvec = dmrp->dmr_bitvec;
12310 
12311         ASSERT(bitvec & 1);
12312 
12313         /*
12314          * Flush TSB and calculate number of pages to flush.
12315          */
12316         while (bitvec != 0) {
12317                 dirtypg = 0;
12318                 /*
12319                  * Find the first page to flush and then count how many
12320                  * pages there are after it that also need to be flushed.
12321                  * This way the number of TSB flushes is minimized.
12322                  */
12323                 while ((bitvec & 1) == 0) {
12324                         pgcnt++;
12325                         addr += MMU_PAGESIZE;
12326                         bitvec >>= 1;
12327                 }
12328                 while (bitvec & 1) {
12329                         dirtypg++;
12330                         bitvec >>= 1;
12331                 }
12332                 eaddr = addr + ptob(dirtypg);
12333                 hatlockp = sfmmu_hat_enter(sfmmup);
12334                 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12335                 sfmmu_hat_exit(hatlockp);
12336                 pgunload += dirtypg;
12337                 addr = eaddr;
12338                 pgcnt += dirtypg;
12339         }
12340 
12341         ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12342         if (sfmmup->sfmmu_free == 0) {
12343                 addr = dmrp->dmr_addr;
12344                 bitvec = dmrp->dmr_bitvec;
12345 
12346                 /*
12347                  * make sure it has SFMMU_PGCNT_SHIFT bits only,
12348                  * as it will be used to pack argument for xt_some
12349                  */
12350                 ASSERT((pgcnt > 0) &&
12351                     (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12352 
12353                 /*
12354                  * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12355                  * the low 6 bits of sfmmup. This is doable since pgcnt
12356                  * always >= 1.
12357                  */
12358                 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12359                 sfmmu_pgcnt = (uint64_t)sfmmup |
12360                     ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12361 
12362                 /*
12363                  * We must hold the hat lock during the flush of TLB,
12364                  * to avoid a race with sfmmu_invalidate_ctx(), where
12365                  * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12366                  * causing TLB demap routine to skip flush on that MMU.
12367                  * If the context on a MMU has already been set to
12368                  * INVALID_CONTEXT, we just get an extra flush on
12369                  * that MMU.
12370                  */
12371                 hatlockp = sfmmu_hat_enter(sfmmup);
12372                 kpreempt_disable();
12373 
12374                 cpuset = sfmmup->sfmmu_cpusran;
12375                 CPUSET_AND(cpuset, cpu_ready_set);
12376                 CPUSET_DEL(cpuset, CPU->cpu_id);
12377 
12378                 SFMMU_XCALL_STATS(sfmmup);
12379                 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12380                     sfmmu_pgcnt);
12381 
12382                 for (; bitvec != 0; bitvec >>= 1) {
12383                         if (bitvec & 1)
12384                                 vtag_flushpage(addr, (uint64_t)sfmmup);
12385                         addr += MMU_PAGESIZE;
12386                 }
12387                 kpreempt_enable();
12388                 sfmmu_hat_exit(hatlockp);
12389 
12390                 sfmmu_xcall_save += (pgunload-1);
12391         }
12392         dmrp->dmr_bitvec = 0;
12393 }
12394 
12395 /*
12396  * In cases where we need to synchronize with TLB/TSB miss trap
12397  * handlers, _and_ need to flush the TLB, it's a lot easier to
12398  * throw away the context from the process than to do a
12399  * special song and dance to keep things consistent for the
12400  * handlers.
12401  *
12402  * Since the process suddenly ends up without a context and our caller
12403  * holds the hat lock, threads that fault after this function is called
12404  * will pile up on the lock.  We can then do whatever we need to
12405  * atomically from the context of the caller.  The first blocked thread
12406  * to resume executing will get the process a new context, and the
12407  * process will resume executing.
12408  *
12409  * One added advantage of this approach is that on MMUs that
12410  * support a "flush all" operation, we will delay the flush until
12411  * cnum wrap-around, and then flush the TLB one time.  This
12412  * is rather rare, so it's a lot less expensive than making 8000
12413  * x-calls to flush the TLB 8000 times.
12414  *
12415  * A per-process (PP) lock is used to synchronize ctx allocations in
12416  * resume() and ctx invalidations here.
12417  */
12418 static void
12419 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12420 {
12421         cpuset_t cpuset;
12422         int cnum, currcnum;
12423         mmu_ctx_t *mmu_ctxp;
12424         int i;
12425         uint_t pstate_save;
12426 
12427         SFMMU_STAT(sf_ctx_inv);
12428 
12429         ASSERT(sfmmu_hat_lock_held(sfmmup));
12430         ASSERT(sfmmup != ksfmmup);
12431 
12432         kpreempt_disable();
12433 
12434         mmu_ctxp = CPU_MMU_CTXP(CPU);
12435         ASSERT(mmu_ctxp);
12436         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12437         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12438 
12439         currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12440 
12441         pstate_save = sfmmu_disable_intrs();
12442 
12443         lock_set(&sfmmup->sfmmu_ctx_lock);       /* acquire PP lock */
12444         /* set HAT cnum invalid across all context domains. */
12445         for (i = 0; i < max_mmu_ctxdoms; i++) {
12446 
12447                 cnum =  sfmmup->sfmmu_ctxs[i].cnum;
12448                 if (cnum == INVALID_CONTEXT) {
12449                         continue;
12450                 }
12451 
12452                 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12453         }
12454         membar_enter(); /* make sure globally visible to all CPUs */
12455         lock_clear(&sfmmup->sfmmu_ctx_lock);     /* release PP lock */
12456 
12457         sfmmu_enable_intrs(pstate_save);
12458 
12459         cpuset = sfmmup->sfmmu_cpusran;
12460         CPUSET_DEL(cpuset, CPU->cpu_id);
12461         CPUSET_AND(cpuset, cpu_ready_set);
12462         if (!CPUSET_ISNULL(cpuset)) {
12463                 SFMMU_XCALL_STATS(sfmmup);
12464                 xt_some(cpuset, sfmmu_raise_tsb_exception,
12465                     (uint64_t)sfmmup, INVALID_CONTEXT);
12466                 xt_sync(cpuset);
12467                 SFMMU_STAT(sf_tsb_raise_exception);
12468                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12469         }
12470 
12471         /*
12472          * If the hat to-be-invalidated is the same as the current
12473          * process on local CPU we need to invalidate
12474          * this CPU context as well.
12475          */
12476         if ((sfmmu_getctx_sec() == currcnum) &&
12477             (currcnum != INVALID_CONTEXT)) {
12478                 /* sets shared context to INVALID too */
12479                 sfmmu_setctx_sec(INVALID_CONTEXT);
12480                 sfmmu_clear_utsbinfo();
12481         }
12482 
12483         SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12484 
12485         kpreempt_enable();
12486 
12487         /*
12488          * we hold the hat lock, so nobody should allocate a context
12489          * for us yet
12490          */
12491         ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12492 }
12493 
12494 #ifdef VAC
12495 /*
12496  * We need to flush the cache in all cpus.  It is possible that
12497  * a process referenced a page as cacheable but has sinced exited
12498  * and cleared the mapping list.  We still to flush it but have no
12499  * state so all cpus is the only alternative.
12500  */
12501 void
12502 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12503 {
12504         cpuset_t cpuset;
12505 
12506         kpreempt_disable();
12507         cpuset = cpu_ready_set;
12508         CPUSET_DEL(cpuset, CPU->cpu_id);
12509         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12510         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12511         xt_sync(cpuset);
12512         vac_flushpage(pfnum, vcolor);
12513         kpreempt_enable();
12514 }
12515 
12516 void
12517 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12518 {
12519         cpuset_t cpuset;
12520 
12521         ASSERT(vcolor >= 0);
12522 
12523         kpreempt_disable();
12524         cpuset = cpu_ready_set;
12525         CPUSET_DEL(cpuset, CPU->cpu_id);
12526         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12527         xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12528         xt_sync(cpuset);
12529         vac_flushcolor(vcolor, pfnum);
12530         kpreempt_enable();
12531 }
12532 #endif  /* VAC */
12533 
12534 /*
12535  * We need to prevent processes from accessing the TSB using a cached physical
12536  * address.  It's alright if they try to access the TSB via virtual address
12537  * since they will just fault on that virtual address once the mapping has
12538  * been suspended.
12539  */
12540 #pragma weak sendmondo_in_recover
12541 
12542 /* ARGSUSED */
12543 static int
12544 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12545 {
12546         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12547         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12548         hatlock_t *hatlockp;
12549         sf_scd_t *scdp;
12550 
12551         if (flags != HAT_PRESUSPEND)
12552                 return (0);
12553 
12554         /*
12555          * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12556          * be a shared hat, then set SCD's tsbinfo's flag.
12557          * If tsb is not shared, sfmmup is a private hat, then set
12558          * its private tsbinfo's flag.
12559          */
12560         hatlockp = sfmmu_hat_enter(sfmmup);
12561         tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12562 
12563         if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12564                 sfmmu_tsb_inv_ctx(sfmmup);
12565                 sfmmu_hat_exit(hatlockp);
12566         } else {
12567                 /* release lock on the shared hat */
12568                 sfmmu_hat_exit(hatlockp);
12569                 /* sfmmup is a shared hat */
12570                 ASSERT(sfmmup->sfmmu_scdhat);
12571                 scdp = sfmmup->sfmmu_scdp;
12572                 ASSERT(scdp != NULL);
12573                 /* get private hat from the scd list */
12574                 mutex_enter(&scdp->scd_mutex);
12575                 sfmmup = scdp->scd_sf_list;
12576                 while (sfmmup != NULL) {
12577                         hatlockp = sfmmu_hat_enter(sfmmup);
12578                         /*
12579                          * We do not call sfmmu_tsb_inv_ctx here because
12580                          * sendmondo_in_recover check is only needed for
12581                          * sun4u.
12582                          */
12583                         sfmmu_invalidate_ctx(sfmmup);
12584                         sfmmu_hat_exit(hatlockp);
12585                         sfmmup = sfmmup->sfmmu_scd_link.next;
12586 
12587                 }
12588                 mutex_exit(&scdp->scd_mutex);
12589         }
12590         return (0);
12591 }
12592 
12593 static void
12594 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12595 {
12596         extern uint32_t sendmondo_in_recover;
12597 
12598         ASSERT(sfmmu_hat_lock_held(sfmmup));
12599 
12600         /*
12601          * For Cheetah+ Erratum 25:
12602          * Wait for any active recovery to finish.  We can't risk
12603          * relocating the TSB of the thread running mondo_recover_proc()
12604          * since, if we did that, we would deadlock.  The scenario we are
12605          * trying to avoid is as follows:
12606          *
12607          * THIS CPU                     RECOVER CPU
12608          * --------                     -----------
12609          *                              Begins recovery, walking through TSB
12610          * hat_pagesuspend() TSB TTE
12611          *                              TLB miss on TSB TTE, spins at TL1
12612          * xt_sync()
12613          *      send_mondo_timeout()
12614          *      mondo_recover_proc()
12615          *      ((deadlocked))
12616          *
12617          * The second half of the workaround is that mondo_recover_proc()
12618          * checks to see if the tsb_info has the RELOC flag set, and if it
12619          * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12620          * and hence avoiding the TLB miss that could result in a deadlock.
12621          */
12622         if (&sendmondo_in_recover) {
12623                 membar_enter(); /* make sure RELOC flag visible */
12624                 while (sendmondo_in_recover) {
12625                         drv_usecwait(1);
12626                         membar_consumer();
12627                 }
12628         }
12629 
12630         sfmmu_invalidate_ctx(sfmmup);
12631 }
12632 
12633 /* ARGSUSED */
12634 static int
12635 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12636         void *tsbinfo, pfn_t newpfn)
12637 {
12638         hatlock_t *hatlockp;
12639         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12640         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12641 
12642         if (flags != HAT_POSTUNSUSPEND)
12643                 return (0);
12644 
12645         hatlockp = sfmmu_hat_enter(sfmmup);
12646 
12647         SFMMU_STAT(sf_tsb_reloc);
12648 
12649         /*
12650          * The process may have swapped out while we were relocating one
12651          * of its TSBs.  If so, don't bother doing the setup since the
12652          * process can't be using the memory anymore.
12653          */
12654         if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12655                 ASSERT(va == tsbinfop->tsb_va);
12656                 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12657 
12658                 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12659                         sfmmu_inv_tsb(tsbinfop->tsb_va,
12660                             TSB_BYTES(tsbinfop->tsb_szc));
12661                         tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12662                 }
12663         }
12664 
12665         membar_exit();
12666         tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12667         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12668 
12669         sfmmu_hat_exit(hatlockp);
12670 
12671         return (0);
12672 }
12673 
12674 /*
12675  * Allocate and initialize a tsb_info structure.  Note that we may or may not
12676  * allocate a TSB here, depending on the flags passed in.
12677  */
12678 static int
12679 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12680         uint_t flags, sfmmu_t *sfmmup)
12681 {
12682         int err;
12683 
12684         *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12685             sfmmu_tsbinfo_cache, KM_SLEEP);
12686 
12687         if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12688             tsb_szc, flags, sfmmup)) != 0) {
12689                 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12690                 SFMMU_STAT(sf_tsb_allocfail);
12691                 *tsbinfopp = NULL;
12692                 return (err);
12693         }
12694         SFMMU_STAT(sf_tsb_alloc);
12695 
12696         /*
12697          * Bump the TSB size counters for this TSB size.
12698          */
12699         (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12700         return (0);
12701 }
12702 
12703 static void
12704 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12705 {
12706         caddr_t tsbva = tsbinfo->tsb_va;
12707         uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12708         struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12709         vmem_t  *vmp = tsbinfo->tsb_vmp;
12710 
12711         /*
12712          * If we allocated this TSB from relocatable kernel memory, then we
12713          * need to uninstall the callback handler.
12714          */
12715         if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12716                 uintptr_t slab_mask;
12717                 caddr_t slab_vaddr;
12718                 page_t **ppl;
12719                 int ret;
12720 
12721                 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12722                 if (tsb_size > MMU_PAGESIZE4M)
12723                         slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12724                 else
12725                         slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12726                 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12727 
12728                 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12729                 ASSERT(ret == 0);
12730                 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12731                     0, NULL);
12732                 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12733         }
12734 
12735         if (kmem_cachep != NULL) {
12736                 kmem_cache_free(kmem_cachep, tsbva);
12737         } else {
12738                 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12739         }
12740         tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12741         atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12742 }
12743 
12744 static void
12745 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12746 {
12747         if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12748                 sfmmu_tsb_free(tsbinfo);
12749         }
12750         kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12751 
12752 }
12753 
12754 /*
12755  * Setup all the references to physical memory for this tsbinfo.
12756  * The underlying page(s) must be locked.
12757  */
12758 static void
12759 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12760 {
12761         ASSERT(pfn != PFN_INVALID);
12762         ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12763 
12764 #ifndef sun4v
12765         if (tsbinfo->tsb_szc == 0) {
12766                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12767                     PROT_WRITE|PROT_READ, TTE8K);
12768         } else {
12769                 /*
12770                  * Round down PA and use a large mapping; the handlers will
12771                  * compute the TSB pointer at the correct offset into the
12772                  * big virtual page.  NOTE: this assumes all TSBs larger
12773                  * than 8K must come from physically contiguous slabs of
12774                  * size tsb_slab_size.
12775                  */
12776                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12777                     PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12778         }
12779         tsbinfo->tsb_pa = ptob(pfn);
12780 
12781         TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12782         TTE_SET_MOD(&tsbinfo->tsb_tte);    /* enable writes */
12783 
12784         ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12785         ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12786 #else /* sun4v */
12787         tsbinfo->tsb_pa = ptob(pfn);
12788 #endif /* sun4v */
12789 }
12790 
12791 
12792 /*
12793  * Returns zero on success, ENOMEM if over the high water mark,
12794  * or EAGAIN if the caller needs to retry with a smaller TSB
12795  * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12796  *
12797  * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12798  * is specified and the TSB requested is PAGESIZE, though it
12799  * may sleep waiting for memory if sufficient memory is not
12800  * available.
12801  */
12802 static int
12803 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12804     int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12805 {
12806         caddr_t vaddr = NULL;
12807         caddr_t slab_vaddr;
12808         uintptr_t slab_mask;
12809         int tsbbytes = TSB_BYTES(tsbcode);
12810         int lowmem = 0;
12811         struct kmem_cache *kmem_cachep = NULL;
12812         vmem_t *vmp = NULL;
12813         lgrp_id_t lgrpid = LGRP_NONE;
12814         pfn_t pfn;
12815         uint_t cbflags = HAC_SLEEP;
12816         page_t **pplist;
12817         int ret;
12818 
12819         ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
12820         if (tsbbytes > MMU_PAGESIZE4M)
12821                 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12822         else
12823                 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12824 
12825         if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
12826                 flags |= TSB_ALLOC;
12827 
12828         ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
12829 
12830         tsbinfo->tsb_sfmmu = sfmmup;
12831 
12832         /*
12833          * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
12834          * return.
12835          */
12836         if ((flags & TSB_ALLOC) == 0) {
12837                 tsbinfo->tsb_szc = tsbcode;
12838                 tsbinfo->tsb_ttesz_mask = tteszmask;
12839                 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
12840                 tsbinfo->tsb_pa = -1;
12841                 tsbinfo->tsb_tte.ll = 0;
12842                 tsbinfo->tsb_next = NULL;
12843                 tsbinfo->tsb_flags = TSB_SWAPPED;
12844                 tsbinfo->tsb_cache = NULL;
12845                 tsbinfo->tsb_vmp = NULL;
12846                 return (0);
12847         }
12848 
12849 #ifdef DEBUG
12850         /*
12851          * For debugging:
12852          * Randomly force allocation failures every tsb_alloc_mtbf
12853          * tries if TSB_FORCEALLOC is not specified.  This will
12854          * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
12855          * it is even, to allow testing of both failure paths...
12856          */
12857         if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
12858             (tsb_alloc_count++ == tsb_alloc_mtbf)) {
12859                 tsb_alloc_count = 0;
12860                 tsb_alloc_fail_mtbf++;
12861                 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
12862         }
12863 #endif  /* DEBUG */
12864 
12865         /*
12866          * Enforce high water mark if we are not doing a forced allocation
12867          * and are not shrinking a process' TSB.
12868          */
12869         if ((flags & TSB_SHRINK) == 0 &&
12870             (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
12871                 if ((flags & TSB_FORCEALLOC) == 0)
12872                         return (ENOMEM);
12873                 lowmem = 1;
12874         }
12875 
12876         /*
12877          * Allocate from the correct location based upon the size of the TSB
12878          * compared to the base page size, and what memory conditions dictate.
12879          * Note we always do nonblocking allocations from the TSB arena since
12880          * we don't want memory fragmentation to cause processes to block
12881          * indefinitely waiting for memory; until the kernel algorithms that
12882          * coalesce large pages are improved this is our best option.
12883          *
12884          * Algorithm:
12885          *      If allocating a "large" TSB (>8K), allocate from the
12886          *              appropriate kmem_tsb_default_arena vmem arena
12887          *      else if low on memory or the TSB_FORCEALLOC flag is set or
12888          *      tsb_forceheap is set
12889          *              Allocate from kernel heap via sfmmu_tsb8k_cache with
12890          *              KM_SLEEP (never fails)
12891          *      else
12892          *              Allocate from appropriate sfmmu_tsb_cache with
12893          *              KM_NOSLEEP
12894          *      endif
12895          */
12896         if (tsb_lgrp_affinity)
12897                 lgrpid = lgrp_home_id(curthread);
12898         if (lgrpid == LGRP_NONE)
12899                 lgrpid = 0;     /* use lgrp of boot CPU */
12900 
12901         if (tsbbytes > MMU_PAGESIZE) {
12902                 if (tsbbytes > MMU_PAGESIZE4M) {
12903                         vmp = kmem_bigtsb_default_arena[lgrpid];
12904                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12905                             0, 0, NULL, NULL, VM_NOSLEEP);
12906                 } else {
12907                         vmp = kmem_tsb_default_arena[lgrpid];
12908                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12909                             0, 0, NULL, NULL, VM_NOSLEEP);
12910                 }
12911 #ifdef  DEBUG
12912         } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
12913 #else   /* !DEBUG */
12914         } else if (lowmem || (flags & TSB_FORCEALLOC)) {
12915 #endif  /* DEBUG */
12916                 kmem_cachep = sfmmu_tsb8k_cache;
12917                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
12918                 ASSERT(vaddr != NULL);
12919         } else {
12920                 kmem_cachep = sfmmu_tsb_cache[lgrpid];
12921                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
12922         }
12923 
12924         tsbinfo->tsb_cache = kmem_cachep;
12925         tsbinfo->tsb_vmp = vmp;
12926 
12927         if (vaddr == NULL) {
12928                 return (EAGAIN);
12929         }
12930 
12931         atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
12932         kmem_cachep = tsbinfo->tsb_cache;
12933 
12934         /*
12935          * If we are allocating from outside the cage, then we need to
12936          * register a relocation callback handler.  Note that for now
12937          * since pseudo mappings always hang off of the slab's root page,
12938          * we need only lock the first 8K of the TSB slab.  This is a bit
12939          * hacky but it is good for performance.
12940          */
12941         if (kmem_cachep != sfmmu_tsb8k_cache) {
12942                 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
12943                 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
12944                 ASSERT(ret == 0);
12945                 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
12946                     cbflags, (void *)tsbinfo, &pfn, NULL);
12947 
12948                 /*
12949                  * Need to free up resources if we could not successfully
12950                  * add the callback function and return an error condition.
12951                  */
12952                 if (ret != 0) {
12953                         if (kmem_cachep) {
12954                                 kmem_cache_free(kmem_cachep, vaddr);
12955                         } else {
12956                                 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
12957                         }
12958                         as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
12959                             S_WRITE);
12960                         return (EAGAIN);
12961                 }
12962         } else {
12963                 /*
12964                  * Since allocation of 8K TSBs from heap is rare and occurs
12965                  * during memory pressure we allocate them from permanent
12966                  * memory rather than using callbacks to get the PFN.
12967                  */
12968                 pfn = hat_getpfnum(kas.a_hat, vaddr);
12969         }
12970 
12971         tsbinfo->tsb_va = vaddr;
12972         tsbinfo->tsb_szc = tsbcode;
12973         tsbinfo->tsb_ttesz_mask = tteszmask;
12974         tsbinfo->tsb_next = NULL;
12975         tsbinfo->tsb_flags = 0;
12976 
12977         sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
12978 
12979         sfmmu_inv_tsb(vaddr, tsbbytes);
12980 
12981         if (kmem_cachep != sfmmu_tsb8k_cache) {
12982                 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
12983         }
12984 
12985         return (0);
12986 }
12987 
12988 /*
12989  * Initialize per cpu tsb and per cpu tsbmiss_area
12990  */
12991 void
12992 sfmmu_init_tsbs(void)
12993 {
12994         int i;
12995         struct tsbmiss  *tsbmissp;
12996         struct kpmtsbm  *kpmtsbmp;
12997 #ifndef sun4v
12998         extern int      dcache_line_mask;
12999 #endif /* sun4v */
13000         extern uint_t   vac_colors;
13001 
13002         /*
13003          * Init. tsb miss area.
13004          */
13005         tsbmissp = tsbmiss_area;
13006 
13007         for (i = 0; i < NCPU; tsbmissp++, i++) {
13008                 /*
13009                  * initialize the tsbmiss area.
13010                  * Do this for all possible CPUs as some may be added
13011                  * while the system is running. There is no cost to this.
13012                  */
13013                 tsbmissp->ksfmmup = ksfmmup;
13014 #ifndef sun4v
13015                 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13016 #endif /* sun4v */
13017                 tsbmissp->khashstart =
13018                     (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13019                 tsbmissp->uhashstart =
13020                     (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13021                 tsbmissp->khashsz = khmehash_num;
13022                 tsbmissp->uhashsz = uhmehash_num;
13023         }
13024 
13025         sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13026             sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13027 
13028         if (kpm_enable == 0)
13029                 return;
13030 
13031         /* -- Begin KPM specific init -- */
13032 
13033         if (kpm_smallpages) {
13034                 /*
13035                  * If we're using base pagesize pages for seg_kpm
13036                  * mappings, we use the kernel TSB since we can't afford
13037                  * to allocate a second huge TSB for these mappings.
13038                  */
13039                 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13040                 kpm_tsbsz = ktsb_szcode;
13041                 kpmsm_tsbbase = kpm_tsbbase;
13042                 kpmsm_tsbsz = kpm_tsbsz;
13043         } else {
13044                 /*
13045                  * In VAC conflict case, just put the entries in the
13046                  * kernel 8K indexed TSB for now so we can find them.
13047                  * This could really be changed in the future if we feel
13048                  * the need...
13049                  */
13050                 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13051                 kpmsm_tsbsz = ktsb_szcode;
13052                 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13053                 kpm_tsbsz = ktsb4m_szcode;
13054         }
13055 
13056         kpmtsbmp = kpmtsbm_area;
13057         for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13058                 /*
13059                  * Initialize the kpmtsbm area.
13060                  * Do this for all possible CPUs as some may be added
13061                  * while the system is running. There is no cost to this.
13062                  */
13063                 kpmtsbmp->vbase = kpm_vbase;
13064                 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13065                 kpmtsbmp->sz_shift = kpm_size_shift;
13066                 kpmtsbmp->kpmp_shift = kpmp_shift;
13067                 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13068                 if (kpm_smallpages == 0) {
13069                         kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13070                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13071                 } else {
13072                         kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13073                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13074                 }
13075                 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13076                 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13077 #ifdef  DEBUG
13078                 kpmtsbmp->flags |= (kpm_tsbmtl) ?  KPMTSBM_TLTSBM_FLAG : 0;
13079 #endif  /* DEBUG */
13080                 if (ktsb_phys)
13081                         kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13082         }
13083 
13084         /* -- End KPM specific init -- */
13085 }
13086 
13087 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13088 struct tsb_info ktsb_info[2];
13089 
13090 /*
13091  * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13092  */
13093 void
13094 sfmmu_init_ktsbinfo()
13095 {
13096         ASSERT(ksfmmup != NULL);
13097         ASSERT(ksfmmup->sfmmu_tsb == NULL);
13098         /*
13099          * Allocate tsbinfos for kernel and copy in data
13100          * to make debug easier and sun4v setup easier.
13101          */
13102         ktsb_info[0].tsb_sfmmu = ksfmmup;
13103         ktsb_info[0].tsb_szc = ktsb_szcode;
13104         ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13105         ktsb_info[0].tsb_va = ktsb_base;
13106         ktsb_info[0].tsb_pa = ktsb_pbase;
13107         ktsb_info[0].tsb_flags = 0;
13108         ktsb_info[0].tsb_tte.ll = 0;
13109         ktsb_info[0].tsb_cache = NULL;
13110 
13111         ktsb_info[1].tsb_sfmmu = ksfmmup;
13112         ktsb_info[1].tsb_szc = ktsb4m_szcode;
13113         ktsb_info[1].tsb_ttesz_mask = TSB4M;
13114         ktsb_info[1].tsb_va = ktsb4m_base;
13115         ktsb_info[1].tsb_pa = ktsb4m_pbase;
13116         ktsb_info[1].tsb_flags = 0;
13117         ktsb_info[1].tsb_tte.ll = 0;
13118         ktsb_info[1].tsb_cache = NULL;
13119 
13120         /* Link them into ksfmmup. */
13121         ktsb_info[0].tsb_next = &ktsb_info[1];
13122         ktsb_info[1].tsb_next = NULL;
13123         ksfmmup->sfmmu_tsb = &ktsb_info[0];
13124 
13125         sfmmu_setup_tsbinfo(ksfmmup);
13126 }
13127 
13128 /*
13129  * Cache the last value returned from va_to_pa().  If the VA specified
13130  * in the current call to cached_va_to_pa() maps to the same Page (as the
13131  * previous call to cached_va_to_pa()), then compute the PA using
13132  * cached info, else call va_to_pa().
13133  *
13134  * Note: this function is neither MT-safe nor consistent in the presence
13135  * of multiple, interleaved threads.  This function was created to enable
13136  * an optimization used during boot (at a point when there's only one thread
13137  * executing on the "boot CPU", and before startup_vm() has been called).
13138  */
13139 static uint64_t
13140 cached_va_to_pa(void *vaddr)
13141 {
13142         static uint64_t prev_vaddr_base = 0;
13143         static uint64_t prev_pfn = 0;
13144 
13145         if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13146                 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13147         } else {
13148                 uint64_t pa = va_to_pa(vaddr);
13149 
13150                 if (pa != ((uint64_t)-1)) {
13151                         /*
13152                          * Computed physical address is valid.  Cache its
13153                          * related info for the next cached_va_to_pa() call.
13154                          */
13155                         prev_pfn = pa & MMU_PAGEMASK;
13156                         prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13157                 }
13158 
13159                 return (pa);
13160         }
13161 }
13162 
13163 /*
13164  * Carve up our nucleus hblk region.  We may allocate more hblks than
13165  * asked due to rounding errors but we are guaranteed to have at least
13166  * enough space to allocate the requested number of hblk8's and hblk1's.
13167  */
13168 void
13169 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13170 {
13171         struct hme_blk *hmeblkp;
13172         size_t hme8blk_sz, hme1blk_sz;
13173         size_t i;
13174         size_t hblk8_bound;
13175         ulong_t j = 0, k = 0;
13176 
13177         ASSERT(addr != NULL && size != 0);
13178 
13179         /* Need to use proper structure alignment */
13180         hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13181         hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13182 
13183         nucleus_hblk8.list = (void *)addr;
13184         nucleus_hblk8.index = 0;
13185 
13186         /*
13187          * Use as much memory as possible for hblk8's since we
13188          * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13189          * We need to hold back enough space for the hblk1's which
13190          * we'll allocate next.
13191          */
13192         hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13193         for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13194                 hmeblkp = (struct hme_blk *)addr;
13195                 addr += hme8blk_sz;
13196                 hmeblkp->hblk_nuc_bit = 1;
13197                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13198         }
13199         nucleus_hblk8.len = j;
13200         ASSERT(j >= nhblk8);
13201         SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13202 
13203         nucleus_hblk1.list = (void *)addr;
13204         nucleus_hblk1.index = 0;
13205         for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13206                 hmeblkp = (struct hme_blk *)addr;
13207                 addr += hme1blk_sz;
13208                 hmeblkp->hblk_nuc_bit = 1;
13209                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13210         }
13211         ASSERT(k >= nhblk1);
13212         nucleus_hblk1.len = k;
13213         SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13214 }
13215 
13216 /*
13217  * This function is currently not supported on this platform. For what
13218  * it's supposed to do, see hat.c and hat_srmmu.c
13219  */
13220 /* ARGSUSED */
13221 faultcode_t
13222 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13223     uint_t flags)
13224 {
13225         return (FC_NOSUPPORT);
13226 }
13227 
13228 /*
13229  * Searchs the mapping list of the page for a mapping of the same size. If not
13230  * found the corresponding bit is cleared in the p_index field. When large
13231  * pages are more prevalent in the system, we can maintain the mapping list
13232  * in order and we don't have to traverse the list each time. Just check the
13233  * next and prev entries, and if both are of different size, we clear the bit.
13234  */
13235 static void
13236 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13237 {
13238         struct sf_hment *sfhmep;
13239         struct hme_blk *hmeblkp;
13240         int     index;
13241         pgcnt_t npgs;
13242 
13243         ASSERT(ttesz > TTE8K);
13244 
13245         ASSERT(sfmmu_mlist_held(pp));
13246 
13247         ASSERT(PP_ISMAPPED_LARGE(pp));
13248 
13249         /*
13250          * Traverse mapping list looking for another mapping of same size.
13251          * since we only want to clear index field if all mappings of
13252          * that size are gone.
13253          */
13254 
13255         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13256                 if (IS_PAHME(sfhmep))
13257                         continue;
13258                 hmeblkp = sfmmu_hmetohblk(sfhmep);
13259                 if (hme_size(sfhmep) == ttesz) {
13260                         /*
13261                          * another mapping of the same size. don't clear index.
13262                          */
13263                         return;
13264                 }
13265         }
13266 
13267         /*
13268          * Clear the p_index bit for large page.
13269          */
13270         index = PAGESZ_TO_INDEX(ttesz);
13271         npgs = TTEPAGES(ttesz);
13272         while (npgs-- > 0) {
13273                 ASSERT(pp->p_index & index);
13274                 pp->p_index &= ~index;
13275                 pp = PP_PAGENEXT(pp);
13276         }
13277 }
13278 
13279 /*
13280  * return supported features
13281  */
13282 /* ARGSUSED */
13283 int
13284 hat_supported(enum hat_features feature, void *arg)
13285 {
13286         switch (feature) {
13287         case    HAT_SHARED_PT:
13288         case    HAT_DYNAMIC_ISM_UNMAP:
13289         case    HAT_VMODSORT:
13290                 return (1);
13291         case    HAT_SHARED_REGIONS:
13292                 if (shctx_on)
13293                         return (1);
13294                 else
13295                         return (0);
13296         default:
13297                 return (0);
13298         }
13299 }
13300 
13301 void
13302 hat_enter(struct hat *hat)
13303 {
13304         hatlock_t       *hatlockp;
13305 
13306         if (hat != ksfmmup) {
13307                 hatlockp = TSB_HASH(hat);
13308                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13309         }
13310 }
13311 
13312 void
13313 hat_exit(struct hat *hat)
13314 {
13315         hatlock_t       *hatlockp;
13316 
13317         if (hat != ksfmmup) {
13318                 hatlockp = TSB_HASH(hat);
13319                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13320         }
13321 }
13322 
13323 /*ARGSUSED*/
13324 void
13325 hat_reserve(struct as *as, caddr_t addr, size_t len)
13326 {
13327 }
13328 
13329 static void
13330 hat_kstat_init(void)
13331 {
13332         kstat_t *ksp;
13333 
13334         ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13335             KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13336             KSTAT_FLAG_VIRTUAL);
13337         if (ksp) {
13338                 ksp->ks_data = (void *) &sfmmu_global_stat;
13339                 kstat_install(ksp);
13340         }
13341         ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13342             KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13343             KSTAT_FLAG_VIRTUAL);
13344         if (ksp) {
13345                 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13346                 kstat_install(ksp);
13347         }
13348         ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13349             KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13350             KSTAT_FLAG_WRITABLE);
13351         if (ksp) {
13352                 ksp->ks_update = sfmmu_kstat_percpu_update;
13353                 kstat_install(ksp);
13354         }
13355 }
13356 
13357 /* ARGSUSED */
13358 static int
13359 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13360 {
13361         struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13362         struct tsbmiss *tsbm = tsbmiss_area;
13363         struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13364         int i;
13365 
13366         ASSERT(cpu_kstat);
13367         if (rw == KSTAT_READ) {
13368                 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13369                         cpu_kstat->sf_itlb_misses = 0;
13370                         cpu_kstat->sf_dtlb_misses = 0;
13371                         cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13372                             tsbm->uprot_traps;
13373                         cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13374                             kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13375                         cpu_kstat->sf_tsb_hits = 0;
13376                         cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13377                         cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13378                 }
13379         } else {
13380                 /* KSTAT_WRITE is used to clear stats */
13381                 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13382                         tsbm->utsb_misses = 0;
13383                         tsbm->ktsb_misses = 0;
13384                         tsbm->uprot_traps = 0;
13385                         tsbm->kprot_traps = 0;
13386                         kpmtsbm->kpm_dtlb_misses = 0;
13387                         kpmtsbm->kpm_tsb_misses = 0;
13388                 }
13389         }
13390         return (0);
13391 }
13392 
13393 #ifdef  DEBUG
13394 
13395 tte_t  *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13396 
13397 /*
13398  * A tte checker. *orig_old is the value we read before cas.
13399  *      *cur is the value returned by cas.
13400  *      *new is the desired value when we do the cas.
13401  *
13402  *      *hmeblkp is currently unused.
13403  */
13404 
13405 /* ARGSUSED */
13406 void
13407 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13408 {
13409         pfn_t i, j, k;
13410         int cpuid = CPU->cpu_id;
13411 
13412         gorig[cpuid] = orig_old;
13413         gcur[cpuid] = cur;
13414         gnew[cpuid] = new;
13415 
13416 #ifdef lint
13417         hmeblkp = hmeblkp;
13418 #endif
13419 
13420         if (TTE_IS_VALID(orig_old)) {
13421                 if (TTE_IS_VALID(cur)) {
13422                         i = TTE_TO_TTEPFN(orig_old);
13423                         j = TTE_TO_TTEPFN(cur);
13424                         k = TTE_TO_TTEPFN(new);
13425                         if (i != j) {
13426                                 /* remap error? */
13427                                 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13428                         }
13429 
13430                         if (i != k) {
13431                                 /* remap error? */
13432                                 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13433                         }
13434                 } else {
13435                         if (TTE_IS_VALID(new)) {
13436                                 panic("chk_tte: invalid cur? ");
13437                         }
13438 
13439                         i = TTE_TO_TTEPFN(orig_old);
13440                         k = TTE_TO_TTEPFN(new);
13441                         if (i != k) {
13442                                 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13443                         }
13444                 }
13445         } else {
13446                 if (TTE_IS_VALID(cur)) {
13447                         j = TTE_TO_TTEPFN(cur);
13448                         if (TTE_IS_VALID(new)) {
13449                                 k = TTE_TO_TTEPFN(new);
13450                                 if (j != k) {
13451                                         panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13452                                             j, k);
13453                                 }
13454                         } else {
13455                                 panic("chk_tte: why here?");
13456                         }
13457                 } else {
13458                         if (!TTE_IS_VALID(new)) {
13459                                 panic("chk_tte: why here2 ?");
13460                         }
13461                 }
13462         }
13463 }
13464 
13465 #endif /* DEBUG */
13466 
13467 extern void prefetch_tsbe_read(struct tsbe *);
13468 extern void prefetch_tsbe_write(struct tsbe *);
13469 
13470 
13471 /*
13472  * We want to prefetch 7 cache lines ahead for our read prefetch.  This gives
13473  * us optimal performance on Cheetah+.  You can only have 8 outstanding
13474  * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13475  * prefetch to make the most utilization of the prefetch capability.
13476  */
13477 #define TSBE_PREFETCH_STRIDE (7)
13478 
13479 void
13480 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13481 {
13482         int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13483         int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13484         int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13485         int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13486         struct tsbe *old;
13487         struct tsbe *new;
13488         struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13489         uint64_t va;
13490         int new_offset;
13491         int i;
13492         int vpshift;
13493         int last_prefetch;
13494 
13495         if (old_bytes == new_bytes) {
13496                 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13497         } else {
13498 
13499                 /*
13500                  * A TSBE is 16 bytes which means there are four TSBE's per
13501                  * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13502                  */
13503                 old = (struct tsbe *)old_tsbinfo->tsb_va;
13504                 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13505                 for (i = 0; i < old_entries; i++, old++) {
13506                         if (((i & (4-1)) == 0) && (i < last_prefetch))
13507                                 prefetch_tsbe_read(old);
13508                         if (!old->tte_tag.tag_invalid) {
13509                                 /*
13510                                  * We have a valid TTE to remap.  Check the
13511                                  * size.  We won't remap 64K or 512K TTEs
13512                                  * because they span more than one TSB entry
13513                                  * and are indexed using an 8K virt. page.
13514                                  * Ditto for 32M and 256M TTEs.
13515                                  */
13516                                 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13517                                     TTE_CSZ(&old->tte_data) == TTE512K)
13518                                         continue;
13519                                 if (mmu_page_sizes == max_mmu_page_sizes) {
13520                                         if (TTE_CSZ(&old->tte_data) == TTE32M ||
13521                                             TTE_CSZ(&old->tte_data) == TTE256M)
13522                                                 continue;
13523                                 }
13524 
13525                                 /* clear the lower 22 bits of the va */
13526                                 va = *(uint64_t *)old << 22;
13527                                 /* turn va into a virtual pfn */
13528                                 va >>= 22 - TSB_START_SIZE;
13529                                 /*
13530                                  * or in bits from the offset in the tsb
13531                                  * to get the real virtual pfn. These
13532                                  * correspond to bits [21:13] in the va
13533                                  */
13534                                 vpshift =
13535                                     TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13536                                     0x1ff;
13537                                 va |= (i << vpshift);
13538                                 va >>= vpshift;
13539                                 new_offset = va & (new_entries - 1);
13540                                 new = new_base + new_offset;
13541                                 prefetch_tsbe_write(new);
13542                                 *new = *old;
13543                         }
13544                 }
13545         }
13546 }
13547 
13548 /*
13549  * unused in sfmmu
13550  */
13551 void
13552 hat_dump(void)
13553 {
13554 }
13555 
13556 /*
13557  * Called when a thread is exiting and we have switched to the kernel address
13558  * space.  Perform the same VM initialization resume() uses when switching
13559  * processes.
13560  *
13561  * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13562  * we call it anyway in case the semantics change in the future.
13563  */
13564 /*ARGSUSED*/
13565 void
13566 hat_thread_exit(kthread_t *thd)
13567 {
13568         uint_t pgsz_cnum;
13569         uint_t pstate_save;
13570 
13571         ASSERT(thd->t_procp->p_as == &kas);
13572 
13573         pgsz_cnum = KCONTEXT;
13574 #ifdef sun4u
13575         pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13576 #endif
13577 
13578         /*
13579          * Note that sfmmu_load_mmustate() is currently a no-op for
13580          * kernel threads. We need to disable interrupts here,
13581          * simply because otherwise sfmmu_load_mmustate() would panic
13582          * if the caller does not disable interrupts.
13583          */
13584         pstate_save = sfmmu_disable_intrs();
13585 
13586         /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13587         sfmmu_setctx_sec(pgsz_cnum);
13588         sfmmu_load_mmustate(ksfmmup);
13589         sfmmu_enable_intrs(pstate_save);
13590 }
13591 
13592 
13593 /*
13594  * SRD support
13595  */
13596 #define SRD_HASH_FUNCTION(vp)   (((((uintptr_t)(vp)) >> 4) ^ \
13597                                     (((uintptr_t)(vp)) >> 11)) & \
13598                                     srd_hashmask)
13599 
13600 /*
13601  * Attach the process to the srd struct associated with the exec vnode
13602  * from which the process is started.
13603  */
13604 void
13605 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13606 {
13607         uint_t hash = SRD_HASH_FUNCTION(evp);
13608         sf_srd_t *srdp;
13609         sf_srd_t *newsrdp;
13610 
13611         ASSERT(sfmmup != ksfmmup);
13612         ASSERT(sfmmup->sfmmu_srdp == NULL);
13613 
13614         if (!shctx_on) {
13615                 return;
13616         }
13617 
13618         VN_HOLD(evp);
13619 
13620         if (srd_buckets[hash].srdb_srdp != NULL) {
13621                 mutex_enter(&srd_buckets[hash].srdb_lock);
13622                 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13623                     srdp = srdp->srd_hash) {
13624                         if (srdp->srd_evp == evp) {
13625                                 ASSERT(srdp->srd_refcnt >= 0);
13626                                 sfmmup->sfmmu_srdp = srdp;
13627                                 atomic_inc_32(
13628                                     (volatile uint_t *)&srdp->srd_refcnt);
13629                                 mutex_exit(&srd_buckets[hash].srdb_lock);
13630                                 return;
13631                         }
13632                 }
13633                 mutex_exit(&srd_buckets[hash].srdb_lock);
13634         }
13635         newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13636         ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13637 
13638         newsrdp->srd_evp = evp;
13639         newsrdp->srd_refcnt = 1;
13640         newsrdp->srd_hmergnfree = NULL;
13641         newsrdp->srd_ismrgnfree = NULL;
13642 
13643         mutex_enter(&srd_buckets[hash].srdb_lock);
13644         for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13645             srdp = srdp->srd_hash) {
13646                 if (srdp->srd_evp == evp) {
13647                         ASSERT(srdp->srd_refcnt >= 0);
13648                         sfmmup->sfmmu_srdp = srdp;
13649                         atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13650                         mutex_exit(&srd_buckets[hash].srdb_lock);
13651                         kmem_cache_free(srd_cache, newsrdp);
13652                         return;
13653                 }
13654         }
13655         newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13656         srd_buckets[hash].srdb_srdp = newsrdp;
13657         sfmmup->sfmmu_srdp = newsrdp;
13658 
13659         mutex_exit(&srd_buckets[hash].srdb_lock);
13660 
13661 }
13662 
13663 static void
13664 sfmmu_leave_srd(sfmmu_t *sfmmup)
13665 {
13666         vnode_t *evp;
13667         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13668         uint_t hash;
13669         sf_srd_t **prev_srdpp;
13670         sf_region_t *rgnp;
13671         sf_region_t *nrgnp;
13672 #ifdef DEBUG
13673         int rgns = 0;
13674 #endif
13675         int i;
13676 
13677         ASSERT(sfmmup != ksfmmup);
13678         ASSERT(srdp != NULL);
13679         ASSERT(srdp->srd_refcnt > 0);
13680         ASSERT(sfmmup->sfmmu_scdp == NULL);
13681         ASSERT(sfmmup->sfmmu_free == 1);
13682 
13683         sfmmup->sfmmu_srdp = NULL;
13684         evp = srdp->srd_evp;
13685         ASSERT(evp != NULL);
13686         if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13687                 VN_RELE(evp);
13688                 return;
13689         }
13690 
13691         hash = SRD_HASH_FUNCTION(evp);
13692         mutex_enter(&srd_buckets[hash].srdb_lock);
13693         for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13694             (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13695                 if (srdp->srd_evp == evp) {
13696                         break;
13697                 }
13698         }
13699         if (srdp == NULL || srdp->srd_refcnt) {
13700                 mutex_exit(&srd_buckets[hash].srdb_lock);
13701                 VN_RELE(evp);
13702                 return;
13703         }
13704         *prev_srdpp = srdp->srd_hash;
13705         mutex_exit(&srd_buckets[hash].srdb_lock);
13706 
13707         ASSERT(srdp->srd_refcnt == 0);
13708         VN_RELE(evp);
13709 
13710 #ifdef DEBUG
13711         for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13712                 ASSERT(srdp->srd_rgnhash[i] == NULL);
13713         }
13714 #endif /* DEBUG */
13715 
13716         /* free each hme regions in the srd */
13717         for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13718                 nrgnp = rgnp->rgn_next;
13719                 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13720                 ASSERT(rgnp->rgn_refcnt == 0);
13721                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13722                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13723                 ASSERT(rgnp->rgn_hmeflags == 0);
13724                 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13725 #ifdef DEBUG
13726                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13727                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13728                 }
13729                 rgns++;
13730 #endif /* DEBUG */
13731                 kmem_cache_free(region_cache, rgnp);
13732         }
13733         ASSERT(rgns == srdp->srd_next_hmerid);
13734 
13735 #ifdef DEBUG
13736         rgns = 0;
13737 #endif
13738         /* free each ism rgns in the srd */
13739         for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13740                 nrgnp = rgnp->rgn_next;
13741                 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13742                 ASSERT(rgnp->rgn_refcnt == 0);
13743                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13744                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13745                 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13746 #ifdef DEBUG
13747                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13748                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13749                 }
13750                 rgns++;
13751 #endif /* DEBUG */
13752                 kmem_cache_free(region_cache, rgnp);
13753         }
13754         ASSERT(rgns == srdp->srd_next_ismrid);
13755         ASSERT(srdp->srd_ismbusyrgns == 0);
13756         ASSERT(srdp->srd_hmebusyrgns == 0);
13757 
13758         srdp->srd_next_ismrid = 0;
13759         srdp->srd_next_hmerid = 0;
13760 
13761         bzero((void *)srdp->srd_ismrgnp,
13762             sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13763         bzero((void *)srdp->srd_hmergnp,
13764             sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13765 
13766         ASSERT(srdp->srd_scdp == NULL);
13767         kmem_cache_free(srd_cache, srdp);
13768 }
13769 
13770 /* ARGSUSED */
13771 static int
13772 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13773 {
13774         sf_srd_t *srdp = (sf_srd_t *)buf;
13775         bzero(buf, sizeof (*srdp));
13776 
13777         mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13778         mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13779         return (0);
13780 }
13781 
13782 /* ARGSUSED */
13783 static void
13784 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13785 {
13786         sf_srd_t *srdp = (sf_srd_t *)buf;
13787 
13788         mutex_destroy(&srdp->srd_mutex);
13789         mutex_destroy(&srdp->srd_scd_mutex);
13790 }
13791 
13792 /*
13793  * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13794  * at the same time for the same process and address range. This is ensured by
13795  * the fact that address space is locked as writer when a process joins the
13796  * regions. Therefore there's no need to hold an srd lock during the entire
13797  * execution of hat_join_region()/hat_leave_region().
13798  */
13799 
13800 #define RGN_HASH_FUNCTION(obj)  (((((uintptr_t)(obj)) >> 4) ^ \
13801                                     (((uintptr_t)(obj)) >> 11)) & \
13802                                         srd_rgn_hashmask)
13803 /*
13804  * This routine implements the shared context functionality required when
13805  * attaching a segment to an address space. It must be called from
13806  * hat_share() for D(ISM) segments and from segvn_create() for segments
13807  * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13808  * which is saved in the private segment data for hme segments and
13809  * the ism_map structure for ism segments.
13810  */
13811 hat_region_cookie_t
13812 hat_join_region(struct hat *sfmmup,
13813         caddr_t r_saddr,
13814         size_t r_size,
13815         void *r_obj,
13816         u_offset_t r_objoff,
13817         uchar_t r_perm,
13818         uchar_t r_pgszc,
13819         hat_rgn_cb_func_t r_cb_function,
13820         uint_t flags)
13821 {
13822         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13823         uint_t rhash;
13824         uint_t rid;
13825         hatlock_t *hatlockp;
13826         sf_region_t *rgnp;
13827         sf_region_t *new_rgnp = NULL;
13828         int i;
13829         uint16_t *nextidp;
13830         sf_region_t **freelistp;
13831         int maxids;
13832         sf_region_t **rarrp;
13833         uint16_t *busyrgnsp;
13834         ulong_t rttecnt;
13835         uchar_t tteflag;
13836         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13837         int text = (r_type == HAT_REGION_TEXT);
13838 
13839         if (srdp == NULL || r_size == 0) {
13840                 return (HAT_INVALID_REGION_COOKIE);
13841         }
13842 
13843         ASSERT(sfmmup != ksfmmup);
13844         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
13845         ASSERT(srdp->srd_refcnt > 0);
13846         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13847         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13848         ASSERT(r_pgszc < mmu_page_sizes);
13849         if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
13850             !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
13851                 panic("hat_join_region: region addr or size is not aligned\n");
13852         }
13853 
13854 
13855         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13856             SFMMU_REGION_HME;
13857         /*
13858          * Currently only support shared hmes for the read only main text
13859          * region.
13860          */
13861         if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
13862             (r_perm & PROT_WRITE))) {
13863                 return (HAT_INVALID_REGION_COOKIE);
13864         }
13865 
13866         rhash = RGN_HASH_FUNCTION(r_obj);
13867 
13868         if (r_type == SFMMU_REGION_ISM) {
13869                 nextidp = &srdp->srd_next_ismrid;
13870                 freelistp = &srdp->srd_ismrgnfree;
13871                 maxids = SFMMU_MAX_ISM_REGIONS;
13872                 rarrp = srdp->srd_ismrgnp;
13873                 busyrgnsp = &srdp->srd_ismbusyrgns;
13874         } else {
13875                 nextidp = &srdp->srd_next_hmerid;
13876                 freelistp = &srdp->srd_hmergnfree;
13877                 maxids = SFMMU_MAX_HME_REGIONS;
13878                 rarrp = srdp->srd_hmergnp;
13879                 busyrgnsp = &srdp->srd_hmebusyrgns;
13880         }
13881 
13882         mutex_enter(&srdp->srd_mutex);
13883 
13884         for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13885             rgnp = rgnp->rgn_hash) {
13886                 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
13887                     rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
13888                     rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
13889                         break;
13890                 }
13891         }
13892 
13893 rfound:
13894         if (rgnp != NULL) {
13895                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
13896                 ASSERT(rgnp->rgn_cb_function == r_cb_function);
13897                 ASSERT(rgnp->rgn_refcnt >= 0);
13898                 rid = rgnp->rgn_id;
13899                 ASSERT(rid < maxids);
13900                 ASSERT(rarrp[rid] == rgnp);
13901                 ASSERT(rid < *nextidp);
13902                 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
13903                 mutex_exit(&srdp->srd_mutex);
13904                 if (new_rgnp != NULL) {
13905                         kmem_cache_free(region_cache, new_rgnp);
13906                 }
13907                 if (r_type == SFMMU_REGION_HME) {
13908                         int myjoin =
13909                             (sfmmup == astosfmmu(curthread->t_procp->p_as));
13910 
13911                         sfmmu_link_to_hmeregion(sfmmup, rgnp);
13912                         /*
13913                          * bitmap should be updated after linking sfmmu on
13914                          * region list so that pageunload() doesn't skip
13915                          * TSB/TLB flush. As soon as bitmap is updated another
13916                          * thread in this process can already start accessing
13917                          * this region.
13918                          */
13919                         /*
13920                          * Normally ttecnt accounting is done as part of
13921                          * pagefault handling. But a process may not take any
13922                          * pagefaults on shared hmeblks created by some other
13923                          * process. To compensate for this assume that the
13924                          * entire region will end up faulted in using
13925                          * the region's pagesize.
13926                          *
13927                          */
13928                         if (r_pgszc > TTE8K) {
13929                                 tteflag = 1 << r_pgszc;
13930                                 if (disable_large_pages & tteflag) {
13931                                         tteflag = 0;
13932                                 }
13933                         } else {
13934                                 tteflag = 0;
13935                         }
13936                         if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
13937                                 hatlockp = sfmmu_hat_enter(sfmmup);
13938                                 sfmmup->sfmmu_rtteflags |= tteflag;
13939                                 sfmmu_hat_exit(hatlockp);
13940                         }
13941                         hatlockp = sfmmu_hat_enter(sfmmup);
13942 
13943                         /*
13944                          * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
13945                          * region to allow for large page allocation failure.
13946                          */
13947                         if (r_pgszc >= TTE4M) {
13948                                 sfmmup->sfmmu_tsb0_4minflcnt +=
13949                                     r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
13950                         }
13951 
13952                         /* update sfmmu_ttecnt with the shme rgn ttecnt */
13953                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
13954                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
13955                             rttecnt);
13956 
13957                         if (text && r_pgszc >= TTE4M &&
13958                             (tteflag || ((disable_large_pages >> TTE4M) &
13959                             ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
13960                             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
13961                                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
13962                         }
13963 
13964                         sfmmu_hat_exit(hatlockp);
13965                         /*
13966                          * On Panther we need to make sure TLB is programmed
13967                          * to accept 32M/256M pages.  Call
13968                          * sfmmu_check_page_sizes() now to make sure TLB is
13969                          * setup before making hmeregions visible to other
13970                          * threads.
13971                          */
13972                         sfmmu_check_page_sizes(sfmmup, 1);
13973                         hatlockp = sfmmu_hat_enter(sfmmup);
13974                         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
13975 
13976                         /*
13977                          * if context is invalid tsb miss exception code will
13978                          * call sfmmu_check_page_sizes() and update tsbmiss
13979                          * area later.
13980                          */
13981                         kpreempt_disable();
13982                         if (myjoin &&
13983                             (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
13984                             != INVALID_CONTEXT)) {
13985                                 struct tsbmiss *tsbmp;
13986 
13987                                 tsbmp = &tsbmiss_area[CPU->cpu_id];
13988                                 ASSERT(sfmmup == tsbmp->usfmmup);
13989                                 BT_SET(tsbmp->shmermap, rid);
13990                                 if (r_pgszc > TTE64K) {
13991                                         tsbmp->uhat_rtteflags |= tteflag;
13992                                 }
13993 
13994                         }
13995                         kpreempt_enable();
13996 
13997                         sfmmu_hat_exit(hatlockp);
13998                         ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
13999                             HAT_INVALID_REGION_COOKIE);
14000                 } else {
14001                         hatlockp = sfmmu_hat_enter(sfmmup);
14002                         SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
14003                         sfmmu_hat_exit(hatlockp);
14004                 }
14005                 ASSERT(rid < maxids);
14006 
14007                 if (r_type == SFMMU_REGION_ISM) {
14008                         sfmmu_find_scd(sfmmup);
14009                 }
14010                 return ((hat_region_cookie_t)((uint64_t)rid));
14011         }
14012 
14013         ASSERT(new_rgnp == NULL);
14014 
14015         if (*busyrgnsp >= maxids) {
14016                 mutex_exit(&srdp->srd_mutex);
14017                 return (HAT_INVALID_REGION_COOKIE);
14018         }
14019 
14020         ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14021         if (*freelistp != NULL) {
14022                 rgnp = *freelistp;
14023                 *freelistp = rgnp->rgn_next;
14024                 ASSERT(rgnp->rgn_id < *nextidp);
14025                 ASSERT(rgnp->rgn_id < maxids);
14026                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14027                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14028                     == r_type);
14029                 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14030                 ASSERT(rgnp->rgn_hmeflags == 0);
14031         } else {
14032                 /*
14033                  * release local locks before memory allocation.
14034                  */
14035                 mutex_exit(&srdp->srd_mutex);
14036 
14037                 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14038 
14039                 mutex_enter(&srdp->srd_mutex);
14040                 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14041                     rgnp = rgnp->rgn_hash) {
14042                         if (rgnp->rgn_saddr == r_saddr &&
14043                             rgnp->rgn_size == r_size &&
14044                             rgnp->rgn_obj == r_obj &&
14045                             rgnp->rgn_objoff == r_objoff &&
14046                             rgnp->rgn_perm == r_perm &&
14047                             rgnp->rgn_pgszc == r_pgszc) {
14048                                 break;
14049                         }
14050                 }
14051                 if (rgnp != NULL) {
14052                         goto rfound;
14053                 }
14054 
14055                 if (*nextidp >= maxids) {
14056                         mutex_exit(&srdp->srd_mutex);
14057                         goto fail;
14058                 }
14059                 rgnp = new_rgnp;
14060                 new_rgnp = NULL;
14061                 rgnp->rgn_id = (*nextidp)++;
14062                 ASSERT(rgnp->rgn_id < maxids);
14063                 ASSERT(rarrp[rgnp->rgn_id] == NULL);
14064                 rarrp[rgnp->rgn_id] = rgnp;
14065         }
14066 
14067         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14068         ASSERT(rgnp->rgn_hmeflags == 0);
14069 #ifdef DEBUG
14070         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14071                 ASSERT(rgnp->rgn_ttecnt[i] == 0);
14072         }
14073 #endif
14074         rgnp->rgn_saddr = r_saddr;
14075         rgnp->rgn_size = r_size;
14076         rgnp->rgn_obj = r_obj;
14077         rgnp->rgn_objoff = r_objoff;
14078         rgnp->rgn_perm = r_perm;
14079         rgnp->rgn_pgszc = r_pgszc;
14080         rgnp->rgn_flags = r_type;
14081         rgnp->rgn_refcnt = 0;
14082         rgnp->rgn_cb_function = r_cb_function;
14083         rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14084         srdp->srd_rgnhash[rhash] = rgnp;
14085         (*busyrgnsp)++;
14086         ASSERT(*busyrgnsp <= maxids);
14087         goto rfound;
14088 
14089 fail:
14090         ASSERT(new_rgnp != NULL);
14091         kmem_cache_free(region_cache, new_rgnp);
14092         return (HAT_INVALID_REGION_COOKIE);
14093 }
14094 
14095 /*
14096  * This function implements the shared context functionality required
14097  * when detaching a segment from an address space. It must be called
14098  * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14099  * for segments with a valid region_cookie.
14100  * It will also be called from all seg_vn routines which change a
14101  * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14102  * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14103  * from segvn_fault().
14104  */
14105 void
14106 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14107 {
14108         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14109         sf_scd_t *scdp;
14110         uint_t rhash;
14111         uint_t rid = (uint_t)((uint64_t)rcookie);
14112         hatlock_t *hatlockp = NULL;
14113         sf_region_t *rgnp;
14114         sf_region_t **prev_rgnpp;
14115         sf_region_t *cur_rgnp;
14116         void *r_obj;
14117         int i;
14118         caddr_t r_saddr;
14119         caddr_t r_eaddr;
14120         size_t  r_size;
14121         uchar_t r_pgszc;
14122         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14123 
14124         ASSERT(sfmmup != ksfmmup);
14125         ASSERT(srdp != NULL);
14126         ASSERT(srdp->srd_refcnt > 0);
14127         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14128         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14129         ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14130 
14131         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14132             SFMMU_REGION_HME;
14133 
14134         if (r_type == SFMMU_REGION_ISM) {
14135                 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14136                 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14137                 rgnp = srdp->srd_ismrgnp[rid];
14138         } else {
14139                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14140                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14141                 rgnp = srdp->srd_hmergnp[rid];
14142         }
14143         ASSERT(rgnp != NULL);
14144         ASSERT(rgnp->rgn_id == rid);
14145         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14146         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14147         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14148 
14149         if (sfmmup->sfmmu_free) {
14150                 ulong_t rttecnt;
14151                 r_pgszc = rgnp->rgn_pgszc;
14152                 r_size = rgnp->rgn_size;
14153 
14154                 ASSERT(sfmmup->sfmmu_scdp == NULL);
14155                 if (r_type == SFMMU_REGION_ISM) {
14156                         SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14157                 } else {
14158                         /* update shme rgns ttecnt in sfmmu_ttecnt */
14159                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14160                         ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14161 
14162                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14163                             -rttecnt);
14164 
14165                         SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14166                 }
14167         } else if (r_type == SFMMU_REGION_ISM) {
14168                 hatlockp = sfmmu_hat_enter(sfmmup);
14169                 ASSERT(rid < srdp->srd_next_ismrid);
14170                 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14171                 scdp = sfmmup->sfmmu_scdp;
14172                 if (scdp != NULL &&
14173                     SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14174                         sfmmu_leave_scd(sfmmup, r_type);
14175                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14176                 }
14177                 sfmmu_hat_exit(hatlockp);
14178         } else {
14179                 ulong_t rttecnt;
14180                 r_pgszc = rgnp->rgn_pgszc;
14181                 r_saddr = rgnp->rgn_saddr;
14182                 r_size = rgnp->rgn_size;
14183                 r_eaddr = r_saddr + r_size;
14184 
14185                 ASSERT(r_type == SFMMU_REGION_HME);
14186                 hatlockp = sfmmu_hat_enter(sfmmup);
14187                 ASSERT(rid < srdp->srd_next_hmerid);
14188                 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14189 
14190                 /*
14191                  * If region is part of an SCD call sfmmu_leave_scd().
14192                  * Otherwise if process is not exiting and has valid context
14193                  * just drop the context on the floor to lose stale TLB
14194                  * entries and force the update of tsb miss area to reflect
14195                  * the new region map. After that clean our TSB entries.
14196                  */
14197                 scdp = sfmmup->sfmmu_scdp;
14198                 if (scdp != NULL &&
14199                     SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14200                         sfmmu_leave_scd(sfmmup, r_type);
14201                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14202                 }
14203                 sfmmu_invalidate_ctx(sfmmup);
14204 
14205                 i = TTE8K;
14206                 while (i < mmu_page_sizes) {
14207                         if (rgnp->rgn_ttecnt[i] != 0) {
14208                                 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14209                                     r_eaddr, i);
14210                                 if (i < TTE4M) {
14211                                         i = TTE4M;
14212                                         continue;
14213                                 } else {
14214                                         break;
14215                                 }
14216                         }
14217                         i++;
14218                 }
14219                 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14220                 if (r_pgszc >= TTE4M) {
14221                         rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14222                         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14223                             rttecnt);
14224                         sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14225                 }
14226 
14227                 /* update shme rgns ttecnt in sfmmu_ttecnt */
14228                 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14229                 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14230                 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14231 
14232                 sfmmu_hat_exit(hatlockp);
14233                 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14234                         /* sfmmup left the scd, grow private tsb */
14235                         sfmmu_check_page_sizes(sfmmup, 1);
14236                 } else {
14237                         sfmmu_check_page_sizes(sfmmup, 0);
14238                 }
14239         }
14240 
14241         if (r_type == SFMMU_REGION_HME) {
14242                 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14243         }
14244 
14245         r_obj = rgnp->rgn_obj;
14246         if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14247                 return;
14248         }
14249 
14250         /*
14251          * looks like nobody uses this region anymore. Free it.
14252          */
14253         rhash = RGN_HASH_FUNCTION(r_obj);
14254         mutex_enter(&srdp->srd_mutex);
14255         for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14256             (cur_rgnp = *prev_rgnpp) != NULL;
14257             prev_rgnpp = &cur_rgnp->rgn_hash) {
14258                 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14259                         break;
14260                 }
14261         }
14262 
14263         if (cur_rgnp == NULL) {
14264                 mutex_exit(&srdp->srd_mutex);
14265                 return;
14266         }
14267 
14268         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14269         *prev_rgnpp = rgnp->rgn_hash;
14270         if (r_type == SFMMU_REGION_ISM) {
14271                 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14272                 ASSERT(rid < srdp->srd_next_ismrid);
14273                 rgnp->rgn_next = srdp->srd_ismrgnfree;
14274                 srdp->srd_ismrgnfree = rgnp;
14275                 ASSERT(srdp->srd_ismbusyrgns > 0);
14276                 srdp->srd_ismbusyrgns--;
14277                 mutex_exit(&srdp->srd_mutex);
14278                 return;
14279         }
14280         mutex_exit(&srdp->srd_mutex);
14281 
14282         /*
14283          * Destroy region's hmeblks.
14284          */
14285         sfmmu_unload_hmeregion(srdp, rgnp);
14286 
14287         rgnp->rgn_hmeflags = 0;
14288 
14289         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14290         ASSERT(rgnp->rgn_id == rid);
14291         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14292                 rgnp->rgn_ttecnt[i] = 0;
14293         }
14294         rgnp->rgn_flags |= SFMMU_REGION_FREE;
14295         mutex_enter(&srdp->srd_mutex);
14296         ASSERT(rid < srdp->srd_next_hmerid);
14297         rgnp->rgn_next = srdp->srd_hmergnfree;
14298         srdp->srd_hmergnfree = rgnp;
14299         ASSERT(srdp->srd_hmebusyrgns > 0);
14300         srdp->srd_hmebusyrgns--;
14301         mutex_exit(&srdp->srd_mutex);
14302 }
14303 
14304 /*
14305  * For now only called for hmeblk regions and not for ISM regions.
14306  */
14307 void
14308 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14309 {
14310         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14311         uint_t rid = (uint_t)((uint64_t)rcookie);
14312         sf_region_t *rgnp;
14313         sf_rgn_link_t *rlink;
14314         sf_rgn_link_t *hrlink;
14315         ulong_t rttecnt;
14316 
14317         ASSERT(sfmmup != ksfmmup);
14318         ASSERT(srdp != NULL);
14319         ASSERT(srdp->srd_refcnt > 0);
14320 
14321         ASSERT(rid < srdp->srd_next_hmerid);
14322         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14323         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14324 
14325         rgnp = srdp->srd_hmergnp[rid];
14326         ASSERT(rgnp->rgn_refcnt > 0);
14327         ASSERT(rgnp->rgn_id == rid);
14328         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14329         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14330 
14331         atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14332 
14333         /* LINTED: constant in conditional context */
14334         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14335         ASSERT(rlink != NULL);
14336         mutex_enter(&rgnp->rgn_mutex);
14337         ASSERT(rgnp->rgn_sfmmu_head != NULL);
14338         /* LINTED: constant in conditional context */
14339         SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14340         ASSERT(hrlink != NULL);
14341         ASSERT(hrlink->prev == NULL);
14342         rlink->next = rgnp->rgn_sfmmu_head;
14343         rlink->prev = NULL;
14344         hrlink->prev = sfmmup;
14345         /*
14346          * make sure rlink's next field is correct
14347          * before making this link visible.
14348          */
14349         membar_stst();
14350         rgnp->rgn_sfmmu_head = sfmmup;
14351         mutex_exit(&rgnp->rgn_mutex);
14352 
14353         /* update sfmmu_ttecnt with the shme rgn ttecnt */
14354         rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14355         atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14356         /* update tsb0 inflation count */
14357         if (rgnp->rgn_pgszc >= TTE4M) {
14358                 sfmmup->sfmmu_tsb0_4minflcnt +=
14359                     rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14360         }
14361         /*
14362          * Update regionid bitmask without hat lock since no other thread
14363          * can update this region bitmask right now.
14364          */
14365         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14366 }
14367 
14368 /* ARGSUSED */
14369 static int
14370 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14371 {
14372         sf_region_t *rgnp = (sf_region_t *)buf;
14373         bzero(buf, sizeof (*rgnp));
14374 
14375         mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14376 
14377         return (0);
14378 }
14379 
14380 /* ARGSUSED */
14381 static void
14382 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14383 {
14384         sf_region_t *rgnp = (sf_region_t *)buf;
14385         mutex_destroy(&rgnp->rgn_mutex);
14386 }
14387 
14388 static int
14389 sfrgnmap_isnull(sf_region_map_t *map)
14390 {
14391         int i;
14392 
14393         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14394                 if (map->bitmap[i] != 0) {
14395                         return (0);
14396                 }
14397         }
14398         return (1);
14399 }
14400 
14401 static int
14402 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14403 {
14404         int i;
14405 
14406         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14407                 if (map->bitmap[i] != 0) {
14408                         return (0);
14409                 }
14410         }
14411         return (1);
14412 }
14413 
14414 #ifdef DEBUG
14415 static void
14416 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14417 {
14418         sfmmu_t *sp;
14419         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14420 
14421         for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14422                 ASSERT(srdp == sp->sfmmu_srdp);
14423                 if (sp == sfmmup) {
14424                         if (onlist) {
14425                                 return;
14426                         } else {
14427                                 panic("shctx: sfmmu 0x%p found on scd"
14428                                     "list 0x%p", (void *)sfmmup,
14429                                     (void *)*headp);
14430                         }
14431                 }
14432         }
14433         if (onlist) {
14434                 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14435                     (void *)sfmmup, (void *)*headp);
14436         } else {
14437                 return;
14438         }
14439 }
14440 #else /* DEBUG */
14441 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14442 #endif /* DEBUG */
14443 
14444 /*
14445  * Removes an sfmmu from the SCD sfmmu list.
14446  */
14447 static void
14448 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14449 {
14450         ASSERT(sfmmup->sfmmu_srdp != NULL);
14451         check_scd_sfmmu_list(headp, sfmmup, 1);
14452         if (sfmmup->sfmmu_scd_link.prev != NULL) {
14453                 ASSERT(*headp != sfmmup);
14454                 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14455                     sfmmup->sfmmu_scd_link.next;
14456         } else {
14457                 ASSERT(*headp == sfmmup);
14458                 *headp = sfmmup->sfmmu_scd_link.next;
14459         }
14460         if (sfmmup->sfmmu_scd_link.next != NULL) {
14461                 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14462                     sfmmup->sfmmu_scd_link.prev;
14463         }
14464 }
14465 
14466 
14467 /*
14468  * Adds an sfmmu to the start of the queue.
14469  */
14470 static void
14471 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14472 {
14473         check_scd_sfmmu_list(headp, sfmmup, 0);
14474         sfmmup->sfmmu_scd_link.prev = NULL;
14475         sfmmup->sfmmu_scd_link.next = *headp;
14476         if (*headp != NULL)
14477                 (*headp)->sfmmu_scd_link.prev = sfmmup;
14478         *headp = sfmmup;
14479 }
14480 
14481 /*
14482  * Remove an scd from the start of the queue.
14483  */
14484 static void
14485 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14486 {
14487         if (scdp->scd_prev != NULL) {
14488                 ASSERT(*headp != scdp);
14489                 scdp->scd_prev->scd_next = scdp->scd_next;
14490         } else {
14491                 ASSERT(*headp == scdp);
14492                 *headp = scdp->scd_next;
14493         }
14494 
14495         if (scdp->scd_next != NULL) {
14496                 scdp->scd_next->scd_prev = scdp->scd_prev;
14497         }
14498 }
14499 
14500 /*
14501  * Add an scd to the start of the queue.
14502  */
14503 static void
14504 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14505 {
14506         scdp->scd_prev = NULL;
14507         scdp->scd_next = *headp;
14508         if (*headp != NULL) {
14509                 (*headp)->scd_prev = scdp;
14510         }
14511         *headp = scdp;
14512 }
14513 
14514 static int
14515 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14516 {
14517         uint_t rid;
14518         uint_t i;
14519         uint_t j;
14520         ulong_t w;
14521         sf_region_t *rgnp;
14522         ulong_t tte8k_cnt = 0;
14523         ulong_t tte4m_cnt = 0;
14524         uint_t tsb_szc;
14525         sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14526         sfmmu_t *ism_hatid;
14527         struct tsb_info *newtsb;
14528         int szc;
14529 
14530         ASSERT(srdp != NULL);
14531 
14532         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14533                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14534                         continue;
14535                 }
14536                 j = 0;
14537                 while (w) {
14538                         if (!(w & 0x1)) {
14539                                 j++;
14540                                 w >>= 1;
14541                                 continue;
14542                         }
14543                         rid = (i << BT_ULSHIFT) | j;
14544                         j++;
14545                         w >>= 1;
14546 
14547                         if (rid < SFMMU_MAX_HME_REGIONS) {
14548                                 rgnp = srdp->srd_hmergnp[rid];
14549                                 ASSERT(rgnp->rgn_id == rid);
14550                                 ASSERT(rgnp->rgn_refcnt > 0);
14551 
14552                                 if (rgnp->rgn_pgszc < TTE4M) {
14553                                         tte8k_cnt += rgnp->rgn_size >>
14554                                             TTE_PAGE_SHIFT(TTE8K);
14555                                 } else {
14556                                         ASSERT(rgnp->rgn_pgszc >= TTE4M);
14557                                         tte4m_cnt += rgnp->rgn_size >>
14558                                             TTE_PAGE_SHIFT(TTE4M);
14559                                         /*
14560                                          * Inflate SCD tsb0 by preallocating
14561                                          * 1/4 8k ttecnt for 4M regions to
14562                                          * allow for lgpg alloc failure.
14563                                          */
14564                                         tte8k_cnt += rgnp->rgn_size >>
14565                                             (TTE_PAGE_SHIFT(TTE8K) + 2);
14566                                 }
14567                         } else {
14568                                 rid -= SFMMU_MAX_HME_REGIONS;
14569                                 rgnp = srdp->srd_ismrgnp[rid];
14570                                 ASSERT(rgnp->rgn_id == rid);
14571                                 ASSERT(rgnp->rgn_refcnt > 0);
14572 
14573                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14574                                 ASSERT(ism_hatid->sfmmu_ismhat);
14575 
14576                                 for (szc = 0; szc < TTE4M; szc++) {
14577                                         tte8k_cnt +=
14578                                             ism_hatid->sfmmu_ttecnt[szc] <<
14579                                             TTE_BSZS_SHIFT(szc);
14580                                 }
14581 
14582                                 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14583                                 if (rgnp->rgn_pgszc >= TTE4M) {
14584                                         tte4m_cnt += rgnp->rgn_size >>
14585                                             TTE_PAGE_SHIFT(TTE4M);
14586                                 }
14587                         }
14588                 }
14589         }
14590 
14591         tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14592 
14593         /* Allocate both the SCD TSBs here. */
14594         if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14595             tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14596             (tsb_szc <= TSB_4M_SZCODE ||
14597             sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14598             TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14599             TSB_ALLOC, scsfmmup))) {
14600 
14601                 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14602                 return (TSB_ALLOCFAIL);
14603         } else {
14604                 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14605 
14606                 if (tte4m_cnt) {
14607                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14608                         if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14609                             TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14610                             (tsb_szc <= TSB_4M_SZCODE ||
14611                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14612                             TSB4M|TSB32M|TSB256M,
14613                             TSB_ALLOC, scsfmmup))) {
14614                                 /*
14615                                  * If we fail to allocate the 2nd shared tsb,
14616                                  * just free the 1st tsb, return failure.
14617                                  */
14618                                 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14619                                 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14620                                 return (TSB_ALLOCFAIL);
14621                         } else {
14622                                 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14623                                 newtsb->tsb_flags |= TSB_SHAREDCTX;
14624                                 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14625                                 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14626                         }
14627                 }
14628                 SFMMU_STAT(sf_scd_1sttsb_alloc);
14629         }
14630         return (TSB_SUCCESS);
14631 }
14632 
14633 static void
14634 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14635 {
14636         while (scd_sfmmu->sfmmu_tsb != NULL) {
14637                 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14638                 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14639                 scd_sfmmu->sfmmu_tsb = next;
14640         }
14641 }
14642 
14643 /*
14644  * Link the sfmmu onto the hme region list.
14645  */
14646 void
14647 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14648 {
14649         uint_t rid;
14650         sf_rgn_link_t *rlink;
14651         sfmmu_t *head;
14652         sf_rgn_link_t *hrlink;
14653 
14654         rid = rgnp->rgn_id;
14655         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14656 
14657         /* LINTED: constant in conditional context */
14658         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14659         ASSERT(rlink != NULL);
14660         mutex_enter(&rgnp->rgn_mutex);
14661         if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14662                 rlink->next = NULL;
14663                 rlink->prev = NULL;
14664                 /*
14665                  * make sure rlink's next field is NULL
14666                  * before making this link visible.
14667                  */
14668                 membar_stst();
14669                 rgnp->rgn_sfmmu_head = sfmmup;
14670         } else {
14671                 /* LINTED: constant in conditional context */
14672                 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14673                 ASSERT(hrlink != NULL);
14674                 ASSERT(hrlink->prev == NULL);
14675                 rlink->next = head;
14676                 rlink->prev = NULL;
14677                 hrlink->prev = sfmmup;
14678                 /*
14679                  * make sure rlink's next field is correct
14680                  * before making this link visible.
14681                  */
14682                 membar_stst();
14683                 rgnp->rgn_sfmmu_head = sfmmup;
14684         }
14685         mutex_exit(&rgnp->rgn_mutex);
14686 }
14687 
14688 /*
14689  * Unlink the sfmmu from the hme region list.
14690  */
14691 void
14692 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14693 {
14694         uint_t rid;
14695         sf_rgn_link_t *rlink;
14696 
14697         rid = rgnp->rgn_id;
14698         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14699 
14700         /* LINTED: constant in conditional context */
14701         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14702         ASSERT(rlink != NULL);
14703         mutex_enter(&rgnp->rgn_mutex);
14704         if (rgnp->rgn_sfmmu_head == sfmmup) {
14705                 sfmmu_t *next = rlink->next;
14706                 rgnp->rgn_sfmmu_head = next;
14707                 /*
14708                  * if we are stopped by xc_attention() after this
14709                  * point the forward link walking in
14710                  * sfmmu_rgntlb_demap() will work correctly since the
14711                  * head correctly points to the next element.
14712                  */
14713                 membar_stst();
14714                 rlink->next = NULL;
14715                 ASSERT(rlink->prev == NULL);
14716                 if (next != NULL) {
14717                         sf_rgn_link_t *nrlink;
14718                         /* LINTED: constant in conditional context */
14719                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14720                         ASSERT(nrlink != NULL);
14721                         ASSERT(nrlink->prev == sfmmup);
14722                         nrlink->prev = NULL;
14723                 }
14724         } else {
14725                 sfmmu_t *next = rlink->next;
14726                 sfmmu_t *prev = rlink->prev;
14727                 sf_rgn_link_t *prlink;
14728 
14729                 ASSERT(prev != NULL);
14730                 /* LINTED: constant in conditional context */
14731                 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14732                 ASSERT(prlink != NULL);
14733                 ASSERT(prlink->next == sfmmup);
14734                 prlink->next = next;
14735                 /*
14736                  * if we are stopped by xc_attention()
14737                  * after this point the forward link walking
14738                  * will work correctly since the prev element
14739                  * correctly points to the next element.
14740                  */
14741                 membar_stst();
14742                 rlink->next = NULL;
14743                 rlink->prev = NULL;
14744                 if (next != NULL) {
14745                         sf_rgn_link_t *nrlink;
14746                         /* LINTED: constant in conditional context */
14747                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14748                         ASSERT(nrlink != NULL);
14749                         ASSERT(nrlink->prev == sfmmup);
14750                         nrlink->prev = prev;
14751                 }
14752         }
14753         mutex_exit(&rgnp->rgn_mutex);
14754 }
14755 
14756 /*
14757  * Link scd sfmmu onto ism or hme region list for each region in the
14758  * scd region map.
14759  */
14760 void
14761 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14762 {
14763         uint_t rid;
14764         uint_t i;
14765         uint_t j;
14766         ulong_t w;
14767         sf_region_t *rgnp;
14768         sfmmu_t *scsfmmup;
14769 
14770         scsfmmup = scdp->scd_sfmmup;
14771         ASSERT(scsfmmup->sfmmu_scdhat);
14772         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14773                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14774                         continue;
14775                 }
14776                 j = 0;
14777                 while (w) {
14778                         if (!(w & 0x1)) {
14779                                 j++;
14780                                 w >>= 1;
14781                                 continue;
14782                         }
14783                         rid = (i << BT_ULSHIFT) | j;
14784                         j++;
14785                         w >>= 1;
14786 
14787                         if (rid < SFMMU_MAX_HME_REGIONS) {
14788                                 rgnp = srdp->srd_hmergnp[rid];
14789                                 ASSERT(rgnp->rgn_id == rid);
14790                                 ASSERT(rgnp->rgn_refcnt > 0);
14791                                 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14792                         } else {
14793                                 sfmmu_t *ism_hatid = NULL;
14794                                 ism_ment_t *ism_ment;
14795                                 rid -= SFMMU_MAX_HME_REGIONS;
14796                                 rgnp = srdp->srd_ismrgnp[rid];
14797                                 ASSERT(rgnp->rgn_id == rid);
14798                                 ASSERT(rgnp->rgn_refcnt > 0);
14799 
14800                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14801                                 ASSERT(ism_hatid->sfmmu_ismhat);
14802                                 ism_ment = &scdp->scd_ism_links[rid];
14803                                 ism_ment->iment_hat = scsfmmup;
14804                                 ism_ment->iment_base_va = rgnp->rgn_saddr;
14805                                 mutex_enter(&ism_mlist_lock);
14806                                 iment_add(ism_ment, ism_hatid);
14807                                 mutex_exit(&ism_mlist_lock);
14808 
14809                         }
14810                 }
14811         }
14812 }
14813 /*
14814  * Unlink scd sfmmu from ism or hme region list for each region in the
14815  * scd region map.
14816  */
14817 void
14818 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14819 {
14820         uint_t rid;
14821         uint_t i;
14822         uint_t j;
14823         ulong_t w;
14824         sf_region_t *rgnp;
14825         sfmmu_t *scsfmmup;
14826 
14827         scsfmmup = scdp->scd_sfmmup;
14828         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14829                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14830                         continue;
14831                 }
14832                 j = 0;
14833                 while (w) {
14834                         if (!(w & 0x1)) {
14835                                 j++;
14836                                 w >>= 1;
14837                                 continue;
14838                         }
14839                         rid = (i << BT_ULSHIFT) | j;
14840                         j++;
14841                         w >>= 1;
14842 
14843                         if (rid < SFMMU_MAX_HME_REGIONS) {
14844                                 rgnp = srdp->srd_hmergnp[rid];
14845                                 ASSERT(rgnp->rgn_id == rid);
14846                                 ASSERT(rgnp->rgn_refcnt > 0);
14847                                 sfmmu_unlink_from_hmeregion(scsfmmup,
14848                                     rgnp);
14849 
14850                         } else {
14851                                 sfmmu_t *ism_hatid = NULL;
14852                                 ism_ment_t *ism_ment;
14853                                 rid -= SFMMU_MAX_HME_REGIONS;
14854                                 rgnp = srdp->srd_ismrgnp[rid];
14855                                 ASSERT(rgnp->rgn_id == rid);
14856                                 ASSERT(rgnp->rgn_refcnt > 0);
14857 
14858                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14859                                 ASSERT(ism_hatid->sfmmu_ismhat);
14860                                 ism_ment = &scdp->scd_ism_links[rid];
14861                                 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
14862                                 ASSERT(ism_ment->iment_base_va ==
14863                                     rgnp->rgn_saddr);
14864                                 mutex_enter(&ism_mlist_lock);
14865                                 iment_sub(ism_ment, ism_hatid);
14866                                 mutex_exit(&ism_mlist_lock);
14867 
14868                         }
14869                 }
14870         }
14871 }
14872 /*
14873  * Allocates and initialises a new SCD structure, this is called with
14874  * the srd_scd_mutex held and returns with the reference count
14875  * initialised to 1.
14876  */
14877 static sf_scd_t *
14878 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
14879 {
14880         sf_scd_t *new_scdp;
14881         sfmmu_t *scsfmmup;
14882         int i;
14883 
14884         ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
14885         new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
14886 
14887         scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
14888         new_scdp->scd_sfmmup = scsfmmup;
14889         scsfmmup->sfmmu_srdp = srdp;
14890         scsfmmup->sfmmu_scdp = new_scdp;
14891         scsfmmup->sfmmu_tsb0_4minflcnt = 0;
14892         scsfmmup->sfmmu_scdhat = 1;
14893         CPUSET_ALL(scsfmmup->sfmmu_cpusran);
14894         bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
14895 
14896         ASSERT(max_mmu_ctxdoms > 0);
14897         for (i = 0; i < max_mmu_ctxdoms; i++) {
14898                 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
14899                 scsfmmup->sfmmu_ctxs[i].gnum = 0;
14900         }
14901 
14902         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14903                 new_scdp->scd_rttecnt[i] = 0;
14904         }
14905 
14906         new_scdp->scd_region_map = *new_map;
14907         new_scdp->scd_refcnt = 1;
14908         if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
14909                 kmem_cache_free(scd_cache, new_scdp);
14910                 kmem_cache_free(sfmmuid_cache, scsfmmup);
14911                 return (NULL);
14912         }
14913         if (&mmu_init_scd) {
14914                 mmu_init_scd(new_scdp);
14915         }
14916         return (new_scdp);
14917 }
14918 
14919 /*
14920  * The first phase of a process joining an SCD. The hat structure is
14921  * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
14922  * and a cross-call with context invalidation is used to cause the
14923  * remaining work to be carried out in the sfmmu_tsbmiss_exception()
14924  * routine.
14925  */
14926 static void
14927 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
14928 {
14929         hatlock_t *hatlockp;
14930         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14931         int i;
14932         sf_scd_t *old_scdp;
14933 
14934         ASSERT(srdp != NULL);
14935         ASSERT(scdp != NULL);
14936         ASSERT(scdp->scd_refcnt > 0);
14937         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14938 
14939         if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
14940                 ASSERT(old_scdp != scdp);
14941 
14942                 mutex_enter(&old_scdp->scd_mutex);
14943                 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
14944                 mutex_exit(&old_scdp->scd_mutex);
14945                 /*
14946                  * sfmmup leaves the old scd. Update sfmmu_ttecnt to
14947                  * include the shme rgn ttecnt for rgns that
14948                  * were in the old SCD
14949                  */
14950                 for (i = 0; i < mmu_page_sizes; i++) {
14951                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14952                             old_scdp->scd_rttecnt[i]);
14953                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14954                             sfmmup->sfmmu_scdrttecnt[i]);
14955                 }
14956         }
14957 
14958         /*
14959          * Move sfmmu to the scd lists.
14960          */
14961         mutex_enter(&scdp->scd_mutex);
14962         sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
14963         mutex_exit(&scdp->scd_mutex);
14964         SF_SCD_INCR_REF(scdp);
14965 
14966         hatlockp = sfmmu_hat_enter(sfmmup);
14967         /*
14968          * For a multi-thread process, we must stop
14969          * all the other threads before joining the scd.
14970          */
14971 
14972         SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
14973 
14974         sfmmu_invalidate_ctx(sfmmup);
14975         sfmmup->sfmmu_scdp = scdp;
14976 
14977         /*
14978          * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
14979          * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
14980          */
14981         for (i = 0; i < mmu_page_sizes; i++) {
14982                 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
14983                 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
14984                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14985                     -sfmmup->sfmmu_scdrttecnt[i]);
14986         }
14987         /* update tsb0 inflation count */
14988         if (old_scdp != NULL) {
14989                 sfmmup->sfmmu_tsb0_4minflcnt +=
14990                     old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14991         }
14992         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14993             scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
14994         sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14995 
14996         sfmmu_hat_exit(hatlockp);
14997 
14998         if (old_scdp != NULL) {
14999                 SF_SCD_DECR_REF(srdp, old_scdp);
15000         }
15001 
15002 }
15003 
15004 /*
15005  * This routine is called by a process to become part of an SCD. It is called
15006  * from sfmmu_tsbmiss_exception() once most of the initial work has been
15007  * done by sfmmu_join_scd(). This routine must not drop the hat lock.
15008  */
15009 static void
15010 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
15011 {
15012         struct tsb_info *tsbinfop;
15013 
15014         ASSERT(sfmmu_hat_lock_held(sfmmup));
15015         ASSERT(sfmmup->sfmmu_scdp != NULL);
15016         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
15017         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15018         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15019 
15020         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15021             tsbinfop = tsbinfop->tsb_next) {
15022                 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15023                         continue;
15024                 }
15025                 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15026 
15027                 sfmmu_inv_tsb(tsbinfop->tsb_va,
15028                     TSB_BYTES(tsbinfop->tsb_szc));
15029         }
15030 
15031         /* Set HAT_CTX1_FLAG for all SCD ISMs */
15032         sfmmu_ism_hatflags(sfmmup, 1);
15033 
15034         SFMMU_STAT(sf_join_scd);
15035 }
15036 
15037 /*
15038  * This routine is called in order to check if there is an SCD which matches
15039  * the process's region map if not then a new SCD may be created.
15040  */
15041 static void
15042 sfmmu_find_scd(sfmmu_t *sfmmup)
15043 {
15044         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15045         sf_scd_t *scdp, *new_scdp;
15046         int ret;
15047 
15048         ASSERT(srdp != NULL);
15049         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15050 
15051         mutex_enter(&srdp->srd_scd_mutex);
15052         for (scdp = srdp->srd_scdp; scdp != NULL;
15053             scdp = scdp->scd_next) {
15054                 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15055                     &sfmmup->sfmmu_region_map, ret);
15056                 if (ret == 1) {
15057                         SF_SCD_INCR_REF(scdp);
15058                         mutex_exit(&srdp->srd_scd_mutex);
15059                         sfmmu_join_scd(scdp, sfmmup);
15060                         ASSERT(scdp->scd_refcnt >= 2);
15061                         atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
15062                         return;
15063                 } else {
15064                         /*
15065                          * If the sfmmu region map is a subset of the scd
15066                          * region map, then the assumption is that this process
15067                          * will continue attaching to ISM segments until the
15068                          * region maps are equal.
15069                          */
15070                         SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15071                             &sfmmup->sfmmu_region_map, ret);
15072                         if (ret == 1) {
15073                                 mutex_exit(&srdp->srd_scd_mutex);
15074                                 return;
15075                         }
15076                 }
15077         }
15078 
15079         ASSERT(scdp == NULL);
15080         /*
15081          * No matching SCD has been found, create a new one.
15082          */
15083         if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15084             NULL) {
15085                 mutex_exit(&srdp->srd_scd_mutex);
15086                 return;
15087         }
15088 
15089         /*
15090          * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15091          */
15092 
15093         /* Set scd_rttecnt for shme rgns in SCD */
15094         sfmmu_set_scd_rttecnt(srdp, new_scdp);
15095 
15096         /*
15097          * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15098          */
15099         sfmmu_link_scd_to_regions(srdp, new_scdp);
15100         sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15101         SFMMU_STAT_ADD(sf_create_scd, 1);
15102 
15103         mutex_exit(&srdp->srd_scd_mutex);
15104         sfmmu_join_scd(new_scdp, sfmmup);
15105         ASSERT(new_scdp->scd_refcnt >= 2);
15106         atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
15107 }
15108 
15109 /*
15110  * This routine is called by a process to remove itself from an SCD. It is
15111  * either called when the processes has detached from a segment or from
15112  * hat_free_start() as a result of calling exit.
15113  */
15114 static void
15115 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15116 {
15117         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15118         sf_srd_t *srdp =  sfmmup->sfmmu_srdp;
15119         hatlock_t *hatlockp = TSB_HASH(sfmmup);
15120         int i;
15121 
15122         ASSERT(scdp != NULL);
15123         ASSERT(srdp != NULL);
15124 
15125         if (sfmmup->sfmmu_free) {
15126                 /*
15127                  * If the process is part of an SCD the sfmmu is unlinked
15128                  * from scd_sf_list.
15129                  */
15130                 mutex_enter(&scdp->scd_mutex);
15131                 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15132                 mutex_exit(&scdp->scd_mutex);
15133                 /*
15134                  * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15135                  * are about to leave the SCD
15136                  */
15137                 for (i = 0; i < mmu_page_sizes; i++) {
15138                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15139                             scdp->scd_rttecnt[i]);
15140                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15141                             sfmmup->sfmmu_scdrttecnt[i]);
15142                         sfmmup->sfmmu_scdrttecnt[i] = 0;
15143                 }
15144                 sfmmup->sfmmu_scdp = NULL;
15145 
15146                 SF_SCD_DECR_REF(srdp, scdp);
15147                 return;
15148         }
15149 
15150         ASSERT(r_type != SFMMU_REGION_ISM ||
15151             SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15152         ASSERT(scdp->scd_refcnt);
15153         ASSERT(!sfmmup->sfmmu_free);
15154         ASSERT(sfmmu_hat_lock_held(sfmmup));
15155         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15156 
15157         /*
15158          * Wait for ISM maps to be updated.
15159          */
15160         if (r_type != SFMMU_REGION_ISM) {
15161                 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15162                     sfmmup->sfmmu_scdp != NULL) {
15163                         cv_wait(&sfmmup->sfmmu_tsb_cv,
15164                             HATLOCK_MUTEXP(hatlockp));
15165                 }
15166 
15167                 if (sfmmup->sfmmu_scdp == NULL) {
15168                         sfmmu_hat_exit(hatlockp);
15169                         return;
15170                 }
15171                 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15172         }
15173 
15174         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15175                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15176                 /*
15177                  * Since HAT_JOIN_SCD was set our context
15178                  * is still invalid.
15179                  */
15180         } else {
15181                 /*
15182                  * For a multi-thread process, we must stop
15183                  * all the other threads before leaving the scd.
15184                  */
15185 
15186                 sfmmu_invalidate_ctx(sfmmup);
15187         }
15188 
15189         /* Clear all the rid's for ISM, delete flags, etc */
15190         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15191         sfmmu_ism_hatflags(sfmmup, 0);
15192 
15193         /*
15194          * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15195          * are in SCD before this sfmmup leaves the SCD.
15196          */
15197         for (i = 0; i < mmu_page_sizes; i++) {
15198                 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15199                     scdp->scd_rttecnt[i]);
15200                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15201                     sfmmup->sfmmu_scdrttecnt[i]);
15202                 sfmmup->sfmmu_scdrttecnt[i] = 0;
15203                 /* update ismttecnt to include SCD ism before hat leaves SCD */
15204                 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15205                 sfmmup->sfmmu_scdismttecnt[i] = 0;
15206         }
15207         /* update tsb0 inflation count */
15208         sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15209 
15210         if (r_type != SFMMU_REGION_ISM) {
15211                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15212         }
15213         sfmmup->sfmmu_scdp = NULL;
15214 
15215         sfmmu_hat_exit(hatlockp);
15216 
15217         /*
15218          * Unlink sfmmu from scd_sf_list this can be done without holding
15219          * the hat lock as we hold the sfmmu_as lock which prevents
15220          * hat_join_region from adding this thread to the scd again. Other
15221          * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15222          * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15223          * while holding the hat lock.
15224          */
15225         mutex_enter(&scdp->scd_mutex);
15226         sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15227         mutex_exit(&scdp->scd_mutex);
15228         SFMMU_STAT(sf_leave_scd);
15229 
15230         SF_SCD_DECR_REF(srdp, scdp);
15231         hatlockp = sfmmu_hat_enter(sfmmup);
15232 
15233 }
15234 
15235 /*
15236  * Unlink and free up an SCD structure with a reference count of 0.
15237  */
15238 static void
15239 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15240 {
15241         sfmmu_t *scsfmmup;
15242         sf_scd_t *sp;
15243         hatlock_t *shatlockp;
15244         int i, ret;
15245 
15246         mutex_enter(&srdp->srd_scd_mutex);
15247         for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15248                 if (sp == scdp)
15249                         break;
15250         }
15251         if (sp == NULL || sp->scd_refcnt) {
15252                 mutex_exit(&srdp->srd_scd_mutex);
15253                 return;
15254         }
15255 
15256         /*
15257          * It is possible that the scd has been freed and reallocated with a
15258          * different region map while we've been waiting for the srd_scd_mutex.
15259          */
15260         SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15261         if (ret != 1) {
15262                 mutex_exit(&srdp->srd_scd_mutex);
15263                 return;
15264         }
15265 
15266         ASSERT(scdp->scd_sf_list == NULL);
15267         /*
15268          * Unlink scd from srd_scdp list.
15269          */
15270         sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15271         mutex_exit(&srdp->srd_scd_mutex);
15272 
15273         sfmmu_unlink_scd_from_regions(srdp, scdp);
15274 
15275         /* Clear shared context tsb and release ctx */
15276         scsfmmup = scdp->scd_sfmmup;
15277 
15278         /*
15279          * create a barrier so that scd will not be destroyed
15280          * if other thread still holds the same shared hat lock.
15281          * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15282          * shared hat lock before checking the shared tsb reloc flag.
15283          */
15284         shatlockp = sfmmu_hat_enter(scsfmmup);
15285         sfmmu_hat_exit(shatlockp);
15286 
15287         sfmmu_free_scd_tsbs(scsfmmup);
15288 
15289         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15290                 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15291                         kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15292                             SFMMU_L2_HMERLINKS_SIZE);
15293                         scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15294                 }
15295         }
15296         kmem_cache_free(sfmmuid_cache, scsfmmup);
15297         kmem_cache_free(scd_cache, scdp);
15298         SFMMU_STAT(sf_destroy_scd);
15299 }
15300 
15301 /*
15302  * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15303  * bits which are set in the ism_region_map parameter. This flag indicates to
15304  * the tsbmiss handler that mapping for these segments should be loaded using
15305  * the shared context.
15306  */
15307 static void
15308 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15309 {
15310         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15311         ism_blk_t *ism_blkp;
15312         ism_map_t *ism_map;
15313         int i, rid;
15314 
15315         ASSERT(sfmmup->sfmmu_iblk != NULL);
15316         ASSERT(scdp != NULL);
15317         /*
15318          * Note that the caller either set HAT_ISMBUSY flag or checked
15319          * under hat lock that HAT_ISMBUSY was not set by another thread.
15320          */
15321         ASSERT(sfmmu_hat_lock_held(sfmmup));
15322 
15323         ism_blkp = sfmmup->sfmmu_iblk;
15324         while (ism_blkp != NULL) {
15325                 ism_map = ism_blkp->iblk_maps;
15326                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15327                         rid = ism_map[i].imap_rid;
15328                         if (rid == SFMMU_INVALID_ISMRID) {
15329                                 continue;
15330                         }
15331                         ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15332                         if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15333                             addflag) {
15334                                 ism_map[i].imap_hatflags |=
15335                                     HAT_CTX1_FLAG;
15336                         } else {
15337                                 ism_map[i].imap_hatflags &=
15338                                     ~HAT_CTX1_FLAG;
15339                         }
15340                 }
15341                 ism_blkp = ism_blkp->iblk_next;
15342         }
15343 }
15344 
15345 static int
15346 sfmmu_srd_lock_held(sf_srd_t *srdp)
15347 {
15348         return (MUTEX_HELD(&srdp->srd_mutex));
15349 }
15350 
15351 /* ARGSUSED */
15352 static int
15353 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15354 {
15355         sf_scd_t *scdp = (sf_scd_t *)buf;
15356 
15357         bzero(buf, sizeof (sf_scd_t));
15358         mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15359         return (0);
15360 }
15361 
15362 /* ARGSUSED */
15363 static void
15364 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15365 {
15366         sf_scd_t *scdp = (sf_scd_t *)buf;
15367 
15368         mutex_destroy(&scdp->scd_mutex);
15369 }
15370 
15371 /*
15372  * The listp parameter is a pointer to a list of hmeblks which are partially
15373  * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15374  * freeing process is to cross-call all cpus to ensure that there are no
15375  * remaining cached references.
15376  *
15377  * If the local generation number is less than the global then we can free
15378  * hmeblks which are already on the pending queue as another cpu has completed
15379  * the cross-call.
15380  *
15381  * We cross-call to make sure that there are no threads on other cpus accessing
15382  * these hmblks and then complete the process of freeing them under the
15383  * following conditions:
15384  *      The total number of pending hmeblks is greater than the threshold
15385  *      The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15386  *      It is at least 1 second since the last time we cross-called
15387  *
15388  * Otherwise, we add the hmeblks to the per-cpu pending queue.
15389  */
15390 static void
15391 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15392 {
15393         struct hme_blk *hblkp, *pr_hblkp = NULL;
15394         int             count = 0;
15395         cpuset_t        cpuset = cpu_ready_set;
15396         cpu_hme_pend_t  *cpuhp;
15397         timestruc_t     now;
15398         int             one_second_expired = 0;
15399 
15400         gethrestime_lasttick(&now);
15401 
15402         for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15403                 ASSERT(hblkp->hblk_shw_bit == 0);
15404                 ASSERT(hblkp->hblk_shared == 0);
15405                 count++;
15406                 pr_hblkp = hblkp;
15407         }
15408 
15409         cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15410         mutex_enter(&cpuhp->chp_mutex);
15411 
15412         if ((cpuhp->chp_count + count) == 0) {
15413                 mutex_exit(&cpuhp->chp_mutex);
15414                 return;
15415         }
15416 
15417         if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15418                 one_second_expired  = 1;
15419         }
15420 
15421         if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15422             (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15423             one_second_expired)) {
15424                 /* Append global list to local */
15425                 if (pr_hblkp == NULL) {
15426                         *listp = cpuhp->chp_listp;
15427                 } else {
15428                         pr_hblkp->hblk_next = cpuhp->chp_listp;
15429                 }
15430                 cpuhp->chp_listp = NULL;
15431                 cpuhp->chp_count = 0;
15432                 cpuhp->chp_timestamp = now.tv_sec;
15433                 mutex_exit(&cpuhp->chp_mutex);
15434 
15435                 kpreempt_disable();
15436                 CPUSET_DEL(cpuset, CPU->cpu_id);
15437                 xt_sync(cpuset);
15438                 xt_sync(cpuset);
15439                 kpreempt_enable();
15440 
15441                 /*
15442                  * At this stage we know that no trap handlers on other
15443                  * cpus can have references to hmeblks on the list.
15444                  */
15445                 sfmmu_hblk_free(listp);
15446         } else if (*listp != NULL) {
15447                 pr_hblkp->hblk_next = cpuhp->chp_listp;
15448                 cpuhp->chp_listp = *listp;
15449                 cpuhp->chp_count += count;
15450                 *listp = NULL;
15451                 mutex_exit(&cpuhp->chp_mutex);
15452         } else {
15453                 mutex_exit(&cpuhp->chp_mutex);
15454         }
15455 }
15456 
15457 /*
15458  * Add an hmeblk to the the hash list.
15459  */
15460 void
15461 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15462         uint64_t hblkpa)
15463 {
15464         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15465 #ifdef  DEBUG
15466         if (hmebp->hmeblkp == NULL) {
15467                 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15468         }
15469 #endif /* DEBUG */
15470 
15471         hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15472         /*
15473          * Since the TSB miss handler now does not lock the hash chain before
15474          * walking it, make sure that the hmeblks nextpa is globally visible
15475          * before we make the hmeblk globally visible by updating the chain root
15476          * pointer in the hash bucket.
15477          */
15478         membar_producer();
15479         hmebp->hmeh_nextpa = hblkpa;
15480         hmeblkp->hblk_next = hmebp->hmeblkp;
15481         hmebp->hmeblkp = hmeblkp;
15482 
15483 }
15484 
15485 /*
15486  * This function is the first part of a 2 part process to remove an hmeblk
15487  * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15488  * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15489  * a per-cpu pending list using the virtual address pointer.
15490  *
15491  * TSB miss trap handlers that start after this phase will no longer see
15492  * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15493  * can still use it for further chain traversal because we haven't yet modifed
15494  * the next physical pointer or freed it.
15495  *
15496  * In the second phase of hmeblk removal we'll issue a barrier xcall before
15497  * we reuse or free this hmeblk. This will make sure all lingering references to
15498  * the hmeblk after first phase disappear before we finally reclaim it.
15499  * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15500  * during their traversal.
15501  *
15502  * The hmehash_mutex must be held when calling this function.
15503  *
15504  * Input:
15505  *       hmebp - hme hash bucket pointer
15506  *       hmeblkp - address of hmeblk to be removed
15507  *       pr_hblk - virtual address of previous hmeblkp
15508  *       listp - pointer to list of hmeblks linked by virtual address
15509  *       free_now flag - indicates that a complete removal from the hash chains
15510  *                       is necessary.
15511  *
15512  * It is inefficient to use the free_now flag as a cross-call is required to
15513  * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15514  * in short supply.
15515  */
15516 void
15517 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15518     struct hme_blk *pr_hblk, struct hme_blk **listp,
15519     int free_now)
15520 {
15521         int shw_size, vshift;
15522         struct hme_blk *shw_hblkp;
15523         uint_t          shw_mask, newshw_mask;
15524         caddr_t         vaddr;
15525         int             size;
15526         cpuset_t cpuset = cpu_ready_set;
15527 
15528         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15529 
15530         if (hmebp->hmeblkp == hmeblkp) {
15531                 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15532                 hmebp->hmeblkp = hmeblkp->hblk_next;
15533         } else {
15534                 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15535                 pr_hblk->hblk_next = hmeblkp->hblk_next;
15536         }
15537 
15538         size = get_hblk_ttesz(hmeblkp);
15539         shw_hblkp = hmeblkp->hblk_shadow;
15540         if (shw_hblkp) {
15541                 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15542                 ASSERT(!hmeblkp->hblk_shared);
15543 #ifdef  DEBUG
15544                 if (mmu_page_sizes == max_mmu_page_sizes) {
15545                         ASSERT(size < TTE256M);
15546                 } else {
15547                         ASSERT(size < TTE4M);
15548                 }
15549 #endif /* DEBUG */
15550 
15551                 shw_size = get_hblk_ttesz(shw_hblkp);
15552                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15553                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15554                 ASSERT(vshift < 8);
15555                 /*
15556                  * Atomically clear shadow mask bit
15557                  */
15558                 do {
15559                         shw_mask = shw_hblkp->hblk_shw_mask;
15560                         ASSERT(shw_mask & (1 << vshift));
15561                         newshw_mask = shw_mask & ~(1 << vshift);
15562                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15563                             shw_mask, newshw_mask);
15564                 } while (newshw_mask != shw_mask);
15565                 hmeblkp->hblk_shadow = NULL;
15566         }
15567         hmeblkp->hblk_shw_bit = 0;
15568 
15569         if (hmeblkp->hblk_shared) {
15570 #ifdef  DEBUG
15571                 sf_srd_t        *srdp;
15572                 sf_region_t     *rgnp;
15573                 uint_t          rid;
15574 
15575                 srdp = hblktosrd(hmeblkp);
15576                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15577                 rid = hmeblkp->hblk_tag.htag_rid;
15578                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15579                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15580                 rgnp = srdp->srd_hmergnp[rid];
15581                 ASSERT(rgnp != NULL);
15582                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15583 #endif /* DEBUG */
15584                 hmeblkp->hblk_shared = 0;
15585         }
15586         if (free_now) {
15587                 kpreempt_disable();
15588                 CPUSET_DEL(cpuset, CPU->cpu_id);
15589                 xt_sync(cpuset);
15590                 xt_sync(cpuset);
15591                 kpreempt_enable();
15592 
15593                 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15594                 hmeblkp->hblk_next = NULL;
15595         } else {
15596                 /* Append hmeblkp to listp for processing later. */
15597                 hmeblkp->hblk_next = *listp;
15598                 *listp = hmeblkp;
15599         }
15600 }
15601 
15602 /*
15603  * This routine is called when memory is in short supply and returns a free
15604  * hmeblk of the requested size from the cpu pending lists.
15605  */
15606 static struct hme_blk *
15607 sfmmu_check_pending_hblks(int size)
15608 {
15609         int i;
15610         struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15611         int found_hmeblk;
15612         cpuset_t cpuset = cpu_ready_set;
15613         cpu_hme_pend_t *cpuhp;
15614 
15615         /* Flush cpu hblk pending queues */
15616         for (i = 0; i < NCPU; i++) {
15617                 cpuhp = &cpu_hme_pend[i];
15618                 if (cpuhp->chp_listp != NULL)  {
15619                         mutex_enter(&cpuhp->chp_mutex);
15620                         if (cpuhp->chp_listp == NULL)  {
15621                                 mutex_exit(&cpuhp->chp_mutex);
15622                                 continue;
15623                         }
15624                         found_hmeblk = 0;
15625                         last_hmeblkp = NULL;
15626                         for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15627                             hmeblkp = hmeblkp->hblk_next) {
15628                                 if (get_hblk_ttesz(hmeblkp) == size) {
15629                                         if (last_hmeblkp == NULL) {
15630                                                 cpuhp->chp_listp =
15631                                                     hmeblkp->hblk_next;
15632                                         } else {
15633                                                 last_hmeblkp->hblk_next =
15634                                                     hmeblkp->hblk_next;
15635                                         }
15636                                         ASSERT(cpuhp->chp_count > 0);
15637                                         cpuhp->chp_count--;
15638                                         found_hmeblk = 1;
15639                                         break;
15640                                 } else {
15641                                         last_hmeblkp = hmeblkp;
15642                                 }
15643                         }
15644                         mutex_exit(&cpuhp->chp_mutex);
15645 
15646                         if (found_hmeblk) {
15647                                 kpreempt_disable();
15648                                 CPUSET_DEL(cpuset, CPU->cpu_id);
15649                                 xt_sync(cpuset);
15650                                 xt_sync(cpuset);
15651                                 kpreempt_enable();
15652                                 return (hmeblkp);
15653                         }
15654                 }
15655         }
15656         return (NULL);
15657 }