1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 /*
  25  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  26  * Copyright 2016 Gary Mills
  27  * Copyright 2019 Joyent, Inc.
  28  */
  29 
  30 /*
  31  * VM - Hardware Address Translation management for Spitfire MMU.
  32  *
  33  * This file implements the machine specific hardware translation
  34  * needed by the VM system.  The machine independent interface is
  35  * described in <vm/hat.h> while the machine dependent interface
  36  * and data structures are described in <vm/hat_sfmmu.h>.
  37  *
  38  * The hat layer manages the address translation hardware as a cache
  39  * driven by calls from the higher levels in the VM system.
  40  */
  41 
  42 #include <sys/types.h>
  43 #include <sys/kstat.h>
  44 #include <vm/hat.h>
  45 #include <vm/hat_sfmmu.h>
  46 #include <vm/page.h>
  47 #include <sys/pte.h>
  48 #include <sys/systm.h>
  49 #include <sys/mman.h>
  50 #include <sys/sysmacros.h>
  51 #include <sys/machparam.h>
  52 #include <sys/vtrace.h>
  53 #include <sys/kmem.h>
  54 #include <sys/mmu.h>
  55 #include <sys/cmn_err.h>
  56 #include <sys/cpu.h>
  57 #include <sys/cpuvar.h>
  58 #include <sys/debug.h>
  59 #include <sys/lgrp.h>
  60 #include <sys/archsystm.h>
  61 #include <sys/machsystm.h>
  62 #include <sys/vmsystm.h>
  63 #include <vm/as.h>
  64 #include <vm/seg.h>
  65 #include <vm/seg_kp.h>
  66 #include <vm/seg_kmem.h>
  67 #include <vm/seg_kpm.h>
  68 #include <vm/rm.h>
  69 #include <sys/t_lock.h>
  70 #include <sys/obpdefs.h>
  71 #include <sys/vm_machparam.h>
  72 #include <sys/var.h>
  73 #include <sys/trap.h>
  74 #include <sys/machtrap.h>
  75 #include <sys/scb.h>
  76 #include <sys/bitmap.h>
  77 #include <sys/machlock.h>
  78 #include <sys/membar.h>
  79 #include <sys/atomic.h>
  80 #include <sys/cpu_module.h>
  81 #include <sys/prom_debug.h>
  82 #include <sys/ksynch.h>
  83 #include <sys/mem_config.h>
  84 #include <sys/mem_cage.h>
  85 #include <vm/vm_dep.h>
  86 #include <sys/fpu/fpusystm.h>
  87 #include <vm/mach_kpm.h>
  88 #include <sys/callb.h>
  89 
  90 #ifdef  DEBUG
  91 #define SFMMU_VALIDATE_HMERID(hat, rid, saddr, len)                     \
  92         if (SFMMU_IS_SHMERID_VALID(rid)) {                              \
  93                 caddr_t _eaddr = (saddr) + (len);                       \
  94                 sf_srd_t *_srdp;                                        \
  95                 sf_region_t *_rgnp;                                     \
  96                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                       \
  97                 ASSERT(SF_RGNMAP_TEST(hat->sfmmu_hmeregion_map, rid));       \
  98                 ASSERT((hat) != ksfmmup);                               \
  99                 _srdp = (hat)->sfmmu_srdp;                           \
 100                 ASSERT(_srdp != NULL);                                  \
 101                 ASSERT(_srdp->srd_refcnt != 0);                              \
 102                 _rgnp = _srdp->srd_hmergnp[(rid)];                   \
 103                 ASSERT(_rgnp != NULL && _rgnp->rgn_id == rid);               \
 104                 ASSERT(_rgnp->rgn_refcnt != 0);                              \
 105                 ASSERT(!(_rgnp->rgn_flags & SFMMU_REGION_FREE)); \
 106                 ASSERT((_rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) ==    \
 107                     SFMMU_REGION_HME);                                  \
 108                 ASSERT((saddr) >= _rgnp->rgn_saddr);                      \
 109                 ASSERT((saddr) < _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 110                 ASSERT(_eaddr > _rgnp->rgn_saddr);                        \
 111                 ASSERT(_eaddr <= _rgnp->rgn_saddr + _rgnp->rgn_size);  \
 112         }
 113 
 114 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)             \
 115 {                                                                       \
 116                 caddr_t _hsva;                                          \
 117                 caddr_t _heva;                                          \
 118                 caddr_t _rsva;                                          \
 119                 caddr_t _reva;                                          \
 120                 int     _ttesz = get_hblk_ttesz(hmeblkp);               \
 121                 int     _flagtte;                                       \
 122                 ASSERT((srdp)->srd_refcnt != 0);                     \
 123                 ASSERT((rid) < SFMMU_MAX_HME_REGIONS);                       \
 124                 ASSERT((rgnp)->rgn_id == rid);                               \
 125                 ASSERT(!((rgnp)->rgn_flags & SFMMU_REGION_FREE));        \
 126                 ASSERT(((rgnp)->rgn_flags & SFMMU_REGION_TYPE_MASK) ==   \
 127                     SFMMU_REGION_HME);                                  \
 128                 ASSERT(_ttesz <= (rgnp)->rgn_pgszc);                      \
 129                 _hsva = (caddr_t)get_hblk_base(hmeblkp);                \
 130                 _heva = get_hblk_endaddr(hmeblkp);                      \
 131                 _rsva = (caddr_t)P2ALIGN(                               \
 132                     (uintptr_t)(rgnp)->rgn_saddr, HBLK_MIN_BYTES);   \
 133                 _reva = (caddr_t)P2ROUNDUP(                             \
 134                     (uintptr_t)((rgnp)->rgn_saddr + (rgnp)->rgn_size),    \
 135                     HBLK_MIN_BYTES);                                    \
 136                 ASSERT(_hsva >= _rsva);                                      \
 137                 ASSERT(_hsva < _reva);                                       \
 138                 ASSERT(_heva > _rsva);                                       \
 139                 ASSERT(_heva <= _reva);                                      \
 140                 _flagtte = (_ttesz < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : \
 141                         _ttesz;                                         \
 142                 ASSERT(rgnp->rgn_hmeflags & (0x1 << _flagtte));            \
 143 }
 144 
 145 #else /* DEBUG */
 146 #define SFMMU_VALIDATE_HMERID(hat, rid, addr, len)
 147 #define SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid)
 148 #endif /* DEBUG */
 149 
 150 #if defined(SF_ERRATA_57)
 151 extern caddr_t errata57_limit;
 152 #endif
 153 
 154 #define HME8BLK_SZ_RND          ((roundup(HME8BLK_SZ, sizeof (int64_t))) /  \
 155                                 (sizeof (int64_t)))
 156 #define HBLK_RESERVE            ((struct hme_blk *)hblk_reserve)
 157 
 158 #define HBLK_RESERVE_CNT        128
 159 #define HBLK_RESERVE_MIN        20
 160 
 161 static struct hme_blk           *freehblkp;
 162 static kmutex_t                 freehblkp_lock;
 163 static int                      freehblkcnt;
 164 
 165 static int64_t                  hblk_reserve[HME8BLK_SZ_RND];
 166 static kmutex_t                 hblk_reserve_lock;
 167 static kthread_t                *hblk_reserve_thread;
 168 
 169 static nucleus_hblk8_info_t     nucleus_hblk8;
 170 static nucleus_hblk1_info_t     nucleus_hblk1;
 171 
 172 /*
 173  * Data to manage per-cpu hmeblk pending queues, hmeblks are queued here
 174  * after the initial phase of removing an hmeblk from the hash chain, see
 175  * the detailed comment in sfmmu_hblk_hash_rm() for further details.
 176  */
 177 static cpu_hme_pend_t           *cpu_hme_pend;
 178 static uint_t                   cpu_hme_pend_thresh;
 179 /*
 180  * SFMMU specific hat functions
 181  */
 182 void    hat_pagecachectl(struct page *, int);
 183 
 184 /* flags for hat_pagecachectl */
 185 #define HAT_CACHE       0x1
 186 #define HAT_UNCACHE     0x2
 187 #define HAT_TMPNC       0x4
 188 
 189 /*
 190  * Flag to allow the creation of non-cacheable translations
 191  * to system memory. It is off by default. At the moment this
 192  * flag is used by the ecache error injector. The error injector
 193  * will turn it on when creating such a translation then shut it
 194  * off when it's finished.
 195  */
 196 
 197 int     sfmmu_allow_nc_trans = 0;
 198 
 199 /*
 200  * Flag to disable large page support.
 201  *      value of 1 => disable all large pages.
 202  *      bits 1, 2, and 3 are to disable 64K, 512K and 4M pages respectively.
 203  *
 204  * For example, use the value 0x4 to disable 512K pages.
 205  *
 206  */
 207 #define LARGE_PAGES_OFF         0x1
 208 
 209 /*
 210  * The disable_large_pages and disable_ism_large_pages variables control
 211  * hat_memload_array and the page sizes to be used by ISM and the kernel.
 212  *
 213  * The disable_auto_data_large_pages and disable_auto_text_large_pages variables
 214  * are only used to control which OOB pages to use at upper VM segment creation
 215  * time, and are set in hat_init_pagesizes and used in the map_pgsz* routines.
 216  * Their values may come from platform or CPU specific code to disable page
 217  * sizes that should not be used.
 218  *
 219  * WARNING: 512K pages are currently not supported for ISM/DISM.
 220  */
 221 uint_t  disable_large_pages = 0;
 222 uint_t  disable_ism_large_pages = (1 << TTE512K);
 223 uint_t  disable_auto_data_large_pages = 0;
 224 uint_t  disable_auto_text_large_pages = 0;
 225 
 226 /*
 227  * Private sfmmu data structures for hat management
 228  */
 229 static struct kmem_cache *sfmmuid_cache;
 230 static struct kmem_cache *mmuctxdom_cache;
 231 
 232 /*
 233  * Private sfmmu data structures for tsb management
 234  */
 235 static struct kmem_cache *sfmmu_tsbinfo_cache;
 236 static struct kmem_cache *sfmmu_tsb8k_cache;
 237 static struct kmem_cache *sfmmu_tsb_cache[NLGRPS_MAX];
 238 static vmem_t *kmem_bigtsb_arena;
 239 static vmem_t *kmem_tsb_arena;
 240 
 241 /*
 242  * sfmmu static variables for hmeblk resource management.
 243  */
 244 static vmem_t *hat_memload1_arena; /* HAT translation arena for sfmmu1_cache */
 245 static struct kmem_cache *sfmmu8_cache;
 246 static struct kmem_cache *sfmmu1_cache;
 247 static struct kmem_cache *pa_hment_cache;
 248 
 249 static kmutex_t         ism_mlist_lock; /* mutex for ism mapping list */
 250 /*
 251  * private data for ism
 252  */
 253 static struct kmem_cache *ism_blk_cache;
 254 static struct kmem_cache *ism_ment_cache;
 255 #define ISMID_STARTADDR NULL
 256 
 257 /*
 258  * Region management data structures and function declarations.
 259  */
 260 
 261 static void     sfmmu_leave_srd(sfmmu_t *);
 262 static int      sfmmu_srdcache_constructor(void *, void *, int);
 263 static void     sfmmu_srdcache_destructor(void *, void *);
 264 static int      sfmmu_rgncache_constructor(void *, void *, int);
 265 static void     sfmmu_rgncache_destructor(void *, void *);
 266 static int      sfrgnmap_isnull(sf_region_map_t *);
 267 static int      sfhmergnmap_isnull(sf_hmeregion_map_t *);
 268 static int      sfmmu_scdcache_constructor(void *, void *, int);
 269 static void     sfmmu_scdcache_destructor(void *, void *);
 270 static void     sfmmu_rgn_cb_noop(caddr_t, caddr_t, caddr_t,
 271     size_t, void *, u_offset_t);
 272 
 273 static uint_t srd_hashmask = SFMMU_MAX_SRD_BUCKETS - 1;
 274 static sf_srd_bucket_t *srd_buckets;
 275 static struct kmem_cache *srd_cache;
 276 static uint_t srd_rgn_hashmask = SFMMU_MAX_REGION_BUCKETS - 1;
 277 static struct kmem_cache *region_cache;
 278 static struct kmem_cache *scd_cache;
 279 
 280 #ifdef sun4v
 281 int use_bigtsb_arena = 1;
 282 #else
 283 int use_bigtsb_arena = 0;
 284 #endif
 285 
 286 /* External /etc/system tunable, for turning on&off the shctx support */
 287 int disable_shctx = 0;
 288 /* Internal variable, set by MD if the HW supports shctx feature */
 289 int shctx_on = 0;
 290 
 291 #ifdef DEBUG
 292 static void check_scd_sfmmu_list(sfmmu_t **, sfmmu_t *, int);
 293 #endif
 294 static void sfmmu_to_scd_list(sfmmu_t **, sfmmu_t *);
 295 static void sfmmu_from_scd_list(sfmmu_t **, sfmmu_t *);
 296 
 297 static sf_scd_t *sfmmu_alloc_scd(sf_srd_t *, sf_region_map_t *);
 298 static void sfmmu_find_scd(sfmmu_t *);
 299 static void sfmmu_join_scd(sf_scd_t *, sfmmu_t *);
 300 static void sfmmu_finish_join_scd(sfmmu_t *);
 301 static void sfmmu_leave_scd(sfmmu_t *, uchar_t);
 302 static void sfmmu_destroy_scd(sf_srd_t *, sf_scd_t *, sf_region_map_t *);
 303 static int sfmmu_alloc_scd_tsbs(sf_srd_t *, sf_scd_t *);
 304 static void sfmmu_free_scd_tsbs(sfmmu_t *);
 305 static void sfmmu_tsb_inv_ctx(sfmmu_t *);
 306 static int find_ism_rid(sfmmu_t *, sfmmu_t *, caddr_t, uint_t *);
 307 static void sfmmu_ism_hatflags(sfmmu_t *, int);
 308 static int sfmmu_srd_lock_held(sf_srd_t *);
 309 static void sfmmu_remove_scd(sf_scd_t **, sf_scd_t *);
 310 static void sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *);
 311 static void sfmmu_link_scd_to_regions(sf_srd_t *, sf_scd_t *);
 312 static void sfmmu_unlink_scd_from_regions(sf_srd_t *, sf_scd_t *);
 313 static void sfmmu_link_to_hmeregion(sfmmu_t *, sf_region_t *);
 314 static void sfmmu_unlink_from_hmeregion(sfmmu_t *, sf_region_t *);
 315 
 316 /*
 317  * ``hat_lock'' is a hashed mutex lock for protecting sfmmu TSB lists,
 318  * HAT flags, synchronizing TLB/TSB coherency, and context management.
 319  * The lock is hashed on the sfmmup since the case where we need to lock
 320  * all processes is rare but does occur (e.g. we need to unload a shared
 321  * mapping from all processes using the mapping).  We have a lot of buckets,
 322  * and each slab of sfmmu_t's can use about a quarter of them, giving us
 323  * a fairly good distribution without wasting too much space and overhead
 324  * when we have to grab them all.
 325  */
 326 #define SFMMU_NUM_LOCK  128             /* must be power of two */
 327 hatlock_t       hat_lock[SFMMU_NUM_LOCK];
 328 
 329 /*
 330  * Hash algorithm optimized for a small number of slabs.
 331  *  7 is (highbit((sizeof sfmmu_t)) - 1)
 332  * This hash algorithm is based upon the knowledge that sfmmu_t's come from a
 333  * kmem_cache, and thus they will be sequential within that cache.  In
 334  * addition, each new slab will have a different "color" up to cache_maxcolor
 335  * which will skew the hashing for each successive slab which is allocated.
 336  * If the size of sfmmu_t changed to a larger size, this algorithm may need
 337  * to be revisited.
 338  */
 339 #define TSB_HASH_SHIFT_BITS (7)
 340 #define PTR_HASH(x) ((uintptr_t)x >> TSB_HASH_SHIFT_BITS)
 341 
 342 #ifdef DEBUG
 343 int tsb_hash_debug = 0;
 344 #define TSB_HASH(sfmmup)        \
 345         (tsb_hash_debug ? &hat_lock[0] : \
 346         &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)])
 347 #else   /* DEBUG */
 348 #define TSB_HASH(sfmmup)        &hat_lock[PTR_HASH(sfmmup) & (SFMMU_NUM_LOCK-1)]
 349 #endif  /* DEBUG */
 350 
 351 
 352 /* sfmmu_replace_tsb() return codes. */
 353 typedef enum tsb_replace_rc {
 354         TSB_SUCCESS,
 355         TSB_ALLOCFAIL,
 356         TSB_LOSTRACE,
 357         TSB_ALREADY_SWAPPED,
 358         TSB_CANTGROW
 359 } tsb_replace_rc_t;
 360 
 361 /*
 362  * Flags for TSB allocation routines.
 363  */
 364 #define TSB_ALLOC       0x01
 365 #define TSB_FORCEALLOC  0x02
 366 #define TSB_GROW        0x04
 367 #define TSB_SHRINK      0x08
 368 #define TSB_SWAPIN      0x10
 369 
 370 /*
 371  * Support for HAT callbacks.
 372  */
 373 #define SFMMU_MAX_RELOC_CALLBACKS       10
 374 int sfmmu_max_cb_id = SFMMU_MAX_RELOC_CALLBACKS;
 375 static id_t sfmmu_cb_nextid = 0;
 376 static id_t sfmmu_tsb_cb_id;
 377 struct sfmmu_callback *sfmmu_cb_table;
 378 
 379 kmutex_t        kpr_mutex;
 380 kmutex_t        kpr_suspendlock;
 381 kthread_t       *kreloc_thread;
 382 
 383 /*
 384  * Enable VA->PA translation sanity checking on DEBUG kernels.
 385  * Disabled by default.  This is incompatible with some
 386  * drivers (error injector, RSM) so if it breaks you get
 387  * to keep both pieces.
 388  */
 389 int hat_check_vtop = 0;
 390 
 391 /*
 392  * Private sfmmu routines (prototypes)
 393  */
 394 static struct hme_blk *sfmmu_shadow_hcreate(sfmmu_t *, caddr_t, int, uint_t);
 395 static struct   hme_blk *sfmmu_hblk_alloc(sfmmu_t *, caddr_t,
 396                         struct hmehash_bucket *, uint_t, hmeblk_tag, uint_t,
 397                         uint_t);
 398 static caddr_t  sfmmu_hblk_unload(struct hat *, struct hme_blk *, caddr_t,
 399                         caddr_t, demap_range_t *, uint_t);
 400 static caddr_t  sfmmu_hblk_sync(struct hat *, struct hme_blk *, caddr_t,
 401                         caddr_t, int);
 402 static void     sfmmu_hblk_free(struct hme_blk **);
 403 static void     sfmmu_hblks_list_purge(struct hme_blk **, int);
 404 static uint_t   sfmmu_get_free_hblk(struct hme_blk **, uint_t);
 405 static uint_t   sfmmu_put_free_hblk(struct hme_blk *, uint_t);
 406 static struct hme_blk *sfmmu_hblk_steal(int);
 407 static int      sfmmu_steal_this_hblk(struct hmehash_bucket *,
 408                         struct hme_blk *, uint64_t, struct hme_blk *);
 409 static caddr_t  sfmmu_hblk_unlock(struct hme_blk *, caddr_t, caddr_t);
 410 
 411 static void     hat_do_memload_array(struct hat *, caddr_t, size_t,
 412                     struct page **, uint_t, uint_t, uint_t);
 413 static void     hat_do_memload(struct hat *, caddr_t, struct page *,
 414                     uint_t, uint_t, uint_t);
 415 static void     sfmmu_memload_batchsmall(struct hat *, caddr_t, page_t **,
 416                     uint_t, uint_t, pgcnt_t, uint_t);
 417 void            sfmmu_tteload(struct hat *, tte_t *, caddr_t, page_t *,
 418                         uint_t);
 419 static int      sfmmu_tteload_array(sfmmu_t *, tte_t *, caddr_t, page_t **,
 420                         uint_t, uint_t);
 421 static struct hmehash_bucket *sfmmu_tteload_acquire_hashbucket(sfmmu_t *,
 422                                         caddr_t, int, uint_t);
 423 static struct hme_blk *sfmmu_tteload_find_hmeblk(sfmmu_t *,
 424                         struct hmehash_bucket *, caddr_t, uint_t, uint_t,
 425                         uint_t);
 426 static int      sfmmu_tteload_addentry(sfmmu_t *, struct hme_blk *, tte_t *,
 427                         caddr_t, page_t **, uint_t, uint_t);
 428 static void     sfmmu_tteload_release_hashbucket(struct hmehash_bucket *);
 429 
 430 static int      sfmmu_pagearray_setup(caddr_t, page_t **, tte_t *, int);
 431 static pfn_t    sfmmu_uvatopfn(caddr_t, sfmmu_t *, tte_t *);
 432 void            sfmmu_memtte(tte_t *, pfn_t, uint_t, int);
 433 #ifdef VAC
 434 static void     sfmmu_vac_conflict(struct hat *, caddr_t, page_t *);
 435 static int      sfmmu_vacconflict_array(caddr_t, page_t *, int *);
 436 int     tst_tnc(page_t *pp, pgcnt_t);
 437 void    conv_tnc(page_t *pp, int);
 438 #endif
 439 
 440 static void     sfmmu_get_ctx(sfmmu_t *);
 441 static void     sfmmu_free_sfmmu(sfmmu_t *);
 442 
 443 static void     sfmmu_ttesync(struct hat *, caddr_t, tte_t *, page_t *);
 444 static void     sfmmu_chgattr(struct hat *, caddr_t, size_t, uint_t, int);
 445 
 446 cpuset_t        sfmmu_pageunload(page_t *, struct sf_hment *, int);
 447 static void     hat_pagereload(struct page *, struct page *);
 448 static cpuset_t sfmmu_pagesync(page_t *, struct sf_hment *, uint_t);
 449 #ifdef VAC
 450 void    sfmmu_page_cache_array(page_t *, int, int, pgcnt_t);
 451 static void     sfmmu_page_cache(page_t *, int, int, int);
 452 #endif
 453 
 454 cpuset_t        sfmmu_rgntlb_demap(caddr_t, sf_region_t *,
 455     struct hme_blk *, int);
 456 static void     sfmmu_tlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 457                         pfn_t, int, int, int, int);
 458 static void     sfmmu_ismtlbcache_demap(caddr_t, sfmmu_t *, struct hme_blk *,
 459                         pfn_t, int);
 460 static void     sfmmu_tlb_demap(caddr_t, sfmmu_t *, struct hme_blk *, int, int);
 461 static void     sfmmu_tlb_range_demap(demap_range_t *);
 462 static void     sfmmu_invalidate_ctx(sfmmu_t *);
 463 static void     sfmmu_sync_mmustate(sfmmu_t *);
 464 
 465 static void     sfmmu_tsbinfo_setup_phys(struct tsb_info *, pfn_t);
 466 static int      sfmmu_tsbinfo_alloc(struct tsb_info **, int, int, uint_t,
 467                         sfmmu_t *);
 468 static void     sfmmu_tsb_free(struct tsb_info *);
 469 static void     sfmmu_tsbinfo_free(struct tsb_info *);
 470 static int      sfmmu_init_tsbinfo(struct tsb_info *, int, int, uint_t,
 471                         sfmmu_t *);
 472 static void     sfmmu_tsb_chk_reloc(sfmmu_t *, hatlock_t *);
 473 static void     sfmmu_tsb_swapin(sfmmu_t *, hatlock_t *);
 474 static int      sfmmu_select_tsb_szc(pgcnt_t);
 475 static void     sfmmu_mod_tsb(sfmmu_t *, caddr_t, tte_t *, int);
 476 #define         sfmmu_load_tsb(sfmmup, vaddr, tte, szc) \
 477         sfmmu_mod_tsb(sfmmup, vaddr, tte, szc)
 478 #define         sfmmu_unload_tsb(sfmmup, vaddr, szc)    \
 479         sfmmu_mod_tsb(sfmmup, vaddr, NULL, szc)
 480 static void     sfmmu_copy_tsb(struct tsb_info *, struct tsb_info *);
 481 static tsb_replace_rc_t sfmmu_replace_tsb(sfmmu_t *, struct tsb_info *, uint_t,
 482     hatlock_t *, uint_t);
 483 static void     sfmmu_size_tsb(sfmmu_t *, int, uint64_t, uint64_t, int);
 484 
 485 #ifdef VAC
 486 void    sfmmu_cache_flush(pfn_t, int);
 487 void    sfmmu_cache_flushcolor(int, pfn_t);
 488 #endif
 489 static caddr_t  sfmmu_hblk_chgattr(sfmmu_t *, struct hme_blk *, caddr_t,
 490                         caddr_t, demap_range_t *, uint_t, int);
 491 
 492 static uint64_t sfmmu_vtop_attr(uint_t, int mode, tte_t *);
 493 static uint_t   sfmmu_ptov_attr(tte_t *);
 494 static caddr_t  sfmmu_hblk_chgprot(sfmmu_t *, struct hme_blk *, caddr_t,
 495                         caddr_t, demap_range_t *, uint_t);
 496 static uint_t   sfmmu_vtop_prot(uint_t, uint_t *);
 497 static int      sfmmu_idcache_constructor(void *, void *, int);
 498 static void     sfmmu_idcache_destructor(void *, void *);
 499 static int      sfmmu_hblkcache_constructor(void *, void *, int);
 500 static void     sfmmu_hblkcache_destructor(void *, void *);
 501 static void     sfmmu_hblkcache_reclaim(void *);
 502 static void     sfmmu_shadow_hcleanup(sfmmu_t *, struct hme_blk *,
 503                         struct hmehash_bucket *);
 504 static void     sfmmu_hblk_hash_rm(struct hmehash_bucket *, struct hme_blk *,
 505                         struct hme_blk *, struct hme_blk **, int);
 506 static void     sfmmu_hblk_hash_add(struct hmehash_bucket *, struct hme_blk *,
 507                         uint64_t);
 508 static struct hme_blk *sfmmu_check_pending_hblks(int);
 509 static void     sfmmu_free_hblks(sfmmu_t *, caddr_t, caddr_t, int);
 510 static void     sfmmu_cleanup_rhblk(sf_srd_t *, caddr_t, uint_t, int);
 511 static void     sfmmu_unload_hmeregion_va(sf_srd_t *, uint_t, caddr_t, caddr_t,
 512                         int, caddr_t *);
 513 static void     sfmmu_unload_hmeregion(sf_srd_t *, sf_region_t *);
 514 
 515 static void     sfmmu_rm_large_mappings(page_t *, int);
 516 
 517 static void     hat_lock_init(void);
 518 static void     hat_kstat_init(void);
 519 static int      sfmmu_kstat_percpu_update(kstat_t *ksp, int rw);
 520 static void     sfmmu_set_scd_rttecnt(sf_srd_t *, sf_scd_t *);
 521 static  int     sfmmu_is_rgnva(sf_srd_t *, caddr_t, ulong_t, ulong_t);
 522 static void     sfmmu_check_page_sizes(sfmmu_t *, int);
 523 int     fnd_mapping_sz(page_t *);
 524 static void     iment_add(struct ism_ment *,  struct hat *);
 525 static void     iment_sub(struct ism_ment *, struct hat *);
 526 static pgcnt_t  ism_tsb_entries(sfmmu_t *, int szc);
 527 extern void     sfmmu_setup_tsbinfo(sfmmu_t *);
 528 extern void     sfmmu_clear_utsbinfo(void);
 529 
 530 static void             sfmmu_ctx_wrap_around(mmu_ctx_t *, boolean_t);
 531 
 532 extern int vpm_enable;
 533 
 534 /* kpm globals */
 535 #ifdef  DEBUG
 536 /*
 537  * Enable trap level tsbmiss handling
 538  */
 539 int     kpm_tsbmtl = 1;
 540 
 541 /*
 542  * Flush the TLB on kpm mapout. Note: Xcalls are used (again) for the
 543  * required TLB shootdowns in this case, so handle w/ care. Off by default.
 544  */
 545 int     kpm_tlb_flush;
 546 #endif  /* DEBUG */
 547 
 548 static void     *sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *, size_t, int);
 549 
 550 #ifdef DEBUG
 551 static void     sfmmu_check_hblk_flist();
 552 #endif
 553 
 554 /*
 555  * Semi-private sfmmu data structures.  Some of them are initialize in
 556  * startup or in hat_init. Some of them are private but accessed by
 557  * assembly code or mach_sfmmu.c
 558  */
 559 struct hmehash_bucket *uhme_hash;       /* user hmeblk hash table */
 560 struct hmehash_bucket *khme_hash;       /* kernel hmeblk hash table */
 561 uint64_t        uhme_hash_pa;           /* PA of uhme_hash */
 562 uint64_t        khme_hash_pa;           /* PA of khme_hash */
 563 int             uhmehash_num;           /* # of buckets in user hash table */
 564 int             khmehash_num;           /* # of buckets in kernel hash table */
 565 
 566 uint_t          max_mmu_ctxdoms = 0;    /* max context domains in the system */
 567 mmu_ctx_t       **mmu_ctxs_tbl;         /* global array of context domains */
 568 uint64_t        mmu_saved_gnum = 0;     /* to init incoming MMUs' gnums */
 569 
 570 #define DEFAULT_NUM_CTXS_PER_MMU 8192
 571 static uint_t   nctxs = DEFAULT_NUM_CTXS_PER_MMU;
 572 
 573 int             cache;                  /* describes system cache */
 574 
 575 caddr_t         ktsb_base;              /* kernel 8k-indexed tsb base address */
 576 uint64_t        ktsb_pbase;             /* kernel 8k-indexed tsb phys address */
 577 int             ktsb_szcode;            /* kernel 8k-indexed tsb size code */
 578 int             ktsb_sz;                /* kernel 8k-indexed tsb size */
 579 
 580 caddr_t         ktsb4m_base;            /* kernel 4m-indexed tsb base address */
 581 uint64_t        ktsb4m_pbase;           /* kernel 4m-indexed tsb phys address */
 582 int             ktsb4m_szcode;          /* kernel 4m-indexed tsb size code */
 583 int             ktsb4m_sz;              /* kernel 4m-indexed tsb size */
 584 
 585 uint64_t        kpm_tsbbase;            /* kernel seg_kpm 4M TSB base address */
 586 int             kpm_tsbsz;              /* kernel seg_kpm 4M TSB size code */
 587 uint64_t        kpmsm_tsbbase;          /* kernel seg_kpm 8K TSB base address */
 588 int             kpmsm_tsbsz;            /* kernel seg_kpm 8K TSB size code */
 589 
 590 #ifndef sun4v
 591 int             utsb_dtlb_ttenum = -1;  /* index in TLB for utsb locked TTE */
 592 int             utsb4m_dtlb_ttenum = -1; /* index in TLB for 4M TSB TTE */
 593 int             dtlb_resv_ttenum;       /* index in TLB of first reserved TTE */
 594 caddr_t         utsb_vabase;            /* reserved kernel virtual memory */
 595 caddr_t         utsb4m_vabase;          /* for trap handler TSB accesses */
 596 #endif /* sun4v */
 597 uint64_t        tsb_alloc_bytes = 0;    /* bytes allocated to TSBs */
 598 vmem_t          *kmem_tsb_default_arena[NLGRPS_MAX];    /* For dynamic TSBs */
 599 vmem_t          *kmem_bigtsb_default_arena[NLGRPS_MAX]; /* dynamic 256M TSBs */
 600 
 601 /*
 602  * Size to use for TSB slabs.  Future platforms that support page sizes
 603  * larger than 4M may wish to change these values, and provide their own
 604  * assembly macros for building and decoding the TSB base register contents.
 605  * Note disable_large_pages will override the value set here.
 606  */
 607 static  uint_t tsb_slab_ttesz = TTE4M;
 608 size_t  tsb_slab_size = MMU_PAGESIZE4M;
 609 uint_t  tsb_slab_shift = MMU_PAGESHIFT4M;
 610 /* PFN mask for TTE */
 611 size_t  tsb_slab_mask = MMU_PAGEOFFSET4M >> MMU_PAGESHIFT;
 612 
 613 /*
 614  * Size to use for TSB slabs.  These are used only when 256M tsb arenas
 615  * exist.
 616  */
 617 static uint_t   bigtsb_slab_ttesz = TTE256M;
 618 static size_t   bigtsb_slab_size = MMU_PAGESIZE256M;
 619 static uint_t   bigtsb_slab_shift = MMU_PAGESHIFT256M;
 620 /* 256M page alignment for 8K pfn */
 621 static size_t   bigtsb_slab_mask = MMU_PAGEOFFSET256M >> MMU_PAGESHIFT;
 622 
 623 /* largest TSB size to grow to, will be smaller on smaller memory systems */
 624 static int      tsb_max_growsize = 0;
 625 
 626 /*
 627  * Tunable parameters dealing with TSB policies.
 628  */
 629 
 630 /*
 631  * This undocumented tunable forces all 8K TSBs to be allocated from
 632  * the kernel heap rather than from the kmem_tsb_default_arena arenas.
 633  */
 634 #ifdef  DEBUG
 635 int     tsb_forceheap = 0;
 636 #endif  /* DEBUG */
 637 
 638 /*
 639  * Decide whether to use per-lgroup arenas, or one global set of
 640  * TSB arenas.  The default is not to break up per-lgroup, since
 641  * most platforms don't recognize any tangible benefit from it.
 642  */
 643 int     tsb_lgrp_affinity = 0;
 644 
 645 /*
 646  * Used for growing the TSB based on the process RSS.
 647  * tsb_rss_factor is based on the smallest TSB, and is
 648  * shifted by the TSB size to determine if we need to grow.
 649  * The default will grow the TSB if the number of TTEs for
 650  * this page size exceeds 75% of the number of TSB entries,
 651  * which should _almost_ eliminate all conflict misses
 652  * (at the expense of using up lots and lots of memory).
 653  */
 654 #define TSB_RSS_FACTOR          (TSB_ENTRIES(TSB_MIN_SZCODE) * 0.75)
 655 #define SFMMU_RSS_TSBSIZE(tsbszc)       (tsb_rss_factor << tsbszc)
 656 #define SELECT_TSB_SIZECODE(pgcnt) ( \
 657         (enable_tsb_rss_sizing)? sfmmu_select_tsb_szc(pgcnt) : \
 658         default_tsb_size)
 659 #define TSB_OK_SHRINK() \
 660         (tsb_alloc_bytes > tsb_alloc_hiwater || freemem < desfree)
 661 #define TSB_OK_GROW()   \
 662         (tsb_alloc_bytes < tsb_alloc_hiwater && freemem > desfree)
 663 
 664 int     enable_tsb_rss_sizing = 1;
 665 int     tsb_rss_factor  = (int)TSB_RSS_FACTOR;
 666 
 667 /* which TSB size code to use for new address spaces or if rss sizing off */
 668 int default_tsb_size = TSB_8K_SZCODE;
 669 
 670 static uint64_t tsb_alloc_hiwater; /* limit TSB reserved memory */
 671 uint64_t tsb_alloc_hiwater_factor; /* tsb_alloc_hiwater = physmem / this */
 672 #define TSB_ALLOC_HIWATER_FACTOR_DEFAULT        32
 673 
 674 #ifdef DEBUG
 675 static int tsb_random_size = 0; /* set to 1 to test random tsb sizes on alloc */
 676 static int tsb_grow_stress = 0; /* if set to 1, keep replacing TSB w/ random */
 677 static int tsb_alloc_mtbf = 0;  /* fail allocation every n attempts */
 678 static int tsb_alloc_fail_mtbf = 0;
 679 static int tsb_alloc_count = 0;
 680 #endif /* DEBUG */
 681 
 682 /* if set to 1, will remap valid TTEs when growing TSB. */
 683 int tsb_remap_ttes = 1;
 684 
 685 /*
 686  * If we have more than this many mappings, allocate a second TSB.
 687  * This default is chosen because the I/D fully associative TLBs are
 688  * assumed to have at least 8 available entries. Platforms with a
 689  * larger fully-associative TLB could probably override the default.
 690  */
 691 
 692 #ifdef sun4v
 693 int tsb_sectsb_threshold = 0;
 694 #else
 695 int tsb_sectsb_threshold = 8;
 696 #endif
 697 
 698 /*
 699  * kstat data
 700  */
 701 struct sfmmu_global_stat sfmmu_global_stat;
 702 struct sfmmu_tsbsize_stat sfmmu_tsbsize_stat;
 703 
 704 /*
 705  * Global data
 706  */
 707 sfmmu_t         *ksfmmup;               /* kernel's hat id */
 708 
 709 #ifdef DEBUG
 710 static void     chk_tte(tte_t *, tte_t *, tte_t *, struct hme_blk *);
 711 #endif
 712 
 713 /* sfmmu locking operations */
 714 static kmutex_t *sfmmu_mlspl_enter(struct page *, int);
 715 static int      sfmmu_mlspl_held(struct page *, int);
 716 
 717 kmutex_t *sfmmu_page_enter(page_t *);
 718 void    sfmmu_page_exit(kmutex_t *);
 719 int     sfmmu_page_spl_held(struct page *);
 720 
 721 /* sfmmu internal locking operations - accessed directly */
 722 static void     sfmmu_mlist_reloc_enter(page_t *, page_t *,
 723                                 kmutex_t **, kmutex_t **);
 724 static void     sfmmu_mlist_reloc_exit(kmutex_t *, kmutex_t *);
 725 static hatlock_t *
 726                 sfmmu_hat_enter(sfmmu_t *);
 727 static hatlock_t *
 728                 sfmmu_hat_tryenter(sfmmu_t *);
 729 static void     sfmmu_hat_exit(hatlock_t *);
 730 static void     sfmmu_hat_lock_all(void);
 731 static void     sfmmu_hat_unlock_all(void);
 732 static void     sfmmu_ismhat_enter(sfmmu_t *, int);
 733 static void     sfmmu_ismhat_exit(sfmmu_t *, int);
 734 
 735 kpm_hlk_t       *kpmp_table;
 736 uint_t          kpmp_table_sz;  /* must be a power of 2 */
 737 uchar_t         kpmp_shift;
 738 
 739 kpm_shlk_t      *kpmp_stable;
 740 uint_t          kpmp_stable_sz; /* must be a power of 2 */
 741 
 742 /*
 743  * SPL_TABLE_SIZE is 2 * NCPU, but no smaller than 128.
 744  * SPL_SHIFT is log2(SPL_TABLE_SIZE).
 745  */
 746 #if ((2*NCPU_P2) > 128)
 747 #define SPL_SHIFT       ((unsigned)(NCPU_LOG2 + 1))
 748 #else
 749 #define SPL_SHIFT       7U
 750 #endif
 751 #define SPL_TABLE_SIZE  (1U << SPL_SHIFT)
 752 #define SPL_MASK        (SPL_TABLE_SIZE - 1)
 753 
 754 /*
 755  * We shift by PP_SHIFT to take care of the low-order 0 bits of a page_t
 756  * and by multiples of SPL_SHIFT to get as many varied bits as we can.
 757  */
 758 #define SPL_INDEX(pp) \
 759         ((((uintptr_t)(pp) >> PP_SHIFT) ^ \
 760         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT)) ^ \
 761         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 2)) ^ \
 762         ((uintptr_t)(pp) >> (PP_SHIFT + SPL_SHIFT * 3))) & \
 763         SPL_MASK)
 764 
 765 #define SPL_HASH(pp)    \
 766         (&sfmmu_page_lock[SPL_INDEX(pp)].pad_mutex)
 767 
 768 static  pad_mutex_t     sfmmu_page_lock[SPL_TABLE_SIZE];
 769 
 770 /* Array of mutexes protecting a page's mapping list and p_nrm field. */
 771 
 772 #define MML_TABLE_SIZE  SPL_TABLE_SIZE
 773 #define MLIST_HASH(pp)  (&mml_table[SPL_INDEX(pp)].pad_mutex)
 774 
 775 static pad_mutex_t      mml_table[MML_TABLE_SIZE];
 776 
 777 /*
 778  * hat_unload_callback() will group together callbacks in order
 779  * to avoid xt_sync() calls.  This is the maximum size of the group.
 780  */
 781 #define MAX_CB_ADDR     32
 782 
 783 tte_t   hw_tte;
 784 static ulong_t sfmmu_dmr_maxbit = DMR_MAXBIT;
 785 
 786 static char     *mmu_ctx_kstat_names[] = {
 787         "mmu_ctx_tsb_exceptions",
 788         "mmu_ctx_tsb_raise_exception",
 789         "mmu_ctx_wrap_around",
 790 };
 791 
 792 /*
 793  * Wrapper for vmem_xalloc since vmem_create only allows limited
 794  * parameters for vm_source_alloc functions.  This function allows us
 795  * to specify alignment consistent with the size of the object being
 796  * allocated.
 797  */
 798 static void *
 799 sfmmu_vmem_xalloc_aligned_wrapper(vmem_t *vmp, size_t size, int vmflag)
 800 {
 801         return (vmem_xalloc(vmp, size, size, 0, 0, NULL, NULL, vmflag));
 802 }
 803 
 804 /* Common code for setting tsb_alloc_hiwater. */
 805 #define SFMMU_SET_TSB_ALLOC_HIWATER(pages)      tsb_alloc_hiwater = \
 806                 ptob(pages) / tsb_alloc_hiwater_factor
 807 
 808 /*
 809  * Set tsb_max_growsize to allow at most all of physical memory to be mapped by
 810  * a single TSB.  physmem is the number of physical pages so we need physmem 8K
 811  * TTEs to represent all those physical pages.  We round this up by using
 812  * 1<<highbit().  To figure out which size code to use, remember that the size
 813  * code is just an amount to shift the smallest TSB size to get the size of
 814  * this TSB.  So we subtract that size, TSB_START_SIZE, from highbit() (or
 815  * highbit() - 1) to get the size code for the smallest TSB that can represent
 816  * all of physical memory, while erring on the side of too much.
 817  *
 818  * Restrict tsb_max_growsize to make sure that:
 819  *      1) TSBs can't grow larger than the TSB slab size
 820  *      2) TSBs can't grow larger than UTSB_MAX_SZCODE.
 821  */
 822 #define SFMMU_SET_TSB_MAX_GROWSIZE(pages) {                             \
 823         int     _i, _szc, _slabszc, _tsbszc;                            \
 824                                                                         \
 825         _i = highbit(pages);                                            \
 826         if ((1 << (_i - 1)) == (pages))                                   \
 827                 _i--;           /* 2^n case, round down */              \
 828         _szc = _i - TSB_START_SIZE;                                     \
 829         _slabszc = bigtsb_slab_shift - (TSB_START_SIZE + TSB_ENTRY_SHIFT); \
 830         _tsbszc = MIN(_szc, _slabszc);                                  \
 831         tsb_max_growsize = MIN(_tsbszc, UTSB_MAX_SZCODE);               \
 832 }
 833 
 834 /*
 835  * Given a pointer to an sfmmu and a TTE size code, return a pointer to the
 836  * tsb_info which handles that TTE size.
 837  */
 838 #define SFMMU_GET_TSBINFO(tsbinfop, sfmmup, tte_szc) {                  \
 839         (tsbinfop) = (sfmmup)->sfmmu_tsb;                            \
 840         ASSERT(((tsbinfop)->tsb_flags & TSB_SHAREDCTX) ||                \
 841             sfmmu_hat_lock_held(sfmmup));                               \
 842         if ((tte_szc) >= TTE4M)      {                                       \
 843                 ASSERT((tsbinfop) != NULL);                             \
 844                 (tsbinfop) = (tsbinfop)->tsb_next;                   \
 845         }                                                               \
 846 }
 847 
 848 /*
 849  * Macro to use to unload entries from the TSB.
 850  * It has knowledge of which page sizes get replicated in the TSB
 851  * and will call the appropriate unload routine for the appropriate size.
 852  */
 853 #define SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, ismhat)         \
 854 {                                                                       \
 855         int ttesz = get_hblk_ttesz(hmeblkp);                            \
 856         if (ttesz == TTE8K || ttesz == TTE4M) {                         \
 857                 sfmmu_unload_tsb(sfmmup, addr, ttesz);                  \
 858         } else {                                                        \
 859                 caddr_t sva = ismhat ? addr :                           \
 860                     (caddr_t)get_hblk_base(hmeblkp);                    \
 861                 caddr_t eva = sva + get_hblk_span(hmeblkp);             \
 862                 ASSERT(addr >= sva && addr < eva);                        \
 863                 sfmmu_unload_tsb_range(sfmmup, sva, eva, ttesz);        \
 864         }                                                               \
 865 }
 866 
 867 
 868 /* Update tsb_alloc_hiwater after memory is configured. */
 869 /*ARGSUSED*/
 870 static void
 871 sfmmu_update_post_add(void *arg, pgcnt_t delta_pages)
 872 {
 873         /* Assumes physmem has already been updated. */
 874         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 875         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 876 }
 877 
 878 /*
 879  * Update tsb_alloc_hiwater before memory is deleted.  We'll do nothing here
 880  * and update tsb_alloc_hiwater and tsb_max_growsize after the memory is
 881  * deleted.
 882  */
 883 /*ARGSUSED*/
 884 static int
 885 sfmmu_update_pre_del(void *arg, pgcnt_t delta_pages)
 886 {
 887         return (0);
 888 }
 889 
 890 /* Update tsb_alloc_hiwater after memory fails to be unconfigured. */
 891 /*ARGSUSED*/
 892 static void
 893 sfmmu_update_post_del(void *arg, pgcnt_t delta_pages, int cancelled)
 894 {
 895         /*
 896          * Whether the delete was cancelled or not, just go ahead and update
 897          * tsb_alloc_hiwater and tsb_max_growsize.
 898          */
 899         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
 900         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
 901 }
 902 
 903 static kphysm_setup_vector_t sfmmu_update_vec = {
 904         KPHYSM_SETUP_VECTOR_VERSION,    /* version */
 905         sfmmu_update_post_add,          /* post_add */
 906         sfmmu_update_pre_del,           /* pre_del */
 907         sfmmu_update_post_del           /* post_del */
 908 };
 909 
 910 
 911 /*
 912  * HME_BLK HASH PRIMITIVES
 913  */
 914 
 915 /*
 916  * Enter a hme on the mapping list for page pp.
 917  * When large pages are more prevalent in the system we might want to
 918  * keep the mapping list in ascending order by the hment size. For now,
 919  * small pages are more frequent, so don't slow it down.
 920  */
 921 #define HME_ADD(hme, pp)                                        \
 922 {                                                               \
 923         ASSERT(sfmmu_mlist_held(pp));                           \
 924                                                                 \
 925         hme->hme_prev = NULL;                                        \
 926         hme->hme_next = pp->p_mapping;                            \
 927         hme->hme_page = pp;                                  \
 928         if (pp->p_mapping) {                                 \
 929                 ((struct sf_hment *)(pp->p_mapping))->hme_prev = hme;\
 930                 ASSERT(pp->p_share > 0);                  \
 931         } else  {                                               \
 932                 /* EMPTY */                                     \
 933                 ASSERT(pp->p_share == 0);                    \
 934         }                                                       \
 935         pp->p_mapping = hme;                                 \
 936         pp->p_share++;                                               \
 937 }
 938 
 939 /*
 940  * Enter a hme on the mapping list for page pp.
 941  * If we are unmapping a large translation, we need to make sure that the
 942  * change is reflect in the corresponding bit of the p_index field.
 943  */
 944 #define HME_SUB(hme, pp)                                        \
 945 {                                                               \
 946         ASSERT(sfmmu_mlist_held(pp));                           \
 947         ASSERT(hme->hme_page == pp || IS_PAHME(hme));                \
 948                                                                 \
 949         if (pp->p_mapping == NULL) {                         \
 950                 panic("hme_remove - no mappings");              \
 951         }                                                       \
 952                                                                 \
 953         membar_stst();  /* ensure previous stores finish */     \
 954                                                                 \
 955         ASSERT(pp->p_share > 0);                          \
 956         pp->p_share--;                                               \
 957                                                                 \
 958         if (hme->hme_prev) {                                 \
 959                 ASSERT(pp->p_mapping != hme);                        \
 960                 ASSERT(hme->hme_prev->hme_page == pp ||           \
 961                         IS_PAHME(hme->hme_prev));            \
 962                 hme->hme_prev->hme_next = hme->hme_next;       \
 963         } else {                                                \
 964                 ASSERT(pp->p_mapping == hme);                        \
 965                 pp->p_mapping = hme->hme_next;                    \
 966                 ASSERT((pp->p_mapping == NULL) ?             \
 967                         (pp->p_share == 0) : 1);             \
 968         }                                                       \
 969                                                                 \
 970         if (hme->hme_next) {                                 \
 971                 ASSERT(hme->hme_next->hme_page == pp ||           \
 972                         IS_PAHME(hme->hme_next));            \
 973                 hme->hme_next->hme_prev = hme->hme_prev;       \
 974         }                                                       \
 975                                                                 \
 976         /* zero out the entry */                                \
 977         hme->hme_next = NULL;                                        \
 978         hme->hme_prev = NULL;                                        \
 979         hme->hme_page = NULL;                                        \
 980                                                                 \
 981         if (hme_size(hme) > TTE8K) {                         \
 982                 /* remove mappings for remainder of large pg */ \
 983                 sfmmu_rm_large_mappings(pp, hme_size(hme));     \
 984         }                                                       \
 985 }
 986 
 987 /*
 988  * This function returns the hment given the hme_blk and a vaddr.
 989  * It assumes addr has already been checked to belong to hme_blk's
 990  * range.
 991  */
 992 #define HBLKTOHME(hment, hmeblkp, addr)                                 \
 993 {                                                                       \
 994         int index;                                                      \
 995         HBLKTOHME_IDX(hment, hmeblkp, addr, index)                      \
 996 }
 997 
 998 /*
 999  * Version of HBLKTOHME that also returns the index in hmeblkp
1000  * of the hment.
1001  */
1002 #define HBLKTOHME_IDX(hment, hmeblkp, addr, idx)                        \
1003 {                                                                       \
1004         ASSERT(in_hblk_range((hmeblkp), (addr)));                       \
1005                                                                         \
1006         if (get_hblk_ttesz(hmeblkp) == TTE8K) {                         \
1007                 idx = (((uintptr_t)(addr) >> MMU_PAGESHIFT) & (NHMENTS-1)); \
1008         } else                                                          \
1009                 idx = 0;                                                \
1010                                                                         \
1011         (hment) = &(hmeblkp)->hblk_hme[idx];                             \
1012 }
1013 
1014 /*
1015  * Disable any page sizes not supported by the CPU
1016  */
1017 void
1018 hat_init_pagesizes()
1019 {
1020         int             i;
1021 
1022         mmu_exported_page_sizes = 0;
1023         for (i = TTE8K; i < max_mmu_page_sizes; i++) {
1024 
1025                 szc_2_userszc[i] = (uint_t)-1;
1026                 userszc_2_szc[i] = (uint_t)-1;
1027 
1028                 if ((mmu_exported_pagesize_mask & (1 << i)) == 0) {
1029                         disable_large_pages |= (1 << i);
1030                 } else {
1031                         szc_2_userszc[i] = mmu_exported_page_sizes;
1032                         userszc_2_szc[mmu_exported_page_sizes] = i;
1033                         mmu_exported_page_sizes++;
1034                 }
1035         }
1036 
1037         disable_ism_large_pages |= disable_large_pages;
1038         disable_auto_data_large_pages = disable_large_pages;
1039         disable_auto_text_large_pages = disable_large_pages;
1040 
1041         /*
1042          * Initialize mmu-specific large page sizes.
1043          */
1044         if (&mmu_large_pages_disabled) {
1045                 disable_large_pages |= mmu_large_pages_disabled(HAT_LOAD);
1046                 disable_ism_large_pages |=
1047                     mmu_large_pages_disabled(HAT_LOAD_SHARE);
1048                 disable_auto_data_large_pages |=
1049                     mmu_large_pages_disabled(HAT_AUTO_DATA);
1050                 disable_auto_text_large_pages |=
1051                     mmu_large_pages_disabled(HAT_AUTO_TEXT);
1052         }
1053 }
1054 
1055 /*
1056  * Initialize the hardware address translation structures.
1057  */
1058 void
1059 hat_init(void)
1060 {
1061         int             i;
1062         uint_t          sz;
1063         size_t          size;
1064 
1065         hat_lock_init();
1066         hat_kstat_init();
1067 
1068         /*
1069          * Hardware-only bits in a TTE
1070          */
1071         MAKE_TTE_MASK(&hw_tte);
1072 
1073         hat_init_pagesizes();
1074 
1075         /* Initialize the hash locks */
1076         for (i = 0; i < khmehash_num; i++) {
1077                 mutex_init(&khme_hash[i].hmehash_mutex, NULL,
1078                     MUTEX_DEFAULT, NULL);
1079                 khme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1080         }
1081         for (i = 0; i < uhmehash_num; i++) {
1082                 mutex_init(&uhme_hash[i].hmehash_mutex, NULL,
1083                     MUTEX_DEFAULT, NULL);
1084                 uhme_hash[i].hmeh_nextpa = HMEBLK_ENDPA;
1085         }
1086         khmehash_num--;         /* make sure counter starts from 0 */
1087         uhmehash_num--;         /* make sure counter starts from 0 */
1088 
1089         /*
1090          * Allocate context domain structures.
1091          *
1092          * A platform may choose to modify max_mmu_ctxdoms in
1093          * set_platform_defaults(). If a platform does not define
1094          * a set_platform_defaults() or does not choose to modify
1095          * max_mmu_ctxdoms, it gets one MMU context domain for every CPU.
1096          *
1097          * For all platforms that have CPUs sharing MMUs, this
1098          * value must be defined.
1099          */
1100         if (max_mmu_ctxdoms == 0)
1101                 max_mmu_ctxdoms = max_ncpus;
1102 
1103         size = max_mmu_ctxdoms * sizeof (mmu_ctx_t *);
1104         mmu_ctxs_tbl = kmem_zalloc(size, KM_SLEEP);
1105 
1106         /* mmu_ctx_t is 64 bytes aligned */
1107         mmuctxdom_cache = kmem_cache_create("mmuctxdom_cache",
1108             sizeof (mmu_ctx_t), 64, NULL, NULL, NULL, NULL, NULL, 0);
1109         /*
1110          * MMU context domain initialization for the Boot CPU.
1111          * This needs the context domains array allocated above.
1112          */
1113         mutex_enter(&cpu_lock);
1114         sfmmu_cpu_init(CPU);
1115         mutex_exit(&cpu_lock);
1116 
1117         /*
1118          * Intialize ism mapping list lock.
1119          */
1120 
1121         mutex_init(&ism_mlist_lock, NULL, MUTEX_DEFAULT, NULL);
1122 
1123         /*
1124          * Each sfmmu structure carries an array of MMU context info
1125          * structures, one per context domain. The size of this array depends
1126          * on the maximum number of context domains. So, the size of the
1127          * sfmmu structure varies per platform.
1128          *
1129          * sfmmu is allocated from static arena, because trap
1130          * handler at TL > 0 is not allowed to touch kernel relocatable
1131          * memory. sfmmu's alignment is changed to 64 bytes from
1132          * default 8 bytes, as the lower 6 bits will be used to pass
1133          * pgcnt to vtag_flush_pgcnt_tl1.
1134          */
1135         size = sizeof (sfmmu_t) + sizeof (sfmmu_ctx_t) * (max_mmu_ctxdoms - 1);
1136 
1137         sfmmuid_cache = kmem_cache_create("sfmmuid_cache", size,
1138             64, sfmmu_idcache_constructor, sfmmu_idcache_destructor,
1139             NULL, NULL, static_arena, 0);
1140 
1141         sfmmu_tsbinfo_cache = kmem_cache_create("sfmmu_tsbinfo_cache",
1142             sizeof (struct tsb_info), 0, NULL, NULL, NULL, NULL, NULL, 0);
1143 
1144         /*
1145          * Since we only use the tsb8k cache to "borrow" pages for TSBs
1146          * from the heap when low on memory or when TSB_FORCEALLOC is
1147          * specified, don't use magazines to cache them--we want to return
1148          * them to the system as quickly as possible.
1149          */
1150         sfmmu_tsb8k_cache = kmem_cache_create("sfmmu_tsb8k_cache",
1151             MMU_PAGESIZE, MMU_PAGESIZE, NULL, NULL, NULL, NULL,
1152             static_arena, KMC_NOMAGAZINE);
1153 
1154         /*
1155          * Set tsb_alloc_hiwater to 1/tsb_alloc_hiwater_factor of physical
1156          * memory, which corresponds to the old static reserve for TSBs.
1157          * tsb_alloc_hiwater_factor defaults to 32.  This caps the amount of
1158          * memory we'll allocate for TSB slabs; beyond this point TSB
1159          * allocations will be taken from the kernel heap (via
1160          * sfmmu_tsb8k_cache) and will be throttled as would any other kmem
1161          * consumer.
1162          */
1163         if (tsb_alloc_hiwater_factor == 0) {
1164                 tsb_alloc_hiwater_factor = TSB_ALLOC_HIWATER_FACTOR_DEFAULT;
1165         }
1166         SFMMU_SET_TSB_ALLOC_HIWATER(physmem);
1167 
1168         for (sz = tsb_slab_ttesz; sz > 0; sz--) {
1169                 if (!(disable_large_pages & (1 << sz)))
1170                         break;
1171         }
1172 
1173         if (sz < tsb_slab_ttesz) {
1174                 tsb_slab_ttesz = sz;
1175                 tsb_slab_shift = MMU_PAGESHIFT + (sz << 1) + sz;
1176                 tsb_slab_size = 1 << tsb_slab_shift;
1177                 tsb_slab_mask = (1 << (tsb_slab_shift - MMU_PAGESHIFT)) - 1;
1178                 use_bigtsb_arena = 0;
1179         } else if (use_bigtsb_arena &&
1180             (disable_large_pages & (1 << bigtsb_slab_ttesz))) {
1181                 use_bigtsb_arena = 0;
1182         }
1183 
1184         if (!use_bigtsb_arena) {
1185                 bigtsb_slab_shift = tsb_slab_shift;
1186         }
1187         SFMMU_SET_TSB_MAX_GROWSIZE(physmem);
1188 
1189         /*
1190          * On smaller memory systems, allocate TSB memory in smaller chunks
1191          * than the default 4M slab size. We also honor disable_large_pages
1192          * here.
1193          *
1194          * The trap handlers need to be patched with the final slab shift,
1195          * since they need to be able to construct the TSB pointer at runtime.
1196          */
1197         if ((tsb_max_growsize <= TSB_512K_SZCODE) &&
1198             !(disable_large_pages & (1 << TTE512K))) {
1199                 tsb_slab_ttesz = TTE512K;
1200                 tsb_slab_shift = MMU_PAGESHIFT512K;
1201                 tsb_slab_size = MMU_PAGESIZE512K;
1202                 tsb_slab_mask = MMU_PAGEOFFSET512K >> MMU_PAGESHIFT;
1203                 use_bigtsb_arena = 0;
1204         }
1205 
1206         if (!use_bigtsb_arena) {
1207                 bigtsb_slab_ttesz = tsb_slab_ttesz;
1208                 bigtsb_slab_shift = tsb_slab_shift;
1209                 bigtsb_slab_size = tsb_slab_size;
1210                 bigtsb_slab_mask = tsb_slab_mask;
1211         }
1212 
1213 
1214         /*
1215          * Set up memory callback to update tsb_alloc_hiwater and
1216          * tsb_max_growsize.
1217          */
1218         i = kphysm_setup_func_register(&sfmmu_update_vec, (void *) 0);
1219         ASSERT(i == 0);
1220 
1221         /*
1222          * kmem_tsb_arena is the source from which large TSB slabs are
1223          * drawn.  The quantum of this arena corresponds to the largest
1224          * TSB size we can dynamically allocate for user processes.
1225          * Currently it must also be a supported page size since we
1226          * use exactly one translation entry to map each slab page.
1227          *
1228          * The per-lgroup kmem_tsb_default_arena arenas are the arenas from
1229          * which most TSBs are allocated.  Since most TSB allocations are
1230          * typically 8K we have a kmem cache we stack on top of each
1231          * kmem_tsb_default_arena to speed up those allocations.
1232          *
1233          * Note the two-level scheme of arenas is required only
1234          * because vmem_create doesn't allow us to specify alignment
1235          * requirements.  If this ever changes the code could be
1236          * simplified to use only one level of arenas.
1237          *
1238          * If 256M page support exists on sun4v, 256MB kmem_bigtsb_arena
1239          * will be provided in addition to the 4M kmem_tsb_arena.
1240          */
1241         if (use_bigtsb_arena) {
1242                 kmem_bigtsb_arena = vmem_create("kmem_bigtsb", NULL, 0,
1243                     bigtsb_slab_size, sfmmu_vmem_xalloc_aligned_wrapper,
1244                     vmem_xfree, heap_arena, 0, VM_SLEEP);
1245         }
1246 
1247         kmem_tsb_arena = vmem_create("kmem_tsb", NULL, 0, tsb_slab_size,
1248             sfmmu_vmem_xalloc_aligned_wrapper,
1249             vmem_xfree, heap_arena, 0, VM_SLEEP);
1250 
1251         if (tsb_lgrp_affinity) {
1252                 char s[50];
1253                 for (i = 0; i < NLGRPS_MAX; i++) {
1254                         if (use_bigtsb_arena) {
1255                                 (void) sprintf(s, "kmem_bigtsb_lgrp%d", i);
1256                                 kmem_bigtsb_default_arena[i] = vmem_create(s,
1257                                     NULL, 0, 2 * tsb_slab_size,
1258                                     sfmmu_tsb_segkmem_alloc,
1259                                     sfmmu_tsb_segkmem_free, kmem_bigtsb_arena,
1260                                     0, VM_SLEEP | VM_BESTFIT);
1261                         }
1262 
1263                         (void) sprintf(s, "kmem_tsb_lgrp%d", i);
1264                         kmem_tsb_default_arena[i] = vmem_create(s,
1265                             NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1266                             sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1267                             VM_SLEEP | VM_BESTFIT);
1268 
1269                         (void) sprintf(s, "sfmmu_tsb_lgrp%d_cache", i);
1270                         sfmmu_tsb_cache[i] = kmem_cache_create(s,
1271                             PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1272                             kmem_tsb_default_arena[i], 0);
1273                 }
1274         } else {
1275                 if (use_bigtsb_arena) {
1276                         kmem_bigtsb_default_arena[0] =
1277                             vmem_create("kmem_bigtsb_default", NULL, 0,
1278                             2 * tsb_slab_size, sfmmu_tsb_segkmem_alloc,
1279                             sfmmu_tsb_segkmem_free, kmem_bigtsb_arena, 0,
1280                             VM_SLEEP | VM_BESTFIT);
1281                 }
1282 
1283                 kmem_tsb_default_arena[0] = vmem_create("kmem_tsb_default",
1284                     NULL, 0, PAGESIZE, sfmmu_tsb_segkmem_alloc,
1285                     sfmmu_tsb_segkmem_free, kmem_tsb_arena, 0,
1286                     VM_SLEEP | VM_BESTFIT);
1287                 sfmmu_tsb_cache[0] = kmem_cache_create("sfmmu_tsb_cache",
1288                     PAGESIZE, PAGESIZE, NULL, NULL, NULL, NULL,
1289                     kmem_tsb_default_arena[0], 0);
1290         }
1291 
1292         sfmmu8_cache = kmem_cache_create("sfmmu8_cache", HME8BLK_SZ,
1293             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1294             sfmmu_hblkcache_destructor,
1295             sfmmu_hblkcache_reclaim, (void *)HME8BLK_SZ,
1296             hat_memload_arena, KMC_NOHASH);
1297 
1298         hat_memload1_arena = vmem_create("hat_memload1", NULL, 0, PAGESIZE,
1299             segkmem_alloc_permanent, segkmem_free, heap_arena, 0,
1300             VMC_DUMPSAFE | VM_SLEEP);
1301 
1302         sfmmu1_cache = kmem_cache_create("sfmmu1_cache", HME1BLK_SZ,
1303             HMEBLK_ALIGN, sfmmu_hblkcache_constructor,
1304             sfmmu_hblkcache_destructor,
1305             NULL, (void *)HME1BLK_SZ,
1306             hat_memload1_arena, KMC_NOHASH);
1307 
1308         pa_hment_cache = kmem_cache_create("pa_hment_cache", PAHME_SZ,
1309             0, NULL, NULL, NULL, NULL, static_arena, KMC_NOHASH);
1310 
1311         ism_blk_cache = kmem_cache_create("ism_blk_cache",
1312             sizeof (ism_blk_t), ecache_alignsize, NULL, NULL,
1313             NULL, NULL, static_arena, KMC_NOHASH);
1314 
1315         ism_ment_cache = kmem_cache_create("ism_ment_cache",
1316             sizeof (ism_ment_t), 0, NULL, NULL,
1317             NULL, NULL, NULL, 0);
1318 
1319         /*
1320          * We grab the first hat for the kernel,
1321          */
1322         AS_LOCK_ENTER(&kas, RW_WRITER);
1323         kas.a_hat = hat_alloc(&kas);
1324         AS_LOCK_EXIT(&kas);
1325 
1326         /*
1327          * Initialize hblk_reserve.
1328          */
1329         ((struct hme_blk *)hblk_reserve)->hblk_nextpa =
1330             va_to_pa((caddr_t)hblk_reserve);
1331 
1332 #ifndef UTSB_PHYS
1333         /*
1334          * Reserve some kernel virtual address space for the locked TTEs
1335          * that allow us to probe the TSB from TL>0.
1336          */
1337         utsb_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1338             0, 0, NULL, NULL, VM_SLEEP);
1339         utsb4m_vabase = vmem_xalloc(heap_arena, tsb_slab_size, tsb_slab_size,
1340             0, 0, NULL, NULL, VM_SLEEP);
1341 #endif
1342 
1343 #ifdef VAC
1344         /*
1345          * The big page VAC handling code assumes VAC
1346          * will not be bigger than the smallest big
1347          * page- which is 64K.
1348          */
1349         if (TTEPAGES(TTE64K) < CACHE_NUM_COLOR) {
1350                 cmn_err(CE_PANIC, "VAC too big!");
1351         }
1352 #endif
1353 
1354         uhme_hash_pa = va_to_pa(uhme_hash);
1355         khme_hash_pa = va_to_pa(khme_hash);
1356 
1357         /*
1358          * Initialize relocation locks. kpr_suspendlock is held
1359          * at PIL_MAX to prevent interrupts from pinning the holder
1360          * of a suspended TTE which may access it leading to a
1361          * deadlock condition.
1362          */
1363         mutex_init(&kpr_mutex, NULL, MUTEX_DEFAULT, NULL);
1364         mutex_init(&kpr_suspendlock, NULL, MUTEX_SPIN, (void *)PIL_MAX);
1365 
1366         /*
1367          * If Shared context support is disabled via /etc/system
1368          * set shctx_on to 0 here if it was set to 1 earlier in boot
1369          * sequence by cpu module initialization code.
1370          */
1371         if (shctx_on && disable_shctx) {
1372                 shctx_on = 0;
1373         }
1374 
1375         if (shctx_on) {
1376                 srd_buckets = kmem_zalloc(SFMMU_MAX_SRD_BUCKETS *
1377                     sizeof (srd_buckets[0]), KM_SLEEP);
1378                 for (i = 0; i < SFMMU_MAX_SRD_BUCKETS; i++) {
1379                         mutex_init(&srd_buckets[i].srdb_lock, NULL,
1380                             MUTEX_DEFAULT, NULL);
1381                 }
1382 
1383                 srd_cache = kmem_cache_create("srd_cache", sizeof (sf_srd_t),
1384                     0, sfmmu_srdcache_constructor, sfmmu_srdcache_destructor,
1385                     NULL, NULL, NULL, 0);
1386                 region_cache = kmem_cache_create("region_cache",
1387                     sizeof (sf_region_t), 0, sfmmu_rgncache_constructor,
1388                     sfmmu_rgncache_destructor, NULL, NULL, NULL, 0);
1389                 scd_cache = kmem_cache_create("scd_cache", sizeof (sf_scd_t),
1390                     0, sfmmu_scdcache_constructor,  sfmmu_scdcache_destructor,
1391                     NULL, NULL, NULL, 0);
1392         }
1393 
1394         /*
1395          * Pre-allocate hrm_hashtab before enabling the collection of
1396          * refmod statistics.  Allocating on the fly would mean us
1397          * running the risk of suffering recursive mutex enters or
1398          * deadlocks.
1399          */
1400         hrm_hashtab = kmem_zalloc(HRM_HASHSIZE * sizeof (struct hrmstat *),
1401             KM_SLEEP);
1402 
1403         /* Allocate per-cpu pending freelist of hmeblks */
1404         cpu_hme_pend = kmem_zalloc((NCPU * sizeof (cpu_hme_pend_t)) + 64,
1405             KM_SLEEP);
1406         cpu_hme_pend = (cpu_hme_pend_t *)P2ROUNDUP(
1407             (uintptr_t)cpu_hme_pend, 64);
1408 
1409         for (i = 0; i < NCPU; i++) {
1410                 mutex_init(&cpu_hme_pend[i].chp_mutex, NULL, MUTEX_DEFAULT,
1411                     NULL);
1412         }
1413 
1414         if (cpu_hme_pend_thresh == 0) {
1415                 cpu_hme_pend_thresh = CPU_HME_PEND_THRESH;
1416         }
1417 }
1418 
1419 /*
1420  * Initialize locking for the hat layer, called early during boot.
1421  */
1422 static void
1423 hat_lock_init()
1424 {
1425         int i;
1426 
1427         /*
1428          * initialize the array of mutexes protecting a page's mapping
1429          * list and p_nrm field.
1430          */
1431         for (i = 0; i < MML_TABLE_SIZE; i++)
1432                 mutex_init(&mml_table[i].pad_mutex, NULL, MUTEX_DEFAULT, NULL);
1433 
1434         if (kpm_enable) {
1435                 for (i = 0; i < kpmp_table_sz; i++) {
1436                         mutex_init(&kpmp_table[i].khl_mutex, NULL,
1437                             MUTEX_DEFAULT, NULL);
1438                 }
1439         }
1440 
1441         /*
1442          * Initialize array of mutex locks that protects sfmmu fields and
1443          * TSB lists.
1444          */
1445         for (i = 0; i < SFMMU_NUM_LOCK; i++)
1446                 mutex_init(HATLOCK_MUTEXP(&hat_lock[i]), NULL, MUTEX_DEFAULT,
1447                     NULL);
1448 }
1449 
1450 #define SFMMU_KERNEL_MAXVA \
1451         (kmem64_base ? (uintptr_t)kmem64_end : (SYSLIMIT))
1452 
1453 /*
1454  * Allocate a hat structure.
1455  * Called when an address space first uses a hat.
1456  */
1457 struct hat *
1458 hat_alloc(struct as *as)
1459 {
1460         sfmmu_t *sfmmup;
1461         int i;
1462         uint64_t cnum;
1463         extern uint_t get_color_start(struct as *);
1464 
1465         ASSERT(AS_WRITE_HELD(as));
1466         sfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
1467         sfmmup->sfmmu_as = as;
1468         sfmmup->sfmmu_flags = 0;
1469         sfmmup->sfmmu_tteflags = 0;
1470         sfmmup->sfmmu_rtteflags = 0;
1471         LOCK_INIT_CLEAR(&sfmmup->sfmmu_ctx_lock);
1472 
1473         if (as == &kas) {
1474                 ksfmmup = sfmmup;
1475                 sfmmup->sfmmu_cext = 0;
1476                 cnum = KCONTEXT;
1477 
1478                 sfmmup->sfmmu_clrstart = 0;
1479                 sfmmup->sfmmu_tsb = NULL;
1480                 /*
1481                  * hat_kern_setup() will call sfmmu_init_ktsbinfo()
1482                  * to setup tsb_info for ksfmmup.
1483                  */
1484         } else {
1485 
1486                 /*
1487                  * Just set to invalid ctx. When it faults, it will
1488                  * get a valid ctx. This would avoid the situation
1489                  * where we get a ctx, but it gets stolen and then
1490                  * we fault when we try to run and so have to get
1491                  * another ctx.
1492                  */
1493                 sfmmup->sfmmu_cext = 0;
1494                 cnum = INVALID_CONTEXT;
1495 
1496                 /* initialize original physical page coloring bin */
1497                 sfmmup->sfmmu_clrstart = get_color_start(as);
1498 #ifdef DEBUG
1499                 if (tsb_random_size) {
1500                         uint32_t randval = (uint32_t)gettick() >> 4;
1501                         int size = randval % (tsb_max_growsize + 1);
1502 
1503                         /* chose a random tsb size for stress testing */
1504                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb, size,
1505                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1506                 } else
1507 #endif /* DEBUG */
1508                         (void) sfmmu_tsbinfo_alloc(&sfmmup->sfmmu_tsb,
1509                             default_tsb_size,
1510                             TSB8K|TSB64K|TSB512K, 0, sfmmup);
1511                 sfmmup->sfmmu_flags = HAT_SWAPPED | HAT_ALLCTX_INVALID;
1512                 ASSERT(sfmmup->sfmmu_tsb != NULL);
1513         }
1514 
1515         ASSERT(max_mmu_ctxdoms > 0);
1516         for (i = 0; i < max_mmu_ctxdoms; i++) {
1517                 sfmmup->sfmmu_ctxs[i].cnum = cnum;
1518                 sfmmup->sfmmu_ctxs[i].gnum = 0;
1519         }
1520 
1521         for (i = 0; i < max_mmu_page_sizes; i++) {
1522                 sfmmup->sfmmu_ttecnt[i] = 0;
1523                 sfmmup->sfmmu_scdrttecnt[i] = 0;
1524                 sfmmup->sfmmu_ismttecnt[i] = 0;
1525                 sfmmup->sfmmu_scdismttecnt[i] = 0;
1526                 sfmmup->sfmmu_pgsz[i] = TTE8K;
1527         }
1528         sfmmup->sfmmu_tsb0_4minflcnt = 0;
1529         sfmmup->sfmmu_iblk = NULL;
1530         sfmmup->sfmmu_ismhat = 0;
1531         sfmmup->sfmmu_scdhat = 0;
1532         sfmmup->sfmmu_ismblkpa = (uint64_t)-1;
1533         if (sfmmup == ksfmmup) {
1534                 CPUSET_ALL(sfmmup->sfmmu_cpusran);
1535         } else {
1536                 CPUSET_ZERO(sfmmup->sfmmu_cpusran);
1537         }
1538         sfmmup->sfmmu_free = 0;
1539         sfmmup->sfmmu_rmstat = 0;
1540         sfmmup->sfmmu_clrbin = sfmmup->sfmmu_clrstart;
1541         cv_init(&sfmmup->sfmmu_tsb_cv, NULL, CV_DEFAULT, NULL);
1542         sfmmup->sfmmu_srdp = NULL;
1543         SF_RGNMAP_ZERO(sfmmup->sfmmu_region_map);
1544         bzero(sfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
1545         sfmmup->sfmmu_scdp = NULL;
1546         sfmmup->sfmmu_scd_link.next = NULL;
1547         sfmmup->sfmmu_scd_link.prev = NULL;
1548         return (sfmmup);
1549 }
1550 
1551 /*
1552  * Create per-MMU context domain kstats for a given MMU ctx.
1553  */
1554 static void
1555 sfmmu_mmu_kstat_create(mmu_ctx_t *mmu_ctxp)
1556 {
1557         mmu_ctx_stat_t  stat;
1558         kstat_t         *mmu_kstat;
1559 
1560         ASSERT(MUTEX_HELD(&cpu_lock));
1561         ASSERT(mmu_ctxp->mmu_kstat == NULL);
1562 
1563         mmu_kstat = kstat_create("unix", mmu_ctxp->mmu_idx, "mmu_ctx",
1564             "hat", KSTAT_TYPE_NAMED, MMU_CTX_NUM_STATS, KSTAT_FLAG_VIRTUAL);
1565 
1566         if (mmu_kstat == NULL) {
1567                 cmn_err(CE_WARN, "kstat_create for MMU %d failed",
1568                     mmu_ctxp->mmu_idx);
1569         } else {
1570                 mmu_kstat->ks_data = mmu_ctxp->mmu_kstat_data;
1571                 for (stat = 0; stat < MMU_CTX_NUM_STATS; stat++)
1572                         kstat_named_init(&mmu_ctxp->mmu_kstat_data[stat],
1573                             mmu_ctx_kstat_names[stat], KSTAT_DATA_INT64);
1574                 mmu_ctxp->mmu_kstat = mmu_kstat;
1575                 kstat_install(mmu_kstat);
1576         }
1577 }
1578 
1579 /*
1580  * plat_cpuid_to_mmu_ctx_info() is a platform interface that returns MMU
1581  * context domain information for a given CPU. If a platform does not
1582  * specify that interface, then the function below is used instead to return
1583  * default information. The defaults are as follows:
1584  *
1585  *      - The number of MMU context IDs supported on any CPU in the
1586  *        system is 8K.
1587  *      - There is one MMU context domain per CPU.
1588  */
1589 /*ARGSUSED*/
1590 static void
1591 sfmmu_cpuid_to_mmu_ctx_info(processorid_t cpuid, mmu_ctx_info_t *infop)
1592 {
1593         infop->mmu_nctxs = nctxs;
1594         infop->mmu_idx = cpu[cpuid]->cpu_seqid;
1595 }
1596 
1597 /*
1598  * Called during CPU initialization to set the MMU context-related information
1599  * for a CPU.
1600  *
1601  * cpu_lock serializes accesses to mmu_ctxs and mmu_saved_gnum.
1602  */
1603 void
1604 sfmmu_cpu_init(cpu_t *cp)
1605 {
1606         mmu_ctx_info_t  info;
1607         mmu_ctx_t       *mmu_ctxp;
1608 
1609         ASSERT(MUTEX_HELD(&cpu_lock));
1610 
1611         if (&plat_cpuid_to_mmu_ctx_info == NULL)
1612                 sfmmu_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1613         else
1614                 plat_cpuid_to_mmu_ctx_info(cp->cpu_id, &info);
1615 
1616         ASSERT(info.mmu_idx < max_mmu_ctxdoms);
1617 
1618         if ((mmu_ctxp = mmu_ctxs_tbl[info.mmu_idx]) == NULL) {
1619                 /* Each mmu_ctx is cacheline aligned. */
1620                 mmu_ctxp = kmem_cache_alloc(mmuctxdom_cache, KM_SLEEP);
1621                 bzero(mmu_ctxp, sizeof (mmu_ctx_t));
1622 
1623                 mutex_init(&mmu_ctxp->mmu_lock, NULL, MUTEX_SPIN,
1624                     (void *)ipltospl(DISP_LEVEL));
1625                 mmu_ctxp->mmu_idx = info.mmu_idx;
1626                 mmu_ctxp->mmu_nctxs = info.mmu_nctxs;
1627                 /*
1628                  * Globally for lifetime of a system,
1629                  * gnum must always increase.
1630                  * mmu_saved_gnum is protected by the cpu_lock.
1631                  */
1632                 mmu_ctxp->mmu_gnum = mmu_saved_gnum + 1;
1633                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
1634 
1635                 sfmmu_mmu_kstat_create(mmu_ctxp);
1636 
1637                 mmu_ctxs_tbl[info.mmu_idx] = mmu_ctxp;
1638         } else {
1639                 ASSERT(mmu_ctxp->mmu_idx == info.mmu_idx);
1640                 ASSERT(mmu_ctxp->mmu_nctxs <= info.mmu_nctxs);
1641         }
1642 
1643         /*
1644          * The mmu_lock is acquired here to prevent races with
1645          * the wrap-around code.
1646          */
1647         mutex_enter(&mmu_ctxp->mmu_lock);
1648 
1649 
1650         mmu_ctxp->mmu_ncpus++;
1651         CPUSET_ADD(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1652         CPU_MMU_IDX(cp) = info.mmu_idx;
1653         CPU_MMU_CTXP(cp) = mmu_ctxp;
1654 
1655         mutex_exit(&mmu_ctxp->mmu_lock);
1656 }
1657 
1658 static void
1659 sfmmu_ctxdom_free(mmu_ctx_t *mmu_ctxp)
1660 {
1661         ASSERT(MUTEX_HELD(&cpu_lock));
1662         ASSERT(!MUTEX_HELD(&mmu_ctxp->mmu_lock));
1663 
1664         mutex_destroy(&mmu_ctxp->mmu_lock);
1665 
1666         if (mmu_ctxp->mmu_kstat)
1667                 kstat_delete(mmu_ctxp->mmu_kstat);
1668 
1669         /* mmu_saved_gnum is protected by the cpu_lock. */
1670         if (mmu_saved_gnum < mmu_ctxp->mmu_gnum)
1671                 mmu_saved_gnum = mmu_ctxp->mmu_gnum;
1672 
1673         kmem_cache_free(mmuctxdom_cache, mmu_ctxp);
1674 }
1675 
1676 /*
1677  * Called to perform MMU context-related cleanup for a CPU.
1678  */
1679 void
1680 sfmmu_cpu_cleanup(cpu_t *cp)
1681 {
1682         mmu_ctx_t       *mmu_ctxp;
1683 
1684         ASSERT(MUTEX_HELD(&cpu_lock));
1685 
1686         mmu_ctxp = CPU_MMU_CTXP(cp);
1687         ASSERT(mmu_ctxp != NULL);
1688 
1689         /*
1690          * The mmu_lock is acquired here to prevent races with
1691          * the wrap-around code.
1692          */
1693         mutex_enter(&mmu_ctxp->mmu_lock);
1694 
1695         CPU_MMU_CTXP(cp) = NULL;
1696 
1697         CPUSET_DEL(mmu_ctxp->mmu_cpuset, cp->cpu_id);
1698         if (--mmu_ctxp->mmu_ncpus == 0) {
1699                 mmu_ctxs_tbl[mmu_ctxp->mmu_idx] = NULL;
1700                 mutex_exit(&mmu_ctxp->mmu_lock);
1701                 sfmmu_ctxdom_free(mmu_ctxp);
1702                 return;
1703         }
1704 
1705         mutex_exit(&mmu_ctxp->mmu_lock);
1706 }
1707 
1708 uint_t
1709 sfmmu_ctxdom_nctxs(int idx)
1710 {
1711         return (mmu_ctxs_tbl[idx]->mmu_nctxs);
1712 }
1713 
1714 #ifdef sun4v
1715 /*
1716  * sfmmu_ctxdoms_* is an interface provided to help keep context domains
1717  * consistant after suspend/resume on system that can resume on a different
1718  * hardware than it was suspended.
1719  *
1720  * sfmmu_ctxdom_lock(void) locks all context domains and prevents new contexts
1721  * from being allocated.  It acquires all hat_locks, which blocks most access to
1722  * context data, except for a few cases that are handled separately or are
1723  * harmless.  It wraps each domain to increment gnum and invalidate on-CPU
1724  * contexts, and forces cnum to its max.  As a result of this call all user
1725  * threads that are running on CPUs trap and try to perform wrap around but
1726  * can't because hat_locks are taken.  Threads that were not on CPUs but started
1727  * by scheduler go to sfmmu_alloc_ctx() to aquire context without checking
1728  * hat_lock, but fail, because cnum == nctxs, and therefore also trap and block
1729  * on hat_lock trying to wrap.  sfmmu_ctxdom_lock() must be called before CPUs
1730  * are paused, else it could deadlock acquiring locks held by paused CPUs.
1731  *
1732  * sfmmu_ctxdoms_remove() removes context domains from every CPUs and records
1733  * the CPUs that had them.  It must be called after CPUs have been paused. This
1734  * ensures that no threads are in sfmmu_alloc_ctx() accessing domain data,
1735  * because pause_cpus sends a mondo interrupt to every CPU, and sfmmu_alloc_ctx
1736  * runs with interrupts disabled.  When CPUs are later resumed, they may enter
1737  * sfmmu_alloc_ctx, but it will check for CPU_MMU_CTXP = NULL and immediately
1738  * return failure.  Or, they will be blocked trying to acquire hat_lock. Thus
1739  * after sfmmu_ctxdoms_remove returns, we are guaranteed that no one is
1740  * accessing the old context domains.
1741  *
1742  * sfmmu_ctxdoms_update(void) frees space used by old context domains and
1743  * allocates new context domains based on hardware layout.  It initializes
1744  * every CPU that had context domain before migration to have one again.
1745  * sfmmu_ctxdoms_update must be called after CPUs are resumed, else it
1746  * could deadlock acquiring locks held by paused CPUs.
1747  *
1748  * sfmmu_ctxdoms_unlock(void) releases all hat_locks after which user threads
1749  * acquire new context ids and continue execution.
1750  *
1751  * Therefore functions should be called in the following order:
1752  *       suspend_routine()
1753  *              sfmmu_ctxdom_lock()
1754  *              pause_cpus()
1755  *              suspend()
1756  *                      if (suspend failed)
1757  *                              sfmmu_ctxdom_unlock()
1758  *              ...
1759  *              sfmmu_ctxdom_remove()
1760  *              resume_cpus()
1761  *              sfmmu_ctxdom_update()
1762  *              sfmmu_ctxdom_unlock()
1763  */
1764 static cpuset_t sfmmu_ctxdoms_pset;
1765 
1766 void
1767 sfmmu_ctxdoms_remove()
1768 {
1769         processorid_t   id;
1770         cpu_t           *cp;
1771 
1772         /*
1773          * Record the CPUs that have domains in sfmmu_ctxdoms_pset, so they can
1774          * be restored post-migration. A CPU may be powered off and not have a
1775          * domain, for example.
1776          */
1777         CPUSET_ZERO(sfmmu_ctxdoms_pset);
1778 
1779         for (id = 0; id < NCPU; id++) {
1780                 if ((cp = cpu[id]) != NULL && CPU_MMU_CTXP(cp) != NULL) {
1781                         CPUSET_ADD(sfmmu_ctxdoms_pset, id);
1782                         CPU_MMU_CTXP(cp) = NULL;
1783                 }
1784         }
1785 }
1786 
1787 void
1788 sfmmu_ctxdoms_lock(void)
1789 {
1790         int             idx;
1791         mmu_ctx_t       *mmu_ctxp;
1792 
1793         sfmmu_hat_lock_all();
1794 
1795         /*
1796          * At this point, no thread can be in sfmmu_ctx_wrap_around, because
1797          * hat_lock is always taken before calling it.
1798          *
1799          * For each domain, set mmu_cnum to max so no more contexts can be
1800          * allocated, and wrap to flush on-CPU contexts and force threads to
1801          * acquire a new context when we later drop hat_lock after migration.
1802          * Setting mmu_cnum may race with sfmmu_alloc_ctx which also sets cnum,
1803          * but the latter uses CAS and will miscompare and not overwrite it.
1804          */
1805         kpreempt_disable(); /* required by sfmmu_ctx_wrap_around */
1806         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1807                 if ((mmu_ctxp = mmu_ctxs_tbl[idx]) != NULL) {
1808                         mutex_enter(&mmu_ctxp->mmu_lock);
1809                         mmu_ctxp->mmu_cnum = mmu_ctxp->mmu_nctxs;
1810                         /* make sure updated cnum visible */
1811                         membar_enter();
1812                         mutex_exit(&mmu_ctxp->mmu_lock);
1813                         sfmmu_ctx_wrap_around(mmu_ctxp, B_FALSE);
1814                 }
1815         }
1816         kpreempt_enable();
1817 }
1818 
1819 void
1820 sfmmu_ctxdoms_unlock(void)
1821 {
1822         sfmmu_hat_unlock_all();
1823 }
1824 
1825 void
1826 sfmmu_ctxdoms_update(void)
1827 {
1828         processorid_t   id;
1829         cpu_t           *cp;
1830         uint_t          idx;
1831         mmu_ctx_t       *mmu_ctxp;
1832 
1833         /*
1834          * Free all context domains.  As side effect, this increases
1835          * mmu_saved_gnum to the maximum gnum over all domains, which is used to
1836          * init gnum in the new domains, which therefore will be larger than the
1837          * sfmmu gnum for any process, guaranteeing that every process will see
1838          * a new generation and allocate a new context regardless of what new
1839          * domain it runs in.
1840          */
1841         mutex_enter(&cpu_lock);
1842 
1843         for (idx = 0; idx < max_mmu_ctxdoms; idx++) {
1844                 if (mmu_ctxs_tbl[idx] != NULL) {
1845                         mmu_ctxp = mmu_ctxs_tbl[idx];
1846                         mmu_ctxs_tbl[idx] = NULL;
1847                         sfmmu_ctxdom_free(mmu_ctxp);
1848                 }
1849         }
1850 
1851         for (id = 0; id < NCPU; id++) {
1852                 if (CPU_IN_SET(sfmmu_ctxdoms_pset, id) &&
1853                     (cp = cpu[id]) != NULL)
1854                         sfmmu_cpu_init(cp);
1855         }
1856         mutex_exit(&cpu_lock);
1857 }
1858 #endif
1859 
1860 /*
1861  * Hat_setup, makes an address space context the current active one.
1862  * In sfmmu this translates to setting the secondary context with the
1863  * corresponding context.
1864  */
1865 void
1866 hat_setup(struct hat *sfmmup, int allocflag)
1867 {
1868         hatlock_t *hatlockp;
1869 
1870         /* Init needs some special treatment. */
1871         if (allocflag == HAT_INIT) {
1872                 /*
1873                  * Make sure that we have
1874                  * 1. a TSB
1875                  * 2. a valid ctx that doesn't get stolen after this point.
1876                  */
1877                 hatlockp = sfmmu_hat_enter(sfmmup);
1878 
1879                 /*
1880                  * Swap in the TSB.  hat_init() allocates tsbinfos without
1881                  * TSBs, but we need one for init, since the kernel does some
1882                  * special things to set up its stack and needs the TSB to
1883                  * resolve page faults.
1884                  */
1885                 sfmmu_tsb_swapin(sfmmup, hatlockp);
1886 
1887                 sfmmu_get_ctx(sfmmup);
1888 
1889                 sfmmu_hat_exit(hatlockp);
1890         } else {
1891                 ASSERT(allocflag == HAT_ALLOC);
1892 
1893                 hatlockp = sfmmu_hat_enter(sfmmup);
1894                 kpreempt_disable();
1895 
1896                 CPUSET_ADD(sfmmup->sfmmu_cpusran, CPU->cpu_id);
1897                 /*
1898                  * sfmmu_setctx_sec takes <pgsz|cnum> as a parameter,
1899                  * pagesize bits don't matter in this case since we are passing
1900                  * INVALID_CONTEXT to it.
1901                  * Compatibility Note: hw takes care of MMU_SCONTEXT1
1902                  */
1903                 sfmmu_setctx_sec(INVALID_CONTEXT);
1904                 sfmmu_clear_utsbinfo();
1905 
1906                 kpreempt_enable();
1907                 sfmmu_hat_exit(hatlockp);
1908         }
1909 }
1910 
1911 /*
1912  * Free all the translation resources for the specified address space.
1913  * Called from as_free when an address space is being destroyed.
1914  */
1915 void
1916 hat_free_start(struct hat *sfmmup)
1917 {
1918         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
1919         ASSERT(sfmmup != ksfmmup);
1920 
1921         sfmmup->sfmmu_free = 1;
1922         if (sfmmup->sfmmu_scdp != NULL) {
1923                 sfmmu_leave_scd(sfmmup, 0);
1924         }
1925 
1926         ASSERT(sfmmup->sfmmu_scdp == NULL);
1927 }
1928 
1929 void
1930 hat_free_end(struct hat *sfmmup)
1931 {
1932         int i;
1933 
1934         ASSERT(sfmmup->sfmmu_free == 1);
1935         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
1936         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
1937         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
1938         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
1939         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
1940         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
1941 
1942         if (sfmmup->sfmmu_rmstat) {
1943                 hat_freestat(sfmmup->sfmmu_as, NULL);
1944         }
1945 
1946         while (sfmmup->sfmmu_tsb != NULL) {
1947                 struct tsb_info *next = sfmmup->sfmmu_tsb->tsb_next;
1948                 sfmmu_tsbinfo_free(sfmmup->sfmmu_tsb);
1949                 sfmmup->sfmmu_tsb = next;
1950         }
1951 
1952         if (sfmmup->sfmmu_srdp != NULL) {
1953                 sfmmu_leave_srd(sfmmup);
1954                 ASSERT(sfmmup->sfmmu_srdp == NULL);
1955                 for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1956                         if (sfmmup->sfmmu_hmeregion_links[i] != NULL) {
1957                                 kmem_free(sfmmup->sfmmu_hmeregion_links[i],
1958                                     SFMMU_L2_HMERLINKS_SIZE);
1959                                 sfmmup->sfmmu_hmeregion_links[i] = NULL;
1960                         }
1961                 }
1962         }
1963         sfmmu_free_sfmmu(sfmmup);
1964 
1965 #ifdef DEBUG
1966         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
1967                 ASSERT(sfmmup->sfmmu_hmeregion_links[i] == NULL);
1968         }
1969 #endif
1970 
1971         kmem_cache_free(sfmmuid_cache, sfmmup);
1972 }
1973 
1974 /*
1975  * Set up any translation structures, for the specified address space,
1976  * that are needed or preferred when the process is being swapped in.
1977  */
1978 /* ARGSUSED */
1979 void
1980 hat_swapin(struct hat *hat)
1981 {
1982 }
1983 
1984 /*
1985  * Free all of the translation resources, for the specified address space,
1986  * that can be freed while the process is swapped out. Called from as_swapout.
1987  * Also, free up the ctx that this process was using.
1988  */
1989 void
1990 hat_swapout(struct hat *sfmmup)
1991 {
1992         struct hmehash_bucket *hmebp;
1993         struct hme_blk *hmeblkp;
1994         struct hme_blk *pr_hblk = NULL;
1995         struct hme_blk *nx_hblk;
1996         int i;
1997         struct hme_blk *list = NULL;
1998         hatlock_t *hatlockp;
1999         struct tsb_info *tsbinfop;
2000         struct free_tsb {
2001                 struct free_tsb *next;
2002                 struct tsb_info *tsbinfop;
2003         };                      /* free list of TSBs */
2004         struct free_tsb *freelist, *last, *next;
2005 
2006         SFMMU_STAT(sf_swapout);
2007 
2008         /*
2009          * There is no way to go from an as to all its translations in sfmmu.
2010          * Here is one of the times when we take the big hit and traverse
2011          * the hash looking for hme_blks to free up.  Not only do we free up
2012          * this as hme_blks but all those that are free.  We are obviously
2013          * swapping because we need memory so let's free up as much
2014          * as we can.
2015          *
2016          * Note that we don't flush TLB/TSB here -- it's not necessary
2017          * because:
2018          *  1) we free the ctx we're using and throw away the TSB(s);
2019          *  2) processes aren't runnable while being swapped out.
2020          */
2021         ASSERT(sfmmup != KHATID);
2022         for (i = 0; i <= UHMEHASH_SZ; i++) {
2023                 hmebp = &uhme_hash[i];
2024                 SFMMU_HASH_LOCK(hmebp);
2025                 hmeblkp = hmebp->hmeblkp;
2026                 pr_hblk = NULL;
2027                 while (hmeblkp) {
2028 
2029                         if ((hmeblkp->hblk_tag.htag_id == sfmmup) &&
2030                             !hmeblkp->hblk_shw_bit && !hmeblkp->hblk_lckcnt) {
2031                                 ASSERT(!hmeblkp->hblk_shared);
2032                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
2033                                     (caddr_t)get_hblk_base(hmeblkp),
2034                                     get_hblk_endaddr(hmeblkp),
2035                                     NULL, HAT_UNLOAD);
2036                         }
2037                         nx_hblk = hmeblkp->hblk_next;
2038                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
2039                                 ASSERT(!hmeblkp->hblk_lckcnt);
2040                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2041                                     &list, 0);
2042                         } else {
2043                                 pr_hblk = hmeblkp;
2044                         }
2045                         hmeblkp = nx_hblk;
2046                 }
2047                 SFMMU_HASH_UNLOCK(hmebp);
2048         }
2049 
2050         sfmmu_hblks_list_purge(&list, 0);
2051 
2052         /*
2053          * Now free up the ctx so that others can reuse it.
2054          */
2055         hatlockp = sfmmu_hat_enter(sfmmup);
2056 
2057         sfmmu_invalidate_ctx(sfmmup);
2058 
2059         /*
2060          * Free TSBs, but not tsbinfos, and set SWAPPED flag.
2061          * If TSBs were never swapped in, just return.
2062          * This implies that we don't support partial swapping
2063          * of TSBs -- either all are swapped out, or none are.
2064          *
2065          * We must hold the HAT lock here to prevent racing with another
2066          * thread trying to unmap TTEs from the TSB or running the post-
2067          * relocator after relocating the TSB's memory.  Unfortunately, we
2068          * can't free memory while holding the HAT lock or we could
2069          * deadlock, so we build a list of TSBs to be freed after marking
2070          * the tsbinfos as swapped out and free them after dropping the
2071          * lock.
2072          */
2073         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
2074                 sfmmu_hat_exit(hatlockp);
2075                 return;
2076         }
2077 
2078         SFMMU_FLAGS_SET(sfmmup, HAT_SWAPPED);
2079         last = freelist = NULL;
2080         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
2081             tsbinfop = tsbinfop->tsb_next) {
2082                 ASSERT((tsbinfop->tsb_flags & TSB_SWAPPED) == 0);
2083 
2084                 /*
2085                  * Cast the TSB into a struct free_tsb and put it on the free
2086                  * list.
2087                  */
2088                 if (freelist == NULL) {
2089                         last = freelist = (struct free_tsb *)tsbinfop->tsb_va;
2090                 } else {
2091                         last->next = (struct free_tsb *)tsbinfop->tsb_va;
2092                         last = last->next;
2093                 }
2094                 last->next = NULL;
2095                 last->tsbinfop = tsbinfop;
2096                 tsbinfop->tsb_flags |= TSB_SWAPPED;
2097                 /*
2098                  * Zero out the TTE to clear the valid bit.
2099                  * Note we can't use a value like 0xbad because we want to
2100                  * ensure diagnostic bits are NEVER set on TTEs that might
2101                  * be loaded.  The intent is to catch any invalid access
2102                  * to the swapped TSB, such as a thread running with a valid
2103                  * context without first calling sfmmu_tsb_swapin() to
2104                  * allocate TSB memory.
2105                  */
2106                 tsbinfop->tsb_tte.ll = 0;
2107         }
2108 
2109         /* Now we can drop the lock and free the TSB memory. */
2110         sfmmu_hat_exit(hatlockp);
2111         for (; freelist != NULL; freelist = next) {
2112                 next = freelist->next;
2113                 sfmmu_tsb_free(freelist->tsbinfop);
2114         }
2115 }
2116 
2117 /*
2118  * Duplicate the translations of an as into another newas
2119  */
2120 /* ARGSUSED */
2121 int
2122 hat_dup(struct hat *hat, struct hat *newhat, caddr_t addr, size_t len,
2123     uint_t flag)
2124 {
2125         sf_srd_t *srdp;
2126         sf_scd_t *scdp;
2127         int i;
2128         extern uint_t get_color_start(struct as *);
2129 
2130         ASSERT((flag == 0) || (flag == HAT_DUP_ALL) || (flag == HAT_DUP_COW) ||
2131             (flag == HAT_DUP_SRD));
2132         ASSERT(hat != ksfmmup);
2133         ASSERT(newhat != ksfmmup);
2134         ASSERT(flag != HAT_DUP_ALL || hat->sfmmu_srdp == newhat->sfmmu_srdp);
2135 
2136         if (flag == HAT_DUP_COW) {
2137                 panic("hat_dup: HAT_DUP_COW not supported");
2138         }
2139 
2140         if (flag == HAT_DUP_SRD && ((srdp = hat->sfmmu_srdp) != NULL)) {
2141                 ASSERT(srdp->srd_evp != NULL);
2142                 VN_HOLD(srdp->srd_evp);
2143                 ASSERT(srdp->srd_refcnt > 0);
2144                 newhat->sfmmu_srdp = srdp;
2145                 atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
2146         }
2147 
2148         /*
2149          * HAT_DUP_ALL flag is used after as duplication is done.
2150          */
2151         if (flag == HAT_DUP_ALL && ((srdp = newhat->sfmmu_srdp) != NULL)) {
2152                 ASSERT(newhat->sfmmu_srdp->srd_refcnt >= 2);
2153                 newhat->sfmmu_rtteflags = hat->sfmmu_rtteflags;
2154                 if (hat->sfmmu_flags & HAT_4MTEXT_FLAG) {
2155                         newhat->sfmmu_flags |= HAT_4MTEXT_FLAG;
2156                 }
2157 
2158                 /* check if need to join scd */
2159                 if ((scdp = hat->sfmmu_scdp) != NULL &&
2160                     newhat->sfmmu_scdp != scdp) {
2161                         int ret;
2162                         SF_RGNMAP_IS_SUBSET(&newhat->sfmmu_region_map,
2163                             &scdp->scd_region_map, ret);
2164                         ASSERT(ret);
2165                         sfmmu_join_scd(scdp, newhat);
2166                         ASSERT(newhat->sfmmu_scdp == scdp &&
2167                             scdp->scd_refcnt >= 2);
2168                         for (i = 0; i < max_mmu_page_sizes; i++) {
2169                                 newhat->sfmmu_ismttecnt[i] =
2170                                     hat->sfmmu_ismttecnt[i];
2171                                 newhat->sfmmu_scdismttecnt[i] =
2172                                     hat->sfmmu_scdismttecnt[i];
2173                         }
2174                 }
2175 
2176                 sfmmu_check_page_sizes(newhat, 1);
2177         }
2178 
2179         if (flag == HAT_DUP_ALL && consistent_coloring == 0 &&
2180             update_proc_pgcolorbase_after_fork != 0) {
2181                 hat->sfmmu_clrbin = get_color_start(hat->sfmmu_as);
2182         }
2183         return (0);
2184 }
2185 
2186 void
2187 hat_memload(struct hat *hat, caddr_t addr, struct page *pp,
2188     uint_t attr, uint_t flags)
2189 {
2190         hat_do_memload(hat, addr, pp, attr, flags,
2191             SFMMU_INVALID_SHMERID);
2192 }
2193 
2194 void
2195 hat_memload_region(struct hat *hat, caddr_t addr, struct page *pp,
2196     uint_t attr, uint_t flags, hat_region_cookie_t rcookie)
2197 {
2198         uint_t rid;
2199         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2200                 hat_do_memload(hat, addr, pp, attr, flags,
2201                     SFMMU_INVALID_SHMERID);
2202                 return;
2203         }
2204         rid = (uint_t)((uint64_t)rcookie);
2205         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2206         hat_do_memload(hat, addr, pp, attr, flags, rid);
2207 }
2208 
2209 /*
2210  * Set up addr to map to page pp with protection prot.
2211  * As an optimization we also load the TSB with the
2212  * corresponding tte but it is no big deal if  the tte gets kicked out.
2213  */
2214 static void
2215 hat_do_memload(struct hat *hat, caddr_t addr, struct page *pp,
2216     uint_t attr, uint_t flags, uint_t rid)
2217 {
2218         tte_t tte;
2219 
2220 
2221         ASSERT(hat != NULL);
2222         ASSERT(PAGE_LOCKED(pp));
2223         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2224         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2225         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2226         SFMMU_VALIDATE_HMERID(hat, rid, addr, MMU_PAGESIZE);
2227 
2228         if (PP_ISFREE(pp)) {
2229                 panic("hat_memload: loading a mapping to free page %p",
2230                     (void *)pp);
2231         }
2232 
2233         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2234 
2235         if (flags & ~SFMMU_LOAD_ALLFLAG)
2236                 cmn_err(CE_NOTE, "hat_memload: unsupported flags %d",
2237                     flags & ~SFMMU_LOAD_ALLFLAG);
2238 
2239         if (hat->sfmmu_rmstat)
2240                 hat_resvstat(MMU_PAGESIZE, hat->sfmmu_as, addr);
2241 
2242 #if defined(SF_ERRATA_57)
2243         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2244             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2245             !(flags & HAT_LOAD_SHARE)) {
2246                 cmn_err(CE_WARN, "hat_memload: illegal attempt to make user "
2247                     " page executable");
2248                 attr &= ~PROT_EXEC;
2249         }
2250 #endif
2251 
2252         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2253         (void) sfmmu_tteload_array(hat, &tte, addr, &pp, flags, rid);
2254 
2255         /*
2256          * Check TSB and TLB page sizes.
2257          */
2258         if ((flags & HAT_LOAD_SHARE) == 0) {
2259                 sfmmu_check_page_sizes(hat, 1);
2260         }
2261 }
2262 
2263 /*
2264  * hat_devload can be called to map real memory (e.g.
2265  * /dev/kmem) and even though hat_devload will determine pf is
2266  * for memory, it will be unable to get a shared lock on the
2267  * page (because someone else has it exclusively) and will
2268  * pass dp = NULL.  If tteload doesn't get a non-NULL
2269  * page pointer it can't cache memory.
2270  */
2271 void
2272 hat_devload(struct hat *hat, caddr_t addr, size_t len, pfn_t pfn,
2273     uint_t attr, int flags)
2274 {
2275         tte_t tte;
2276         struct page *pp = NULL;
2277         int use_lgpg = 0;
2278 
2279         ASSERT(hat != NULL);
2280 
2281         ASSERT(!(flags & ~SFMMU_LOAD_ALLFLAG));
2282         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2283         ASSERT((hat == ksfmmup) || AS_LOCK_HELD(hat->sfmmu_as));
2284         if (len == 0)
2285                 panic("hat_devload: zero len");
2286         if (flags & ~SFMMU_LOAD_ALLFLAG)
2287                 cmn_err(CE_NOTE, "hat_devload: unsupported flags %d",
2288                     flags & ~SFMMU_LOAD_ALLFLAG);
2289 
2290 #if defined(SF_ERRATA_57)
2291         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2292             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2293             !(flags & HAT_LOAD_SHARE)) {
2294                 cmn_err(CE_WARN, "hat_devload: illegal attempt to make user "
2295                     " page executable");
2296                 attr &= ~PROT_EXEC;
2297         }
2298 #endif
2299 
2300         /*
2301          * If it's a memory page find its pp
2302          */
2303         if (!(flags & HAT_LOAD_NOCONSIST) && pf_is_memory(pfn)) {
2304                 pp = page_numtopp_nolock(pfn);
2305                 if (pp == NULL) {
2306                         flags |= HAT_LOAD_NOCONSIST;
2307                 } else {
2308                         if (PP_ISFREE(pp)) {
2309                                 panic("hat_memload: loading "
2310                                     "a mapping to free page %p",
2311                                     (void *)pp);
2312                         }
2313                         if (!PAGE_LOCKED(pp) && !PP_ISNORELOC(pp)) {
2314                                 panic("hat_memload: loading a mapping "
2315                                     "to unlocked relocatable page %p",
2316                                     (void *)pp);
2317                         }
2318                         ASSERT(len == MMU_PAGESIZE);
2319                 }
2320         }
2321 
2322         if (hat->sfmmu_rmstat)
2323                 hat_resvstat(len, hat->sfmmu_as, addr);
2324 
2325         if (flags & HAT_LOAD_NOCONSIST) {
2326                 attr |= SFMMU_UNCACHEVTTE;
2327                 use_lgpg = 1;
2328         }
2329         if (!pf_is_memory(pfn)) {
2330                 attr |= SFMMU_UNCACHEPTTE | HAT_NOSYNC;
2331                 use_lgpg = 1;
2332                 switch (attr & HAT_ORDER_MASK) {
2333                         case HAT_STRICTORDER:
2334                         case HAT_UNORDERED_OK:
2335                                 /*
2336                                  * we set the side effect bit for all non
2337                                  * memory mappings unless merging is ok
2338                                  */
2339                                 attr |= SFMMU_SIDEFFECT;
2340                                 break;
2341                         case HAT_MERGING_OK:
2342                         case HAT_LOADCACHING_OK:
2343                         case HAT_STORECACHING_OK:
2344                                 break;
2345                         default:
2346                                 panic("hat_devload: bad attr");
2347                                 break;
2348                 }
2349         }
2350         while (len) {
2351                 if (!use_lgpg) {
2352                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2353                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2354                             flags, SFMMU_INVALID_SHMERID);
2355                         len -= MMU_PAGESIZE;
2356                         addr += MMU_PAGESIZE;
2357                         pfn++;
2358                         continue;
2359                 }
2360                 /*
2361                  *  try to use large pages, check va/pa alignments
2362                  *  Note that 32M/256M page sizes are not (yet) supported.
2363                  */
2364                 if ((len >= MMU_PAGESIZE4M) &&
2365                     !((uintptr_t)addr & MMU_PAGEOFFSET4M) &&
2366                     !(disable_large_pages & (1 << TTE4M)) &&
2367                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET4M)) {
2368                         sfmmu_memtte(&tte, pfn, attr, TTE4M);
2369                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2370                             flags, SFMMU_INVALID_SHMERID);
2371                         len -= MMU_PAGESIZE4M;
2372                         addr += MMU_PAGESIZE4M;
2373                         pfn += MMU_PAGESIZE4M / MMU_PAGESIZE;
2374                 } else if ((len >= MMU_PAGESIZE512K) &&
2375                     !((uintptr_t)addr & MMU_PAGEOFFSET512K) &&
2376                     !(disable_large_pages & (1 << TTE512K)) &&
2377                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET512K)) {
2378                         sfmmu_memtte(&tte, pfn, attr, TTE512K);
2379                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2380                             flags, SFMMU_INVALID_SHMERID);
2381                         len -= MMU_PAGESIZE512K;
2382                         addr += MMU_PAGESIZE512K;
2383                         pfn += MMU_PAGESIZE512K / MMU_PAGESIZE;
2384                 } else if ((len >= MMU_PAGESIZE64K) &&
2385                     !((uintptr_t)addr & MMU_PAGEOFFSET64K) &&
2386                     !(disable_large_pages & (1 << TTE64K)) &&
2387                     !(mmu_ptob(pfn) & MMU_PAGEOFFSET64K)) {
2388                         sfmmu_memtte(&tte, pfn, attr, TTE64K);
2389                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2390                             flags, SFMMU_INVALID_SHMERID);
2391                         len -= MMU_PAGESIZE64K;
2392                         addr += MMU_PAGESIZE64K;
2393                         pfn += MMU_PAGESIZE64K / MMU_PAGESIZE;
2394                 } else {
2395                         sfmmu_memtte(&tte, pfn, attr, TTE8K);
2396                         (void) sfmmu_tteload_array(hat, &tte, addr, &pp,
2397                             flags, SFMMU_INVALID_SHMERID);
2398                         len -= MMU_PAGESIZE;
2399                         addr += MMU_PAGESIZE;
2400                         pfn++;
2401                 }
2402         }
2403 
2404         /*
2405          * Check TSB and TLB page sizes.
2406          */
2407         if ((flags & HAT_LOAD_SHARE) == 0) {
2408                 sfmmu_check_page_sizes(hat, 1);
2409         }
2410 }
2411 
2412 void
2413 hat_memload_array(struct hat *hat, caddr_t addr, size_t len,
2414     struct page **pps, uint_t attr, uint_t flags)
2415 {
2416         hat_do_memload_array(hat, addr, len, pps, attr, flags,
2417             SFMMU_INVALID_SHMERID);
2418 }
2419 
2420 void
2421 hat_memload_array_region(struct hat *hat, caddr_t addr, size_t len,
2422     struct page **pps, uint_t attr, uint_t flags,
2423     hat_region_cookie_t rcookie)
2424 {
2425         uint_t rid;
2426         if (rcookie == HAT_INVALID_REGION_COOKIE) {
2427                 hat_do_memload_array(hat, addr, len, pps, attr, flags,
2428                     SFMMU_INVALID_SHMERID);
2429                 return;
2430         }
2431         rid = (uint_t)((uint64_t)rcookie);
2432         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
2433         hat_do_memload_array(hat, addr, len, pps, attr, flags, rid);
2434 }
2435 
2436 /*
2437  * Map the largest extend possible out of the page array. The array may NOT
2438  * be in order.  The largest possible mapping a page can have
2439  * is specified in the p_szc field.  The p_szc field
2440  * cannot change as long as there any mappings (large or small)
2441  * to any of the pages that make up the large page. (ie. any
2442  * promotion/demotion of page size is not up to the hat but up to
2443  * the page free list manager).  The array
2444  * should consist of properly aligned contigous pages that are
2445  * part of a big page for a large mapping to be created.
2446  */
2447 static void
2448 hat_do_memload_array(struct hat *hat, caddr_t addr, size_t len,
2449     struct page **pps, uint_t attr, uint_t flags, uint_t rid)
2450 {
2451         int  ttesz;
2452         size_t mapsz;
2453         pgcnt_t numpg, npgs;
2454         tte_t tte;
2455         page_t *pp;
2456         uint_t large_pages_disable;
2457 
2458         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
2459         SFMMU_VALIDATE_HMERID(hat, rid, addr, len);
2460 
2461         if (hat->sfmmu_rmstat)
2462                 hat_resvstat(len, hat->sfmmu_as, addr);
2463 
2464 #if defined(SF_ERRATA_57)
2465         if ((hat != ksfmmup) && AS_TYPE_64BIT(hat->sfmmu_as) &&
2466             (addr < errata57_limit) && (attr & PROT_EXEC) &&
2467             !(flags & HAT_LOAD_SHARE)) {
2468                 cmn_err(CE_WARN, "hat_memload_array: illegal attempt to make "
2469                     "user page executable");
2470                 attr &= ~PROT_EXEC;
2471         }
2472 #endif
2473 
2474         /* Get number of pages */
2475         npgs = len >> MMU_PAGESHIFT;
2476 
2477         if (flags & HAT_LOAD_SHARE) {
2478                 large_pages_disable = disable_ism_large_pages;
2479         } else {
2480                 large_pages_disable = disable_large_pages;
2481         }
2482 
2483         if (npgs < NHMENTS || large_pages_disable == LARGE_PAGES_OFF) {
2484                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2485                     rid);
2486                 return;
2487         }
2488 
2489         while (npgs >= NHMENTS) {
2490                 pp = *pps;
2491                 for (ttesz = pp->p_szc; ttesz != TTE8K; ttesz--) {
2492                         /*
2493                          * Check if this page size is disabled.
2494                          */
2495                         if (large_pages_disable & (1 << ttesz))
2496                                 continue;
2497 
2498                         numpg = TTEPAGES(ttesz);
2499                         mapsz = numpg << MMU_PAGESHIFT;
2500                         if ((npgs >= numpg) &&
2501                             IS_P2ALIGNED(addr, mapsz) &&
2502                             IS_P2ALIGNED(pp->p_pagenum, numpg)) {
2503                                 /*
2504                                  * At this point we have enough pages and
2505                                  * we know the virtual address and the pfn
2506                                  * are properly aligned.  We still need
2507                                  * to check for physical contiguity but since
2508                                  * it is very likely that this is the case
2509                                  * we will assume they are so and undo
2510                                  * the request if necessary.  It would
2511                                  * be great if we could get a hint flag
2512                                  * like HAT_CONTIG which would tell us
2513                                  * the pages are contigous for sure.
2514                                  */
2515                                 sfmmu_memtte(&tte, (*pps)->p_pagenum,
2516                                     attr, ttesz);
2517                                 if (!sfmmu_tteload_array(hat, &tte, addr,
2518                                     pps, flags, rid)) {
2519                                         break;
2520                                 }
2521                         }
2522                 }
2523                 if (ttesz == TTE8K) {
2524                         /*
2525                          * We were not able to map array using a large page
2526                          * batch a hmeblk or fraction at a time.
2527                          */
2528                         numpg = ((uintptr_t)addr >> MMU_PAGESHIFT)
2529                             & (NHMENTS-1);
2530                         numpg = NHMENTS - numpg;
2531                         ASSERT(numpg <= npgs);
2532                         mapsz = numpg * MMU_PAGESIZE;
2533                         sfmmu_memload_batchsmall(hat, addr, pps, attr, flags,
2534                             numpg, rid);
2535                 }
2536                 addr += mapsz;
2537                 npgs -= numpg;
2538                 pps += numpg;
2539         }
2540 
2541         if (npgs) {
2542                 sfmmu_memload_batchsmall(hat, addr, pps, attr, flags, npgs,
2543                     rid);
2544         }
2545 
2546         /*
2547          * Check TSB and TLB page sizes.
2548          */
2549         if ((flags & HAT_LOAD_SHARE) == 0) {
2550                 sfmmu_check_page_sizes(hat, 1);
2551         }
2552 }
2553 
2554 /*
2555  * Function tries to batch 8K pages into the same hme blk.
2556  */
2557 static void
2558 sfmmu_memload_batchsmall(struct hat *hat, caddr_t vaddr, page_t **pps,
2559     uint_t attr, uint_t flags, pgcnt_t npgs, uint_t rid)
2560 {
2561         tte_t   tte;
2562         page_t *pp;
2563         struct hmehash_bucket *hmebp;
2564         struct hme_blk *hmeblkp;
2565         int     index;
2566 
2567         while (npgs) {
2568                 /*
2569                  * Acquire the hash bucket.
2570                  */
2571                 hmebp = sfmmu_tteload_acquire_hashbucket(hat, vaddr, TTE8K,
2572                     rid);
2573                 ASSERT(hmebp);
2574 
2575                 /*
2576                  * Find the hment block.
2577                  */
2578                 hmeblkp = sfmmu_tteload_find_hmeblk(hat, hmebp, vaddr,
2579                     TTE8K, flags, rid);
2580                 ASSERT(hmeblkp);
2581 
2582                 do {
2583                         /*
2584                          * Make the tte.
2585                          */
2586                         pp = *pps;
2587                         sfmmu_memtte(&tte, pp->p_pagenum, attr, TTE8K);
2588 
2589                         /*
2590                          * Add the translation.
2591                          */
2592                         (void) sfmmu_tteload_addentry(hat, hmeblkp, &tte,
2593                             vaddr, pps, flags, rid);
2594 
2595                         /*
2596                          * Goto next page.
2597                          */
2598                         pps++;
2599                         npgs--;
2600 
2601                         /*
2602                          * Goto next address.
2603                          */
2604                         vaddr += MMU_PAGESIZE;
2605 
2606                         /*
2607                          * Don't crossover into a different hmentblk.
2608                          */
2609                         index = (int)(((uintptr_t)vaddr >> MMU_PAGESHIFT) &
2610                             (NHMENTS-1));
2611 
2612                 } while (index != 0 && npgs != 0);
2613 
2614                 /*
2615                  * Release the hash bucket.
2616                  */
2617 
2618                 sfmmu_tteload_release_hashbucket(hmebp);
2619         }
2620 }
2621 
2622 /*
2623  * Construct a tte for a page:
2624  *
2625  * tte_valid = 1
2626  * tte_size2 = size & TTE_SZ2_BITS (Panther and Olympus-C only)
2627  * tte_size = size
2628  * tte_nfo = attr & HAT_NOFAULT
2629  * tte_ie = attr & HAT_STRUCTURE_LE
2630  * tte_hmenum = hmenum
2631  * tte_pahi = pp->p_pagenum >> TTE_PASHIFT;
2632  * tte_palo = pp->p_pagenum & TTE_PALOMASK;
2633  * tte_ref = 1 (optimization)
2634  * tte_wr_perm = attr & PROT_WRITE;
2635  * tte_no_sync = attr & HAT_NOSYNC
2636  * tte_lock = attr & SFMMU_LOCKTTE
2637  * tte_cp = !(attr & SFMMU_UNCACHEPTTE)
2638  * tte_cv = !(attr & SFMMU_UNCACHEVTTE)
2639  * tte_e = attr & SFMMU_SIDEFFECT
2640  * tte_priv = !(attr & PROT_USER)
2641  * tte_hwwr = if nosync is set and it is writable we set the mod bit (opt)
2642  * tte_glb = 0
2643  */
2644 void
2645 sfmmu_memtte(tte_t *ttep, pfn_t pfn, uint_t attr, int tte_sz)
2646 {
2647         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
2648 
2649         ttep->tte_inthi = MAKE_TTE_INTHI(pfn, attr, tte_sz, 0 /* hmenum */);
2650         ttep->tte_intlo = MAKE_TTE_INTLO(pfn, attr, tte_sz, 0 /* hmenum */);
2651 
2652         if (TTE_IS_NOSYNC(ttep)) {
2653                 TTE_SET_REF(ttep);
2654                 if (TTE_IS_WRITABLE(ttep)) {
2655                         TTE_SET_MOD(ttep);
2656                 }
2657         }
2658         if (TTE_IS_NFO(ttep) && TTE_IS_EXECUTABLE(ttep)) {
2659                 panic("sfmmu_memtte: can't set both NFO and EXEC bits");
2660         }
2661 }
2662 
2663 /*
2664  * This function will add a translation to the hme_blk and allocate the
2665  * hme_blk if one does not exist.
2666  * If a page structure is specified then it will add the
2667  * corresponding hment to the mapping list.
2668  * It will also update the hmenum field for the tte.
2669  *
2670  * Currently this function is only used for kernel mappings.
2671  * So pass invalid region to sfmmu_tteload_array().
2672  */
2673 void
2674 sfmmu_tteload(struct hat *sfmmup, tte_t *ttep, caddr_t vaddr, page_t *pp,
2675     uint_t flags)
2676 {
2677         ASSERT(sfmmup == ksfmmup);
2678         (void) sfmmu_tteload_array(sfmmup, ttep, vaddr, &pp, flags,
2679             SFMMU_INVALID_SHMERID);
2680 }
2681 
2682 /*
2683  * Load (ttep != NULL) or unload (ttep == NULL) one entry in the TSB.
2684  * Assumes that a particular page size may only be resident in one TSB.
2685  */
2686 static void
2687 sfmmu_mod_tsb(sfmmu_t *sfmmup, caddr_t vaddr, tte_t *ttep, int ttesz)
2688 {
2689         struct tsb_info *tsbinfop = NULL;
2690         uint64_t tag;
2691         struct tsbe *tsbe_addr;
2692         uint64_t tsb_base;
2693         uint_t tsb_size;
2694         int vpshift = MMU_PAGESHIFT;
2695         int phys = 0;
2696 
2697         if (sfmmup == ksfmmup) { /* No support for 32/256M ksfmmu pages */
2698                 phys = ktsb_phys;
2699                 if (ttesz >= TTE4M) {
2700 #ifndef sun4v
2701                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2702 #endif
2703                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2704                         tsb_size = ktsb4m_szcode;
2705                 } else {
2706                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2707                         tsb_size = ktsb_szcode;
2708                 }
2709         } else {
2710                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2711 
2712                 /*
2713                  * If there isn't a TSB for this page size, or the TSB is
2714                  * swapped out, there is nothing to do.  Note that the latter
2715                  * case seems impossible but can occur if hat_pageunload()
2716                  * is called on an ISM mapping while the process is swapped
2717                  * out.
2718                  */
2719                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2720                         return;
2721 
2722                 /*
2723                  * If another thread is in the middle of relocating a TSB
2724                  * we can't unload the entry so set a flag so that the
2725                  * TSB will be flushed before it can be accessed by the
2726                  * process.
2727                  */
2728                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2729                         if (ttep == NULL)
2730                                 tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2731                         return;
2732                 }
2733 #if defined(UTSB_PHYS)
2734                 phys = 1;
2735                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2736 #else
2737                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2738 #endif
2739                 tsb_size = tsbinfop->tsb_szc;
2740         }
2741         if (ttesz >= TTE4M)
2742                 vpshift = MMU_PAGESHIFT4M;
2743 
2744         tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2745         tag = sfmmu_make_tsbtag(vaddr);
2746 
2747         if (ttep == NULL) {
2748                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2749         } else {
2750                 if (ttesz >= TTE4M) {
2751                         SFMMU_STAT(sf_tsb_load4m);
2752                 } else {
2753                         SFMMU_STAT(sf_tsb_load8k);
2754                 }
2755 
2756                 sfmmu_load_tsbe(tsbe_addr, tag, ttep, phys);
2757         }
2758 }
2759 
2760 /*
2761  * Unmap all entries from [start, end) matching the given page size.
2762  *
2763  * This function is used primarily to unmap replicated 64K or 512K entries
2764  * from the TSB that are inserted using the base page size TSB pointer, but
2765  * it may also be called to unmap a range of addresses from the TSB.
2766  */
2767 void
2768 sfmmu_unload_tsb_range(sfmmu_t *sfmmup, caddr_t start, caddr_t end, int ttesz)
2769 {
2770         struct tsb_info *tsbinfop;
2771         uint64_t tag;
2772         struct tsbe *tsbe_addr;
2773         caddr_t vaddr;
2774         uint64_t tsb_base;
2775         int vpshift, vpgsz;
2776         uint_t tsb_size;
2777         int phys = 0;
2778 
2779         /*
2780          * Assumptions:
2781          *  If ttesz == 8K, 64K or 512K, we walk through the range 8K
2782          *  at a time shooting down any valid entries we encounter.
2783          *
2784          *  If ttesz >= 4M we walk the range 4M at a time shooting
2785          *  down any valid mappings we find.
2786          */
2787         if (sfmmup == ksfmmup) {
2788                 phys = ktsb_phys;
2789                 if (ttesz >= TTE4M) {
2790 #ifndef sun4v
2791                         ASSERT((ttesz != TTE32M) && (ttesz != TTE256M));
2792 #endif
2793                         tsb_base = (phys)? ktsb4m_pbase : (uint64_t)ktsb4m_base;
2794                         tsb_size = ktsb4m_szcode;
2795                 } else {
2796                         tsb_base = (phys)? ktsb_pbase : (uint64_t)ktsb_base;
2797                         tsb_size = ktsb_szcode;
2798                 }
2799         } else {
2800                 SFMMU_GET_TSBINFO(tsbinfop, sfmmup, ttesz);
2801 
2802                 /*
2803                  * If there isn't a TSB for this page size, or the TSB is
2804                  * swapped out, there is nothing to do.  Note that the latter
2805                  * case seems impossible but can occur if hat_pageunload()
2806                  * is called on an ISM mapping while the process is swapped
2807                  * out.
2808                  */
2809                 if (tsbinfop == NULL || (tsbinfop->tsb_flags & TSB_SWAPPED))
2810                         return;
2811 
2812                 /*
2813                  * If another thread is in the middle of relocating a TSB
2814                  * we can't unload the entry so set a flag so that the
2815                  * TSB will be flushed before it can be accessed by the
2816                  * process.
2817                  */
2818                 if ((tsbinfop->tsb_flags & TSB_RELOC_FLAG) != 0) {
2819                         tsbinfop->tsb_flags |= TSB_FLUSH_NEEDED;
2820                         return;
2821                 }
2822 #if defined(UTSB_PHYS)
2823                 phys = 1;
2824                 tsb_base = (uint64_t)tsbinfop->tsb_pa;
2825 #else
2826                 tsb_base = (uint64_t)tsbinfop->tsb_va;
2827 #endif
2828                 tsb_size = tsbinfop->tsb_szc;
2829         }
2830         if (ttesz >= TTE4M) {
2831                 vpshift = MMU_PAGESHIFT4M;
2832                 vpgsz = MMU_PAGESIZE4M;
2833         } else {
2834                 vpshift = MMU_PAGESHIFT;
2835                 vpgsz = MMU_PAGESIZE;
2836         }
2837 
2838         for (vaddr = start; vaddr < end; vaddr += vpgsz) {
2839                 tag = sfmmu_make_tsbtag(vaddr);
2840                 tsbe_addr = sfmmu_get_tsbe(tsb_base, vaddr, vpshift, tsb_size);
2841                 sfmmu_unload_tsbe(tsbe_addr, tag, phys);
2842         }
2843 }
2844 
2845 /*
2846  * Select the optimum TSB size given the number of mappings
2847  * that need to be cached.
2848  */
2849 static int
2850 sfmmu_select_tsb_szc(pgcnt_t pgcnt)
2851 {
2852         int szc = 0;
2853 
2854 #ifdef DEBUG
2855         if (tsb_grow_stress) {
2856                 uint32_t randval = (uint32_t)gettick() >> 4;
2857                 return (randval % (tsb_max_growsize + 1));
2858         }
2859 #endif  /* DEBUG */
2860 
2861         while ((szc < tsb_max_growsize) && (pgcnt > SFMMU_RSS_TSBSIZE(szc)))
2862                 szc++;
2863         return (szc);
2864 }
2865 
2866 /*
2867  * This function will add a translation to the hme_blk and allocate the
2868  * hme_blk if one does not exist.
2869  * If a page structure is specified then it will add the
2870  * corresponding hment to the mapping list.
2871  * It will also update the hmenum field for the tte.
2872  * Furthermore, it attempts to create a large page translation
2873  * for <addr,hat> at page array pps.  It assumes addr and first
2874  * pp is correctly aligned.  It returns 0 if successful and 1 otherwise.
2875  */
2876 static int
2877 sfmmu_tteload_array(sfmmu_t *sfmmup, tte_t *ttep, caddr_t vaddr,
2878     page_t **pps, uint_t flags, uint_t rid)
2879 {
2880         struct hmehash_bucket *hmebp;
2881         struct hme_blk *hmeblkp;
2882         int     ret;
2883         uint_t  size;
2884 
2885         /*
2886          * Get mapping size.
2887          */
2888         size = TTE_CSZ(ttep);
2889         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
2890 
2891         /*
2892          * Acquire the hash bucket.
2893          */
2894         hmebp = sfmmu_tteload_acquire_hashbucket(sfmmup, vaddr, size, rid);
2895         ASSERT(hmebp);
2896 
2897         /*
2898          * Find the hment block.
2899          */
2900         hmeblkp = sfmmu_tteload_find_hmeblk(sfmmup, hmebp, vaddr, size, flags,
2901             rid);
2902         ASSERT(hmeblkp);
2903 
2904         /*
2905          * Add the translation.
2906          */
2907         ret = sfmmu_tteload_addentry(sfmmup, hmeblkp, ttep, vaddr, pps, flags,
2908             rid);
2909 
2910         /*
2911          * Release the hash bucket.
2912          */
2913         sfmmu_tteload_release_hashbucket(hmebp);
2914 
2915         return (ret);
2916 }
2917 
2918 /*
2919  * Function locks and returns a pointer to the hash bucket for vaddr and size.
2920  */
2921 static struct hmehash_bucket *
2922 sfmmu_tteload_acquire_hashbucket(sfmmu_t *sfmmup, caddr_t vaddr, int size,
2923     uint_t rid)
2924 {
2925         struct hmehash_bucket *hmebp;
2926         int hmeshift;
2927         void *htagid = sfmmutohtagid(sfmmup, rid);
2928 
2929         ASSERT(htagid != NULL);
2930 
2931         hmeshift = HME_HASH_SHIFT(size);
2932 
2933         hmebp = HME_HASH_FUNCTION(htagid, vaddr, hmeshift);
2934 
2935         SFMMU_HASH_LOCK(hmebp);
2936 
2937         return (hmebp);
2938 }
2939 
2940 /*
2941  * Function returns a pointer to an hmeblk in the hash bucket, hmebp. If the
2942  * hmeblk doesn't exists for the [sfmmup, vaddr & size] signature, a hmeblk is
2943  * allocated.
2944  */
2945 static struct hme_blk *
2946 sfmmu_tteload_find_hmeblk(sfmmu_t *sfmmup, struct hmehash_bucket *hmebp,
2947     caddr_t vaddr, uint_t size, uint_t flags, uint_t rid)
2948 {
2949         hmeblk_tag hblktag;
2950         int hmeshift;
2951         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
2952 
2953         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
2954 
2955         hblktag.htag_id = sfmmutohtagid(sfmmup, rid);
2956         ASSERT(hblktag.htag_id != NULL);
2957         hmeshift = HME_HASH_SHIFT(size);
2958         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
2959         hblktag.htag_rehash = HME_HASH_REHASH(size);
2960         hblktag.htag_rid = rid;
2961 
2962 ttearray_realloc:
2963 
2964         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
2965 
2966         /*
2967          * We block until hblk_reserve_lock is released; it's held by
2968          * the thread, temporarily using hblk_reserve, until hblk_reserve is
2969          * replaced by a hblk from sfmmu8_cache.
2970          */
2971         if (hmeblkp == (struct hme_blk *)hblk_reserve &&
2972             hblk_reserve_thread != curthread) {
2973                 SFMMU_HASH_UNLOCK(hmebp);
2974                 mutex_enter(&hblk_reserve_lock);
2975                 mutex_exit(&hblk_reserve_lock);
2976                 SFMMU_STAT(sf_hblk_reserve_hit);
2977                 SFMMU_HASH_LOCK(hmebp);
2978                 goto ttearray_realloc;
2979         }
2980 
2981         if (hmeblkp == NULL) {
2982                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
2983                     hblktag, flags, rid);
2984                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
2985                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
2986         } else {
2987                 /*
2988                  * It is possible for 8k and 64k hblks to collide since they
2989                  * have the same rehash value. This is because we
2990                  * lazily free hblks and 8K/64K blks could be lingering.
2991                  * If we find size mismatch we free the block and & try again.
2992                  */
2993                 if (get_hblk_ttesz(hmeblkp) != size) {
2994                         ASSERT(!hmeblkp->hblk_vcnt);
2995                         ASSERT(!hmeblkp->hblk_hmecnt);
2996                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
2997                             &list, 0);
2998                         goto ttearray_realloc;
2999                 }
3000                 if (hmeblkp->hblk_shw_bit) {
3001                         /*
3002                          * if the hblk was previously used as a shadow hblk then
3003                          * we will change it to a normal hblk
3004                          */
3005                         ASSERT(!hmeblkp->hblk_shared);
3006                         if (hmeblkp->hblk_shw_mask) {
3007                                 sfmmu_shadow_hcleanup(sfmmup, hmeblkp, hmebp);
3008                                 ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3009                                 goto ttearray_realloc;
3010                         } else {
3011                                 hmeblkp->hblk_shw_bit = 0;
3012                         }
3013                 }
3014                 SFMMU_STAT(sf_hblk_hit);
3015         }
3016 
3017         /*
3018          * hat_memload() should never call kmem_cache_free() for kernel hmeblks;
3019          * see block comment showing the stacktrace in sfmmu_hblk_alloc();
3020          * set the flag parameter to 1 so that sfmmu_hblks_list_purge() will
3021          * just add these hmeblks to the per-cpu pending queue.
3022          */
3023         sfmmu_hblks_list_purge(&list, 1);
3024 
3025         ASSERT(get_hblk_ttesz(hmeblkp) == size);
3026         ASSERT(!hmeblkp->hblk_shw_bit);
3027         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3028         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3029         ASSERT(hmeblkp->hblk_tag.htag_rid == rid);
3030 
3031         return (hmeblkp);
3032 }
3033 
3034 /*
3035  * Function adds a tte entry into the hmeblk. It returns 0 if successful and 1
3036  * otherwise.
3037  */
3038 static int
3039 sfmmu_tteload_addentry(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, tte_t *ttep,
3040     caddr_t vaddr, page_t **pps, uint_t flags, uint_t rid)
3041 {
3042         page_t *pp = *pps;
3043         int hmenum, size, remap;
3044         tte_t tteold, flush_tte;
3045 #ifdef DEBUG
3046         tte_t orig_old;
3047 #endif /* DEBUG */
3048         struct sf_hment *sfhme;
3049         kmutex_t *pml, *pmtx;
3050         hatlock_t *hatlockp;
3051         int myflt;
3052 
3053         /*
3054          * remove this panic when we decide to let user virtual address
3055          * space be >= USERLIMIT.
3056          */
3057         if (!TTE_IS_PRIVILEGED(ttep) && vaddr >= (caddr_t)USERLIMIT)
3058                 panic("user addr %p in kernel space", (void *)vaddr);
3059 #if defined(TTE_IS_GLOBAL)
3060         if (TTE_IS_GLOBAL(ttep))
3061                 panic("sfmmu_tteload: creating global tte");
3062 #endif
3063 
3064 #ifdef DEBUG
3065         if (pf_is_memory(sfmmu_ttetopfn(ttep, vaddr)) &&
3066             !TTE_IS_PCACHEABLE(ttep) && !sfmmu_allow_nc_trans)
3067                 panic("sfmmu_tteload: non cacheable memory tte");
3068 #endif /* DEBUG */
3069 
3070         /* don't simulate dirty bit for writeable ISM/DISM mappings */
3071         if ((flags & HAT_LOAD_SHARE) && TTE_IS_WRITABLE(ttep)) {
3072                 TTE_SET_REF(ttep);
3073                 TTE_SET_MOD(ttep);
3074         }
3075 
3076         if ((flags & HAT_LOAD_SHARE) || !TTE_IS_REF(ttep) ||
3077             !TTE_IS_MOD(ttep)) {
3078                 /*
3079                  * Don't load TSB for dummy as in ISM.  Also don't preload
3080                  * the TSB if the TTE isn't writable since we're likely to
3081                  * fault on it again -- preloading can be fairly expensive.
3082                  */
3083                 flags |= SFMMU_NO_TSBLOAD;
3084         }
3085 
3086         size = TTE_CSZ(ttep);
3087         switch (size) {
3088         case TTE8K:
3089                 SFMMU_STAT(sf_tteload8k);
3090                 break;
3091         case TTE64K:
3092                 SFMMU_STAT(sf_tteload64k);
3093                 break;
3094         case TTE512K:
3095                 SFMMU_STAT(sf_tteload512k);
3096                 break;
3097         case TTE4M:
3098                 SFMMU_STAT(sf_tteload4m);
3099                 break;
3100         case (TTE32M):
3101                 SFMMU_STAT(sf_tteload32m);
3102                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3103                 break;
3104         case (TTE256M):
3105                 SFMMU_STAT(sf_tteload256m);
3106                 ASSERT(mmu_page_sizes == max_mmu_page_sizes);
3107                 break;
3108         }
3109 
3110         ASSERT(!((uintptr_t)vaddr & TTE_PAGE_OFFSET(size)));
3111         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
3112         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) || hmeblkp->hblk_shared);
3113         ASSERT(SFMMU_IS_SHMERID_VALID(rid) || !hmeblkp->hblk_shared);
3114 
3115         HBLKTOHME_IDX(sfhme, hmeblkp, vaddr, hmenum);
3116 
3117         /*
3118          * Need to grab mlist lock here so that pageunload
3119          * will not change tte behind us.
3120          */
3121         if (pp) {
3122                 pml = sfmmu_mlist_enter(pp);
3123         }
3124 
3125         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3126         /*
3127          * Look for corresponding hment and if valid verify
3128          * pfns are equal.
3129          */
3130         remap = TTE_IS_VALID(&tteold);
3131         if (remap) {
3132                 pfn_t   new_pfn, old_pfn;
3133 
3134                 old_pfn = TTE_TO_PFN(vaddr, &tteold);
3135                 new_pfn = TTE_TO_PFN(vaddr, ttep);
3136 
3137                 if (flags & HAT_LOAD_REMAP) {
3138                         /* make sure we are remapping same type of pages */
3139                         if (pf_is_memory(old_pfn) != pf_is_memory(new_pfn)) {
3140                                 panic("sfmmu_tteload - tte remap io<->memory");
3141                         }
3142                         if (old_pfn != new_pfn &&
3143                             (pp != NULL || sfhme->hme_page != NULL)) {
3144                                 panic("sfmmu_tteload - tte remap pp != NULL");
3145                         }
3146                 } else if (old_pfn != new_pfn) {
3147                         panic("sfmmu_tteload - tte remap, hmeblkp 0x%p",
3148                             (void *)hmeblkp);
3149                 }
3150                 ASSERT(TTE_CSZ(&tteold) == TTE_CSZ(ttep));
3151         }
3152 
3153         if (pp) {
3154                 if (size == TTE8K) {
3155 #ifdef VAC
3156                         /*
3157                          * Handle VAC consistency
3158                          */
3159                         if (!remap && (cache & CACHE_VAC) && !PP_ISNC(pp)) {
3160                                 sfmmu_vac_conflict(sfmmup, vaddr, pp);
3161                         }
3162 #endif
3163 
3164                         if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3165                                 pmtx = sfmmu_page_enter(pp);
3166                                 PP_CLRRO(pp);
3167                                 sfmmu_page_exit(pmtx);
3168                         } else if (!PP_ISMAPPED(pp) &&
3169                             (!TTE_IS_WRITABLE(ttep)) && !(PP_ISMOD(pp))) {
3170                                 pmtx = sfmmu_page_enter(pp);
3171                                 if (!(PP_ISMOD(pp))) {
3172                                         PP_SETRO(pp);
3173                                 }
3174                                 sfmmu_page_exit(pmtx);
3175                         }
3176 
3177                 } else if (sfmmu_pagearray_setup(vaddr, pps, ttep, remap)) {
3178                         /*
3179                          * sfmmu_pagearray_setup failed so return
3180                          */
3181                         sfmmu_mlist_exit(pml);
3182                         return (1);
3183                 }
3184         }
3185 
3186         /*
3187          * Make sure hment is not on a mapping list.
3188          */
3189         ASSERT(remap || (sfhme->hme_page == NULL));
3190 
3191         /* if it is not a remap then hme->next better be NULL */
3192         ASSERT((!remap) ? sfhme->hme_next == NULL : 1);
3193 
3194         if (flags & HAT_LOAD_LOCK) {
3195                 if ((hmeblkp->hblk_lckcnt + 1) >= MAX_HBLK_LCKCNT) {
3196                         panic("too high lckcnt-hmeblk %p",
3197                             (void *)hmeblkp);
3198                 }
3199                 atomic_inc_32(&hmeblkp->hblk_lckcnt);
3200 
3201                 HBLK_STACK_TRACE(hmeblkp, HBLK_LOCK);
3202         }
3203 
3204 #ifdef VAC
3205         if (pp && PP_ISNC(pp)) {
3206                 /*
3207                  * If the physical page is marked to be uncacheable, like
3208                  * by a vac conflict, make sure the new mapping is also
3209                  * uncacheable.
3210                  */
3211                 TTE_CLR_VCACHEABLE(ttep);
3212                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
3213         }
3214 #endif
3215         ttep->tte_hmenum = hmenum;
3216 
3217 #ifdef DEBUG
3218         orig_old = tteold;
3219 #endif /* DEBUG */
3220 
3221         while (sfmmu_modifytte_try(&tteold, ttep, &sfhme->hme_tte) < 0) {
3222                 if ((sfmmup == KHATID) &&
3223                     (flags & (HAT_LOAD_LOCK | HAT_LOAD_REMAP))) {
3224                         sfmmu_copytte(&sfhme->hme_tte, &tteold);
3225                 }
3226 #ifdef DEBUG
3227                 chk_tte(&orig_old, &tteold, ttep, hmeblkp);
3228 #endif /* DEBUG */
3229         }
3230         ASSERT(TTE_IS_VALID(&sfhme->hme_tte));
3231 
3232         if (!TTE_IS_VALID(&tteold)) {
3233 
3234                 atomic_inc_16(&hmeblkp->hblk_vcnt);
3235                 if (rid == SFMMU_INVALID_SHMERID) {
3236                         atomic_inc_ulong(&sfmmup->sfmmu_ttecnt[size]);
3237                 } else {
3238                         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
3239                         sf_region_t *rgnp = srdp->srd_hmergnp[rid];
3240                         /*
3241                          * We already accounted for region ttecnt's in sfmmu
3242                          * during hat_join_region() processing. Here we
3243                          * only update ttecnt's in region struture.
3244                          */
3245                         atomic_inc_ulong(&rgnp->rgn_ttecnt[size]);
3246                 }
3247         }
3248 
3249         myflt = (astosfmmu(curthread->t_procp->p_as) == sfmmup);
3250         if (size > TTE8K && (flags & HAT_LOAD_SHARE) == 0 &&
3251             sfmmup != ksfmmup) {
3252                 uchar_t tteflag = 1 << size;
3253                 if (rid == SFMMU_INVALID_SHMERID) {
3254                         if (!(sfmmup->sfmmu_tteflags & tteflag)) {
3255                                 hatlockp = sfmmu_hat_enter(sfmmup);
3256                                 sfmmup->sfmmu_tteflags |= tteflag;
3257                                 sfmmu_hat_exit(hatlockp);
3258                         }
3259                 } else if (!(sfmmup->sfmmu_rtteflags & tteflag)) {
3260                         hatlockp = sfmmu_hat_enter(sfmmup);
3261                         sfmmup->sfmmu_rtteflags |= tteflag;
3262                         sfmmu_hat_exit(hatlockp);
3263                 }
3264                 /*
3265                  * Update the current CPU tsbmiss area, so the current thread
3266                  * won't need to take the tsbmiss for the new pagesize.
3267                  * The other threads in the process will update their tsb
3268                  * miss area lazily in sfmmu_tsbmiss_exception() when they
3269                  * fail to find the translation for a newly added pagesize.
3270                  */
3271                 if (size > TTE64K && myflt) {
3272                         struct tsbmiss *tsbmp;
3273                         kpreempt_disable();
3274                         tsbmp = &tsbmiss_area[CPU->cpu_id];
3275                         if (rid == SFMMU_INVALID_SHMERID) {
3276                                 if (!(tsbmp->uhat_tteflags & tteflag)) {
3277                                         tsbmp->uhat_tteflags |= tteflag;
3278                                 }
3279                         } else {
3280                                 if (!(tsbmp->uhat_rtteflags & tteflag)) {
3281                                         tsbmp->uhat_rtteflags |= tteflag;
3282                                 }
3283                         }
3284                         kpreempt_enable();
3285                 }
3286         }
3287 
3288         if (size >= TTE4M && (flags & HAT_LOAD_TEXT) &&
3289             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
3290                 hatlockp = sfmmu_hat_enter(sfmmup);
3291                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
3292                 sfmmu_hat_exit(hatlockp);
3293         }
3294 
3295         flush_tte.tte_intlo = (tteold.tte_intlo ^ ttep->tte_intlo) &
3296             hw_tte.tte_intlo;
3297         flush_tte.tte_inthi = (tteold.tte_inthi ^ ttep->tte_inthi) &
3298             hw_tte.tte_inthi;
3299 
3300         if (remap && (flush_tte.tte_inthi || flush_tte.tte_intlo)) {
3301                 /*
3302                  * If remap and new tte differs from old tte we need
3303                  * to sync the mod bit and flush TLB/TSB.  We don't
3304                  * need to sync ref bit because we currently always set
3305                  * ref bit in tteload.
3306                  */
3307                 ASSERT(TTE_IS_REF(ttep));
3308                 if (TTE_IS_MOD(&tteold)) {
3309                         sfmmu_ttesync(sfmmup, vaddr, &tteold, pp);
3310                 }
3311                 /*
3312                  * hwtte bits shouldn't change for SRD hmeblks as long as SRD
3313                  * hmes are only used for read only text. Adding this code for
3314                  * completeness and future use of shared hmeblks with writable
3315                  * mappings of VMODSORT vnodes.
3316                  */
3317                 if (hmeblkp->hblk_shared) {
3318                         cpuset_t cpuset = sfmmu_rgntlb_demap(vaddr,
3319                             sfmmup->sfmmu_srdp->srd_hmergnp[rid], hmeblkp, 1);
3320                         xt_sync(cpuset);
3321                         SFMMU_STAT_ADD(sf_region_remap_demap, 1);
3322                 } else {
3323                         sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 0);
3324                         xt_sync(sfmmup->sfmmu_cpusran);
3325                 }
3326         }
3327 
3328         if ((flags & SFMMU_NO_TSBLOAD) == 0) {
3329                 /*
3330                  * We only preload 8K and 4M mappings into the TSB, since
3331                  * 64K and 512K mappings are replicated and hence don't
3332                  * have a single, unique TSB entry. Ditto for 32M/256M.
3333                  */
3334                 if (size == TTE8K || size == TTE4M) {
3335                         sf_scd_t *scdp;
3336                         hatlockp = sfmmu_hat_enter(sfmmup);
3337                         /*
3338                          * Don't preload private TSB if the mapping is used
3339                          * by the shctx in the SCD.
3340                          */
3341                         scdp = sfmmup->sfmmu_scdp;
3342                         if (rid == SFMMU_INVALID_SHMERID || scdp == NULL ||
3343                             !SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
3344                                 sfmmu_load_tsb(sfmmup, vaddr, &sfhme->hme_tte,
3345                                     size);
3346                         }
3347                         sfmmu_hat_exit(hatlockp);
3348                 }
3349         }
3350         if (pp) {
3351                 if (!remap) {
3352                         HME_ADD(sfhme, pp);
3353                         atomic_inc_16(&hmeblkp->hblk_hmecnt);
3354                         ASSERT(hmeblkp->hblk_hmecnt > 0);
3355 
3356                         /*
3357                          * Cannot ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
3358                          * see pageunload() for comment.
3359                          */
3360                 }
3361                 sfmmu_mlist_exit(pml);
3362         }
3363 
3364         return (0);
3365 }
3366 /*
3367  * Function unlocks hash bucket.
3368  */
3369 static void
3370 sfmmu_tteload_release_hashbucket(struct hmehash_bucket *hmebp)
3371 {
3372         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3373         SFMMU_HASH_UNLOCK(hmebp);
3374 }
3375 
3376 /*
3377  * function which checks and sets up page array for a large
3378  * translation.  Will set p_vcolor, p_index, p_ro fields.
3379  * Assumes addr and pfnum of first page are properly aligned.
3380  * Will check for physical contiguity. If check fails it return
3381  * non null.
3382  */
3383 static int
3384 sfmmu_pagearray_setup(caddr_t addr, page_t **pps, tte_t *ttep, int remap)
3385 {
3386         int     i, index, ttesz;
3387         pfn_t   pfnum;
3388         pgcnt_t npgs;
3389         page_t *pp, *pp1;
3390         kmutex_t *pmtx;
3391 #ifdef VAC
3392         int osz;
3393         int cflags = 0;
3394         int vac_err = 0;
3395 #endif
3396         int newidx = 0;
3397 
3398         ttesz = TTE_CSZ(ttep);
3399 
3400         ASSERT(ttesz > TTE8K);
3401 
3402         npgs = TTEPAGES(ttesz);
3403         index = PAGESZ_TO_INDEX(ttesz);
3404 
3405         pfnum = (*pps)->p_pagenum;
3406         ASSERT(IS_P2ALIGNED(pfnum, npgs));
3407 
3408         /*
3409          * Save the first pp so we can do HAT_TMPNC at the end.
3410          */
3411         pp1 = *pps;
3412 #ifdef VAC
3413         osz = fnd_mapping_sz(pp1);
3414 #endif
3415 
3416         for (i = 0; i < npgs; i++, pps++) {
3417                 pp = *pps;
3418                 ASSERT(PAGE_LOCKED(pp));
3419                 ASSERT(pp->p_szc >= ttesz);
3420                 ASSERT(pp->p_szc == pp1->p_szc);
3421                 ASSERT(sfmmu_mlist_held(pp));
3422 
3423                 /*
3424                  * XXX is it possible to maintain P_RO on the root only?
3425                  */
3426                 if (TTE_IS_WRITABLE(ttep) && PP_ISRO(pp)) {
3427                         pmtx = sfmmu_page_enter(pp);
3428                         PP_CLRRO(pp);
3429                         sfmmu_page_exit(pmtx);
3430                 } else if (!PP_ISMAPPED(pp) && !TTE_IS_WRITABLE(ttep) &&
3431                     !PP_ISMOD(pp)) {
3432                         pmtx = sfmmu_page_enter(pp);
3433                         if (!(PP_ISMOD(pp))) {
3434                                 PP_SETRO(pp);
3435                         }
3436                         sfmmu_page_exit(pmtx);
3437                 }
3438 
3439                 /*
3440                  * If this is a remap we skip vac & contiguity checks.
3441                  */
3442                 if (remap)
3443                         continue;
3444 
3445                 /*
3446                  * set p_vcolor and detect any vac conflicts.
3447                  */
3448 #ifdef VAC
3449                 if (vac_err == 0) {
3450                         vac_err = sfmmu_vacconflict_array(addr, pp, &cflags);
3451 
3452                 }
3453 #endif
3454 
3455                 /*
3456                  * Save current index in case we need to undo it.
3457                  * Note: "PAGESZ_TO_INDEX(sz)   (1 << (sz))"
3458                  *      "SFMMU_INDEX_SHIFT      6"
3459                  *       "SFMMU_INDEX_MASK      ((1 << SFMMU_INDEX_SHIFT) - 1)"
3460                  *       "PP_MAPINDEX(p_index)  (p_index & SFMMU_INDEX_MASK)"
3461                  *
3462                  * So:  index = PAGESZ_TO_INDEX(ttesz);
3463                  *      if ttesz == 1 then index = 0x2
3464                  *                  2 then index = 0x4
3465                  *                  3 then index = 0x8
3466                  *                  4 then index = 0x10
3467                  *                  5 then index = 0x20
3468                  * The code below checks if it's a new pagesize (ie, newidx)
3469                  * in case we need to take it back out of p_index,
3470                  * and then or's the new index into the existing index.
3471                  */
3472                 if ((PP_MAPINDEX(pp) & index) == 0)
3473                         newidx = 1;
3474                 pp->p_index = (PP_MAPINDEX(pp) | index);
3475 
3476                 /*
3477                  * contiguity check
3478                  */
3479                 if (pp->p_pagenum != pfnum) {
3480                         /*
3481                          * If we fail the contiguity test then
3482                          * the only thing we need to fix is the p_index field.
3483                          * We might get a few extra flushes but since this
3484                          * path is rare that is ok.  The p_ro field will
3485                          * get automatically fixed on the next tteload to
3486                          * the page.  NO TNC bit is set yet.
3487                          */
3488                         while (i >= 0) {
3489                                 pp = *pps;
3490                                 if (newidx)
3491                                         pp->p_index = (PP_MAPINDEX(pp) &
3492                                             ~index);
3493                                 pps--;
3494                                 i--;
3495                         }
3496                         return (1);
3497                 }
3498                 pfnum++;
3499                 addr += MMU_PAGESIZE;
3500         }
3501 
3502 #ifdef VAC
3503         if (vac_err) {
3504                 if (ttesz > osz) {
3505                         /*
3506                          * There are some smaller mappings that causes vac
3507                          * conflicts. Convert all existing small mappings to
3508                          * TNC.
3509                          */
3510                         SFMMU_STAT_ADD(sf_uncache_conflict, npgs);
3511                         sfmmu_page_cache_array(pp1, HAT_TMPNC, CACHE_FLUSH,
3512                             npgs);
3513                 } else {
3514                         /* EMPTY */
3515                         /*
3516                          * If there exists an big page mapping,
3517                          * that means the whole existing big page
3518                          * has TNC setting already. No need to covert to
3519                          * TNC again.
3520                          */
3521                         ASSERT(PP_ISTNC(pp1));
3522                 }
3523         }
3524 #endif  /* VAC */
3525 
3526         return (0);
3527 }
3528 
3529 #ifdef VAC
3530 /*
3531  * Routine that detects vac consistency for a large page. It also
3532  * sets virtual color for all pp's for this big mapping.
3533  */
3534 static int
3535 sfmmu_vacconflict_array(caddr_t addr, page_t *pp, int *cflags)
3536 {
3537         int vcolor, ocolor;
3538 
3539         ASSERT(sfmmu_mlist_held(pp));
3540 
3541         if (PP_ISNC(pp)) {
3542                 return (HAT_TMPNC);
3543         }
3544 
3545         vcolor = addr_to_vcolor(addr);
3546         if (PP_NEWPAGE(pp)) {
3547                 PP_SET_VCOLOR(pp, vcolor);
3548                 return (0);
3549         }
3550 
3551         ocolor = PP_GET_VCOLOR(pp);
3552         if (ocolor == vcolor) {
3553                 return (0);
3554         }
3555 
3556         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
3557                 /*
3558                  * Previous user of page had a differnet color
3559                  * but since there are no current users
3560                  * we just flush the cache and change the color.
3561                  * As an optimization for large pages we flush the
3562                  * entire cache of that color and set a flag.
3563                  */
3564                 SFMMU_STAT(sf_pgcolor_conflict);
3565                 if (!CacheColor_IsFlushed(*cflags, ocolor)) {
3566                         CacheColor_SetFlushed(*cflags, ocolor);
3567                         sfmmu_cache_flushcolor(ocolor, pp->p_pagenum);
3568                 }
3569                 PP_SET_VCOLOR(pp, vcolor);
3570                 return (0);
3571         }
3572 
3573         /*
3574          * We got a real conflict with a current mapping.
3575          * set flags to start unencaching all mappings
3576          * and return failure so we restart looping
3577          * the pp array from the beginning.
3578          */
3579         return (HAT_TMPNC);
3580 }
3581 #endif  /* VAC */
3582 
3583 /*
3584  * creates a large page shadow hmeblk for a tte.
3585  * The purpose of this routine is to allow us to do quick unloads because
3586  * the vm layer can easily pass a very large but sparsely populated range.
3587  */
3588 static struct hme_blk *
3589 sfmmu_shadow_hcreate(sfmmu_t *sfmmup, caddr_t vaddr, int ttesz, uint_t flags)
3590 {
3591         struct hmehash_bucket *hmebp;
3592         hmeblk_tag hblktag;
3593         int hmeshift, size, vshift;
3594         uint_t shw_mask, newshw_mask;
3595         struct hme_blk *hmeblkp;
3596 
3597         ASSERT(sfmmup != KHATID);
3598         if (mmu_page_sizes == max_mmu_page_sizes) {
3599                 ASSERT(ttesz < TTE256M);
3600         } else {
3601                 ASSERT(ttesz < TTE4M);
3602                 ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
3603                 ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
3604         }
3605 
3606         if (ttesz == TTE8K) {
3607                 size = TTE512K;
3608         } else {
3609                 size = ++ttesz;
3610         }
3611 
3612         hblktag.htag_id = sfmmup;
3613         hmeshift = HME_HASH_SHIFT(size);
3614         hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
3615         hblktag.htag_rehash = HME_HASH_REHASH(size);
3616         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3617         hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
3618 
3619         SFMMU_HASH_LOCK(hmebp);
3620 
3621         HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
3622         ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
3623         if (hmeblkp == NULL) {
3624                 hmeblkp = sfmmu_hblk_alloc(sfmmup, vaddr, hmebp, size,
3625                     hblktag, flags, SFMMU_INVALID_SHMERID);
3626         }
3627         ASSERT(hmeblkp);
3628         if (!hmeblkp->hblk_shw_mask) {
3629                 /*
3630                  * if this is a unused hblk it was just allocated or could
3631                  * potentially be a previous large page hblk so we need to
3632                  * set the shadow bit.
3633                  */
3634                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3635                 hmeblkp->hblk_shw_bit = 1;
3636         } else if (hmeblkp->hblk_shw_bit == 0) {
3637                 panic("sfmmu_shadow_hcreate: shw bit not set in hmeblkp 0x%p",
3638                     (void *)hmeblkp);
3639         }
3640         ASSERT(hmeblkp->hblk_shw_bit == 1);
3641         ASSERT(!hmeblkp->hblk_shared);
3642         vshift = vaddr_to_vshift(hblktag, vaddr, size);
3643         ASSERT(vshift < 8);
3644         /*
3645          * Atomically set shw mask bit
3646          */
3647         do {
3648                 shw_mask = hmeblkp->hblk_shw_mask;
3649                 newshw_mask = shw_mask | (1 << vshift);
3650                 newshw_mask = atomic_cas_32(&hmeblkp->hblk_shw_mask, shw_mask,
3651                     newshw_mask);
3652         } while (newshw_mask != shw_mask);
3653 
3654         SFMMU_HASH_UNLOCK(hmebp);
3655 
3656         return (hmeblkp);
3657 }
3658 
3659 /*
3660  * This routine cleanup a previous shadow hmeblk and changes it to
3661  * a regular hblk.  This happens rarely but it is possible
3662  * when a process wants to use large pages and there are hblks still
3663  * lying around from the previous as that used these hmeblks.
3664  * The alternative was to cleanup the shadow hblks at unload time
3665  * but since so few user processes actually use large pages, it is
3666  * better to be lazy and cleanup at this time.
3667  */
3668 static void
3669 sfmmu_shadow_hcleanup(sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
3670     struct hmehash_bucket *hmebp)
3671 {
3672         caddr_t addr, endaddr;
3673         int hashno, size;
3674 
3675         ASSERT(hmeblkp->hblk_shw_bit);
3676         ASSERT(!hmeblkp->hblk_shared);
3677 
3678         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
3679 
3680         if (!hmeblkp->hblk_shw_mask) {
3681                 hmeblkp->hblk_shw_bit = 0;
3682                 return;
3683         }
3684         addr = (caddr_t)get_hblk_base(hmeblkp);
3685         endaddr = get_hblk_endaddr(hmeblkp);
3686         size = get_hblk_ttesz(hmeblkp);
3687         hashno = size - 1;
3688         ASSERT(hashno > 0);
3689         SFMMU_HASH_UNLOCK(hmebp);
3690 
3691         sfmmu_free_hblks(sfmmup, addr, endaddr, hashno);
3692 
3693         SFMMU_HASH_LOCK(hmebp);
3694 }
3695 
3696 static void
3697 sfmmu_free_hblks(sfmmu_t *sfmmup, caddr_t addr, caddr_t endaddr,
3698     int hashno)
3699 {
3700         int hmeshift, shadow = 0;
3701         hmeblk_tag hblktag;
3702         struct hmehash_bucket *hmebp;
3703         struct hme_blk *hmeblkp;
3704         struct hme_blk *nx_hblk, *pr_hblk, *list = NULL;
3705 
3706         ASSERT(hashno > 0);
3707         hblktag.htag_id = sfmmup;
3708         hblktag.htag_rehash = hashno;
3709         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3710 
3711         hmeshift = HME_HASH_SHIFT(hashno);
3712 
3713         while (addr < endaddr) {
3714                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3715                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3716                 SFMMU_HASH_LOCK(hmebp);
3717                 /* inline HME_HASH_SEARCH */
3718                 hmeblkp = hmebp->hmeblkp;
3719                 pr_hblk = NULL;
3720                 while (hmeblkp) {
3721                         if (HTAGS_EQ(hmeblkp->hblk_tag, hblktag)) {
3722                                 /* found hme_blk */
3723                                 ASSERT(!hmeblkp->hblk_shared);
3724                                 if (hmeblkp->hblk_shw_bit) {
3725                                         if (hmeblkp->hblk_shw_mask) {
3726                                                 shadow = 1;
3727                                                 sfmmu_shadow_hcleanup(sfmmup,
3728                                                     hmeblkp, hmebp);
3729                                                 break;
3730                                         } else {
3731                                                 hmeblkp->hblk_shw_bit = 0;
3732                                         }
3733                                 }
3734 
3735                                 /*
3736                                  * Hblk_hmecnt and hblk_vcnt could be non zero
3737                                  * since hblk_unload() does not gurantee that.
3738                                  *
3739                                  * XXX - this could cause tteload() to spin
3740                                  * where sfmmu_shadow_hcleanup() is called.
3741                                  */
3742                         }
3743 
3744                         nx_hblk = hmeblkp->hblk_next;
3745                         if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
3746                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3747                                     &list, 0);
3748                         } else {
3749                                 pr_hblk = hmeblkp;
3750                         }
3751                         hmeblkp = nx_hblk;
3752                 }
3753 
3754                 SFMMU_HASH_UNLOCK(hmebp);
3755 
3756                 if (shadow) {
3757                         /*
3758                          * We found another shadow hblk so cleaned its
3759                          * children.  We need to go back and cleanup
3760                          * the original hblk so we don't change the
3761                          * addr.
3762                          */
3763                         shadow = 0;
3764                 } else {
3765                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
3766                             (1 << hmeshift));
3767                 }
3768         }
3769         sfmmu_hblks_list_purge(&list, 0);
3770 }
3771 
3772 /*
3773  * This routine's job is to delete stale invalid shared hmeregions hmeblks that
3774  * may still linger on after pageunload.
3775  */
3776 static void
3777 sfmmu_cleanup_rhblk(sf_srd_t *srdp, caddr_t addr, uint_t rid, int ttesz)
3778 {
3779         int hmeshift;
3780         hmeblk_tag hblktag;
3781         struct hmehash_bucket *hmebp;
3782         struct hme_blk *hmeblkp;
3783         struct hme_blk *pr_hblk;
3784         struct hme_blk *list = NULL;
3785 
3786         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3787         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3788 
3789         hmeshift = HME_HASH_SHIFT(ttesz);
3790         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3791         hblktag.htag_rehash = ttesz;
3792         hblktag.htag_rid = rid;
3793         hblktag.htag_id = srdp;
3794         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3795 
3796         SFMMU_HASH_LOCK(hmebp);
3797         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3798         if (hmeblkp != NULL) {
3799                 ASSERT(hmeblkp->hblk_shared);
3800                 ASSERT(!hmeblkp->hblk_shw_bit);
3801                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3802                         panic("sfmmu_cleanup_rhblk: valid hmeblk");
3803                 }
3804                 ASSERT(!hmeblkp->hblk_lckcnt);
3805                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3806                     &list, 0);
3807         }
3808         SFMMU_HASH_UNLOCK(hmebp);
3809         sfmmu_hblks_list_purge(&list, 0);
3810 }
3811 
3812 /* ARGSUSED */
3813 static void
3814 sfmmu_rgn_cb_noop(caddr_t saddr, caddr_t eaddr, caddr_t r_saddr,
3815     size_t r_size, void *r_obj, u_offset_t r_objoff)
3816 {
3817 }
3818 
3819 /*
3820  * Searches for an hmeblk which maps addr, then unloads this mapping
3821  * and updates *eaddrp, if the hmeblk is found.
3822  */
3823 static void
3824 sfmmu_unload_hmeregion_va(sf_srd_t *srdp, uint_t rid, caddr_t addr,
3825     caddr_t eaddr, int ttesz, caddr_t *eaddrp)
3826 {
3827         int hmeshift;
3828         hmeblk_tag hblktag;
3829         struct hmehash_bucket *hmebp;
3830         struct hme_blk *hmeblkp;
3831         struct hme_blk *pr_hblk;
3832         struct hme_blk *list = NULL;
3833 
3834         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3835         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3836         ASSERT(ttesz >= HBLK_MIN_TTESZ);
3837 
3838         hmeshift = HME_HASH_SHIFT(ttesz);
3839         hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3840         hblktag.htag_rehash = ttesz;
3841         hblktag.htag_rid = rid;
3842         hblktag.htag_id = srdp;
3843         hmebp = HME_HASH_FUNCTION(srdp, addr, hmeshift);
3844 
3845         SFMMU_HASH_LOCK(hmebp);
3846         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
3847         if (hmeblkp != NULL) {
3848                 ASSERT(hmeblkp->hblk_shared);
3849                 ASSERT(!hmeblkp->hblk_lckcnt);
3850                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
3851                         *eaddrp = sfmmu_hblk_unload(NULL, hmeblkp, addr,
3852                             eaddr, NULL, HAT_UNLOAD);
3853                         ASSERT(*eaddrp > addr);
3854                 }
3855                 ASSERT(!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt);
3856                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
3857                     &list, 0);
3858         }
3859         SFMMU_HASH_UNLOCK(hmebp);
3860         sfmmu_hblks_list_purge(&list, 0);
3861 }
3862 
3863 static void
3864 sfmmu_unload_hmeregion(sf_srd_t *srdp, sf_region_t *rgnp)
3865 {
3866         int ttesz = rgnp->rgn_pgszc;
3867         size_t rsz = rgnp->rgn_size;
3868         caddr_t rsaddr = rgnp->rgn_saddr;
3869         caddr_t readdr = rsaddr + rsz;
3870         caddr_t rhsaddr;
3871         caddr_t va;
3872         uint_t rid = rgnp->rgn_id;
3873         caddr_t cbsaddr;
3874         caddr_t cbeaddr;
3875         hat_rgn_cb_func_t rcbfunc;
3876         ulong_t cnt;
3877 
3878         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
3879         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
3880 
3881         ASSERT(IS_P2ALIGNED(rsaddr, TTEBYTES(ttesz)));
3882         ASSERT(IS_P2ALIGNED(rsz, TTEBYTES(ttesz)));
3883         if (ttesz < HBLK_MIN_TTESZ) {
3884                 ttesz = HBLK_MIN_TTESZ;
3885                 rhsaddr = (caddr_t)P2ALIGN((uintptr_t)rsaddr, HBLK_MIN_BYTES);
3886         } else {
3887                 rhsaddr = rsaddr;
3888         }
3889 
3890         if ((rcbfunc = rgnp->rgn_cb_function) == NULL) {
3891                 rcbfunc = sfmmu_rgn_cb_noop;
3892         }
3893 
3894         while (ttesz >= HBLK_MIN_TTESZ) {
3895                 cbsaddr = rsaddr;
3896                 cbeaddr = rsaddr;
3897                 if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
3898                         ttesz--;
3899                         continue;
3900                 }
3901                 cnt = 0;
3902                 va = rsaddr;
3903                 while (va < readdr) {
3904                         ASSERT(va >= rhsaddr);
3905                         if (va != cbeaddr) {
3906                                 if (cbeaddr != cbsaddr) {
3907                                         ASSERT(cbeaddr > cbsaddr);
3908                                         (*rcbfunc)(cbsaddr, cbeaddr,
3909                                             rsaddr, rsz, rgnp->rgn_obj,
3910                                             rgnp->rgn_objoff);
3911                                 }
3912                                 cbsaddr = va;
3913                                 cbeaddr = va;
3914                         }
3915                         sfmmu_unload_hmeregion_va(srdp, rid, va, readdr,
3916                             ttesz, &cbeaddr);
3917                         cnt++;
3918                         va = rhsaddr + (cnt << TTE_PAGE_SHIFT(ttesz));
3919                 }
3920                 if (cbeaddr != cbsaddr) {
3921                         ASSERT(cbeaddr > cbsaddr);
3922                         (*rcbfunc)(cbsaddr, cbeaddr, rsaddr,
3923                             rsz, rgnp->rgn_obj,
3924                             rgnp->rgn_objoff);
3925                 }
3926                 ttesz--;
3927         }
3928 }
3929 
3930 /*
3931  * Release one hardware address translation lock on the given address range.
3932  */
3933 void
3934 hat_unlock(struct hat *sfmmup, caddr_t addr, size_t len)
3935 {
3936         struct hmehash_bucket *hmebp;
3937         hmeblk_tag hblktag;
3938         int hmeshift, hashno = 1;
3939         struct hme_blk *hmeblkp, *list = NULL;
3940         caddr_t endaddr;
3941 
3942         ASSERT(sfmmup != NULL);
3943 
3944         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
3945         ASSERT((len & MMU_PAGEOFFSET) == 0);
3946         endaddr = addr + len;
3947         hblktag.htag_id = sfmmup;
3948         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
3949 
3950         /*
3951          * Spitfire supports 4 page sizes.
3952          * Most pages are expected to be of the smallest page size (8K) and
3953          * these will not need to be rehashed. 64K pages also don't need to be
3954          * rehashed because an hmeblk spans 64K of address space. 512K pages
3955          * might need 1 rehash and and 4M pages might need 2 rehashes.
3956          */
3957         while (addr < endaddr) {
3958                 hmeshift = HME_HASH_SHIFT(hashno);
3959                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
3960                 hblktag.htag_rehash = hashno;
3961                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
3962 
3963                 SFMMU_HASH_LOCK(hmebp);
3964 
3965                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
3966                 if (hmeblkp != NULL) {
3967                         ASSERT(!hmeblkp->hblk_shared);
3968                         /*
3969                          * If we encounter a shadow hmeblk then
3970                          * we know there are no valid hmeblks mapping
3971                          * this address at this size or larger.
3972                          * Just increment address by the smallest
3973                          * page size.
3974                          */
3975                         if (hmeblkp->hblk_shw_bit) {
3976                                 addr += MMU_PAGESIZE;
3977                         } else {
3978                                 addr = sfmmu_hblk_unlock(hmeblkp, addr,
3979                                     endaddr);
3980                         }
3981                         SFMMU_HASH_UNLOCK(hmebp);
3982                         hashno = 1;
3983                         continue;
3984                 }
3985                 SFMMU_HASH_UNLOCK(hmebp);
3986 
3987                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
3988                         /*
3989                          * We have traversed the whole list and rehashed
3990                          * if necessary without finding the address to unlock
3991                          * which should never happen.
3992                          */
3993                         panic("sfmmu_unlock: addr not found. "
3994                             "addr %p hat %p", (void *)addr, (void *)sfmmup);
3995                 } else {
3996                         hashno++;
3997                 }
3998         }
3999 
4000         sfmmu_hblks_list_purge(&list, 0);
4001 }
4002 
4003 void
4004 hat_unlock_region(struct hat *sfmmup, caddr_t addr, size_t len,
4005     hat_region_cookie_t rcookie)
4006 {
4007         sf_srd_t *srdp;
4008         sf_region_t *rgnp;
4009         int ttesz;
4010         uint_t rid;
4011         caddr_t eaddr;
4012         caddr_t va;
4013         int hmeshift;
4014         hmeblk_tag hblktag;
4015         struct hmehash_bucket *hmebp;
4016         struct hme_blk *hmeblkp;
4017         struct hme_blk *pr_hblk;
4018         struct hme_blk *list;
4019 
4020         if (rcookie == HAT_INVALID_REGION_COOKIE) {
4021                 hat_unlock(sfmmup, addr, len);
4022                 return;
4023         }
4024 
4025         ASSERT(sfmmup != NULL);
4026         ASSERT(sfmmup != ksfmmup);
4027 
4028         srdp = sfmmup->sfmmu_srdp;
4029         rid = (uint_t)((uint64_t)rcookie);
4030         VERIFY3U(rid, <, SFMMU_MAX_HME_REGIONS);
4031         eaddr = addr + len;
4032         va = addr;
4033         list = NULL;
4034         rgnp = srdp->srd_hmergnp[rid];
4035         SFMMU_VALIDATE_HMERID(sfmmup, rid, addr, len);
4036 
4037         ASSERT(IS_P2ALIGNED(addr, TTEBYTES(rgnp->rgn_pgszc)));
4038         ASSERT(IS_P2ALIGNED(len, TTEBYTES(rgnp->rgn_pgszc)));
4039         if (rgnp->rgn_pgszc < HBLK_MIN_TTESZ) {
4040                 ttesz = HBLK_MIN_TTESZ;
4041         } else {
4042                 ttesz = rgnp->rgn_pgszc;
4043         }
4044         while (va < eaddr) {
4045                 while (ttesz < rgnp->rgn_pgszc &&
4046                     IS_P2ALIGNED(va, TTEBYTES(ttesz + 1))) {
4047                         ttesz++;
4048                 }
4049                 while (ttesz >= HBLK_MIN_TTESZ) {
4050                         if (!(rgnp->rgn_hmeflags & (1 << ttesz))) {
4051                                 ttesz--;
4052                                 continue;
4053                         }
4054                         hmeshift = HME_HASH_SHIFT(ttesz);
4055                         hblktag.htag_bspage = HME_HASH_BSPAGE(va, hmeshift);
4056                         hblktag.htag_rehash = ttesz;
4057                         hblktag.htag_rid = rid;
4058                         hblktag.htag_id = srdp;
4059                         hmebp = HME_HASH_FUNCTION(srdp, va, hmeshift);
4060                         SFMMU_HASH_LOCK(hmebp);
4061                         HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk,
4062                             &list);
4063                         if (hmeblkp == NULL) {
4064                                 SFMMU_HASH_UNLOCK(hmebp);
4065                                 ttesz--;
4066                                 continue;
4067                         }
4068                         ASSERT(hmeblkp->hblk_shared);
4069                         va = sfmmu_hblk_unlock(hmeblkp, va, eaddr);
4070                         ASSERT(va >= eaddr ||
4071                             IS_P2ALIGNED((uintptr_t)va, TTEBYTES(ttesz)));
4072                         SFMMU_HASH_UNLOCK(hmebp);
4073                         break;
4074                 }
4075                 if (ttesz < HBLK_MIN_TTESZ) {
4076                         panic("hat_unlock_region: addr not found "
4077                             "addr %p hat %p", (void *)va, (void *)sfmmup);
4078                 }
4079         }
4080         sfmmu_hblks_list_purge(&list, 0);
4081 }
4082 
4083 /*
4084  * Function to unlock a range of addresses in an hmeblk.  It returns the
4085  * next address that needs to be unlocked.
4086  * Should be called with the hash lock held.
4087  */
4088 static caddr_t
4089 sfmmu_hblk_unlock(struct hme_blk *hmeblkp, caddr_t addr, caddr_t endaddr)
4090 {
4091         struct sf_hment *sfhme;
4092         tte_t tteold, ttemod;
4093         int ttesz, ret;
4094 
4095         ASSERT(in_hblk_range(hmeblkp, addr));
4096         ASSERT(hmeblkp->hblk_shw_bit == 0);
4097 
4098         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4099         ttesz = get_hblk_ttesz(hmeblkp);
4100 
4101         HBLKTOHME(sfhme, hmeblkp, addr);
4102         while (addr < endaddr) {
4103 readtte:
4104                 sfmmu_copytte(&sfhme->hme_tte, &tteold);
4105                 if (TTE_IS_VALID(&tteold)) {
4106 
4107                         ttemod = tteold;
4108 
4109                         ret = sfmmu_modifytte_try(&tteold, &ttemod,
4110                             &sfhme->hme_tte);
4111 
4112                         if (ret < 0)
4113                                 goto readtte;
4114 
4115                         if (hmeblkp->hblk_lckcnt == 0)
4116                                 panic("zero hblk lckcnt");
4117 
4118                         if (((uintptr_t)addr + TTEBYTES(ttesz)) >
4119                             (uintptr_t)endaddr)
4120                                 panic("can't unlock large tte");
4121 
4122                         ASSERT(hmeblkp->hblk_lckcnt > 0);
4123                         atomic_dec_32(&hmeblkp->hblk_lckcnt);
4124                         HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
4125                 } else {
4126                         panic("sfmmu_hblk_unlock: invalid tte");
4127                 }
4128                 addr += TTEBYTES(ttesz);
4129                 sfhme++;
4130         }
4131         return (addr);
4132 }
4133 
4134 /*
4135  * Physical Address Mapping Framework
4136  *
4137  * General rules:
4138  *
4139  * (1) Applies only to seg_kmem memory pages. To make things easier,
4140  *     seg_kpm addresses are also accepted by the routines, but nothing
4141  *     is done with them since by definition their PA mappings are static.
4142  * (2) hat_add_callback() may only be called while holding the page lock
4143  *     SE_SHARED or SE_EXCL of the underlying page (e.g., as_pagelock()),
4144  *     or passing HAC_PAGELOCK flag.
4145  * (3) prehandler() and posthandler() may not call hat_add_callback() or
4146  *     hat_delete_callback(), nor should they allocate memory. Post quiesce
4147  *     callbacks may not sleep or acquire adaptive mutex locks.
4148  * (4) Either prehandler() or posthandler() (but not both) may be specified
4149  *     as being NULL.  Specifying an errhandler() is optional.
4150  *
4151  * Details of using the framework:
4152  *
4153  * registering a callback (hat_register_callback())
4154  *
4155  *      Pass prehandler, posthandler, errhandler addresses
4156  *      as described below. If capture_cpus argument is nonzero,
4157  *      suspend callback to the prehandler will occur with CPUs
4158  *      captured and executing xc_loop() and CPUs will remain
4159  *      captured until after the posthandler suspend callback
4160  *      occurs.
4161  *
4162  * adding a callback (hat_add_callback())
4163  *
4164  *      as_pagelock();
4165  *      hat_add_callback();
4166  *      save returned pfn in private data structures or program registers;
4167  *      as_pageunlock();
4168  *
4169  * prehandler()
4170  *
4171  *      Stop all accesses by physical address to this memory page.
4172  *      Called twice: the first, PRESUSPEND, is a context safe to acquire
4173  *      adaptive locks. The second, SUSPEND, is called at high PIL with
4174  *      CPUs captured so adaptive locks may NOT be acquired (and all spin
4175  *      locks must be XCALL_PIL or higher locks).
4176  *
4177  *      May return the following errors:
4178  *              EIO:    A fatal error has occurred. This will result in panic.
4179  *              EAGAIN: The page cannot be suspended. This will fail the
4180  *                      relocation.
4181  *              0:      Success.
4182  *
4183  * posthandler()
4184  *
4185  *      Save new pfn in private data structures or program registers;
4186  *      not allowed to fail (non-zero return values will result in panic).
4187  *
4188  * errhandler()
4189  *
4190  *      called when an error occurs related to the callback.  Currently
4191  *      the only such error is HAT_CB_ERR_LEAKED which indicates that
4192  *      a page is being freed, but there are still outstanding callback(s)
4193  *      registered on the page.
4194  *
4195  * removing a callback (hat_delete_callback(); e.g., prior to freeing memory)
4196  *
4197  *      stop using physical address
4198  *      hat_delete_callback();
4199  *
4200  */
4201 
4202 /*
4203  * Register a callback class.  Each subsystem should do this once and
4204  * cache the id_t returned for use in setting up and tearing down callbacks.
4205  *
4206  * There is no facility for removing callback IDs once they are created;
4207  * the "key" should be unique for each module, so in case a module is unloaded
4208  * and subsequently re-loaded, we can recycle the module's previous entry.
4209  */
4210 id_t
4211 hat_register_callback(int key,
4212     int (*prehandler)(caddr_t, uint_t, uint_t, void *),
4213     int (*posthandler)(caddr_t, uint_t, uint_t, void *, pfn_t),
4214     int (*errhandler)(caddr_t, uint_t, uint_t, void *),
4215     int capture_cpus)
4216 {
4217         id_t id;
4218 
4219         /*
4220          * Search the table for a pre-existing callback associated with
4221          * the identifier "key".  If one exists, we re-use that entry in
4222          * the table for this instance, otherwise we assign the next
4223          * available table slot.
4224          */
4225         for (id = 0; id < sfmmu_max_cb_id; id++) {
4226                 if (sfmmu_cb_table[id].key == key)
4227                         break;
4228         }
4229 
4230         if (id == sfmmu_max_cb_id) {
4231                 id = sfmmu_cb_nextid++;
4232                 if (id >= sfmmu_max_cb_id)
4233                         panic("hat_register_callback: out of callback IDs");
4234         }
4235 
4236         ASSERT(prehandler != NULL || posthandler != NULL);
4237 
4238         sfmmu_cb_table[id].key = key;
4239         sfmmu_cb_table[id].prehandler = prehandler;
4240         sfmmu_cb_table[id].posthandler = posthandler;
4241         sfmmu_cb_table[id].errhandler = errhandler;
4242         sfmmu_cb_table[id].capture_cpus = capture_cpus;
4243 
4244         return (id);
4245 }
4246 
4247 #define HAC_COOKIE_NONE (void *)-1
4248 
4249 /*
4250  * Add relocation callbacks to the specified addr/len which will be called
4251  * when relocating the associated page. See the description of pre and
4252  * posthandler above for more details.
4253  *
4254  * If HAC_PAGELOCK is included in flags, the underlying memory page is
4255  * locked internally so the caller must be able to deal with the callback
4256  * running even before this function has returned.  If HAC_PAGELOCK is not
4257  * set, it is assumed that the underlying memory pages are locked.
4258  *
4259  * Since the caller must track the individual page boundaries anyway,
4260  * we only allow a callback to be added to a single page (large
4261  * or small).  Thus [addr, addr + len) MUST be contained within a single
4262  * page.
4263  *
4264  * Registering multiple callbacks on the same [addr, addr+len) is supported,
4265  * _provided_that_ a unique parameter is specified for each callback.
4266  * If multiple callbacks are registered on the same range the callback will
4267  * be invoked with each unique parameter. Registering the same callback with
4268  * the same argument more than once will result in corrupted kernel state.
4269  *
4270  * Returns the pfn of the underlying kernel page in *rpfn
4271  * on success, or PFN_INVALID on failure.
4272  *
4273  * cookiep (if passed) provides storage space for an opaque cookie
4274  * to return later to hat_delete_callback(). This cookie makes the callback
4275  * deletion significantly quicker by avoiding a potentially lengthy hash
4276  * search.
4277  *
4278  * Returns values:
4279  *    0:      success
4280  *    ENOMEM: memory allocation failure (e.g. flags was passed as HAC_NOSLEEP)
4281  *    EINVAL: callback ID is not valid
4282  *    ENXIO:  ["vaddr", "vaddr" + len) is not mapped in the kernel's address
4283  *            space
4284  *    ERANGE: ["vaddr", "vaddr" + len) crosses a page boundary
4285  */
4286 int
4287 hat_add_callback(id_t callback_id, caddr_t vaddr, uint_t len, uint_t flags,
4288     void *pvt, pfn_t *rpfn, void **cookiep)
4289 {
4290         struct          hmehash_bucket *hmebp;
4291         hmeblk_tag      hblktag;
4292         struct hme_blk  *hmeblkp;
4293         int             hmeshift, hashno;
4294         caddr_t         saddr, eaddr, baseaddr;
4295         struct pa_hment *pahmep;
4296         struct sf_hment *sfhmep, *osfhmep;
4297         kmutex_t        *pml;
4298         tte_t           tte;
4299         page_t          *pp;
4300         vnode_t         *vp;
4301         u_offset_t      off;
4302         pfn_t           pfn;
4303         int             kmflags = (flags & HAC_SLEEP)? KM_SLEEP : KM_NOSLEEP;
4304         int             locked = 0;
4305 
4306         /*
4307          * For KPM mappings, just return the physical address since we
4308          * don't need to register any callbacks.
4309          */
4310         if (IS_KPM_ADDR(vaddr)) {
4311                 uint64_t paddr;
4312                 SFMMU_KPM_VTOP(vaddr, paddr);
4313                 *rpfn = btop(paddr);
4314                 if (cookiep != NULL)
4315                         *cookiep = HAC_COOKIE_NONE;
4316                 return (0);
4317         }
4318 
4319         if (callback_id < (id_t)0 || callback_id >= sfmmu_cb_nextid) {
4320                 *rpfn = PFN_INVALID;
4321                 return (EINVAL);
4322         }
4323 
4324         if ((pahmep = kmem_cache_alloc(pa_hment_cache, kmflags)) == NULL) {
4325                 *rpfn = PFN_INVALID;
4326                 return (ENOMEM);
4327         }
4328 
4329         sfhmep = &pahmep->sfment;
4330 
4331         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4332         eaddr = saddr + len;
4333 
4334 rehash:
4335         /* Find the mapping(s) for this page */
4336         for (hashno = TTE64K, hmeblkp = NULL;
4337             hmeblkp == NULL && hashno <= mmu_hashcnt;
4338             hashno++) {
4339                 hmeshift = HME_HASH_SHIFT(hashno);
4340                 hblktag.htag_id = ksfmmup;
4341                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4342                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4343                 hblktag.htag_rehash = hashno;
4344                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4345 
4346                 SFMMU_HASH_LOCK(hmebp);
4347 
4348                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4349 
4350                 if (hmeblkp == NULL)
4351                         SFMMU_HASH_UNLOCK(hmebp);
4352         }
4353 
4354         if (hmeblkp == NULL) {
4355                 kmem_cache_free(pa_hment_cache, pahmep);
4356                 *rpfn = PFN_INVALID;
4357                 return (ENXIO);
4358         }
4359 
4360         ASSERT(!hmeblkp->hblk_shared);
4361 
4362         HBLKTOHME(osfhmep, hmeblkp, saddr);
4363         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4364 
4365         if (!TTE_IS_VALID(&tte)) {
4366                 SFMMU_HASH_UNLOCK(hmebp);
4367                 kmem_cache_free(pa_hment_cache, pahmep);
4368                 *rpfn = PFN_INVALID;
4369                 return (ENXIO);
4370         }
4371 
4372         /*
4373          * Make sure the boundaries for the callback fall within this
4374          * single mapping.
4375          */
4376         baseaddr = (caddr_t)get_hblk_base(hmeblkp);
4377         ASSERT(saddr >= baseaddr);
4378         if (eaddr > saddr + TTEBYTES(TTE_CSZ(&tte))) {
4379                 SFMMU_HASH_UNLOCK(hmebp);
4380                 kmem_cache_free(pa_hment_cache, pahmep);
4381                 *rpfn = PFN_INVALID;
4382                 return (ERANGE);
4383         }
4384 
4385         pfn = sfmmu_ttetopfn(&tte, vaddr);
4386 
4387         /*
4388          * The pfn may not have a page_t underneath in which case we
4389          * just return it. This can happen if we are doing I/O to a
4390          * static portion of the kernel's address space, for instance.
4391          */
4392         pp = osfhmep->hme_page;
4393         if (pp == NULL) {
4394                 SFMMU_HASH_UNLOCK(hmebp);
4395                 kmem_cache_free(pa_hment_cache, pahmep);
4396                 *rpfn = pfn;
4397                 if (cookiep)
4398                         *cookiep = HAC_COOKIE_NONE;
4399                 return (0);
4400         }
4401         ASSERT(pp == PP_PAGEROOT(pp));
4402 
4403         vp = pp->p_vnode;
4404         off = pp->p_offset;
4405 
4406         pml = sfmmu_mlist_enter(pp);
4407 
4408         if (flags & HAC_PAGELOCK) {
4409                 if (!page_trylock(pp, SE_SHARED)) {
4410                         /*
4411                          * Somebody is holding SE_EXCL lock. Might
4412                          * even be hat_page_relocate(). Drop all
4413                          * our locks, lookup the page in &kvp, and
4414                          * retry. If it doesn't exist in &kvp and &zvp,
4415                          * then we must be dealing with a kernel mapped
4416                          * page which doesn't actually belong to
4417                          * segkmem so we punt.
4418                          */
4419                         sfmmu_mlist_exit(pml);
4420                         SFMMU_HASH_UNLOCK(hmebp);
4421                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4422 
4423                         /* check zvp before giving up */
4424                         if (pp == NULL)
4425                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4426                                     SE_SHARED);
4427 
4428                         /* Okay, we didn't find it, give up */
4429                         if (pp == NULL) {
4430                                 kmem_cache_free(pa_hment_cache, pahmep);
4431                                 *rpfn = pfn;
4432                                 if (cookiep)
4433                                         *cookiep = HAC_COOKIE_NONE;
4434                                 return (0);
4435                         }
4436                         page_unlock(pp);
4437                         goto rehash;
4438                 }
4439                 locked = 1;
4440         }
4441 
4442         if (!PAGE_LOCKED(pp) && !panicstr)
4443                 panic("hat_add_callback: page 0x%p not locked", (void *)pp);
4444 
4445         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4446             pp->p_offset != off) {
4447                 /*
4448                  * The page moved before we got our hands on it.  Drop
4449                  * all the locks and try again.
4450                  */
4451                 ASSERT((flags & HAC_PAGELOCK) != 0);
4452                 sfmmu_mlist_exit(pml);
4453                 SFMMU_HASH_UNLOCK(hmebp);
4454                 page_unlock(pp);
4455                 locked = 0;
4456                 goto rehash;
4457         }
4458 
4459         if (!VN_ISKAS(vp)) {
4460                 /*
4461                  * This is not a segkmem page but another page which
4462                  * has been kernel mapped. It had better have at least
4463                  * a share lock on it. Return the pfn.
4464                  */
4465                 sfmmu_mlist_exit(pml);
4466                 SFMMU_HASH_UNLOCK(hmebp);
4467                 if (locked)
4468                         page_unlock(pp);
4469                 kmem_cache_free(pa_hment_cache, pahmep);
4470                 ASSERT(PAGE_LOCKED(pp));
4471                 *rpfn = pfn;
4472                 if (cookiep)
4473                         *cookiep = HAC_COOKIE_NONE;
4474                 return (0);
4475         }
4476 
4477         /*
4478          * Setup this pa_hment and link its embedded dummy sf_hment into
4479          * the mapping list.
4480          */
4481         pp->p_share++;
4482         pahmep->cb_id = callback_id;
4483         pahmep->addr = vaddr;
4484         pahmep->len = len;
4485         pahmep->refcnt = 1;
4486         pahmep->flags = 0;
4487         pahmep->pvt = pvt;
4488 
4489         sfhmep->hme_tte.ll = 0;
4490         sfhmep->hme_data = pahmep;
4491         sfhmep->hme_prev = osfhmep;
4492         sfhmep->hme_next = osfhmep->hme_next;
4493 
4494         if (osfhmep->hme_next)
4495                 osfhmep->hme_next->hme_prev = sfhmep;
4496 
4497         osfhmep->hme_next = sfhmep;
4498 
4499         sfmmu_mlist_exit(pml);
4500         SFMMU_HASH_UNLOCK(hmebp);
4501 
4502         if (locked)
4503                 page_unlock(pp);
4504 
4505         *rpfn = pfn;
4506         if (cookiep)
4507                 *cookiep = (void *)pahmep;
4508 
4509         return (0);
4510 }
4511 
4512 /*
4513  * Remove the relocation callbacks from the specified addr/len.
4514  */
4515 void
4516 hat_delete_callback(caddr_t vaddr, uint_t len, void *pvt, uint_t flags,
4517     void *cookie)
4518 {
4519         struct          hmehash_bucket *hmebp;
4520         hmeblk_tag      hblktag;
4521         struct hme_blk  *hmeblkp;
4522         int             hmeshift, hashno;
4523         caddr_t         saddr;
4524         struct pa_hment *pahmep;
4525         struct sf_hment *sfhmep, *osfhmep;
4526         kmutex_t        *pml;
4527         tte_t           tte;
4528         page_t          *pp;
4529         vnode_t         *vp;
4530         u_offset_t      off;
4531         int             locked = 0;
4532 
4533         /*
4534          * If the cookie is HAC_COOKIE_NONE then there is no pa_hment to
4535          * remove so just return.
4536          */
4537         if (cookie == HAC_COOKIE_NONE || IS_KPM_ADDR(vaddr))
4538                 return;
4539 
4540         saddr = (caddr_t)((uintptr_t)vaddr & MMU_PAGEMASK);
4541 
4542 rehash:
4543         /* Find the mapping(s) for this page */
4544         for (hashno = TTE64K, hmeblkp = NULL;
4545             hmeblkp == NULL && hashno <= mmu_hashcnt;
4546             hashno++) {
4547                 hmeshift = HME_HASH_SHIFT(hashno);
4548                 hblktag.htag_id = ksfmmup;
4549                 hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4550                 hblktag.htag_bspage = HME_HASH_BSPAGE(saddr, hmeshift);
4551                 hblktag.htag_rehash = hashno;
4552                 hmebp = HME_HASH_FUNCTION(ksfmmup, saddr, hmeshift);
4553 
4554                 SFMMU_HASH_LOCK(hmebp);
4555 
4556                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
4557 
4558                 if (hmeblkp == NULL)
4559                         SFMMU_HASH_UNLOCK(hmebp);
4560         }
4561 
4562         if (hmeblkp == NULL)
4563                 return;
4564 
4565         ASSERT(!hmeblkp->hblk_shared);
4566 
4567         HBLKTOHME(osfhmep, hmeblkp, saddr);
4568 
4569         sfmmu_copytte(&osfhmep->hme_tte, &tte);
4570         if (!TTE_IS_VALID(&tte)) {
4571                 SFMMU_HASH_UNLOCK(hmebp);
4572                 return;
4573         }
4574 
4575         pp = osfhmep->hme_page;
4576         if (pp == NULL) {
4577                 SFMMU_HASH_UNLOCK(hmebp);
4578                 ASSERT(cookie == NULL);
4579                 return;
4580         }
4581 
4582         vp = pp->p_vnode;
4583         off = pp->p_offset;
4584 
4585         pml = sfmmu_mlist_enter(pp);
4586 
4587         if (flags & HAC_PAGELOCK) {
4588                 if (!page_trylock(pp, SE_SHARED)) {
4589                         /*
4590                          * Somebody is holding SE_EXCL lock. Might
4591                          * even be hat_page_relocate(). Drop all
4592                          * our locks, lookup the page in &kvp, and
4593                          * retry. If it doesn't exist in &kvp and &zvp,
4594                          * then we must be dealing with a kernel mapped
4595                          * page which doesn't actually belong to
4596                          * segkmem so we punt.
4597                          */
4598                         sfmmu_mlist_exit(pml);
4599                         SFMMU_HASH_UNLOCK(hmebp);
4600                         pp = page_lookup(&kvp, (u_offset_t)saddr, SE_SHARED);
4601                         /* check zvp before giving up */
4602                         if (pp == NULL)
4603                                 pp = page_lookup(&zvp, (u_offset_t)saddr,
4604                                     SE_SHARED);
4605 
4606                         if (pp == NULL) {
4607                                 ASSERT(cookie == NULL);
4608                                 return;
4609                         }
4610                         page_unlock(pp);
4611                         goto rehash;
4612                 }
4613                 locked = 1;
4614         }
4615 
4616         ASSERT(PAGE_LOCKED(pp));
4617 
4618         if (osfhmep->hme_page != pp || pp->p_vnode != vp ||
4619             pp->p_offset != off) {
4620                 /*
4621                  * The page moved before we got our hands on it.  Drop
4622                  * all the locks and try again.
4623                  */
4624                 ASSERT((flags & HAC_PAGELOCK) != 0);
4625                 sfmmu_mlist_exit(pml);
4626                 SFMMU_HASH_UNLOCK(hmebp);
4627                 page_unlock(pp);
4628                 locked = 0;
4629                 goto rehash;
4630         }
4631 
4632         if (!VN_ISKAS(vp)) {
4633                 /*
4634                  * This is not a segkmem page but another page which
4635                  * has been kernel mapped.
4636                  */
4637                 sfmmu_mlist_exit(pml);
4638                 SFMMU_HASH_UNLOCK(hmebp);
4639                 if (locked)
4640                         page_unlock(pp);
4641                 ASSERT(cookie == NULL);
4642                 return;
4643         }
4644 
4645         if (cookie != NULL) {
4646                 pahmep = (struct pa_hment *)cookie;
4647                 sfhmep = &pahmep->sfment;
4648         } else {
4649                 for (sfhmep = pp->p_mapping; sfhmep != NULL;
4650                     sfhmep = sfhmep->hme_next) {
4651 
4652                         /*
4653                          * skip va<->pa mappings
4654                          */
4655                         if (!IS_PAHME(sfhmep))
4656                                 continue;
4657 
4658                         pahmep = sfhmep->hme_data;
4659                         ASSERT(pahmep != NULL);
4660 
4661                         /*
4662                          * if pa_hment matches, remove it
4663                          */
4664                         if ((pahmep->pvt == pvt) &&
4665                             (pahmep->addr == vaddr) &&
4666                             (pahmep->len == len)) {
4667                                 break;
4668                         }
4669                 }
4670         }
4671 
4672         if (sfhmep == NULL) {
4673                 if (!panicstr) {
4674                         panic("hat_delete_callback: pa_hment not found, pp %p",
4675                             (void *)pp);
4676                 }
4677                 return;
4678         }
4679 
4680         /*
4681          * Note: at this point a valid kernel mapping must still be
4682          * present on this page.
4683          */
4684         pp->p_share--;
4685         if (pp->p_share <= 0)
4686                 panic("hat_delete_callback: zero p_share");
4687 
4688         if (--pahmep->refcnt == 0) {
4689                 if (pahmep->flags != 0)
4690                         panic("hat_delete_callback: pa_hment is busy");
4691 
4692                 /*
4693                  * Remove sfhmep from the mapping list for the page.
4694                  */
4695                 if (sfhmep->hme_prev) {
4696                         sfhmep->hme_prev->hme_next = sfhmep->hme_next;
4697                 } else {
4698                         pp->p_mapping = sfhmep->hme_next;
4699                 }
4700 
4701                 if (sfhmep->hme_next)
4702                         sfhmep->hme_next->hme_prev = sfhmep->hme_prev;
4703 
4704                 sfmmu_mlist_exit(pml);
4705                 SFMMU_HASH_UNLOCK(hmebp);
4706 
4707                 if (locked)
4708                         page_unlock(pp);
4709 
4710                 kmem_cache_free(pa_hment_cache, pahmep);
4711                 return;
4712         }
4713 
4714         sfmmu_mlist_exit(pml);
4715         SFMMU_HASH_UNLOCK(hmebp);
4716         if (locked)
4717                 page_unlock(pp);
4718 }
4719 
4720 /*
4721  * hat_probe returns 1 if the translation for the address 'addr' is
4722  * loaded, zero otherwise.
4723  *
4724  * hat_probe should be used only for advisorary purposes because it may
4725  * occasionally return the wrong value. The implementation must guarantee that
4726  * returning the wrong value is a very rare event. hat_probe is used
4727  * to implement optimizations in the segment drivers.
4728  *
4729  */
4730 int
4731 hat_probe(struct hat *sfmmup, caddr_t addr)
4732 {
4733         pfn_t pfn;
4734         tte_t tte;
4735 
4736         ASSERT(sfmmup != NULL);
4737 
4738         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4739 
4740         if (sfmmup == ksfmmup) {
4741                 while ((pfn = sfmmu_vatopfn(addr, sfmmup, &tte))
4742                     == PFN_SUSPENDED) {
4743                         sfmmu_vatopfn_suspended(addr, sfmmup, &tte);
4744                 }
4745         } else {
4746                 pfn = sfmmu_uvatopfn(addr, sfmmup, NULL);
4747         }
4748 
4749         if (pfn != PFN_INVALID)
4750                 return (1);
4751         else
4752                 return (0);
4753 }
4754 
4755 ssize_t
4756 hat_getpagesize(struct hat *sfmmup, caddr_t addr)
4757 {
4758         tte_t tte;
4759 
4760         if (sfmmup == ksfmmup) {
4761                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4762                         return (-1);
4763                 }
4764         } else {
4765                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4766                         return (-1);
4767                 }
4768         }
4769 
4770         ASSERT(TTE_IS_VALID(&tte));
4771         return (TTEBYTES(TTE_CSZ(&tte)));
4772 }
4773 
4774 uint_t
4775 hat_getattr(struct hat *sfmmup, caddr_t addr, uint_t *attr)
4776 {
4777         tte_t tte;
4778 
4779         if (sfmmup == ksfmmup) {
4780                 if (sfmmu_vatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4781                         tte.ll = 0;
4782                 }
4783         } else {
4784                 if (sfmmu_uvatopfn(addr, sfmmup, &tte) == PFN_INVALID) {
4785                         tte.ll = 0;
4786                 }
4787         }
4788         if (TTE_IS_VALID(&tte)) {
4789                 *attr = sfmmu_ptov_attr(&tte);
4790                 return (0);
4791         }
4792         *attr = 0;
4793         return ((uint_t)0xffffffff);
4794 }
4795 
4796 /*
4797  * Enables more attributes on specified address range (ie. logical OR)
4798  */
4799 void
4800 hat_setattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4801 {
4802         ASSERT(hat->sfmmu_as != NULL);
4803 
4804         sfmmu_chgattr(hat, addr, len, attr, SFMMU_SETATTR);
4805 }
4806 
4807 /*
4808  * Assigns attributes to the specified address range.  All the attributes
4809  * are specified.
4810  */
4811 void
4812 hat_chgattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4813 {
4814         ASSERT(hat->sfmmu_as != NULL);
4815 
4816         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CHGATTR);
4817 }
4818 
4819 /*
4820  * Remove attributes on the specified address range (ie. loginal NAND)
4821  */
4822 void
4823 hat_clrattr(struct hat *hat, caddr_t addr, size_t len, uint_t attr)
4824 {
4825         ASSERT(hat->sfmmu_as != NULL);
4826 
4827         sfmmu_chgattr(hat, addr, len, attr, SFMMU_CLRATTR);
4828 }
4829 
4830 /*
4831  * Change attributes on an address range to that specified by attr and mode.
4832  */
4833 static void
4834 sfmmu_chgattr(struct hat *sfmmup, caddr_t addr, size_t len, uint_t attr,
4835     int mode)
4836 {
4837         struct hmehash_bucket *hmebp;
4838         hmeblk_tag hblktag;
4839         int hmeshift, hashno = 1;
4840         struct hme_blk *hmeblkp, *list = NULL;
4841         caddr_t endaddr;
4842         cpuset_t cpuset;
4843         demap_range_t dmr;
4844 
4845         CPUSET_ZERO(cpuset);
4846 
4847         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
4848         ASSERT((len & MMU_PAGEOFFSET) == 0);
4849         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
4850 
4851         if ((attr & PROT_USER) && (mode != SFMMU_CLRATTR) &&
4852             ((addr + len) > (caddr_t)USERLIMIT)) {
4853                 panic("user addr %p in kernel space",
4854                     (void *)addr);
4855         }
4856 
4857         endaddr = addr + len;
4858         hblktag.htag_id = sfmmup;
4859         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
4860         DEMAP_RANGE_INIT(sfmmup, &dmr);
4861 
4862         while (addr < endaddr) {
4863                 hmeshift = HME_HASH_SHIFT(hashno);
4864                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
4865                 hblktag.htag_rehash = hashno;
4866                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
4867 
4868                 SFMMU_HASH_LOCK(hmebp);
4869 
4870                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
4871                 if (hmeblkp != NULL) {
4872                         ASSERT(!hmeblkp->hblk_shared);
4873                         /*
4874                          * We've encountered a shadow hmeblk so skip the range
4875                          * of the next smaller mapping size.
4876                          */
4877                         if (hmeblkp->hblk_shw_bit) {
4878                                 ASSERT(sfmmup != ksfmmup);
4879                                 ASSERT(hashno > 1);
4880                                 addr = (caddr_t)P2END((uintptr_t)addr,
4881                                     TTEBYTES(hashno - 1));
4882                         } else {
4883                                 addr = sfmmu_hblk_chgattr(sfmmup,
4884                                     hmeblkp, addr, endaddr, &dmr, attr, mode);
4885                         }
4886                         SFMMU_HASH_UNLOCK(hmebp);
4887                         hashno = 1;
4888                         continue;
4889                 }
4890                 SFMMU_HASH_UNLOCK(hmebp);
4891 
4892                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
4893                         /*
4894                          * We have traversed the whole list and rehashed
4895                          * if necessary without finding the address to chgattr.
4896                          * This is ok, so we increment the address by the
4897                          * smallest hmeblk range for kernel mappings or for
4898                          * user mappings with no large pages, and the largest
4899                          * hmeblk range, to account for shadow hmeblks, for
4900                          * user mappings with large pages and continue.
4901                          */
4902                         if (sfmmup == ksfmmup)
4903                                 addr = (caddr_t)P2END((uintptr_t)addr,
4904                                     TTEBYTES(1));
4905                         else
4906                                 addr = (caddr_t)P2END((uintptr_t)addr,
4907                                     TTEBYTES(hashno));
4908                         hashno = 1;
4909                 } else {
4910                         hashno++;
4911                 }
4912         }
4913 
4914         sfmmu_hblks_list_purge(&list, 0);
4915         DEMAP_RANGE_FLUSH(&dmr);
4916         cpuset = sfmmup->sfmmu_cpusran;
4917         xt_sync(cpuset);
4918 }
4919 
4920 /*
4921  * This function chgattr on a range of addresses in an hmeblk.  It returns the
4922  * next addres that needs to be chgattr.
4923  * It should be called with the hash lock held.
4924  * XXX It should be possible to optimize chgattr by not flushing every time but
4925  * on the other hand:
4926  * 1. do one flush crosscall.
4927  * 2. only flush if we are increasing permissions (make sure this will work)
4928  */
4929 static caddr_t
4930 sfmmu_hblk_chgattr(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
4931     caddr_t endaddr, demap_range_t *dmrp, uint_t attr, int mode)
4932 {
4933         tte_t tte, tteattr, tteflags, ttemod;
4934         struct sf_hment *sfhmep;
4935         int ttesz;
4936         struct page *pp = NULL;
4937         kmutex_t *pml, *pmtx;
4938         int ret;
4939         int use_demap_range;
4940 #if defined(SF_ERRATA_57)
4941         int check_exec;
4942 #endif
4943 
4944         ASSERT(in_hblk_range(hmeblkp, addr));
4945         ASSERT(hmeblkp->hblk_shw_bit == 0);
4946         ASSERT(!hmeblkp->hblk_shared);
4947 
4948         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
4949         ttesz = get_hblk_ttesz(hmeblkp);
4950 
4951         /*
4952          * Flush the current demap region if addresses have been
4953          * skipped or the page size doesn't match.
4954          */
4955         use_demap_range = (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp));
4956         if (use_demap_range) {
4957                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
4958         } else if (dmrp != NULL) {
4959                 DEMAP_RANGE_FLUSH(dmrp);
4960         }
4961 
4962         tteattr.ll = sfmmu_vtop_attr(attr, mode, &tteflags);
4963 #if defined(SF_ERRATA_57)
4964         check_exec = (sfmmup != ksfmmup) &&
4965             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
4966             TTE_IS_EXECUTABLE(&tteattr);
4967 #endif
4968         HBLKTOHME(sfhmep, hmeblkp, addr);
4969         while (addr < endaddr) {
4970                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
4971                 if (TTE_IS_VALID(&tte)) {
4972                         if ((tte.ll & tteflags.ll) == tteattr.ll) {
4973                                 /*
4974                                  * if the new attr is the same as old
4975                                  * continue
4976                                  */
4977                                 goto next_addr;
4978                         }
4979                         if (!TTE_IS_WRITABLE(&tteattr)) {
4980                                 /*
4981                                  * make sure we clear hw modify bit if we
4982                                  * removing write protections
4983                                  */
4984                                 tteflags.tte_intlo |= TTE_HWWR_INT;
4985                         }
4986 
4987                         pml = NULL;
4988                         pp = sfhmep->hme_page;
4989                         if (pp) {
4990                                 pml = sfmmu_mlist_enter(pp);
4991                         }
4992 
4993                         if (pp != sfhmep->hme_page) {
4994                                 /*
4995                                  * tte must have been unloaded.
4996                                  */
4997                                 ASSERT(pml);
4998                                 sfmmu_mlist_exit(pml);
4999                                 continue;
5000                         }
5001 
5002                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5003 
5004                         ttemod = tte;
5005                         ttemod.ll = (ttemod.ll & ~tteflags.ll) | tteattr.ll;
5006                         ASSERT(TTE_TO_TTEPFN(&ttemod) == TTE_TO_TTEPFN(&tte));
5007 
5008 #if defined(SF_ERRATA_57)
5009                         if (check_exec && addr < errata57_limit)
5010                                 ttemod.tte_exec_perm = 0;
5011 #endif
5012                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5013                             &sfhmep->hme_tte);
5014 
5015                         if (ret < 0) {
5016                                 /* tte changed underneath us */
5017                                 if (pml) {
5018                                         sfmmu_mlist_exit(pml);
5019                                 }
5020                                 continue;
5021                         }
5022 
5023                         if (tteflags.tte_intlo & TTE_HWWR_INT) {
5024                                 /*
5025                                  * need to sync if we are clearing modify bit.
5026                                  */
5027                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5028                         }
5029 
5030                         if (pp && PP_ISRO(pp)) {
5031                                 if (tteattr.tte_intlo & TTE_WRPRM_INT) {
5032                                         pmtx = sfmmu_page_enter(pp);
5033                                         PP_CLRRO(pp);
5034                                         sfmmu_page_exit(pmtx);
5035                                 }
5036                         }
5037 
5038                         if (ret > 0 && use_demap_range) {
5039                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5040                         } else if (ret > 0) {
5041                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5042                         }
5043 
5044                         if (pml) {
5045                                 sfmmu_mlist_exit(pml);
5046                         }
5047                 }
5048 next_addr:
5049                 addr += TTEBYTES(ttesz);
5050                 sfhmep++;
5051                 DEMAP_RANGE_NEXTPG(dmrp);
5052         }
5053         return (addr);
5054 }
5055 
5056 /*
5057  * This routine converts virtual attributes to physical ones.  It will
5058  * update the tteflags field with the tte mask corresponding to the attributes
5059  * affected and it returns the new attributes.  It will also clear the modify
5060  * bit if we are taking away write permission.  This is necessary since the
5061  * modify bit is the hardware permission bit and we need to clear it in order
5062  * to detect write faults.
5063  */
5064 static uint64_t
5065 sfmmu_vtop_attr(uint_t attr, int mode, tte_t *ttemaskp)
5066 {
5067         tte_t ttevalue;
5068 
5069         ASSERT(!(attr & ~SFMMU_LOAD_ALLATTR));
5070 
5071         switch (mode) {
5072         case SFMMU_CHGATTR:
5073                 /* all attributes specified */
5074                 ttevalue.tte_inthi = MAKE_TTEATTR_INTHI(attr);
5075                 ttevalue.tte_intlo = MAKE_TTEATTR_INTLO(attr);
5076                 ttemaskp->tte_inthi = TTEINTHI_ATTR;
5077                 ttemaskp->tte_intlo = TTEINTLO_ATTR;
5078                 break;
5079         case SFMMU_SETATTR:
5080                 ASSERT(!(attr & ~HAT_PROT_MASK));
5081                 ttemaskp->ll = 0;
5082                 ttevalue.ll = 0;
5083                 /*
5084                  * a valid tte implies exec and read for sfmmu
5085                  * so no need to do anything about them.
5086                  * since priviledged access implies user access
5087                  * PROT_USER doesn't make sense either.
5088                  */
5089                 if (attr & PROT_WRITE) {
5090                         ttemaskp->tte_intlo |= TTE_WRPRM_INT;
5091                         ttevalue.tte_intlo |= TTE_WRPRM_INT;
5092                 }
5093                 break;
5094         case SFMMU_CLRATTR:
5095                 /* attributes will be nand with current ones */
5096                 if (attr & ~(PROT_WRITE | PROT_USER)) {
5097                         panic("sfmmu: attr %x not supported", attr);
5098                 }
5099                 ttemaskp->ll = 0;
5100                 ttevalue.ll = 0;
5101                 if (attr & PROT_WRITE) {
5102                         /* clear both writable and modify bit */
5103                         ttemaskp->tte_intlo |= TTE_WRPRM_INT | TTE_HWWR_INT;
5104                 }
5105                 if (attr & PROT_USER) {
5106                         ttemaskp->tte_intlo |= TTE_PRIV_INT;
5107                         ttevalue.tte_intlo |= TTE_PRIV_INT;
5108                 }
5109                 break;
5110         default:
5111                 panic("sfmmu_vtop_attr: bad mode %x", mode);
5112         }
5113         ASSERT(TTE_TO_TTEPFN(&ttevalue) == 0);
5114         return (ttevalue.ll);
5115 }
5116 
5117 static uint_t
5118 sfmmu_ptov_attr(tte_t *ttep)
5119 {
5120         uint_t attr;
5121 
5122         ASSERT(TTE_IS_VALID(ttep));
5123 
5124         attr = PROT_READ;
5125 
5126         if (TTE_IS_WRITABLE(ttep)) {
5127                 attr |= PROT_WRITE;
5128         }
5129         if (TTE_IS_EXECUTABLE(ttep)) {
5130                 attr |= PROT_EXEC;
5131         }
5132         if (!TTE_IS_PRIVILEGED(ttep)) {
5133                 attr |= PROT_USER;
5134         }
5135         if (TTE_IS_NFO(ttep)) {
5136                 attr |= HAT_NOFAULT;
5137         }
5138         if (TTE_IS_NOSYNC(ttep)) {
5139                 attr |= HAT_NOSYNC;
5140         }
5141         if (TTE_IS_SIDEFFECT(ttep)) {
5142                 attr |= SFMMU_SIDEFFECT;
5143         }
5144         if (!TTE_IS_VCACHEABLE(ttep)) {
5145                 attr |= SFMMU_UNCACHEVTTE;
5146         }
5147         if (!TTE_IS_PCACHEABLE(ttep)) {
5148                 attr |= SFMMU_UNCACHEPTTE;
5149         }
5150         return (attr);
5151 }
5152 
5153 /*
5154  * hat_chgprot is a deprecated hat call.  New segment drivers
5155  * should store all attributes and use hat_*attr calls.
5156  *
5157  * Change the protections in the virtual address range
5158  * given to the specified virtual protection.  If vprot is ~PROT_WRITE,
5159  * then remove write permission, leaving the other
5160  * permissions unchanged.  If vprot is ~PROT_USER, remove user permissions.
5161  *
5162  */
5163 void
5164 hat_chgprot(struct hat *sfmmup, caddr_t addr, size_t len, uint_t vprot)
5165 {
5166         struct hmehash_bucket *hmebp;
5167         hmeblk_tag hblktag;
5168         int hmeshift, hashno = 1;
5169         struct hme_blk *hmeblkp, *list = NULL;
5170         caddr_t endaddr;
5171         cpuset_t cpuset;
5172         demap_range_t dmr;
5173 
5174         ASSERT((len & MMU_PAGEOFFSET) == 0);
5175         ASSERT(((uintptr_t)addr & MMU_PAGEOFFSET) == 0);
5176 
5177         ASSERT(sfmmup->sfmmu_as != NULL);
5178 
5179         CPUSET_ZERO(cpuset);
5180 
5181         if ((vprot != (uint_t)~PROT_WRITE) && (vprot & PROT_USER) &&
5182             ((addr + len) > (caddr_t)USERLIMIT)) {
5183                 panic("user addr %p vprot %x in kernel space",
5184                     (void *)addr, vprot);
5185         }
5186         endaddr = addr + len;
5187         hblktag.htag_id = sfmmup;
5188         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5189         DEMAP_RANGE_INIT(sfmmup, &dmr);
5190 
5191         while (addr < endaddr) {
5192                 hmeshift = HME_HASH_SHIFT(hashno);
5193                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5194                 hblktag.htag_rehash = hashno;
5195                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5196 
5197                 SFMMU_HASH_LOCK(hmebp);
5198 
5199                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
5200                 if (hmeblkp != NULL) {
5201                         ASSERT(!hmeblkp->hblk_shared);
5202                         /*
5203                          * We've encountered a shadow hmeblk so skip the range
5204                          * of the next smaller mapping size.
5205                          */
5206                         if (hmeblkp->hblk_shw_bit) {
5207                                 ASSERT(sfmmup != ksfmmup);
5208                                 ASSERT(hashno > 1);
5209                                 addr = (caddr_t)P2END((uintptr_t)addr,
5210                                     TTEBYTES(hashno - 1));
5211                         } else {
5212                                 addr = sfmmu_hblk_chgprot(sfmmup, hmeblkp,
5213                                     addr, endaddr, &dmr, vprot);
5214                         }
5215                         SFMMU_HASH_UNLOCK(hmebp);
5216                         hashno = 1;
5217                         continue;
5218                 }
5219                 SFMMU_HASH_UNLOCK(hmebp);
5220 
5221                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
5222                         /*
5223                          * We have traversed the whole list and rehashed
5224                          * if necessary without finding the address to chgprot.
5225                          * This is ok so we increment the address by the
5226                          * smallest hmeblk range for kernel mappings and the
5227                          * largest hmeblk range, to account for shadow hmeblks,
5228                          * for user mappings and continue.
5229                          */
5230                         if (sfmmup == ksfmmup)
5231                                 addr = (caddr_t)P2END((uintptr_t)addr,
5232                                     TTEBYTES(1));
5233                         else
5234                                 addr = (caddr_t)P2END((uintptr_t)addr,
5235                                     TTEBYTES(hashno));
5236                         hashno = 1;
5237                 } else {
5238                         hashno++;
5239                 }
5240         }
5241 
5242         sfmmu_hblks_list_purge(&list, 0);
5243         DEMAP_RANGE_FLUSH(&dmr);
5244         cpuset = sfmmup->sfmmu_cpusran;
5245         xt_sync(cpuset);
5246 }
5247 
5248 /*
5249  * This function chgprots a range of addresses in an hmeblk.  It returns the
5250  * next addres that needs to be chgprot.
5251  * It should be called with the hash lock held.
5252  * XXX It shold be possible to optimize chgprot by not flushing every time but
5253  * on the other hand:
5254  * 1. do one flush crosscall.
5255  * 2. only flush if we are increasing permissions (make sure this will work)
5256  */
5257 static caddr_t
5258 sfmmu_hblk_chgprot(sfmmu_t *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5259     caddr_t endaddr, demap_range_t *dmrp, uint_t vprot)
5260 {
5261         uint_t pprot;
5262         tte_t tte, ttemod;
5263         struct sf_hment *sfhmep;
5264         uint_t tteflags;
5265         int ttesz;
5266         struct page *pp = NULL;
5267         kmutex_t *pml, *pmtx;
5268         int ret;
5269         int use_demap_range;
5270 #if defined(SF_ERRATA_57)
5271         int check_exec;
5272 #endif
5273 
5274         ASSERT(in_hblk_range(hmeblkp, addr));
5275         ASSERT(hmeblkp->hblk_shw_bit == 0);
5276         ASSERT(!hmeblkp->hblk_shared);
5277 
5278 #ifdef DEBUG
5279         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5280             (endaddr < get_hblk_endaddr(hmeblkp))) {
5281                 panic("sfmmu_hblk_chgprot: partial chgprot of large page");
5282         }
5283 #endif /* DEBUG */
5284 
5285         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5286         ttesz = get_hblk_ttesz(hmeblkp);
5287 
5288         pprot = sfmmu_vtop_prot(vprot, &tteflags);
5289 #if defined(SF_ERRATA_57)
5290         check_exec = (sfmmup != ksfmmup) &&
5291             AS_TYPE_64BIT(sfmmup->sfmmu_as) &&
5292             ((vprot & PROT_EXEC) == PROT_EXEC);
5293 #endif
5294         HBLKTOHME(sfhmep, hmeblkp, addr);
5295 
5296         /*
5297          * Flush the current demap region if addresses have been
5298          * skipped or the page size doesn't match.
5299          */
5300         use_demap_range = (TTEBYTES(ttesz) == MMU_PAGESIZE);
5301         if (use_demap_range) {
5302                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5303         } else if (dmrp != NULL) {
5304                 DEMAP_RANGE_FLUSH(dmrp);
5305         }
5306 
5307         while (addr < endaddr) {
5308                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5309                 if (TTE_IS_VALID(&tte)) {
5310                         if (TTE_GET_LOFLAGS(&tte, tteflags) == pprot) {
5311                                 /*
5312                                  * if the new protection is the same as old
5313                                  * continue
5314                                  */
5315                                 goto next_addr;
5316                         }
5317                         pml = NULL;
5318                         pp = sfhmep->hme_page;
5319                         if (pp) {
5320                                 pml = sfmmu_mlist_enter(pp);
5321                         }
5322                         if (pp != sfhmep->hme_page) {
5323                                 /*
5324                                  * tte most have been unloaded
5325                                  * underneath us.  Recheck
5326                                  */
5327                                 ASSERT(pml);
5328                                 sfmmu_mlist_exit(pml);
5329                                 continue;
5330                         }
5331 
5332                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5333 
5334                         ttemod = tte;
5335                         TTE_SET_LOFLAGS(&ttemod, tteflags, pprot);
5336 #if defined(SF_ERRATA_57)
5337                         if (check_exec && addr < errata57_limit)
5338                                 ttemod.tte_exec_perm = 0;
5339 #endif
5340                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5341                             &sfhmep->hme_tte);
5342 
5343                         if (ret < 0) {
5344                                 /* tte changed underneath us */
5345                                 if (pml) {
5346                                         sfmmu_mlist_exit(pml);
5347                                 }
5348                                 continue;
5349                         }
5350 
5351                         if (tteflags & TTE_HWWR_INT) {
5352                                 /*
5353                                  * need to sync if we are clearing modify bit.
5354                                  */
5355                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
5356                         }
5357 
5358                         if (pp && PP_ISRO(pp)) {
5359                                 if (pprot & TTE_WRPRM_INT) {
5360                                         pmtx = sfmmu_page_enter(pp);
5361                                         PP_CLRRO(pp);
5362                                         sfmmu_page_exit(pmtx);
5363                                 }
5364                         }
5365 
5366                         if (ret > 0 && use_demap_range) {
5367                                 DEMAP_RANGE_MARKPG(dmrp, addr);
5368                         } else if (ret > 0) {
5369                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
5370                         }
5371 
5372                         if (pml) {
5373                                 sfmmu_mlist_exit(pml);
5374                         }
5375                 }
5376 next_addr:
5377                 addr += TTEBYTES(ttesz);
5378                 sfhmep++;
5379                 DEMAP_RANGE_NEXTPG(dmrp);
5380         }
5381         return (addr);
5382 }
5383 
5384 /*
5385  * This routine is deprecated and should only be used by hat_chgprot.
5386  * The correct routine is sfmmu_vtop_attr.
5387  * This routine converts virtual page protections to physical ones.  It will
5388  * update the tteflags field with the tte mask corresponding to the protections
5389  * affected and it returns the new protections.  It will also clear the modify
5390  * bit if we are taking away write permission.  This is necessary since the
5391  * modify bit is the hardware permission bit and we need to clear it in order
5392  * to detect write faults.
5393  * It accepts the following special protections:
5394  * ~PROT_WRITE = remove write permissions.
5395  * ~PROT_USER = remove user permissions.
5396  */
5397 static uint_t
5398 sfmmu_vtop_prot(uint_t vprot, uint_t *tteflagsp)
5399 {
5400         if (vprot == (uint_t)~PROT_WRITE) {
5401                 *tteflagsp = TTE_WRPRM_INT | TTE_HWWR_INT;
5402                 return (0);             /* will cause wrprm to be cleared */
5403         }
5404         if (vprot == (uint_t)~PROT_USER) {
5405                 *tteflagsp = TTE_PRIV_INT;
5406                 return (0);             /* will cause privprm to be cleared */
5407         }
5408         if ((vprot == 0) || (vprot == PROT_USER) ||
5409             ((vprot & PROT_ALL) != vprot)) {
5410                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5411         }
5412 
5413         switch (vprot) {
5414         case (PROT_READ):
5415         case (PROT_EXEC):
5416         case (PROT_EXEC | PROT_READ):
5417                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5418                 return (TTE_PRIV_INT);          /* set prv and clr wrt */
5419         case (PROT_WRITE):
5420         case (PROT_WRITE | PROT_READ):
5421         case (PROT_EXEC | PROT_WRITE):
5422         case (PROT_EXEC | PROT_WRITE | PROT_READ):
5423                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5424                 return (TTE_PRIV_INT | TTE_WRPRM_INT);  /* set prv and wrt */
5425         case (PROT_USER | PROT_READ):
5426         case (PROT_USER | PROT_EXEC):
5427         case (PROT_USER | PROT_EXEC | PROT_READ):
5428                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT | TTE_HWWR_INT;
5429                 return (0);                     /* clr prv and wrt */
5430         case (PROT_USER | PROT_WRITE):
5431         case (PROT_USER | PROT_WRITE | PROT_READ):
5432         case (PROT_USER | PROT_EXEC | PROT_WRITE):
5433         case (PROT_USER | PROT_EXEC | PROT_WRITE | PROT_READ):
5434                 *tteflagsp = TTE_PRIV_INT | TTE_WRPRM_INT;
5435                 return (TTE_WRPRM_INT);         /* clr prv and set wrt */
5436         default:
5437                 panic("sfmmu_vtop_prot -- bad prot %x", vprot);
5438         }
5439         return (0);
5440 }
5441 
5442 /*
5443  * Alternate unload for very large virtual ranges. With a true 64 bit VA,
5444  * the normal algorithm would take too long for a very large VA range with
5445  * few real mappings. This routine just walks thru all HMEs in the global
5446  * hash table to find and remove mappings.
5447  */
5448 static void
5449 hat_unload_large_virtual(struct hat *sfmmup, caddr_t startaddr, size_t len,
5450     uint_t flags, hat_callback_t *callback)
5451 {
5452         struct hmehash_bucket *hmebp;
5453         struct hme_blk *hmeblkp;
5454         struct hme_blk *pr_hblk = NULL;
5455         struct hme_blk *nx_hblk;
5456         struct hme_blk *list = NULL;
5457         int i;
5458         demap_range_t dmr, *dmrp;
5459         cpuset_t cpuset;
5460         caddr_t endaddr = startaddr + len;
5461         caddr_t sa;
5462         caddr_t ea;
5463         caddr_t cb_sa[MAX_CB_ADDR];
5464         caddr_t cb_ea[MAX_CB_ADDR];
5465         int     addr_cnt = 0;
5466         int     a = 0;
5467 
5468         if (sfmmup->sfmmu_free) {
5469                 dmrp = NULL;
5470         } else {
5471                 dmrp = &dmr;
5472                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5473         }
5474 
5475         /*
5476          * Loop through all the hash buckets of HME blocks looking for matches.
5477          */
5478         for (i = 0; i <= UHMEHASH_SZ; i++) {
5479                 hmebp = &uhme_hash[i];
5480                 SFMMU_HASH_LOCK(hmebp);
5481                 hmeblkp = hmebp->hmeblkp;
5482                 pr_hblk = NULL;
5483                 while (hmeblkp) {
5484                         nx_hblk = hmeblkp->hblk_next;
5485 
5486                         /*
5487                          * skip if not this context, if a shadow block or
5488                          * if the mapping is not in the requested range
5489                          */
5490                         if (hmeblkp->hblk_tag.htag_id != sfmmup ||
5491                             hmeblkp->hblk_shw_bit ||
5492                             (sa = (caddr_t)get_hblk_base(hmeblkp)) >= endaddr ||
5493                             (ea = get_hblk_endaddr(hmeblkp)) <= startaddr) {
5494                                 pr_hblk = hmeblkp;
5495                                 goto next_block;
5496                         }
5497 
5498                         ASSERT(!hmeblkp->hblk_shared);
5499                         /*
5500                          * unload if there are any current valid mappings
5501                          */
5502                         if (hmeblkp->hblk_vcnt != 0 ||
5503                             hmeblkp->hblk_hmecnt != 0)
5504                                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
5505                                     sa, ea, dmrp, flags);
5506 
5507                         /*
5508                          * on unmap we also release the HME block itself, once
5509                          * all mappings are gone.
5510                          */
5511                         if ((flags & HAT_UNLOAD_UNMAP) != 0 &&
5512                             !hmeblkp->hblk_vcnt &&
5513                             !hmeblkp->hblk_hmecnt) {
5514                                 ASSERT(!hmeblkp->hblk_lckcnt);
5515                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5516                                     &list, 0);
5517                         } else {
5518                                 pr_hblk = hmeblkp;
5519                         }
5520 
5521                         if (callback == NULL)
5522                                 goto next_block;
5523 
5524                         /*
5525                          * HME blocks may span more than one page, but we may be
5526                          * unmapping only one page, so check for a smaller range
5527                          * for the callback
5528                          */
5529                         if (sa < startaddr)
5530                                 sa = startaddr;
5531                         if (--ea > endaddr)
5532                                 ea = endaddr - 1;
5533 
5534                         cb_sa[addr_cnt] = sa;
5535                         cb_ea[addr_cnt] = ea;
5536                         if (++addr_cnt == MAX_CB_ADDR) {
5537                                 if (dmrp != NULL) {
5538                                         DEMAP_RANGE_FLUSH(dmrp);
5539                                         cpuset = sfmmup->sfmmu_cpusran;
5540                                         xt_sync(cpuset);
5541                                 }
5542 
5543                                 for (a = 0; a < MAX_CB_ADDR; ++a) {
5544                                         callback->hcb_start_addr = cb_sa[a];
5545                                         callback->hcb_end_addr = cb_ea[a];
5546                                         callback->hcb_function(callback);
5547                                 }
5548                                 addr_cnt = 0;
5549                         }
5550 
5551 next_block:
5552                         hmeblkp = nx_hblk;
5553                 }
5554                 SFMMU_HASH_UNLOCK(hmebp);
5555         }
5556 
5557         sfmmu_hblks_list_purge(&list, 0);
5558         if (dmrp != NULL) {
5559                 DEMAP_RANGE_FLUSH(dmrp);
5560                 cpuset = sfmmup->sfmmu_cpusran;
5561                 xt_sync(cpuset);
5562         }
5563 
5564         for (a = 0; a < addr_cnt; ++a) {
5565                 callback->hcb_start_addr = cb_sa[a];
5566                 callback->hcb_end_addr = cb_ea[a];
5567                 callback->hcb_function(callback);
5568         }
5569 
5570         /*
5571          * Check TSB and TLB page sizes if the process isn't exiting.
5572          */
5573         if (!sfmmup->sfmmu_free)
5574                 sfmmu_check_page_sizes(sfmmup, 0);
5575 }
5576 
5577 /*
5578  * Unload all the mappings in the range [addr..addr+len). addr and len must
5579  * be MMU_PAGESIZE aligned.
5580  */
5581 
5582 extern struct seg *segkmap;
5583 #define ISSEGKMAP(sfmmup, addr) (sfmmup == ksfmmup && \
5584 segkmap->s_base <= (addr) && (addr) < (segkmap->s_base + segkmap->s_size))
5585 
5586 
5587 void
5588 hat_unload_callback(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags,
5589     hat_callback_t *callback)
5590 {
5591         struct hmehash_bucket *hmebp;
5592         hmeblk_tag hblktag;
5593         int hmeshift, hashno, iskernel;
5594         struct hme_blk *hmeblkp, *pr_hblk, *list = NULL;
5595         caddr_t endaddr;
5596         cpuset_t cpuset;
5597         int addr_count = 0;
5598         int a;
5599         caddr_t cb_start_addr[MAX_CB_ADDR];
5600         caddr_t cb_end_addr[MAX_CB_ADDR];
5601         int issegkmap = ISSEGKMAP(sfmmup, addr);
5602         demap_range_t dmr, *dmrp;
5603 
5604         ASSERT(sfmmup->sfmmu_as != NULL);
5605 
5606         ASSERT((sfmmup == ksfmmup) || (flags & HAT_UNLOAD_OTHER) || \
5607             AS_LOCK_HELD(sfmmup->sfmmu_as));
5608 
5609         ASSERT(sfmmup != NULL);
5610         ASSERT((len & MMU_PAGEOFFSET) == 0);
5611         ASSERT(!((uintptr_t)addr & MMU_PAGEOFFSET));
5612 
5613         /*
5614          * Probing through a large VA range (say 63 bits) will be slow, even
5615          * at 4 Meg steps between the probes. So, when the virtual address range
5616          * is very large, search the HME entries for what to unload.
5617          *
5618          *      len >> TTE_PAGE_SHIFT(TTE4M) is the # of 4Meg probes we'd need
5619          *
5620          *      UHMEHASH_SZ is number of hash buckets to examine
5621          *
5622          */
5623         if (sfmmup != KHATID && (len >> TTE_PAGE_SHIFT(TTE4M)) > UHMEHASH_SZ) {
5624                 hat_unload_large_virtual(sfmmup, addr, len, flags, callback);
5625                 return;
5626         }
5627 
5628         CPUSET_ZERO(cpuset);
5629 
5630         /*
5631          * If the process is exiting, we can save a lot of fuss since
5632          * we'll flush the TLB when we free the ctx anyway.
5633          */
5634         if (sfmmup->sfmmu_free) {
5635                 dmrp = NULL;
5636         } else {
5637                 dmrp = &dmr;
5638                 DEMAP_RANGE_INIT(sfmmup, dmrp);
5639         }
5640 
5641         endaddr = addr + len;
5642         hblktag.htag_id = sfmmup;
5643         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
5644 
5645         /*
5646          * It is likely for the vm to call unload over a wide range of
5647          * addresses that are actually very sparsely populated by
5648          * translations.  In order to speed this up the sfmmu hat supports
5649          * the concept of shadow hmeblks. Dummy large page hmeblks that
5650          * correspond to actual small translations are allocated at tteload
5651          * time and are referred to as shadow hmeblks.  Now, during unload
5652          * time, we first check if we have a shadow hmeblk for that
5653          * translation.  The absence of one means the corresponding address
5654          * range is empty and can be skipped.
5655          *
5656          * The kernel is an exception to above statement and that is why
5657          * we don't use shadow hmeblks and hash starting from the smallest
5658          * page size.
5659          */
5660         if (sfmmup == KHATID) {
5661                 iskernel = 1;
5662                 hashno = TTE64K;
5663         } else {
5664                 iskernel = 0;
5665                 if (mmu_page_sizes == max_mmu_page_sizes) {
5666                         hashno = TTE256M;
5667                 } else {
5668                         hashno = TTE4M;
5669                 }
5670         }
5671         while (addr < endaddr) {
5672                 hmeshift = HME_HASH_SHIFT(hashno);
5673                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
5674                 hblktag.htag_rehash = hashno;
5675                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
5676 
5677                 SFMMU_HASH_LOCK(hmebp);
5678 
5679                 HME_HASH_SEARCH_PREV(hmebp, hblktag, hmeblkp, pr_hblk, &list);
5680                 if (hmeblkp == NULL) {
5681                         /*
5682                          * didn't find an hmeblk. skip the appropiate
5683                          * address range.
5684                          */
5685                         SFMMU_HASH_UNLOCK(hmebp);
5686                         if (iskernel) {
5687                                 if (hashno < mmu_hashcnt) {
5688                                         hashno++;
5689                                         continue;
5690                                 } else {
5691                                         hashno = TTE64K;
5692                                         addr = (caddr_t)roundup((uintptr_t)addr
5693                                             + 1, MMU_PAGESIZE64K);
5694                                         continue;
5695                                 }
5696                         }
5697                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5698                             (1 << hmeshift));
5699                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5700                                 ASSERT(hashno == TTE64K);
5701                                 continue;
5702                         }
5703                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5704                                 hashno = TTE512K;
5705                                 continue;
5706                         }
5707                         if (mmu_page_sizes == max_mmu_page_sizes) {
5708                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5709                                         hashno = TTE4M;
5710                                         continue;
5711                                 }
5712                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5713                                         hashno = TTE32M;
5714                                         continue;
5715                                 }
5716                                 hashno = TTE256M;
5717                                 continue;
5718                         } else {
5719                                 hashno = TTE4M;
5720                                 continue;
5721                         }
5722                 }
5723                 ASSERT(hmeblkp);
5724                 ASSERT(!hmeblkp->hblk_shared);
5725                 if (!hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5726                         /*
5727                          * If the valid count is zero we can skip the range
5728                          * mapped by this hmeblk.
5729                          * We free hblks in the case of HAT_UNMAP.  HAT_UNMAP
5730                          * is used by segment drivers as a hint
5731                          * that the mapping resource won't be used any longer.
5732                          * The best example of this is during exit().
5733                          */
5734                         addr = (caddr_t)roundup((uintptr_t)addr + 1,
5735                             get_hblk_span(hmeblkp));
5736                         if ((flags & HAT_UNLOAD_UNMAP) ||
5737                             (iskernel && !issegkmap)) {
5738                                 sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk,
5739                                     &list, 0);
5740                         }
5741                         SFMMU_HASH_UNLOCK(hmebp);
5742 
5743                         if (iskernel) {
5744                                 hashno = TTE64K;
5745                                 continue;
5746                         }
5747                         if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5748                                 ASSERT(hashno == TTE64K);
5749                                 continue;
5750                         }
5751                         if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5752                                 hashno = TTE512K;
5753                                 continue;
5754                         }
5755                         if (mmu_page_sizes == max_mmu_page_sizes) {
5756                                 if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5757                                         hashno = TTE4M;
5758                                         continue;
5759                                 }
5760                                 if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5761                                         hashno = TTE32M;
5762                                         continue;
5763                                 }
5764                                 hashno = TTE256M;
5765                                 continue;
5766                         } else {
5767                                 hashno = TTE4M;
5768                                 continue;
5769                         }
5770                 }
5771                 if (hmeblkp->hblk_shw_bit) {
5772                         /*
5773                          * If we encounter a shadow hmeblk we know there is
5774                          * smaller sized hmeblks mapping the same address space.
5775                          * Decrement the hash size and rehash.
5776                          */
5777                         ASSERT(sfmmup != KHATID);
5778                         hashno--;
5779                         SFMMU_HASH_UNLOCK(hmebp);
5780                         continue;
5781                 }
5782 
5783                 /*
5784                  * track callback address ranges.
5785                  * only start a new range when it's not contiguous
5786                  */
5787                 if (callback != NULL) {
5788                         if (addr_count > 0 &&
5789                             addr == cb_end_addr[addr_count - 1])
5790                                 --addr_count;
5791                         else
5792                                 cb_start_addr[addr_count] = addr;
5793                 }
5794 
5795                 addr = sfmmu_hblk_unload(sfmmup, hmeblkp, addr, endaddr,
5796                     dmrp, flags);
5797 
5798                 if (callback != NULL)
5799                         cb_end_addr[addr_count++] = addr;
5800 
5801                 if (((flags & HAT_UNLOAD_UNMAP) || (iskernel && !issegkmap)) &&
5802                     !hmeblkp->hblk_vcnt && !hmeblkp->hblk_hmecnt) {
5803                         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 0);
5804                 }
5805                 SFMMU_HASH_UNLOCK(hmebp);
5806 
5807                 /*
5808                  * Notify our caller as to exactly which pages
5809                  * have been unloaded. We do these in clumps,
5810                  * to minimize the number of xt_sync()s that need to occur.
5811                  */
5812                 if (callback != NULL && addr_count == MAX_CB_ADDR) {
5813                         if (dmrp != NULL) {
5814                                 DEMAP_RANGE_FLUSH(dmrp);
5815                                 cpuset = sfmmup->sfmmu_cpusran;
5816                                 xt_sync(cpuset);
5817                         }
5818 
5819                         for (a = 0; a < MAX_CB_ADDR; ++a) {
5820                                 callback->hcb_start_addr = cb_start_addr[a];
5821                                 callback->hcb_end_addr = cb_end_addr[a];
5822                                 callback->hcb_function(callback);
5823                         }
5824                         addr_count = 0;
5825                 }
5826                 if (iskernel) {
5827                         hashno = TTE64K;
5828                         continue;
5829                 }
5830                 if ((uintptr_t)addr & MMU_PAGEOFFSET512K) {
5831                         ASSERT(hashno == TTE64K);
5832                         continue;
5833                 }
5834                 if ((uintptr_t)addr & MMU_PAGEOFFSET4M) {
5835                         hashno = TTE512K;
5836                         continue;
5837                 }
5838                 if (mmu_page_sizes == max_mmu_page_sizes) {
5839                         if ((uintptr_t)addr & MMU_PAGEOFFSET32M) {
5840                                 hashno = TTE4M;
5841                                 continue;
5842                         }
5843                         if ((uintptr_t)addr & MMU_PAGEOFFSET256M) {
5844                                 hashno = TTE32M;
5845                                 continue;
5846                         }
5847                         hashno = TTE256M;
5848                 } else {
5849                         hashno = TTE4M;
5850                 }
5851         }
5852 
5853         sfmmu_hblks_list_purge(&list, 0);
5854         if (dmrp != NULL) {
5855                 DEMAP_RANGE_FLUSH(dmrp);
5856                 cpuset = sfmmup->sfmmu_cpusran;
5857                 xt_sync(cpuset);
5858         }
5859         if (callback && addr_count != 0) {
5860                 for (a = 0; a < addr_count; ++a) {
5861                         callback->hcb_start_addr = cb_start_addr[a];
5862                         callback->hcb_end_addr = cb_end_addr[a];
5863                         callback->hcb_function(callback);
5864                 }
5865         }
5866 
5867         /*
5868          * Check TSB and TLB page sizes if the process isn't exiting.
5869          */
5870         if (!sfmmup->sfmmu_free)
5871                 sfmmu_check_page_sizes(sfmmup, 0);
5872 }
5873 
5874 /*
5875  * Unload all the mappings in the range [addr..addr+len). addr and len must
5876  * be MMU_PAGESIZE aligned.
5877  */
5878 void
5879 hat_unload(struct hat *sfmmup, caddr_t addr, size_t len, uint_t flags)
5880 {
5881         hat_unload_callback(sfmmup, addr, len, flags, NULL);
5882 }
5883 
5884 
5885 /*
5886  * Find the largest mapping size for this page.
5887  */
5888 int
5889 fnd_mapping_sz(page_t *pp)
5890 {
5891         int sz;
5892         int p_index;
5893 
5894         p_index = PP_MAPINDEX(pp);
5895 
5896         sz = 0;
5897         p_index >>= 1;    /* don't care about 8K bit */
5898         for (; p_index; p_index >>= 1) {
5899                 sz++;
5900         }
5901 
5902         return (sz);
5903 }
5904 
5905 /*
5906  * This function unloads a range of addresses for an hmeblk.
5907  * It returns the next address to be unloaded.
5908  * It should be called with the hash lock held.
5909  */
5910 static caddr_t
5911 sfmmu_hblk_unload(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
5912     caddr_t endaddr, demap_range_t *dmrp, uint_t flags)
5913 {
5914         tte_t   tte, ttemod;
5915         struct  sf_hment *sfhmep;
5916         int     ttesz;
5917         long    ttecnt;
5918         page_t *pp;
5919         kmutex_t *pml;
5920         int ret;
5921         int use_demap_range;
5922 
5923         ASSERT(in_hblk_range(hmeblkp, addr));
5924         ASSERT(!hmeblkp->hblk_shw_bit);
5925         ASSERT(sfmmup != NULL || hmeblkp->hblk_shared);
5926         ASSERT(sfmmup == NULL || !hmeblkp->hblk_shared);
5927         ASSERT(dmrp == NULL || !hmeblkp->hblk_shared);
5928 
5929 #ifdef DEBUG
5930         if (get_hblk_ttesz(hmeblkp) != TTE8K &&
5931             (endaddr < get_hblk_endaddr(hmeblkp))) {
5932                 panic("sfmmu_hblk_unload: partial unload of large page");
5933         }
5934 #endif /* DEBUG */
5935 
5936         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
5937         ttesz = get_hblk_ttesz(hmeblkp);
5938 
5939         use_demap_range = ((dmrp == NULL) ||
5940             (TTEBYTES(ttesz) == DEMAP_RANGE_PGSZ(dmrp)));
5941 
5942         if (use_demap_range) {
5943                 DEMAP_RANGE_CONTINUE(dmrp, addr, endaddr);
5944         } else if (dmrp != NULL) {
5945                 DEMAP_RANGE_FLUSH(dmrp);
5946         }
5947         ttecnt = 0;
5948         HBLKTOHME(sfhmep, hmeblkp, addr);
5949 
5950         while (addr < endaddr) {
5951                 pml = NULL;
5952                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
5953                 if (TTE_IS_VALID(&tte)) {
5954                         pp = sfhmep->hme_page;
5955                         if (pp != NULL) {
5956                                 pml = sfmmu_mlist_enter(pp);
5957                         }
5958 
5959                         /*
5960                          * Verify if hme still points to 'pp' now that
5961                          * we have p_mapping lock.
5962                          */
5963                         if (sfhmep->hme_page != pp) {
5964                                 if (pp != NULL && sfhmep->hme_page != NULL) {
5965                                         ASSERT(pml != NULL);
5966                                         sfmmu_mlist_exit(pml);
5967                                         /* Re-start this iteration. */
5968                                         continue;
5969                                 }
5970                                 ASSERT((pp != NULL) &&
5971                                     (sfhmep->hme_page == NULL));
5972                                 goto tte_unloaded;
5973                         }
5974 
5975                         /*
5976                          * This point on we have both HASH and p_mapping
5977                          * lock.
5978                          */
5979                         ASSERT(pp == sfhmep->hme_page);
5980                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
5981 
5982                         /*
5983                          * We need to loop on modify tte because it is
5984                          * possible for pagesync to come along and
5985                          * change the software bits beneath us.
5986                          *
5987                          * Page_unload can also invalidate the tte after
5988                          * we read tte outside of p_mapping lock.
5989                          */
5990 again:
5991                         ttemod = tte;
5992 
5993                         TTE_SET_INVALID(&ttemod);
5994                         ret = sfmmu_modifytte_try(&tte, &ttemod,
5995                             &sfhmep->hme_tte);
5996 
5997                         if (ret <= 0) {
5998                                 if (TTE_IS_VALID(&tte)) {
5999                                         ASSERT(ret < 0);
6000                                         goto again;
6001                                 }
6002                                 if (pp != NULL) {
6003                                         panic("sfmmu_hblk_unload: pp = 0x%p "
6004                                             "tte became invalid under mlist"
6005                                             " lock = 0x%p", (void *)pp,
6006                                             (void *)pml);
6007                                 }
6008                                 continue;
6009                         }
6010 
6011                         if (!(flags & HAT_UNLOAD_NOSYNC)) {
6012                                 sfmmu_ttesync(sfmmup, addr, &tte, pp);
6013                         }
6014 
6015                         /*
6016                          * Ok- we invalidated the tte. Do the rest of the job.
6017                          */
6018                         ttecnt++;
6019 
6020                         if (flags & HAT_UNLOAD_UNLOCK) {
6021                                 ASSERT(hmeblkp->hblk_lckcnt > 0);
6022                                 atomic_dec_32(&hmeblkp->hblk_lckcnt);
6023                                 HBLK_STACK_TRACE(hmeblkp, HBLK_UNLOCK);
6024                         }
6025 
6026                         /*
6027                          * Normally we would need to flush the page
6028                          * from the virtual cache at this point in
6029                          * order to prevent a potential cache alias
6030                          * inconsistency.
6031                          * The particular scenario we need to worry
6032                          * about is:
6033                          * Given:  va1 and va2 are two virtual address
6034                          * that alias and map the same physical
6035                          * address.
6036                          * 1.   mapping exists from va1 to pa and data
6037                          * has been read into the cache.
6038                          * 2.   unload va1.
6039                          * 3.   load va2 and modify data using va2.
6040                          * 4    unload va2.
6041                          * 5.   load va1 and reference data.  Unless we
6042                          * flush the data cache when we unload we will
6043                          * get stale data.
6044                          * Fortunately, page coloring eliminates the
6045                          * above scenario by remembering the color a
6046                          * physical page was last or is currently
6047                          * mapped to.  Now, we delay the flush until
6048                          * the loading of translations.  Only when the
6049                          * new translation is of a different color
6050                          * are we forced to flush.
6051                          */
6052                         if (use_demap_range) {
6053                                 /*
6054                                  * Mark this page as needing a demap.
6055                                  */
6056                                 DEMAP_RANGE_MARKPG(dmrp, addr);
6057                         } else {
6058                                 ASSERT(sfmmup != NULL);
6059                                 ASSERT(!hmeblkp->hblk_shared);
6060                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
6061                                     sfmmup->sfmmu_free, 0);
6062                         }
6063 
6064                         if (pp) {
6065                                 /*
6066                                  * Remove the hment from the mapping list
6067                                  */
6068                                 ASSERT(hmeblkp->hblk_hmecnt > 0);
6069 
6070                                 /*
6071                                  * Again, we cannot
6072                                  * ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS);
6073                                  */
6074                                 HME_SUB(sfhmep, pp);
6075                                 membar_stst();
6076                                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
6077                         }
6078 
6079                         ASSERT(hmeblkp->hblk_vcnt > 0);
6080                         atomic_dec_16(&hmeblkp->hblk_vcnt);
6081 
6082                         ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
6083                             !hmeblkp->hblk_lckcnt);
6084 
6085 #ifdef VAC
6086                         if (pp && (pp->p_nrm & (P_KPMC | P_KPMS | P_TNC))) {
6087                                 if (PP_ISTNC(pp)) {
6088                                         /*
6089                                          * If page was temporary
6090                                          * uncached, try to recache
6091                                          * it. Note that HME_SUB() was
6092                                          * called above so p_index and
6093                                          * mlist had been updated.
6094                                          */
6095                                         conv_tnc(pp, ttesz);
6096                                 } else if (pp->p_mapping == NULL) {
6097                                         ASSERT(kpm_enable);
6098                                         /*
6099                                          * Page is marked to be in VAC conflict
6100                                          * to an existing kpm mapping and/or is
6101                                          * kpm mapped using only the regular
6102                                          * pagesize.
6103                                          */
6104                                         sfmmu_kpm_hme_unload(pp);
6105                                 }
6106                         }
6107 #endif  /* VAC */
6108                 } else if ((pp = sfhmep->hme_page) != NULL) {
6109                                 /*
6110                                  * TTE is invalid but the hme
6111                                  * still exists. let pageunload
6112                                  * complete its job.
6113                                  */
6114                                 ASSERT(pml == NULL);
6115                                 pml = sfmmu_mlist_enter(pp);
6116                                 if (sfhmep->hme_page != NULL) {
6117                                         sfmmu_mlist_exit(pml);
6118                                         continue;
6119                                 }
6120                                 ASSERT(sfhmep->hme_page == NULL);
6121                 } else if (hmeblkp->hblk_hmecnt != 0) {
6122                         /*
6123                          * pageunload may have not finished decrementing
6124                          * hblk_vcnt and hblk_hmecnt. Find page_t if any and
6125                          * wait for pageunload to finish. Rely on pageunload
6126                          * to decrement hblk_hmecnt after hblk_vcnt.
6127                          */
6128                         pfn_t pfn = TTE_TO_TTEPFN(&tte);
6129                         ASSERT(pml == NULL);
6130                         if (pf_is_memory(pfn)) {
6131                                 pp = page_numtopp_nolock(pfn);
6132                                 if (pp != NULL) {
6133                                         pml = sfmmu_mlist_enter(pp);
6134                                         sfmmu_mlist_exit(pml);
6135                                         pml = NULL;
6136                                 }
6137                         }
6138                 }
6139 
6140 tte_unloaded:
6141                 /*
6142                  * At this point, the tte we are looking at
6143                  * should be unloaded, and hme has been unlinked
6144                  * from page too. This is important because in
6145                  * pageunload, it does ttesync() then HME_SUB.
6146                  * We need to make sure HME_SUB has been completed
6147                  * so we know ttesync() has been completed. Otherwise,
6148                  * at exit time, after return from hat layer, VM will
6149                  * release as structure which hat_setstat() (called
6150                  * by ttesync()) needs.
6151                  */
6152 #ifdef DEBUG
6153                 {
6154                         tte_t   dtte;
6155 
6156                         ASSERT(sfhmep->hme_page == NULL);
6157 
6158                         sfmmu_copytte(&sfhmep->hme_tte, &dtte);
6159                         ASSERT(!TTE_IS_VALID(&dtte));
6160                 }
6161 #endif
6162 
6163                 if (pml) {
6164                         sfmmu_mlist_exit(pml);
6165                 }
6166 
6167                 addr += TTEBYTES(ttesz);
6168                 sfhmep++;
6169                 DEMAP_RANGE_NEXTPG(dmrp);
6170         }
6171         /*
6172          * For shared hmeblks this routine is only called when region is freed
6173          * and no longer referenced.  So no need to decrement ttecnt
6174          * in the region structure here.
6175          */
6176         if (ttecnt > 0 && sfmmup != NULL) {
6177                 atomic_add_long(&sfmmup->sfmmu_ttecnt[ttesz], -ttecnt);
6178         }
6179         return (addr);
6180 }
6181 
6182 /*
6183  * Invalidate a virtual address range for the local CPU.
6184  * For best performance ensure that the va range is completely
6185  * mapped, otherwise the entire TLB will be flushed.
6186  */
6187 void
6188 hat_flush_range(struct hat *sfmmup, caddr_t va, size_t size)
6189 {
6190         ssize_t sz;
6191         caddr_t endva = va + size;
6192 
6193         while (va < endva) {
6194                 sz = hat_getpagesize(sfmmup, va);
6195                 if (sz < 0) {
6196                         vtag_flushall();
6197                         break;
6198                 }
6199                 vtag_flushpage(va, (uint64_t)sfmmup);
6200                 va += sz;
6201         }
6202 }
6203 
6204 /*
6205  * Synchronize all the mappings in the range [addr..addr+len).
6206  * Can be called with clearflag having two states:
6207  * HAT_SYNC_DONTZERO means just return the rm stats
6208  * HAT_SYNC_ZERORM means zero rm bits in the tte and return the stats
6209  */
6210 void
6211 hat_sync(struct hat *sfmmup, caddr_t addr, size_t len, uint_t clearflag)
6212 {
6213         struct hmehash_bucket *hmebp;
6214         hmeblk_tag hblktag;
6215         int hmeshift, hashno = 1;
6216         struct hme_blk *hmeblkp, *list = NULL;
6217         caddr_t endaddr;
6218         cpuset_t cpuset;
6219 
6220         ASSERT((sfmmup == ksfmmup) || AS_LOCK_HELD(sfmmup->sfmmu_as));
6221         ASSERT((len & MMU_PAGEOFFSET) == 0);
6222         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
6223             (clearflag == HAT_SYNC_ZERORM));
6224 
6225         CPUSET_ZERO(cpuset);
6226 
6227         endaddr = addr + len;
6228         hblktag.htag_id = sfmmup;
6229         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
6230 
6231         /*
6232          * Spitfire supports 4 page sizes.
6233          * Most pages are expected to be of the smallest page
6234          * size (8K) and these will not need to be rehashed. 64K
6235          * pages also don't need to be rehashed because the an hmeblk
6236          * spans 64K of address space. 512K pages might need 1 rehash and
6237          * and 4M pages 2 rehashes.
6238          */
6239         while (addr < endaddr) {
6240                 hmeshift = HME_HASH_SHIFT(hashno);
6241                 hblktag.htag_bspage = HME_HASH_BSPAGE(addr, hmeshift);
6242                 hblktag.htag_rehash = hashno;
6243                 hmebp = HME_HASH_FUNCTION(sfmmup, addr, hmeshift);
6244 
6245                 SFMMU_HASH_LOCK(hmebp);
6246 
6247                 HME_HASH_SEARCH(hmebp, hblktag, hmeblkp, &list);
6248                 if (hmeblkp != NULL) {
6249                         ASSERT(!hmeblkp->hblk_shared);
6250                         /*
6251                          * We've encountered a shadow hmeblk so skip the range
6252                          * of the next smaller mapping size.
6253                          */
6254                         if (hmeblkp->hblk_shw_bit) {
6255                                 ASSERT(sfmmup != ksfmmup);
6256                                 ASSERT(hashno > 1);
6257                                 addr = (caddr_t)P2END((uintptr_t)addr,
6258                                     TTEBYTES(hashno - 1));
6259                         } else {
6260                                 addr = sfmmu_hblk_sync(sfmmup, hmeblkp,
6261                                     addr, endaddr, clearflag);
6262                         }
6263                         SFMMU_HASH_UNLOCK(hmebp);
6264                         hashno = 1;
6265                         continue;
6266                 }
6267                 SFMMU_HASH_UNLOCK(hmebp);
6268 
6269                 if (!HME_REHASH(sfmmup) || (hashno >= mmu_hashcnt)) {
6270                         /*
6271                          * We have traversed the whole list and rehashed
6272                          * if necessary without finding the address to sync.
6273                          * This is ok so we increment the address by the
6274                          * smallest hmeblk range for kernel mappings and the
6275                          * largest hmeblk range, to account for shadow hmeblks,
6276                          * for user mappings and continue.
6277                          */
6278                         if (sfmmup == ksfmmup)
6279                                 addr = (caddr_t)P2END((uintptr_t)addr,
6280                                     TTEBYTES(1));
6281                         else
6282                                 addr = (caddr_t)P2END((uintptr_t)addr,
6283                                     TTEBYTES(hashno));
6284                         hashno = 1;
6285                 } else {
6286                         hashno++;
6287                 }
6288         }
6289         sfmmu_hblks_list_purge(&list, 0);
6290         cpuset = sfmmup->sfmmu_cpusran;
6291         xt_sync(cpuset);
6292 }
6293 
6294 static caddr_t
6295 sfmmu_hblk_sync(struct hat *sfmmup, struct hme_blk *hmeblkp, caddr_t addr,
6296     caddr_t endaddr, int clearflag)
6297 {
6298         tte_t   tte, ttemod;
6299         struct sf_hment *sfhmep;
6300         int ttesz;
6301         struct page *pp;
6302         kmutex_t *pml;
6303         int ret;
6304 
6305         ASSERT(hmeblkp->hblk_shw_bit == 0);
6306         ASSERT(!hmeblkp->hblk_shared);
6307 
6308         endaddr = MIN(endaddr, get_hblk_endaddr(hmeblkp));
6309 
6310         ttesz = get_hblk_ttesz(hmeblkp);
6311         HBLKTOHME(sfhmep, hmeblkp, addr);
6312 
6313         while (addr < endaddr) {
6314                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6315                 if (TTE_IS_VALID(&tte)) {
6316                         pml = NULL;
6317                         pp = sfhmep->hme_page;
6318                         if (pp) {
6319                                 pml = sfmmu_mlist_enter(pp);
6320                         }
6321                         if (pp != sfhmep->hme_page) {
6322                                 /*
6323                                  * tte most have been unloaded
6324                                  * underneath us.  Recheck
6325                                  */
6326                                 ASSERT(pml);
6327                                 sfmmu_mlist_exit(pml);
6328                                 continue;
6329                         }
6330 
6331                         ASSERT(pp == NULL || sfmmu_mlist_held(pp));
6332 
6333                         if (clearflag == HAT_SYNC_ZERORM) {
6334                                 ttemod = tte;
6335                                 TTE_CLR_RM(&ttemod);
6336                                 ret = sfmmu_modifytte_try(&tte, &ttemod,
6337                                     &sfhmep->hme_tte);
6338                                 if (ret < 0) {
6339                                         if (pml) {
6340                                                 sfmmu_mlist_exit(pml);
6341                                         }
6342                                         continue;
6343                                 }
6344 
6345                                 if (ret > 0) {
6346                                         sfmmu_tlb_demap(addr, sfmmup,
6347                                             hmeblkp, 0, 0);
6348                                 }
6349                         }
6350                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
6351                         if (pml) {
6352                                 sfmmu_mlist_exit(pml);
6353                         }
6354                 }
6355                 addr += TTEBYTES(ttesz);
6356                 sfhmep++;
6357         }
6358         return (addr);
6359 }
6360 
6361 /*
6362  * This function will sync a tte to the page struct and it will
6363  * update the hat stats. Currently it allows us to pass a NULL pp
6364  * and we will simply update the stats.  We may want to change this
6365  * so we only keep stats for pages backed by pp's.
6366  */
6367 static void
6368 sfmmu_ttesync(struct hat *sfmmup, caddr_t addr, tte_t *ttep, page_t *pp)
6369 {
6370         uint_t rm = 0;
6371         int     sz;
6372         pgcnt_t npgs;
6373 
6374         ASSERT(TTE_IS_VALID(ttep));
6375 
6376         if (TTE_IS_NOSYNC(ttep)) {
6377                 return;
6378         }
6379 
6380         if (TTE_IS_REF(ttep))  {
6381                 rm = P_REF;
6382         }
6383         if (TTE_IS_MOD(ttep))  {
6384                 rm |= P_MOD;
6385         }
6386 
6387         if (rm == 0) {
6388                 return;
6389         }
6390 
6391         sz = TTE_CSZ(ttep);
6392         if (sfmmup != NULL && sfmmup->sfmmu_rmstat) {
6393                 int i;
6394                 caddr_t vaddr = addr;
6395 
6396                 for (i = 0; i < TTEPAGES(sz); i++, vaddr += MMU_PAGESIZE) {
6397                         hat_setstat(sfmmup->sfmmu_as, vaddr, MMU_PAGESIZE, rm);
6398                 }
6399 
6400         }
6401 
6402         /*
6403          * XXX I want to use cas to update nrm bits but they
6404          * currently belong in common/vm and not in hat where
6405          * they should be.
6406          * The nrm bits are protected by the same mutex as
6407          * the one that protects the page's mapping list.
6408          */
6409         if (!pp)
6410                 return;
6411         ASSERT(sfmmu_mlist_held(pp));
6412         /*
6413          * If the tte is for a large page, we need to sync all the
6414          * pages covered by the tte.
6415          */
6416         if (sz != TTE8K) {
6417                 ASSERT(pp->p_szc != 0);
6418                 pp = PP_GROUPLEADER(pp, sz);
6419                 ASSERT(sfmmu_mlist_held(pp));
6420         }
6421 
6422         /* Get number of pages from tte size. */
6423         npgs = TTEPAGES(sz);
6424 
6425         do {
6426                 ASSERT(pp);
6427                 ASSERT(sfmmu_mlist_held(pp));
6428                 if (((rm & P_REF) != 0 && !PP_ISREF(pp)) ||
6429                     ((rm & P_MOD) != 0 && !PP_ISMOD(pp)))
6430                         hat_page_setattr(pp, rm);
6431 
6432                 /*
6433                  * Are we done? If not, we must have a large mapping.
6434                  * For large mappings we need to sync the rest of the pages
6435                  * covered by this tte; goto the next page.
6436                  */
6437         } while (--npgs > 0 && (pp = PP_PAGENEXT(pp)));
6438 }
6439 
6440 /*
6441  * Execute pre-callback handler of each pa_hment linked to pp
6442  *
6443  * Inputs:
6444  *   flag: either HAT_PRESUSPEND or HAT_SUSPEND.
6445  *   capture_cpus: pointer to return value (below)
6446  *
6447  * Returns:
6448  *   Propagates the subsystem callback return values back to the caller;
6449  *   returns 0 on success.  If capture_cpus is non-NULL, the value returned
6450  *   is zero if all of the pa_hments are of a type that do not require
6451  *   capturing CPUs prior to suspending the mapping, else it is 1.
6452  */
6453 static int
6454 hat_pageprocess_precallbacks(struct page *pp, uint_t flag, int *capture_cpus)
6455 {
6456         struct sf_hment *sfhmep;
6457         struct pa_hment *pahmep;
6458         int (*f)(caddr_t, uint_t, uint_t, void *);
6459         int             ret;
6460         id_t            id;
6461         int             locked = 0;
6462         kmutex_t        *pml;
6463 
6464         ASSERT(PAGE_EXCL(pp));
6465         if (!sfmmu_mlist_held(pp)) {
6466                 pml = sfmmu_mlist_enter(pp);
6467                 locked = 1;
6468         }
6469 
6470         if (capture_cpus)
6471                 *capture_cpus = 0;
6472 
6473 top:
6474         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6475                 /*
6476                  * skip sf_hments corresponding to VA<->PA mappings;
6477                  * for pa_hment's, hme_tte.ll is zero
6478                  */
6479                 if (!IS_PAHME(sfhmep))
6480                         continue;
6481 
6482                 pahmep = sfhmep->hme_data;
6483                 ASSERT(pahmep != NULL);
6484 
6485                 /*
6486                  * skip if pre-handler has been called earlier in this loop
6487                  */
6488                 if (pahmep->flags & flag)
6489                         continue;
6490 
6491                 id = pahmep->cb_id;
6492                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6493                 if (capture_cpus && sfmmu_cb_table[id].capture_cpus != 0)
6494                         *capture_cpus = 1;
6495                 if ((f = sfmmu_cb_table[id].prehandler) == NULL) {
6496                         pahmep->flags |= flag;
6497                         continue;
6498                 }
6499 
6500                 /*
6501                  * Drop the mapping list lock to avoid locking order issues.
6502                  */
6503                 if (locked)
6504                         sfmmu_mlist_exit(pml);
6505 
6506                 ret = f(pahmep->addr, pahmep->len, flag, pahmep->pvt);
6507                 if (ret != 0)
6508                         return (ret);   /* caller must do the cleanup */
6509 
6510                 if (locked) {
6511                         pml = sfmmu_mlist_enter(pp);
6512                         pahmep->flags |= flag;
6513                         goto top;
6514                 }
6515 
6516                 pahmep->flags |= flag;
6517         }
6518 
6519         if (locked)
6520                 sfmmu_mlist_exit(pml);
6521 
6522         return (0);
6523 }
6524 
6525 /*
6526  * Execute post-callback handler of each pa_hment linked to pp
6527  *
6528  * Same overall assumptions and restrictions apply as for
6529  * hat_pageprocess_precallbacks().
6530  */
6531 static void
6532 hat_pageprocess_postcallbacks(struct page *pp, uint_t flag)
6533 {
6534         pfn_t pgpfn = pp->p_pagenum;
6535         pfn_t pgmask = btop(page_get_pagesize(pp->p_szc)) - 1;
6536         pfn_t newpfn;
6537         struct sf_hment *sfhmep;
6538         struct pa_hment *pahmep;
6539         int (*f)(caddr_t, uint_t, uint_t, void *, pfn_t);
6540         id_t    id;
6541         int     locked = 0;
6542         kmutex_t *pml;
6543 
6544         ASSERT(PAGE_EXCL(pp));
6545         if (!sfmmu_mlist_held(pp)) {
6546                 pml = sfmmu_mlist_enter(pp);
6547                 locked = 1;
6548         }
6549 
6550 top:
6551         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6552                 /*
6553                  * skip sf_hments corresponding to VA<->PA mappings;
6554                  * for pa_hment's, hme_tte.ll is zero
6555                  */
6556                 if (!IS_PAHME(sfhmep))
6557                         continue;
6558 
6559                 pahmep = sfhmep->hme_data;
6560                 ASSERT(pahmep != NULL);
6561 
6562                 if ((pahmep->flags & flag) == 0)
6563                         continue;
6564 
6565                 pahmep->flags &= ~flag;
6566 
6567                 id = pahmep->cb_id;
6568                 ASSERT(id >= (id_t)0 && id < sfmmu_cb_nextid);
6569                 if ((f = sfmmu_cb_table[id].posthandler) == NULL)
6570                         continue;
6571 
6572                 /*
6573                  * Convert the base page PFN into the constituent PFN
6574                  * which is needed by the callback handler.
6575                  */
6576                 newpfn = pgpfn | (btop((uintptr_t)pahmep->addr) & pgmask);
6577 
6578                 /*
6579                  * Drop the mapping list lock to avoid locking order issues.
6580                  */
6581                 if (locked)
6582                         sfmmu_mlist_exit(pml);
6583 
6584                 if (f(pahmep->addr, pahmep->len, flag, pahmep->pvt, newpfn)
6585                     != 0)
6586                         panic("sfmmu: posthandler failed");
6587 
6588                 if (locked) {
6589                         pml = sfmmu_mlist_enter(pp);
6590                         goto top;
6591                 }
6592         }
6593 
6594         if (locked)
6595                 sfmmu_mlist_exit(pml);
6596 }
6597 
6598 /*
6599  * Suspend locked kernel mapping
6600  */
6601 void
6602 hat_pagesuspend(struct page *pp)
6603 {
6604         struct sf_hment *sfhmep;
6605         sfmmu_t *sfmmup;
6606         tte_t tte, ttemod;
6607         struct hme_blk *hmeblkp;
6608         caddr_t addr;
6609         int index, cons;
6610         cpuset_t cpuset;
6611 
6612         ASSERT(PAGE_EXCL(pp));
6613         ASSERT(sfmmu_mlist_held(pp));
6614 
6615         mutex_enter(&kpr_suspendlock);
6616 
6617         /*
6618          * We're about to suspend a kernel mapping so mark this thread as
6619          * non-traceable by DTrace. This prevents us from running into issues
6620          * with probe context trying to touch a suspended page
6621          * in the relocation codepath itself.
6622          */
6623         curthread->t_flag |= T_DONTDTRACE;
6624 
6625         index = PP_MAPINDEX(pp);
6626         cons = TTE8K;
6627 
6628 retry:
6629         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
6630 
6631                 if (IS_PAHME(sfhmep))
6632                         continue;
6633 
6634                 if (get_hblk_ttesz(sfmmu_hmetohblk(sfhmep)) != cons)
6635                         continue;
6636 
6637                 /*
6638                  * Loop until we successfully set the suspend bit in
6639                  * the TTE.
6640                  */
6641 again:
6642                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
6643                 ASSERT(TTE_IS_VALID(&tte));
6644 
6645                 ttemod = tte;
6646                 TTE_SET_SUSPEND(&ttemod);
6647                 if (sfmmu_modifytte_try(&tte, &ttemod,
6648                     &sfhmep->hme_tte) < 0)
6649                         goto again;
6650 
6651                 /*
6652                  * Invalidate TSB entry
6653                  */
6654                 hmeblkp = sfmmu_hmetohblk(sfhmep);
6655 
6656                 sfmmup = hblktosfmmu(hmeblkp);
6657                 ASSERT(sfmmup == ksfmmup);
6658                 ASSERT(!hmeblkp->hblk_shared);
6659 
6660                 addr = tte_to_vaddr(hmeblkp, tte);
6661 
6662                 /*
6663                  * No need to make sure that the TSB for this sfmmu is
6664                  * not being relocated since it is ksfmmup and thus it
6665                  * will never be relocated.
6666                  */
6667                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
6668 
6669                 /*
6670                  * Update xcall stats
6671                  */
6672                 cpuset = cpu_ready_set;
6673                 CPUSET_DEL(cpuset, CPU->cpu_id);
6674 
6675                 /* LINTED: constant in conditional context */
6676                 SFMMU_XCALL_STATS(ksfmmup);
6677 
6678                 /*
6679                  * Flush TLB entry on remote CPU's
6680                  */
6681                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
6682                     (uint64_t)ksfmmup);
6683                 xt_sync(cpuset);
6684 
6685                 /*
6686                  * Flush TLB entry on local CPU
6687                  */
6688                 vtag_flushpage(addr, (uint64_t)ksfmmup);
6689         }
6690 
6691         while (index != 0) {
6692                 index = index >> 1;
6693                 if (index != 0)
6694                         cons++;
6695                 if (index & 0x1) {
6696                         pp = PP_GROUPLEADER(pp, cons);
6697                         goto retry;
6698                 }
6699         }
6700 }
6701 
6702 #ifdef  DEBUG
6703 
6704 #define N_PRLE  1024
6705 struct prle {
6706         page_t *targ;
6707         page_t *repl;
6708         int status;
6709         int pausecpus;
6710         hrtime_t whence;
6711 };
6712 
6713 static struct prle page_relocate_log[N_PRLE];
6714 static int prl_entry;
6715 static kmutex_t prl_mutex;
6716 
6717 #define PAGE_RELOCATE_LOG(t, r, s, p)                                   \
6718         mutex_enter(&prl_mutex);                                    \
6719         page_relocate_log[prl_entry].targ = *(t);                       \
6720         page_relocate_log[prl_entry].repl = *(r);                       \
6721         page_relocate_log[prl_entry].status = (s);                      \
6722         page_relocate_log[prl_entry].pausecpus = (p);                   \
6723         page_relocate_log[prl_entry].whence = gethrtime();              \
6724         prl_entry = (prl_entry == (N_PRLE - 1))? 0 : prl_entry + 1;     \
6725         mutex_exit(&prl_mutex);
6726 
6727 #else   /* !DEBUG */
6728 #define PAGE_RELOCATE_LOG(t, r, s, p)
6729 #endif
6730 
6731 /*
6732  * Core Kernel Page Relocation Algorithm
6733  *
6734  * Input:
6735  *
6736  * target :     constituent pages are SE_EXCL locked.
6737  * replacement: constituent pages are SE_EXCL locked.
6738  *
6739  * Output:
6740  *
6741  * nrelocp:     number of pages relocated
6742  */
6743 int
6744 hat_page_relocate(page_t **target, page_t **replacement, spgcnt_t *nrelocp)
6745 {
6746         page_t          *targ, *repl;
6747         page_t          *tpp, *rpp;
6748         kmutex_t        *low, *high;
6749         spgcnt_t        npages, i;
6750         page_t          *pl = NULL;
6751         int             old_pil;
6752         cpuset_t        cpuset;
6753         int             cap_cpus;
6754         int             ret;
6755 #ifdef VAC
6756         int             cflags = 0;
6757 #endif
6758 
6759         if (!kcage_on || PP_ISNORELOC(*target)) {
6760                 PAGE_RELOCATE_LOG(target, replacement, EAGAIN, -1);
6761                 return (EAGAIN);
6762         }
6763 
6764         mutex_enter(&kpr_mutex);
6765         kreloc_thread = curthread;
6766 
6767         targ = *target;
6768         repl = *replacement;
6769         ASSERT(repl != NULL);
6770         ASSERT(targ->p_szc == repl->p_szc);
6771 
6772         npages = page_get_pagecnt(targ->p_szc);
6773 
6774         /*
6775          * unload VA<->PA mappings that are not locked
6776          */
6777         tpp = targ;
6778         for (i = 0; i < npages; i++) {
6779                 (void) hat_pageunload(tpp, SFMMU_KERNEL_RELOC);
6780                 tpp++;
6781         }
6782 
6783         /*
6784          * Do "presuspend" callbacks, in a context from which we can still
6785          * block as needed. Note that we don't hold the mapping list lock
6786          * of "targ" at this point due to potential locking order issues;
6787          * we assume that between the hat_pageunload() above and holding
6788          * the SE_EXCL lock that the mapping list *cannot* change at this
6789          * point.
6790          */
6791         ret = hat_pageprocess_precallbacks(targ, HAT_PRESUSPEND, &cap_cpus);
6792         if (ret != 0) {
6793                 /*
6794                  * EIO translates to fatal error, for all others cleanup
6795                  * and return EAGAIN.
6796                  */
6797                 ASSERT(ret != EIO);
6798                 hat_pageprocess_postcallbacks(targ, HAT_POSTUNSUSPEND);
6799                 PAGE_RELOCATE_LOG(target, replacement, ret, -1);
6800                 kreloc_thread = NULL;
6801                 mutex_exit(&kpr_mutex);
6802                 return (EAGAIN);
6803         }
6804 
6805         /*
6806          * acquire p_mapping list lock for both the target and replacement
6807          * root pages.
6808          *
6809          * low and high refer to the need to grab the mlist locks in a
6810          * specific order in order to prevent race conditions.  Thus the
6811          * lower lock must be grabbed before the higher lock.
6812          *
6813          * This will block hat_unload's accessing p_mapping list.  Since
6814          * we have SE_EXCL lock, hat_memload and hat_pageunload will be
6815          * blocked.  Thus, no one else will be accessing the p_mapping list
6816          * while we suspend and reload the locked mapping below.
6817          */
6818         tpp = targ;
6819         rpp = repl;
6820         sfmmu_mlist_reloc_enter(tpp, rpp, &low, &high);
6821 
6822         kpreempt_disable();
6823 
6824         /*
6825          * We raise our PIL to 13 so that we don't get captured by
6826          * another CPU or pinned by an interrupt thread.  We can't go to
6827          * PIL 14 since the nexus driver(s) may need to interrupt at
6828          * that level in the case of IOMMU pseudo mappings.
6829          */
6830         cpuset = cpu_ready_set;
6831         CPUSET_DEL(cpuset, CPU->cpu_id);
6832         if (!cap_cpus || CPUSET_ISNULL(cpuset)) {
6833                 old_pil = splr(XCALL_PIL);
6834         } else {
6835                 old_pil = -1;
6836                 xc_attention(cpuset);
6837         }
6838         ASSERT(getpil() == XCALL_PIL);
6839 
6840         /*
6841          * Now do suspend callbacks. In the case of an IOMMU mapping
6842          * this will suspend all DMA activity to the page while it is
6843          * being relocated. Since we are well above LOCK_LEVEL and CPUs
6844          * may be captured at this point we should have acquired any needed
6845          * locks in the presuspend callback.
6846          */
6847         ret = hat_pageprocess_precallbacks(targ, HAT_SUSPEND, NULL);
6848         if (ret != 0) {
6849                 repl = targ;
6850                 goto suspend_fail;
6851         }
6852 
6853         /*
6854          * Raise the PIL yet again, this time to block all high-level
6855          * interrupts on this CPU. This is necessary to prevent an
6856          * interrupt routine from pinning the thread which holds the
6857          * mapping suspended and then touching the suspended page.
6858          *
6859          * Once the page is suspended we also need to be careful to
6860          * avoid calling any functions which touch any seg_kmem memory
6861          * since that memory may be backed by the very page we are
6862          * relocating in here!
6863          */
6864         hat_pagesuspend(targ);
6865 
6866         /*
6867          * Now that we are confident everybody has stopped using this page,
6868          * copy the page contents.  Note we use a physical copy to prevent
6869          * locking issues and to avoid fpRAS because we can't handle it in
6870          * this context.
6871          */
6872         for (i = 0; i < npages; i++, tpp++, rpp++) {
6873 #ifdef VAC
6874                 /*
6875                  * If the replacement has a different vcolor than
6876                  * the one being replacd, we need to handle VAC
6877                  * consistency for it just as we were setting up
6878                  * a new mapping to it.
6879                  */
6880                 if ((PP_GET_VCOLOR(rpp) != NO_VCOLOR) &&
6881                     (tpp->p_vcolor != rpp->p_vcolor) &&
6882                     !CacheColor_IsFlushed(cflags, PP_GET_VCOLOR(rpp))) {
6883                         CacheColor_SetFlushed(cflags, PP_GET_VCOLOR(rpp));
6884                         sfmmu_cache_flushcolor(PP_GET_VCOLOR(rpp),
6885                             rpp->p_pagenum);
6886                 }
6887 #endif
6888                 /*
6889                  * Copy the contents of the page.
6890                  */
6891                 ppcopy_kernel(tpp, rpp);
6892         }
6893 
6894         tpp = targ;
6895         rpp = repl;
6896         for (i = 0; i < npages; i++, tpp++, rpp++) {
6897                 /*
6898                  * Copy attributes.  VAC consistency was handled above,
6899                  * if required.
6900                  */
6901                 rpp->p_nrm = tpp->p_nrm;
6902                 tpp->p_nrm = 0;
6903                 rpp->p_index = tpp->p_index;
6904                 tpp->p_index = 0;
6905 #ifdef VAC
6906                 rpp->p_vcolor = tpp->p_vcolor;
6907 #endif
6908         }
6909 
6910         /*
6911          * First, unsuspend the page, if we set the suspend bit, and transfer
6912          * the mapping list from the target page to the replacement page.
6913          * Next process postcallbacks; since pa_hment's are linked only to the
6914          * p_mapping list of root page, we don't iterate over the constituent
6915          * pages.
6916          */
6917         hat_pagereload(targ, repl);
6918 
6919 suspend_fail:
6920         hat_pageprocess_postcallbacks(repl, HAT_UNSUSPEND);
6921 
6922         /*
6923          * Now lower our PIL and release any captured CPUs since we
6924          * are out of the "danger zone".  After this it will again be
6925          * safe to acquire adaptive mutex locks, or to drop them...
6926          */
6927         if (old_pil != -1) {
6928                 splx(old_pil);
6929         } else {
6930                 xc_dismissed(cpuset);
6931         }
6932 
6933         kpreempt_enable();
6934 
6935         sfmmu_mlist_reloc_exit(low, high);
6936 
6937         /*
6938          * Postsuspend callbacks should drop any locks held across
6939          * the suspend callbacks.  As before, we don't hold the mapping
6940          * list lock at this point.. our assumption is that the mapping
6941          * list still can't change due to our holding SE_EXCL lock and
6942          * there being no unlocked mappings left. Hence the restriction
6943          * on calling context to hat_delete_callback()
6944          */
6945         hat_pageprocess_postcallbacks(repl, HAT_POSTUNSUSPEND);
6946         if (ret != 0) {
6947                 /*
6948                  * The second presuspend call failed: we got here through
6949                  * the suspend_fail label above.
6950                  */
6951                 ASSERT(ret != EIO);
6952                 PAGE_RELOCATE_LOG(target, replacement, ret, cap_cpus);
6953                 kreloc_thread = NULL;
6954                 mutex_exit(&kpr_mutex);
6955                 return (EAGAIN);
6956         }
6957 
6958         /*
6959          * Now that we're out of the performance critical section we can
6960          * take care of updating the hash table, since we still
6961          * hold all the pages locked SE_EXCL at this point we
6962          * needn't worry about things changing out from under us.
6963          */
6964         tpp = targ;
6965         rpp = repl;
6966         for (i = 0; i < npages; i++, tpp++, rpp++) {
6967 
6968                 /*
6969                  * replace targ with replacement in page_hash table
6970                  */
6971                 targ = tpp;
6972                 page_relocate_hash(rpp, targ);
6973 
6974                 /*
6975                  * concatenate target; caller of platform_page_relocate()
6976                  * expects target to be concatenated after returning.
6977                  */
6978                 ASSERT(targ->p_next == targ);
6979                 ASSERT(targ->p_prev == targ);
6980                 page_list_concat(&pl, &targ);
6981         }
6982 
6983         ASSERT(*target == pl);
6984         *nrelocp = npages;
6985         PAGE_RELOCATE_LOG(target, replacement, 0, cap_cpus);
6986         kreloc_thread = NULL;
6987         mutex_exit(&kpr_mutex);
6988         return (0);
6989 }
6990 
6991 /*
6992  * Called when stray pa_hments are found attached to a page which is
6993  * being freed.  Notify the subsystem which attached the pa_hment of
6994  * the error if it registered a suitable handler, else panic.
6995  */
6996 static void
6997 sfmmu_pahment_leaked(struct pa_hment *pahmep)
6998 {
6999         id_t cb_id = pahmep->cb_id;
7000 
7001         ASSERT(cb_id >= (id_t)0 && cb_id < sfmmu_cb_nextid);
7002         if (sfmmu_cb_table[cb_id].errhandler != NULL) {
7003                 if (sfmmu_cb_table[cb_id].errhandler(pahmep->addr, pahmep->len,
7004                     HAT_CB_ERR_LEAKED, pahmep->pvt) == 0)
7005                         return;         /* non-fatal */
7006         }
7007         panic("pa_hment leaked: 0x%p", (void *)pahmep);
7008 }
7009 
7010 /*
7011  * Remove all mappings to page 'pp'.
7012  */
7013 int
7014 hat_pageunload(struct page *pp, uint_t forceflag)
7015 {
7016         struct page *origpp = pp;
7017         struct sf_hment *sfhme, *tmphme;
7018         struct hme_blk *hmeblkp;
7019         kmutex_t *pml;
7020 #ifdef VAC
7021         kmutex_t *pmtx;
7022 #endif
7023         cpuset_t cpuset, tset;
7024         int index, cons;
7025         int pa_hments;
7026 
7027         ASSERT(PAGE_EXCL(pp));
7028 
7029         tmphme = NULL;
7030         pa_hments = 0;
7031         CPUSET_ZERO(cpuset);
7032 
7033         pml = sfmmu_mlist_enter(pp);
7034 
7035 #ifdef VAC
7036         if (pp->p_kpmref)
7037                 sfmmu_kpm_pageunload(pp);
7038         ASSERT(!PP_ISMAPPED_KPM(pp));
7039 #endif
7040         /*
7041          * Clear vpm reference. Since the page is exclusively locked
7042          * vpm cannot be referencing it.
7043          */
7044         if (vpm_enable) {
7045                 pp->p_vpmref = 0;
7046         }
7047 
7048         index = PP_MAPINDEX(pp);
7049         cons = TTE8K;
7050 retry:
7051         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7052                 tmphme = sfhme->hme_next;
7053 
7054                 if (IS_PAHME(sfhme)) {
7055                         ASSERT(sfhme->hme_data != NULL);
7056                         pa_hments++;
7057                         continue;
7058                 }
7059 
7060                 hmeblkp = sfmmu_hmetohblk(sfhme);
7061 
7062                 /*
7063                  * If there are kernel mappings don't unload them, they will
7064                  * be suspended.
7065                  */
7066                 if (forceflag == SFMMU_KERNEL_RELOC && hmeblkp->hblk_lckcnt &&
7067                     hmeblkp->hblk_tag.htag_id == ksfmmup)
7068                         continue;
7069 
7070                 tset = sfmmu_pageunload(pp, sfhme, cons);
7071                 CPUSET_OR(cpuset, tset);
7072         }
7073 
7074         while (index != 0) {
7075                 index = index >> 1;
7076                 if (index != 0)
7077                         cons++;
7078                 if (index & 0x1) {
7079                         /* Go to leading page */
7080                         pp = PP_GROUPLEADER(pp, cons);
7081                         ASSERT(sfmmu_mlist_held(pp));
7082                         goto retry;
7083                 }
7084         }
7085 
7086         /*
7087          * cpuset may be empty if the page was only mapped by segkpm,
7088          * in which case we won't actually cross-trap.
7089          */
7090         xt_sync(cpuset);
7091 
7092         /*
7093          * The page should have no mappings at this point, unless
7094          * we were called from hat_page_relocate() in which case we
7095          * leave the locked mappings which will be suspended later.
7096          */
7097         ASSERT(!PP_ISMAPPED(origpp) || pa_hments ||
7098             (forceflag == SFMMU_KERNEL_RELOC));
7099 
7100 #ifdef VAC
7101         if (PP_ISTNC(pp)) {
7102                 if (cons == TTE8K) {
7103                         pmtx = sfmmu_page_enter(pp);
7104                         PP_CLRTNC(pp);
7105                         sfmmu_page_exit(pmtx);
7106                 } else {
7107                         conv_tnc(pp, cons);
7108                 }
7109         }
7110 #endif  /* VAC */
7111 
7112         if (pa_hments && forceflag != SFMMU_KERNEL_RELOC) {
7113                 /*
7114                  * Unlink any pa_hments and free them, calling back
7115                  * the responsible subsystem to notify it of the error.
7116                  * This can occur in situations such as drivers leaking
7117                  * DMA handles: naughty, but common enough that we'd like
7118                  * to keep the system running rather than bringing it
7119                  * down with an obscure error like "pa_hment leaked"
7120                  * which doesn't aid the user in debugging their driver.
7121                  */
7122                 for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7123                         tmphme = sfhme->hme_next;
7124                         if (IS_PAHME(sfhme)) {
7125                                 struct pa_hment *pahmep = sfhme->hme_data;
7126                                 sfmmu_pahment_leaked(pahmep);
7127                                 HME_SUB(sfhme, pp);
7128                                 kmem_cache_free(pa_hment_cache, pahmep);
7129                         }
7130                 }
7131 
7132                 ASSERT(!PP_ISMAPPED(origpp));
7133         }
7134 
7135         sfmmu_mlist_exit(pml);
7136 
7137         return (0);
7138 }
7139 
7140 cpuset_t
7141 sfmmu_pageunload(page_t *pp, struct sf_hment *sfhme, int cons)
7142 {
7143         struct hme_blk *hmeblkp;
7144         sfmmu_t *sfmmup;
7145         tte_t tte, ttemod;
7146 #ifdef DEBUG
7147         tte_t orig_old;
7148 #endif /* DEBUG */
7149         caddr_t addr;
7150         int ttesz;
7151         int ret;
7152         cpuset_t cpuset;
7153 
7154         ASSERT(pp != NULL);
7155         ASSERT(sfmmu_mlist_held(pp));
7156         ASSERT(!PP_ISKAS(pp));
7157 
7158         CPUSET_ZERO(cpuset);
7159 
7160         hmeblkp = sfmmu_hmetohblk(sfhme);
7161 
7162 readtte:
7163         sfmmu_copytte(&sfhme->hme_tte, &tte);
7164         if (TTE_IS_VALID(&tte)) {
7165                 sfmmup = hblktosfmmu(hmeblkp);
7166                 ttesz = get_hblk_ttesz(hmeblkp);
7167                 /*
7168                  * Only unload mappings of 'cons' size.
7169                  */
7170                 if (ttesz != cons)
7171                         return (cpuset);
7172 
7173                 /*
7174                  * Note that we have p_mapping lock, but no hash lock here.
7175                  * hblk_unload() has to have both hash lock AND p_mapping
7176                  * lock before it tries to modify tte. So, the tte could
7177                  * not become invalid in the sfmmu_modifytte_try() below.
7178                  */
7179                 ttemod = tte;
7180 #ifdef DEBUG
7181                 orig_old = tte;
7182 #endif /* DEBUG */
7183 
7184                 TTE_SET_INVALID(&ttemod);
7185                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7186                 if (ret < 0) {
7187 #ifdef DEBUG
7188                         /* only R/M bits can change. */
7189                         chk_tte(&orig_old, &tte, &ttemod, hmeblkp);
7190 #endif /* DEBUG */
7191                         goto readtte;
7192                 }
7193 
7194                 if (ret == 0) {
7195                         panic("pageunload: cas failed?");
7196                 }
7197 
7198                 addr = tte_to_vaddr(hmeblkp, tte);
7199 
7200                 if (hmeblkp->hblk_shared) {
7201                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7202                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
7203                         sf_region_t *rgnp;
7204                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7205                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7206                         ASSERT(srdp != NULL);
7207                         rgnp = srdp->srd_hmergnp[rid];
7208                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7209                         cpuset = sfmmu_rgntlb_demap(addr, rgnp, hmeblkp, 1);
7210                         sfmmu_ttesync(NULL, addr, &tte, pp);
7211                         ASSERT(rgnp->rgn_ttecnt[ttesz] > 0);
7212                         atomic_dec_ulong(&rgnp->rgn_ttecnt[ttesz]);
7213                 } else {
7214                         sfmmu_ttesync(sfmmup, addr, &tte, pp);
7215                         atomic_dec_ulong(&sfmmup->sfmmu_ttecnt[ttesz]);
7216 
7217                         /*
7218                          * We need to flush the page from the virtual cache
7219                          * in order to prevent a virtual cache alias
7220                          * inconsistency. The particular scenario we need
7221                          * to worry about is:
7222                          * Given:  va1 and va2 are two virtual address that
7223                          * alias and will map the same physical address.
7224                          * 1.   mapping exists from va1 to pa and data has
7225                          *      been read into the cache.
7226                          * 2.   unload va1.
7227                          * 3.   load va2 and modify data using va2.
7228                          * 4    unload va2.
7229                          * 5.   load va1 and reference data.  Unless we flush
7230                          *      the data cache when we unload we will get
7231                          *      stale data.
7232                          * This scenario is taken care of by using virtual
7233                          * page coloring.
7234                          */
7235                         if (sfmmup->sfmmu_ismhat) {
7236                                 /*
7237                                  * Flush TSBs, TLBs and caches
7238                                  * of every process
7239                                  * sharing this ism segment.
7240                                  */
7241                                 sfmmu_hat_lock_all();
7242                                 mutex_enter(&ism_mlist_lock);
7243                                 kpreempt_disable();
7244                                 sfmmu_ismtlbcache_demap(addr, sfmmup, hmeblkp,
7245                                     pp->p_pagenum, CACHE_NO_FLUSH);
7246                                 kpreempt_enable();
7247                                 mutex_exit(&ism_mlist_lock);
7248                                 sfmmu_hat_unlock_all();
7249                                 cpuset = cpu_ready_set;
7250                         } else {
7251                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7252                                 cpuset = sfmmup->sfmmu_cpusran;
7253                         }
7254                 }
7255 
7256                 /*
7257                  * Hme_sub has to run after ttesync() and a_rss update.
7258                  * See hblk_unload().
7259                  */
7260                 HME_SUB(sfhme, pp);
7261                 membar_stst();
7262 
7263                 /*
7264                  * We can not make ASSERT(hmeblkp->hblk_hmecnt <= NHMENTS)
7265                  * since pteload may have done a HME_ADD() right after
7266                  * we did the HME_SUB() above. Hmecnt is now maintained
7267                  * by cas only. no lock guranteed its value. The only
7268                  * gurantee we have is the hmecnt should not be less than
7269                  * what it should be so the hblk will not be taken away.
7270                  * It's also important that we decremented the hmecnt after
7271                  * we are done with hmeblkp so that this hmeblk won't be
7272                  * stolen.
7273                  */
7274                 ASSERT(hmeblkp->hblk_hmecnt > 0);
7275                 ASSERT(hmeblkp->hblk_vcnt > 0);
7276                 atomic_dec_16(&hmeblkp->hblk_vcnt);
7277                 atomic_dec_16(&hmeblkp->hblk_hmecnt);
7278                 /*
7279                  * This is bug 4063182.
7280                  * XXX: fixme
7281                  * ASSERT(hmeblkp->hblk_hmecnt || hmeblkp->hblk_vcnt ||
7282                  *      !hmeblkp->hblk_lckcnt);
7283                  */
7284         } else {
7285                 panic("invalid tte? pp %p &tte %p",
7286                     (void *)pp, (void *)&tte);
7287         }
7288 
7289         return (cpuset);
7290 }
7291 
7292 /*
7293  * While relocating a kernel page, this function will move the mappings
7294  * from tpp to dpp and modify any associated data with these mappings.
7295  * It also unsuspends the suspended kernel mapping.
7296  */
7297 static void
7298 hat_pagereload(struct page *tpp, struct page *dpp)
7299 {
7300         struct sf_hment *sfhme;
7301         tte_t tte, ttemod;
7302         int index, cons;
7303 
7304         ASSERT(getpil() == PIL_MAX);
7305         ASSERT(sfmmu_mlist_held(tpp));
7306         ASSERT(sfmmu_mlist_held(dpp));
7307 
7308         index = PP_MAPINDEX(tpp);
7309         cons = TTE8K;
7310 
7311         /* Update real mappings to the page */
7312 retry:
7313         for (sfhme = tpp->p_mapping; sfhme != NULL; sfhme = sfhme->hme_next) {
7314                 if (IS_PAHME(sfhme))
7315                         continue;
7316                 sfmmu_copytte(&sfhme->hme_tte, &tte);
7317                 ttemod = tte;
7318 
7319                 /*
7320                  * replace old pfn with new pfn in TTE
7321                  */
7322                 PFN_TO_TTE(ttemod, dpp->p_pagenum);
7323 
7324                 /*
7325                  * clear suspend bit
7326                  */
7327                 ASSERT(TTE_IS_SUSPEND(&ttemod));
7328                 TTE_CLR_SUSPEND(&ttemod);
7329 
7330                 if (sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte) < 0)
7331                         panic("hat_pagereload(): sfmmu_modifytte_try() failed");
7332 
7333                 /*
7334                  * set hme_page point to new page
7335                  */
7336                 sfhme->hme_page = dpp;
7337         }
7338 
7339         /*
7340          * move p_mapping list from old page to new page
7341          */
7342         dpp->p_mapping = tpp->p_mapping;
7343         tpp->p_mapping = NULL;
7344         dpp->p_share = tpp->p_share;
7345         tpp->p_share = 0;
7346 
7347         while (index != 0) {
7348                 index = index >> 1;
7349                 if (index != 0)
7350                         cons++;
7351                 if (index & 0x1) {
7352                         tpp = PP_GROUPLEADER(tpp, cons);
7353                         dpp = PP_GROUPLEADER(dpp, cons);
7354                         goto retry;
7355                 }
7356         }
7357 
7358         curthread->t_flag &= ~T_DONTDTRACE;
7359         mutex_exit(&kpr_suspendlock);
7360 }
7361 
7362 uint_t
7363 hat_pagesync(struct page *pp, uint_t clearflag)
7364 {
7365         struct sf_hment *sfhme, *tmphme = NULL;
7366         struct hme_blk *hmeblkp;
7367         kmutex_t *pml;
7368         cpuset_t cpuset, tset;
7369         int     index, cons;
7370         extern  ulong_t po_share;
7371         page_t  *save_pp = pp;
7372         int     stop_on_sh = 0;
7373         uint_t  shcnt;
7374 
7375         CPUSET_ZERO(cpuset);
7376 
7377         if (PP_ISRO(pp) && (clearflag & HAT_SYNC_STOPON_MOD)) {
7378                 return (PP_GENERIC_ATTR(pp));
7379         }
7380 
7381         if ((clearflag & HAT_SYNC_ZERORM) == 0) {
7382                 if ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(pp)) {
7383                         return (PP_GENERIC_ATTR(pp));
7384                 }
7385                 if ((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(pp)) {
7386                         return (PP_GENERIC_ATTR(pp));
7387                 }
7388                 if (clearflag & HAT_SYNC_STOPON_SHARED) {
7389                         if (pp->p_share > po_share) {
7390                                 hat_page_setattr(pp, P_REF);
7391                                 return (PP_GENERIC_ATTR(pp));
7392                         }
7393                         stop_on_sh = 1;
7394                         shcnt = 0;
7395                 }
7396         }
7397 
7398         clearflag &= ~HAT_SYNC_STOPON_SHARED;
7399         pml = sfmmu_mlist_enter(pp);
7400         index = PP_MAPINDEX(pp);
7401         cons = TTE8K;
7402 retry:
7403         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7404                 /*
7405                  * We need to save the next hment on the list since
7406                  * it is possible for pagesync to remove an invalid hment
7407                  * from the list.
7408                  */
7409                 tmphme = sfhme->hme_next;
7410                 if (IS_PAHME(sfhme))
7411                         continue;
7412                 /*
7413                  * If we are looking for large mappings and this hme doesn't
7414                  * reach the range we are seeking, just ignore it.
7415                  */
7416                 hmeblkp = sfmmu_hmetohblk(sfhme);
7417 
7418                 if (hme_size(sfhme) < cons)
7419                         continue;
7420 
7421                 if (stop_on_sh) {
7422                         if (hmeblkp->hblk_shared) {
7423                                 sf_srd_t *srdp = hblktosrd(hmeblkp);
7424                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7425                                 sf_region_t *rgnp;
7426                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7427                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7428                                 ASSERT(srdp != NULL);
7429                                 rgnp = srdp->srd_hmergnp[rid];
7430                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
7431                                     rgnp, rid);
7432                                 shcnt += rgnp->rgn_refcnt;
7433                         } else {
7434                                 shcnt++;
7435                         }
7436                         if (shcnt > po_share) {
7437                                 /*
7438                                  * tell the pager to spare the page this time
7439                                  * around.
7440                                  */
7441                                 hat_page_setattr(save_pp, P_REF);
7442                                 index = 0;
7443                                 break;
7444                         }
7445                 }
7446                 tset = sfmmu_pagesync(pp, sfhme,
7447                     clearflag & ~HAT_SYNC_STOPON_RM);
7448                 CPUSET_OR(cpuset, tset);
7449 
7450                 /*
7451                  * If clearflag is HAT_SYNC_DONTZERO, break out as soon
7452                  * as the "ref" or "mod" is set or share cnt exceeds po_share.
7453                  */
7454                 if ((clearflag & ~HAT_SYNC_STOPON_RM) == HAT_SYNC_DONTZERO &&
7455                     (((clearflag & HAT_SYNC_STOPON_MOD) && PP_ISMOD(save_pp)) ||
7456                     ((clearflag & HAT_SYNC_STOPON_REF) && PP_ISREF(save_pp)))) {
7457                         index = 0;
7458                         break;
7459                 }
7460         }
7461 
7462         while (index) {
7463                 index = index >> 1;
7464                 cons++;
7465                 if (index & 0x1) {
7466                         /* Go to leading page */
7467                         pp = PP_GROUPLEADER(pp, cons);
7468                         goto retry;
7469                 }
7470         }
7471 
7472         xt_sync(cpuset);
7473         sfmmu_mlist_exit(pml);
7474         return (PP_GENERIC_ATTR(save_pp));
7475 }
7476 
7477 /*
7478  * Get all the hardware dependent attributes for a page struct
7479  */
7480 static cpuset_t
7481 sfmmu_pagesync(struct page *pp, struct sf_hment *sfhme,
7482     uint_t clearflag)
7483 {
7484         caddr_t addr;
7485         tte_t tte, ttemod;
7486         struct hme_blk *hmeblkp;
7487         int ret;
7488         sfmmu_t *sfmmup;
7489         cpuset_t cpuset;
7490 
7491         ASSERT(pp != NULL);
7492         ASSERT(sfmmu_mlist_held(pp));
7493         ASSERT((clearflag == HAT_SYNC_DONTZERO) ||
7494             (clearflag == HAT_SYNC_ZERORM));
7495 
7496         SFMMU_STAT(sf_pagesync);
7497 
7498         CPUSET_ZERO(cpuset);
7499 
7500 sfmmu_pagesync_retry:
7501 
7502         sfmmu_copytte(&sfhme->hme_tte, &tte);
7503         if (TTE_IS_VALID(&tte)) {
7504                 hmeblkp = sfmmu_hmetohblk(sfhme);
7505                 sfmmup = hblktosfmmu(hmeblkp);
7506                 addr = tte_to_vaddr(hmeblkp, tte);
7507                 if (clearflag == HAT_SYNC_ZERORM) {
7508                         ttemod = tte;
7509                         TTE_CLR_RM(&ttemod);
7510                         ret = sfmmu_modifytte_try(&tte, &ttemod,
7511                             &sfhme->hme_tte);
7512                         if (ret < 0) {
7513                                 /*
7514                                  * cas failed and the new value is not what
7515                                  * we want.
7516                                  */
7517                                 goto sfmmu_pagesync_retry;
7518                         }
7519 
7520                         if (ret > 0) {
7521                                 /* we win the cas */
7522                                 if (hmeblkp->hblk_shared) {
7523                                         sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7524                                         uint_t rid =
7525                                             hmeblkp->hblk_tag.htag_rid;
7526                                         sf_region_t *rgnp;
7527                                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7528                                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7529                                         ASSERT(srdp != NULL);
7530                                         rgnp = srdp->srd_hmergnp[rid];
7531                                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7532                                             srdp, rgnp, rid);
7533                                         cpuset = sfmmu_rgntlb_demap(addr,
7534                                             rgnp, hmeblkp, 1);
7535                                 } else {
7536                                         sfmmu_tlb_demap(addr, sfmmup, hmeblkp,
7537                                             0, 0);
7538                                         cpuset = sfmmup->sfmmu_cpusran;
7539                                 }
7540                         }
7541                 }
7542                 sfmmu_ttesync(hmeblkp->hblk_shared ? NULL : sfmmup, addr,
7543                     &tte, pp);
7544         }
7545         return (cpuset);
7546 }
7547 
7548 /*
7549  * Remove write permission from a mappings to a page, so that
7550  * we can detect the next modification of it. This requires modifying
7551  * the TTE then invalidating (demap) any TLB entry using that TTE.
7552  * This code is similar to sfmmu_pagesync().
7553  */
7554 static cpuset_t
7555 sfmmu_pageclrwrt(struct page *pp, struct sf_hment *sfhme)
7556 {
7557         caddr_t addr;
7558         tte_t tte;
7559         tte_t ttemod;
7560         struct hme_blk *hmeblkp;
7561         int ret;
7562         sfmmu_t *sfmmup;
7563         cpuset_t cpuset;
7564 
7565         ASSERT(pp != NULL);
7566         ASSERT(sfmmu_mlist_held(pp));
7567 
7568         CPUSET_ZERO(cpuset);
7569         SFMMU_STAT(sf_clrwrt);
7570 
7571 retry:
7572 
7573         sfmmu_copytte(&sfhme->hme_tte, &tte);
7574         if (TTE_IS_VALID(&tte) && TTE_IS_WRITABLE(&tte)) {
7575                 hmeblkp = sfmmu_hmetohblk(sfhme);
7576                 sfmmup = hblktosfmmu(hmeblkp);
7577                 addr = tte_to_vaddr(hmeblkp, tte);
7578 
7579                 ttemod = tte;
7580                 TTE_CLR_WRT(&ttemod);
7581                 TTE_CLR_MOD(&ttemod);
7582                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
7583 
7584                 /*
7585                  * if cas failed and the new value is not what
7586                  * we want retry
7587                  */
7588                 if (ret < 0)
7589                         goto retry;
7590 
7591                 /* we win the cas */
7592                 if (ret > 0) {
7593                         if (hmeblkp->hblk_shared) {
7594                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
7595                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
7596                                 sf_region_t *rgnp;
7597                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7598                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7599                                 ASSERT(srdp != NULL);
7600                                 rgnp = srdp->srd_hmergnp[rid];
7601                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
7602                                     srdp, rgnp, rid);
7603                                 cpuset = sfmmu_rgntlb_demap(addr,
7604                                     rgnp, hmeblkp, 1);
7605                         } else {
7606                                 sfmmu_tlb_demap(addr, sfmmup, hmeblkp, 0, 0);
7607                                 cpuset = sfmmup->sfmmu_cpusran;
7608                         }
7609                 }
7610         }
7611 
7612         return (cpuset);
7613 }
7614 
7615 /*
7616  * Walk all mappings of a page, removing write permission and clearing the
7617  * ref/mod bits. This code is similar to hat_pagesync()
7618  */
7619 static void
7620 hat_page_clrwrt(page_t *pp)
7621 {
7622         struct sf_hment *sfhme;
7623         struct sf_hment *tmphme = NULL;
7624         kmutex_t *pml;
7625         cpuset_t cpuset;
7626         cpuset_t tset;
7627         int     index;
7628         int      cons;
7629 
7630         CPUSET_ZERO(cpuset);
7631 
7632         pml = sfmmu_mlist_enter(pp);
7633         index = PP_MAPINDEX(pp);
7634         cons = TTE8K;
7635 retry:
7636         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
7637                 tmphme = sfhme->hme_next;
7638 
7639                 /*
7640                  * If we are looking for large mappings and this hme doesn't
7641                  * reach the range we are seeking, just ignore its.
7642                  */
7643 
7644                 if (hme_size(sfhme) < cons)
7645                         continue;
7646 
7647                 tset = sfmmu_pageclrwrt(pp, sfhme);
7648                 CPUSET_OR(cpuset, tset);
7649         }
7650 
7651         while (index) {
7652                 index = index >> 1;
7653                 cons++;
7654                 if (index & 0x1) {
7655                         /* Go to leading page */
7656                         pp = PP_GROUPLEADER(pp, cons);
7657                         goto retry;
7658                 }
7659         }
7660 
7661         xt_sync(cpuset);
7662         sfmmu_mlist_exit(pml);
7663 }
7664 
7665 /*
7666  * Set the given REF/MOD/RO bits for the given page.
7667  * For a vnode with a sorted v_pages list, we need to change
7668  * the attributes and the v_pages list together under page_vnode_mutex.
7669  */
7670 void
7671 hat_page_setattr(page_t *pp, uint_t flag)
7672 {
7673         vnode_t         *vp = pp->p_vnode;
7674         page_t          **listp;
7675         kmutex_t        *pmtx;
7676         kmutex_t        *vphm = NULL;
7677         int             noshuffle;
7678 
7679         noshuffle = flag & P_NSH;
7680         flag &= ~P_NSH;
7681 
7682         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7683 
7684         /*
7685          * nothing to do if attribute already set
7686          */
7687         if ((pp->p_nrm & flag) == flag)
7688                 return;
7689 
7690         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp) &&
7691             !noshuffle) {
7692                 vphm = page_vnode_mutex(vp);
7693                 mutex_enter(vphm);
7694         }
7695 
7696         pmtx = sfmmu_page_enter(pp);
7697         pp->p_nrm |= flag;
7698         sfmmu_page_exit(pmtx);
7699 
7700         if (vphm != NULL) {
7701                 /*
7702                  * Some File Systems examine v_pages for NULL w/o
7703                  * grabbing the vphm mutex. Must not let it become NULL when
7704                  * pp is the only page on the list.
7705                  */
7706                 if (pp->p_vpnext != pp) {
7707                         page_vpsub(&vp->v_pages, pp);
7708                         if (vp->v_pages != NULL)
7709                                 listp = &vp->v_pages->p_vpprev->p_vpnext;
7710                         else
7711                                 listp = &vp->v_pages;
7712                         page_vpadd(listp, pp);
7713                 }
7714                 mutex_exit(vphm);
7715         }
7716 }
7717 
7718 void
7719 hat_page_clrattr(page_t *pp, uint_t flag)
7720 {
7721         vnode_t         *vp = pp->p_vnode;
7722         kmutex_t        *pmtx;
7723 
7724         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7725 
7726         pmtx = sfmmu_page_enter(pp);
7727 
7728         /*
7729          * Caller is expected to hold page's io lock for VMODSORT to work
7730          * correctly with pvn_vplist_dirty() and pvn_getdirty() when mod
7731          * bit is cleared.
7732          * We don't have assert to avoid tripping some existing third party
7733          * code. The dirty page is moved back to top of the v_page list
7734          * after IO is done in pvn_write_done().
7735          */
7736         pp->p_nrm &= ~flag;
7737         sfmmu_page_exit(pmtx);
7738 
7739         if ((flag & P_MOD) != 0 && vp != NULL && IS_VMODSORT(vp)) {
7740 
7741                 /*
7742                  * VMODSORT works by removing write permissions and getting
7743                  * a fault when a page is made dirty. At this point
7744                  * we need to remove write permission from all mappings
7745                  * to this page.
7746                  */
7747                 hat_page_clrwrt(pp);
7748         }
7749 }
7750 
7751 uint_t
7752 hat_page_getattr(page_t *pp, uint_t flag)
7753 {
7754         ASSERT(!(flag & ~(P_MOD | P_REF | P_RO)));
7755         return ((uint_t)(pp->p_nrm & flag));
7756 }
7757 
7758 /*
7759  * DEBUG kernels: verify that a kernel va<->pa translation
7760  * is safe by checking the underlying page_t is in a page
7761  * relocation-safe state.
7762  */
7763 #ifdef  DEBUG
7764 void
7765 sfmmu_check_kpfn(pfn_t pfn)
7766 {
7767         page_t *pp;
7768         int index, cons;
7769 
7770         if (hat_check_vtop == 0)
7771                 return;
7772 
7773         if (kvseg.s_base == NULL || panicstr)
7774                 return;
7775 
7776         pp = page_numtopp_nolock(pfn);
7777         if (!pp)
7778                 return;
7779 
7780         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7781                 return;
7782 
7783         /*
7784          * Handed a large kernel page, we dig up the root page since we
7785          * know the root page might have the lock also.
7786          */
7787         if (pp->p_szc != 0) {
7788                 index = PP_MAPINDEX(pp);
7789                 cons = TTE8K;
7790 again:
7791                 while (index != 0) {
7792                         index >>= 1;
7793                         if (index != 0)
7794                                 cons++;
7795                         if (index & 0x1) {
7796                                 pp = PP_GROUPLEADER(pp, cons);
7797                                 goto again;
7798                         }
7799                 }
7800         }
7801 
7802         if (PAGE_LOCKED(pp) || PP_ISNORELOC(pp))
7803                 return;
7804 
7805         /*
7806          * Pages need to be locked or allocated "permanent" (either from
7807          * static_arena arena or explicitly setting PG_NORELOC when calling
7808          * page_create_va()) for VA->PA translations to be valid.
7809          */
7810         if (!PP_ISNORELOC(pp))
7811                 panic("Illegal VA->PA translation, pp 0x%p not permanent",
7812                     (void *)pp);
7813         else
7814                 panic("Illegal VA->PA translation, pp 0x%p not locked",
7815                     (void *)pp);
7816 }
7817 #endif  /* DEBUG */
7818 
7819 /*
7820  * Returns a page frame number for a given virtual address.
7821  * Returns PFN_INVALID to indicate an invalid mapping
7822  */
7823 pfn_t
7824 hat_getpfnum(struct hat *hat, caddr_t addr)
7825 {
7826         pfn_t pfn;
7827         tte_t tte;
7828 
7829         /*
7830          * We would like to
7831          * ASSERT(AS_LOCK_HELD(as));
7832          * but we can't because the iommu driver will call this
7833          * routine at interrupt time and it can't grab the as lock
7834          * or it will deadlock: A thread could have the as lock
7835          * and be waiting for io.  The io can't complete
7836          * because the interrupt thread is blocked trying to grab
7837          * the as lock.
7838          */
7839 
7840         if (hat == ksfmmup) {
7841                 if (IS_KMEM_VA_LARGEPAGE(addr)) {
7842                         ASSERT(segkmem_lpszc > 0);
7843                         pfn = sfmmu_kvaszc2pfn(addr, segkmem_lpszc);
7844                         if (pfn != PFN_INVALID) {
7845                                 sfmmu_check_kpfn(pfn);
7846                                 return (pfn);
7847                         }
7848                 } else if (segkpm && IS_KPM_ADDR(addr)) {
7849                         return (sfmmu_kpm_vatopfn(addr));
7850                 }
7851                 while ((pfn = sfmmu_vatopfn(addr, ksfmmup, &tte))
7852                     == PFN_SUSPENDED) {
7853                         sfmmu_vatopfn_suspended(addr, ksfmmup, &tte);
7854                 }
7855                 sfmmu_check_kpfn(pfn);
7856                 return (pfn);
7857         } else {
7858                 return (sfmmu_uvatopfn(addr, hat, NULL));
7859         }
7860 }
7861 
7862 /*
7863  * This routine will return both pfn and tte for the vaddr.
7864  */
7865 static pfn_t
7866 sfmmu_uvatopfn(caddr_t vaddr, struct hat *sfmmup, tte_t *ttep)
7867 {
7868         struct hmehash_bucket *hmebp;
7869         hmeblk_tag hblktag;
7870         int hmeshift, hashno = 1;
7871         struct hme_blk *hmeblkp = NULL;
7872         tte_t tte;
7873 
7874         struct sf_hment *sfhmep;
7875         pfn_t pfn;
7876 
7877         /* support for ISM */
7878         ism_map_t       *ism_map;
7879         ism_blk_t       *ism_blkp;
7880         int             i;
7881         sfmmu_t *ism_hatid = NULL;
7882         sfmmu_t *locked_hatid = NULL;
7883         sfmmu_t *sv_sfmmup = sfmmup;
7884         caddr_t sv_vaddr = vaddr;
7885         sf_srd_t *srdp;
7886 
7887         if (ttep == NULL) {
7888                 ttep = &tte;
7889         } else {
7890                 ttep->ll = 0;
7891         }
7892 
7893         ASSERT(sfmmup != ksfmmup);
7894         SFMMU_STAT(sf_user_vtop);
7895         /*
7896          * Set ism_hatid if vaddr falls in a ISM segment.
7897          */
7898         ism_blkp = sfmmup->sfmmu_iblk;
7899         if (ism_blkp != NULL) {
7900                 sfmmu_ismhat_enter(sfmmup, 0);
7901                 locked_hatid = sfmmup;
7902         }
7903         while (ism_blkp != NULL && ism_hatid == NULL) {
7904                 ism_map = ism_blkp->iblk_maps;
7905                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
7906                         if (vaddr >= ism_start(ism_map[i]) &&
7907                             vaddr < ism_end(ism_map[i])) {
7908                                 sfmmup = ism_hatid = ism_map[i].imap_ismhat;
7909                                 vaddr = (caddr_t)(vaddr -
7910                                     ism_start(ism_map[i]));
7911                                 break;
7912                         }
7913                 }
7914                 ism_blkp = ism_blkp->iblk_next;
7915         }
7916         if (locked_hatid) {
7917                 sfmmu_ismhat_exit(locked_hatid, 0);
7918         }
7919 
7920         hblktag.htag_id = sfmmup;
7921         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
7922         do {
7923                 hmeshift = HME_HASH_SHIFT(hashno);
7924                 hblktag.htag_bspage = HME_HASH_BSPAGE(vaddr, hmeshift);
7925                 hblktag.htag_rehash = hashno;
7926                 hmebp = HME_HASH_FUNCTION(sfmmup, vaddr, hmeshift);
7927 
7928                 SFMMU_HASH_LOCK(hmebp);
7929 
7930                 HME_HASH_FAST_SEARCH(hmebp, hblktag, hmeblkp);
7931                 if (hmeblkp != NULL) {
7932                         ASSERT(!hmeblkp->hblk_shared);
7933                         HBLKTOHME(sfhmep, hmeblkp, vaddr);
7934                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7935                         SFMMU_HASH_UNLOCK(hmebp);
7936                         if (TTE_IS_VALID(ttep)) {
7937                                 pfn = TTE_TO_PFN(vaddr, ttep);
7938                                 return (pfn);
7939                         }
7940                         break;
7941                 }
7942                 SFMMU_HASH_UNLOCK(hmebp);
7943                 hashno++;
7944         } while (HME_REHASH(sfmmup) && (hashno <= mmu_hashcnt));
7945 
7946         if (SF_HMERGNMAP_ISNULL(sv_sfmmup)) {
7947                 return (PFN_INVALID);
7948         }
7949         srdp = sv_sfmmup->sfmmu_srdp;
7950         ASSERT(srdp != NULL);
7951         ASSERT(srdp->srd_refcnt != 0);
7952         hblktag.htag_id = srdp;
7953         hashno = 1;
7954         do {
7955                 hmeshift = HME_HASH_SHIFT(hashno);
7956                 hblktag.htag_bspage = HME_HASH_BSPAGE(sv_vaddr, hmeshift);
7957                 hblktag.htag_rehash = hashno;
7958                 hmebp = HME_HASH_FUNCTION(srdp, sv_vaddr, hmeshift);
7959 
7960                 SFMMU_HASH_LOCK(hmebp);
7961                 for (hmeblkp = hmebp->hmeblkp; hmeblkp != NULL;
7962                     hmeblkp = hmeblkp->hblk_next) {
7963                         uint_t rid;
7964                         sf_region_t *rgnp;
7965                         caddr_t rsaddr;
7966                         caddr_t readdr;
7967 
7968                         if (!HTAGS_EQ_SHME(hmeblkp->hblk_tag, hblktag,
7969                             sv_sfmmup->sfmmu_hmeregion_map)) {
7970                                 continue;
7971                         }
7972                         ASSERT(hmeblkp->hblk_shared);
7973                         rid = hmeblkp->hblk_tag.htag_rid;
7974                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
7975                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
7976                         rgnp = srdp->srd_hmergnp[rid];
7977                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
7978                         HBLKTOHME(sfhmep, hmeblkp, sv_vaddr);
7979                         sfmmu_copytte(&sfhmep->hme_tte, ttep);
7980                         rsaddr = rgnp->rgn_saddr;
7981                         readdr = rsaddr + rgnp->rgn_size;
7982 #ifdef DEBUG
7983                         if (TTE_IS_VALID(ttep) ||
7984                             get_hblk_ttesz(hmeblkp) > TTE8K) {
7985                                 caddr_t eva = tte_to_evaddr(hmeblkp, ttep);
7986                                 ASSERT(eva > sv_vaddr);
7987                                 ASSERT(sv_vaddr >= rsaddr);
7988                                 ASSERT(sv_vaddr < readdr);
7989                                 ASSERT(eva <= readdr);
7990                         }
7991 #endif /* DEBUG */
7992                         /*
7993                          * Continue the search if we
7994                          * found an invalid 8K tte outside of the area
7995                          * covered by this hmeblk's region.
7996                          */
7997                         if (TTE_IS_VALID(ttep)) {
7998                                 SFMMU_HASH_UNLOCK(hmebp);
7999                                 pfn = TTE_TO_PFN(sv_vaddr, ttep);
8000                                 return (pfn);
8001                         } else if (get_hblk_ttesz(hmeblkp) > TTE8K ||
8002                             (sv_vaddr >= rsaddr && sv_vaddr < readdr)) {
8003                                 SFMMU_HASH_UNLOCK(hmebp);
8004                                 pfn = PFN_INVALID;
8005                                 return (pfn);
8006                         }
8007                 }
8008                 SFMMU_HASH_UNLOCK(hmebp);
8009                 hashno++;
8010         } while (hashno <= mmu_hashcnt);
8011         return (PFN_INVALID);
8012 }
8013 
8014 
8015 /*
8016  * For compatability with AT&T and later optimizations
8017  */
8018 /* ARGSUSED */
8019 void
8020 hat_map(struct hat *hat, caddr_t addr, size_t len, uint_t flags)
8021 {
8022         ASSERT(hat != NULL);
8023 }
8024 
8025 /*
8026  * Return the number of mappings to a particular page.  This number is an
8027  * approximation of the number of people sharing the page.
8028  *
8029  * shared hmeblks or ism hmeblks are counted as 1 mapping here.
8030  * hat_page_checkshare() can be used to compare threshold to share
8031  * count that reflects the number of region sharers albeit at higher cost.
8032  */
8033 ulong_t
8034 hat_page_getshare(page_t *pp)
8035 {
8036         page_t *spp = pp;       /* start page */
8037         kmutex_t *pml;
8038         ulong_t cnt;
8039         int index, sz = TTE64K;
8040 
8041         /*
8042          * We need to grab the mlist lock to make sure any outstanding
8043          * load/unloads complete.  Otherwise we could return zero
8044          * even though the unload(s) hasn't finished yet.
8045          */
8046         pml = sfmmu_mlist_enter(spp);
8047         cnt = spp->p_share;
8048 
8049 #ifdef VAC
8050         if (kpm_enable)
8051                 cnt += spp->p_kpmref;
8052 #endif
8053         if (vpm_enable && pp->p_vpmref) {
8054                 cnt += 1;
8055         }
8056 
8057         /*
8058          * If we have any large mappings, we count the number of
8059          * mappings that this large page is part of.
8060          */
8061         index = PP_MAPINDEX(spp);
8062         index >>= 1;
8063         while (index) {
8064                 pp = PP_GROUPLEADER(spp, sz);
8065                 if ((index & 0x1) && pp != spp) {
8066                         cnt += pp->p_share;
8067                         spp = pp;
8068                 }
8069                 index >>= 1;
8070                 sz++;
8071         }
8072         sfmmu_mlist_exit(pml);
8073         return (cnt);
8074 }
8075 
8076 /*
8077  * Return 1 if the number of mappings exceeds sh_thresh. Return 0
8078  * otherwise. Count shared hmeblks by region's refcnt.
8079  */
8080 int
8081 hat_page_checkshare(page_t *pp, ulong_t sh_thresh)
8082 {
8083         kmutex_t *pml;
8084         ulong_t cnt = 0;
8085         int index, sz = TTE8K;
8086         struct sf_hment *sfhme, *tmphme = NULL;
8087         struct hme_blk *hmeblkp;
8088 
8089         pml = sfmmu_mlist_enter(pp);
8090 
8091 #ifdef VAC
8092         if (kpm_enable)
8093                 cnt = pp->p_kpmref;
8094 #endif
8095 
8096         if (vpm_enable && pp->p_vpmref) {
8097                 cnt += 1;
8098         }
8099 
8100         if (pp->p_share + cnt > sh_thresh) {
8101                 sfmmu_mlist_exit(pml);
8102                 return (1);
8103         }
8104 
8105         index = PP_MAPINDEX(pp);
8106 
8107 again:
8108         for (sfhme = pp->p_mapping; sfhme; sfhme = tmphme) {
8109                 tmphme = sfhme->hme_next;
8110                 if (IS_PAHME(sfhme)) {
8111                         continue;
8112                 }
8113 
8114                 hmeblkp = sfmmu_hmetohblk(sfhme);
8115                 if (hme_size(sfhme) != sz) {
8116                         continue;
8117                 }
8118 
8119                 if (hmeblkp->hblk_shared) {
8120                         sf_srd_t *srdp = hblktosrd(hmeblkp);
8121                         uint_t rid = hmeblkp->hblk_tag.htag_rid;
8122                         sf_region_t *rgnp;
8123                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
8124                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
8125                         ASSERT(srdp != NULL);
8126                         rgnp = srdp->srd_hmergnp[rid];
8127                         SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp,
8128                             rgnp, rid);
8129                         cnt += rgnp->rgn_refcnt;
8130                 } else {
8131                         cnt++;
8132                 }
8133                 if (cnt > sh_thresh) {
8134                         sfmmu_mlist_exit(pml);
8135                         return (1);
8136                 }
8137         }
8138 
8139         index >>= 1;
8140         sz++;
8141         while (index) {
8142                 pp = PP_GROUPLEADER(pp, sz);
8143                 ASSERT(sfmmu_mlist_held(pp));
8144                 if (index & 0x1) {
8145                         goto again;
8146                 }
8147                 index >>= 1;
8148                 sz++;
8149         }
8150         sfmmu_mlist_exit(pml);
8151         return (0);
8152 }
8153 
8154 /*
8155  * Unload all large mappings to the pp and reset the p_szc field of every
8156  * constituent page according to the remaining mappings.
8157  *
8158  * pp must be locked SE_EXCL. Even though no other constituent pages are
8159  * locked it's legal to unload the large mappings to the pp because all
8160  * constituent pages of large locked mappings have to be locked SE_SHARED.
8161  * This means if we have SE_EXCL lock on one of constituent pages none of the
8162  * large mappings to pp are locked.
8163  *
8164  * Decrease p_szc field starting from the last constituent page and ending
8165  * with the root page. This method is used because other threads rely on the
8166  * root's p_szc to find the lock to syncronize on. After a root page_t's p_szc
8167  * is demoted then other threads will succeed in sfmmu_mlspl_enter(). This
8168  * ensures that p_szc changes of the constituent pages appears atomic for all
8169  * threads that use sfmmu_mlspl_enter() to examine p_szc field.
8170  *
8171  * This mechanism is only used for file system pages where it's not always
8172  * possible to get SE_EXCL locks on all constituent pages to demote the size
8173  * code (as is done for anonymous or kernel large pages).
8174  *
8175  * See more comments in front of sfmmu_mlspl_enter().
8176  */
8177 void
8178 hat_page_demote(page_t *pp)
8179 {
8180         int index;
8181         int sz;
8182         cpuset_t cpuset;
8183         int sync = 0;
8184         page_t *rootpp;
8185         struct sf_hment *sfhme;
8186         struct sf_hment *tmphme = NULL;
8187         uint_t pszc;
8188         page_t *lastpp;
8189         cpuset_t tset;
8190         pgcnt_t npgs;
8191         kmutex_t *pml;
8192         kmutex_t *pmtx = NULL;
8193 
8194         ASSERT(PAGE_EXCL(pp));
8195         ASSERT(!PP_ISFREE(pp));
8196         ASSERT(!PP_ISKAS(pp));
8197         ASSERT(page_szc_lock_assert(pp));
8198         pml = sfmmu_mlist_enter(pp);
8199 
8200         pszc = pp->p_szc;
8201         if (pszc == 0) {
8202                 goto out;
8203         }
8204 
8205         index = PP_MAPINDEX(pp) >> 1;
8206 
8207         if (index) {
8208                 CPUSET_ZERO(cpuset);
8209                 sz = TTE64K;
8210                 sync = 1;
8211         }
8212 
8213         while (index) {
8214                 if (!(index & 0x1)) {
8215                         index >>= 1;
8216                         sz++;
8217                         continue;
8218                 }
8219                 ASSERT(sz <= pszc);
8220                 rootpp = PP_GROUPLEADER(pp, sz);
8221                 for (sfhme = rootpp->p_mapping; sfhme; sfhme = tmphme) {
8222                         tmphme = sfhme->hme_next;
8223                         ASSERT(!IS_PAHME(sfhme));
8224                         if (hme_size(sfhme) != sz) {
8225                                 continue;
8226                         }
8227                         tset = sfmmu_pageunload(rootpp, sfhme, sz);
8228                         CPUSET_OR(cpuset, tset);
8229                 }
8230                 if (index >>= 1) {
8231                         sz++;
8232                 }
8233         }
8234 
8235         ASSERT(!PP_ISMAPPED_LARGE(pp));
8236 
8237         if (sync) {
8238                 xt_sync(cpuset);
8239 #ifdef VAC
8240                 if (PP_ISTNC(pp)) {
8241                         conv_tnc(rootpp, sz);
8242                 }
8243 #endif  /* VAC */
8244         }
8245 
8246         pmtx = sfmmu_page_enter(pp);
8247 
8248         ASSERT(pp->p_szc == pszc);
8249         rootpp = PP_PAGEROOT(pp);
8250         ASSERT(rootpp->p_szc == pszc);
8251         lastpp = PP_PAGENEXT_N(rootpp, TTEPAGES(pszc) - 1);
8252 
8253         while (lastpp != rootpp) {
8254                 sz = PP_MAPINDEX(lastpp) ? fnd_mapping_sz(lastpp) : 0;
8255                 ASSERT(sz < pszc);
8256                 npgs = (sz == 0) ? 1 : TTEPAGES(sz);
8257                 ASSERT(P2PHASE(lastpp->p_pagenum, npgs) == npgs - 1);
8258                 while (--npgs > 0) {
8259                         lastpp->p_szc = (uchar_t)sz;
8260                         lastpp = PP_PAGEPREV(lastpp);
8261                 }
8262                 if (sz) {
8263                         /*
8264                          * make sure before current root's pszc
8265                          * is updated all updates to constituent pages pszc
8266                          * fields are globally visible.
8267                          */
8268                         membar_producer();
8269                 }
8270                 lastpp->p_szc = sz;
8271                 ASSERT(IS_P2ALIGNED(lastpp->p_pagenum, TTEPAGES(sz)));
8272                 if (lastpp != rootpp) {
8273                         lastpp = PP_PAGEPREV(lastpp);
8274                 }
8275         }
8276         if (sz == 0) {
8277                 /* the loop above doesn't cover this case */
8278                 rootpp->p_szc = 0;
8279         }
8280 out:
8281         ASSERT(pp->p_szc == 0);
8282         if (pmtx != NULL) {
8283                 sfmmu_page_exit(pmtx);
8284         }
8285         sfmmu_mlist_exit(pml);
8286 }
8287 
8288 /*
8289  * Refresh the HAT ismttecnt[] element for size szc.
8290  * Caller must have set ISM busy flag to prevent mapping
8291  * lists from changing while we're traversing them.
8292  */
8293 pgcnt_t
8294 ism_tsb_entries(sfmmu_t *sfmmup, int szc)
8295 {
8296         ism_blk_t       *ism_blkp = sfmmup->sfmmu_iblk;
8297         ism_map_t       *ism_map;
8298         pgcnt_t         npgs = 0;
8299         pgcnt_t         npgs_scd = 0;
8300         int             j;
8301         sf_scd_t        *scdp;
8302         uchar_t         rid;
8303 
8304         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
8305         scdp = sfmmup->sfmmu_scdp;
8306 
8307         for (; ism_blkp != NULL; ism_blkp = ism_blkp->iblk_next) {
8308                 ism_map = ism_blkp->iblk_maps;
8309                 for (j = 0; ism_map[j].imap_ismhat && j < ISM_MAP_SLOTS; j++) {
8310                         rid = ism_map[j].imap_rid;
8311                         ASSERT(rid == SFMMU_INVALID_ISMRID ||
8312                             rid < sfmmup->sfmmu_srdp->srd_next_ismrid);
8313 
8314                         if (scdp != NULL && rid != SFMMU_INVALID_ISMRID &&
8315                             SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
8316                                 /* ISM is in sfmmup's SCD */
8317                                 npgs_scd +=
8318                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8319                         } else {
8320                                 /* ISMs is not in SCD */
8321                                 npgs +=
8322                                     ism_map[j].imap_ismhat->sfmmu_ttecnt[szc];
8323                         }
8324                 }
8325         }
8326         sfmmup->sfmmu_ismttecnt[szc] = npgs;
8327         sfmmup->sfmmu_scdismttecnt[szc] = npgs_scd;
8328         return (npgs);
8329 }
8330 
8331 /*
8332  * Yield the memory claim requirement for an address space.
8333  *
8334  * This is currently implemented as the number of bytes that have active
8335  * hardware translations that have page structures.  Therefore, it can
8336  * underestimate the traditional resident set size, eg, if the
8337  * physical page is present and the hardware translation is missing;
8338  * and it can overestimate the rss, eg, if there are active
8339  * translations to a frame buffer with page structs.
8340  * Also, it does not take sharing into account.
8341  *
8342  * Note that we don't acquire locks here since this function is most often
8343  * called from the clock thread.
8344  */
8345 size_t
8346 hat_get_mapped_size(struct hat *hat)
8347 {
8348         size_t          assize = 0;
8349         int             i;
8350 
8351         if (hat == NULL)
8352                 return (0);
8353 
8354         for (i = 0; i < mmu_page_sizes; i++)
8355                 assize += ((pgcnt_t)hat->sfmmu_ttecnt[i] +
8356                     (pgcnt_t)hat->sfmmu_scdrttecnt[i]) * TTEBYTES(i);
8357 
8358         if (hat->sfmmu_iblk == NULL)
8359                 return (assize);
8360 
8361         for (i = 0; i < mmu_page_sizes; i++)
8362                 assize += ((pgcnt_t)hat->sfmmu_ismttecnt[i] +
8363                     (pgcnt_t)hat->sfmmu_scdismttecnt[i]) * TTEBYTES(i);
8364 
8365         return (assize);
8366 }
8367 
8368 int
8369 hat_stats_enable(struct hat *hat)
8370 {
8371         hatlock_t       *hatlockp;
8372 
8373         hatlockp = sfmmu_hat_enter(hat);
8374         hat->sfmmu_rmstat++;
8375         sfmmu_hat_exit(hatlockp);
8376         return (1);
8377 }
8378 
8379 void
8380 hat_stats_disable(struct hat *hat)
8381 {
8382         hatlock_t       *hatlockp;
8383 
8384         hatlockp = sfmmu_hat_enter(hat);
8385         hat->sfmmu_rmstat--;
8386         sfmmu_hat_exit(hatlockp);
8387 }
8388 
8389 /*
8390  * Routines for entering or removing  ourselves from the
8391  * ism_hat's mapping list. This is used for both private and
8392  * SCD hats.
8393  */
8394 static void
8395 iment_add(struct ism_ment *iment,  struct hat *ism_hat)
8396 {
8397         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8398 
8399         iment->iment_prev = NULL;
8400         iment->iment_next = ism_hat->sfmmu_iment;
8401         if (ism_hat->sfmmu_iment) {
8402                 ism_hat->sfmmu_iment->iment_prev = iment;
8403         }
8404         ism_hat->sfmmu_iment = iment;
8405 }
8406 
8407 static void
8408 iment_sub(struct ism_ment *iment, struct hat *ism_hat)
8409 {
8410         ASSERT(MUTEX_HELD(&ism_mlist_lock));
8411 
8412         if (ism_hat->sfmmu_iment == NULL) {
8413                 panic("ism map entry remove - no entries");
8414         }
8415 
8416         if (iment->iment_prev) {
8417                 ASSERT(ism_hat->sfmmu_iment != iment);
8418                 iment->iment_prev->iment_next = iment->iment_next;
8419         } else {
8420                 ASSERT(ism_hat->sfmmu_iment == iment);
8421                 ism_hat->sfmmu_iment = iment->iment_next;
8422         }
8423 
8424         if (iment->iment_next) {
8425                 iment->iment_next->iment_prev = iment->iment_prev;
8426         }
8427 
8428         /*
8429          * zero out the entry
8430          */
8431         iment->iment_next = NULL;
8432         iment->iment_prev = NULL;
8433         iment->iment_hat =  NULL;
8434         iment->iment_base_va = 0;
8435 }
8436 
8437 /*
8438  * Hat_share()/unshare() return an (non-zero) error
8439  * when saddr and daddr are not properly aligned.
8440  *
8441  * The top level mapping element determines the alignment
8442  * requirement for saddr and daddr, depending on different
8443  * architectures.
8444  *
8445  * When hat_share()/unshare() are not supported,
8446  * HATOP_SHARE()/UNSHARE() return 0
8447  */
8448 int
8449 hat_share(struct hat *sfmmup, caddr_t addr, struct hat *ism_hatid,
8450     caddr_t sptaddr, size_t len, uint_t ismszc)
8451 {
8452         ism_blk_t       *ism_blkp;
8453         ism_blk_t       *new_iblk;
8454         ism_map_t       *ism_map;
8455         ism_ment_t      *ism_ment;
8456         int             i, added;
8457         hatlock_t       *hatlockp;
8458         int             reload_mmu = 0;
8459         uint_t          ismshift = page_get_shift(ismszc);
8460         size_t          ismpgsz = page_get_pagesize(ismszc);
8461         uint_t          ismmask = (uint_t)ismpgsz - 1;
8462         size_t          sh_size = ISM_SHIFT(ismshift, len);
8463         ushort_t        ismhatflag;
8464         hat_region_cookie_t rcookie;
8465         sf_scd_t        *old_scdp;
8466 
8467 #ifdef DEBUG
8468         caddr_t         eaddr = addr + len;
8469 #endif /* DEBUG */
8470 
8471         ASSERT(ism_hatid != NULL && sfmmup != NULL);
8472         ASSERT(sptaddr == ISMID_STARTADDR);
8473         /*
8474          * Check the alignment.
8475          */
8476         if (!ISM_ALIGNED(ismshift, addr) || !ISM_ALIGNED(ismshift, sptaddr))
8477                 return (EINVAL);
8478 
8479         /*
8480          * Check size alignment.
8481          */
8482         if (!ISM_ALIGNED(ismshift, len))
8483                 return (EINVAL);
8484 
8485         /*
8486          * Allocate ism_ment for the ism_hat's mapping list, and an
8487          * ism map blk in case we need one.  We must do our
8488          * allocations before acquiring locks to prevent a deadlock
8489          * in the kmem allocator on the mapping list lock.
8490          */
8491         new_iblk = kmem_cache_alloc(ism_blk_cache, KM_SLEEP);
8492         ism_ment = kmem_cache_alloc(ism_ment_cache, KM_SLEEP);
8493 
8494         /*
8495          * Serialize ISM mappings with the ISM busy flag, and also the
8496          * trap handlers.
8497          */
8498         sfmmu_ismhat_enter(sfmmup, 0);
8499 
8500         /*
8501          * Allocate an ism map blk if necessary.
8502          */
8503         if (sfmmup->sfmmu_iblk == NULL) {
8504                 sfmmup->sfmmu_iblk = new_iblk;
8505                 bzero(new_iblk, sizeof (*new_iblk));
8506                 new_iblk->iblk_nextpa = (uint64_t)-1;
8507                 membar_stst();  /* make sure next ptr visible to all CPUs */
8508                 sfmmup->sfmmu_ismblkpa = va_to_pa((caddr_t)new_iblk);
8509                 reload_mmu = 1;
8510                 new_iblk = NULL;
8511         }
8512 
8513 #ifdef DEBUG
8514         /*
8515          * Make sure mapping does not already exist.
8516          */
8517         ism_blkp = sfmmup->sfmmu_iblk;
8518         while (ism_blkp != NULL) {
8519                 ism_map = ism_blkp->iblk_maps;
8520                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
8521                         if ((addr >= ism_start(ism_map[i]) &&
8522                             addr < ism_end(ism_map[i])) ||
8523                             eaddr > ism_start(ism_map[i]) &&
8524                             eaddr <= ism_end(ism_map[i])) {
8525                                 panic("sfmmu_share: Already mapped!");
8526                         }
8527                 }
8528                 ism_blkp = ism_blkp->iblk_next;
8529         }
8530 #endif /* DEBUG */
8531 
8532         ASSERT(ismszc >= TTE4M);
8533         if (ismszc == TTE4M) {
8534                 ismhatflag = HAT_4M_FLAG;
8535         } else if (ismszc == TTE32M) {
8536                 ismhatflag = HAT_32M_FLAG;
8537         } else if (ismszc == TTE256M) {
8538                 ismhatflag = HAT_256M_FLAG;
8539         }
8540         /*
8541          * Add mapping to first available mapping slot.
8542          */
8543         ism_blkp = sfmmup->sfmmu_iblk;
8544         added = 0;
8545         while (!added) {
8546                 ism_map = ism_blkp->iblk_maps;
8547                 for (i = 0; i < ISM_MAP_SLOTS; i++)  {
8548                         if (ism_map[i].imap_ismhat == NULL) {
8549 
8550                                 ism_map[i].imap_ismhat = ism_hatid;
8551                                 ism_map[i].imap_vb_shift = (uchar_t)ismshift;
8552                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8553                                 ism_map[i].imap_hatflags = ismhatflag;
8554                                 ism_map[i].imap_sz_mask = ismmask;
8555                                 /*
8556                                  * imap_seg is checked in ISM_CHECK to see if
8557                                  * non-NULL, then other info assumed valid.
8558                                  */
8559                                 membar_stst();
8560                                 ism_map[i].imap_seg = (uintptr_t)addr | sh_size;
8561                                 ism_map[i].imap_ment = ism_ment;
8562 
8563                                 /*
8564                                  * Now add ourselves to the ism_hat's
8565                                  * mapping list.
8566                                  */
8567                                 ism_ment->iment_hat = sfmmup;
8568                                 ism_ment->iment_base_va = addr;
8569                                 ism_hatid->sfmmu_ismhat = 1;
8570                                 mutex_enter(&ism_mlist_lock);
8571                                 iment_add(ism_ment, ism_hatid);
8572                                 mutex_exit(&ism_mlist_lock);
8573                                 added = 1;
8574                                 break;
8575                         }
8576                 }
8577                 if (!added && ism_blkp->iblk_next == NULL) {
8578                         ism_blkp->iblk_next = new_iblk;
8579                         new_iblk = NULL;
8580                         bzero(ism_blkp->iblk_next,
8581                             sizeof (*ism_blkp->iblk_next));
8582                         ism_blkp->iblk_next->iblk_nextpa = (uint64_t)-1;
8583                         membar_stst();
8584                         ism_blkp->iblk_nextpa =
8585                             va_to_pa((caddr_t)ism_blkp->iblk_next);
8586                 }
8587                 ism_blkp = ism_blkp->iblk_next;
8588         }
8589 
8590         /*
8591          * After calling hat_join_region, sfmmup may join a new SCD or
8592          * move from the old scd to a new scd, in which case, we want to
8593          * shrink the sfmmup's private tsb size, i.e., pass shrink to
8594          * sfmmu_check_page_sizes at the end of this routine.
8595          */
8596         old_scdp = sfmmup->sfmmu_scdp;
8597 
8598         rcookie = hat_join_region(sfmmup, addr, len, (void *)ism_hatid, 0,
8599             PROT_ALL, ismszc, NULL, HAT_REGION_ISM);
8600         if (rcookie != HAT_INVALID_REGION_COOKIE) {
8601                 ism_map[i].imap_rid = (uchar_t)((uint64_t)rcookie);
8602         }
8603         /*
8604          * Update our counters for this sfmmup's ism mappings.
8605          */
8606         for (i = 0; i <= ismszc; i++) {
8607                 if (!(disable_ism_large_pages & (1 << i)))
8608                         (void) ism_tsb_entries(sfmmup, i);
8609         }
8610 
8611         /*
8612          * For ISM and DISM we do not support 512K pages, so we only only
8613          * search the 4M and 8K/64K hashes for 4 pagesize cpus, and search the
8614          * 256M or 32M, and 4M and 8K/64K hashes for 6 pagesize cpus.
8615          *
8616          * Need to set 32M/256M ISM flags to make sure
8617          * sfmmu_check_page_sizes() enables them on Panther.
8618          */
8619         ASSERT((disable_ism_large_pages & (1 << TTE512K)) != 0);
8620 
8621         switch (ismszc) {
8622         case TTE256M:
8623                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_256M_ISM)) {
8624                         hatlockp = sfmmu_hat_enter(sfmmup);
8625                         SFMMU_FLAGS_SET(sfmmup, HAT_256M_ISM);
8626                         sfmmu_hat_exit(hatlockp);
8627                 }
8628                 break;
8629         case TTE32M:
8630                 if (!SFMMU_FLAGS_ISSET(sfmmup, HAT_32M_ISM)) {
8631                         hatlockp = sfmmu_hat_enter(sfmmup);
8632                         SFMMU_FLAGS_SET(sfmmup, HAT_32M_ISM);
8633                         sfmmu_hat_exit(hatlockp);
8634                 }
8635                 break;
8636         default:
8637                 break;
8638         }
8639 
8640         /*
8641          * If we updated the ismblkpa for this HAT we must make
8642          * sure all CPUs running this process reload their tsbmiss area.
8643          * Otherwise they will fail to load the mappings in the tsbmiss
8644          * handler and will loop calling pagefault().
8645          */
8646         if (reload_mmu) {
8647                 hatlockp = sfmmu_hat_enter(sfmmup);
8648                 sfmmu_sync_mmustate(sfmmup);
8649                 sfmmu_hat_exit(hatlockp);
8650         }
8651 
8652         sfmmu_ismhat_exit(sfmmup, 0);
8653 
8654         /*
8655          * Free up ismblk if we didn't use it.
8656          */
8657         if (new_iblk != NULL)
8658                 kmem_cache_free(ism_blk_cache, new_iblk);
8659 
8660         /*
8661          * Check TSB and TLB page sizes.
8662          */
8663         if (sfmmup->sfmmu_scdp != NULL && old_scdp != sfmmup->sfmmu_scdp) {
8664                 sfmmu_check_page_sizes(sfmmup, 0);
8665         } else {
8666                 sfmmu_check_page_sizes(sfmmup, 1);
8667         }
8668         return (0);
8669 }
8670 
8671 /*
8672  * hat_unshare removes exactly one ism_map from
8673  * this process's as.  It expects multiple calls
8674  * to hat_unshare for multiple shm segments.
8675  */
8676 void
8677 hat_unshare(struct hat *sfmmup, caddr_t addr, size_t len, uint_t ismszc)
8678 {
8679         ism_map_t       *ism_map;
8680         ism_ment_t      *free_ment = NULL;
8681         ism_blk_t       *ism_blkp;
8682         struct hat      *ism_hatid;
8683         int             found, i;
8684         hatlock_t       *hatlockp;
8685         struct tsb_info *tsbinfo;
8686         uint_t          ismshift = page_get_shift(ismszc);
8687         size_t          sh_size = ISM_SHIFT(ismshift, len);
8688         uchar_t         ism_rid;
8689         sf_scd_t        *old_scdp;
8690 
8691         ASSERT(ISM_ALIGNED(ismshift, addr));
8692         ASSERT(ISM_ALIGNED(ismshift, len));
8693         ASSERT(sfmmup != NULL);
8694         ASSERT(sfmmup != ksfmmup);
8695 
8696         ASSERT(sfmmup->sfmmu_as != NULL);
8697 
8698         /*
8699          * Make sure that during the entire time ISM mappings are removed,
8700          * the trap handlers serialize behind us, and that no one else
8701          * can be mucking with ISM mappings.  This also lets us get away
8702          * with not doing expensive cross calls to flush the TLB -- we
8703          * just discard the context, flush the entire TSB, and call it
8704          * a day.
8705          */
8706         sfmmu_ismhat_enter(sfmmup, 0);
8707 
8708         /*
8709          * Remove the mapping.
8710          *
8711          * We can't have any holes in the ism map.
8712          * The tsb miss code while searching the ism map will
8713          * stop on an empty map slot.  So we must move
8714          * everyone past the hole up 1 if any.
8715          *
8716          * Also empty ism map blks are not freed until the
8717          * process exits. This is to prevent a MT race condition
8718          * between sfmmu_unshare() and sfmmu_tsbmiss_exception().
8719          */
8720         found = 0;
8721         ism_blkp = sfmmup->sfmmu_iblk;
8722         while (!found && ism_blkp != NULL) {
8723                 ism_map = ism_blkp->iblk_maps;
8724                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
8725                         if (addr == ism_start(ism_map[i]) &&
8726                             sh_size == (size_t)(ism_size(ism_map[i]))) {
8727                                 found = 1;
8728                                 break;
8729                         }
8730                 }
8731                 if (!found)
8732                         ism_blkp = ism_blkp->iblk_next;
8733         }
8734 
8735         if (found) {
8736                 ism_hatid = ism_map[i].imap_ismhat;
8737                 ism_rid = ism_map[i].imap_rid;
8738                 ASSERT(ism_hatid != NULL);
8739                 ASSERT(ism_hatid->sfmmu_ismhat == 1);
8740 
8741                 /*
8742                  * After hat_leave_region, the sfmmup may leave SCD,
8743                  * in which case, we want to grow the private tsb size when
8744                  * calling sfmmu_check_page_sizes at the end of the routine.
8745                  */
8746                 old_scdp = sfmmup->sfmmu_scdp;
8747                 /*
8748                  * Then remove ourselves from the region.
8749                  */
8750                 if (ism_rid != SFMMU_INVALID_ISMRID) {
8751                         hat_leave_region(sfmmup, (void *)((uint64_t)ism_rid),
8752                             HAT_REGION_ISM);
8753                 }
8754 
8755                 /*
8756                  * And now guarantee that any other cpu
8757                  * that tries to process an ISM miss
8758                  * will go to tl=0.
8759                  */
8760                 hatlockp = sfmmu_hat_enter(sfmmup);
8761                 sfmmu_invalidate_ctx(sfmmup);
8762                 sfmmu_hat_exit(hatlockp);
8763 
8764                 /*
8765                  * Remove ourselves from the ism mapping list.
8766                  */
8767                 mutex_enter(&ism_mlist_lock);
8768                 iment_sub(ism_map[i].imap_ment, ism_hatid);
8769                 mutex_exit(&ism_mlist_lock);
8770                 free_ment = ism_map[i].imap_ment;
8771 
8772                 /*
8773                  * We delete the ism map by copying
8774                  * the next map over the current one.
8775                  * We will take the next one in the maps
8776                  * array or from the next ism_blk.
8777                  */
8778                 while (ism_blkp != NULL) {
8779                         ism_map = ism_blkp->iblk_maps;
8780                         while (i < (ISM_MAP_SLOTS - 1)) {
8781                                 ism_map[i] = ism_map[i + 1];
8782                                 i++;
8783                         }
8784                         /* i == (ISM_MAP_SLOTS - 1) */
8785                         ism_blkp = ism_blkp->iblk_next;
8786                         if (ism_blkp != NULL) {
8787                                 ism_map[i] = ism_blkp->iblk_maps[0];
8788                                 i = 0;
8789                         } else {
8790                                 ism_map[i].imap_seg = 0;
8791                                 ism_map[i].imap_vb_shift = 0;
8792                                 ism_map[i].imap_rid = SFMMU_INVALID_ISMRID;
8793                                 ism_map[i].imap_hatflags = 0;
8794                                 ism_map[i].imap_sz_mask = 0;
8795                                 ism_map[i].imap_ismhat = NULL;
8796                                 ism_map[i].imap_ment = NULL;
8797                         }
8798                 }
8799 
8800                 /*
8801                  * Now flush entire TSB for the process, since
8802                  * demapping page by page can be too expensive.
8803                  * We don't have to flush the TLB here anymore
8804                  * since we switch to a new TLB ctx instead.
8805                  * Also, there is no need to flush if the process
8806                  * is exiting since the TSB will be freed later.
8807                  */
8808                 if (!sfmmup->sfmmu_free) {
8809                         hatlockp = sfmmu_hat_enter(sfmmup);
8810                         for (tsbinfo = sfmmup->sfmmu_tsb; tsbinfo != NULL;
8811                             tsbinfo = tsbinfo->tsb_next) {
8812                                 if (tsbinfo->tsb_flags & TSB_SWAPPED)
8813                                         continue;
8814                                 if (tsbinfo->tsb_flags & TSB_RELOC_FLAG) {
8815                                         tsbinfo->tsb_flags |=
8816                                             TSB_FLUSH_NEEDED;
8817                                         continue;
8818                                 }
8819 
8820                                 sfmmu_inv_tsb(tsbinfo->tsb_va,
8821                                     TSB_BYTES(tsbinfo->tsb_szc));
8822                         }
8823                         sfmmu_hat_exit(hatlockp);
8824                 }
8825         }
8826 
8827         /*
8828          * Update our counters for this sfmmup's ism mappings.
8829          */
8830         for (i = 0; i <= ismszc; i++) {
8831                 if (!(disable_ism_large_pages & (1 << i)))
8832                         (void) ism_tsb_entries(sfmmup, i);
8833         }
8834 
8835         sfmmu_ismhat_exit(sfmmup, 0);
8836 
8837         /*
8838          * We must do our freeing here after dropping locks
8839          * to prevent a deadlock in the kmem allocator on the
8840          * mapping list lock.
8841          */
8842         if (free_ment != NULL)
8843                 kmem_cache_free(ism_ment_cache, free_ment);
8844 
8845         /*
8846          * Check TSB and TLB page sizes if the process isn't exiting.
8847          */
8848         if (!sfmmup->sfmmu_free) {
8849                 if (found && old_scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
8850                         sfmmu_check_page_sizes(sfmmup, 1);
8851                 } else {
8852                         sfmmu_check_page_sizes(sfmmup, 0);
8853                 }
8854         }
8855 }
8856 
8857 /* ARGSUSED */
8858 static int
8859 sfmmu_idcache_constructor(void *buf, void *cdrarg, int kmflags)
8860 {
8861         /* void *buf is sfmmu_t pointer */
8862         bzero(buf, sizeof (sfmmu_t));
8863 
8864         return (0);
8865 }
8866 
8867 /* ARGSUSED */
8868 static void
8869 sfmmu_idcache_destructor(void *buf, void *cdrarg)
8870 {
8871         /* void *buf is sfmmu_t pointer */
8872 }
8873 
8874 /*
8875  * setup kmem hmeblks by bzeroing all members and initializing the nextpa
8876  * field to be the pa of this hmeblk
8877  */
8878 /* ARGSUSED */
8879 static int
8880 sfmmu_hblkcache_constructor(void *buf, void *cdrarg, int kmflags)
8881 {
8882         struct hme_blk *hmeblkp;
8883 
8884         bzero(buf, (size_t)cdrarg);
8885         hmeblkp = (struct hme_blk *)buf;
8886         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
8887 
8888 #ifdef  HBLK_TRACE
8889         mutex_init(&hmeblkp->hblk_audit_lock, NULL, MUTEX_DEFAULT, NULL);
8890 #endif  /* HBLK_TRACE */
8891 
8892         return (0);
8893 }
8894 
8895 /* ARGSUSED */
8896 static void
8897 sfmmu_hblkcache_destructor(void *buf, void *cdrarg)
8898 {
8899 
8900 #ifdef  HBLK_TRACE
8901 
8902         struct hme_blk *hmeblkp;
8903 
8904         hmeblkp = (struct hme_blk *)buf;
8905         mutex_destroy(&hmeblkp->hblk_audit_lock);
8906 
8907 #endif  /* HBLK_TRACE */
8908 }
8909 
8910 #define SFMMU_CACHE_RECLAIM_SCAN_RATIO 8
8911 static int sfmmu_cache_reclaim_scan_ratio = SFMMU_CACHE_RECLAIM_SCAN_RATIO;
8912 /*
8913  * The kmem allocator will callback into our reclaim routine when the system
8914  * is running low in memory.  We traverse the hash and free up all unused but
8915  * still cached hme_blks.  We also traverse the free list and free them up
8916  * as well.
8917  */
8918 /*ARGSUSED*/
8919 static void
8920 sfmmu_hblkcache_reclaim(void *cdrarg)
8921 {
8922         int i;
8923         struct hmehash_bucket *hmebp;
8924         struct hme_blk *hmeblkp, *nx_hblk, *pr_hblk = NULL;
8925         static struct hmehash_bucket *uhmehash_reclaim_hand;
8926         static struct hmehash_bucket *khmehash_reclaim_hand;
8927         struct hme_blk *list = NULL, *last_hmeblkp;
8928         cpuset_t cpuset = cpu_ready_set;
8929         cpu_hme_pend_t *cpuhp;
8930 
8931         /* Free up hmeblks on the cpu pending lists */
8932         for (i = 0; i < NCPU; i++) {
8933                 cpuhp = &cpu_hme_pend[i];
8934                 if (cpuhp->chp_listp != NULL)  {
8935                         mutex_enter(&cpuhp->chp_mutex);
8936                         if (cpuhp->chp_listp == NULL) {
8937                                 mutex_exit(&cpuhp->chp_mutex);
8938                                 continue;
8939                         }
8940                         for (last_hmeblkp = cpuhp->chp_listp;
8941                             last_hmeblkp->hblk_next != NULL;
8942                             last_hmeblkp = last_hmeblkp->hblk_next)
8943                                 ;
8944                         last_hmeblkp->hblk_next = list;
8945                         list = cpuhp->chp_listp;
8946                         cpuhp->chp_listp = NULL;
8947                         cpuhp->chp_count = 0;
8948                         mutex_exit(&cpuhp->chp_mutex);
8949                 }
8950 
8951         }
8952 
8953         if (list != NULL) {
8954                 kpreempt_disable();
8955                 CPUSET_DEL(cpuset, CPU->cpu_id);
8956                 xt_sync(cpuset);
8957                 xt_sync(cpuset);
8958                 kpreempt_enable();
8959                 sfmmu_hblk_free(&list);
8960                 list = NULL;
8961         }
8962 
8963         hmebp = uhmehash_reclaim_hand;
8964         if (hmebp == NULL || hmebp > &uhme_hash[UHMEHASH_SZ])
8965                 uhmehash_reclaim_hand = hmebp = uhme_hash;
8966         uhmehash_reclaim_hand += UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8967 
8968         for (i = UHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8969                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8970                         hmeblkp = hmebp->hmeblkp;
8971                         pr_hblk = NULL;
8972                         while (hmeblkp) {
8973                                 nx_hblk = hmeblkp->hblk_next;
8974                                 if (!hmeblkp->hblk_vcnt &&
8975                                     !hmeblkp->hblk_hmecnt) {
8976                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
8977                                             pr_hblk, &list, 0);
8978                                 } else {
8979                                         pr_hblk = hmeblkp;
8980                                 }
8981                                 hmeblkp = nx_hblk;
8982                         }
8983                         SFMMU_HASH_UNLOCK(hmebp);
8984                 }
8985                 if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
8986                         hmebp = uhme_hash;
8987         }
8988 
8989         hmebp = khmehash_reclaim_hand;
8990         if (hmebp == NULL || hmebp > &khme_hash[KHMEHASH_SZ])
8991                 khmehash_reclaim_hand = hmebp = khme_hash;
8992         khmehash_reclaim_hand += KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio;
8993 
8994         for (i = KHMEHASH_SZ / sfmmu_cache_reclaim_scan_ratio; i; i--) {
8995                 if (SFMMU_HASH_LOCK_TRYENTER(hmebp) != 0) {
8996                         hmeblkp = hmebp->hmeblkp;
8997                         pr_hblk = NULL;
8998                         while (hmeblkp) {
8999                                 nx_hblk = hmeblkp->hblk_next;
9000                                 if (!hmeblkp->hblk_vcnt &&
9001                                     !hmeblkp->hblk_hmecnt) {
9002                                         sfmmu_hblk_hash_rm(hmebp, hmeblkp,
9003                                             pr_hblk, &list, 0);
9004                                 } else {
9005                                         pr_hblk = hmeblkp;
9006                                 }
9007                                 hmeblkp = nx_hblk;
9008                         }
9009                         SFMMU_HASH_UNLOCK(hmebp);
9010                 }
9011                 if (hmebp++ == &khme_hash[KHMEHASH_SZ])
9012                         hmebp = khme_hash;
9013         }
9014         sfmmu_hblks_list_purge(&list, 0);
9015 }
9016 
9017 /*
9018  * sfmmu_get_ppvcolor should become a vm_machdep or hatop interface.
9019  * same goes for sfmmu_get_addrvcolor().
9020  *
9021  * This function will return the virtual color for the specified page. The
9022  * virtual color corresponds to this page current mapping or its last mapping.
9023  * It is used by memory allocators to choose addresses with the correct
9024  * alignment so vac consistency is automatically maintained.  If the page
9025  * has no color it returns -1.
9026  */
9027 /*ARGSUSED*/
9028 int
9029 sfmmu_get_ppvcolor(struct page *pp)
9030 {
9031 #ifdef VAC
9032         int color;
9033 
9034         if (!(cache & CACHE_VAC) || PP_NEWPAGE(pp)) {
9035                 return (-1);
9036         }
9037         color = PP_GET_VCOLOR(pp);
9038         ASSERT(color < mmu_btop(shm_alignment));
9039         return (color);
9040 #else
9041         return (-1);
9042 #endif  /* VAC */
9043 }
9044 
9045 /*
9046  * This function will return the desired alignment for vac consistency
9047  * (vac color) given a virtual address.  If no vac is present it returns -1.
9048  */
9049 /*ARGSUSED*/
9050 int
9051 sfmmu_get_addrvcolor(caddr_t vaddr)
9052 {
9053 #ifdef VAC
9054         if (cache & CACHE_VAC) {
9055                 return (addr_to_vcolor(vaddr));
9056         } else {
9057                 return (-1);
9058         }
9059 #else
9060         return (-1);
9061 #endif  /* VAC */
9062 }
9063 
9064 #ifdef VAC
9065 /*
9066  * Check for conflicts.
9067  * A conflict exists if the new and existent mappings do not match in
9068  * their "shm_alignment fields. If conflicts exist, the existant mappings
9069  * are flushed unless one of them is locked. If one of them is locked, then
9070  * the mappings are flushed and converted to non-cacheable mappings.
9071  */
9072 static void
9073 sfmmu_vac_conflict(struct hat *hat, caddr_t addr, page_t *pp)
9074 {
9075         struct hat *tmphat;
9076         struct sf_hment *sfhmep, *tmphme = NULL;
9077         struct hme_blk *hmeblkp;
9078         int vcolor;
9079         tte_t tte;
9080 
9081         ASSERT(sfmmu_mlist_held(pp));
9082         ASSERT(!PP_ISNC(pp));           /* page better be cacheable */
9083 
9084         vcolor = addr_to_vcolor(addr);
9085         if (PP_NEWPAGE(pp)) {
9086                 PP_SET_VCOLOR(pp, vcolor);
9087                 return;
9088         }
9089 
9090         if (PP_GET_VCOLOR(pp) == vcolor) {
9091                 return;
9092         }
9093 
9094         if (!PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp)) {
9095                 /*
9096                  * Previous user of page had a different color
9097                  * but since there are no current users
9098                  * we just flush the cache and change the color.
9099                  */
9100                 SFMMU_STAT(sf_pgcolor_conflict);
9101                 sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9102                 PP_SET_VCOLOR(pp, vcolor);
9103                 return;
9104         }
9105 
9106         /*
9107          * If we get here we have a vac conflict with a current
9108          * mapping.  VAC conflict policy is as follows.
9109          * - The default is to unload the other mappings unless:
9110          * - If we have a large mapping we uncache the page.
9111          * We need to uncache the rest of the large page too.
9112          * - If any of the mappings are locked we uncache the page.
9113          * - If the requested mapping is inconsistent
9114          * with another mapping and that mapping
9115          * is in the same address space we have to
9116          * make it non-cached.  The default thing
9117          * to do is unload the inconsistent mapping
9118          * but if they are in the same address space
9119          * we run the risk of unmapping the pc or the
9120          * stack which we will use as we return to the user,
9121          * in which case we can then fault on the thing
9122          * we just unloaded and get into an infinite loop.
9123          */
9124         if (PP_ISMAPPED_LARGE(pp)) {
9125                 int sz;
9126 
9127                 /*
9128                  * Existing mapping is for big pages. We don't unload
9129                  * existing big mappings to satisfy new mappings.
9130                  * Always convert all mappings to TNC.
9131                  */
9132                 sz = fnd_mapping_sz(pp);
9133                 pp = PP_GROUPLEADER(pp, sz);
9134                 SFMMU_STAT_ADD(sf_uncache_conflict, TTEPAGES(sz));
9135                 sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH,
9136                     TTEPAGES(sz));
9137 
9138                 return;
9139         }
9140 
9141         /*
9142          * check if any mapping is in same as or if it is locked
9143          * since in that case we need to uncache.
9144          */
9145         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9146                 tmphme = sfhmep->hme_next;
9147                 if (IS_PAHME(sfhmep))
9148                         continue;
9149                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9150                 tmphat = hblktosfmmu(hmeblkp);
9151                 sfmmu_copytte(&sfhmep->hme_tte, &tte);
9152                 ASSERT(TTE_IS_VALID(&tte));
9153                 if (hmeblkp->hblk_shared || tmphat == hat ||
9154                     hmeblkp->hblk_lckcnt) {
9155                         /*
9156                          * We have an uncache conflict
9157                          */
9158                         SFMMU_STAT(sf_uncache_conflict);
9159                         sfmmu_page_cache_array(pp, HAT_TMPNC, CACHE_FLUSH, 1);
9160                         return;
9161                 }
9162         }
9163 
9164         /*
9165          * We have an unload conflict
9166          * We have already checked for LARGE mappings, therefore
9167          * the remaining mapping(s) must be TTE8K.
9168          */
9169         SFMMU_STAT(sf_unload_conflict);
9170 
9171         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = tmphme) {
9172                 tmphme = sfhmep->hme_next;
9173                 if (IS_PAHME(sfhmep))
9174                         continue;
9175                 hmeblkp = sfmmu_hmetohblk(sfhmep);
9176                 ASSERT(!hmeblkp->hblk_shared);
9177                 (void) sfmmu_pageunload(pp, sfhmep, TTE8K);
9178         }
9179 
9180         if (PP_ISMAPPED_KPM(pp))
9181                 sfmmu_kpm_vac_unload(pp, addr);
9182 
9183         /*
9184          * Unloads only do TLB flushes so we need to flush the
9185          * cache here.
9186          */
9187         sfmmu_cache_flush(pp->p_pagenum, PP_GET_VCOLOR(pp));
9188         PP_SET_VCOLOR(pp, vcolor);
9189 }
9190 
9191 /*
9192  * Whenever a mapping is unloaded and the page is in TNC state,
9193  * we see if the page can be made cacheable again. 'pp' is
9194  * the page that we just unloaded a mapping from, the size
9195  * of mapping that was unloaded is 'ottesz'.
9196  * Remark:
9197  * The recache policy for mpss pages can leave a performance problem
9198  * under the following circumstances:
9199  * . A large page in uncached mode has just been unmapped.
9200  * . All constituent pages are TNC due to a conflicting small mapping.
9201  * . There are many other, non conflicting, small mappings around for
9202  *   a lot of the constituent pages.
9203  * . We're called w/ the "old" groupleader page and the old ottesz,
9204  *   but this is irrelevant, since we're no more "PP_ISMAPPED_LARGE", so
9205  *   we end up w/ TTE8K or npages == 1.
9206  * . We call tst_tnc w/ the old groupleader only, and if there is no
9207  *   conflict, we re-cache only this page.
9208  * . All other small mappings are not checked and will be left in TNC mode.
9209  * The problem is not very serious because:
9210  * . mpss is actually only defined for heap and stack, so the probability
9211  *   is not very high that a large page mapping exists in parallel to a small
9212  *   one (this is possible, but seems to be bad programming style in the
9213  *   appl).
9214  * . The problem gets a little bit more serious, when those TNC pages
9215  *   have to be mapped into kernel space, e.g. for networking.
9216  * . When VAC alias conflicts occur in applications, this is regarded
9217  *   as an application bug. So if kstat's show them, the appl should
9218  *   be changed anyway.
9219  */
9220 void
9221 conv_tnc(page_t *pp, int ottesz)
9222 {
9223         int cursz, dosz;
9224         pgcnt_t curnpgs, dopgs;
9225         pgcnt_t pg64k;
9226         page_t *pp2;
9227 
9228         /*
9229          * Determine how big a range we check for TNC and find
9230          * leader page. cursz is the size of the biggest
9231          * mapping that still exist on 'pp'.
9232          */
9233         if (PP_ISMAPPED_LARGE(pp)) {
9234                 cursz = fnd_mapping_sz(pp);
9235         } else {
9236                 cursz = TTE8K;
9237         }
9238 
9239         if (ottesz >= cursz) {
9240                 dosz = ottesz;
9241                 pp2 = pp;
9242         } else {
9243                 dosz = cursz;
9244                 pp2 = PP_GROUPLEADER(pp, dosz);
9245         }
9246 
9247         pg64k = TTEPAGES(TTE64K);
9248         dopgs = TTEPAGES(dosz);
9249 
9250         ASSERT(dopgs == 1 || ((dopgs & (pg64k - 1)) == 0));
9251 
9252         while (dopgs != 0) {
9253                 curnpgs = TTEPAGES(cursz);
9254                 if (tst_tnc(pp2, curnpgs)) {
9255                         SFMMU_STAT_ADD(sf_recache, curnpgs);
9256                         sfmmu_page_cache_array(pp2, HAT_CACHE, CACHE_NO_FLUSH,
9257                             curnpgs);
9258                 }
9259 
9260                 ASSERT(dopgs >= curnpgs);
9261                 dopgs -= curnpgs;
9262 
9263                 if (dopgs == 0) {
9264                         break;
9265                 }
9266 
9267                 pp2 = PP_PAGENEXT_N(pp2, curnpgs);
9268                 if (((dopgs & (pg64k - 1)) == 0) && PP_ISMAPPED_LARGE(pp2)) {
9269                         cursz = fnd_mapping_sz(pp2);
9270                 } else {
9271                         cursz = TTE8K;
9272                 }
9273         }
9274 }
9275 
9276 /*
9277  * Returns 1 if page(s) can be converted from TNC to cacheable setting,
9278  * returns 0 otherwise. Note that oaddr argument is valid for only
9279  * 8k pages.
9280  */
9281 int
9282 tst_tnc(page_t *pp, pgcnt_t npages)
9283 {
9284         struct  sf_hment *sfhme;
9285         struct  hme_blk *hmeblkp;
9286         tte_t   tte;
9287         caddr_t vaddr;
9288         int     clr_valid = 0;
9289         int     color, color1, bcolor;
9290         int     i, ncolors;
9291 
9292         ASSERT(pp != NULL);
9293         ASSERT(!(cache & CACHE_WRITEBACK));
9294 
9295         if (npages > 1) {
9296                 ncolors = CACHE_NUM_COLOR;
9297         }
9298 
9299         for (i = 0; i < npages; i++) {
9300                 ASSERT(sfmmu_mlist_held(pp));
9301                 ASSERT(PP_ISTNC(pp));
9302                 ASSERT(PP_GET_VCOLOR(pp) == NO_VCOLOR);
9303 
9304                 if (PP_ISPNC(pp)) {
9305                         return (0);
9306                 }
9307 
9308                 clr_valid = 0;
9309                 if (PP_ISMAPPED_KPM(pp)) {
9310                         caddr_t kpmvaddr;
9311 
9312                         ASSERT(kpm_enable);
9313                         kpmvaddr = hat_kpm_page2va(pp, 1);
9314                         ASSERT(!(npages > 1 && IS_KPM_ALIAS_RANGE(kpmvaddr)));
9315                         color1 = addr_to_vcolor(kpmvaddr);
9316                         clr_valid = 1;
9317                 }
9318 
9319                 for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9320                         if (IS_PAHME(sfhme))
9321                                 continue;
9322                         hmeblkp = sfmmu_hmetohblk(sfhme);
9323 
9324                         sfmmu_copytte(&sfhme->hme_tte, &tte);
9325                         ASSERT(TTE_IS_VALID(&tte));
9326 
9327                         vaddr = tte_to_vaddr(hmeblkp, tte);
9328                         color = addr_to_vcolor(vaddr);
9329 
9330                         if (npages > 1) {
9331                                 /*
9332                                  * If there is a big mapping, make sure
9333                                  * 8K mapping is consistent with the big
9334                                  * mapping.
9335                                  */
9336                                 bcolor = i % ncolors;
9337                                 if (color != bcolor) {
9338                                         return (0);
9339                                 }
9340                         }
9341                         if (!clr_valid) {
9342                                 clr_valid = 1;
9343                                 color1 = color;
9344                         }
9345 
9346                         if (color1 != color) {
9347                                 return (0);
9348                         }
9349                 }
9350 
9351                 pp = PP_PAGENEXT(pp);
9352         }
9353 
9354         return (1);
9355 }
9356 
9357 void
9358 sfmmu_page_cache_array(page_t *pp, int flags, int cache_flush_flag,
9359     pgcnt_t npages)
9360 {
9361         kmutex_t *pmtx;
9362         int i, ncolors, bcolor;
9363         kpm_hlk_t *kpmp;
9364         cpuset_t cpuset;
9365 
9366         ASSERT(pp != NULL);
9367         ASSERT(!(cache & CACHE_WRITEBACK));
9368 
9369         kpmp = sfmmu_kpm_kpmp_enter(pp, npages);
9370         pmtx = sfmmu_page_enter(pp);
9371 
9372         /*
9373          * Fast path caching single unmapped page
9374          */
9375         if (npages == 1 && !PP_ISMAPPED(pp) && !PP_ISMAPPED_KPM(pp) &&
9376             flags == HAT_CACHE) {
9377                 PP_CLRTNC(pp);
9378                 PP_CLRPNC(pp);
9379                 sfmmu_page_exit(pmtx);
9380                 sfmmu_kpm_kpmp_exit(kpmp);
9381                 return;
9382         }
9383 
9384         /*
9385          * We need to capture all cpus in order to change cacheability
9386          * because we can't allow one cpu to access the same physical
9387          * page using a cacheable and a non-cachebale mapping at the same
9388          * time. Since we may end up walking the ism mapping list
9389          * have to grab it's lock now since we can't after all the
9390          * cpus have been captured.
9391          */
9392         sfmmu_hat_lock_all();
9393         mutex_enter(&ism_mlist_lock);
9394         kpreempt_disable();
9395         cpuset = cpu_ready_set;
9396         xc_attention(cpuset);
9397 
9398         if (npages > 1) {
9399                 /*
9400                  * Make sure all colors are flushed since the
9401                  * sfmmu_page_cache() only flushes one color-
9402                  * it does not know big pages.
9403                  */
9404                 ncolors = CACHE_NUM_COLOR;
9405                 if (flags & HAT_TMPNC) {
9406                         for (i = 0; i < ncolors; i++) {
9407                                 sfmmu_cache_flushcolor(i, pp->p_pagenum);
9408                         }
9409                         cache_flush_flag = CACHE_NO_FLUSH;
9410                 }
9411         }
9412 
9413         for (i = 0; i < npages; i++) {
9414 
9415                 ASSERT(sfmmu_mlist_held(pp));
9416 
9417                 if (!(flags == HAT_TMPNC && PP_ISTNC(pp))) {
9418 
9419                         if (npages > 1) {
9420                                 bcolor = i % ncolors;
9421                         } else {
9422                                 bcolor = NO_VCOLOR;
9423                         }
9424 
9425                         sfmmu_page_cache(pp, flags, cache_flush_flag,
9426                             bcolor);
9427                 }
9428 
9429                 pp = PP_PAGENEXT(pp);
9430         }
9431 
9432         xt_sync(cpuset);
9433         xc_dismissed(cpuset);
9434         mutex_exit(&ism_mlist_lock);
9435         sfmmu_hat_unlock_all();
9436         sfmmu_page_exit(pmtx);
9437         sfmmu_kpm_kpmp_exit(kpmp);
9438         kpreempt_enable();
9439 }
9440 
9441 /*
9442  * This function changes the virtual cacheability of all mappings to a
9443  * particular page.  When changing from uncache to cacheable the mappings will
9444  * only be changed if all of them have the same virtual color.
9445  * We need to flush the cache in all cpus.  It is possible that
9446  * a process referenced a page as cacheable but has sinced exited
9447  * and cleared the mapping list.  We still to flush it but have no
9448  * state so all cpus is the only alternative.
9449  */
9450 static void
9451 sfmmu_page_cache(page_t *pp, int flags, int cache_flush_flag, int bcolor)
9452 {
9453         struct  sf_hment *sfhme;
9454         struct  hme_blk *hmeblkp;
9455         sfmmu_t *sfmmup;
9456         tte_t   tte, ttemod;
9457         caddr_t vaddr;
9458         int     ret, color;
9459         pfn_t   pfn;
9460 
9461         color = bcolor;
9462         pfn = pp->p_pagenum;
9463 
9464         for (sfhme = pp->p_mapping; sfhme; sfhme = sfhme->hme_next) {
9465 
9466                 if (IS_PAHME(sfhme))
9467                         continue;
9468                 hmeblkp = sfmmu_hmetohblk(sfhme);
9469 
9470                 sfmmu_copytte(&sfhme->hme_tte, &tte);
9471                 ASSERT(TTE_IS_VALID(&tte));
9472                 vaddr = tte_to_vaddr(hmeblkp, tte);
9473                 color = addr_to_vcolor(vaddr);
9474 
9475 #ifdef DEBUG
9476                 if ((flags & HAT_CACHE) && bcolor != NO_VCOLOR) {
9477                         ASSERT(color == bcolor);
9478                 }
9479 #endif
9480 
9481                 ASSERT(flags != HAT_TMPNC || color == PP_GET_VCOLOR(pp));
9482 
9483                 ttemod = tte;
9484                 if (flags & (HAT_UNCACHE | HAT_TMPNC)) {
9485                         TTE_CLR_VCACHEABLE(&ttemod);
9486                 } else {        /* flags & HAT_CACHE */
9487                         TTE_SET_VCACHEABLE(&ttemod);
9488                 }
9489                 ret = sfmmu_modifytte_try(&tte, &ttemod, &sfhme->hme_tte);
9490                 if (ret < 0) {
9491                         /*
9492                          * Since all cpus are captured modifytte should not
9493                          * fail.
9494                          */
9495                         panic("sfmmu_page_cache: write to tte failed");
9496                 }
9497 
9498                 sfmmup = hblktosfmmu(hmeblkp);
9499                 if (cache_flush_flag == CACHE_FLUSH) {
9500                         /*
9501                          * Flush TSBs, TLBs and caches
9502                          */
9503                         if (hmeblkp->hblk_shared) {
9504                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9505                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9506                                 sf_region_t *rgnp;
9507                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9508                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9509                                 ASSERT(srdp != NULL);
9510                                 rgnp = srdp->srd_hmergnp[rid];
9511                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9512                                     srdp, rgnp, rid);
9513                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9514                                     hmeblkp, 0);
9515                                 sfmmu_cache_flush(pfn, addr_to_vcolor(vaddr));
9516                         } else if (sfmmup->sfmmu_ismhat) {
9517                                 if (flags & HAT_CACHE) {
9518                                         SFMMU_STAT(sf_ism_recache);
9519                                 } else {
9520                                         SFMMU_STAT(sf_ism_uncache);
9521                                 }
9522                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9523                                     pfn, CACHE_FLUSH);
9524                         } else {
9525                                 sfmmu_tlbcache_demap(vaddr, sfmmup, hmeblkp,
9526                                     pfn, 0, FLUSH_ALL_CPUS, CACHE_FLUSH, 1);
9527                         }
9528 
9529                         /*
9530                          * all cache entries belonging to this pfn are
9531                          * now flushed.
9532                          */
9533                         cache_flush_flag = CACHE_NO_FLUSH;
9534                 } else {
9535                         /*
9536                          * Flush only TSBs and TLBs.
9537                          */
9538                         if (hmeblkp->hblk_shared) {
9539                                 sf_srd_t *srdp = (sf_srd_t *)sfmmup;
9540                                 uint_t rid = hmeblkp->hblk_tag.htag_rid;
9541                                 sf_region_t *rgnp;
9542                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
9543                                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
9544                                 ASSERT(srdp != NULL);
9545                                 rgnp = srdp->srd_hmergnp[rid];
9546                                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp,
9547                                     srdp, rgnp, rid);
9548                                 (void) sfmmu_rgntlb_demap(vaddr, rgnp,
9549                                     hmeblkp, 0);
9550                         } else if (sfmmup->sfmmu_ismhat) {
9551                                 if (flags & HAT_CACHE) {
9552                                         SFMMU_STAT(sf_ism_recache);
9553                                 } else {
9554                                         SFMMU_STAT(sf_ism_uncache);
9555                                 }
9556                                 sfmmu_ismtlbcache_demap(vaddr, sfmmup, hmeblkp,
9557                                     pfn, CACHE_NO_FLUSH);
9558                         } else {
9559                                 sfmmu_tlb_demap(vaddr, sfmmup, hmeblkp, 0, 1);
9560                         }
9561                 }
9562         }
9563 
9564         if (PP_ISMAPPED_KPM(pp))
9565                 sfmmu_kpm_page_cache(pp, flags, cache_flush_flag);
9566 
9567         switch (flags) {
9568 
9569                 default:
9570                         panic("sfmmu_pagecache: unknown flags");
9571                         break;
9572 
9573                 case HAT_CACHE:
9574                         PP_CLRTNC(pp);
9575                         PP_CLRPNC(pp);
9576                         PP_SET_VCOLOR(pp, color);
9577                         break;
9578 
9579                 case HAT_TMPNC:
9580                         PP_SETTNC(pp);
9581                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9582                         break;
9583 
9584                 case HAT_UNCACHE:
9585                         PP_SETPNC(pp);
9586                         PP_CLRTNC(pp);
9587                         PP_SET_VCOLOR(pp, NO_VCOLOR);
9588                         break;
9589         }
9590 }
9591 #endif  /* VAC */
9592 
9593 
9594 /*
9595  * Wrapper routine used to return a context.
9596  *
9597  * It's the responsibility of the caller to guarantee that the
9598  * process serializes on calls here by taking the HAT lock for
9599  * the hat.
9600  *
9601  */
9602 static void
9603 sfmmu_get_ctx(sfmmu_t *sfmmup)
9604 {
9605         mmu_ctx_t *mmu_ctxp;
9606         uint_t pstate_save;
9607         int ret;
9608 
9609         ASSERT(sfmmu_hat_lock_held(sfmmup));
9610         ASSERT(sfmmup != ksfmmup);
9611 
9612         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID)) {
9613                 sfmmu_setup_tsbinfo(sfmmup);
9614                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ALLCTX_INVALID);
9615         }
9616 
9617         kpreempt_disable();
9618 
9619         mmu_ctxp = CPU_MMU_CTXP(CPU);
9620         ASSERT(mmu_ctxp);
9621         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
9622         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
9623 
9624         /*
9625          * Do a wrap-around if cnum reaches the max # cnum supported by a MMU.
9626          */
9627         if (mmu_ctxp->mmu_cnum == mmu_ctxp->mmu_nctxs)
9628                 sfmmu_ctx_wrap_around(mmu_ctxp, B_TRUE);
9629 
9630         /*
9631          * Let the MMU set up the page sizes to use for
9632          * this context in the TLB. Don't program 2nd dtlb for ism hat.
9633          */
9634         if ((&mmu_set_ctx_page_sizes) && (sfmmup->sfmmu_ismhat == 0)) {
9635                 mmu_set_ctx_page_sizes(sfmmup);
9636         }
9637 
9638         /*
9639          * sfmmu_alloc_ctx and sfmmu_load_mmustate will be performed with
9640          * interrupts disabled to prevent race condition with wrap-around
9641          * ctx invalidatation. In sun4v, ctx invalidation also involves
9642          * a HV call to set the number of TSBs to 0. If interrupts are not
9643          * disabled until after sfmmu_load_mmustate is complete TSBs may
9644          * become assigned to INVALID_CONTEXT. This is not allowed.
9645          */
9646         pstate_save = sfmmu_disable_intrs();
9647 
9648         if (sfmmu_alloc_ctx(sfmmup, 1, CPU, SFMMU_PRIVATE) &&
9649             sfmmup->sfmmu_scdp != NULL) {
9650                 sf_scd_t *scdp = sfmmup->sfmmu_scdp;
9651                 sfmmu_t *scsfmmup = scdp->scd_sfmmup;
9652                 ret = sfmmu_alloc_ctx(scsfmmup, 1, CPU, SFMMU_SHARED);
9653                 /* debug purpose only */
9654                 ASSERT(!ret || scsfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
9655                     != INVALID_CONTEXT);
9656         }
9657         sfmmu_load_mmustate(sfmmup);
9658 
9659         sfmmu_enable_intrs(pstate_save);
9660 
9661         kpreempt_enable();
9662 }
9663 
9664 /*
9665  * When all cnums are used up in a MMU, cnum will wrap around to the
9666  * next generation and start from 2.
9667  */
9668 static void
9669 sfmmu_ctx_wrap_around(mmu_ctx_t *mmu_ctxp, boolean_t reset_cnum)
9670 {
9671 
9672         /* caller must have disabled the preemption */
9673         ASSERT(curthread->t_preempt >= 1);
9674         ASSERT(mmu_ctxp != NULL);
9675 
9676         /* acquire Per-MMU (PM) spin lock */
9677         mutex_enter(&mmu_ctxp->mmu_lock);
9678 
9679         /* re-check to see if wrap-around is needed */
9680         if (mmu_ctxp->mmu_cnum < mmu_ctxp->mmu_nctxs)
9681                 goto done;
9682 
9683         SFMMU_MMU_STAT(mmu_wrap_around);
9684 
9685         /* update gnum */
9686         ASSERT(mmu_ctxp->mmu_gnum != 0);
9687         mmu_ctxp->mmu_gnum++;
9688         if (mmu_ctxp->mmu_gnum == 0 ||
9689             mmu_ctxp->mmu_gnum > MAX_SFMMU_GNUM_VAL) {
9690                 cmn_err(CE_PANIC, "mmu_gnum of mmu_ctx 0x%p is out of bound.",
9691                     (void *)mmu_ctxp);
9692         }
9693 
9694         if (mmu_ctxp->mmu_ncpus > 1) {
9695                 cpuset_t cpuset;
9696 
9697                 membar_enter(); /* make sure updated gnum visible */
9698 
9699                 SFMMU_XCALL_STATS(NULL);
9700 
9701                 /* xcall to others on the same MMU to invalidate ctx */
9702                 cpuset = mmu_ctxp->mmu_cpuset;
9703                 ASSERT(CPU_IN_SET(cpuset, CPU->cpu_id) || !reset_cnum);
9704                 CPUSET_DEL(cpuset, CPU->cpu_id);
9705                 CPUSET_AND(cpuset, cpu_ready_set);
9706 
9707                 /*
9708                  * Pass in INVALID_CONTEXT as the first parameter to
9709                  * sfmmu_raise_tsb_exception, which invalidates the context
9710                  * of any process running on the CPUs in the MMU.
9711                  */
9712                 xt_some(cpuset, sfmmu_raise_tsb_exception,
9713                     INVALID_CONTEXT, INVALID_CONTEXT);
9714                 xt_sync(cpuset);
9715 
9716                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
9717         }
9718 
9719         if (sfmmu_getctx_sec() != INVALID_CONTEXT) {
9720                 sfmmu_setctx_sec(INVALID_CONTEXT);
9721                 sfmmu_clear_utsbinfo();
9722         }
9723 
9724         /*
9725          * No xcall is needed here. For sun4u systems all CPUs in context
9726          * domain share a single physical MMU therefore it's enough to flush
9727          * TLB on local CPU. On sun4v systems we use 1 global context
9728          * domain and flush all remote TLBs in sfmmu_raise_tsb_exception
9729          * handler. Note that vtag_flushall_uctxs() is called
9730          * for Ultra II machine, where the equivalent flushall functionality
9731          * is implemented in SW, and only user ctx TLB entries are flushed.
9732          */
9733         if (&vtag_flushall_uctxs != NULL) {
9734                 vtag_flushall_uctxs();
9735         } else {
9736                 vtag_flushall();
9737         }
9738 
9739         /* reset mmu cnum, skips cnum 0 and 1 */
9740         if (reset_cnum == B_TRUE)
9741                 mmu_ctxp->mmu_cnum = NUM_LOCKED_CTXS;
9742 
9743 done:
9744         mutex_exit(&mmu_ctxp->mmu_lock);
9745 }
9746 
9747 
9748 /*
9749  * For multi-threaded process, set the process context to INVALID_CONTEXT
9750  * so that it faults and reloads the MMU state from TL=0. For single-threaded
9751  * process, we can just load the MMU state directly without having to
9752  * set context invalid. Caller must hold the hat lock since we don't
9753  * acquire it here.
9754  */
9755 static void
9756 sfmmu_sync_mmustate(sfmmu_t *sfmmup)
9757 {
9758         uint_t cnum;
9759         uint_t pstate_save;
9760 
9761         ASSERT(sfmmup != ksfmmup);
9762         ASSERT(sfmmu_hat_lock_held(sfmmup));
9763 
9764         kpreempt_disable();
9765 
9766         /*
9767          * We check whether the pass'ed-in sfmmup is the same as the
9768          * current running proc. This is to makes sure the current proc
9769          * stays single-threaded if it already is.
9770          */
9771         if ((sfmmup == curthread->t_procp->p_as->a_hat) &&
9772             (curthread->t_procp->p_lwpcnt == 1)) {
9773                 /* single-thread */
9774                 cnum = sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum;
9775                 if (cnum != INVALID_CONTEXT) {
9776                         uint_t curcnum;
9777                         /*
9778                          * Disable interrupts to prevent race condition
9779                          * with sfmmu_ctx_wrap_around ctx invalidation.
9780                          * In sun4v, ctx invalidation involves setting
9781                          * TSB to NULL, hence, interrupts should be disabled
9782                          * untill after sfmmu_load_mmustate is completed.
9783                          */
9784                         pstate_save = sfmmu_disable_intrs();
9785                         curcnum = sfmmu_getctx_sec();
9786                         if (curcnum == cnum)
9787                                 sfmmu_load_mmustate(sfmmup);
9788                         sfmmu_enable_intrs(pstate_save);
9789                         ASSERT(curcnum == cnum || curcnum == INVALID_CONTEXT);
9790                 }
9791         } else {
9792                 /*
9793                  * multi-thread
9794                  * or when sfmmup is not the same as the curproc.
9795                  */
9796                 sfmmu_invalidate_ctx(sfmmup);
9797         }
9798 
9799         kpreempt_enable();
9800 }
9801 
9802 
9803 /*
9804  * Replace the specified TSB with a new TSB.  This function gets called when
9805  * we grow, shrink or swapin a TSB.  When swapping in a TSB (TSB_SWAPIN), the
9806  * TSB_FORCEALLOC flag may be used to force allocation of a minimum-sized TSB
9807  * (8K).
9808  *
9809  * Caller must hold the HAT lock, but should assume any tsb_info
9810  * pointers it has are no longer valid after calling this function.
9811  *
9812  * Return values:
9813  *      TSB_ALLOCFAIL   Failed to allocate a TSB, due to memory constraints
9814  *      TSB_LOSTRACE    HAT is busy, i.e. another thread is already doing
9815  *                      something to this tsbinfo/TSB
9816  *      TSB_SUCCESS     Operation succeeded
9817  */
9818 static tsb_replace_rc_t
9819 sfmmu_replace_tsb(sfmmu_t *sfmmup, struct tsb_info *old_tsbinfo, uint_t szc,
9820     hatlock_t *hatlockp, uint_t flags)
9821 {
9822         struct tsb_info *new_tsbinfo = NULL;
9823         struct tsb_info *curtsb, *prevtsb;
9824         uint_t tte_sz_mask;
9825         int i;
9826 
9827         ASSERT(sfmmup != ksfmmup);
9828         ASSERT(sfmmup->sfmmu_ismhat == 0);
9829         ASSERT(sfmmu_hat_lock_held(sfmmup));
9830         ASSERT(szc <= tsb_max_growsize);
9831 
9832         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_BUSY))
9833                 return (TSB_LOSTRACE);
9834 
9835         /*
9836          * Find the tsb_info ahead of this one in the list, and
9837          * also make sure that the tsb_info passed in really
9838          * exists!
9839          */
9840         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9841             curtsb != old_tsbinfo && curtsb != NULL;
9842             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9843                 ;
9844         ASSERT(curtsb != NULL);
9845 
9846         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9847                 /*
9848                  * The process is swapped out, so just set the new size
9849                  * code.  When it swaps back in, we'll allocate a new one
9850                  * of the new chosen size.
9851                  */
9852                 curtsb->tsb_szc = szc;
9853                 return (TSB_SUCCESS);
9854         }
9855         SFMMU_FLAGS_SET(sfmmup, HAT_BUSY);
9856 
9857         tte_sz_mask = old_tsbinfo->tsb_ttesz_mask;
9858 
9859         /*
9860          * All initialization is done inside of sfmmu_tsbinfo_alloc().
9861          * If we fail to allocate a TSB, exit.
9862          *
9863          * If tsb grows with new tsb size > 4M and old tsb size < 4M,
9864          * then try 4M slab after the initial alloc fails.
9865          *
9866          * If tsb swapin with tsb size > 4M, then try 4M after the
9867          * initial alloc fails.
9868          */
9869         sfmmu_hat_exit(hatlockp);
9870         if (sfmmu_tsbinfo_alloc(&new_tsbinfo, szc,
9871             tte_sz_mask, flags, sfmmup) &&
9872             (!(flags & (TSB_GROW | TSB_SWAPIN)) || (szc <= TSB_4M_SZCODE) ||
9873             (!(flags & TSB_SWAPIN) &&
9874             (old_tsbinfo->tsb_szc >= TSB_4M_SZCODE)) ||
9875             sfmmu_tsbinfo_alloc(&new_tsbinfo, TSB_4M_SZCODE,
9876             tte_sz_mask, flags, sfmmup))) {
9877                 (void) sfmmu_hat_enter(sfmmup);
9878                 if (!(flags & TSB_SWAPIN))
9879                         SFMMU_STAT(sf_tsb_resize_failures);
9880                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9881                 return (TSB_ALLOCFAIL);
9882         }
9883         (void) sfmmu_hat_enter(sfmmup);
9884 
9885         /*
9886          * Re-check to make sure somebody else didn't muck with us while we
9887          * didn't hold the HAT lock.  If the process swapped out, fine, just
9888          * exit; this can happen if we try to shrink the TSB from the context
9889          * of another process (such as on an ISM unmap), though it is rare.
9890          */
9891         if (!(flags & TSB_SWAPIN) && SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
9892                 SFMMU_STAT(sf_tsb_resize_failures);
9893                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9894                 sfmmu_hat_exit(hatlockp);
9895                 sfmmu_tsbinfo_free(new_tsbinfo);
9896                 (void) sfmmu_hat_enter(sfmmup);
9897                 return (TSB_LOSTRACE);
9898         }
9899 
9900 #ifdef  DEBUG
9901         /* Reverify that the tsb_info still exists.. for debugging only */
9902         for (prevtsb = NULL, curtsb = sfmmup->sfmmu_tsb;
9903             curtsb != old_tsbinfo && curtsb != NULL;
9904             prevtsb = curtsb, curtsb = curtsb->tsb_next)
9905                 ;
9906         ASSERT(curtsb != NULL);
9907 #endif  /* DEBUG */
9908 
9909         /*
9910          * Quiesce any CPUs running this process on their next TLB miss
9911          * so they atomically see the new tsb_info.  We temporarily set the
9912          * context to invalid context so new threads that come on processor
9913          * after we do the xcall to cpusran will also serialize behind the
9914          * HAT lock on TLB miss and will see the new TSB.  Since this short
9915          * race with a new thread coming on processor is relatively rare,
9916          * this synchronization mechanism should be cheaper than always
9917          * pausing all CPUs for the duration of the setup, which is what
9918          * the old implementation did.  This is particuarly true if we are
9919          * copying a huge chunk of memory around during that window.
9920          *
9921          * The memory barriers are to make sure things stay consistent
9922          * with resume() since it does not hold the HAT lock while
9923          * walking the list of tsb_info structures.
9924          */
9925         if ((flags & TSB_SWAPIN) != TSB_SWAPIN) {
9926                 /* The TSB is either growing or shrinking. */
9927                 sfmmu_invalidate_ctx(sfmmup);
9928         } else {
9929                 /*
9930                  * It is illegal to swap in TSBs from a process other
9931                  * than a process being swapped in.  This in turn
9932                  * implies we do not have a valid MMU context here
9933                  * since a process needs one to resolve translation
9934                  * misses.
9935                  */
9936                 ASSERT(curthread->t_procp->p_as->a_hat == sfmmup);
9937         }
9938 
9939 #ifdef DEBUG
9940         ASSERT(max_mmu_ctxdoms > 0);
9941 
9942         /*
9943          * Process should have INVALID_CONTEXT on all MMUs
9944          */
9945         for (i = 0; i < max_mmu_ctxdoms; i++) {
9946 
9947                 ASSERT(sfmmup->sfmmu_ctxs[i].cnum == INVALID_CONTEXT);
9948         }
9949 #endif
9950 
9951         new_tsbinfo->tsb_next = old_tsbinfo->tsb_next;
9952         membar_stst();  /* strict ordering required */
9953         if (prevtsb)
9954                 prevtsb->tsb_next = new_tsbinfo;
9955         else
9956                 sfmmup->sfmmu_tsb = new_tsbinfo;
9957         membar_enter(); /* make sure new TSB globally visible */
9958 
9959         /*
9960          * We need to migrate TSB entries from the old TSB to the new TSB
9961          * if tsb_remap_ttes is set and the TSB is growing.
9962          */
9963         if (tsb_remap_ttes && ((flags & TSB_GROW) == TSB_GROW))
9964                 sfmmu_copy_tsb(old_tsbinfo, new_tsbinfo);
9965 
9966         SFMMU_FLAGS_CLEAR(sfmmup, HAT_BUSY);
9967 
9968         /*
9969          * Drop the HAT lock to free our old tsb_info.
9970          */
9971         sfmmu_hat_exit(hatlockp);
9972 
9973         if ((flags & TSB_GROW) == TSB_GROW) {
9974                 SFMMU_STAT(sf_tsb_grow);
9975         } else if ((flags & TSB_SHRINK) == TSB_SHRINK) {
9976                 SFMMU_STAT(sf_tsb_shrink);
9977         }
9978 
9979         sfmmu_tsbinfo_free(old_tsbinfo);
9980 
9981         (void) sfmmu_hat_enter(sfmmup);
9982         return (TSB_SUCCESS);
9983 }
9984 
9985 /*
9986  * This function will re-program hat pgsz array, and invalidate the
9987  * process' context, forcing the process to switch to another
9988  * context on the next TLB miss, and therefore start using the
9989  * TLB that is reprogrammed for the new page sizes.
9990  */
9991 void
9992 sfmmu_reprog_pgsz_arr(sfmmu_t *sfmmup, uint8_t *tmp_pgsz)
9993 {
9994         int i;
9995         hatlock_t *hatlockp = NULL;
9996 
9997         hatlockp = sfmmu_hat_enter(sfmmup);
9998         /* USIII+-IV+ optimization, requires hat lock */
9999         if (tmp_pgsz) {
10000                 for (i = 0; i < mmu_page_sizes; i++)
10001                         sfmmup->sfmmu_pgsz[i] = tmp_pgsz[i];
10002         }
10003         SFMMU_STAT(sf_tlb_reprog_pgsz);
10004 
10005         sfmmu_invalidate_ctx(sfmmup);
10006 
10007         sfmmu_hat_exit(hatlockp);
10008 }
10009 
10010 /*
10011  * The scd_rttecnt field in the SCD must be updated to take account of the
10012  * regions which it contains.
10013  */
10014 static void
10015 sfmmu_set_scd_rttecnt(sf_srd_t *srdp, sf_scd_t *scdp)
10016 {
10017         uint_t rid;
10018         uint_t i, j;
10019         ulong_t w;
10020         sf_region_t *rgnp;
10021 
10022         ASSERT(srdp != NULL);
10023 
10024         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
10025                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
10026                         continue;
10027                 }
10028 
10029                 j = 0;
10030                 while (w) {
10031                         if (!(w & 0x1)) {
10032                                 j++;
10033                                 w >>= 1;
10034                                 continue;
10035                         }
10036                         rid = (i << BT_ULSHIFT) | j;
10037                         j++;
10038                         w >>= 1;
10039 
10040                         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
10041                         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
10042                         rgnp = srdp->srd_hmergnp[rid];
10043                         ASSERT(rgnp->rgn_refcnt > 0);
10044                         ASSERT(rgnp->rgn_id == rid);
10045 
10046                         scdp->scd_rttecnt[rgnp->rgn_pgszc] +=
10047                             rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
10048 
10049                         /*
10050                          * Maintain the tsb0 inflation cnt for the regions
10051                          * in the SCD.
10052                          */
10053                         if (rgnp->rgn_pgszc >= TTE4M) {
10054                                 scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt +=
10055                                     rgnp->rgn_size >>
10056                                     (TTE_PAGE_SHIFT(TTE8K) + 2);
10057                         }
10058                 }
10059         }
10060 }
10061 
10062 /*
10063  * This function assumes that there are either four or six supported page
10064  * sizes and at most two programmable TLBs, so we need to decide which
10065  * page sizes are most important and then tell the MMU layer so it
10066  * can adjust the TLB page sizes accordingly (if supported).
10067  *
10068  * If these assumptions change, this function will need to be
10069  * updated to support whatever the new limits are.
10070  *
10071  * The growing flag is nonzero if we are growing the address space,
10072  * and zero if it is shrinking.  This allows us to decide whether
10073  * to grow or shrink our TSB, depending upon available memory
10074  * conditions.
10075  */
10076 static void
10077 sfmmu_check_page_sizes(sfmmu_t *sfmmup, int growing)
10078 {
10079         uint64_t ttecnt[MMU_PAGE_SIZES];
10080         uint64_t tte8k_cnt, tte4m_cnt;
10081         uint8_t i;
10082         int sectsb_thresh;
10083 
10084         /*
10085          * Kernel threads, processes with small address spaces not using
10086          * large pages, and dummy ISM HATs need not apply.
10087          */
10088         if (sfmmup == ksfmmup || sfmmup->sfmmu_ismhat != NULL)
10089                 return;
10090 
10091         if (!SFMMU_LGPGS_INUSE(sfmmup) &&
10092             sfmmup->sfmmu_ttecnt[TTE8K] <= tsb_rss_factor)
10093                 return;
10094 
10095         for (i = 0; i < mmu_page_sizes; i++) {
10096                 ttecnt[i] = sfmmup->sfmmu_ttecnt[i] +
10097                     sfmmup->sfmmu_ismttecnt[i];
10098         }
10099 
10100         /* Check pagesizes in use, and possibly reprogram DTLB. */
10101         if (&mmu_check_page_sizes)
10102                 mmu_check_page_sizes(sfmmup, ttecnt);
10103 
10104         /*
10105          * Calculate the number of 8k ttes to represent the span of these
10106          * pages.
10107          */
10108         tte8k_cnt = ttecnt[TTE8K] +
10109             (ttecnt[TTE64K] << (MMU_PAGESHIFT64K - MMU_PAGESHIFT)) +
10110             (ttecnt[TTE512K] << (MMU_PAGESHIFT512K - MMU_PAGESHIFT));
10111         if (mmu_page_sizes == max_mmu_page_sizes) {
10112                 tte4m_cnt = ttecnt[TTE4M] +
10113                     (ttecnt[TTE32M] << (MMU_PAGESHIFT32M - MMU_PAGESHIFT4M)) +
10114                     (ttecnt[TTE256M] << (MMU_PAGESHIFT256M - MMU_PAGESHIFT4M));
10115         } else {
10116                 tte4m_cnt = ttecnt[TTE4M];
10117         }
10118 
10119         /*
10120          * Inflate tte8k_cnt to allow for region large page allocation failure.
10121          */
10122         tte8k_cnt += sfmmup->sfmmu_tsb0_4minflcnt;
10123 
10124         /*
10125          * Inflate TSB sizes by a factor of 2 if this process
10126          * uses 4M text pages to minimize extra conflict misses
10127          * in the first TSB since without counting text pages
10128          * 8K TSB may become too small.
10129          *
10130          * Also double the size of the second TSB to minimize
10131          * extra conflict misses due to competition between 4M text pages
10132          * and data pages.
10133          *
10134          * We need to adjust the second TSB allocation threshold by the
10135          * inflation factor, since there is no point in creating a second
10136          * TSB when we know all the mappings can fit in the I/D TLBs.
10137          */
10138         sectsb_thresh = tsb_sectsb_threshold;
10139         if (sfmmup->sfmmu_flags & HAT_4MTEXT_FLAG) {
10140                 tte8k_cnt <<= 1;
10141                 tte4m_cnt <<= 1;
10142                 sectsb_thresh <<= 1;
10143         }
10144 
10145         /*
10146          * Check to see if our TSB is the right size; we may need to
10147          * grow or shrink it.  If the process is small, our work is
10148          * finished at this point.
10149          */
10150         if (tte8k_cnt <= tsb_rss_factor && tte4m_cnt <= sectsb_thresh) {
10151                 return;
10152         }
10153         sfmmu_size_tsb(sfmmup, growing, tte8k_cnt, tte4m_cnt, sectsb_thresh);
10154 }
10155 
10156 static void
10157 sfmmu_size_tsb(sfmmu_t *sfmmup, int growing, uint64_t tte8k_cnt,
10158     uint64_t tte4m_cnt, int sectsb_thresh)
10159 {
10160         int tsb_bits;
10161         uint_t tsb_szc;
10162         struct tsb_info *tsbinfop;
10163         hatlock_t *hatlockp = NULL;
10164 
10165         hatlockp = sfmmu_hat_enter(sfmmup);
10166         ASSERT(hatlockp != NULL);
10167         tsbinfop = sfmmup->sfmmu_tsb;
10168         ASSERT(tsbinfop != NULL);
10169 
10170         /*
10171          * If we're growing, select the size based on RSS.  If we're
10172          * shrinking, leave some room so we don't have to turn around and
10173          * grow again immediately.
10174          */
10175         if (growing)
10176                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
10177         else
10178                 tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt << 1);
10179 
10180         if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10181             (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10182                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10183                     hatlockp, TSB_SHRINK);
10184         } else if (growing && tsb_szc > tsbinfop->tsb_szc && TSB_OK_GROW()) {
10185                 (void) sfmmu_replace_tsb(sfmmup, tsbinfop, tsb_szc,
10186                     hatlockp, TSB_GROW);
10187         }
10188         tsbinfop = sfmmup->sfmmu_tsb;
10189 
10190         /*
10191          * With the TLB and first TSB out of the way, we need to see if
10192          * we need a second TSB for 4M pages.  If we managed to reprogram
10193          * the TLB page sizes above, the process will start using this new
10194          * TSB right away; otherwise, it will start using it on the next
10195          * context switch.  Either way, it's no big deal so there's no
10196          * synchronization with the trap handlers here unless we grow the
10197          * TSB (in which case it's required to prevent using the old one
10198          * after it's freed). Note: second tsb is required for 32M/256M
10199          * page sizes.
10200          */
10201         if (tte4m_cnt > sectsb_thresh) {
10202                 /*
10203                  * If we're growing, select the size based on RSS.  If we're
10204                  * shrinking, leave some room so we don't have to turn
10205                  * around and grow again immediately.
10206                  */
10207                 if (growing)
10208                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
10209                 else
10210                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt << 1);
10211                 if (tsbinfop->tsb_next == NULL) {
10212                         struct tsb_info *newtsb;
10213                         int allocflags = SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)?
10214                             0 : TSB_ALLOC;
10215 
10216                         sfmmu_hat_exit(hatlockp);
10217 
10218                         /*
10219                          * Try to allocate a TSB for 4[32|256]M pages.  If we
10220                          * can't get the size we want, retry w/a minimum sized
10221                          * TSB.  If that still didn't work, give up; we can
10222                          * still run without one.
10223                          */
10224                         tsb_bits = (mmu_page_sizes == max_mmu_page_sizes)?
10225                             TSB4M|TSB32M|TSB256M:TSB4M;
10226                         if ((sfmmu_tsbinfo_alloc(&newtsb, tsb_szc, tsb_bits,
10227                             allocflags, sfmmup)) &&
10228                             (tsb_szc <= TSB_4M_SZCODE ||
10229                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
10230                             tsb_bits, allocflags, sfmmup)) &&
10231                             sfmmu_tsbinfo_alloc(&newtsb, TSB_MIN_SZCODE,
10232                             tsb_bits, allocflags, sfmmup)) {
10233                                 return;
10234                         }
10235 
10236                         hatlockp = sfmmu_hat_enter(sfmmup);
10237 
10238                         sfmmu_invalidate_ctx(sfmmup);
10239 
10240                         if (sfmmup->sfmmu_tsb->tsb_next == NULL) {
10241                                 sfmmup->sfmmu_tsb->tsb_next = newtsb;
10242                                 SFMMU_STAT(sf_tsb_sectsb_create);
10243                                 sfmmu_hat_exit(hatlockp);
10244                                 return;
10245                         } else {
10246                                 /*
10247                                  * It's annoying, but possible for us
10248                                  * to get here.. we dropped the HAT lock
10249                                  * because of locking order in the kmem
10250                                  * allocator, and while we were off getting
10251                                  * our memory, some other thread decided to
10252                                  * do us a favor and won the race to get a
10253                                  * second TSB for this process.  Sigh.
10254                                  */
10255                                 sfmmu_hat_exit(hatlockp);
10256                                 sfmmu_tsbinfo_free(newtsb);
10257                                 return;
10258                         }
10259                 }
10260 
10261                 /*
10262                  * We have a second TSB, see if it's big enough.
10263                  */
10264                 tsbinfop = tsbinfop->tsb_next;
10265 
10266                 /*
10267                  * Check to see if our second TSB is the right size;
10268                  * we may need to grow or shrink it.
10269                  * To prevent thrashing (e.g. growing the TSB on a
10270                  * subsequent map operation), only try to shrink if
10271                  * the TSB reach exceeds twice the virtual address
10272                  * space size.
10273                  */
10274                 if (!growing && (tsb_szc < tsbinfop->tsb_szc) &&
10275                     (tsb_szc >= default_tsb_size) && TSB_OK_SHRINK()) {
10276                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10277                             tsb_szc, hatlockp, TSB_SHRINK);
10278                 } else if (growing && tsb_szc > tsbinfop->tsb_szc &&
10279                     TSB_OK_GROW()) {
10280                         (void) sfmmu_replace_tsb(sfmmup, tsbinfop,
10281                             tsb_szc, hatlockp, TSB_GROW);
10282                 }
10283         }
10284 
10285         sfmmu_hat_exit(hatlockp);
10286 }
10287 
10288 /*
10289  * Free up a sfmmu
10290  * Since the sfmmu is currently embedded in the hat struct we simply zero
10291  * out our fields and free up the ism map blk list if any.
10292  */
10293 static void
10294 sfmmu_free_sfmmu(sfmmu_t *sfmmup)
10295 {
10296         ism_blk_t       *blkp, *nx_blkp;
10297 #ifdef  DEBUG
10298         ism_map_t       *map;
10299         int             i;
10300 #endif
10301 
10302         ASSERT(sfmmup->sfmmu_ttecnt[TTE8K] == 0);
10303         ASSERT(sfmmup->sfmmu_ttecnt[TTE64K] == 0);
10304         ASSERT(sfmmup->sfmmu_ttecnt[TTE512K] == 0);
10305         ASSERT(sfmmup->sfmmu_ttecnt[TTE4M] == 0);
10306         ASSERT(sfmmup->sfmmu_ttecnt[TTE32M] == 0);
10307         ASSERT(sfmmup->sfmmu_ttecnt[TTE256M] == 0);
10308         ASSERT(SF_RGNMAP_ISNULL(sfmmup));
10309 
10310         sfmmup->sfmmu_free = 0;
10311         sfmmup->sfmmu_ismhat = 0;
10312 
10313         blkp = sfmmup->sfmmu_iblk;
10314         sfmmup->sfmmu_iblk = NULL;
10315 
10316         while (blkp) {
10317 #ifdef  DEBUG
10318                 map = blkp->iblk_maps;
10319                 for (i = 0; i < ISM_MAP_SLOTS; i++) {
10320                         ASSERT(map[i].imap_seg == 0);
10321                         ASSERT(map[i].imap_ismhat == NULL);
10322                         ASSERT(map[i].imap_ment == NULL);
10323                 }
10324 #endif
10325                 nx_blkp = blkp->iblk_next;
10326                 blkp->iblk_next = NULL;
10327                 blkp->iblk_nextpa = (uint64_t)-1;
10328                 kmem_cache_free(ism_blk_cache, blkp);
10329                 blkp = nx_blkp;
10330         }
10331 }
10332 
10333 /*
10334  * Locking primitves accessed by HATLOCK macros
10335  */
10336 
10337 #define SFMMU_SPL_MTX   (0x0)
10338 #define SFMMU_ML_MTX    (0x1)
10339 
10340 #define SFMMU_MLSPL_MTX(type, pg)       (((type) == SFMMU_SPL_MTX) ? \
10341                                             SPL_HASH(pg) : MLIST_HASH(pg))
10342 
10343 kmutex_t *
10344 sfmmu_page_enter(struct page *pp)
10345 {
10346         return (sfmmu_mlspl_enter(pp, SFMMU_SPL_MTX));
10347 }
10348 
10349 void
10350 sfmmu_page_exit(kmutex_t *spl)
10351 {
10352         mutex_exit(spl);
10353 }
10354 
10355 int
10356 sfmmu_page_spl_held(struct page *pp)
10357 {
10358         return (sfmmu_mlspl_held(pp, SFMMU_SPL_MTX));
10359 }
10360 
10361 kmutex_t *
10362 sfmmu_mlist_enter(struct page *pp)
10363 {
10364         return (sfmmu_mlspl_enter(pp, SFMMU_ML_MTX));
10365 }
10366 
10367 void
10368 sfmmu_mlist_exit(kmutex_t *mml)
10369 {
10370         mutex_exit(mml);
10371 }
10372 
10373 int
10374 sfmmu_mlist_held(struct page *pp)
10375 {
10376 
10377         return (sfmmu_mlspl_held(pp, SFMMU_ML_MTX));
10378 }
10379 
10380 /*
10381  * Common code for sfmmu_mlist_enter() and sfmmu_page_enter().  For
10382  * sfmmu_mlist_enter() case mml_table lock array is used and for
10383  * sfmmu_page_enter() sfmmu_page_lock lock array is used.
10384  *
10385  * The lock is taken on a root page so that it protects an operation on all
10386  * constituent pages of a large page pp belongs to.
10387  *
10388  * The routine takes a lock from the appropriate array. The lock is determined
10389  * by hashing the root page. After taking the lock this routine checks if the
10390  * root page has the same size code that was used to determine the root (i.e
10391  * that root hasn't changed).  If root page has the expected p_szc field we
10392  * have the right lock and it's returned to the caller. If root's p_szc
10393  * decreased we release the lock and retry from the beginning.  This case can
10394  * happen due to hat_page_demote() decreasing p_szc between our load of p_szc
10395  * value and taking the lock. The number of retries due to p_szc decrease is
10396  * limited by the maximum p_szc value. If p_szc is 0 we return the lock
10397  * determined by hashing pp itself.
10398  *
10399  * If our caller doesn't hold a SE_SHARED or SE_EXCL lock on pp it's also
10400  * possible that p_szc can increase. To increase p_szc a thread has to lock
10401  * all constituent pages EXCL and do hat_pageunload() on all of them. All the
10402  * callers that don't hold a page locked recheck if hmeblk through which pp
10403  * was found still maps this pp.  If it doesn't map it anymore returned lock
10404  * is immediately dropped. Therefore if sfmmu_mlspl_enter() hits the case of
10405  * p_szc increase after taking the lock it returns this lock without further
10406  * retries because in this case the caller doesn't care about which lock was
10407  * taken. The caller will drop it right away.
10408  *
10409  * After the routine returns it's guaranteed that hat_page_demote() can't
10410  * change p_szc field of any of constituent pages of a large page pp belongs
10411  * to as long as pp was either locked at least SHARED prior to this call or
10412  * the caller finds that hment that pointed to this pp still references this
10413  * pp (this also assumes that the caller holds hme hash bucket lock so that
10414  * the same pp can't be remapped into the same hmeblk after it was unmapped by
10415  * hat_pageunload()).
10416  */
10417 static kmutex_t *
10418 sfmmu_mlspl_enter(struct page *pp, int type)
10419 {
10420         kmutex_t        *mtx;
10421         uint_t          prev_rszc = UINT_MAX;
10422         page_t          *rootpp;
10423         uint_t          szc;
10424         uint_t          rszc;
10425         uint_t          pszc = pp->p_szc;
10426 
10427         ASSERT(pp != NULL);
10428 
10429 again:
10430         if (pszc == 0) {
10431                 mtx = SFMMU_MLSPL_MTX(type, pp);
10432                 mutex_enter(mtx);
10433                 return (mtx);
10434         }
10435 
10436         /* The lock lives in the root page */
10437         rootpp = PP_GROUPLEADER(pp, pszc);
10438         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10439         mutex_enter(mtx);
10440 
10441         /*
10442          * Return mml in the following 3 cases:
10443          *
10444          * 1) If pp itself is root since if its p_szc decreased before we took
10445          * the lock pp is still the root of smaller szc page. And if its p_szc
10446          * increased it doesn't matter what lock we return (see comment in
10447          * front of this routine).
10448          *
10449          * 2) If pp's not root but rootpp is the root of a rootpp->p_szc size
10450          * large page we have the right lock since any previous potential
10451          * hat_page_demote() is done demoting from greater than current root's
10452          * p_szc because hat_page_demote() changes root's p_szc last. No
10453          * further hat_page_demote() can start or be in progress since it
10454          * would need the same lock we currently hold.
10455          *
10456          * 3) If rootpp's p_szc increased since previous iteration it doesn't
10457          * matter what lock we return (see comment in front of this routine).
10458          */
10459         if (pp == rootpp || (rszc = rootpp->p_szc) == pszc ||
10460             rszc >= prev_rszc) {
10461                 return (mtx);
10462         }
10463 
10464         /*
10465          * hat_page_demote() could have decreased root's p_szc.
10466          * In this case pp's p_szc must also be smaller than pszc.
10467          * Retry.
10468          */
10469         if (rszc < pszc) {
10470                 szc = pp->p_szc;
10471                 if (szc < pszc) {
10472                         mutex_exit(mtx);
10473                         pszc = szc;
10474                         goto again;
10475                 }
10476                 /*
10477                  * pp's p_szc increased after it was decreased.
10478                  * page cannot be mapped. Return current lock. The caller
10479                  * will drop it right away.
10480                  */
10481                 return (mtx);
10482         }
10483 
10484         /*
10485          * root's p_szc is greater than pp's p_szc.
10486          * hat_page_demote() is not done with all pages
10487          * yet. Wait for it to complete.
10488          */
10489         mutex_exit(mtx);
10490         rootpp = PP_GROUPLEADER(rootpp, rszc);
10491         mtx = SFMMU_MLSPL_MTX(type, rootpp);
10492         mutex_enter(mtx);
10493         mutex_exit(mtx);
10494         prev_rszc = rszc;
10495         goto again;
10496 }
10497 
10498 static int
10499 sfmmu_mlspl_held(struct page *pp, int type)
10500 {
10501         kmutex_t        *mtx;
10502 
10503         ASSERT(pp != NULL);
10504         /* The lock lives in the root page */
10505         pp = PP_PAGEROOT(pp);
10506         ASSERT(pp != NULL);
10507 
10508         mtx = SFMMU_MLSPL_MTX(type, pp);
10509         return (MUTEX_HELD(mtx));
10510 }
10511 
10512 static uint_t
10513 sfmmu_get_free_hblk(struct hme_blk **hmeblkpp, uint_t critical)
10514 {
10515         struct  hme_blk *hblkp;
10516 
10517 
10518         if (freehblkp != NULL) {
10519                 mutex_enter(&freehblkp_lock);
10520                 if (freehblkp != NULL) {
10521                         /*
10522                          * If the current thread is owning hblk_reserve OR
10523                          * critical request from sfmmu_hblk_steal()
10524                          * let it succeed even if freehblkcnt is really low.
10525                          */
10526                         if (freehblkcnt <= HBLK_RESERVE_MIN && !critical) {
10527                                 SFMMU_STAT(sf_get_free_throttle);
10528                                 mutex_exit(&freehblkp_lock);
10529                                 return (0);
10530                         }
10531                         freehblkcnt--;
10532                         *hmeblkpp = freehblkp;
10533                         hblkp = *hmeblkpp;
10534                         freehblkp = hblkp->hblk_next;
10535                         mutex_exit(&freehblkp_lock);
10536                         hblkp->hblk_next = NULL;
10537                         SFMMU_STAT(sf_get_free_success);
10538 
10539                         ASSERT(hblkp->hblk_hmecnt == 0);
10540                         ASSERT(hblkp->hblk_vcnt == 0);
10541                         ASSERT(hblkp->hblk_nextpa == va_to_pa((caddr_t)hblkp));
10542 
10543                         return (1);
10544                 }
10545                 mutex_exit(&freehblkp_lock);
10546         }
10547 
10548         /* Check cpu hblk pending queues */
10549         if ((*hmeblkpp = sfmmu_check_pending_hblks(TTE8K)) != NULL) {
10550                 hblkp = *hmeblkpp;
10551                 hblkp->hblk_next = NULL;
10552                 hblkp->hblk_nextpa = va_to_pa((caddr_t)hblkp);
10553 
10554                 ASSERT(hblkp->hblk_hmecnt == 0);
10555                 ASSERT(hblkp->hblk_vcnt == 0);
10556 
10557                 return (1);
10558         }
10559 
10560         SFMMU_STAT(sf_get_free_fail);
10561         return (0);
10562 }
10563 
10564 static uint_t
10565 sfmmu_put_free_hblk(struct hme_blk *hmeblkp, uint_t critical)
10566 {
10567         struct  hme_blk *hblkp;
10568 
10569         ASSERT(hmeblkp->hblk_hmecnt == 0);
10570         ASSERT(hmeblkp->hblk_vcnt == 0);
10571         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
10572 
10573         /*
10574          * If the current thread is mapping into kernel space,
10575          * let it succede even if freehblkcnt is max
10576          * so that it will avoid freeing it to kmem.
10577          * This will prevent stack overflow due to
10578          * possible recursion since kmem_cache_free()
10579          * might require creation of a slab which
10580          * in turn needs an hmeblk to map that slab;
10581          * let's break this vicious chain at the first
10582          * opportunity.
10583          */
10584         if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10585                 mutex_enter(&freehblkp_lock);
10586                 if (freehblkcnt < HBLK_RESERVE_CNT || critical) {
10587                         SFMMU_STAT(sf_put_free_success);
10588                         freehblkcnt++;
10589                         hmeblkp->hblk_next = freehblkp;
10590                         freehblkp = hmeblkp;
10591                         mutex_exit(&freehblkp_lock);
10592                         return (1);
10593                 }
10594                 mutex_exit(&freehblkp_lock);
10595         }
10596 
10597         /*
10598          * Bring down freehblkcnt to HBLK_RESERVE_CNT. We are here
10599          * only if freehblkcnt is at least HBLK_RESERVE_CNT *and*
10600          * we are not in the process of mapping into kernel space.
10601          */
10602         ASSERT(!critical);
10603         while (freehblkcnt > HBLK_RESERVE_CNT) {
10604                 mutex_enter(&freehblkp_lock);
10605                 if (freehblkcnt > HBLK_RESERVE_CNT) {
10606                         freehblkcnt--;
10607                         hblkp = freehblkp;
10608                         freehblkp = hblkp->hblk_next;
10609                         mutex_exit(&freehblkp_lock);
10610                         ASSERT(get_hblk_cache(hblkp) == sfmmu8_cache);
10611                         kmem_cache_free(sfmmu8_cache, hblkp);
10612                         continue;
10613                 }
10614                 mutex_exit(&freehblkp_lock);
10615         }
10616         SFMMU_STAT(sf_put_free_fail);
10617         return (0);
10618 }
10619 
10620 static void
10621 sfmmu_hblk_swap(struct hme_blk *new)
10622 {
10623         struct hme_blk *old, *hblkp, *prev;
10624         uint64_t newpa;
10625         caddr_t base, vaddr, endaddr;
10626         struct hmehash_bucket *hmebp;
10627         struct sf_hment *osfhme, *nsfhme;
10628         page_t *pp;
10629         kmutex_t *pml;
10630         tte_t tte;
10631         struct hme_blk *list = NULL;
10632 
10633 #ifdef  DEBUG
10634         hmeblk_tag              hblktag;
10635         struct hme_blk          *found;
10636 #endif
10637         old = HBLK_RESERVE;
10638         ASSERT(!old->hblk_shared);
10639 
10640         /*
10641          * save pa before bcopy clobbers it
10642          */
10643         newpa = new->hblk_nextpa;
10644 
10645         base = (caddr_t)get_hblk_base(old);
10646         endaddr = base + get_hblk_span(old);
10647 
10648         /*
10649          * acquire hash bucket lock.
10650          */
10651         hmebp = sfmmu_tteload_acquire_hashbucket(ksfmmup, base, TTE8K,
10652             SFMMU_INVALID_SHMERID);
10653 
10654         /*
10655          * copy contents from old to new
10656          */
10657         bcopy((void *)old, (void *)new, HME8BLK_SZ);
10658 
10659         /*
10660          * add new to hash chain
10661          */
10662         sfmmu_hblk_hash_add(hmebp, new, newpa);
10663 
10664         /*
10665          * search hash chain for hblk_reserve; this needs to be performed
10666          * after adding new, otherwise prev won't correspond to the hblk which
10667          * is prior to old in hash chain when we call sfmmu_hblk_hash_rm to
10668          * remove old later.
10669          */
10670         for (prev = NULL,
10671             hblkp = hmebp->hmeblkp; hblkp != NULL && hblkp != old;
10672             prev = hblkp, hblkp = hblkp->hblk_next)
10673                 ;
10674 
10675         if (hblkp != old)
10676                 panic("sfmmu_hblk_swap: hblk_reserve not found");
10677 
10678         /*
10679          * p_mapping list is still pointing to hments in hblk_reserve;
10680          * fix up p_mapping list so that they point to hments in new.
10681          *
10682          * Since all these mappings are created by hblk_reserve_thread
10683          * on the way and it's using at least one of the buffers from each of
10684          * the newly minted slabs, there is no danger of any of these
10685          * mappings getting unloaded by another thread.
10686          *
10687          * tsbmiss could only modify ref/mod bits of hments in old/new.
10688          * Since all of these hments hold mappings established by segkmem
10689          * and mappings in segkmem are setup with HAT_NOSYNC, ref/mod bits
10690          * have no meaning for the mappings in hblk_reserve.  hments in
10691          * old and new are identical except for ref/mod bits.
10692          */
10693         for (vaddr = base; vaddr < endaddr; vaddr += TTEBYTES(TTE8K)) {
10694 
10695                 HBLKTOHME(osfhme, old, vaddr);
10696                 sfmmu_copytte(&osfhme->hme_tte, &tte);
10697 
10698                 if (TTE_IS_VALID(&tte)) {
10699                         if ((pp = osfhme->hme_page) == NULL)
10700                                 panic("sfmmu_hblk_swap: page not mapped");
10701 
10702                         pml = sfmmu_mlist_enter(pp);
10703 
10704                         if (pp != osfhme->hme_page)
10705                                 panic("sfmmu_hblk_swap: mapping changed");
10706 
10707                         HBLKTOHME(nsfhme, new, vaddr);
10708 
10709                         HME_ADD(nsfhme, pp);
10710                         HME_SUB(osfhme, pp);
10711 
10712                         sfmmu_mlist_exit(pml);
10713                 }
10714         }
10715 
10716         /*
10717          * remove old from hash chain
10718          */
10719         sfmmu_hblk_hash_rm(hmebp, old, prev, &list, 1);
10720 
10721 #ifdef  DEBUG
10722 
10723         hblktag.htag_id = ksfmmup;
10724         hblktag.htag_rid = SFMMU_INVALID_SHMERID;
10725         hblktag.htag_bspage = HME_HASH_BSPAGE(base, HME_HASH_SHIFT(TTE8K));
10726         hblktag.htag_rehash = HME_HASH_REHASH(TTE8K);
10727         HME_HASH_FAST_SEARCH(hmebp, hblktag, found);
10728 
10729         if (found != new)
10730                 panic("sfmmu_hblk_swap: new hblk not found");
10731 #endif
10732 
10733         SFMMU_HASH_UNLOCK(hmebp);
10734 
10735         /*
10736          * Reset hblk_reserve
10737          */
10738         bzero((void *)old, HME8BLK_SZ);
10739         old->hblk_nextpa = va_to_pa((caddr_t)old);
10740 }
10741 
10742 /*
10743  * Grab the mlist mutex for both pages passed in.
10744  *
10745  * low and high will be returned as pointers to the mutexes for these pages.
10746  * low refers to the mutex residing in the lower bin of the mlist hash, while
10747  * high refers to the mutex residing in the higher bin of the mlist hash.  This
10748  * is due to the locking order restrictions on the same thread grabbing
10749  * multiple mlist mutexes.  The low lock must be acquired before the high lock.
10750  *
10751  * If both pages hash to the same mutex, only grab that single mutex, and
10752  * high will be returned as NULL
10753  * If the pages hash to different bins in the hash, grab the lower addressed
10754  * lock first and then the higher addressed lock in order to follow the locking
10755  * rules involved with the same thread grabbing multiple mlist mutexes.
10756  * low and high will both have non-NULL values.
10757  */
10758 static void
10759 sfmmu_mlist_reloc_enter(struct page *targ, struct page *repl,
10760     kmutex_t **low, kmutex_t **high)
10761 {
10762         kmutex_t        *mml_targ, *mml_repl;
10763 
10764         /*
10765          * no need to do the dance around szc as in sfmmu_mlist_enter()
10766          * because this routine is only called by hat_page_relocate() and all
10767          * targ and repl pages are already locked EXCL so szc can't change.
10768          */
10769 
10770         mml_targ = MLIST_HASH(PP_PAGEROOT(targ));
10771         mml_repl = MLIST_HASH(PP_PAGEROOT(repl));
10772 
10773         if (mml_targ == mml_repl) {
10774                 *low = mml_targ;
10775                 *high = NULL;
10776         } else {
10777                 if (mml_targ < mml_repl) {
10778                         *low = mml_targ;
10779                         *high = mml_repl;
10780                 } else {
10781                         *low = mml_repl;
10782                         *high = mml_targ;
10783                 }
10784         }
10785 
10786         mutex_enter(*low);
10787         if (*high)
10788                 mutex_enter(*high);
10789 }
10790 
10791 static void
10792 sfmmu_mlist_reloc_exit(kmutex_t *low, kmutex_t *high)
10793 {
10794         if (high)
10795                 mutex_exit(high);
10796         mutex_exit(low);
10797 }
10798 
10799 static hatlock_t *
10800 sfmmu_hat_enter(sfmmu_t *sfmmup)
10801 {
10802         hatlock_t       *hatlockp;
10803 
10804         if (sfmmup != ksfmmup) {
10805                 hatlockp = TSB_HASH(sfmmup);
10806                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
10807                 return (hatlockp);
10808         }
10809         return (NULL);
10810 }
10811 
10812 static hatlock_t *
10813 sfmmu_hat_tryenter(sfmmu_t *sfmmup)
10814 {
10815         hatlock_t       *hatlockp;
10816 
10817         if (sfmmup != ksfmmup) {
10818                 hatlockp = TSB_HASH(sfmmup);
10819                 if (mutex_tryenter(HATLOCK_MUTEXP(hatlockp)) == 0)
10820                         return (NULL);
10821                 return (hatlockp);
10822         }
10823         return (NULL);
10824 }
10825 
10826 static void
10827 sfmmu_hat_exit(hatlock_t *hatlockp)
10828 {
10829         if (hatlockp != NULL)
10830                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
10831 }
10832 
10833 static void
10834 sfmmu_hat_lock_all(void)
10835 {
10836         int i;
10837         for (i = 0; i < SFMMU_NUM_LOCK; i++)
10838                 mutex_enter(HATLOCK_MUTEXP(&hat_lock[i]));
10839 }
10840 
10841 static void
10842 sfmmu_hat_unlock_all(void)
10843 {
10844         int i;
10845         for (i = SFMMU_NUM_LOCK - 1; i >= 0; i--)
10846                 mutex_exit(HATLOCK_MUTEXP(&hat_lock[i]));
10847 }
10848 
10849 int
10850 sfmmu_hat_lock_held(sfmmu_t *sfmmup)
10851 {
10852         ASSERT(sfmmup != ksfmmup);
10853         return (MUTEX_HELD(HATLOCK_MUTEXP(TSB_HASH(sfmmup))));
10854 }
10855 
10856 /*
10857  * Locking primitives to provide consistency between ISM unmap
10858  * and other operations.  Since ISM unmap can take a long time, we
10859  * use HAT_ISMBUSY flag (protected by the hatlock) to avoid creating
10860  * contention on the hatlock buckets while ISM segments are being
10861  * unmapped.  The tradeoff is that the flags don't prevent priority
10862  * inversion from occurring, so we must request kernel priority in
10863  * case we have to sleep to keep from getting buried while holding
10864  * the HAT_ISMBUSY flag set, which in turn could block other kernel
10865  * threads from running (for example, in sfmmu_uvatopfn()).
10866  */
10867 static void
10868 sfmmu_ismhat_enter(sfmmu_t *sfmmup, int hatlock_held)
10869 {
10870         hatlock_t *hatlockp;
10871 
10872         if (!hatlock_held)
10873                 hatlockp = sfmmu_hat_enter(sfmmup);
10874         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY))
10875                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
10876         SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
10877         if (!hatlock_held)
10878                 sfmmu_hat_exit(hatlockp);
10879 }
10880 
10881 static void
10882 sfmmu_ismhat_exit(sfmmu_t *sfmmup, int hatlock_held)
10883 {
10884         hatlock_t *hatlockp;
10885 
10886         if (!hatlock_held)
10887                 hatlockp = sfmmu_hat_enter(sfmmup);
10888         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
10889         SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
10890         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
10891         if (!hatlock_held)
10892                 sfmmu_hat_exit(hatlockp);
10893 }
10894 
10895 /*
10896  *
10897  * Algorithm:
10898  *
10899  * (1) if segkmem is not ready, allocate hblk from an array of pre-alloc'ed
10900  *      hblks.
10901  *
10902  * (2) if we are allocating an hblk for mapping a slab in sfmmu_cache,
10903  *
10904  *              (a) try to return an hblk from reserve pool of free hblks;
10905  *              (b) if the reserve pool is empty, acquire hblk_reserve_lock
10906  *                  and return hblk_reserve.
10907  *
10908  * (3) call kmem_cache_alloc() to allocate hblk;
10909  *
10910  *              (a) if hblk_reserve_lock is held by the current thread,
10911  *                  atomically replace hblk_reserve by the hblk that is
10912  *                  returned by kmem_cache_alloc; release hblk_reserve_lock
10913  *                  and call kmem_cache_alloc() again.
10914  *              (b) if reserve pool is not full, add the hblk that is
10915  *                  returned by kmem_cache_alloc to reserve pool and
10916  *                  call kmem_cache_alloc again.
10917  *
10918  */
10919 static struct hme_blk *
10920 sfmmu_hblk_alloc(sfmmu_t *sfmmup, caddr_t vaddr,
10921     struct hmehash_bucket *hmebp, uint_t size, hmeblk_tag hblktag,
10922     uint_t flags, uint_t rid)
10923 {
10924         struct hme_blk *hmeblkp = NULL;
10925         struct hme_blk *newhblkp;
10926         struct hme_blk *shw_hblkp = NULL;
10927         struct kmem_cache *sfmmu_cache = NULL;
10928         uint64_t hblkpa;
10929         ulong_t index;
10930         uint_t owner;           /* set to 1 if using hblk_reserve */
10931         uint_t forcefree;
10932         int sleep;
10933         sf_srd_t *srdp;
10934         sf_region_t *rgnp;
10935 
10936         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
10937         ASSERT(hblktag.htag_rid == rid);
10938         SFMMU_VALIDATE_HMERID(sfmmup, rid, vaddr, TTEBYTES(size));
10939         ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
10940             IS_P2ALIGNED(vaddr, TTEBYTES(size)));
10941 
10942         /*
10943          * If segkmem is not created yet, allocate from static hmeblks
10944          * created at the end of startup_modules().  See the block comment
10945          * in startup_modules() describing how we estimate the number of
10946          * static hmeblks that will be needed during re-map.
10947          */
10948         if (!hblk_alloc_dynamic) {
10949 
10950                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
10951 
10952                 if (size == TTE8K) {
10953                         index = nucleus_hblk8.index;
10954                         if (index >= nucleus_hblk8.len) {
10955                                 /*
10956                                  * If we panic here, see startup_modules() to
10957                                  * make sure that we are calculating the
10958                                  * number of hblk8's that we need correctly.
10959                                  */
10960                                 prom_panic("no nucleus hblk8 to allocate");
10961                         }
10962                         hmeblkp =
10963                             (struct hme_blk *)&nucleus_hblk8.list[index];
10964                         nucleus_hblk8.index++;
10965                         SFMMU_STAT(sf_hblk8_nalloc);
10966                 } else {
10967                         index = nucleus_hblk1.index;
10968                         if (nucleus_hblk1.index >= nucleus_hblk1.len) {
10969                                 /*
10970                                  * If we panic here, see startup_modules().
10971                                  * Most likely you need to update the
10972                                  * calculation of the number of hblk1 elements
10973                                  * that the kernel needs to boot.
10974                                  */
10975                                 prom_panic("no nucleus hblk1 to allocate");
10976                         }
10977                         hmeblkp =
10978                             (struct hme_blk *)&nucleus_hblk1.list[index];
10979                         nucleus_hblk1.index++;
10980                         SFMMU_STAT(sf_hblk1_nalloc);
10981                 }
10982 
10983                 goto hblk_init;
10984         }
10985 
10986         SFMMU_HASH_UNLOCK(hmebp);
10987 
10988         if (sfmmup != KHATID && !SFMMU_IS_SHMERID_VALID(rid)) {
10989                 if (mmu_page_sizes == max_mmu_page_sizes) {
10990                         if (size < TTE256M)
10991                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10992                                     size, flags);
10993                 } else {
10994                         if (size < TTE4M)
10995                                 shw_hblkp = sfmmu_shadow_hcreate(sfmmup, vaddr,
10996                                     size, flags);
10997                 }
10998         } else if (SFMMU_IS_SHMERID_VALID(rid)) {
10999                 /*
11000                  * Shared hmes use per region bitmaps in rgn_hmeflag
11001                  * rather than shadow hmeblks to keep track of the
11002                  * mapping sizes which have been allocated for the region.
11003                  * Here we cleanup old invalid hmeblks with this rid,
11004                  * which may be left around by pageunload().
11005                  */
11006                 int ttesz;
11007                 caddr_t va;
11008                 caddr_t eva = vaddr + TTEBYTES(size);
11009 
11010                 ASSERT(sfmmup != KHATID);
11011 
11012                 srdp = sfmmup->sfmmu_srdp;
11013                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11014                 rgnp = srdp->srd_hmergnp[rid];
11015                 ASSERT(rgnp != NULL && rgnp->rgn_id == rid);
11016                 ASSERT(rgnp->rgn_refcnt != 0);
11017                 ASSERT(size <= rgnp->rgn_pgszc);
11018 
11019                 ttesz = HBLK_MIN_TTESZ;
11020                 do {
11021                         if (!(rgnp->rgn_hmeflags & (0x1 << ttesz))) {
11022                                 continue;
11023                         }
11024 
11025                         if (ttesz > size && ttesz != HBLK_MIN_TTESZ) {
11026                                 sfmmu_cleanup_rhblk(srdp, vaddr, rid, ttesz);
11027                         } else if (ttesz < size) {
11028                                 for (va = vaddr; va < eva;
11029                                     va += TTEBYTES(ttesz)) {
11030                                         sfmmu_cleanup_rhblk(srdp, va, rid,
11031                                             ttesz);
11032                                 }
11033                         }
11034                 } while (++ttesz <= rgnp->rgn_pgszc);
11035         }
11036 
11037 fill_hblk:
11038         owner = (hblk_reserve_thread == curthread) ? 1 : 0;
11039 
11040         if (owner && size == TTE8K) {
11041 
11042                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid));
11043                 /*
11044                  * We are really in a tight spot. We already own
11045                  * hblk_reserve and we need another hblk.  In anticipation
11046                  * of this kind of scenario, we specifically set aside
11047                  * HBLK_RESERVE_MIN number of hblks to be used exclusively
11048                  * by owner of hblk_reserve.
11049                  */
11050                 SFMMU_STAT(sf_hblk_recurse_cnt);
11051 
11052                 if (!sfmmu_get_free_hblk(&hmeblkp, 1))
11053                         panic("sfmmu_hblk_alloc: reserve list is empty");
11054 
11055                 goto hblk_verify;
11056         }
11057 
11058         ASSERT(!owner);
11059 
11060         if ((flags & HAT_NO_KALLOC) == 0) {
11061 
11062                 sfmmu_cache = ((size == TTE8K) ? sfmmu8_cache : sfmmu1_cache);
11063                 sleep = ((sfmmup == KHATID) ? KM_NOSLEEP : KM_SLEEP);
11064 
11065                 if ((hmeblkp = kmem_cache_alloc(sfmmu_cache, sleep)) == NULL) {
11066                         hmeblkp = sfmmu_hblk_steal(size);
11067                 } else {
11068                         /*
11069                          * if we are the owner of hblk_reserve,
11070                          * swap hblk_reserve with hmeblkp and
11071                          * start a fresh life.  Hope things go
11072                          * better this time.
11073                          */
11074                         if (hblk_reserve_thread == curthread) {
11075                                 ASSERT(sfmmu_cache == sfmmu8_cache);
11076                                 sfmmu_hblk_swap(hmeblkp);
11077                                 hblk_reserve_thread = NULL;
11078                                 mutex_exit(&hblk_reserve_lock);
11079                                 goto fill_hblk;
11080                         }
11081                         /*
11082                          * let's donate this hblk to our reserve list if
11083                          * we are not mapping kernel range
11084                          */
11085                         if (size == TTE8K && sfmmup != KHATID) {
11086                                 if (sfmmu_put_free_hblk(hmeblkp, 0))
11087                                         goto fill_hblk;
11088                         }
11089                 }
11090         } else {
11091                 /*
11092                  * We are here to map the slab in sfmmu8_cache; let's
11093                  * check if we could tap our reserve list; if successful,
11094                  * this will avoid the pain of going thru sfmmu_hblk_swap
11095                  */
11096                 SFMMU_STAT(sf_hblk_slab_cnt);
11097                 if (!sfmmu_get_free_hblk(&hmeblkp, 0)) {
11098                         /*
11099                          * let's start hblk_reserve dance
11100                          */
11101                         SFMMU_STAT(sf_hblk_reserve_cnt);
11102                         owner = 1;
11103                         mutex_enter(&hblk_reserve_lock);
11104                         hmeblkp = HBLK_RESERVE;
11105                         hblk_reserve_thread = curthread;
11106                 }
11107         }
11108 
11109 hblk_verify:
11110         ASSERT(hmeblkp != NULL);
11111         set_hblk_sz(hmeblkp, size);
11112         ASSERT(hmeblkp->hblk_nextpa == va_to_pa((caddr_t)hmeblkp));
11113         SFMMU_HASH_LOCK(hmebp);
11114         HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11115         if (newhblkp != NULL) {
11116                 SFMMU_HASH_UNLOCK(hmebp);
11117                 if (hmeblkp != HBLK_RESERVE) {
11118                         /*
11119                          * This is really tricky!
11120                          *
11121                          * vmem_alloc(vmem_seg_arena)
11122                          *  vmem_alloc(vmem_internal_arena)
11123                          *   segkmem_alloc(heap_arena)
11124                          *    vmem_alloc(heap_arena)
11125                          *    page_create()
11126                          *    hat_memload()
11127                          *      kmem_cache_free()
11128                          *       kmem_cache_alloc()
11129                          *        kmem_slab_create()
11130                          *         vmem_alloc(kmem_internal_arena)
11131                          *          segkmem_alloc(heap_arena)
11132                          *              vmem_alloc(heap_arena)
11133                          *              page_create()
11134                          *              hat_memload()
11135                          *                kmem_cache_free()
11136                          *              ...
11137                          *
11138                          * Thus, hat_memload() could call kmem_cache_free
11139                          * for enough number of times that we could easily
11140                          * hit the bottom of the stack or run out of reserve
11141                          * list of vmem_seg structs.  So, we must donate
11142                          * this hblk to reserve list if it's allocated
11143                          * from sfmmu8_cache *and* mapping kernel range.
11144                          * We don't need to worry about freeing hmeblk1's
11145                          * to kmem since they don't map any kmem slabs.
11146                          *
11147                          * Note: When segkmem supports largepages, we must
11148                          * free hmeblk1's to reserve list as well.
11149                          */
11150                         forcefree = (sfmmup == KHATID) ? 1 : 0;
11151                         if (size == TTE8K &&
11152                             sfmmu_put_free_hblk(hmeblkp, forcefree)) {
11153                                 goto re_verify;
11154                         }
11155                         ASSERT(sfmmup != KHATID);
11156                         kmem_cache_free(get_hblk_cache(hmeblkp), hmeblkp);
11157                 } else {
11158                         /*
11159                          * Hey! we don't need hblk_reserve any more.
11160                          */
11161                         ASSERT(owner);
11162                         hblk_reserve_thread = NULL;
11163                         mutex_exit(&hblk_reserve_lock);
11164                         owner = 0;
11165                 }
11166 re_verify:
11167                 /*
11168                  * let's check if the goodies are still present
11169                  */
11170                 SFMMU_HASH_LOCK(hmebp);
11171                 HME_HASH_FAST_SEARCH(hmebp, hblktag, newhblkp);
11172                 if (newhblkp != NULL) {
11173                         /*
11174                          * return newhblkp if it's not hblk_reserve;
11175                          * if newhblkp is hblk_reserve, return it
11176                          * _only if_ we are the owner of hblk_reserve.
11177                          */
11178                         if (newhblkp != HBLK_RESERVE || owner) {
11179                                 ASSERT(!SFMMU_IS_SHMERID_VALID(rid) ||
11180                                     newhblkp->hblk_shared);
11181                                 ASSERT(SFMMU_IS_SHMERID_VALID(rid) ||
11182                                     !newhblkp->hblk_shared);
11183                                 return (newhblkp);
11184                         } else {
11185                                 /*
11186                                  * we just hit hblk_reserve in the hash and
11187                                  * we are not the owner of that;
11188                                  *
11189                                  * block until hblk_reserve_thread completes
11190                                  * swapping hblk_reserve and try the dance
11191                                  * once again.
11192                                  */
11193                                 SFMMU_HASH_UNLOCK(hmebp);
11194                                 mutex_enter(&hblk_reserve_lock);
11195                                 mutex_exit(&hblk_reserve_lock);
11196                                 SFMMU_STAT(sf_hblk_reserve_hit);
11197                                 goto fill_hblk;
11198                         }
11199                 } else {
11200                         /*
11201                          * it's no more! try the dance once again.
11202                          */
11203                         SFMMU_HASH_UNLOCK(hmebp);
11204                         goto fill_hblk;
11205                 }
11206         }
11207 
11208 hblk_init:
11209         if (SFMMU_IS_SHMERID_VALID(rid)) {
11210                 uint16_t tteflag = 0x1 <<
11211                     ((size < HBLK_MIN_TTESZ) ? HBLK_MIN_TTESZ : size);
11212 
11213                 if (!(rgnp->rgn_hmeflags & tteflag)) {
11214                         atomic_or_16(&rgnp->rgn_hmeflags, tteflag);
11215                 }
11216                 hmeblkp->hblk_shared = 1;
11217         } else {
11218                 hmeblkp->hblk_shared = 0;
11219         }
11220         set_hblk_sz(hmeblkp, size);
11221         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11222         hmeblkp->hblk_next = (struct hme_blk *)NULL;
11223         hmeblkp->hblk_tag = hblktag;
11224         hmeblkp->hblk_shadow = shw_hblkp;
11225         hblkpa = hmeblkp->hblk_nextpa;
11226         hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
11227 
11228         ASSERT(get_hblk_ttesz(hmeblkp) == size);
11229         ASSERT(get_hblk_span(hmeblkp) == HMEBLK_SPAN(size));
11230         ASSERT(hmeblkp->hblk_hmecnt == 0);
11231         ASSERT(hmeblkp->hblk_vcnt == 0);
11232         ASSERT(hmeblkp->hblk_lckcnt == 0);
11233         ASSERT(hblkpa == va_to_pa((caddr_t)hmeblkp));
11234         sfmmu_hblk_hash_add(hmebp, hmeblkp, hblkpa);
11235         return (hmeblkp);
11236 }
11237 
11238 /*
11239  * This function cleans up the hme_blk and returns it to the free list.
11240  */
11241 /* ARGSUSED */
11242 static void
11243 sfmmu_hblk_free(struct hme_blk **listp)
11244 {
11245         struct hme_blk *hmeblkp, *next_hmeblkp;
11246         int             size;
11247         uint_t          critical;
11248         uint64_t        hblkpa;
11249 
11250         ASSERT(*listp != NULL);
11251 
11252         hmeblkp = *listp;
11253         while (hmeblkp != NULL) {
11254                 next_hmeblkp = hmeblkp->hblk_next;
11255                 ASSERT(!hmeblkp->hblk_hmecnt);
11256                 ASSERT(!hmeblkp->hblk_vcnt);
11257                 ASSERT(!hmeblkp->hblk_lckcnt);
11258                 ASSERT(hmeblkp != (struct hme_blk *)hblk_reserve);
11259                 ASSERT(hmeblkp->hblk_shared == 0);
11260                 ASSERT(hmeblkp->hblk_shw_bit == 0);
11261                 ASSERT(hmeblkp->hblk_shadow == NULL);
11262 
11263                 hblkpa = va_to_pa((caddr_t)hmeblkp);
11264                 ASSERT(hblkpa != (uint64_t)-1);
11265                 critical = (hblktosfmmu(hmeblkp) == KHATID) ? 1 : 0;
11266 
11267                 size = get_hblk_ttesz(hmeblkp);
11268                 hmeblkp->hblk_next = NULL;
11269                 hmeblkp->hblk_nextpa = hblkpa;
11270 
11271                 if (hmeblkp->hblk_nuc_bit == 0) {
11272 
11273                         if (size != TTE8K ||
11274                             !sfmmu_put_free_hblk(hmeblkp, critical))
11275                                 kmem_cache_free(get_hblk_cache(hmeblkp),
11276                                     hmeblkp);
11277                 }
11278                 hmeblkp = next_hmeblkp;
11279         }
11280 }
11281 
11282 #define BUCKETS_TO_SEARCH_BEFORE_UNLOAD 30
11283 #define SFMMU_HBLK_STEAL_THRESHOLD 5
11284 
11285 static uint_t sfmmu_hblk_steal_twice;
11286 static uint_t sfmmu_hblk_steal_count, sfmmu_hblk_steal_unload_count;
11287 
11288 /*
11289  * Steal a hmeblk from user or kernel hme hash lists.
11290  * For 8K tte grab one from reserve pool (freehblkp) before proceeding to
11291  * steal and if we fail to steal after SFMMU_HBLK_STEAL_THRESHOLD attempts
11292  * tap into critical reserve of freehblkp.
11293  * Note: We remain looping in this routine until we find one.
11294  */
11295 static struct hme_blk *
11296 sfmmu_hblk_steal(int size)
11297 {
11298         static struct hmehash_bucket *uhmehash_steal_hand = NULL;
11299         struct hmehash_bucket *hmebp;
11300         struct hme_blk *hmeblkp = NULL, *pr_hblk;
11301         uint64_t hblkpa;
11302         int i;
11303         uint_t loop_cnt = 0, critical;
11304 
11305         for (;;) {
11306                 /* Check cpu hblk pending queues */
11307                 if ((hmeblkp = sfmmu_check_pending_hblks(size)) != NULL) {
11308                         hmeblkp->hblk_nextpa = va_to_pa((caddr_t)hmeblkp);
11309                         ASSERT(hmeblkp->hblk_hmecnt == 0);
11310                         ASSERT(hmeblkp->hblk_vcnt == 0);
11311                         return (hmeblkp);
11312                 }
11313 
11314                 if (size == TTE8K) {
11315                         critical =
11316                             (++loop_cnt > SFMMU_HBLK_STEAL_THRESHOLD) ? 1 : 0;
11317                         if (sfmmu_get_free_hblk(&hmeblkp, critical))
11318                                 return (hmeblkp);
11319                 }
11320 
11321                 hmebp = (uhmehash_steal_hand == NULL) ? uhme_hash :
11322                     uhmehash_steal_hand;
11323                 ASSERT(hmebp >= uhme_hash && hmebp <= &uhme_hash[UHMEHASH_SZ]);
11324 
11325                 for (i = 0; hmeblkp == NULL && i <= UHMEHASH_SZ +
11326                     BUCKETS_TO_SEARCH_BEFORE_UNLOAD; i++) {
11327                         SFMMU_HASH_LOCK(hmebp);
11328                         hmeblkp = hmebp->hmeblkp;
11329                         hblkpa = hmebp->hmeh_nextpa;
11330                         pr_hblk = NULL;
11331                         while (hmeblkp) {
11332                                 /*
11333                                  * check if it is a hmeblk that is not locked
11334                                  * and not shared. skip shadow hmeblks with
11335                                  * shadow_mask set i.e valid count non zero.
11336                                  */
11337                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11338                                     (hmeblkp->hblk_shw_bit == 0 ||
11339                                     hmeblkp->hblk_vcnt == 0) &&
11340                                     (hmeblkp->hblk_lckcnt == 0)) {
11341                                         /*
11342                                          * there is a high probability that we
11343                                          * will find a free one. search some
11344                                          * buckets for a free hmeblk initially
11345                                          * before unloading a valid hmeblk.
11346                                          */
11347                                         if ((hmeblkp->hblk_vcnt == 0 &&
11348                                             hmeblkp->hblk_hmecnt == 0) || (i >=
11349                                             BUCKETS_TO_SEARCH_BEFORE_UNLOAD)) {
11350                                                 if (sfmmu_steal_this_hblk(hmebp,
11351                                                     hmeblkp, hblkpa, pr_hblk)) {
11352                                                         /*
11353                                                          * Hblk is unloaded
11354                                                          * successfully
11355                                                          */
11356                                                         break;
11357                                                 }
11358                                         }
11359                                 }
11360                                 pr_hblk = hmeblkp;
11361                                 hblkpa = hmeblkp->hblk_nextpa;
11362                                 hmeblkp = hmeblkp->hblk_next;
11363                         }
11364 
11365                         SFMMU_HASH_UNLOCK(hmebp);
11366                         if (hmebp++ == &uhme_hash[UHMEHASH_SZ])
11367                                 hmebp = uhme_hash;
11368                 }
11369                 uhmehash_steal_hand = hmebp;
11370 
11371                 if (hmeblkp != NULL)
11372                         break;
11373 
11374                 /*
11375                  * in the worst case, look for a free one in the kernel
11376                  * hash table.
11377                  */
11378                 for (i = 0, hmebp = khme_hash; i <= KHMEHASH_SZ; i++) {
11379                         SFMMU_HASH_LOCK(hmebp);
11380                         hmeblkp = hmebp->hmeblkp;
11381                         hblkpa = hmebp->hmeh_nextpa;
11382                         pr_hblk = NULL;
11383                         while (hmeblkp) {
11384                                 /*
11385                                  * check if it is free hmeblk
11386                                  */
11387                                 if ((get_hblk_ttesz(hmeblkp) == size) &&
11388                                     (hmeblkp->hblk_lckcnt == 0) &&
11389                                     (hmeblkp->hblk_vcnt == 0) &&
11390                                     (hmeblkp->hblk_hmecnt == 0)) {
11391                                         if (sfmmu_steal_this_hblk(hmebp,
11392                                             hmeblkp, hblkpa, pr_hblk)) {
11393                                                 break;
11394                                         } else {
11395                                                 /*
11396                                                  * Cannot fail since we have
11397                                                  * hash lock.
11398                                                  */
11399                                                 panic("fail to steal?");
11400                                         }
11401                                 }
11402 
11403                                 pr_hblk = hmeblkp;
11404                                 hblkpa = hmeblkp->hblk_nextpa;
11405                                 hmeblkp = hmeblkp->hblk_next;
11406                         }
11407 
11408                         SFMMU_HASH_UNLOCK(hmebp);
11409                         if (hmebp++ == &khme_hash[KHMEHASH_SZ])
11410                                 hmebp = khme_hash;
11411                 }
11412 
11413                 if (hmeblkp != NULL)
11414                         break;
11415                 sfmmu_hblk_steal_twice++;
11416         }
11417         return (hmeblkp);
11418 }
11419 
11420 /*
11421  * This routine does real work to prepare a hblk to be "stolen" by
11422  * unloading the mappings, updating shadow counts ....
11423  * It returns 1 if the block is ready to be reused (stolen), or 0
11424  * means the block cannot be stolen yet- pageunload is still working
11425  * on this hblk.
11426  */
11427 static int
11428 sfmmu_steal_this_hblk(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
11429     uint64_t hblkpa, struct hme_blk *pr_hblk)
11430 {
11431         int shw_size, vshift;
11432         struct hme_blk *shw_hblkp;
11433         caddr_t vaddr;
11434         uint_t shw_mask, newshw_mask;
11435         struct hme_blk *list = NULL;
11436 
11437         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
11438 
11439         /*
11440          * check if the hmeblk is free, unload if necessary
11441          */
11442         if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11443                 sfmmu_t *sfmmup;
11444                 demap_range_t dmr;
11445 
11446                 sfmmup = hblktosfmmu(hmeblkp);
11447                 if (hmeblkp->hblk_shared || sfmmup->sfmmu_ismhat) {
11448                         return (0);
11449                 }
11450                 DEMAP_RANGE_INIT(sfmmup, &dmr);
11451                 (void) sfmmu_hblk_unload(sfmmup, hmeblkp,
11452                     (caddr_t)get_hblk_base(hmeblkp),
11453                     get_hblk_endaddr(hmeblkp), &dmr, HAT_UNLOAD);
11454                 DEMAP_RANGE_FLUSH(&dmr);
11455                 if (hmeblkp->hblk_vcnt || hmeblkp->hblk_hmecnt) {
11456                         /*
11457                          * Pageunload is working on the same hblk.
11458                          */
11459                         return (0);
11460                 }
11461 
11462                 sfmmu_hblk_steal_unload_count++;
11463         }
11464 
11465         ASSERT(hmeblkp->hblk_lckcnt == 0);
11466         ASSERT(hmeblkp->hblk_vcnt == 0 && hmeblkp->hblk_hmecnt == 0);
11467 
11468         sfmmu_hblk_hash_rm(hmebp, hmeblkp, pr_hblk, &list, 1);
11469         hmeblkp->hblk_nextpa = hblkpa;
11470 
11471         shw_hblkp = hmeblkp->hblk_shadow;
11472         if (shw_hblkp) {
11473                 ASSERT(!hmeblkp->hblk_shared);
11474                 shw_size = get_hblk_ttesz(shw_hblkp);
11475                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
11476                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
11477                 ASSERT(vshift < 8);
11478                 /*
11479                  * Atomically clear shadow mask bit
11480                  */
11481                 do {
11482                         shw_mask = shw_hblkp->hblk_shw_mask;
11483                         ASSERT(shw_mask & (1 << vshift));
11484                         newshw_mask = shw_mask & ~(1 << vshift);
11485                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
11486                             shw_mask, newshw_mask);
11487                 } while (newshw_mask != shw_mask);
11488                 hmeblkp->hblk_shadow = NULL;
11489         }
11490 
11491         /*
11492          * remove shadow bit if we are stealing an unused shadow hmeblk.
11493          * sfmmu_hblk_alloc needs it that way, will set shadow bit later if
11494          * we are indeed allocating a shadow hmeblk.
11495          */
11496         hmeblkp->hblk_shw_bit = 0;
11497 
11498         if (hmeblkp->hblk_shared) {
11499                 sf_srd_t        *srdp;
11500                 sf_region_t     *rgnp;
11501                 uint_t          rid;
11502 
11503                 srdp = hblktosrd(hmeblkp);
11504                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
11505                 rid = hmeblkp->hblk_tag.htag_rid;
11506                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11507                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11508                 rgnp = srdp->srd_hmergnp[rid];
11509                 ASSERT(rgnp != NULL);
11510                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
11511                 hmeblkp->hblk_shared = 0;
11512         }
11513 
11514         sfmmu_hblk_steal_count++;
11515         SFMMU_STAT(sf_steal_count);
11516 
11517         return (1);
11518 }
11519 
11520 struct hme_blk *
11521 sfmmu_hmetohblk(struct sf_hment *sfhme)
11522 {
11523         struct hme_blk *hmeblkp;
11524         struct sf_hment *sfhme0;
11525         struct hme_blk *hblk_dummy = 0;
11526 
11527         /*
11528          * No dummy sf_hments, please.
11529          */
11530         ASSERT(sfhme->hme_tte.ll != 0);
11531 
11532         sfhme0 = sfhme - sfhme->hme_tte.tte_hmenum;
11533         hmeblkp = (struct hme_blk *)((uintptr_t)sfhme0 -
11534             (uintptr_t)&hblk_dummy->hblk_hme[0]);
11535 
11536         return (hmeblkp);
11537 }
11538 
11539 /*
11540  * On swapin, get appropriately sized TSB(s) and clear the HAT_SWAPPED flag.
11541  * If we can't get appropriately sized TSB(s), try for 8K TSB(s) using
11542  * KM_SLEEP allocation.
11543  *
11544  * Return 0 on success, -1 otherwise.
11545  */
11546 static void
11547 sfmmu_tsb_swapin(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11548 {
11549         struct tsb_info *tsbinfop, *next;
11550         tsb_replace_rc_t rc;
11551         boolean_t gotfirst = B_FALSE;
11552 
11553         ASSERT(sfmmup != ksfmmup);
11554         ASSERT(sfmmu_hat_lock_held(sfmmup));
11555 
11556         while (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPIN)) {
11557                 cv_wait(&sfmmup->sfmmu_tsb_cv, HATLOCK_MUTEXP(hatlockp));
11558         }
11559 
11560         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11561                 SFMMU_FLAGS_SET(sfmmup, HAT_SWAPIN);
11562         } else {
11563                 return;
11564         }
11565 
11566         ASSERT(sfmmup->sfmmu_tsb != NULL);
11567 
11568         /*
11569          * Loop over all tsbinfo's replacing them with ones that actually have
11570          * a TSB.  If any of the replacements ever fail, bail out of the loop.
11571          */
11572         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL; tsbinfop = next) {
11573                 ASSERT(tsbinfop->tsb_flags & TSB_SWAPPED);
11574                 next = tsbinfop->tsb_next;
11575                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, tsbinfop->tsb_szc,
11576                     hatlockp, TSB_SWAPIN);
11577                 if (rc != TSB_SUCCESS) {
11578                         break;
11579                 }
11580                 gotfirst = B_TRUE;
11581         }
11582 
11583         switch (rc) {
11584         case TSB_SUCCESS:
11585                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11586                 cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11587                 return;
11588         case TSB_LOSTRACE:
11589                 break;
11590         case TSB_ALLOCFAIL:
11591                 break;
11592         default:
11593                 panic("sfmmu_replace_tsb returned unrecognized failure code "
11594                     "%d", rc);
11595         }
11596 
11597         /*
11598          * In this case, we failed to get one of our TSBs.  If we failed to
11599          * get the first TSB, get one of minimum size (8KB).  Walk the list
11600          * and throw away the tsbinfos, starting where the allocation failed;
11601          * we can get by with just one TSB as long as we don't leave the
11602          * SWAPPED tsbinfo structures lying around.
11603          */
11604         tsbinfop = sfmmup->sfmmu_tsb;
11605         next = tsbinfop->tsb_next;
11606         tsbinfop->tsb_next = NULL;
11607 
11608         sfmmu_hat_exit(hatlockp);
11609         for (tsbinfop = next; tsbinfop != NULL; tsbinfop = next) {
11610                 next = tsbinfop->tsb_next;
11611                 sfmmu_tsbinfo_free(tsbinfop);
11612         }
11613         hatlockp = sfmmu_hat_enter(sfmmup);
11614 
11615         /*
11616          * If we don't have any TSBs, get a single 8K TSB for 8K, 64K and 512K
11617          * pages.
11618          */
11619         if (!gotfirst) {
11620                 tsbinfop = sfmmup->sfmmu_tsb;
11621                 rc = sfmmu_replace_tsb(sfmmup, tsbinfop, TSB_MIN_SZCODE,
11622                     hatlockp, TSB_SWAPIN | TSB_FORCEALLOC);
11623                 ASSERT(rc == TSB_SUCCESS);
11624         }
11625 
11626         SFMMU_FLAGS_CLEAR(sfmmup, HAT_SWAPPED|HAT_SWAPIN);
11627         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
11628 }
11629 
11630 static int
11631 sfmmu_is_rgnva(sf_srd_t *srdp, caddr_t addr, ulong_t w, ulong_t bmw)
11632 {
11633         ulong_t bix = 0;
11634         uint_t rid;
11635         sf_region_t *rgnp;
11636 
11637         ASSERT(srdp != NULL);
11638         ASSERT(srdp->srd_refcnt != 0);
11639 
11640         w <<= BT_ULSHIFT;
11641         while (bmw) {
11642                 if (!(bmw & 0x1)) {
11643                         bix++;
11644                         bmw >>= 1;
11645                         continue;
11646                 }
11647                 rid = w | bix;
11648                 rgnp = srdp->srd_hmergnp[rid];
11649                 ASSERT(rgnp->rgn_refcnt > 0);
11650                 ASSERT(rgnp->rgn_id == rid);
11651                 if (addr < rgnp->rgn_saddr ||
11652                     addr >= (rgnp->rgn_saddr + rgnp->rgn_size)) {
11653                         bix++;
11654                         bmw >>= 1;
11655                 } else {
11656                         return (1);
11657                 }
11658         }
11659         return (0);
11660 }
11661 
11662 /*
11663  * Handle exceptions for low level tsb_handler.
11664  *
11665  * There are many scenarios that could land us here:
11666  *
11667  * If the context is invalid we land here. The context can be invalid
11668  * for 3 reasons: 1) we couldn't allocate a new context and now need to
11669  * perform a wrap around operation in order to allocate a new context.
11670  * 2) Context was invalidated to change pagesize programming 3) ISMs or
11671  * TSBs configuration is changeing for this process and we are forced into
11672  * here to do a syncronization operation. If the context is valid we can
11673  * be here from window trap hanlder. In this case just call trap to handle
11674  * the fault.
11675  *
11676  * Note that the process will run in INVALID_CONTEXT before
11677  * faulting into here and subsequently loading the MMU registers
11678  * (including the TSB base register) associated with this process.
11679  * For this reason, the trap handlers must all test for
11680  * INVALID_CONTEXT before attempting to access any registers other
11681  * than the context registers.
11682  */
11683 void
11684 sfmmu_tsbmiss_exception(struct regs *rp, uintptr_t tagaccess, uint_t traptype)
11685 {
11686         sfmmu_t *sfmmup, *shsfmmup;
11687         uint_t ctxtype;
11688         klwp_id_t lwp;
11689         char lwp_save_state;
11690         hatlock_t *hatlockp, *shatlockp;
11691         struct tsb_info *tsbinfop;
11692         struct tsbmiss *tsbmp;
11693         sf_scd_t *scdp;
11694 
11695         SFMMU_STAT(sf_tsb_exceptions);
11696         SFMMU_MMU_STAT(mmu_tsb_exceptions);
11697         sfmmup = astosfmmu(curthread->t_procp->p_as);
11698         /*
11699          * note that in sun4u, tagacces register contains ctxnum
11700          * while sun4v passes ctxtype in the tagaccess register.
11701          */
11702         ctxtype = tagaccess & TAGACC_CTX_MASK;
11703 
11704         ASSERT(sfmmup != ksfmmup && ctxtype != KCONTEXT);
11705         ASSERT(sfmmup->sfmmu_ismhat == 0);
11706         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED) ||
11707             ctxtype == INVALID_CONTEXT);
11708 
11709         if (ctxtype != INVALID_CONTEXT && traptype != T_DATA_PROT) {
11710                 /*
11711                  * We may land here because shme bitmap and pagesize
11712                  * flags are updated lazily in tsbmiss area on other cpus.
11713                  * If we detect here that tsbmiss area is out of sync with
11714                  * sfmmu update it and retry the trapped instruction.
11715                  * Otherwise call trap().
11716                  */
11717                 int ret = 0;
11718                 uchar_t tteflag_mask = (1 << TTE64K) | (1 << TTE8K);
11719                 caddr_t addr = (caddr_t)(tagaccess & TAGACC_VADDR_MASK);
11720 
11721                 /*
11722                  * Must set lwp state to LWP_SYS before
11723                  * trying to acquire any adaptive lock
11724                  */
11725                 lwp = ttolwp(curthread);
11726                 ASSERT(lwp);
11727                 lwp_save_state = lwp->lwp_state;
11728                 lwp->lwp_state = LWP_SYS;
11729 
11730                 hatlockp = sfmmu_hat_enter(sfmmup);
11731                 kpreempt_disable();
11732                 tsbmp = &tsbmiss_area[CPU->cpu_id];
11733                 ASSERT(sfmmup == tsbmp->usfmmup);
11734                 if (((tsbmp->uhat_tteflags ^ sfmmup->sfmmu_tteflags) &
11735                     ~tteflag_mask) ||
11736                     ((tsbmp->uhat_rtteflags ^  sfmmup->sfmmu_rtteflags) &
11737                     ~tteflag_mask)) {
11738                         tsbmp->uhat_tteflags = sfmmup->sfmmu_tteflags;
11739                         tsbmp->uhat_rtteflags = sfmmup->sfmmu_rtteflags;
11740                         ret = 1;
11741                 }
11742                 if (sfmmup->sfmmu_srdp != NULL) {
11743                         ulong_t *sm = sfmmup->sfmmu_hmeregion_map.bitmap;
11744                         ulong_t *tm = tsbmp->shmermap;
11745                         ulong_t i;
11746                         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
11747                                 ulong_t d = tm[i] ^ sm[i];
11748                                 if (d) {
11749                                         if (d & sm[i]) {
11750                                                 if (!ret && sfmmu_is_rgnva(
11751                                                     sfmmup->sfmmu_srdp,
11752                                                     addr, i, d & sm[i])) {
11753                                                         ret = 1;
11754                                                 }
11755                                         }
11756                                         tm[i] = sm[i];
11757                                 }
11758                         }
11759                 }
11760                 kpreempt_enable();
11761                 sfmmu_hat_exit(hatlockp);
11762                 lwp->lwp_state = lwp_save_state;
11763                 if (ret) {
11764                         return;
11765                 }
11766         } else if (ctxtype == INVALID_CONTEXT) {
11767                 /*
11768                  * First, make sure we come out of here with a valid ctx,
11769                  * since if we don't get one we'll simply loop on the
11770                  * faulting instruction.
11771                  *
11772                  * If the ISM mappings are changing, the TSB is relocated,
11773                  * the process is swapped, the process is joining SCD or
11774                  * leaving SCD or shared regions we serialize behind the
11775                  * controlling thread with hat lock, sfmmu_flags and
11776                  * sfmmu_tsb_cv condition variable.
11777                  */
11778 
11779                 /*
11780                  * Must set lwp state to LWP_SYS before
11781                  * trying to acquire any adaptive lock
11782                  */
11783                 lwp = ttolwp(curthread);
11784                 ASSERT(lwp);
11785                 lwp_save_state = lwp->lwp_state;
11786                 lwp->lwp_state = LWP_SYS;
11787 
11788                 hatlockp = sfmmu_hat_enter(sfmmup);
11789 retry:
11790                 if ((scdp = sfmmup->sfmmu_scdp) != NULL) {
11791                         shsfmmup = scdp->scd_sfmmup;
11792                         ASSERT(shsfmmup != NULL);
11793 
11794                         for (tsbinfop = shsfmmup->sfmmu_tsb; tsbinfop != NULL;
11795                             tsbinfop = tsbinfop->tsb_next) {
11796                                 if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11797                                         /* drop the private hat lock */
11798                                         sfmmu_hat_exit(hatlockp);
11799                                         /* acquire the shared hat lock */
11800                                         shatlockp = sfmmu_hat_enter(shsfmmup);
11801                                         /*
11802                                          * recheck to see if anything changed
11803                                          * after we drop the private hat lock.
11804                                          */
11805                                         if (sfmmup->sfmmu_scdp == scdp &&
11806                                             shsfmmup == scdp->scd_sfmmup) {
11807                                                 sfmmu_tsb_chk_reloc(shsfmmup,
11808                                                     shatlockp);
11809                                         }
11810                                         sfmmu_hat_exit(shatlockp);
11811                                         hatlockp = sfmmu_hat_enter(sfmmup);
11812                                         goto retry;
11813                                 }
11814                         }
11815                 }
11816 
11817                 for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
11818                     tsbinfop = tsbinfop->tsb_next) {
11819                         if (tsbinfop->tsb_flags & TSB_RELOC_FLAG) {
11820                                 cv_wait(&sfmmup->sfmmu_tsb_cv,
11821                                     HATLOCK_MUTEXP(hatlockp));
11822                                 goto retry;
11823                         }
11824                 }
11825 
11826                 /*
11827                  * Wait for ISM maps to be updated.
11828                  */
11829                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
11830                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11831                             HATLOCK_MUTEXP(hatlockp));
11832                         goto retry;
11833                 }
11834 
11835                 /* Is this process joining an SCD? */
11836                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11837                         /*
11838                          * Flush private TSB and setup shared TSB.
11839                          * sfmmu_finish_join_scd() does not drop the
11840                          * hat lock.
11841                          */
11842                         sfmmu_finish_join_scd(sfmmup);
11843                         SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
11844                 }
11845 
11846                 /*
11847                  * If we're swapping in, get TSB(s).  Note that we must do
11848                  * this before we get a ctx or load the MMU state.  Once
11849                  * we swap in we have to recheck to make sure the TSB(s) and
11850                  * ISM mappings didn't change while we slept.
11851                  */
11852                 if (SFMMU_FLAGS_ISSET(sfmmup, HAT_SWAPPED)) {
11853                         sfmmu_tsb_swapin(sfmmup, hatlockp);
11854                         goto retry;
11855                 }
11856 
11857                 sfmmu_get_ctx(sfmmup);
11858 
11859                 sfmmu_hat_exit(hatlockp);
11860                 /*
11861                  * Must restore lwp_state if not calling
11862                  * trap() for further processing. Restore
11863                  * it anyway.
11864                  */
11865                 lwp->lwp_state = lwp_save_state;
11866                 return;
11867         }
11868         trap(rp, (caddr_t)tagaccess, traptype, 0);
11869 }
11870 
11871 static void
11872 sfmmu_tsb_chk_reloc(sfmmu_t *sfmmup, hatlock_t *hatlockp)
11873 {
11874         struct tsb_info *tp;
11875 
11876         ASSERT(sfmmu_hat_lock_held(sfmmup));
11877 
11878         for (tp = sfmmup->sfmmu_tsb; tp != NULL; tp = tp->tsb_next) {
11879                 if (tp->tsb_flags & TSB_RELOC_FLAG) {
11880                         cv_wait(&sfmmup->sfmmu_tsb_cv,
11881                             HATLOCK_MUTEXP(hatlockp));
11882                         break;
11883                 }
11884         }
11885 }
11886 
11887 /*
11888  * sfmmu_vatopfn_suspended is called from GET_TTE when TL=0 and
11889  * TTE_SUSPENDED bit set in tte we block on aquiring a page lock
11890  * rather than spinning to avoid send mondo timeouts with
11891  * interrupts enabled. When the lock is acquired it is immediately
11892  * released and we return back to sfmmu_vatopfn just after
11893  * the GET_TTE call.
11894  */
11895 void
11896 sfmmu_vatopfn_suspended(caddr_t vaddr, sfmmu_t *sfmmu, tte_t *ttep)
11897 {
11898         struct page     **pp;
11899 
11900         (void) as_pagelock(sfmmu->sfmmu_as, &pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11901         as_pageunlock(sfmmu->sfmmu_as, pp, vaddr, TTE_CSZ(ttep), S_WRITE);
11902 }
11903 
11904 /*
11905  * sfmmu_tsbmiss_suspended is called from GET_TTE when TL>0 and
11906  * TTE_SUSPENDED bit set in tte. We do this so that we can handle
11907  * cross traps which cannot be handled while spinning in the
11908  * trap handlers. Simply enter and exit the kpr_suspendlock spin
11909  * mutex, which is held by the holder of the suspend bit, and then
11910  * retry the trapped instruction after unwinding.
11911  */
11912 /*ARGSUSED*/
11913 void
11914 sfmmu_tsbmiss_suspended(struct regs *rp, uintptr_t tagacc, uint_t traptype)
11915 {
11916         ASSERT(curthread != kreloc_thread);
11917         mutex_enter(&kpr_suspendlock);
11918         mutex_exit(&kpr_suspendlock);
11919 }
11920 
11921 /*
11922  * This routine could be optimized to reduce the number of xcalls by flushing
11923  * the entire TLBs if region reference count is above some threshold but the
11924  * tradeoff will depend on the size of the TLB. So for now flush the specific
11925  * page a context at a time.
11926  *
11927  * If uselocks is 0 then it's called after all cpus were captured and all the
11928  * hat locks were taken. In this case don't take the region lock by relying on
11929  * the order of list region update operations in hat_join_region(),
11930  * hat_leave_region() and hat_dup_region(). The ordering in those routines
11931  * guarantees that list is always forward walkable and reaches active sfmmus
11932  * regardless of where xc_attention() captures a cpu.
11933  */
11934 cpuset_t
11935 sfmmu_rgntlb_demap(caddr_t addr, sf_region_t *rgnp,
11936     struct hme_blk *hmeblkp, int uselocks)
11937 {
11938         sfmmu_t *sfmmup;
11939         cpuset_t cpuset;
11940         cpuset_t rcpuset;
11941         hatlock_t *hatlockp;
11942         uint_t rid = rgnp->rgn_id;
11943         sf_rgn_link_t *rlink;
11944         sf_scd_t *scdp;
11945 
11946         ASSERT(hmeblkp->hblk_shared);
11947         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
11948         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
11949 
11950         CPUSET_ZERO(rcpuset);
11951         if (uselocks) {
11952                 mutex_enter(&rgnp->rgn_mutex);
11953         }
11954         sfmmup = rgnp->rgn_sfmmu_head;
11955         while (sfmmup != NULL) {
11956                 if (uselocks) {
11957                         hatlockp = sfmmu_hat_enter(sfmmup);
11958                 }
11959 
11960                 /*
11961                  * When an SCD is created the SCD hat is linked on the sfmmu
11962                  * region lists for each hme region which is part of the
11963                  * SCD. If we find an SCD hat, when walking these lists,
11964                  * then we flush the shared TSBs, if we find a private hat,
11965                  * which is part of an SCD, but where the region
11966                  * is not part of the SCD then we flush the private TSBs.
11967                  */
11968                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
11969                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
11970                         scdp = sfmmup->sfmmu_scdp;
11971                         if (SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
11972                                 if (uselocks) {
11973                                         sfmmu_hat_exit(hatlockp);
11974                                 }
11975                                 goto next;
11976                         }
11977                 }
11978 
11979                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
11980 
11981                 kpreempt_disable();
11982                 cpuset = sfmmup->sfmmu_cpusran;
11983                 CPUSET_AND(cpuset, cpu_ready_set);
11984                 CPUSET_DEL(cpuset, CPU->cpu_id);
11985                 SFMMU_XCALL_STATS(sfmmup);
11986                 xt_some(cpuset, vtag_flushpage_tl1,
11987                     (uint64_t)addr, (uint64_t)sfmmup);
11988                 vtag_flushpage(addr, (uint64_t)sfmmup);
11989                 if (uselocks) {
11990                         sfmmu_hat_exit(hatlockp);
11991                 }
11992                 kpreempt_enable();
11993                 CPUSET_OR(rcpuset, cpuset);
11994 
11995 next:
11996                 /* LINTED: constant in conditional context */
11997                 SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
11998                 ASSERT(rlink != NULL);
11999                 sfmmup = rlink->next;
12000         }
12001         if (uselocks) {
12002                 mutex_exit(&rgnp->rgn_mutex);
12003         }
12004         return (rcpuset);
12005 }
12006 
12007 /*
12008  * This routine takes an sfmmu pointer and the va for an adddress in an
12009  * ISM region as input and returns the corresponding region id in ism_rid.
12010  * The return value of 1 indicates that a region has been found and ism_rid
12011  * is valid, otherwise 0 is returned.
12012  */
12013 static int
12014 find_ism_rid(sfmmu_t *sfmmup, sfmmu_t *ism_sfmmup, caddr_t va, uint_t *ism_rid)
12015 {
12016         ism_blk_t       *ism_blkp;
12017         int             i;
12018         ism_map_t       *ism_map;
12019 #ifdef DEBUG
12020         struct hat      *ism_hatid;
12021 #endif
12022         ASSERT(sfmmu_hat_lock_held(sfmmup));
12023 
12024         ism_blkp = sfmmup->sfmmu_iblk;
12025         while (ism_blkp != NULL) {
12026                 ism_map = ism_blkp->iblk_maps;
12027                 for (i = 0; i < ISM_MAP_SLOTS && ism_map[i].imap_ismhat; i++) {
12028                         if ((va >= ism_start(ism_map[i])) &&
12029                             (va < ism_end(ism_map[i]))) {
12030 
12031                                 *ism_rid = ism_map[i].imap_rid;
12032 #ifdef DEBUG
12033                                 ism_hatid = ism_map[i].imap_ismhat;
12034                                 ASSERT(ism_hatid == ism_sfmmup);
12035                                 ASSERT(ism_hatid->sfmmu_ismhat);
12036 #endif
12037                                 return (1);
12038                         }
12039                 }
12040                 ism_blkp = ism_blkp->iblk_next;
12041         }
12042         return (0);
12043 }
12044 
12045 /*
12046  * Special routine to flush out ism mappings- TSBs, TLBs and D-caches.
12047  * This routine may be called with all cpu's captured. Therefore, the
12048  * caller is responsible for holding all locks and disabling kernel
12049  * preemption.
12050  */
12051 /* ARGSUSED */
12052 static void
12053 sfmmu_ismtlbcache_demap(caddr_t addr, sfmmu_t *ism_sfmmup,
12054     struct hme_blk *hmeblkp, pfn_t pfnum, int cache_flush_flag)
12055 {
12056         cpuset_t        cpuset;
12057         caddr_t         va;
12058         ism_ment_t      *ment;
12059         sfmmu_t         *sfmmup;
12060 #ifdef VAC
12061         int             vcolor;
12062 #endif
12063 
12064         sf_scd_t        *scdp;
12065         uint_t          ism_rid;
12066 
12067         ASSERT(!hmeblkp->hblk_shared);
12068         /*
12069          * Walk the ism_hat's mapping list and flush the page
12070          * from every hat sharing this ism_hat. This routine
12071          * may be called while all cpu's have been captured.
12072          * Therefore we can't attempt to grab any locks. For now
12073          * this means we will protect the ism mapping list under
12074          * a single lock which will be grabbed by the caller.
12075          * If hat_share/unshare scalibility becomes a performance
12076          * problem then we may need to re-think ism mapping list locking.
12077          */
12078         ASSERT(ism_sfmmup->sfmmu_ismhat);
12079         ASSERT(MUTEX_HELD(&ism_mlist_lock));
12080         addr = addr - ISMID_STARTADDR;
12081 
12082         for (ment = ism_sfmmup->sfmmu_iment; ment; ment = ment->iment_next) {
12083 
12084                 sfmmup = ment->iment_hat;
12085 
12086                 va = ment->iment_base_va;
12087                 va = (caddr_t)((uintptr_t)va  + (uintptr_t)addr);
12088 
12089                 /*
12090                  * When an SCD is created the SCD hat is linked on the ism
12091                  * mapping lists for each ISM segment which is part of the
12092                  * SCD. If we find an SCD hat, when walking these lists,
12093                  * then we flush the shared TSBs, if we find a private hat,
12094                  * which is part of an SCD, but where the region
12095                  * corresponding to this va is not part of the SCD then we
12096                  * flush the private TSBs.
12097                  */
12098                 if (!sfmmup->sfmmu_scdhat && sfmmup->sfmmu_scdp != NULL &&
12099                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD) &&
12100                     !SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY)) {
12101                         if (!find_ism_rid(sfmmup, ism_sfmmup, va,
12102                             &ism_rid)) {
12103                                 cmn_err(CE_PANIC,
12104                                     "can't find matching ISM rid!");
12105                         }
12106 
12107                         scdp = sfmmup->sfmmu_scdp;
12108                         if (SFMMU_IS_ISMRID_VALID(ism_rid) &&
12109                             SF_RGNMAP_TEST(scdp->scd_ismregion_map,
12110                             ism_rid)) {
12111                                 continue;
12112                         }
12113                 }
12114                 SFMMU_UNLOAD_TSB(va, sfmmup, hmeblkp, 1);
12115 
12116                 cpuset = sfmmup->sfmmu_cpusran;
12117                 CPUSET_AND(cpuset, cpu_ready_set);
12118                 CPUSET_DEL(cpuset, CPU->cpu_id);
12119                 SFMMU_XCALL_STATS(sfmmup);
12120                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)va,
12121                     (uint64_t)sfmmup);
12122                 vtag_flushpage(va, (uint64_t)sfmmup);
12123 
12124 #ifdef VAC
12125                 /*
12126                  * Flush D$
12127                  * When flushing D$ we must flush all
12128                  * cpu's. See sfmmu_cache_flush().
12129                  */
12130                 if (cache_flush_flag == CACHE_FLUSH) {
12131                         cpuset = cpu_ready_set;
12132                         CPUSET_DEL(cpuset, CPU->cpu_id);
12133 
12134                         SFMMU_XCALL_STATS(sfmmup);
12135                         vcolor = addr_to_vcolor(va);
12136                         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12137                         vac_flushpage(pfnum, vcolor);
12138                 }
12139 #endif  /* VAC */
12140         }
12141 }
12142 
12143 /*
12144  * Demaps the TSB, CPU caches, and flushes all TLBs on all CPUs of
12145  * a particular virtual address and ctx.  If noflush is set we do not
12146  * flush the TLB/TSB.  This function may or may not be called with the
12147  * HAT lock held.
12148  */
12149 static void
12150 sfmmu_tlbcache_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12151     pfn_t pfnum, int tlb_noflush, int cpu_flag, int cache_flush_flag,
12152     int hat_lock_held)
12153 {
12154 #ifdef VAC
12155         int vcolor;
12156 #endif
12157         cpuset_t cpuset;
12158         hatlock_t *hatlockp;
12159 
12160         ASSERT(!hmeblkp->hblk_shared);
12161 
12162 #if defined(lint) && !defined(VAC)
12163         pfnum = pfnum;
12164         cpu_flag = cpu_flag;
12165         cache_flush_flag = cache_flush_flag;
12166 #endif
12167 
12168         /*
12169          * There is no longer a need to protect against ctx being
12170          * stolen here since we don't store the ctx in the TSB anymore.
12171          */
12172 #ifdef VAC
12173         vcolor = addr_to_vcolor(addr);
12174 #endif
12175 
12176         /*
12177          * We must hold the hat lock during the flush of TLB,
12178          * to avoid a race with sfmmu_invalidate_ctx(), where
12179          * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12180          * causing TLB demap routine to skip flush on that MMU.
12181          * If the context on a MMU has already been set to
12182          * INVALID_CONTEXT, we just get an extra flush on
12183          * that MMU.
12184          */
12185         if (!hat_lock_held && !tlb_noflush)
12186                 hatlockp = sfmmu_hat_enter(sfmmup);
12187 
12188         kpreempt_disable();
12189         if (!tlb_noflush) {
12190                 /*
12191                  * Flush the TSB and TLB.
12192                  */
12193                 SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12194 
12195                 cpuset = sfmmup->sfmmu_cpusran;
12196                 CPUSET_AND(cpuset, cpu_ready_set);
12197                 CPUSET_DEL(cpuset, CPU->cpu_id);
12198 
12199                 SFMMU_XCALL_STATS(sfmmup);
12200 
12201                 xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr,
12202                     (uint64_t)sfmmup);
12203 
12204                 vtag_flushpage(addr, (uint64_t)sfmmup);
12205         }
12206 
12207         if (!hat_lock_held && !tlb_noflush)
12208                 sfmmu_hat_exit(hatlockp);
12209 
12210 #ifdef VAC
12211         /*
12212          * Flush the D$
12213          *
12214          * Even if the ctx is stolen, we need to flush the
12215          * cache. Our ctx stealer only flushes the TLBs.
12216          */
12217         if (cache_flush_flag == CACHE_FLUSH) {
12218                 if (cpu_flag & FLUSH_ALL_CPUS) {
12219                         cpuset = cpu_ready_set;
12220                 } else {
12221                         cpuset = sfmmup->sfmmu_cpusran;
12222                         CPUSET_AND(cpuset, cpu_ready_set);
12223                 }
12224                 CPUSET_DEL(cpuset, CPU->cpu_id);
12225                 SFMMU_XCALL_STATS(sfmmup);
12226                 xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12227                 vac_flushpage(pfnum, vcolor);
12228         }
12229 #endif  /* VAC */
12230         kpreempt_enable();
12231 }
12232 
12233 /*
12234  * Demaps the TSB and flushes all TLBs on all cpus for a particular virtual
12235  * address and ctx.  If noflush is set we do not currently do anything.
12236  * This function may or may not be called with the HAT lock held.
12237  */
12238 static void
12239 sfmmu_tlb_demap(caddr_t addr, sfmmu_t *sfmmup, struct hme_blk *hmeblkp,
12240     int tlb_noflush, int hat_lock_held)
12241 {
12242         cpuset_t cpuset;
12243         hatlock_t *hatlockp;
12244 
12245         ASSERT(!hmeblkp->hblk_shared);
12246 
12247         /*
12248          * If the process is exiting we have nothing to do.
12249          */
12250         if (tlb_noflush)
12251                 return;
12252 
12253         /*
12254          * Flush TSB.
12255          */
12256         if (!hat_lock_held)
12257                 hatlockp = sfmmu_hat_enter(sfmmup);
12258         SFMMU_UNLOAD_TSB(addr, sfmmup, hmeblkp, 0);
12259 
12260         kpreempt_disable();
12261 
12262         cpuset = sfmmup->sfmmu_cpusran;
12263         CPUSET_AND(cpuset, cpu_ready_set);
12264         CPUSET_DEL(cpuset, CPU->cpu_id);
12265 
12266         SFMMU_XCALL_STATS(sfmmup);
12267         xt_some(cpuset, vtag_flushpage_tl1, (uint64_t)addr, (uint64_t)sfmmup);
12268 
12269         vtag_flushpage(addr, (uint64_t)sfmmup);
12270 
12271         if (!hat_lock_held)
12272                 sfmmu_hat_exit(hatlockp);
12273 
12274         kpreempt_enable();
12275 
12276 }
12277 
12278 /*
12279  * Special case of sfmmu_tlb_demap for MMU_PAGESIZE hblks. Use the xcall
12280  * call handler that can flush a range of pages to save on xcalls.
12281  */
12282 static int sfmmu_xcall_save;
12283 
12284 /*
12285  * this routine is never used for demaping addresses backed by SRD hmeblks.
12286  */
12287 static void
12288 sfmmu_tlb_range_demap(demap_range_t *dmrp)
12289 {
12290         sfmmu_t *sfmmup = dmrp->dmr_sfmmup;
12291         hatlock_t *hatlockp;
12292         cpuset_t cpuset;
12293         uint64_t sfmmu_pgcnt;
12294         pgcnt_t pgcnt = 0;
12295         int pgunload = 0;
12296         int dirtypg = 0;
12297         caddr_t addr = dmrp->dmr_addr;
12298         caddr_t eaddr;
12299         uint64_t bitvec = dmrp->dmr_bitvec;
12300 
12301         ASSERT(bitvec & 1);
12302 
12303         /*
12304          * Flush TSB and calculate number of pages to flush.
12305          */
12306         while (bitvec != 0) {
12307                 dirtypg = 0;
12308                 /*
12309                  * Find the first page to flush and then count how many
12310                  * pages there are after it that also need to be flushed.
12311                  * This way the number of TSB flushes is minimized.
12312                  */
12313                 while ((bitvec & 1) == 0) {
12314                         pgcnt++;
12315                         addr += MMU_PAGESIZE;
12316                         bitvec >>= 1;
12317                 }
12318                 while (bitvec & 1) {
12319                         dirtypg++;
12320                         bitvec >>= 1;
12321                 }
12322                 eaddr = addr + ptob(dirtypg);
12323                 hatlockp = sfmmu_hat_enter(sfmmup);
12324                 sfmmu_unload_tsb_range(sfmmup, addr, eaddr, TTE8K);
12325                 sfmmu_hat_exit(hatlockp);
12326                 pgunload += dirtypg;
12327                 addr = eaddr;
12328                 pgcnt += dirtypg;
12329         }
12330 
12331         ASSERT((pgcnt<<MMU_PAGESHIFT) <= dmrp->dmr_endaddr - dmrp->dmr_addr);
12332         if (sfmmup->sfmmu_free == 0) {
12333                 addr = dmrp->dmr_addr;
12334                 bitvec = dmrp->dmr_bitvec;
12335 
12336                 /*
12337                  * make sure it has SFMMU_PGCNT_SHIFT bits only,
12338                  * as it will be used to pack argument for xt_some
12339                  */
12340                 ASSERT((pgcnt > 0) &&
12341                     (pgcnt <= (1 << SFMMU_PGCNT_SHIFT)));
12342 
12343                 /*
12344                  * Encode pgcnt as (pgcnt -1 ), and pass (pgcnt - 1) in
12345                  * the low 6 bits of sfmmup. This is doable since pgcnt
12346                  * always >= 1.
12347                  */
12348                 ASSERT(!((uint64_t)sfmmup & SFMMU_PGCNT_MASK));
12349                 sfmmu_pgcnt = (uint64_t)sfmmup |
12350                     ((pgcnt - 1) & SFMMU_PGCNT_MASK);
12351 
12352                 /*
12353                  * We must hold the hat lock during the flush of TLB,
12354                  * to avoid a race with sfmmu_invalidate_ctx(), where
12355                  * sfmmu_cnum on a MMU could be set to INVALID_CONTEXT,
12356                  * causing TLB demap routine to skip flush on that MMU.
12357                  * If the context on a MMU has already been set to
12358                  * INVALID_CONTEXT, we just get an extra flush on
12359                  * that MMU.
12360                  */
12361                 hatlockp = sfmmu_hat_enter(sfmmup);
12362                 kpreempt_disable();
12363 
12364                 cpuset = sfmmup->sfmmu_cpusran;
12365                 CPUSET_AND(cpuset, cpu_ready_set);
12366                 CPUSET_DEL(cpuset, CPU->cpu_id);
12367 
12368                 SFMMU_XCALL_STATS(sfmmup);
12369                 xt_some(cpuset, vtag_flush_pgcnt_tl1, (uint64_t)addr,
12370                     sfmmu_pgcnt);
12371 
12372                 for (; bitvec != 0; bitvec >>= 1) {
12373                         if (bitvec & 1)
12374                                 vtag_flushpage(addr, (uint64_t)sfmmup);
12375                         addr += MMU_PAGESIZE;
12376                 }
12377                 kpreempt_enable();
12378                 sfmmu_hat_exit(hatlockp);
12379 
12380                 sfmmu_xcall_save += (pgunload-1);
12381         }
12382         dmrp->dmr_bitvec = 0;
12383 }
12384 
12385 /*
12386  * In cases where we need to synchronize with TLB/TSB miss trap
12387  * handlers, _and_ need to flush the TLB, it's a lot easier to
12388  * throw away the context from the process than to do a
12389  * special song and dance to keep things consistent for the
12390  * handlers.
12391  *
12392  * Since the process suddenly ends up without a context and our caller
12393  * holds the hat lock, threads that fault after this function is called
12394  * will pile up on the lock.  We can then do whatever we need to
12395  * atomically from the context of the caller.  The first blocked thread
12396  * to resume executing will get the process a new context, and the
12397  * process will resume executing.
12398  *
12399  * One added advantage of this approach is that on MMUs that
12400  * support a "flush all" operation, we will delay the flush until
12401  * cnum wrap-around, and then flush the TLB one time.  This
12402  * is rather rare, so it's a lot less expensive than making 8000
12403  * x-calls to flush the TLB 8000 times.
12404  *
12405  * A per-process (PP) lock is used to synchronize ctx allocations in
12406  * resume() and ctx invalidations here.
12407  */
12408 static void
12409 sfmmu_invalidate_ctx(sfmmu_t *sfmmup)
12410 {
12411         cpuset_t cpuset;
12412         int cnum, currcnum;
12413         mmu_ctx_t *mmu_ctxp;
12414         int i;
12415         uint_t pstate_save;
12416 
12417         SFMMU_STAT(sf_ctx_inv);
12418 
12419         ASSERT(sfmmu_hat_lock_held(sfmmup));
12420         ASSERT(sfmmup != ksfmmup);
12421 
12422         kpreempt_disable();
12423 
12424         mmu_ctxp = CPU_MMU_CTXP(CPU);
12425         ASSERT(mmu_ctxp);
12426         ASSERT(mmu_ctxp->mmu_idx < max_mmu_ctxdoms);
12427         ASSERT(mmu_ctxp == mmu_ctxs_tbl[mmu_ctxp->mmu_idx]);
12428 
12429         currcnum = sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum;
12430 
12431         pstate_save = sfmmu_disable_intrs();
12432 
12433         lock_set(&sfmmup->sfmmu_ctx_lock);       /* acquire PP lock */
12434         /* set HAT cnum invalid across all context domains. */
12435         for (i = 0; i < max_mmu_ctxdoms; i++) {
12436 
12437                 cnum = sfmmup->sfmmu_ctxs[i].cnum;
12438                 if (cnum == INVALID_CONTEXT) {
12439                         continue;
12440                 }
12441 
12442                 sfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
12443         }
12444         membar_enter(); /* make sure globally visible to all CPUs */
12445         lock_clear(&sfmmup->sfmmu_ctx_lock);     /* release PP lock */
12446 
12447         sfmmu_enable_intrs(pstate_save);
12448 
12449         cpuset = sfmmup->sfmmu_cpusran;
12450         CPUSET_DEL(cpuset, CPU->cpu_id);
12451         CPUSET_AND(cpuset, cpu_ready_set);
12452         if (!CPUSET_ISNULL(cpuset)) {
12453                 SFMMU_XCALL_STATS(sfmmup);
12454                 xt_some(cpuset, sfmmu_raise_tsb_exception,
12455                     (uint64_t)sfmmup, INVALID_CONTEXT);
12456                 xt_sync(cpuset);
12457                 SFMMU_STAT(sf_tsb_raise_exception);
12458                 SFMMU_MMU_STAT(mmu_tsb_raise_exception);
12459         }
12460 
12461         /*
12462          * If the hat to-be-invalidated is the same as the current
12463          * process on local CPU we need to invalidate
12464          * this CPU context as well.
12465          */
12466         if ((sfmmu_getctx_sec() == currcnum) &&
12467             (currcnum != INVALID_CONTEXT)) {
12468                 /* sets shared context to INVALID too */
12469                 sfmmu_setctx_sec(INVALID_CONTEXT);
12470                 sfmmu_clear_utsbinfo();
12471         }
12472 
12473         SFMMU_FLAGS_SET(sfmmup, HAT_ALLCTX_INVALID);
12474 
12475         kpreempt_enable();
12476 
12477         /*
12478          * we hold the hat lock, so nobody should allocate a context
12479          * for us yet
12480          */
12481         ASSERT(sfmmup->sfmmu_ctxs[mmu_ctxp->mmu_idx].cnum == INVALID_CONTEXT);
12482 }
12483 
12484 #ifdef VAC
12485 /*
12486  * We need to flush the cache in all cpus.  It is possible that
12487  * a process referenced a page as cacheable but has sinced exited
12488  * and cleared the mapping list.  We still to flush it but have no
12489  * state so all cpus is the only alternative.
12490  */
12491 void
12492 sfmmu_cache_flush(pfn_t pfnum, int vcolor)
12493 {
12494         cpuset_t cpuset;
12495 
12496         kpreempt_disable();
12497         cpuset = cpu_ready_set;
12498         CPUSET_DEL(cpuset, CPU->cpu_id);
12499         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12500         xt_some(cpuset, vac_flushpage_tl1, pfnum, vcolor);
12501         xt_sync(cpuset);
12502         vac_flushpage(pfnum, vcolor);
12503         kpreempt_enable();
12504 }
12505 
12506 void
12507 sfmmu_cache_flushcolor(int vcolor, pfn_t pfnum)
12508 {
12509         cpuset_t cpuset;
12510 
12511         ASSERT(vcolor >= 0);
12512 
12513         kpreempt_disable();
12514         cpuset = cpu_ready_set;
12515         CPUSET_DEL(cpuset, CPU->cpu_id);
12516         SFMMU_XCALL_STATS(NULL);        /* account to any ctx */
12517         xt_some(cpuset, vac_flushcolor_tl1, vcolor, pfnum);
12518         xt_sync(cpuset);
12519         vac_flushcolor(vcolor, pfnum);
12520         kpreempt_enable();
12521 }
12522 #endif  /* VAC */
12523 
12524 /*
12525  * We need to prevent processes from accessing the TSB using a cached physical
12526  * address.  It's alright if they try to access the TSB via virtual address
12527  * since they will just fault on that virtual address once the mapping has
12528  * been suspended.
12529  */
12530 #pragma weak sendmondo_in_recover
12531 
12532 /* ARGSUSED */
12533 static int
12534 sfmmu_tsb_pre_relocator(caddr_t va, uint_t tsbsz, uint_t flags, void *tsbinfo)
12535 {
12536         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12537         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12538         hatlock_t *hatlockp;
12539         sf_scd_t *scdp;
12540 
12541         if (flags != HAT_PRESUSPEND)
12542                 return (0);
12543 
12544         /*
12545          * If tsb is a shared TSB with TSB_SHAREDCTX set, sfmmup must
12546          * be a shared hat, then set SCD's tsbinfo's flag.
12547          * If tsb is not shared, sfmmup is a private hat, then set
12548          * its private tsbinfo's flag.
12549          */
12550         hatlockp = sfmmu_hat_enter(sfmmup);
12551         tsbinfop->tsb_flags |= TSB_RELOC_FLAG;
12552 
12553         if (!(tsbinfop->tsb_flags & TSB_SHAREDCTX)) {
12554                 sfmmu_tsb_inv_ctx(sfmmup);
12555                 sfmmu_hat_exit(hatlockp);
12556         } else {
12557                 /* release lock on the shared hat */
12558                 sfmmu_hat_exit(hatlockp);
12559                 /* sfmmup is a shared hat */
12560                 ASSERT(sfmmup->sfmmu_scdhat);
12561                 scdp = sfmmup->sfmmu_scdp;
12562                 ASSERT(scdp != NULL);
12563                 /* get private hat from the scd list */
12564                 mutex_enter(&scdp->scd_mutex);
12565                 sfmmup = scdp->scd_sf_list;
12566                 while (sfmmup != NULL) {
12567                         hatlockp = sfmmu_hat_enter(sfmmup);
12568                         /*
12569                          * We do not call sfmmu_tsb_inv_ctx here because
12570                          * sendmondo_in_recover check is only needed for
12571                          * sun4u.
12572                          */
12573                         sfmmu_invalidate_ctx(sfmmup);
12574                         sfmmu_hat_exit(hatlockp);
12575                         sfmmup = sfmmup->sfmmu_scd_link.next;
12576 
12577                 }
12578                 mutex_exit(&scdp->scd_mutex);
12579         }
12580         return (0);
12581 }
12582 
12583 static void
12584 sfmmu_tsb_inv_ctx(sfmmu_t *sfmmup)
12585 {
12586         extern uint32_t sendmondo_in_recover;
12587 
12588         ASSERT(sfmmu_hat_lock_held(sfmmup));
12589 
12590         /*
12591          * For Cheetah+ Erratum 25:
12592          * Wait for any active recovery to finish.  We can't risk
12593          * relocating the TSB of the thread running mondo_recover_proc()
12594          * since, if we did that, we would deadlock.  The scenario we are
12595          * trying to avoid is as follows:
12596          *
12597          * THIS CPU                     RECOVER CPU
12598          * --------                     -----------
12599          *                              Begins recovery, walking through TSB
12600          * hat_pagesuspend() TSB TTE
12601          *                              TLB miss on TSB TTE, spins at TL1
12602          * xt_sync()
12603          *      send_mondo_timeout()
12604          *      mondo_recover_proc()
12605          *      ((deadlocked))
12606          *
12607          * The second half of the workaround is that mondo_recover_proc()
12608          * checks to see if the tsb_info has the RELOC flag set, and if it
12609          * does, it skips over that TSB without ever touching tsbinfop->tsb_va
12610          * and hence avoiding the TLB miss that could result in a deadlock.
12611          */
12612         if (&sendmondo_in_recover) {
12613                 membar_enter(); /* make sure RELOC flag visible */
12614                 while (sendmondo_in_recover) {
12615                         drv_usecwait(1);
12616                         membar_consumer();
12617                 }
12618         }
12619 
12620         sfmmu_invalidate_ctx(sfmmup);
12621 }
12622 
12623 /* ARGSUSED */
12624 static int
12625 sfmmu_tsb_post_relocator(caddr_t va, uint_t tsbsz, uint_t flags,
12626     void *tsbinfo, pfn_t newpfn)
12627 {
12628         hatlock_t *hatlockp;
12629         struct tsb_info *tsbinfop = (struct tsb_info *)tsbinfo;
12630         sfmmu_t *sfmmup = tsbinfop->tsb_sfmmu;
12631 
12632         if (flags != HAT_POSTUNSUSPEND)
12633                 return (0);
12634 
12635         hatlockp = sfmmu_hat_enter(sfmmup);
12636 
12637         SFMMU_STAT(sf_tsb_reloc);
12638 
12639         /*
12640          * The process may have swapped out while we were relocating one
12641          * of its TSBs.  If so, don't bother doing the setup since the
12642          * process can't be using the memory anymore.
12643          */
12644         if ((tsbinfop->tsb_flags & TSB_SWAPPED) == 0) {
12645                 ASSERT(va == tsbinfop->tsb_va);
12646                 sfmmu_tsbinfo_setup_phys(tsbinfop, newpfn);
12647 
12648                 if (tsbinfop->tsb_flags & TSB_FLUSH_NEEDED) {
12649                         sfmmu_inv_tsb(tsbinfop->tsb_va,
12650                             TSB_BYTES(tsbinfop->tsb_szc));
12651                         tsbinfop->tsb_flags &= ~TSB_FLUSH_NEEDED;
12652                 }
12653         }
12654 
12655         membar_exit();
12656         tsbinfop->tsb_flags &= ~TSB_RELOC_FLAG;
12657         cv_broadcast(&sfmmup->sfmmu_tsb_cv);
12658 
12659         sfmmu_hat_exit(hatlockp);
12660 
12661         return (0);
12662 }
12663 
12664 /*
12665  * Allocate and initialize a tsb_info structure.  Note that we may or may not
12666  * allocate a TSB here, depending on the flags passed in.
12667  */
12668 static int
12669 sfmmu_tsbinfo_alloc(struct tsb_info **tsbinfopp, int tsb_szc, int tte_sz_mask,
12670     uint_t flags, sfmmu_t *sfmmup)
12671 {
12672         int err;
12673 
12674         *tsbinfopp = (struct tsb_info *)kmem_cache_alloc(
12675             sfmmu_tsbinfo_cache, KM_SLEEP);
12676 
12677         if ((err = sfmmu_init_tsbinfo(*tsbinfopp, tte_sz_mask,
12678             tsb_szc, flags, sfmmup)) != 0) {
12679                 kmem_cache_free(sfmmu_tsbinfo_cache, *tsbinfopp);
12680                 SFMMU_STAT(sf_tsb_allocfail);
12681                 *tsbinfopp = NULL;
12682                 return (err);
12683         }
12684         SFMMU_STAT(sf_tsb_alloc);
12685 
12686         /*
12687          * Bump the TSB size counters for this TSB size.
12688          */
12689         (*(((int *)&sfmmu_tsbsize_stat) + tsb_szc))++;
12690         return (0);
12691 }
12692 
12693 static void
12694 sfmmu_tsb_free(struct tsb_info *tsbinfo)
12695 {
12696         caddr_t tsbva = tsbinfo->tsb_va;
12697         uint_t tsb_size = TSB_BYTES(tsbinfo->tsb_szc);
12698         struct kmem_cache *kmem_cachep = tsbinfo->tsb_cache;
12699         vmem_t  *vmp = tsbinfo->tsb_vmp;
12700 
12701         /*
12702          * If we allocated this TSB from relocatable kernel memory, then we
12703          * need to uninstall the callback handler.
12704          */
12705         if (tsbinfo->tsb_cache != sfmmu_tsb8k_cache) {
12706                 uintptr_t slab_mask;
12707                 caddr_t slab_vaddr;
12708                 page_t **ppl;
12709                 int ret;
12710 
12711                 ASSERT(tsb_size <= MMU_PAGESIZE4M || use_bigtsb_arena);
12712                 if (tsb_size > MMU_PAGESIZE4M)
12713                         slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12714                 else
12715                         slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12716                 slab_vaddr = (caddr_t)((uintptr_t)tsbva & slab_mask);
12717 
12718                 ret = as_pagelock(&kas, &ppl, slab_vaddr, PAGESIZE, S_WRITE);
12719                 ASSERT(ret == 0);
12720                 hat_delete_callback(tsbva, (uint_t)tsb_size, (void *)tsbinfo,
12721                     0, NULL);
12722                 as_pageunlock(&kas, ppl, slab_vaddr, PAGESIZE, S_WRITE);
12723         }
12724 
12725         if (kmem_cachep != NULL) {
12726                 kmem_cache_free(kmem_cachep, tsbva);
12727         } else {
12728                 vmem_xfree(vmp, (void *)tsbva, tsb_size);
12729         }
12730         tsbinfo->tsb_va = (caddr_t)0xbad00bad;
12731         atomic_add_64(&tsb_alloc_bytes, -(int64_t)tsb_size);
12732 }
12733 
12734 static void
12735 sfmmu_tsbinfo_free(struct tsb_info *tsbinfo)
12736 {
12737         if ((tsbinfo->tsb_flags & TSB_SWAPPED) == 0) {
12738                 sfmmu_tsb_free(tsbinfo);
12739         }
12740         kmem_cache_free(sfmmu_tsbinfo_cache, tsbinfo);
12741 
12742 }
12743 
12744 /*
12745  * Setup all the references to physical memory for this tsbinfo.
12746  * The underlying page(s) must be locked.
12747  */
12748 static void
12749 sfmmu_tsbinfo_setup_phys(struct tsb_info *tsbinfo, pfn_t pfn)
12750 {
12751         ASSERT(pfn != PFN_INVALID);
12752         ASSERT(pfn == va_to_pfn(tsbinfo->tsb_va));
12753 
12754 #ifndef sun4v
12755         if (tsbinfo->tsb_szc == 0) {
12756                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn,
12757                     PROT_WRITE|PROT_READ, TTE8K);
12758         } else {
12759                 /*
12760                  * Round down PA and use a large mapping; the handlers will
12761                  * compute the TSB pointer at the correct offset into the
12762                  * big virtual page.  NOTE: this assumes all TSBs larger
12763                  * than 8K must come from physically contiguous slabs of
12764                  * size tsb_slab_size.
12765                  */
12766                 sfmmu_memtte(&tsbinfo->tsb_tte, pfn & ~tsb_slab_mask,
12767                     PROT_WRITE|PROT_READ, tsb_slab_ttesz);
12768         }
12769         tsbinfo->tsb_pa = ptob(pfn);
12770 
12771         TTE_SET_LOCKED(&tsbinfo->tsb_tte); /* lock the tte into dtlb */
12772         TTE_SET_MOD(&tsbinfo->tsb_tte);    /* enable writes */
12773 
12774         ASSERT(TTE_IS_PRIVILEGED(&tsbinfo->tsb_tte));
12775         ASSERT(TTE_IS_LOCKED(&tsbinfo->tsb_tte));
12776 #else /* sun4v */
12777         tsbinfo->tsb_pa = ptob(pfn);
12778 #endif /* sun4v */
12779 }
12780 
12781 
12782 /*
12783  * Returns zero on success, ENOMEM if over the high water mark,
12784  * or EAGAIN if the caller needs to retry with a smaller TSB
12785  * size (or specify TSB_FORCEALLOC if the allocation can't fail).
12786  *
12787  * This call cannot fail to allocate a TSB if TSB_FORCEALLOC
12788  * is specified and the TSB requested is PAGESIZE, though it
12789  * may sleep waiting for memory if sufficient memory is not
12790  * available.
12791  */
12792 static int
12793 sfmmu_init_tsbinfo(struct tsb_info *tsbinfo, int tteszmask,
12794     int tsbcode, uint_t flags, sfmmu_t *sfmmup)
12795 {
12796         caddr_t vaddr = NULL;
12797         caddr_t slab_vaddr;
12798         uintptr_t slab_mask;
12799         int tsbbytes = TSB_BYTES(tsbcode);
12800         int lowmem = 0;
12801         struct kmem_cache *kmem_cachep = NULL;
12802         vmem_t *vmp = NULL;
12803         lgrp_id_t lgrpid = LGRP_NONE;
12804         pfn_t pfn;
12805         uint_t cbflags = HAC_SLEEP;
12806         page_t **pplist;
12807         int ret;
12808 
12809         ASSERT(tsbbytes <= MMU_PAGESIZE4M || use_bigtsb_arena);
12810         if (tsbbytes > MMU_PAGESIZE4M)
12811                 slab_mask = ~((uintptr_t)bigtsb_slab_mask) << PAGESHIFT;
12812         else
12813                 slab_mask = ~((uintptr_t)tsb_slab_mask) << PAGESHIFT;
12814 
12815         if (flags & (TSB_FORCEALLOC | TSB_SWAPIN | TSB_GROW | TSB_SHRINK))
12816                 flags |= TSB_ALLOC;
12817 
12818         ASSERT((flags & TSB_FORCEALLOC) == 0 || tsbcode == TSB_MIN_SZCODE);
12819 
12820         tsbinfo->tsb_sfmmu = sfmmup;
12821 
12822         /*
12823          * If not allocating a TSB, set up the tsbinfo, set TSB_SWAPPED, and
12824          * return.
12825          */
12826         if ((flags & TSB_ALLOC) == 0) {
12827                 tsbinfo->tsb_szc = tsbcode;
12828                 tsbinfo->tsb_ttesz_mask = tteszmask;
12829                 tsbinfo->tsb_va = (caddr_t)0xbadbadbeef;
12830                 tsbinfo->tsb_pa = -1;
12831                 tsbinfo->tsb_tte.ll = 0;
12832                 tsbinfo->tsb_next = NULL;
12833                 tsbinfo->tsb_flags = TSB_SWAPPED;
12834                 tsbinfo->tsb_cache = NULL;
12835                 tsbinfo->tsb_vmp = NULL;
12836                 return (0);
12837         }
12838 
12839 #ifdef DEBUG
12840         /*
12841          * For debugging:
12842          * Randomly force allocation failures every tsb_alloc_mtbf
12843          * tries if TSB_FORCEALLOC is not specified.  This will
12844          * return ENOMEM if tsb_alloc_mtbf is odd, or EAGAIN if
12845          * it is even, to allow testing of both failure paths...
12846          */
12847         if (tsb_alloc_mtbf && ((flags & TSB_FORCEALLOC) == 0) &&
12848             (tsb_alloc_count++ == tsb_alloc_mtbf)) {
12849                 tsb_alloc_count = 0;
12850                 tsb_alloc_fail_mtbf++;
12851                 return ((tsb_alloc_mtbf & 1)? ENOMEM : EAGAIN);
12852         }
12853 #endif  /* DEBUG */
12854 
12855         /*
12856          * Enforce high water mark if we are not doing a forced allocation
12857          * and are not shrinking a process' TSB.
12858          */
12859         if ((flags & TSB_SHRINK) == 0 &&
12860             (tsbbytes + tsb_alloc_bytes) > tsb_alloc_hiwater) {
12861                 if ((flags & TSB_FORCEALLOC) == 0)
12862                         return (ENOMEM);
12863                 lowmem = 1;
12864         }
12865 
12866         /*
12867          * Allocate from the correct location based upon the size of the TSB
12868          * compared to the base page size, and what memory conditions dictate.
12869          * Note we always do nonblocking allocations from the TSB arena since
12870          * we don't want memory fragmentation to cause processes to block
12871          * indefinitely waiting for memory; until the kernel algorithms that
12872          * coalesce large pages are improved this is our best option.
12873          *
12874          * Algorithm:
12875          *      If allocating a "large" TSB (>8K), allocate from the
12876          *              appropriate kmem_tsb_default_arena vmem arena
12877          *      else if low on memory or the TSB_FORCEALLOC flag is set or
12878          *      tsb_forceheap is set
12879          *              Allocate from kernel heap via sfmmu_tsb8k_cache with
12880          *              KM_SLEEP (never fails)
12881          *      else
12882          *              Allocate from appropriate sfmmu_tsb_cache with
12883          *              KM_NOSLEEP
12884          *      endif
12885          */
12886         if (tsb_lgrp_affinity)
12887                 lgrpid = lgrp_home_id(curthread);
12888         if (lgrpid == LGRP_NONE)
12889                 lgrpid = 0;     /* use lgrp of boot CPU */
12890 
12891         if (tsbbytes > MMU_PAGESIZE) {
12892                 if (tsbbytes > MMU_PAGESIZE4M) {
12893                         vmp = kmem_bigtsb_default_arena[lgrpid];
12894                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12895                             0, 0, NULL, NULL, VM_NOSLEEP);
12896                 } else {
12897                         vmp = kmem_tsb_default_arena[lgrpid];
12898                         vaddr = (caddr_t)vmem_xalloc(vmp, tsbbytes, tsbbytes,
12899                             0, 0, NULL, NULL, VM_NOSLEEP);
12900                 }
12901 #ifdef  DEBUG
12902         } else if (lowmem || (flags & TSB_FORCEALLOC) || tsb_forceheap) {
12903 #else   /* !DEBUG */
12904         } else if (lowmem || (flags & TSB_FORCEALLOC)) {
12905 #endif  /* DEBUG */
12906                 kmem_cachep = sfmmu_tsb8k_cache;
12907                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_SLEEP);
12908                 ASSERT(vaddr != NULL);
12909         } else {
12910                 kmem_cachep = sfmmu_tsb_cache[lgrpid];
12911                 vaddr = (caddr_t)kmem_cache_alloc(kmem_cachep, KM_NOSLEEP);
12912         }
12913 
12914         tsbinfo->tsb_cache = kmem_cachep;
12915         tsbinfo->tsb_vmp = vmp;
12916 
12917         if (vaddr == NULL) {
12918                 return (EAGAIN);
12919         }
12920 
12921         atomic_add_64(&tsb_alloc_bytes, (int64_t)tsbbytes);
12922         kmem_cachep = tsbinfo->tsb_cache;
12923 
12924         /*
12925          * If we are allocating from outside the cage, then we need to
12926          * register a relocation callback handler.  Note that for now
12927          * since pseudo mappings always hang off of the slab's root page,
12928          * we need only lock the first 8K of the TSB slab.  This is a bit
12929          * hacky but it is good for performance.
12930          */
12931         if (kmem_cachep != sfmmu_tsb8k_cache) {
12932                 slab_vaddr = (caddr_t)((uintptr_t)vaddr & slab_mask);
12933                 ret = as_pagelock(&kas, &pplist, slab_vaddr, PAGESIZE, S_WRITE);
12934                 ASSERT(ret == 0);
12935                 ret = hat_add_callback(sfmmu_tsb_cb_id, vaddr, (uint_t)tsbbytes,
12936                     cbflags, (void *)tsbinfo, &pfn, NULL);
12937 
12938                 /*
12939                  * Need to free up resources if we could not successfully
12940                  * add the callback function and return an error condition.
12941                  */
12942                 if (ret != 0) {
12943                         if (kmem_cachep) {
12944                                 kmem_cache_free(kmem_cachep, vaddr);
12945                         } else {
12946                                 vmem_xfree(vmp, (void *)vaddr, tsbbytes);
12947                         }
12948                         as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE,
12949                             S_WRITE);
12950                         return (EAGAIN);
12951                 }
12952         } else {
12953                 /*
12954                  * Since allocation of 8K TSBs from heap is rare and occurs
12955                  * during memory pressure we allocate them from permanent
12956                  * memory rather than using callbacks to get the PFN.
12957                  */
12958                 pfn = hat_getpfnum(kas.a_hat, vaddr);
12959         }
12960 
12961         tsbinfo->tsb_va = vaddr;
12962         tsbinfo->tsb_szc = tsbcode;
12963         tsbinfo->tsb_ttesz_mask = tteszmask;
12964         tsbinfo->tsb_next = NULL;
12965         tsbinfo->tsb_flags = 0;
12966 
12967         sfmmu_tsbinfo_setup_phys(tsbinfo, pfn);
12968 
12969         sfmmu_inv_tsb(vaddr, tsbbytes);
12970 
12971         if (kmem_cachep != sfmmu_tsb8k_cache) {
12972                 as_pageunlock(&kas, pplist, slab_vaddr, PAGESIZE, S_WRITE);
12973         }
12974 
12975         return (0);
12976 }
12977 
12978 /*
12979  * Initialize per cpu tsb and per cpu tsbmiss_area
12980  */
12981 void
12982 sfmmu_init_tsbs(void)
12983 {
12984         int i;
12985         struct tsbmiss  *tsbmissp;
12986         struct kpmtsbm  *kpmtsbmp;
12987 #ifndef sun4v
12988         extern int      dcache_line_mask;
12989 #endif /* sun4v */
12990         extern uint_t   vac_colors;
12991 
12992         /*
12993          * Init. tsb miss area.
12994          */
12995         tsbmissp = tsbmiss_area;
12996 
12997         for (i = 0; i < NCPU; tsbmissp++, i++) {
12998                 /*
12999                  * initialize the tsbmiss area.
13000                  * Do this for all possible CPUs as some may be added
13001                  * while the system is running. There is no cost to this.
13002                  */
13003                 tsbmissp->ksfmmup = ksfmmup;
13004 #ifndef sun4v
13005                 tsbmissp->dcache_line_mask = (uint16_t)dcache_line_mask;
13006 #endif /* sun4v */
13007                 tsbmissp->khashstart =
13008                     (struct hmehash_bucket *)va_to_pa((caddr_t)khme_hash);
13009                 tsbmissp->uhashstart =
13010                     (struct hmehash_bucket *)va_to_pa((caddr_t)uhme_hash);
13011                 tsbmissp->khashsz = khmehash_num;
13012                 tsbmissp->uhashsz = uhmehash_num;
13013         }
13014 
13015         sfmmu_tsb_cb_id = hat_register_callback('T'<<16 | 'S' << 8 | 'B',
13016             sfmmu_tsb_pre_relocator, sfmmu_tsb_post_relocator, NULL, 0);
13017 
13018         if (kpm_enable == 0)
13019                 return;
13020 
13021         /* -- Begin KPM specific init -- */
13022 
13023         if (kpm_smallpages) {
13024                 /*
13025                  * If we're using base pagesize pages for seg_kpm
13026                  * mappings, we use the kernel TSB since we can't afford
13027                  * to allocate a second huge TSB for these mappings.
13028                  */
13029                 kpm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13030                 kpm_tsbsz = ktsb_szcode;
13031                 kpmsm_tsbbase = kpm_tsbbase;
13032                 kpmsm_tsbsz = kpm_tsbsz;
13033         } else {
13034                 /*
13035                  * In VAC conflict case, just put the entries in the
13036                  * kernel 8K indexed TSB for now so we can find them.
13037                  * This could really be changed in the future if we feel
13038                  * the need...
13039                  */
13040                 kpmsm_tsbbase = ktsb_phys? ktsb_pbase : (uint64_t)ktsb_base;
13041                 kpmsm_tsbsz = ktsb_szcode;
13042                 kpm_tsbbase = ktsb_phys? ktsb4m_pbase : (uint64_t)ktsb4m_base;
13043                 kpm_tsbsz = ktsb4m_szcode;
13044         }
13045 
13046         kpmtsbmp = kpmtsbm_area;
13047         for (i = 0; i < NCPU; kpmtsbmp++, i++) {
13048                 /*
13049                  * Initialize the kpmtsbm area.
13050                  * Do this for all possible CPUs as some may be added
13051                  * while the system is running. There is no cost to this.
13052                  */
13053                 kpmtsbmp->vbase = kpm_vbase;
13054                 kpmtsbmp->vend = kpm_vbase + kpm_size * vac_colors;
13055                 kpmtsbmp->sz_shift = kpm_size_shift;
13056                 kpmtsbmp->kpmp_shift = kpmp_shift;
13057                 kpmtsbmp->kpmp2pshft = (uchar_t)kpmp2pshft;
13058                 if (kpm_smallpages == 0) {
13059                         kpmtsbmp->kpmp_table_sz = kpmp_table_sz;
13060                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_table);
13061                 } else {
13062                         kpmtsbmp->kpmp_table_sz = kpmp_stable_sz;
13063                         kpmtsbmp->kpmp_tablepa = va_to_pa(kpmp_stable);
13064                 }
13065                 kpmtsbmp->msegphashpa = va_to_pa(memseg_phash);
13066                 kpmtsbmp->flags = KPMTSBM_ENABLE_FLAG;
13067 #ifdef  DEBUG
13068                 kpmtsbmp->flags |= (kpm_tsbmtl) ?  KPMTSBM_TLTSBM_FLAG : 0;
13069 #endif  /* DEBUG */
13070                 if (ktsb_phys)
13071                         kpmtsbmp->flags |= KPMTSBM_TSBPHYS_FLAG;
13072         }
13073 
13074         /* -- End KPM specific init -- */
13075 }
13076 
13077 /* Avoid using sfmmu_tsbinfo_alloc() to avoid kmem_alloc - no real reason */
13078 struct tsb_info ktsb_info[2];
13079 
13080 /*
13081  * Called from hat_kern_setup() to setup the tsb_info for ksfmmup.
13082  */
13083 void
13084 sfmmu_init_ktsbinfo()
13085 {
13086         ASSERT(ksfmmup != NULL);
13087         ASSERT(ksfmmup->sfmmu_tsb == NULL);
13088         /*
13089          * Allocate tsbinfos for kernel and copy in data
13090          * to make debug easier and sun4v setup easier.
13091          */
13092         ktsb_info[0].tsb_sfmmu = ksfmmup;
13093         ktsb_info[0].tsb_szc = ktsb_szcode;
13094         ktsb_info[0].tsb_ttesz_mask = TSB8K|TSB64K|TSB512K;
13095         ktsb_info[0].tsb_va = ktsb_base;
13096         ktsb_info[0].tsb_pa = ktsb_pbase;
13097         ktsb_info[0].tsb_flags = 0;
13098         ktsb_info[0].tsb_tte.ll = 0;
13099         ktsb_info[0].tsb_cache = NULL;
13100 
13101         ktsb_info[1].tsb_sfmmu = ksfmmup;
13102         ktsb_info[1].tsb_szc = ktsb4m_szcode;
13103         ktsb_info[1].tsb_ttesz_mask = TSB4M;
13104         ktsb_info[1].tsb_va = ktsb4m_base;
13105         ktsb_info[1].tsb_pa = ktsb4m_pbase;
13106         ktsb_info[1].tsb_flags = 0;
13107         ktsb_info[1].tsb_tte.ll = 0;
13108         ktsb_info[1].tsb_cache = NULL;
13109 
13110         /* Link them into ksfmmup. */
13111         ktsb_info[0].tsb_next = &ktsb_info[1];
13112         ktsb_info[1].tsb_next = NULL;
13113         ksfmmup->sfmmu_tsb = &ktsb_info[0];
13114 
13115         sfmmu_setup_tsbinfo(ksfmmup);
13116 }
13117 
13118 /*
13119  * Cache the last value returned from va_to_pa().  If the VA specified
13120  * in the current call to cached_va_to_pa() maps to the same Page (as the
13121  * previous call to cached_va_to_pa()), then compute the PA using
13122  * cached info, else call va_to_pa().
13123  *
13124  * Note: this function is neither MT-safe nor consistent in the presence
13125  * of multiple, interleaved threads.  This function was created to enable
13126  * an optimization used during boot (at a point when there's only one thread
13127  * executing on the "boot CPU", and before startup_vm() has been called).
13128  */
13129 static uint64_t
13130 cached_va_to_pa(void *vaddr)
13131 {
13132         static uint64_t prev_vaddr_base = 0;
13133         static uint64_t prev_pfn = 0;
13134 
13135         if ((((uint64_t)vaddr) & MMU_PAGEMASK) == prev_vaddr_base) {
13136                 return (prev_pfn | ((uint64_t)vaddr & MMU_PAGEOFFSET));
13137         } else {
13138                 uint64_t pa = va_to_pa(vaddr);
13139 
13140                 if (pa != ((uint64_t)-1)) {
13141                         /*
13142                          * Computed physical address is valid.  Cache its
13143                          * related info for the next cached_va_to_pa() call.
13144                          */
13145                         prev_pfn = pa & MMU_PAGEMASK;
13146                         prev_vaddr_base = ((uint64_t)vaddr) & MMU_PAGEMASK;
13147                 }
13148 
13149                 return (pa);
13150         }
13151 }
13152 
13153 /*
13154  * Carve up our nucleus hblk region.  We may allocate more hblks than
13155  * asked due to rounding errors but we are guaranteed to have at least
13156  * enough space to allocate the requested number of hblk8's and hblk1's.
13157  */
13158 void
13159 sfmmu_init_nucleus_hblks(caddr_t addr, size_t size, int nhblk8, int nhblk1)
13160 {
13161         struct hme_blk *hmeblkp;
13162         size_t hme8blk_sz, hme1blk_sz;
13163         size_t i;
13164         size_t hblk8_bound;
13165         ulong_t j = 0, k = 0;
13166 
13167         ASSERT(addr != NULL && size != 0);
13168 
13169         /* Need to use proper structure alignment */
13170         hme8blk_sz = roundup(HME8BLK_SZ, sizeof (int64_t));
13171         hme1blk_sz = roundup(HME1BLK_SZ, sizeof (int64_t));
13172 
13173         nucleus_hblk8.list = (void *)addr;
13174         nucleus_hblk8.index = 0;
13175 
13176         /*
13177          * Use as much memory as possible for hblk8's since we
13178          * expect all bop_alloc'ed memory to be allocated in 8k chunks.
13179          * We need to hold back enough space for the hblk1's which
13180          * we'll allocate next.
13181          */
13182         hblk8_bound = size - (nhblk1 * hme1blk_sz) - hme8blk_sz;
13183         for (i = 0; i <= hblk8_bound; i += hme8blk_sz, j++) {
13184                 hmeblkp = (struct hme_blk *)addr;
13185                 addr += hme8blk_sz;
13186                 hmeblkp->hblk_nuc_bit = 1;
13187                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13188         }
13189         nucleus_hblk8.len = j;
13190         ASSERT(j >= nhblk8);
13191         SFMMU_STAT_ADD(sf_hblk8_ncreate, j);
13192 
13193         nucleus_hblk1.list = (void *)addr;
13194         nucleus_hblk1.index = 0;
13195         for (; i <= (size - hme1blk_sz); i += hme1blk_sz, k++) {
13196                 hmeblkp = (struct hme_blk *)addr;
13197                 addr += hme1blk_sz;
13198                 hmeblkp->hblk_nuc_bit = 1;
13199                 hmeblkp->hblk_nextpa = cached_va_to_pa((caddr_t)hmeblkp);
13200         }
13201         ASSERT(k >= nhblk1);
13202         nucleus_hblk1.len = k;
13203         SFMMU_STAT_ADD(sf_hblk1_ncreate, k);
13204 }
13205 
13206 /*
13207  * This function is currently not supported on this platform. For what
13208  * it's supposed to do, see hat.c and hat_srmmu.c
13209  */
13210 /* ARGSUSED */
13211 faultcode_t
13212 hat_softlock(struct hat *hat, caddr_t addr, size_t *lenp, page_t **ppp,
13213     uint_t flags)
13214 {
13215         return (FC_NOSUPPORT);
13216 }
13217 
13218 /*
13219  * Searchs the mapping list of the page for a mapping of the same size. If not
13220  * found the corresponding bit is cleared in the p_index field. When large
13221  * pages are more prevalent in the system, we can maintain the mapping list
13222  * in order and we don't have to traverse the list each time. Just check the
13223  * next and prev entries, and if both are of different size, we clear the bit.
13224  */
13225 static void
13226 sfmmu_rm_large_mappings(page_t *pp, int ttesz)
13227 {
13228         struct sf_hment *sfhmep;
13229         int     index;
13230         pgcnt_t npgs;
13231 
13232         ASSERT(ttesz > TTE8K);
13233 
13234         ASSERT(sfmmu_mlist_held(pp));
13235 
13236         ASSERT(PP_ISMAPPED_LARGE(pp));
13237 
13238         /*
13239          * Traverse mapping list looking for another mapping of same size.
13240          * since we only want to clear index field if all mappings of
13241          * that size are gone.
13242          */
13243 
13244         for (sfhmep = pp->p_mapping; sfhmep; sfhmep = sfhmep->hme_next) {
13245                 if (IS_PAHME(sfhmep))
13246                         continue;
13247                 if (hme_size(sfhmep) == ttesz) {
13248                         /*
13249                          * another mapping of the same size. don't clear index.
13250                          */
13251                         return;
13252                 }
13253         }
13254 
13255         /*
13256          * Clear the p_index bit for large page.
13257          */
13258         index = PAGESZ_TO_INDEX(ttesz);
13259         npgs = TTEPAGES(ttesz);
13260         while (npgs-- > 0) {
13261                 ASSERT(pp->p_index & index);
13262                 pp->p_index &= ~index;
13263                 pp = PP_PAGENEXT(pp);
13264         }
13265 }
13266 
13267 /*
13268  * return supported features
13269  */
13270 /* ARGSUSED */
13271 int
13272 hat_supported(enum hat_features feature, void *arg)
13273 {
13274         switch (feature) {
13275         case    HAT_SHARED_PT:
13276         case    HAT_DYNAMIC_ISM_UNMAP:
13277         case    HAT_VMODSORT:
13278                 return (1);
13279         case    HAT_SHARED_REGIONS:
13280                 if (shctx_on)
13281                         return (1);
13282                 else
13283                         return (0);
13284         default:
13285                 return (0);
13286         }
13287 }
13288 
13289 void
13290 hat_enter(struct hat *hat)
13291 {
13292         hatlock_t       *hatlockp;
13293 
13294         if (hat != ksfmmup) {
13295                 hatlockp = TSB_HASH(hat);
13296                 mutex_enter(HATLOCK_MUTEXP(hatlockp));
13297         }
13298 }
13299 
13300 void
13301 hat_exit(struct hat *hat)
13302 {
13303         hatlock_t       *hatlockp;
13304 
13305         if (hat != ksfmmup) {
13306                 hatlockp = TSB_HASH(hat);
13307                 mutex_exit(HATLOCK_MUTEXP(hatlockp));
13308         }
13309 }
13310 
13311 /*ARGSUSED*/
13312 void
13313 hat_reserve(struct as *as, caddr_t addr, size_t len)
13314 {
13315 }
13316 
13317 static void
13318 hat_kstat_init(void)
13319 {
13320         kstat_t *ksp;
13321 
13322         ksp = kstat_create("unix", 0, "sfmmu_global_stat", "hat",
13323             KSTAT_TYPE_RAW, sizeof (struct sfmmu_global_stat),
13324             KSTAT_FLAG_VIRTUAL);
13325         if (ksp) {
13326                 ksp->ks_data = (void *) &sfmmu_global_stat;
13327                 kstat_install(ksp);
13328         }
13329         ksp = kstat_create("unix", 0, "sfmmu_tsbsize_stat", "hat",
13330             KSTAT_TYPE_RAW, sizeof (struct sfmmu_tsbsize_stat),
13331             KSTAT_FLAG_VIRTUAL);
13332         if (ksp) {
13333                 ksp->ks_data = (void *) &sfmmu_tsbsize_stat;
13334                 kstat_install(ksp);
13335         }
13336         ksp = kstat_create("unix", 0, "sfmmu_percpu_stat", "hat",
13337             KSTAT_TYPE_RAW, sizeof (struct sfmmu_percpu_stat) * NCPU,
13338             KSTAT_FLAG_WRITABLE);
13339         if (ksp) {
13340                 ksp->ks_update = sfmmu_kstat_percpu_update;
13341                 kstat_install(ksp);
13342         }
13343 }
13344 
13345 /* ARGSUSED */
13346 static int
13347 sfmmu_kstat_percpu_update(kstat_t *ksp, int rw)
13348 {
13349         struct sfmmu_percpu_stat *cpu_kstat = ksp->ks_data;
13350         struct tsbmiss *tsbm = tsbmiss_area;
13351         struct kpmtsbm *kpmtsbm = kpmtsbm_area;
13352         int i;
13353 
13354         ASSERT(cpu_kstat);
13355         if (rw == KSTAT_READ) {
13356                 for (i = 0; i < NCPU; cpu_kstat++, tsbm++, kpmtsbm++, i++) {
13357                         cpu_kstat->sf_itlb_misses = 0;
13358                         cpu_kstat->sf_dtlb_misses = 0;
13359                         cpu_kstat->sf_utsb_misses = tsbm->utsb_misses -
13360                             tsbm->uprot_traps;
13361                         cpu_kstat->sf_ktsb_misses = tsbm->ktsb_misses +
13362                             kpmtsbm->kpm_tsb_misses - tsbm->kprot_traps;
13363                         cpu_kstat->sf_tsb_hits = 0;
13364                         cpu_kstat->sf_umod_faults = tsbm->uprot_traps;
13365                         cpu_kstat->sf_kmod_faults = tsbm->kprot_traps;
13366                 }
13367         } else {
13368                 /* KSTAT_WRITE is used to clear stats */
13369                 for (i = 0; i < NCPU; tsbm++, kpmtsbm++, i++) {
13370                         tsbm->utsb_misses = 0;
13371                         tsbm->ktsb_misses = 0;
13372                         tsbm->uprot_traps = 0;
13373                         tsbm->kprot_traps = 0;
13374                         kpmtsbm->kpm_dtlb_misses = 0;
13375                         kpmtsbm->kpm_tsb_misses = 0;
13376                 }
13377         }
13378         return (0);
13379 }
13380 
13381 #ifdef  DEBUG
13382 
13383 tte_t  *gorig[NCPU], *gcur[NCPU], *gnew[NCPU];
13384 
13385 /*
13386  * A tte checker. *orig_old is the value we read before cas.
13387  *      *cur is the value returned by cas.
13388  *      *new is the desired value when we do the cas.
13389  *
13390  *      *hmeblkp is currently unused.
13391  */
13392 
13393 /* ARGSUSED */
13394 void
13395 chk_tte(tte_t *orig_old, tte_t *cur, tte_t *new, struct hme_blk *hmeblkp)
13396 {
13397         pfn_t i, j, k;
13398         int cpuid = CPU->cpu_id;
13399 
13400         gorig[cpuid] = orig_old;
13401         gcur[cpuid] = cur;
13402         gnew[cpuid] = new;
13403 
13404 #ifdef lint
13405         hmeblkp = hmeblkp;
13406 #endif
13407 
13408         if (TTE_IS_VALID(orig_old)) {
13409                 if (TTE_IS_VALID(cur)) {
13410                         i = TTE_TO_TTEPFN(orig_old);
13411                         j = TTE_TO_TTEPFN(cur);
13412                         k = TTE_TO_TTEPFN(new);
13413                         if (i != j) {
13414                                 /* remap error? */
13415                                 panic("chk_tte: bad pfn, 0x%lx, 0x%lx", i, j);
13416                         }
13417 
13418                         if (i != k) {
13419                                 /* remap error? */
13420                                 panic("chk_tte: bad pfn2, 0x%lx, 0x%lx", i, k);
13421                         }
13422                 } else {
13423                         if (TTE_IS_VALID(new)) {
13424                                 panic("chk_tte: invalid cur? ");
13425                         }
13426 
13427                         i = TTE_TO_TTEPFN(orig_old);
13428                         k = TTE_TO_TTEPFN(new);
13429                         if (i != k) {
13430                                 panic("chk_tte: bad pfn3, 0x%lx, 0x%lx", i, k);
13431                         }
13432                 }
13433         } else {
13434                 if (TTE_IS_VALID(cur)) {
13435                         j = TTE_TO_TTEPFN(cur);
13436                         if (TTE_IS_VALID(new)) {
13437                                 k = TTE_TO_TTEPFN(new);
13438                                 if (j != k) {
13439                                         panic("chk_tte: bad pfn4, 0x%lx, 0x%lx",
13440                                             j, k);
13441                                 }
13442                         } else {
13443                                 panic("chk_tte: why here?");
13444                         }
13445                 } else {
13446                         if (!TTE_IS_VALID(new)) {
13447                                 panic("chk_tte: why here2 ?");
13448                         }
13449                 }
13450         }
13451 }
13452 
13453 #endif /* DEBUG */
13454 
13455 extern void prefetch_tsbe_read(struct tsbe *);
13456 extern void prefetch_tsbe_write(struct tsbe *);
13457 
13458 
13459 /*
13460  * We want to prefetch 7 cache lines ahead for our read prefetch.  This gives
13461  * us optimal performance on Cheetah+.  You can only have 8 outstanding
13462  * prefetches at any one time, so we opted for 7 read prefetches and 1 write
13463  * prefetch to make the most utilization of the prefetch capability.
13464  */
13465 #define TSBE_PREFETCH_STRIDE (7)
13466 
13467 void
13468 sfmmu_copy_tsb(struct tsb_info *old_tsbinfo, struct tsb_info *new_tsbinfo)
13469 {
13470         int old_bytes = TSB_BYTES(old_tsbinfo->tsb_szc);
13471         int new_bytes = TSB_BYTES(new_tsbinfo->tsb_szc);
13472         int old_entries = TSB_ENTRIES(old_tsbinfo->tsb_szc);
13473         int new_entries = TSB_ENTRIES(new_tsbinfo->tsb_szc);
13474         struct tsbe *old;
13475         struct tsbe *new;
13476         struct tsbe *new_base = (struct tsbe *)new_tsbinfo->tsb_va;
13477         uint64_t va;
13478         int new_offset;
13479         int i;
13480         int vpshift;
13481         int last_prefetch;
13482 
13483         if (old_bytes == new_bytes) {
13484                 bcopy(old_tsbinfo->tsb_va, new_tsbinfo->tsb_va, new_bytes);
13485         } else {
13486 
13487                 /*
13488                  * A TSBE is 16 bytes which means there are four TSBE's per
13489                  * P$ line (64 bytes), thus every 4 TSBE's we prefetch.
13490                  */
13491                 old = (struct tsbe *)old_tsbinfo->tsb_va;
13492                 last_prefetch = old_entries - (4*(TSBE_PREFETCH_STRIDE+1));
13493                 for (i = 0; i < old_entries; i++, old++) {
13494                         if (((i & (4-1)) == 0) && (i < last_prefetch))
13495                                 prefetch_tsbe_read(old);
13496                         if (!old->tte_tag.tag_invalid) {
13497                                 /*
13498                                  * We have a valid TTE to remap.  Check the
13499                                  * size.  We won't remap 64K or 512K TTEs
13500                                  * because they span more than one TSB entry
13501                                  * and are indexed using an 8K virt. page.
13502                                  * Ditto for 32M and 256M TTEs.
13503                                  */
13504                                 if (TTE_CSZ(&old->tte_data) == TTE64K ||
13505                                     TTE_CSZ(&old->tte_data) == TTE512K)
13506                                         continue;
13507                                 if (mmu_page_sizes == max_mmu_page_sizes) {
13508                                         if (TTE_CSZ(&old->tte_data) == TTE32M ||
13509                                             TTE_CSZ(&old->tte_data) == TTE256M)
13510                                                 continue;
13511                                 }
13512 
13513                                 /* clear the lower 22 bits of the va */
13514                                 va = *(uint64_t *)old << 22;
13515                                 /* turn va into a virtual pfn */
13516                                 va >>= 22 - TSB_START_SIZE;
13517                                 /*
13518                                  * or in bits from the offset in the tsb
13519                                  * to get the real virtual pfn. These
13520                                  * correspond to bits [21:13] in the va
13521                                  */
13522                                 vpshift =
13523                                     TTE_BSZS_SHIFT(TTE_CSZ(&old->tte_data)) &
13524                                     0x1ff;
13525                                 va |= (i << vpshift);
13526                                 va >>= vpshift;
13527                                 new_offset = va & (new_entries - 1);
13528                                 new = new_base + new_offset;
13529                                 prefetch_tsbe_write(new);
13530                                 *new = *old;
13531                         }
13532                 }
13533         }
13534 }
13535 
13536 /*
13537  * unused in sfmmu
13538  */
13539 void
13540 hat_dump(void)
13541 {
13542 }
13543 
13544 /*
13545  * Called when a thread is exiting and we have switched to the kernel address
13546  * space.  Perform the same VM initialization resume() uses when switching
13547  * processes.
13548  *
13549  * Note that sfmmu_load_mmustate() is currently a no-op for kernel threads, but
13550  * we call it anyway in case the semantics change in the future.
13551  */
13552 /*ARGSUSED*/
13553 void
13554 hat_thread_exit(kthread_t *thd)
13555 {
13556         uint_t pgsz_cnum;
13557         uint_t pstate_save;
13558 
13559         ASSERT(thd->t_procp->p_as == &kas);
13560 
13561         pgsz_cnum = KCONTEXT;
13562 #ifdef sun4u
13563         pgsz_cnum |= (ksfmmup->sfmmu_cext << CTXREG_EXT_SHIFT);
13564 #endif
13565 
13566         /*
13567          * Note that sfmmu_load_mmustate() is currently a no-op for
13568          * kernel threads. We need to disable interrupts here,
13569          * simply because otherwise sfmmu_load_mmustate() would panic
13570          * if the caller does not disable interrupts.
13571          */
13572         pstate_save = sfmmu_disable_intrs();
13573 
13574         /* Compatibility Note: hw takes care of MMU_SCONTEXT1 */
13575         sfmmu_setctx_sec(pgsz_cnum);
13576         sfmmu_load_mmustate(ksfmmup);
13577         sfmmu_enable_intrs(pstate_save);
13578 }
13579 
13580 
13581 /*
13582  * SRD support
13583  */
13584 #define SRD_HASH_FUNCTION(vp)   (((((uintptr_t)(vp)) >> 4) ^ \
13585                                     (((uintptr_t)(vp)) >> 11)) & \
13586                                     srd_hashmask)
13587 
13588 /*
13589  * Attach the process to the srd struct associated with the exec vnode
13590  * from which the process is started.
13591  */
13592 void
13593 hat_join_srd(struct hat *sfmmup, vnode_t *evp)
13594 {
13595         uint_t hash = SRD_HASH_FUNCTION(evp);
13596         sf_srd_t *srdp;
13597         sf_srd_t *newsrdp;
13598 
13599         ASSERT(sfmmup != ksfmmup);
13600         ASSERT(sfmmup->sfmmu_srdp == NULL);
13601 
13602         if (!shctx_on) {
13603                 return;
13604         }
13605 
13606         VN_HOLD(evp);
13607 
13608         if (srd_buckets[hash].srdb_srdp != NULL) {
13609                 mutex_enter(&srd_buckets[hash].srdb_lock);
13610                 for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13611                     srdp = srdp->srd_hash) {
13612                         if (srdp->srd_evp == evp) {
13613                                 ASSERT(srdp->srd_refcnt >= 0);
13614                                 sfmmup->sfmmu_srdp = srdp;
13615                                 atomic_inc_32(
13616                                     (volatile uint_t *)&srdp->srd_refcnt);
13617                                 mutex_exit(&srd_buckets[hash].srdb_lock);
13618                                 return;
13619                         }
13620                 }
13621                 mutex_exit(&srd_buckets[hash].srdb_lock);
13622         }
13623         newsrdp = kmem_cache_alloc(srd_cache, KM_SLEEP);
13624         ASSERT(newsrdp->srd_next_ismrid == 0 && newsrdp->srd_next_hmerid == 0);
13625 
13626         newsrdp->srd_evp = evp;
13627         newsrdp->srd_refcnt = 1;
13628         newsrdp->srd_hmergnfree = NULL;
13629         newsrdp->srd_ismrgnfree = NULL;
13630 
13631         mutex_enter(&srd_buckets[hash].srdb_lock);
13632         for (srdp = srd_buckets[hash].srdb_srdp; srdp != NULL;
13633             srdp = srdp->srd_hash) {
13634                 if (srdp->srd_evp == evp) {
13635                         ASSERT(srdp->srd_refcnt >= 0);
13636                         sfmmup->sfmmu_srdp = srdp;
13637                         atomic_inc_32((volatile uint_t *)&srdp->srd_refcnt);
13638                         mutex_exit(&srd_buckets[hash].srdb_lock);
13639                         kmem_cache_free(srd_cache, newsrdp);
13640                         return;
13641                 }
13642         }
13643         newsrdp->srd_hash = srd_buckets[hash].srdb_srdp;
13644         srd_buckets[hash].srdb_srdp = newsrdp;
13645         sfmmup->sfmmu_srdp = newsrdp;
13646 
13647         mutex_exit(&srd_buckets[hash].srdb_lock);
13648 
13649 }
13650 
13651 static void
13652 sfmmu_leave_srd(sfmmu_t *sfmmup)
13653 {
13654         vnode_t *evp;
13655         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13656         uint_t hash;
13657         sf_srd_t **prev_srdpp;
13658         sf_region_t *rgnp;
13659         sf_region_t *nrgnp;
13660 #ifdef DEBUG
13661         int rgns = 0;
13662 #endif
13663         int i;
13664 
13665         ASSERT(sfmmup != ksfmmup);
13666         ASSERT(srdp != NULL);
13667         ASSERT(srdp->srd_refcnt > 0);
13668         ASSERT(sfmmup->sfmmu_scdp == NULL);
13669         ASSERT(sfmmup->sfmmu_free == 1);
13670 
13671         sfmmup->sfmmu_srdp = NULL;
13672         evp = srdp->srd_evp;
13673         ASSERT(evp != NULL);
13674         if (atomic_dec_32_nv((volatile uint_t *)&srdp->srd_refcnt)) {
13675                 VN_RELE(evp);
13676                 return;
13677         }
13678 
13679         hash = SRD_HASH_FUNCTION(evp);
13680         mutex_enter(&srd_buckets[hash].srdb_lock);
13681         for (prev_srdpp = &srd_buckets[hash].srdb_srdp;
13682             (srdp = *prev_srdpp) != NULL; prev_srdpp = &srdp->srd_hash) {
13683                 if (srdp->srd_evp == evp) {
13684                         break;
13685                 }
13686         }
13687         if (srdp == NULL || srdp->srd_refcnt) {
13688                 mutex_exit(&srd_buckets[hash].srdb_lock);
13689                 VN_RELE(evp);
13690                 return;
13691         }
13692         *prev_srdpp = srdp->srd_hash;
13693         mutex_exit(&srd_buckets[hash].srdb_lock);
13694 
13695         ASSERT(srdp->srd_refcnt == 0);
13696         VN_RELE(evp);
13697 
13698 #ifdef DEBUG
13699         for (i = 0; i < SFMMU_MAX_REGION_BUCKETS; i++) {
13700                 ASSERT(srdp->srd_rgnhash[i] == NULL);
13701         }
13702 #endif /* DEBUG */
13703 
13704         /* free each hme regions in the srd */
13705         for (rgnp = srdp->srd_hmergnfree; rgnp != NULL; rgnp = nrgnp) {
13706                 nrgnp = rgnp->rgn_next;
13707                 ASSERT(rgnp->rgn_id < srdp->srd_next_hmerid);
13708                 ASSERT(rgnp->rgn_refcnt == 0);
13709                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13710                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13711                 ASSERT(rgnp->rgn_hmeflags == 0);
13712                 ASSERT(srdp->srd_hmergnp[rgnp->rgn_id] == rgnp);
13713 #ifdef DEBUG
13714                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13715                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13716                 }
13717                 rgns++;
13718 #endif /* DEBUG */
13719                 kmem_cache_free(region_cache, rgnp);
13720         }
13721         ASSERT(rgns == srdp->srd_next_hmerid);
13722 
13723 #ifdef DEBUG
13724         rgns = 0;
13725 #endif
13726         /* free each ism rgns in the srd */
13727         for (rgnp = srdp->srd_ismrgnfree; rgnp != NULL; rgnp = nrgnp) {
13728                 nrgnp = rgnp->rgn_next;
13729                 ASSERT(rgnp->rgn_id < srdp->srd_next_ismrid);
13730                 ASSERT(rgnp->rgn_refcnt == 0);
13731                 ASSERT(rgnp->rgn_sfmmu_head == NULL);
13732                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
13733                 ASSERT(srdp->srd_ismrgnp[rgnp->rgn_id] == rgnp);
13734 #ifdef DEBUG
13735                 for (i = 0; i < MMU_PAGE_SIZES; i++) {
13736                         ASSERT(rgnp->rgn_ttecnt[i] == 0);
13737                 }
13738                 rgns++;
13739 #endif /* DEBUG */
13740                 kmem_cache_free(region_cache, rgnp);
13741         }
13742         ASSERT(rgns == srdp->srd_next_ismrid);
13743         ASSERT(srdp->srd_ismbusyrgns == 0);
13744         ASSERT(srdp->srd_hmebusyrgns == 0);
13745 
13746         srdp->srd_next_ismrid = 0;
13747         srdp->srd_next_hmerid = 0;
13748 
13749         bzero((void *)srdp->srd_ismrgnp,
13750             sizeof (sf_region_t *) * SFMMU_MAX_ISM_REGIONS);
13751         bzero((void *)srdp->srd_hmergnp,
13752             sizeof (sf_region_t *) * SFMMU_MAX_HME_REGIONS);
13753 
13754         ASSERT(srdp->srd_scdp == NULL);
13755         kmem_cache_free(srd_cache, srdp);
13756 }
13757 
13758 /* ARGSUSED */
13759 static int
13760 sfmmu_srdcache_constructor(void *buf, void *cdrarg, int kmflags)
13761 {
13762         sf_srd_t *srdp = (sf_srd_t *)buf;
13763         bzero(buf, sizeof (*srdp));
13764 
13765         mutex_init(&srdp->srd_mutex, NULL, MUTEX_DEFAULT, NULL);
13766         mutex_init(&srdp->srd_scd_mutex, NULL, MUTEX_DEFAULT, NULL);
13767         return (0);
13768 }
13769 
13770 /* ARGSUSED */
13771 static void
13772 sfmmu_srdcache_destructor(void *buf, void *cdrarg)
13773 {
13774         sf_srd_t *srdp = (sf_srd_t *)buf;
13775 
13776         mutex_destroy(&srdp->srd_mutex);
13777         mutex_destroy(&srdp->srd_scd_mutex);
13778 }
13779 
13780 /*
13781  * The caller makes sure hat_join_region()/hat_leave_region() can't be called
13782  * at the same time for the same process and address range. This is ensured by
13783  * the fact that address space is locked as writer when a process joins the
13784  * regions. Therefore there's no need to hold an srd lock during the entire
13785  * execution of hat_join_region()/hat_leave_region().
13786  */
13787 
13788 #define RGN_HASH_FUNCTION(obj)  (((((uintptr_t)(obj)) >> 4) ^ \
13789                                     (((uintptr_t)(obj)) >> 11)) & \
13790                                         srd_rgn_hashmask)
13791 /*
13792  * This routine implements the shared context functionality required when
13793  * attaching a segment to an address space. It must be called from
13794  * hat_share() for D(ISM) segments and from segvn_create() for segments
13795  * with the MAP_PRIVATE and MAP_TEXT flags set. It returns a region_cookie
13796  * which is saved in the private segment data for hme segments and
13797  * the ism_map structure for ism segments.
13798  */
13799 hat_region_cookie_t
13800 hat_join_region(struct hat *sfmmup, caddr_t r_saddr, size_t r_size,
13801     void *r_obj, u_offset_t r_objoff, uchar_t r_perm, uchar_t r_pgszc,
13802     hat_rgn_cb_func_t r_cb_function, uint_t flags)
13803 {
13804         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
13805         uint_t rhash;
13806         uint_t rid;
13807         hatlock_t *hatlockp;
13808         sf_region_t *rgnp;
13809         sf_region_t *new_rgnp = NULL;
13810         int i;
13811         uint16_t *nextidp;
13812         sf_region_t **freelistp;
13813         int maxids;
13814         sf_region_t **rarrp;
13815         uint16_t *busyrgnsp;
13816         ulong_t rttecnt;
13817         uchar_t tteflag;
13818         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
13819         int text = (r_type == HAT_REGION_TEXT);
13820 
13821         if (srdp == NULL || r_size == 0) {
13822                 return (HAT_INVALID_REGION_COOKIE);
13823         }
13824 
13825         ASSERT(sfmmup != ksfmmup);
13826         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
13827         ASSERT(srdp->srd_refcnt > 0);
13828         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
13829         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
13830         ASSERT(r_pgszc < mmu_page_sizes);
13831         if (!IS_P2ALIGNED(r_saddr, TTEBYTES(r_pgszc)) ||
13832             !IS_P2ALIGNED(r_size, TTEBYTES(r_pgszc))) {
13833                 panic("hat_join_region: region addr or size is not aligned\n");
13834         }
13835 
13836 
13837         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
13838             SFMMU_REGION_HME;
13839         /*
13840          * Currently only support shared hmes for the read only main text
13841          * region.
13842          */
13843         if (r_type == SFMMU_REGION_HME && ((r_obj != srdp->srd_evp) ||
13844             (r_perm & PROT_WRITE))) {
13845                 return (HAT_INVALID_REGION_COOKIE);
13846         }
13847 
13848         rhash = RGN_HASH_FUNCTION(r_obj);
13849 
13850         if (r_type == SFMMU_REGION_ISM) {
13851                 nextidp = &srdp->srd_next_ismrid;
13852                 freelistp = &srdp->srd_ismrgnfree;
13853                 maxids = SFMMU_MAX_ISM_REGIONS;
13854                 rarrp = srdp->srd_ismrgnp;
13855                 busyrgnsp = &srdp->srd_ismbusyrgns;
13856         } else {
13857                 nextidp = &srdp->srd_next_hmerid;
13858                 freelistp = &srdp->srd_hmergnfree;
13859                 maxids = SFMMU_MAX_HME_REGIONS;
13860                 rarrp = srdp->srd_hmergnp;
13861                 busyrgnsp = &srdp->srd_hmebusyrgns;
13862         }
13863 
13864         mutex_enter(&srdp->srd_mutex);
13865 
13866         for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
13867             rgnp = rgnp->rgn_hash) {
13868                 if (rgnp->rgn_saddr == r_saddr && rgnp->rgn_size == r_size &&
13869                     rgnp->rgn_obj == r_obj && rgnp->rgn_objoff == r_objoff &&
13870                     rgnp->rgn_perm == r_perm && rgnp->rgn_pgszc == r_pgszc) {
13871                         break;
13872                 }
13873         }
13874 
13875 rfound:
13876         if (rgnp != NULL) {
13877                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
13878                 ASSERT(rgnp->rgn_cb_function == r_cb_function);
13879                 ASSERT(rgnp->rgn_refcnt >= 0);
13880                 rid = rgnp->rgn_id;
13881                 ASSERT(rid < maxids);
13882                 ASSERT(rarrp[rid] == rgnp);
13883                 ASSERT(rid < *nextidp);
13884                 atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
13885                 mutex_exit(&srdp->srd_mutex);
13886                 if (new_rgnp != NULL) {
13887                         kmem_cache_free(region_cache, new_rgnp);
13888                 }
13889                 if (r_type == SFMMU_REGION_HME) {
13890                         int myjoin =
13891                             (sfmmup == astosfmmu(curthread->t_procp->p_as));
13892 
13893                         sfmmu_link_to_hmeregion(sfmmup, rgnp);
13894                         /*
13895                          * bitmap should be updated after linking sfmmu on
13896                          * region list so that pageunload() doesn't skip
13897                          * TSB/TLB flush. As soon as bitmap is updated another
13898                          * thread in this process can already start accessing
13899                          * this region.
13900                          */
13901                         /*
13902                          * Normally ttecnt accounting is done as part of
13903                          * pagefault handling. But a process may not take any
13904                          * pagefaults on shared hmeblks created by some other
13905                          * process. To compensate for this assume that the
13906                          * entire region will end up faulted in using
13907                          * the region's pagesize.
13908                          *
13909                          */
13910                         if (r_pgszc > TTE8K) {
13911                                 tteflag = 1 << r_pgszc;
13912                                 if (disable_large_pages & tteflag) {
13913                                         tteflag = 0;
13914                                 }
13915                         } else {
13916                                 tteflag = 0;
13917                         }
13918                         if (tteflag && !(sfmmup->sfmmu_rtteflags & tteflag)) {
13919                                 hatlockp = sfmmu_hat_enter(sfmmup);
13920                                 sfmmup->sfmmu_rtteflags |= tteflag;
13921                                 sfmmu_hat_exit(hatlockp);
13922                         }
13923                         hatlockp = sfmmu_hat_enter(sfmmup);
13924 
13925                         /*
13926                          * Preallocate 1/4 of ttecnt's in 8K TSB for >= 4M
13927                          * region to allow for large page allocation failure.
13928                          */
13929                         if (r_pgszc >= TTE4M) {
13930                                 sfmmup->sfmmu_tsb0_4minflcnt +=
13931                                     r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
13932                         }
13933 
13934                         /* update sfmmu_ttecnt with the shme rgn ttecnt */
13935                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
13936                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
13937                             rttecnt);
13938 
13939                         if (text && r_pgszc >= TTE4M &&
13940                             (tteflag || ((disable_large_pages >> TTE4M) &
13941                             ((1 << (r_pgszc - TTE4M + 1)) - 1))) &&
13942                             !SFMMU_FLAGS_ISSET(sfmmup, HAT_4MTEXT_FLAG)) {
13943                                 SFMMU_FLAGS_SET(sfmmup, HAT_4MTEXT_FLAG);
13944                         }
13945 
13946                         sfmmu_hat_exit(hatlockp);
13947                         /*
13948                          * On Panther we need to make sure TLB is programmed
13949                          * to accept 32M/256M pages.  Call
13950                          * sfmmu_check_page_sizes() now to make sure TLB is
13951                          * setup before making hmeregions visible to other
13952                          * threads.
13953                          */
13954                         sfmmu_check_page_sizes(sfmmup, 1);
13955                         hatlockp = sfmmu_hat_enter(sfmmup);
13956                         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
13957 
13958                         /*
13959                          * if context is invalid tsb miss exception code will
13960                          * call sfmmu_check_page_sizes() and update tsbmiss
13961                          * area later.
13962                          */
13963                         kpreempt_disable();
13964                         if (myjoin &&
13965                             (sfmmup->sfmmu_ctxs[CPU_MMU_IDX(CPU)].cnum
13966                             != INVALID_CONTEXT)) {
13967                                 struct tsbmiss *tsbmp;
13968 
13969                                 tsbmp = &tsbmiss_area[CPU->cpu_id];
13970                                 ASSERT(sfmmup == tsbmp->usfmmup);
13971                                 BT_SET(tsbmp->shmermap, rid);
13972                                 if (r_pgszc > TTE64K) {
13973                                         tsbmp->uhat_rtteflags |= tteflag;
13974                                 }
13975 
13976                         }
13977                         kpreempt_enable();
13978 
13979                         sfmmu_hat_exit(hatlockp);
13980                         ASSERT((hat_region_cookie_t)((uint64_t)rid) !=
13981                             HAT_INVALID_REGION_COOKIE);
13982                 } else {
13983                         hatlockp = sfmmu_hat_enter(sfmmup);
13984                         SF_RGNMAP_ADD(sfmmup->sfmmu_ismregion_map, rid);
13985                         sfmmu_hat_exit(hatlockp);
13986                 }
13987                 ASSERT(rid < maxids);
13988 
13989                 if (r_type == SFMMU_REGION_ISM) {
13990                         sfmmu_find_scd(sfmmup);
13991                 }
13992                 return ((hat_region_cookie_t)((uint64_t)rid));
13993         }
13994 
13995         ASSERT(new_rgnp == NULL);
13996 
13997         if (*busyrgnsp >= maxids) {
13998                 mutex_exit(&srdp->srd_mutex);
13999                 return (HAT_INVALID_REGION_COOKIE);
14000         }
14001 
14002         ASSERT(MUTEX_HELD(&srdp->srd_mutex));
14003         if (*freelistp != NULL) {
14004                 rgnp = *freelistp;
14005                 *freelistp = rgnp->rgn_next;
14006                 ASSERT(rgnp->rgn_id < *nextidp);
14007                 ASSERT(rgnp->rgn_id < maxids);
14008                 ASSERT(rgnp->rgn_flags & SFMMU_REGION_FREE);
14009                 ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK)
14010                     == r_type);
14011                 ASSERT(rarrp[rgnp->rgn_id] == rgnp);
14012                 ASSERT(rgnp->rgn_hmeflags == 0);
14013         } else {
14014                 /*
14015                  * release local locks before memory allocation.
14016                  */
14017                 mutex_exit(&srdp->srd_mutex);
14018 
14019                 new_rgnp = kmem_cache_alloc(region_cache, KM_SLEEP);
14020 
14021                 mutex_enter(&srdp->srd_mutex);
14022                 for (rgnp = srdp->srd_rgnhash[rhash]; rgnp != NULL;
14023                     rgnp = rgnp->rgn_hash) {
14024                         if (rgnp->rgn_saddr == r_saddr &&
14025                             rgnp->rgn_size == r_size &&
14026                             rgnp->rgn_obj == r_obj &&
14027                             rgnp->rgn_objoff == r_objoff &&
14028                             rgnp->rgn_perm == r_perm &&
14029                             rgnp->rgn_pgszc == r_pgszc) {
14030                                 break;
14031                         }
14032                 }
14033                 if (rgnp != NULL) {
14034                         goto rfound;
14035                 }
14036 
14037                 if (*nextidp >= maxids) {
14038                         mutex_exit(&srdp->srd_mutex);
14039                         goto fail;
14040                 }
14041                 rgnp = new_rgnp;
14042                 new_rgnp = NULL;
14043                 rgnp->rgn_id = (*nextidp)++;
14044                 ASSERT(rgnp->rgn_id < maxids);
14045                 ASSERT(rarrp[rgnp->rgn_id] == NULL);
14046                 rarrp[rgnp->rgn_id] = rgnp;
14047         }
14048 
14049         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14050         ASSERT(rgnp->rgn_hmeflags == 0);
14051 #ifdef DEBUG
14052         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14053                 ASSERT(rgnp->rgn_ttecnt[i] == 0);
14054         }
14055 #endif
14056         rgnp->rgn_saddr = r_saddr;
14057         rgnp->rgn_size = r_size;
14058         rgnp->rgn_obj = r_obj;
14059         rgnp->rgn_objoff = r_objoff;
14060         rgnp->rgn_perm = r_perm;
14061         rgnp->rgn_pgszc = r_pgszc;
14062         rgnp->rgn_flags = r_type;
14063         rgnp->rgn_refcnt = 0;
14064         rgnp->rgn_cb_function = r_cb_function;
14065         rgnp->rgn_hash = srdp->srd_rgnhash[rhash];
14066         srdp->srd_rgnhash[rhash] = rgnp;
14067         (*busyrgnsp)++;
14068         ASSERT(*busyrgnsp <= maxids);
14069         goto rfound;
14070 
14071 fail:
14072         ASSERT(new_rgnp != NULL);
14073         kmem_cache_free(region_cache, new_rgnp);
14074         return (HAT_INVALID_REGION_COOKIE);
14075 }
14076 
14077 /*
14078  * This function implements the shared context functionality required
14079  * when detaching a segment from an address space. It must be called
14080  * from hat_unshare() for all D(ISM) segments and from segvn_unmap(),
14081  * for segments with a valid region_cookie.
14082  * It will also be called from all seg_vn routines which change a
14083  * segment's attributes such as segvn_setprot(), segvn_setpagesize(),
14084  * segvn_clrszc() & segvn_advise(), as well as in the case of COW fault
14085  * from segvn_fault().
14086  */
14087 void
14088 hat_leave_region(struct hat *sfmmup, hat_region_cookie_t rcookie, uint_t flags)
14089 {
14090         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14091         sf_scd_t *scdp;
14092         uint_t rhash;
14093         uint_t rid = (uint_t)((uint64_t)rcookie);
14094         hatlock_t *hatlockp = NULL;
14095         sf_region_t *rgnp;
14096         sf_region_t **prev_rgnpp;
14097         sf_region_t *cur_rgnp;
14098         void *r_obj;
14099         int i;
14100         caddr_t r_saddr;
14101         caddr_t r_eaddr;
14102         size_t  r_size;
14103         uchar_t r_pgszc;
14104         uchar_t r_type = flags & HAT_REGION_TYPE_MASK;
14105 
14106         ASSERT(sfmmup != ksfmmup);
14107         ASSERT(srdp != NULL);
14108         ASSERT(srdp->srd_refcnt > 0);
14109         ASSERT(!(flags & ~HAT_REGION_TYPE_MASK));
14110         ASSERT(flags == HAT_REGION_TEXT || flags == HAT_REGION_ISM);
14111         ASSERT(!sfmmup->sfmmu_free || sfmmup->sfmmu_scdp == NULL);
14112 
14113         r_type = (r_type == HAT_REGION_ISM) ? SFMMU_REGION_ISM :
14114             SFMMU_REGION_HME;
14115 
14116         if (r_type == SFMMU_REGION_ISM) {
14117                 ASSERT(SFMMU_IS_ISMRID_VALID(rid));
14118                 ASSERT(rid < SFMMU_MAX_ISM_REGIONS);
14119                 rgnp = srdp->srd_ismrgnp[rid];
14120         } else {
14121                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14122                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14123                 rgnp = srdp->srd_hmergnp[rid];
14124         }
14125         ASSERT(rgnp != NULL);
14126         ASSERT(rgnp->rgn_id == rid);
14127         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14128         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14129         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
14130 
14131         if (sfmmup->sfmmu_free) {
14132                 ulong_t rttecnt;
14133                 r_pgszc = rgnp->rgn_pgszc;
14134                 r_size = rgnp->rgn_size;
14135 
14136                 ASSERT(sfmmup->sfmmu_scdp == NULL);
14137                 if (r_type == SFMMU_REGION_ISM) {
14138                         SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14139                 } else {
14140                         /* update shme rgns ttecnt in sfmmu_ttecnt */
14141                         rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14142                         ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14143 
14144                         atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc],
14145                             -rttecnt);
14146 
14147                         SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14148                 }
14149         } else if (r_type == SFMMU_REGION_ISM) {
14150                 hatlockp = sfmmu_hat_enter(sfmmup);
14151                 ASSERT(rid < srdp->srd_next_ismrid);
14152                 SF_RGNMAP_DEL(sfmmup->sfmmu_ismregion_map, rid);
14153                 scdp = sfmmup->sfmmu_scdp;
14154                 if (scdp != NULL &&
14155                     SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid)) {
14156                         sfmmu_leave_scd(sfmmup, r_type);
14157                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14158                 }
14159                 sfmmu_hat_exit(hatlockp);
14160         } else {
14161                 ulong_t rttecnt;
14162                 r_pgszc = rgnp->rgn_pgszc;
14163                 r_saddr = rgnp->rgn_saddr;
14164                 r_size = rgnp->rgn_size;
14165                 r_eaddr = r_saddr + r_size;
14166 
14167                 ASSERT(r_type == SFMMU_REGION_HME);
14168                 hatlockp = sfmmu_hat_enter(sfmmup);
14169                 ASSERT(rid < srdp->srd_next_hmerid);
14170                 SF_RGNMAP_DEL(sfmmup->sfmmu_hmeregion_map, rid);
14171 
14172                 /*
14173                  * If region is part of an SCD call sfmmu_leave_scd().
14174                  * Otherwise if process is not exiting and has valid context
14175                  * just drop the context on the floor to lose stale TLB
14176                  * entries and force the update of tsb miss area to reflect
14177                  * the new region map. After that clean our TSB entries.
14178                  */
14179                 scdp = sfmmup->sfmmu_scdp;
14180                 if (scdp != NULL &&
14181                     SF_RGNMAP_TEST(scdp->scd_hmeregion_map, rid)) {
14182                         sfmmu_leave_scd(sfmmup, r_type);
14183                         ASSERT(sfmmu_hat_lock_held(sfmmup));
14184                 }
14185                 sfmmu_invalidate_ctx(sfmmup);
14186 
14187                 i = TTE8K;
14188                 while (i < mmu_page_sizes) {
14189                         if (rgnp->rgn_ttecnt[i] != 0) {
14190                                 sfmmu_unload_tsb_range(sfmmup, r_saddr,
14191                                     r_eaddr, i);
14192                                 if (i < TTE4M) {
14193                                         i = TTE4M;
14194                                         continue;
14195                                 } else {
14196                                         break;
14197                                 }
14198                         }
14199                         i++;
14200                 }
14201                 /* Remove the preallocated 1/4 8k ttecnt for 4M regions. */
14202                 if (r_pgszc >= TTE4M) {
14203                         rttecnt = r_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14204                         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14205                             rttecnt);
14206                         sfmmup->sfmmu_tsb0_4minflcnt -= rttecnt;
14207                 }
14208 
14209                 /* update shme rgns ttecnt in sfmmu_ttecnt */
14210                 rttecnt = r_size >> TTE_PAGE_SHIFT(r_pgszc);
14211                 ASSERT(sfmmup->sfmmu_ttecnt[r_pgszc] >= rttecnt);
14212                 atomic_add_long(&sfmmup->sfmmu_ttecnt[r_pgszc], -rttecnt);
14213 
14214                 sfmmu_hat_exit(hatlockp);
14215                 if (scdp != NULL && sfmmup->sfmmu_scdp == NULL) {
14216                         /* sfmmup left the scd, grow private tsb */
14217                         sfmmu_check_page_sizes(sfmmup, 1);
14218                 } else {
14219                         sfmmu_check_page_sizes(sfmmup, 0);
14220                 }
14221         }
14222 
14223         if (r_type == SFMMU_REGION_HME) {
14224                 sfmmu_unlink_from_hmeregion(sfmmup, rgnp);
14225         }
14226 
14227         r_obj = rgnp->rgn_obj;
14228         if (atomic_dec_32_nv((volatile uint_t *)&rgnp->rgn_refcnt)) {
14229                 return;
14230         }
14231 
14232         /*
14233          * looks like nobody uses this region anymore. Free it.
14234          */
14235         rhash = RGN_HASH_FUNCTION(r_obj);
14236         mutex_enter(&srdp->srd_mutex);
14237         for (prev_rgnpp = &srdp->srd_rgnhash[rhash];
14238             (cur_rgnp = *prev_rgnpp) != NULL;
14239             prev_rgnpp = &cur_rgnp->rgn_hash) {
14240                 if (cur_rgnp == rgnp && cur_rgnp->rgn_refcnt == 0) {
14241                         break;
14242                 }
14243         }
14244 
14245         if (cur_rgnp == NULL) {
14246                 mutex_exit(&srdp->srd_mutex);
14247                 return;
14248         }
14249 
14250         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == r_type);
14251         *prev_rgnpp = rgnp->rgn_hash;
14252         if (r_type == SFMMU_REGION_ISM) {
14253                 rgnp->rgn_flags |= SFMMU_REGION_FREE;
14254                 ASSERT(rid < srdp->srd_next_ismrid);
14255                 rgnp->rgn_next = srdp->srd_ismrgnfree;
14256                 srdp->srd_ismrgnfree = rgnp;
14257                 ASSERT(srdp->srd_ismbusyrgns > 0);
14258                 srdp->srd_ismbusyrgns--;
14259                 mutex_exit(&srdp->srd_mutex);
14260                 return;
14261         }
14262         mutex_exit(&srdp->srd_mutex);
14263 
14264         /*
14265          * Destroy region's hmeblks.
14266          */
14267         sfmmu_unload_hmeregion(srdp, rgnp);
14268 
14269         rgnp->rgn_hmeflags = 0;
14270 
14271         ASSERT(rgnp->rgn_sfmmu_head == NULL);
14272         ASSERT(rgnp->rgn_id == rid);
14273         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14274                 rgnp->rgn_ttecnt[i] = 0;
14275         }
14276         rgnp->rgn_flags |= SFMMU_REGION_FREE;
14277         mutex_enter(&srdp->srd_mutex);
14278         ASSERT(rid < srdp->srd_next_hmerid);
14279         rgnp->rgn_next = srdp->srd_hmergnfree;
14280         srdp->srd_hmergnfree = rgnp;
14281         ASSERT(srdp->srd_hmebusyrgns > 0);
14282         srdp->srd_hmebusyrgns--;
14283         mutex_exit(&srdp->srd_mutex);
14284 }
14285 
14286 /*
14287  * For now only called for hmeblk regions and not for ISM regions.
14288  */
14289 void
14290 hat_dup_region(struct hat *sfmmup, hat_region_cookie_t rcookie)
14291 {
14292         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14293         uint_t rid = (uint_t)((uint64_t)rcookie);
14294         sf_region_t *rgnp;
14295         sf_rgn_link_t *rlink;
14296         sf_rgn_link_t *hrlink;
14297         ulong_t rttecnt;
14298 
14299         ASSERT(sfmmup != ksfmmup);
14300         ASSERT(srdp != NULL);
14301         ASSERT(srdp->srd_refcnt > 0);
14302 
14303         ASSERT(rid < srdp->srd_next_hmerid);
14304         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14305         ASSERT(rid < SFMMU_MAX_HME_REGIONS);
14306 
14307         rgnp = srdp->srd_hmergnp[rid];
14308         ASSERT(rgnp->rgn_refcnt > 0);
14309         ASSERT(rgnp->rgn_id == rid);
14310         ASSERT((rgnp->rgn_flags & SFMMU_REGION_TYPE_MASK) == SFMMU_REGION_HME);
14311         ASSERT(!(rgnp->rgn_flags & SFMMU_REGION_FREE));
14312 
14313         atomic_inc_32((volatile uint_t *)&rgnp->rgn_refcnt);
14314 
14315         /* LINTED: constant in conditional context */
14316         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 0);
14317         ASSERT(rlink != NULL);
14318         mutex_enter(&rgnp->rgn_mutex);
14319         ASSERT(rgnp->rgn_sfmmu_head != NULL);
14320         /* LINTED: constant in conditional context */
14321         SFMMU_HMERID2RLINKP(rgnp->rgn_sfmmu_head, rid, hrlink, 0, 0);
14322         ASSERT(hrlink != NULL);
14323         ASSERT(hrlink->prev == NULL);
14324         rlink->next = rgnp->rgn_sfmmu_head;
14325         rlink->prev = NULL;
14326         hrlink->prev = sfmmup;
14327         /*
14328          * make sure rlink's next field is correct
14329          * before making this link visible.
14330          */
14331         membar_stst();
14332         rgnp->rgn_sfmmu_head = sfmmup;
14333         mutex_exit(&rgnp->rgn_mutex);
14334 
14335         /* update sfmmu_ttecnt with the shme rgn ttecnt */
14336         rttecnt = rgnp->rgn_size >> TTE_PAGE_SHIFT(rgnp->rgn_pgszc);
14337         atomic_add_long(&sfmmup->sfmmu_ttecnt[rgnp->rgn_pgszc], rttecnt);
14338         /* update tsb0 inflation count */
14339         if (rgnp->rgn_pgszc >= TTE4M) {
14340                 sfmmup->sfmmu_tsb0_4minflcnt +=
14341                     rgnp->rgn_size >> (TTE_PAGE_SHIFT(TTE8K) + 2);
14342         }
14343         /*
14344          * Update regionid bitmask without hat lock since no other thread
14345          * can update this region bitmask right now.
14346          */
14347         SF_RGNMAP_ADD(sfmmup->sfmmu_hmeregion_map, rid);
14348 }
14349 
14350 /* ARGSUSED */
14351 static int
14352 sfmmu_rgncache_constructor(void *buf, void *cdrarg, int kmflags)
14353 {
14354         sf_region_t *rgnp = (sf_region_t *)buf;
14355         bzero(buf, sizeof (*rgnp));
14356 
14357         mutex_init(&rgnp->rgn_mutex, NULL, MUTEX_DEFAULT, NULL);
14358 
14359         return (0);
14360 }
14361 
14362 /* ARGSUSED */
14363 static void
14364 sfmmu_rgncache_destructor(void *buf, void *cdrarg)
14365 {
14366         sf_region_t *rgnp = (sf_region_t *)buf;
14367         mutex_destroy(&rgnp->rgn_mutex);
14368 }
14369 
14370 static int
14371 sfrgnmap_isnull(sf_region_map_t *map)
14372 {
14373         int i;
14374 
14375         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14376                 if (map->bitmap[i] != 0) {
14377                         return (0);
14378                 }
14379         }
14380         return (1);
14381 }
14382 
14383 static int
14384 sfhmergnmap_isnull(sf_hmeregion_map_t *map)
14385 {
14386         int i;
14387 
14388         for (i = 0; i < SFMMU_HMERGNMAP_WORDS; i++) {
14389                 if (map->bitmap[i] != 0) {
14390                         return (0);
14391                 }
14392         }
14393         return (1);
14394 }
14395 
14396 #ifdef DEBUG
14397 static void
14398 check_scd_sfmmu_list(sfmmu_t **headp, sfmmu_t *sfmmup, int onlist)
14399 {
14400         sfmmu_t *sp;
14401         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14402 
14403         for (sp = *headp; sp != NULL; sp = sp->sfmmu_scd_link.next) {
14404                 ASSERT(srdp == sp->sfmmu_srdp);
14405                 if (sp == sfmmup) {
14406                         if (onlist) {
14407                                 return;
14408                         } else {
14409                                 panic("shctx: sfmmu 0x%p found on scd"
14410                                     "list 0x%p", (void *)sfmmup,
14411                                     (void *)*headp);
14412                         }
14413                 }
14414         }
14415         if (onlist) {
14416                 panic("shctx: sfmmu 0x%p not found on scd list 0x%p",
14417                     (void *)sfmmup, (void *)*headp);
14418         } else {
14419                 return;
14420         }
14421 }
14422 #else /* DEBUG */
14423 #define check_scd_sfmmu_list(headp, sfmmup, onlist)
14424 #endif /* DEBUG */
14425 
14426 /*
14427  * Removes an sfmmu from the SCD sfmmu list.
14428  */
14429 static void
14430 sfmmu_from_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14431 {
14432         ASSERT(sfmmup->sfmmu_srdp != NULL);
14433         check_scd_sfmmu_list(headp, sfmmup, 1);
14434         if (sfmmup->sfmmu_scd_link.prev != NULL) {
14435                 ASSERT(*headp != sfmmup);
14436                 sfmmup->sfmmu_scd_link.prev->sfmmu_scd_link.next =
14437                     sfmmup->sfmmu_scd_link.next;
14438         } else {
14439                 ASSERT(*headp == sfmmup);
14440                 *headp = sfmmup->sfmmu_scd_link.next;
14441         }
14442         if (sfmmup->sfmmu_scd_link.next != NULL) {
14443                 sfmmup->sfmmu_scd_link.next->sfmmu_scd_link.prev =
14444                     sfmmup->sfmmu_scd_link.prev;
14445         }
14446 }
14447 
14448 
14449 /*
14450  * Adds an sfmmu to the start of the queue.
14451  */
14452 static void
14453 sfmmu_to_scd_list(sfmmu_t **headp, sfmmu_t *sfmmup)
14454 {
14455         check_scd_sfmmu_list(headp, sfmmup, 0);
14456         sfmmup->sfmmu_scd_link.prev = NULL;
14457         sfmmup->sfmmu_scd_link.next = *headp;
14458         if (*headp != NULL)
14459                 (*headp)->sfmmu_scd_link.prev = sfmmup;
14460         *headp = sfmmup;
14461 }
14462 
14463 /*
14464  * Remove an scd from the start of the queue.
14465  */
14466 static void
14467 sfmmu_remove_scd(sf_scd_t **headp, sf_scd_t *scdp)
14468 {
14469         if (scdp->scd_prev != NULL) {
14470                 ASSERT(*headp != scdp);
14471                 scdp->scd_prev->scd_next = scdp->scd_next;
14472         } else {
14473                 ASSERT(*headp == scdp);
14474                 *headp = scdp->scd_next;
14475         }
14476 
14477         if (scdp->scd_next != NULL) {
14478                 scdp->scd_next->scd_prev = scdp->scd_prev;
14479         }
14480 }
14481 
14482 /*
14483  * Add an scd to the start of the queue.
14484  */
14485 static void
14486 sfmmu_add_scd(sf_scd_t **headp, sf_scd_t *scdp)
14487 {
14488         scdp->scd_prev = NULL;
14489         scdp->scd_next = *headp;
14490         if (*headp != NULL) {
14491                 (*headp)->scd_prev = scdp;
14492         }
14493         *headp = scdp;
14494 }
14495 
14496 static int
14497 sfmmu_alloc_scd_tsbs(sf_srd_t *srdp, sf_scd_t *scdp)
14498 {
14499         uint_t rid;
14500         uint_t i;
14501         uint_t j;
14502         ulong_t w;
14503         sf_region_t *rgnp;
14504         ulong_t tte8k_cnt = 0;
14505         ulong_t tte4m_cnt = 0;
14506         uint_t tsb_szc;
14507         sfmmu_t *scsfmmup = scdp->scd_sfmmup;
14508         sfmmu_t *ism_hatid;
14509         struct tsb_info *newtsb;
14510         int szc;
14511 
14512         ASSERT(srdp != NULL);
14513 
14514         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14515                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14516                         continue;
14517                 }
14518                 j = 0;
14519                 while (w) {
14520                         if (!(w & 0x1)) {
14521                                 j++;
14522                                 w >>= 1;
14523                                 continue;
14524                         }
14525                         rid = (i << BT_ULSHIFT) | j;
14526                         j++;
14527                         w >>= 1;
14528 
14529                         if (rid < SFMMU_MAX_HME_REGIONS) {
14530                                 rgnp = srdp->srd_hmergnp[rid];
14531                                 ASSERT(rgnp->rgn_id == rid);
14532                                 ASSERT(rgnp->rgn_refcnt > 0);
14533 
14534                                 if (rgnp->rgn_pgszc < TTE4M) {
14535                                         tte8k_cnt += rgnp->rgn_size >>
14536                                             TTE_PAGE_SHIFT(TTE8K);
14537                                 } else {
14538                                         ASSERT(rgnp->rgn_pgszc >= TTE4M);
14539                                         tte4m_cnt += rgnp->rgn_size >>
14540                                             TTE_PAGE_SHIFT(TTE4M);
14541                                         /*
14542                                          * Inflate SCD tsb0 by preallocating
14543                                          * 1/4 8k ttecnt for 4M regions to
14544                                          * allow for lgpg alloc failure.
14545                                          */
14546                                         tte8k_cnt += rgnp->rgn_size >>
14547                                             (TTE_PAGE_SHIFT(TTE8K) + 2);
14548                                 }
14549                         } else {
14550                                 rid -= SFMMU_MAX_HME_REGIONS;
14551                                 rgnp = srdp->srd_ismrgnp[rid];
14552                                 ASSERT(rgnp->rgn_id == rid);
14553                                 ASSERT(rgnp->rgn_refcnt > 0);
14554 
14555                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14556                                 ASSERT(ism_hatid->sfmmu_ismhat);
14557 
14558                                 for (szc = 0; szc < TTE4M; szc++) {
14559                                         tte8k_cnt +=
14560                                             ism_hatid->sfmmu_ttecnt[szc] <<
14561                                             TTE_BSZS_SHIFT(szc);
14562                                 }
14563 
14564                                 ASSERT(rgnp->rgn_pgszc >= TTE4M);
14565                                 if (rgnp->rgn_pgszc >= TTE4M) {
14566                                         tte4m_cnt += rgnp->rgn_size >>
14567                                             TTE_PAGE_SHIFT(TTE4M);
14568                                 }
14569                         }
14570                 }
14571         }
14572 
14573         tsb_szc = SELECT_TSB_SIZECODE(tte8k_cnt);
14574 
14575         /* Allocate both the SCD TSBs here. */
14576         if (sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14577             tsb_szc, TSB8K|TSB64K|TSB512K, TSB_ALLOC, scsfmmup) &&
14578             (tsb_szc <= TSB_4M_SZCODE ||
14579             sfmmu_tsbinfo_alloc(&scsfmmup->sfmmu_tsb,
14580             TSB_4M_SZCODE, TSB8K|TSB64K|TSB512K,
14581             TSB_ALLOC, scsfmmup))) {
14582 
14583                 SFMMU_STAT(sf_scd_1sttsb_allocfail);
14584                 return (TSB_ALLOCFAIL);
14585         } else {
14586                 scsfmmup->sfmmu_tsb->tsb_flags |= TSB_SHAREDCTX;
14587 
14588                 if (tte4m_cnt) {
14589                         tsb_szc = SELECT_TSB_SIZECODE(tte4m_cnt);
14590                         if (sfmmu_tsbinfo_alloc(&newtsb, tsb_szc,
14591                             TSB4M|TSB32M|TSB256M, TSB_ALLOC, scsfmmup) &&
14592                             (tsb_szc <= TSB_4M_SZCODE ||
14593                             sfmmu_tsbinfo_alloc(&newtsb, TSB_4M_SZCODE,
14594                             TSB4M|TSB32M|TSB256M,
14595                             TSB_ALLOC, scsfmmup))) {
14596                                 /*
14597                                  * If we fail to allocate the 2nd shared tsb,
14598                                  * just free the 1st tsb, return failure.
14599                                  */
14600                                 sfmmu_tsbinfo_free(scsfmmup->sfmmu_tsb);
14601                                 SFMMU_STAT(sf_scd_2ndtsb_allocfail);
14602                                 return (TSB_ALLOCFAIL);
14603                         } else {
14604                                 ASSERT(scsfmmup->sfmmu_tsb->tsb_next == NULL);
14605                                 newtsb->tsb_flags |= TSB_SHAREDCTX;
14606                                 scsfmmup->sfmmu_tsb->tsb_next = newtsb;
14607                                 SFMMU_STAT(sf_scd_2ndtsb_alloc);
14608                         }
14609                 }
14610                 SFMMU_STAT(sf_scd_1sttsb_alloc);
14611         }
14612         return (TSB_SUCCESS);
14613 }
14614 
14615 static void
14616 sfmmu_free_scd_tsbs(sfmmu_t *scd_sfmmu)
14617 {
14618         while (scd_sfmmu->sfmmu_tsb != NULL) {
14619                 struct tsb_info *next = scd_sfmmu->sfmmu_tsb->tsb_next;
14620                 sfmmu_tsbinfo_free(scd_sfmmu->sfmmu_tsb);
14621                 scd_sfmmu->sfmmu_tsb = next;
14622         }
14623 }
14624 
14625 /*
14626  * Link the sfmmu onto the hme region list.
14627  */
14628 void
14629 sfmmu_link_to_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14630 {
14631         uint_t rid;
14632         sf_rgn_link_t *rlink;
14633         sfmmu_t *head;
14634         sf_rgn_link_t *hrlink;
14635 
14636         rid = rgnp->rgn_id;
14637         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14638 
14639         /* LINTED: constant in conditional context */
14640         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 1, 1);
14641         ASSERT(rlink != NULL);
14642         mutex_enter(&rgnp->rgn_mutex);
14643         if ((head = rgnp->rgn_sfmmu_head) == NULL) {
14644                 rlink->next = NULL;
14645                 rlink->prev = NULL;
14646                 /*
14647                  * make sure rlink's next field is NULL
14648                  * before making this link visible.
14649                  */
14650                 membar_stst();
14651                 rgnp->rgn_sfmmu_head = sfmmup;
14652         } else {
14653                 /* LINTED: constant in conditional context */
14654                 SFMMU_HMERID2RLINKP(head, rid, hrlink, 0, 0);
14655                 ASSERT(hrlink != NULL);
14656                 ASSERT(hrlink->prev == NULL);
14657                 rlink->next = head;
14658                 rlink->prev = NULL;
14659                 hrlink->prev = sfmmup;
14660                 /*
14661                  * make sure rlink's next field is correct
14662                  * before making this link visible.
14663                  */
14664                 membar_stst();
14665                 rgnp->rgn_sfmmu_head = sfmmup;
14666         }
14667         mutex_exit(&rgnp->rgn_mutex);
14668 }
14669 
14670 /*
14671  * Unlink the sfmmu from the hme region list.
14672  */
14673 void
14674 sfmmu_unlink_from_hmeregion(sfmmu_t *sfmmup, sf_region_t *rgnp)
14675 {
14676         uint_t rid;
14677         sf_rgn_link_t *rlink;
14678 
14679         rid = rgnp->rgn_id;
14680         ASSERT(SFMMU_IS_SHMERID_VALID(rid));
14681 
14682         /* LINTED: constant in conditional context */
14683         SFMMU_HMERID2RLINKP(sfmmup, rid, rlink, 0, 0);
14684         ASSERT(rlink != NULL);
14685         mutex_enter(&rgnp->rgn_mutex);
14686         if (rgnp->rgn_sfmmu_head == sfmmup) {
14687                 sfmmu_t *next = rlink->next;
14688                 rgnp->rgn_sfmmu_head = next;
14689                 /*
14690                  * if we are stopped by xc_attention() after this
14691                  * point the forward link walking in
14692                  * sfmmu_rgntlb_demap() will work correctly since the
14693                  * head correctly points to the next element.
14694                  */
14695                 membar_stst();
14696                 rlink->next = NULL;
14697                 ASSERT(rlink->prev == NULL);
14698                 if (next != NULL) {
14699                         sf_rgn_link_t *nrlink;
14700                         /* LINTED: constant in conditional context */
14701                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14702                         ASSERT(nrlink != NULL);
14703                         ASSERT(nrlink->prev == sfmmup);
14704                         nrlink->prev = NULL;
14705                 }
14706         } else {
14707                 sfmmu_t *next = rlink->next;
14708                 sfmmu_t *prev = rlink->prev;
14709                 sf_rgn_link_t *prlink;
14710 
14711                 ASSERT(prev != NULL);
14712                 /* LINTED: constant in conditional context */
14713                 SFMMU_HMERID2RLINKP(prev, rid, prlink, 0, 0);
14714                 ASSERT(prlink != NULL);
14715                 ASSERT(prlink->next == sfmmup);
14716                 prlink->next = next;
14717                 /*
14718                  * if we are stopped by xc_attention()
14719                  * after this point the forward link walking
14720                  * will work correctly since the prev element
14721                  * correctly points to the next element.
14722                  */
14723                 membar_stst();
14724                 rlink->next = NULL;
14725                 rlink->prev = NULL;
14726                 if (next != NULL) {
14727                         sf_rgn_link_t *nrlink;
14728                         /* LINTED: constant in conditional context */
14729                         SFMMU_HMERID2RLINKP(next, rid, nrlink, 0, 0);
14730                         ASSERT(nrlink != NULL);
14731                         ASSERT(nrlink->prev == sfmmup);
14732                         nrlink->prev = prev;
14733                 }
14734         }
14735         mutex_exit(&rgnp->rgn_mutex);
14736 }
14737 
14738 /*
14739  * Link scd sfmmu onto ism or hme region list for each region in the
14740  * scd region map.
14741  */
14742 void
14743 sfmmu_link_scd_to_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14744 {
14745         uint_t rid;
14746         uint_t i;
14747         uint_t j;
14748         ulong_t w;
14749         sf_region_t *rgnp;
14750         sfmmu_t *scsfmmup;
14751 
14752         scsfmmup = scdp->scd_sfmmup;
14753         ASSERT(scsfmmup->sfmmu_scdhat);
14754         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14755                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14756                         continue;
14757                 }
14758                 j = 0;
14759                 while (w) {
14760                         if (!(w & 0x1)) {
14761                                 j++;
14762                                 w >>= 1;
14763                                 continue;
14764                         }
14765                         rid = (i << BT_ULSHIFT) | j;
14766                         j++;
14767                         w >>= 1;
14768 
14769                         if (rid < SFMMU_MAX_HME_REGIONS) {
14770                                 rgnp = srdp->srd_hmergnp[rid];
14771                                 ASSERT(rgnp->rgn_id == rid);
14772                                 ASSERT(rgnp->rgn_refcnt > 0);
14773                                 sfmmu_link_to_hmeregion(scsfmmup, rgnp);
14774                         } else {
14775                                 sfmmu_t *ism_hatid = NULL;
14776                                 ism_ment_t *ism_ment;
14777                                 rid -= SFMMU_MAX_HME_REGIONS;
14778                                 rgnp = srdp->srd_ismrgnp[rid];
14779                                 ASSERT(rgnp->rgn_id == rid);
14780                                 ASSERT(rgnp->rgn_refcnt > 0);
14781 
14782                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14783                                 ASSERT(ism_hatid->sfmmu_ismhat);
14784                                 ism_ment = &scdp->scd_ism_links[rid];
14785                                 ism_ment->iment_hat = scsfmmup;
14786                                 ism_ment->iment_base_va = rgnp->rgn_saddr;
14787                                 mutex_enter(&ism_mlist_lock);
14788                                 iment_add(ism_ment, ism_hatid);
14789                                 mutex_exit(&ism_mlist_lock);
14790 
14791                         }
14792                 }
14793         }
14794 }
14795 /*
14796  * Unlink scd sfmmu from ism or hme region list for each region in the
14797  * scd region map.
14798  */
14799 void
14800 sfmmu_unlink_scd_from_regions(sf_srd_t *srdp, sf_scd_t *scdp)
14801 {
14802         uint_t rid;
14803         uint_t i;
14804         uint_t j;
14805         ulong_t w;
14806         sf_region_t *rgnp;
14807         sfmmu_t *scsfmmup;
14808 
14809         scsfmmup = scdp->scd_sfmmup;
14810         for (i = 0; i < SFMMU_RGNMAP_WORDS; i++) {
14811                 if ((w = scdp->scd_region_map.bitmap[i]) == 0) {
14812                         continue;
14813                 }
14814                 j = 0;
14815                 while (w) {
14816                         if (!(w & 0x1)) {
14817                                 j++;
14818                                 w >>= 1;
14819                                 continue;
14820                         }
14821                         rid = (i << BT_ULSHIFT) | j;
14822                         j++;
14823                         w >>= 1;
14824 
14825                         if (rid < SFMMU_MAX_HME_REGIONS) {
14826                                 rgnp = srdp->srd_hmergnp[rid];
14827                                 ASSERT(rgnp->rgn_id == rid);
14828                                 ASSERT(rgnp->rgn_refcnt > 0);
14829                                 sfmmu_unlink_from_hmeregion(scsfmmup,
14830                                     rgnp);
14831 
14832                         } else {
14833                                 sfmmu_t *ism_hatid = NULL;
14834                                 ism_ment_t *ism_ment;
14835                                 rid -= SFMMU_MAX_HME_REGIONS;
14836                                 rgnp = srdp->srd_ismrgnp[rid];
14837                                 ASSERT(rgnp->rgn_id == rid);
14838                                 ASSERT(rgnp->rgn_refcnt > 0);
14839 
14840                                 ism_hatid = (sfmmu_t *)rgnp->rgn_obj;
14841                                 ASSERT(ism_hatid->sfmmu_ismhat);
14842                                 ism_ment = &scdp->scd_ism_links[rid];
14843                                 ASSERT(ism_ment->iment_hat == scdp->scd_sfmmup);
14844                                 ASSERT(ism_ment->iment_base_va ==
14845                                     rgnp->rgn_saddr);
14846                                 mutex_enter(&ism_mlist_lock);
14847                                 iment_sub(ism_ment, ism_hatid);
14848                                 mutex_exit(&ism_mlist_lock);
14849 
14850                         }
14851                 }
14852         }
14853 }
14854 /*
14855  * Allocates and initialises a new SCD structure, this is called with
14856  * the srd_scd_mutex held and returns with the reference count
14857  * initialised to 1.
14858  */
14859 static sf_scd_t *
14860 sfmmu_alloc_scd(sf_srd_t *srdp, sf_region_map_t *new_map)
14861 {
14862         sf_scd_t *new_scdp;
14863         sfmmu_t *scsfmmup;
14864         int i;
14865 
14866         ASSERT(MUTEX_HELD(&srdp->srd_scd_mutex));
14867         new_scdp = kmem_cache_alloc(scd_cache, KM_SLEEP);
14868 
14869         scsfmmup = kmem_cache_alloc(sfmmuid_cache, KM_SLEEP);
14870         new_scdp->scd_sfmmup = scsfmmup;
14871         scsfmmup->sfmmu_srdp = srdp;
14872         scsfmmup->sfmmu_scdp = new_scdp;
14873         scsfmmup->sfmmu_tsb0_4minflcnt = 0;
14874         scsfmmup->sfmmu_scdhat = 1;
14875         CPUSET_ALL(scsfmmup->sfmmu_cpusran);
14876         bzero(scsfmmup->sfmmu_hmeregion_links, SFMMU_L1_HMERLINKS_SIZE);
14877 
14878         ASSERT(max_mmu_ctxdoms > 0);
14879         for (i = 0; i < max_mmu_ctxdoms; i++) {
14880                 scsfmmup->sfmmu_ctxs[i].cnum = INVALID_CONTEXT;
14881                 scsfmmup->sfmmu_ctxs[i].gnum = 0;
14882         }
14883 
14884         for (i = 0; i < MMU_PAGE_SIZES; i++) {
14885                 new_scdp->scd_rttecnt[i] = 0;
14886         }
14887 
14888         new_scdp->scd_region_map = *new_map;
14889         new_scdp->scd_refcnt = 1;
14890         if (sfmmu_alloc_scd_tsbs(srdp, new_scdp) != TSB_SUCCESS) {
14891                 kmem_cache_free(scd_cache, new_scdp);
14892                 kmem_cache_free(sfmmuid_cache, scsfmmup);
14893                 return (NULL);
14894         }
14895         if (&mmu_init_scd) {
14896                 mmu_init_scd(new_scdp);
14897         }
14898         return (new_scdp);
14899 }
14900 
14901 /*
14902  * The first phase of a process joining an SCD. The hat structure is
14903  * linked to the SCD queue and then the HAT_JOIN_SCD sfmmu flag is set
14904  * and a cross-call with context invalidation is used to cause the
14905  * remaining work to be carried out in the sfmmu_tsbmiss_exception()
14906  * routine.
14907  */
14908 static void
14909 sfmmu_join_scd(sf_scd_t *scdp, sfmmu_t *sfmmup)
14910 {
14911         hatlock_t *hatlockp;
14912         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
14913         int i;
14914         sf_scd_t *old_scdp;
14915 
14916         ASSERT(srdp != NULL);
14917         ASSERT(scdp != NULL);
14918         ASSERT(scdp->scd_refcnt > 0);
14919         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
14920 
14921         if ((old_scdp = sfmmup->sfmmu_scdp) != NULL) {
14922                 ASSERT(old_scdp != scdp);
14923 
14924                 mutex_enter(&old_scdp->scd_mutex);
14925                 sfmmu_from_scd_list(&old_scdp->scd_sf_list, sfmmup);
14926                 mutex_exit(&old_scdp->scd_mutex);
14927                 /*
14928                  * sfmmup leaves the old scd. Update sfmmu_ttecnt to
14929                  * include the shme rgn ttecnt for rgns that
14930                  * were in the old SCD
14931                  */
14932                 for (i = 0; i < mmu_page_sizes; i++) {
14933                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
14934                             old_scdp->scd_rttecnt[i]);
14935                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14936                             sfmmup->sfmmu_scdrttecnt[i]);
14937                 }
14938         }
14939 
14940         /*
14941          * Move sfmmu to the scd lists.
14942          */
14943         mutex_enter(&scdp->scd_mutex);
14944         sfmmu_to_scd_list(&scdp->scd_sf_list, sfmmup);
14945         mutex_exit(&scdp->scd_mutex);
14946         SF_SCD_INCR_REF(scdp);
14947 
14948         hatlockp = sfmmu_hat_enter(sfmmup);
14949         /*
14950          * For a multi-thread process, we must stop
14951          * all the other threads before joining the scd.
14952          */
14953 
14954         SFMMU_FLAGS_SET(sfmmup, HAT_JOIN_SCD);
14955 
14956         sfmmu_invalidate_ctx(sfmmup);
14957         sfmmup->sfmmu_scdp = scdp;
14958 
14959         /*
14960          * Copy scd_rttecnt into sfmmup's sfmmu_scdrttecnt, and update
14961          * sfmmu_ttecnt to not include the rgn ttecnt just joined in SCD.
14962          */
14963         for (i = 0; i < mmu_page_sizes; i++) {
14964                 sfmmup->sfmmu_scdrttecnt[i] = scdp->scd_rttecnt[i];
14965                 ASSERT(sfmmup->sfmmu_ttecnt[i] >= scdp->scd_rttecnt[i]);
14966                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
14967                     -sfmmup->sfmmu_scdrttecnt[i]);
14968         }
14969         /* update tsb0 inflation count */
14970         if (old_scdp != NULL) {
14971                 sfmmup->sfmmu_tsb0_4minflcnt +=
14972                     old_scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14973         }
14974         ASSERT(sfmmup->sfmmu_tsb0_4minflcnt >=
14975             scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt);
14976         sfmmup->sfmmu_tsb0_4minflcnt -= scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
14977 
14978         sfmmu_hat_exit(hatlockp);
14979 
14980         if (old_scdp != NULL) {
14981                 SF_SCD_DECR_REF(srdp, old_scdp);
14982         }
14983 
14984 }
14985 
14986 /*
14987  * This routine is called by a process to become part of an SCD. It is called
14988  * from sfmmu_tsbmiss_exception() once most of the initial work has been
14989  * done by sfmmu_join_scd(). This routine must not drop the hat lock.
14990  */
14991 static void
14992 sfmmu_finish_join_scd(sfmmu_t *sfmmup)
14993 {
14994         struct tsb_info *tsbinfop;
14995 
14996         ASSERT(sfmmu_hat_lock_held(sfmmup));
14997         ASSERT(sfmmup->sfmmu_scdp != NULL);
14998         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD));
14999         ASSERT(!SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15000         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ALLCTX_INVALID));
15001 
15002         for (tsbinfop = sfmmup->sfmmu_tsb; tsbinfop != NULL;
15003             tsbinfop = tsbinfop->tsb_next) {
15004                 if (tsbinfop->tsb_flags & TSB_SWAPPED) {
15005                         continue;
15006                 }
15007                 ASSERT(!(tsbinfop->tsb_flags & TSB_RELOC_FLAG));
15008 
15009                 sfmmu_inv_tsb(tsbinfop->tsb_va,
15010                     TSB_BYTES(tsbinfop->tsb_szc));
15011         }
15012 
15013         /* Set HAT_CTX1_FLAG for all SCD ISMs */
15014         sfmmu_ism_hatflags(sfmmup, 1);
15015 
15016         SFMMU_STAT(sf_join_scd);
15017 }
15018 
15019 /*
15020  * This routine is called in order to check if there is an SCD which matches
15021  * the process's region map if not then a new SCD may be created.
15022  */
15023 static void
15024 sfmmu_find_scd(sfmmu_t *sfmmup)
15025 {
15026         sf_srd_t *srdp = sfmmup->sfmmu_srdp;
15027         sf_scd_t *scdp, *new_scdp;
15028         int ret;
15029 
15030         ASSERT(srdp != NULL);
15031         ASSERT(AS_WRITE_HELD(sfmmup->sfmmu_as));
15032 
15033         mutex_enter(&srdp->srd_scd_mutex);
15034         for (scdp = srdp->srd_scdp; scdp != NULL;
15035             scdp = scdp->scd_next) {
15036                 SF_RGNMAP_EQUAL(&scdp->scd_region_map,
15037                     &sfmmup->sfmmu_region_map, ret);
15038                 if (ret == 1) {
15039                         SF_SCD_INCR_REF(scdp);
15040                         mutex_exit(&srdp->srd_scd_mutex);
15041                         sfmmu_join_scd(scdp, sfmmup);
15042                         ASSERT(scdp->scd_refcnt >= 2);
15043                         atomic_dec_32((volatile uint32_t *)&scdp->scd_refcnt);
15044                         return;
15045                 } else {
15046                         /*
15047                          * If the sfmmu region map is a subset of the scd
15048                          * region map, then the assumption is that this process
15049                          * will continue attaching to ISM segments until the
15050                          * region maps are equal.
15051                          */
15052                         SF_RGNMAP_IS_SUBSET(&scdp->scd_region_map,
15053                             &sfmmup->sfmmu_region_map, ret);
15054                         if (ret == 1) {
15055                                 mutex_exit(&srdp->srd_scd_mutex);
15056                                 return;
15057                         }
15058                 }
15059         }
15060 
15061         ASSERT(scdp == NULL);
15062         /*
15063          * No matching SCD has been found, create a new one.
15064          */
15065         if ((new_scdp = sfmmu_alloc_scd(srdp, &sfmmup->sfmmu_region_map)) ==
15066             NULL) {
15067                 mutex_exit(&srdp->srd_scd_mutex);
15068                 return;
15069         }
15070 
15071         /*
15072          * sfmmu_alloc_scd() returns with a ref count of 1 on the scd.
15073          */
15074 
15075         /* Set scd_rttecnt for shme rgns in SCD */
15076         sfmmu_set_scd_rttecnt(srdp, new_scdp);
15077 
15078         /*
15079          * Link scd onto srd_scdp list and scd sfmmu onto region/iment lists.
15080          */
15081         sfmmu_link_scd_to_regions(srdp, new_scdp);
15082         sfmmu_add_scd(&srdp->srd_scdp, new_scdp);
15083         SFMMU_STAT_ADD(sf_create_scd, 1);
15084 
15085         mutex_exit(&srdp->srd_scd_mutex);
15086         sfmmu_join_scd(new_scdp, sfmmup);
15087         ASSERT(new_scdp->scd_refcnt >= 2);
15088         atomic_dec_32((volatile uint32_t *)&new_scdp->scd_refcnt);
15089 }
15090 
15091 /*
15092  * This routine is called by a process to remove itself from an SCD. It is
15093  * either called when the processes has detached from a segment or from
15094  * hat_free_start() as a result of calling exit.
15095  */
15096 static void
15097 sfmmu_leave_scd(sfmmu_t *sfmmup, uchar_t r_type)
15098 {
15099         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15100         sf_srd_t *srdp =  sfmmup->sfmmu_srdp;
15101         hatlock_t *hatlockp = TSB_HASH(sfmmup);
15102         int i;
15103 
15104         ASSERT(scdp != NULL);
15105         ASSERT(srdp != NULL);
15106 
15107         if (sfmmup->sfmmu_free) {
15108                 /*
15109                  * If the process is part of an SCD the sfmmu is unlinked
15110                  * from scd_sf_list.
15111                  */
15112                 mutex_enter(&scdp->scd_mutex);
15113                 sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15114                 mutex_exit(&scdp->scd_mutex);
15115                 /*
15116                  * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15117                  * are about to leave the SCD
15118                  */
15119                 for (i = 0; i < mmu_page_sizes; i++) {
15120                         ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15121                             scdp->scd_rttecnt[i]);
15122                         atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15123                             sfmmup->sfmmu_scdrttecnt[i]);
15124                         sfmmup->sfmmu_scdrttecnt[i] = 0;
15125                 }
15126                 sfmmup->sfmmu_scdp = NULL;
15127 
15128                 SF_SCD_DECR_REF(srdp, scdp);
15129                 return;
15130         }
15131 
15132         ASSERT(r_type != SFMMU_REGION_ISM ||
15133             SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15134         ASSERT(scdp->scd_refcnt);
15135         ASSERT(!sfmmup->sfmmu_free);
15136         ASSERT(sfmmu_hat_lock_held(sfmmup));
15137         ASSERT(AS_LOCK_HELD(sfmmup->sfmmu_as));
15138 
15139         /*
15140          * Wait for ISM maps to be updated.
15141          */
15142         if (r_type != SFMMU_REGION_ISM) {
15143                 while (SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY) &&
15144                     sfmmup->sfmmu_scdp != NULL) {
15145                         cv_wait(&sfmmup->sfmmu_tsb_cv,
15146                             HATLOCK_MUTEXP(hatlockp));
15147                 }
15148 
15149                 if (sfmmup->sfmmu_scdp == NULL) {
15150                         sfmmu_hat_exit(hatlockp);
15151                         return;
15152                 }
15153                 SFMMU_FLAGS_SET(sfmmup, HAT_ISMBUSY);
15154         }
15155 
15156         if (SFMMU_FLAGS_ISSET(sfmmup, HAT_JOIN_SCD)) {
15157                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_JOIN_SCD);
15158                 /*
15159                  * Since HAT_JOIN_SCD was set our context
15160                  * is still invalid.
15161                  */
15162         } else {
15163                 /*
15164                  * For a multi-thread process, we must stop
15165                  * all the other threads before leaving the scd.
15166                  */
15167 
15168                 sfmmu_invalidate_ctx(sfmmup);
15169         }
15170 
15171         /* Clear all the rid's for ISM, delete flags, etc */
15172         ASSERT(SFMMU_FLAGS_ISSET(sfmmup, HAT_ISMBUSY));
15173         sfmmu_ism_hatflags(sfmmup, 0);
15174 
15175         /*
15176          * Update sfmmu_ttecnt to include the rgn ttecnt for rgns that
15177          * are in SCD before this sfmmup leaves the SCD.
15178          */
15179         for (i = 0; i < mmu_page_sizes; i++) {
15180                 ASSERT(sfmmup->sfmmu_scdrttecnt[i] ==
15181                     scdp->scd_rttecnt[i]);
15182                 atomic_add_long(&sfmmup->sfmmu_ttecnt[i],
15183                     sfmmup->sfmmu_scdrttecnt[i]);
15184                 sfmmup->sfmmu_scdrttecnt[i] = 0;
15185                 /* update ismttecnt to include SCD ism before hat leaves SCD */
15186                 sfmmup->sfmmu_ismttecnt[i] += sfmmup->sfmmu_scdismttecnt[i];
15187                 sfmmup->sfmmu_scdismttecnt[i] = 0;
15188         }
15189         /* update tsb0 inflation count */
15190         sfmmup->sfmmu_tsb0_4minflcnt += scdp->scd_sfmmup->sfmmu_tsb0_4minflcnt;
15191 
15192         if (r_type != SFMMU_REGION_ISM) {
15193                 SFMMU_FLAGS_CLEAR(sfmmup, HAT_ISMBUSY);
15194         }
15195         sfmmup->sfmmu_scdp = NULL;
15196 
15197         sfmmu_hat_exit(hatlockp);
15198 
15199         /*
15200          * Unlink sfmmu from scd_sf_list this can be done without holding
15201          * the hat lock as we hold the sfmmu_as lock which prevents
15202          * hat_join_region from adding this thread to the scd again. Other
15203          * threads check if sfmmu_scdp is NULL under hat lock and if it's NULL
15204          * they won't get here, since sfmmu_leave_scd() clears sfmmu_scdp
15205          * while holding the hat lock.
15206          */
15207         mutex_enter(&scdp->scd_mutex);
15208         sfmmu_from_scd_list(&scdp->scd_sf_list, sfmmup);
15209         mutex_exit(&scdp->scd_mutex);
15210         SFMMU_STAT(sf_leave_scd);
15211 
15212         SF_SCD_DECR_REF(srdp, scdp);
15213         hatlockp = sfmmu_hat_enter(sfmmup);
15214 
15215 }
15216 
15217 /*
15218  * Unlink and free up an SCD structure with a reference count of 0.
15219  */
15220 static void
15221 sfmmu_destroy_scd(sf_srd_t *srdp, sf_scd_t *scdp, sf_region_map_t *scd_rmap)
15222 {
15223         sfmmu_t *scsfmmup;
15224         sf_scd_t *sp;
15225         hatlock_t *shatlockp;
15226         int i, ret;
15227 
15228         mutex_enter(&srdp->srd_scd_mutex);
15229         for (sp = srdp->srd_scdp; sp != NULL; sp = sp->scd_next) {
15230                 if (sp == scdp)
15231                         break;
15232         }
15233         if (sp == NULL || sp->scd_refcnt) {
15234                 mutex_exit(&srdp->srd_scd_mutex);
15235                 return;
15236         }
15237 
15238         /*
15239          * It is possible that the scd has been freed and reallocated with a
15240          * different region map while we've been waiting for the srd_scd_mutex.
15241          */
15242         SF_RGNMAP_EQUAL(scd_rmap, &sp->scd_region_map, ret);
15243         if (ret != 1) {
15244                 mutex_exit(&srdp->srd_scd_mutex);
15245                 return;
15246         }
15247 
15248         ASSERT(scdp->scd_sf_list == NULL);
15249         /*
15250          * Unlink scd from srd_scdp list.
15251          */
15252         sfmmu_remove_scd(&srdp->srd_scdp, scdp);
15253         mutex_exit(&srdp->srd_scd_mutex);
15254 
15255         sfmmu_unlink_scd_from_regions(srdp, scdp);
15256 
15257         /* Clear shared context tsb and release ctx */
15258         scsfmmup = scdp->scd_sfmmup;
15259 
15260         /*
15261          * create a barrier so that scd will not be destroyed
15262          * if other thread still holds the same shared hat lock.
15263          * E.g., sfmmu_tsbmiss_exception() needs to acquire the
15264          * shared hat lock before checking the shared tsb reloc flag.
15265          */
15266         shatlockp = sfmmu_hat_enter(scsfmmup);
15267         sfmmu_hat_exit(shatlockp);
15268 
15269         sfmmu_free_scd_tsbs(scsfmmup);
15270 
15271         for (i = 0; i < SFMMU_L1_HMERLINKS; i++) {
15272                 if (scsfmmup->sfmmu_hmeregion_links[i] != NULL) {
15273                         kmem_free(scsfmmup->sfmmu_hmeregion_links[i],
15274                             SFMMU_L2_HMERLINKS_SIZE);
15275                         scsfmmup->sfmmu_hmeregion_links[i] = NULL;
15276                 }
15277         }
15278         kmem_cache_free(sfmmuid_cache, scsfmmup);
15279         kmem_cache_free(scd_cache, scdp);
15280         SFMMU_STAT(sf_destroy_scd);
15281 }
15282 
15283 /*
15284  * Modifies the HAT_CTX1_FLAG for each of the ISM segments which correspond to
15285  * bits which are set in the ism_region_map parameter. This flag indicates to
15286  * the tsbmiss handler that mapping for these segments should be loaded using
15287  * the shared context.
15288  */
15289 static void
15290 sfmmu_ism_hatflags(sfmmu_t *sfmmup, int addflag)
15291 {
15292         sf_scd_t *scdp = sfmmup->sfmmu_scdp;
15293         ism_blk_t *ism_blkp;
15294         ism_map_t *ism_map;
15295         int i, rid;
15296 
15297         ASSERT(sfmmup->sfmmu_iblk != NULL);
15298         ASSERT(scdp != NULL);
15299         /*
15300          * Note that the caller either set HAT_ISMBUSY flag or checked
15301          * under hat lock that HAT_ISMBUSY was not set by another thread.
15302          */
15303         ASSERT(sfmmu_hat_lock_held(sfmmup));
15304 
15305         ism_blkp = sfmmup->sfmmu_iblk;
15306         while (ism_blkp != NULL) {
15307                 ism_map = ism_blkp->iblk_maps;
15308                 for (i = 0; ism_map[i].imap_ismhat && i < ISM_MAP_SLOTS; i++) {
15309                         rid = ism_map[i].imap_rid;
15310                         if (rid == SFMMU_INVALID_ISMRID) {
15311                                 continue;
15312                         }
15313                         ASSERT(rid >= 0 && rid < SFMMU_MAX_ISM_REGIONS);
15314                         if (SF_RGNMAP_TEST(scdp->scd_ismregion_map, rid) &&
15315                             addflag) {
15316                                 ism_map[i].imap_hatflags |=
15317                                     HAT_CTX1_FLAG;
15318                         } else {
15319                                 ism_map[i].imap_hatflags &=
15320                                     ~HAT_CTX1_FLAG;
15321                         }
15322                 }
15323                 ism_blkp = ism_blkp->iblk_next;
15324         }
15325 }
15326 
15327 static int
15328 sfmmu_srd_lock_held(sf_srd_t *srdp)
15329 {
15330         return (MUTEX_HELD(&srdp->srd_mutex));
15331 }
15332 
15333 /* ARGSUSED */
15334 static int
15335 sfmmu_scdcache_constructor(void *buf, void *cdrarg, int kmflags)
15336 {
15337         sf_scd_t *scdp = (sf_scd_t *)buf;
15338 
15339         bzero(buf, sizeof (sf_scd_t));
15340         mutex_init(&scdp->scd_mutex, NULL, MUTEX_DEFAULT, NULL);
15341         return (0);
15342 }
15343 
15344 /* ARGSUSED */
15345 static void
15346 sfmmu_scdcache_destructor(void *buf, void *cdrarg)
15347 {
15348         sf_scd_t *scdp = (sf_scd_t *)buf;
15349 
15350         mutex_destroy(&scdp->scd_mutex);
15351 }
15352 
15353 /*
15354  * The listp parameter is a pointer to a list of hmeblks which are partially
15355  * freed as result of calling sfmmu_hblk_hash_rm(), the last phase of the
15356  * freeing process is to cross-call all cpus to ensure that there are no
15357  * remaining cached references.
15358  *
15359  * If the local generation number is less than the global then we can free
15360  * hmeblks which are already on the pending queue as another cpu has completed
15361  * the cross-call.
15362  *
15363  * We cross-call to make sure that there are no threads on other cpus accessing
15364  * these hmblks and then complete the process of freeing them under the
15365  * following conditions:
15366  *      The total number of pending hmeblks is greater than the threshold
15367  *      The reserve list has fewer than HBLK_RESERVE_CNT hmeblks
15368  *      It is at least 1 second since the last time we cross-called
15369  *
15370  * Otherwise, we add the hmeblks to the per-cpu pending queue.
15371  */
15372 static void
15373 sfmmu_hblks_list_purge(struct hme_blk **listp, int dontfree)
15374 {
15375         struct hme_blk *hblkp, *pr_hblkp = NULL;
15376         int             count = 0;
15377         cpuset_t        cpuset = cpu_ready_set;
15378         cpu_hme_pend_t  *cpuhp;
15379         timestruc_t     now;
15380         int             one_second_expired = 0;
15381 
15382         gethrestime_lasttick(&now);
15383 
15384         for (hblkp = *listp; hblkp != NULL; hblkp = hblkp->hblk_next) {
15385                 ASSERT(hblkp->hblk_shw_bit == 0);
15386                 ASSERT(hblkp->hblk_shared == 0);
15387                 count++;
15388                 pr_hblkp = hblkp;
15389         }
15390 
15391         cpuhp = &cpu_hme_pend[CPU->cpu_seqid];
15392         mutex_enter(&cpuhp->chp_mutex);
15393 
15394         if ((cpuhp->chp_count + count) == 0) {
15395                 mutex_exit(&cpuhp->chp_mutex);
15396                 return;
15397         }
15398 
15399         if ((now.tv_sec - cpuhp->chp_timestamp) > 1) {
15400                 one_second_expired  = 1;
15401         }
15402 
15403         if (!dontfree && (freehblkcnt < HBLK_RESERVE_CNT ||
15404             (cpuhp->chp_count + count) > cpu_hme_pend_thresh ||
15405             one_second_expired)) {
15406                 /* Append global list to local */
15407                 if (pr_hblkp == NULL) {
15408                         *listp = cpuhp->chp_listp;
15409                 } else {
15410                         pr_hblkp->hblk_next = cpuhp->chp_listp;
15411                 }
15412                 cpuhp->chp_listp = NULL;
15413                 cpuhp->chp_count = 0;
15414                 cpuhp->chp_timestamp = now.tv_sec;
15415                 mutex_exit(&cpuhp->chp_mutex);
15416 
15417                 kpreempt_disable();
15418                 CPUSET_DEL(cpuset, CPU->cpu_id);
15419                 xt_sync(cpuset);
15420                 xt_sync(cpuset);
15421                 kpreempt_enable();
15422 
15423                 /*
15424                  * At this stage we know that no trap handlers on other
15425                  * cpus can have references to hmeblks on the list.
15426                  */
15427                 sfmmu_hblk_free(listp);
15428         } else if (*listp != NULL) {
15429                 pr_hblkp->hblk_next = cpuhp->chp_listp;
15430                 cpuhp->chp_listp = *listp;
15431                 cpuhp->chp_count += count;
15432                 *listp = NULL;
15433                 mutex_exit(&cpuhp->chp_mutex);
15434         } else {
15435                 mutex_exit(&cpuhp->chp_mutex);
15436         }
15437 }
15438 
15439 /*
15440  * Add an hmeblk to the the hash list.
15441  */
15442 void
15443 sfmmu_hblk_hash_add(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15444     uint64_t hblkpa)
15445 {
15446         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15447 #ifdef  DEBUG
15448         if (hmebp->hmeblkp == NULL) {
15449                 ASSERT(hmebp->hmeh_nextpa == HMEBLK_ENDPA);
15450         }
15451 #endif /* DEBUG */
15452 
15453         hmeblkp->hblk_nextpa = hmebp->hmeh_nextpa;
15454         /*
15455          * Since the TSB miss handler now does not lock the hash chain before
15456          * walking it, make sure that the hmeblks nextpa is globally visible
15457          * before we make the hmeblk globally visible by updating the chain root
15458          * pointer in the hash bucket.
15459          */
15460         membar_producer();
15461         hmebp->hmeh_nextpa = hblkpa;
15462         hmeblkp->hblk_next = hmebp->hmeblkp;
15463         hmebp->hmeblkp = hmeblkp;
15464 
15465 }
15466 
15467 /*
15468  * This function is the first part of a 2 part process to remove an hmeblk
15469  * from the hash chain. In this phase we unlink the hmeblk from the hash chain
15470  * but leave the next physical pointer unchanged. The hmeblk is then linked onto
15471  * a per-cpu pending list using the virtual address pointer.
15472  *
15473  * TSB miss trap handlers that start after this phase will no longer see
15474  * this hmeblk. TSB miss handlers that still cache this hmeblk in a register
15475  * can still use it for further chain traversal because we haven't yet modifed
15476  * the next physical pointer or freed it.
15477  *
15478  * In the second phase of hmeblk removal we'll issue a barrier xcall before
15479  * we reuse or free this hmeblk. This will make sure all lingering references to
15480  * the hmeblk after first phase disappear before we finally reclaim it.
15481  * This scheme eliminates the need for TSB miss handlers to lock hmeblk chains
15482  * during their traversal.
15483  *
15484  * The hmehash_mutex must be held when calling this function.
15485  *
15486  * Input:
15487  *       hmebp - hme hash bucket pointer
15488  *       hmeblkp - address of hmeblk to be removed
15489  *       pr_hblk - virtual address of previous hmeblkp
15490  *       listp - pointer to list of hmeblks linked by virtual address
15491  *       free_now flag - indicates that a complete removal from the hash chains
15492  *                       is necessary.
15493  *
15494  * It is inefficient to use the free_now flag as a cross-call is required to
15495  * remove a single hmeblk from the hash chain but is necessary when hmeblks are
15496  * in short supply.
15497  */
15498 void
15499 sfmmu_hblk_hash_rm(struct hmehash_bucket *hmebp, struct hme_blk *hmeblkp,
15500     struct hme_blk *pr_hblk, struct hme_blk **listp, int free_now)
15501 {
15502         int shw_size, vshift;
15503         struct hme_blk *shw_hblkp;
15504         uint_t          shw_mask, newshw_mask;
15505         caddr_t         vaddr;
15506         int             size;
15507         cpuset_t cpuset = cpu_ready_set;
15508 
15509         ASSERT(SFMMU_HASH_LOCK_ISHELD(hmebp));
15510 
15511         if (hmebp->hmeblkp == hmeblkp) {
15512                 hmebp->hmeh_nextpa = hmeblkp->hblk_nextpa;
15513                 hmebp->hmeblkp = hmeblkp->hblk_next;
15514         } else {
15515                 pr_hblk->hblk_nextpa = hmeblkp->hblk_nextpa;
15516                 pr_hblk->hblk_next = hmeblkp->hblk_next;
15517         }
15518 
15519         size = get_hblk_ttesz(hmeblkp);
15520         shw_hblkp = hmeblkp->hblk_shadow;
15521         if (shw_hblkp) {
15522                 ASSERT(hblktosfmmu(hmeblkp) != KHATID);
15523                 ASSERT(!hmeblkp->hblk_shared);
15524 #ifdef  DEBUG
15525                 if (mmu_page_sizes == max_mmu_page_sizes) {
15526                         ASSERT(size < TTE256M);
15527                 } else {
15528                         ASSERT(size < TTE4M);
15529                 }
15530 #endif /* DEBUG */
15531 
15532                 shw_size = get_hblk_ttesz(shw_hblkp);
15533                 vaddr = (caddr_t)get_hblk_base(hmeblkp);
15534                 vshift = vaddr_to_vshift(shw_hblkp->hblk_tag, vaddr, shw_size);
15535                 ASSERT(vshift < 8);
15536                 /*
15537                  * Atomically clear shadow mask bit
15538                  */
15539                 do {
15540                         shw_mask = shw_hblkp->hblk_shw_mask;
15541                         ASSERT(shw_mask & (1 << vshift));
15542                         newshw_mask = shw_mask & ~(1 << vshift);
15543                         newshw_mask = atomic_cas_32(&shw_hblkp->hblk_shw_mask,
15544                             shw_mask, newshw_mask);
15545                 } while (newshw_mask != shw_mask);
15546                 hmeblkp->hblk_shadow = NULL;
15547         }
15548         hmeblkp->hblk_shw_bit = 0;
15549 
15550         if (hmeblkp->hblk_shared) {
15551 #ifdef  DEBUG
15552                 sf_srd_t        *srdp;
15553                 sf_region_t     *rgnp;
15554                 uint_t          rid;
15555 
15556                 srdp = hblktosrd(hmeblkp);
15557                 ASSERT(srdp != NULL && srdp->srd_refcnt != 0);
15558                 rid = hmeblkp->hblk_tag.htag_rid;
15559                 ASSERT(SFMMU_IS_SHMERID_VALID(rid));
15560                 ASSERT(rid < SFMMU_MAX_HME_REGIONS);
15561                 rgnp = srdp->srd_hmergnp[rid];
15562                 ASSERT(rgnp != NULL);
15563                 SFMMU_VALIDATE_SHAREDHBLK(hmeblkp, srdp, rgnp, rid);
15564 #endif /* DEBUG */
15565                 hmeblkp->hblk_shared = 0;
15566         }
15567         if (free_now) {
15568                 kpreempt_disable();
15569                 CPUSET_DEL(cpuset, CPU->cpu_id);
15570                 xt_sync(cpuset);
15571                 xt_sync(cpuset);
15572                 kpreempt_enable();
15573 
15574                 hmeblkp->hblk_nextpa = HMEBLK_ENDPA;
15575                 hmeblkp->hblk_next = NULL;
15576         } else {
15577                 /* Append hmeblkp to listp for processing later. */
15578                 hmeblkp->hblk_next = *listp;
15579                 *listp = hmeblkp;
15580         }
15581 }
15582 
15583 /*
15584  * This routine is called when memory is in short supply and returns a free
15585  * hmeblk of the requested size from the cpu pending lists.
15586  */
15587 static struct hme_blk *
15588 sfmmu_check_pending_hblks(int size)
15589 {
15590         int i;
15591         struct hme_blk *hmeblkp = NULL, *last_hmeblkp;
15592         int found_hmeblk;
15593         cpuset_t cpuset = cpu_ready_set;
15594         cpu_hme_pend_t *cpuhp;
15595 
15596         /* Flush cpu hblk pending queues */
15597         for (i = 0; i < NCPU; i++) {
15598                 cpuhp = &cpu_hme_pend[i];
15599                 if (cpuhp->chp_listp != NULL)  {
15600                         mutex_enter(&cpuhp->chp_mutex);
15601                         if (cpuhp->chp_listp == NULL)  {
15602                                 mutex_exit(&cpuhp->chp_mutex);
15603                                 continue;
15604                         }
15605                         found_hmeblk = 0;
15606                         last_hmeblkp = NULL;
15607                         for (hmeblkp = cpuhp->chp_listp; hmeblkp != NULL;
15608                             hmeblkp = hmeblkp->hblk_next) {
15609                                 if (get_hblk_ttesz(hmeblkp) == size) {
15610                                         if (last_hmeblkp == NULL) {
15611                                                 cpuhp->chp_listp =
15612                                                     hmeblkp->hblk_next;
15613                                         } else {
15614                                                 last_hmeblkp->hblk_next =
15615                                                     hmeblkp->hblk_next;
15616                                         }
15617                                         ASSERT(cpuhp->chp_count > 0);
15618                                         cpuhp->chp_count--;
15619                                         found_hmeblk = 1;
15620                                         break;
15621                                 } else {
15622                                         last_hmeblkp = hmeblkp;
15623                                 }
15624                         }
15625                         mutex_exit(&cpuhp->chp_mutex);
15626 
15627                         if (found_hmeblk) {
15628                                 kpreempt_disable();
15629                                 CPUSET_DEL(cpuset, CPU->cpu_id);
15630                                 xt_sync(cpuset);
15631                                 xt_sync(cpuset);
15632                                 kpreempt_enable();
15633                                 return (hmeblkp);
15634                         }
15635                 }
15636         }
15637         return (NULL);
15638 }